The threat at the heart of the work is the membership inference attack, or MIA. In such an attack, an adversary interrogates a trained model and tries to determine whether a specific record, perhaps a patient’s medical scan or a person’s biometric template, was part of the data used to train it. The mere confirmation that someone’s data was in a hospital’s training set can be a privacy violation in its own right, particularly under regulations such as the GDPR that govern how personal information may be processed. Membership inference attacks were first formalized by Shokri and colleagues in 2017, and since then an entire research literature has grown around both sharpening these attacks and defending against them.

What has frustrated defenders is that most existing attack and evaluation methods rest on assumptions that rarely hold in the real world. Classic approaches require shadow models, replicas trained to mimic the target’s behavior, or access to confidence scores, or knowledge of how the data was split between training and test sets. In a genuine black-box scenario, where an evaluator can only query a deployed model and observe its outputs, these assumptions are often unrealistic. Moreover, existing techniques tend to be computationally expensive, and many were designed exclusively for classification tasks, leaving semantic segmentation models, which are central to medical imaging, poorly covered. Evaluating whether decentralized training paradigms such as federated learning resist these attacks has therefore remained a genuine open challenge.

The IIT Kharagpur team’s contribution is a framework that sidesteps these obstacles entirely. Their method assesses membership privacy risk through what they call dropout-induced inference deviation. Dropout, a technique originally introduced by Srivastava and colleagues in 2014 to prevent overfitting, randomly deactivates units in a neural network during training. The researchers exploit a different facet of dropout: by randomly dropping units at inference time and observing how much the model’s outputs fluctuate, they obtain a signal that distinguishes memorized training samples from unseen ones. Samples the model has memorized respond differently to this induced randomness than samples it has merely generalized over, and the magnitude of that deviation serves as a proxy for membership risk.

The elegance of the approach lies in its minimal requirements. It demands no shadow models, no auxiliary datasets, and no access to the model’s internal parameters or train-test splits. Anyone who can query a deployed black-box model can apply the diagnostic, making it a practical tool for organizations that need to audit privacy risk in systems they did not train. Because it works for both classification and segmentation tasks, it covers the full spectrum of vision models used in biometric authentication and medical imaging, the cross-disciplinary context in which the work is situated.

Beyond the empirical tool, the study offers a theoretical account of why federated learning should resist memorization in the first place. Through sensitivity analysis and an examination of loss surface geometry, the authors show that centralized training tends to converge to sharp minima, narrow valleys in the loss landscape where the model fits the training data with high precision. Sharp minima are associated with overfitting and with amplified output variability between training and non-training samples, which is precisely the variability an inference attacker exploits. Federated aggregation, in which multiple clients train locally and only model updates are combined by a central server, drives models toward flatter minima. Flatness, as prior work on generative models has also suggested, suppresses memorization and reduces the leakage of membership information.

This connection between loss landscape geometry and privacy is the conceptual payoff of the paper. It reframes federated learning not merely as a data-governance arrangement, in which raw data never leaves the client device or institution, but as a training procedure whose optimization dynamics themselves confer a privacy benefit. The aggregation of updates across heterogeneous clients acts as a form of implicit regularization, smoothing the loss surface and discouraging the model from latching onto individual records. That mechanistic insight elevates the work beyond a benchmarking exercise and gives practitioners a principled reason to prefer decentralized training when privacy is paramount.

The empirical validation is unusually broad. The framework was tested across seven datasets spanning both classification and segmentation tasks, including biomedical image benchmarks such as MedMNIST and the ISIC skin lesion archive, alongside classic computer vision datasets like CIFAR and SVHN. Model architectures were equally diverse, ranging from residual networks and MobileNet variants for classification to U-Net, U-Net++, and DeepLabV3+ for segmentation. Across this breadth, the dropout-induced deviation signal consistently separated training from non-training samples, and the comparison between centralized and federated training regimes confirmed that federated aggregation reduces membership leakage. Demonstrating generality across tasks and architectures is what distinguishes the method from earlier evaluation schemes that were tailored to a single model family or output type.

The practical implications extend well into the domains where the stakes are highest. In medical imaging, models trained on hospital data are exactly the kind of high-value, sensitive assets that membership inference attacks target, and regulations going back decades, from early federal medical privacy rules to modern data protection law, recognize the harm that even metadata-level disclosures can cause. In biometric authentication, where the training data consists of irrevocable personal identifiers, the ability to audit a deployed model for memorization without touching its internals is a significant operational advantage. A hospital or a device manufacturer could run the diagnostic on a production model, quantify its membership risk, and make informed decisions about whether additional defenses, such as input perturbation at the client level, are warranted.

The work also contributes to a broader recalibration in the security community. Recent systematizations of knowledge have argued that membership inference is harder than previously thought, and that many reported attack successes depend on favorable assumptions about data dependencies, distribution shifts, and attacker knowledge. Against that backdrop, a cheap, assumption-free measurement tool is valuable precisely because it lets defenders, not just attackers, quantify risk under realistic black-box conditions. The authors’ framework, computable with nothing more than repeated stochastic queries to the model, turns privacy auditing from an expensive research project into a routine check. As federated learning continues to spread through healthcare, mobile computing, and cross-institutional collaborations, the study suggests that the decentralized paradigm offers not just regulatory comfort but a measurable, geometrically grounded reduction in the risk that a model will give up the secrets of the data it was built on.

Subject of Research: Membership privacy risk assessment in federated versus centralized deep learning

Article Title: Can federated models keep secrets better?

Article References: Borthakur, A., Srivastava, A., & Sheet, D. (2026). Can federated models keep secrets better?. Multimedia Tools and Applications, 85(11), Article 816. https://doi.org/10.1007/s11042-026-21981-5

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21981-5

Keywords: federated learning, membership inference attack, deep learning, data privacy, dropout, loss surface geometry, black-box evaluation, medical imaging, biometric authentication, semantic segmentation, sharp minima, privacy auditing