Using soft prompts to launch privacy attacks in federated prompt tuning

The researchers propose PromptMIA, a membership inference attack against federated prompt tuning, in which a malicious server infers whether a target data point is in a client's private dataset by injecting adversarially constructed prompts and exploiting their training updates. The paper formalizes this threat as a security game; experiments show that PromptMIA achieves high attack advantage on multiple benchmark datasets, significantly outperforming existing state-of-the-art federated membership inference attacks, and provides a theoretical lower bound on attack advantage to explain the empirical performance. The authors also find that existing MIA defenses are often ineffective against PromptMIA, and point out the need to develop defense mechanisms specifically targeting prompt tuning in federated settings.