Abstract:Vertical federated learning (VFL) is being used more and more widely in industry. One of its most common application scenarios is a two-party setting: a participant (i.e., the host), who exclusively owns the labels but possesses insufficient number of features, wants to improve its model performance by combining features from another participant (i.e., the client) of a different business group. The best deep ML architecture suits for this scenario is considered to be Split Neural Network (SplitNN), in which each participant runs a self-defined bottom model to learn the hidden representations (i.e., the local embeddings) of its local data and then forwards them to the host, who runs a top model to aggregate both the local embeddings to produce the final predicts. In this paper, we assume the client is malicious and demonstrate that she/he could inject a stealthy backdoor into the top model during the training to misclassify any sample to a pre-selected target class with a high probability by just replacing its local embedding with a special trigger vector regardless of the host-side embedding. This task is non-trivial because existing data poison attacks for backdoor injection in traditional models usually require to modify the labels of a set of trigger-tagged samples of non-target classes, which is impossible here as the client has no rights to access or modify the labels exclusively owned by the host. Targeting this challenge, we propose a SplitNN-dedicated data poison attack which does not require to modify any labels but just replaces the local embeddings of a very small number of target-class samples with a carefully constructed trigger vector during training. The experiments on four datasets show that our attack can achieve an attack rate as high as 94%, while bringing negligible side-effects to the model accuracy. Moreover, it is stealthy enough to resist various anomaly detection methods.

Neurotoxin: Durable Backdoors in Federated Learning

Backdoor Attacks and Defenses in Federated Learning: State-of-the-Art, Taxonomy, and Future Directions

How To Backdoor Federated Learning

Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning

Towards Practical Backdoor Attacks on Federated Learning Systems

RoPe-Door: Towards Robust and Persistent Backdoor Data Poisoning Attacks in Federated Learning

Backdoor Federated Learning by Poisoning Backdoor-Critical Layers

Persistent Backdoor Attacks in Continual Learning

PerDoor: Persistent Non-Uniform Backdoors in Federated Learning using Adversarial Perturbations

Get Rid Of Your Trail: Remotely Erasing Backdoors in Federated Learning

Never Too Late: Tracing and Mitigating Backdoor Attacks in Federated Learning

Non-Cooperative Backdoor Attacks in Federated Learning: A New Threat Landscape

Act in Collusion: A Persistent Distributed Multi-Target Backdoor in Federated Learning

BadSFL: Backdoor Attack against Scaffold Federated Learning

Mitigating Backdoor Attacks in Federated Learning via Flipping Weight Updates of Low-Activation Input Neurons

Thinking Two Moves Ahead: Anticipating Other Users Improves Backdoor Attacks in Federated Learning

On the Vulnerability of Backdoor Defenses for Federated Learning

Protect Federated Learning Against Backdoor Attacks via Data-Free Trigger Generation

SDBA: A Stealthy and Long-Lasting Durable Backdoor Attack in Federated Learning

Venomancer: Towards Imperceptible and Target-on-Demand Backdoor Attacks in Federated Learning

Backdoor Attack Against Split Neural Network-Based Vertical Federated Learning