Leveraging Membership Inference Attacks for Privacy Measurement in Federated Learning for Remote Sensing Images

TL;DR

The paper addresses privacy leakage in federated learning for remote sensing image classification by treating membership inference attacks (MIA) as a quantitative privacy measurement framework. It systematically evaluates black-box MIAs, including entropy-based attacks and LiRA, across standard FL algorithms (FedAvg, FedProx) and feature-based communication schemes, using two remote-sensing datasets. Experiments reveal that MIA leakage is not necessarily aligned with accuracy and show that communication-efficient FL can substantially reduce attack success while maintaining competitive performance. The study highlights FedFT, FedProxFT, and related strategies as favorable for privacy and advocates integrating MIA-based privacy assessment into FL design for remote sensing tasks.

Abstract

Federated Learning (FL) enables collaborative model training while keeping training data localized, allowing us to preserve privacy in various domains including remote sensing. However, recent studies show that FL models may still leak sensitive information through their outputs, motivating the need for rigorous privacy evaluation. In this paper, we leverage membership inference attacks (MIA) as a quantitative privacy measurement framework for FL applied to remote sensing image classification. We evaluate multiple black-box MIA techniques, including entropy-based attacks, modified entropy attacks, and the likelihood ratio attack, across different FL algorithms and communication strategies. Experiments conducted on two public scene classification datasets demonstrate that MIA effectively reveals privacy leakage not captured by accuracy alone. Our results show that communication-efficient FL strategies reduce MIA success rates while maintaining competitive performance. These findings confirm MIA as a practical metric and highlight the importance of integrating privacy measurement into FL system design for remote sensing applications.

Figures (2)

• Figure 1: Illustration of our experimental setup on the AID dataset.
• Figure 2: Comparison of various training approaches.