Research map / Bandits and online learning / Multi-armed bandits
Constructing Adversarial Examples for Vertical Federated Learning: Optimal Client Corruption through Multi-Armed Bandit
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes an adaptive client-corruption attack on vertical federated learning inference, casting corruption-pattern selection as a multi-armed bandit solved by Thompson sampling with empirical maximum reward (E-TS), with NES-based adversarial embedding generation.
Problem
Adversarial example attacks on VFL inference where an adversary can corrupt only a limited subset of client channels and must adaptively choose which clients to corrupt over time without prior knowledge of test data or models.
Approach
Formulate the adaptive corruption problem as an MAB over C-subsets of clients, and speed up Thompson sampling by restricting exploration to an empirical competitive set defined via each arm's empirical maximum reward, yielding regret (N-D)O(1)+D O(log T).
Key results
- E-TS achieves attack success rates of 38%-99% for targeted attacks and 41%-99% for untargeted attacks across six datasets.
- E-TS converges faster and more stably than plain Thompson sampling, with regret bound (N-D)O(1)+D O(log T) versus O(log T) per arm for plain TS.
- Manifold projection defense reduces untargeted ASR by 35%-72% at beta=0.1, though it does not fully eliminate adversarial examples.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use E-TS instead of plain Thompson sampling for corruption pattern selection | VFL adversarial attack · Six VFL datasets | convergence speed to the best corruption pattern | Helped |
| Use E-TS instead of random corruption (ablation) | VFL adversarial attack · FashionMNIST, varying number of corrupted clients | ASR | Helped |
| Increase the number of corrupted clients (ablation) | E-TS · FashionMNIST | ASR | Helped |
| Set warm-up rounds to 20 (ablation) | E-TS · FashionMNIST | ASR | Hurt |
| Increase warm-up rounds to 200 or 1000 (ablation) | E-TS · FashionMNIST | advantage over plain TS | Hurt |
| Increase query budget (ablation) | E-TS · FashionMNIST, targeted attack | ASR | Helped |
| Increase perturbation budget up to 0.3 (ablation) | E-TS · FashionMNIST | ASR | Helped |
| Increase perturbation budget beyond 0.3 (ablation) | E-TS · FashionMNIST | ASR | No clear effect |
| Apply randomized smoothing | VFL model under E-TS attack · FashionMNIST, targeted attack | ASR | Hurt |
| Apply dropout | VFL model under E-TS attack · FashionMNIST, targeted attack | ASR | Hurt |
| Apply manifold projection | VFL model under E-TS attack · FashionMNIST, untargeted attack with β = 0.1 | ASR: 35% ∼ 72% | Hurt |
| Expand the corruption-pattern search space (ablation) | E-TS · Larger exploration spaces | performance gap over TS | Helped |
Surprising findings
- Increasing the perturbation budget beyond 0.3 has negligible effect on ASR.
Limitations
- Assumes each arm is pulled at least twice during warm-up, which the adversary must ensure by traversing all arms.
- Attack evaluated only with a simple magnitude-based anomaly detector model; the paper notes manifold projection defense does not fully eliminate AEs.
Experimental setup
Datasets: Credit Real-Sim FashionMNIST CIFAR-10 Caltech-7 IMDB
Benchmarks: Credit Real-Sim FashionMNIST CIFAR-10 Caltech-7 IMDB
Metrics: attack success rate regret
Baselines: Fixed corruption pattern Random corruption Plain Thompson sampling
Builds on: Thompson sampling natural evolution strategy projected gradient descent zeroth-order optimization (ZOO)
Closest papers by meaning
- Federated Linear Bandits with Finite Adversarial Actions (NeurIPS 2023 · similarity 0.87)
- Federated Adversarial Learning: A Framework with Convergence Analysis (ICML 2023 · similarity 0.87)
- Federated Robustness Propagation: Sharing Adversarial Robustness in Heterogeneous Federated Learning (AAAI 2023 · similarity 0.87)
- Bandit Learning in Matching Markets Robust to Adversarial Corruptions (ICLR 2026 · similarity 0.87)
- VFLAIR: A Research Library and Benchmark for Vertical Federated Learning (ICLR 2024 · similarity 0.86)
- Competitive Advantage Attacks to Decentralized Federated Learning (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.