While Federated Learning (FL) mitigates direct data exposure, the resulting trained models remain susceptible to membership inference attacks (MIAs). This paper presents an empirical evaluation of Differential Privacy (DP) as a defense mechanism against MIAs in FL, leveraging the environment of the 2025 NIST Genomics Privacy-Preserving Federated Learning (PPFL) Red Teaming Event. To improve inference accuracy, we propose a stacking attack strategy that ensembles seven black-box estimators to train a meta-classifier on prediction probabilities and cross-entropy losses. We evaluate this methodology against target models under three privacy configurations: an unprotected convolutional neural network (CNN, $ε=\infty$), a low-privacy DP model ($ε=200$), and a high-privacy DP model ($ε=10$). The attack outperforms all baselines in the No DP and Low Privacy settings and, critically, maintains measurable membership leakage at $ε=200$ where a single-signal LiRA baseline collapses. Evaluated on an independent third-party benchmark, these results provide an empirical characterisation of how stacking-based inference degrades across calibrated DP tiers in FL.

翻译：尽管联邦学习（FL）减轻了直接数据暴露的风险，但所训练的模型仍易受成员推理攻击（MIA）的影响。本文基于2025年NIST基因组隐私保护联邦学习（PPFL）红队演习环境，对差分隐私（DP）作为FL中对抗MIA的防御机制进行了实证评估。为提升推理准确率，我们提出了一种堆叠攻击策略，该策略集成七个黑盒估计器，利用预测概率和交叉熵损失训练元分类器。我们在三种隐私配置下针对目标模型评估该方法：未防护的卷积神经网络（CNN，$ε=\infty$）、低隐私DP模型（$ε=200$）与高隐私DP模型（$ε=10$）。该攻击在无DP和低隐私设置下优于所有基线方法，且至关重要的是，在单一信号LiRA基线失效的$ε=200$条件下，仍能维持可测量的成员泄露。基于独立第三方基准的评估结果，实证刻画了堆叠推理如何随FL中校准的DP等级逐步退化。