The Geometry of Privacy: A Two-Stage Analysis of Generative Membership Inference in Federated Learning

We study Membership Inference Attack (MIA) risk in Federated Learning through a two-stage lens that separates (i) whether a target client’s contribution is detectable after aggregation and system noise (Stage I: Signal Survival) from (ii) whether a surviving contribution induces a generative membership score change attributable to the target’s private data (Stage II: Signal Attribution). Stage I models aggregation as a target–background decomposition and shows that detectability hinges on target–background alignment, which can induce cancellation. Stage II connects the surviving target component to a generative MIA score via a local path representation and Lipschitz/smoothness bounds, avoiding architecture-specific assumptions. Our analysis reveals that the leading attribution term is governed by the alignment between the target update and the score geometry of the target data at an appropriate baseline. We validate the theoretical bounds and illustrate risk trajectories across several scenarios.