🤖 machine learning

Fed-Listing: Federated Label Distribution Inference in Graph Neural Networks

This paper introduces Fed-Listing, a novel gradient-based attack that effectively infers private label distribution statistics of clients in Federated Graph Neural Networks using only final-layer gradients, significantly outperforming existing baselines while remaining resilient to current defense mechanisms.

Original authors: Suprim Nakarmi, Junggab Son, Yue Zhao, Zuobin Xiong

Published 2026-05-08

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Suprim Nakarmi, Junggab Son, Yue Zhao, Zuobin Xiong

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of friends (the clients) who all have secret recipe books. They want to create one "Master Cookbook" together without ever showing their actual pages to each other or to the organizer (the server). This is how Federated Learning works: everyone learns locally and only sends back small notes about how they improved their recipes, not the recipes themselves.

In the world of Graph Neural Networks (GNNs), these "recipes" are actually complex networks of relationships, like social media friends or medical connections between patients.

The Problem: The "Whisper" in the Room

The paper argues that even though the friends aren't sharing their actual recipe pages, the "notes" they send back (called gradients) accidentally whisper secrets. Specifically, the server can listen to these whispers and figure out the statistical mix of the recipes in someone's book.

For example, if a hospital is part of this group, the server shouldn't know that "80% of the patients in this hospital have a specific rare disease." But this new attack, called Fed-Listing, claims the server can figure that out just by listening to the notes.

The Solution (The Attack): Fed-Listing

The authors created a tool called Fed-Listing (Federated Label Distribution Inference). Here is how it works, using a simple analogy:

1. The "Shadow Play" (Shadow Training)
Imagine the server is a detective. To catch the thief, the detective sets up a fake training camp (Shadow Training) using a pile of "dummy" recipe books (an auxiliary dataset) that look similar to the real ones.

The detective creates many different scenarios in this fake camp: some where everyone has the same mix of recipes, some where one person has only pizza recipes, and some where a person is missing the "dessert" category entirely.
The detective trains the fake camp and records the "notes" (gradients) sent by the fake participants in each scenario.

2. Building the Decoder (The Attack Model)
The detective now has a massive library of data: "When the notes looked like this, the participant was actually holding that mix of recipes."

They train a computer program (an MLP, or a simple brain) to recognize these patterns. It learns to say, "Ah, these specific notes mean the participant has 90% of Class A and 10% of Class B."

3. The Heist (Inference)
Now, the detective watches the real training session. When a real participant sends their notes, the detective runs them through the trained computer program.

Result: The program instantly guesses the statistical breakdown of the participant's private data. Did they have mostly tumor scans? Mostly normal scans? The attack reveals the proportions, even if it doesn't see the individual patients.

Why This is Scary (The Findings)

The paper tested this on four real-world datasets (like scientific papers and product networks) and found:

It's a Master Thief: Fed-Listing is much better at guessing these proportions than previous methods. It works even when the data is messy or unbalanced (e.g., when one client has only one type of data).
It's Stealthy: The server doesn't need to change the training process or hack the code. It just listens to the standard notes that are already being exchanged.
Defenses Don't Work Well: The paper tested three common security shields (adding noise, hiding details, or encrypting data).
- If the shields are weak, the attack still works perfectly.
- If the shields are strong enough to stop the attack, they also break the Master Cookbook, making the final model useless. It's a "lose-lose" situation.

The Bottom Line

The paper claims that in the current setup of Federated Graph Learning, privacy is an illusion regarding data proportions. Even if you hide the raw data, the way the model learns from the graph structure leaks a "fingerprint" of your data's composition. The authors warn that we need new ways to protect not just the data itself, but the statistics of that data.

Technical Summary: Fed-Listing

Problem Statement

Federated Graph Neural Networks (FedGNNs) enable collaborative learning across distributed clients while preserving data privacy. However, recent research indicates that shared model updates, particularly gradients, can inadvertently leak sensitive information about local users. While various privacy attacks (e.g., membership inference, property inference, and graph reconstruction) have been explored in FedGNNs, Label Distribution Inference (LDI) remains underexplored in this setting.

LDI attacks aim to infer the statistical distribution of class labels within a target client's private dataset. In graph-structured data, this risk is amplified by homophily, where nodes of similar labels tend to connect, causing structural and feature correlations to implicitly reveal community composition. Leakage of label distribution can expose sensitive demographic traits, user behaviors, or medical conditions (e.g., the ratio of tumor-positive to normal scans in a hospital), leading to privacy violations and competitive disadvantages.

Existing LDI methods, such as Decaf, were primarily designed for image datasets and rely on gradient-change magnitudes in the final linear layer. These methods struggle in FedGNNs because gradients are influenced not only by node labels but also by complex neighboring structures and unknown node degrees, making direct reverse engineering non-trivial. Furthermore, concurrent active attacks like EC-LDA require the server to tamper with client parameters, making them detectable and disruptive to model utility.

Methodology: Fed-Listing

The authors propose Fed-Listing (Federated Label Distribution Inference in GNNs), a novel, passive, and stealthy attack framework designed specifically for horizontal FedGNN settings. The attack assumes an "honest-but-curious" server that has access to shared model updates (gradients) and an auxiliary dataset but does not alter the training process.

The attack proceeds in three phases:

Auxiliary Dataset Partitioning:
The attacker utilizes an auxiliary dataset ( $D_a$ ) with a similar distribution and label space to the target clients. This dataset is partitioned into subsets using four distinct strategies to simulate diverse client distributions:
- Equal proportion: Classes are equally represented.
- Random distribution: Classes are assigned randomly (simulating non-i.i.d. scenarios).
- Single-class: Each client holds samples from only one class.
- Missing classes: Certain classes are absent from specific clients.
Shadow Federated Training:
The attacker constructs multiple "shadow" federated learning instances using the partitioned auxiliary data. During these shadow training rounds, the attacker records the last-layer gradients ( $g_r$ ) exchanged between shadow clients and the server. These gradients are paired with the known ground-truth label distributions of the shadow clients to form an attack dataset ( $T_{attack}$ ).
Attack Model Training and Inference:
A neural network-based attack model (specifically an MLP) is trained on $T_{attack}$ to map gradient updates to label distributions. The model minimizes a composite loss function combining:
- L1 Norm ( $L_{L1}$ ): Measures the statistical discrepancy between predicted and true distributions.
- Jensen-Shannon Divergence ( $L_{JS}$ ): Measures the overlap/separation between distributions.
Once trained, the attack model infers the label distribution of a real victim client by analyzing the gradients received during the actual FedGNN training process.

Key Contributions

Novel Attack Framework: Introduction of Fed-Listing, the first passive and stealth LDI attack specifically tailored for horizontal FedGNNs.
Shadow Training Pipeline: A designed pipeline using an auxiliary dataset to explore heterogeneous data distributions, creating diverse attack scenarios that mimic real-world non-i.i.d. conditions.
Comprehensive Evaluation: Extensive experiments conducted on four benchmark datasets (Cora, PubMed, Citeseer, Amazon Computers) and three GNN architectures (GCN, GraphSage, GIN).
Defense Analysis: Empirical analysis of Fed-Listing's resilience against three widely adopted defense mechanisms: Differential Privacy (DP), noisy gradients, and gradient compression.

Experimental Results

The authors evaluated Fed-Listing against random guessing and Decaf (adapted for graph data), as well as the active attack EC-LDA (used as an upper bound).

Performance: Fed-Listing significantly outperforms existing baselines across all datasets and architectures. In challenging non-i.i.d. scenarios (e.g., single-class or one-class-dominant distributions), Fed-Listing maintains high accuracy (e.g., Cosine Similarity > 0.97 on Cora), whereas Decaf and random guessing show significant performance degradation.
Efficiency: The attack model achieves superior performance using last-layer gradients compared to all-layer gradients, reducing training time by up to 479× on the Amazon Computers dataset while maintaining or improving inference accuracy.
Model Architecture: An MLP-based attack model was found to be as effective as a CNN-based model but with significantly fewer parameters (~44 times fewer), offering a more efficient solution.
Defense Resilience: Existing defense mechanisms struggle to mitigate Fed-Listing without severely degrading model utility.
- Differential Privacy (DP): Increasing the privacy budget ( $\epsilon$ ) generally improves model utility but also increases attack effectiveness, except at specific low values.
- Noisy Gradients: High noise levels degrade both model accuracy and attack reliability, but intermediate noise levels still allow for moderate attack success.
- Gradient Compression: While compression reduces attack success at certain thresholds (e.g., $\alpha=0.5$ ), it requires a trade-off where higher compression ratios improve model utility but may not fully eliminate the leakage.

Significance and Claims

The paper claims that Fed-Listing exposes a critical vulnerability in current FedGNN deployments: label distribution leakage is a significant and underexplored privacy risk. The authors emphasize that:

The attack is passive and stealthy, making it difficult to detect compared to active attacks that manipulate training parameters.
Current defense mechanisms are insufficient; they either fail to stop the attack or require such strong perturbation that the utility of the global model is severely compromised.
The findings highlight an urgent need for new privacy-preserving mechanisms specifically designed to prevent label distribution leakage in graph-based federated learning, rather than relying on defenses designed for centralized or image-based settings.

The work concludes that understanding these security implications is essential for the robust deployment of FedGNNs in sensitive real-world systems such as healthcare, recommendation systems, and cross-institutional research.