Research map / Adversarial robustness and security / Backdoor and poisoning
Chronic Poisoning: Backdoor Attack against Split Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SFI, a three-stage (Steal, Finetune, Implant) server-side backdoor attack on split learning that trains a shadow model and uses a GAN-style discriminator to make the client model acquire its backdoor-encoding ability.
Problem
Server-side backdoor attacks in split learning are hard because the server cannot access client training data or the client model, so traditional data-poisoning backdoors do not apply.
Approach
Build a server-side shadow model that encodes backdoor samples (with an auxiliary binary classifier boosting sensitivity), then guide the client model to imitate it through a GAN-like discriminator while the server's main-task model keeps the client's main-task performance, so the client learns the backdoor without seeing poisoned data.
Key results
- Backdoor success rates of SFI on MNIST, Fashion and CIFAR10 exceed 90% (Split B: 92.8%, 97.4%, 91.8% with 500, 750, 2500 shadow samples as reported in the introduction and Table 2).
- The auxiliary model Fa improves backdoor accuracy on MNIST by about 8%, without hurting main-task performance.
- Main-task accuracy drops only modestly relative to the no-attack baseline (e.g., MNIST Split B 0.991 base vs 0.943 main).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add the auxiliary model Fa during shadow-model training (ablation) | SFI · MNIST | backdoor attack accuracy: +8% | Helped |
| Add the auxiliary model Fa during shadow-model training (ablation) | SFI · MNIST | main-task performance | No clear effect |
| Apply SFI instead of clean training | ResNet18 split learning · MNIST, Split A | main-task accuracy: 0.993 -> 0.958 | Hurt |
| Apply SFI instead of clean training | ResNet18 split learning · MNIST, Split B | main-task accuracy: 0.991 -> 0.943 | Hurt |
| Apply SFI instead of clean training | ResNet18 split learning · Fashion-MNIST, Split A | main-task accuracy: 0.932 -> 0.899 | Hurt |
| Apply SFI instead of clean training | ResNet18 split learning · Fashion-MNIST, Split B | main-task accuracy: 0.926 -> 0.875 | Hurt |
| Apply SFI instead of clean training | ResNet18 split learning · CIFAR10, Split A | main-task accuracy: 0.957 -> 0.916 | Hurt |
| Apply SFI instead of clean training | ResNet18 split learning · CIFAR10, Split B | main-task accuracy: 0.939 -> 0.882 | Hurt |
| Apply SFI instead of clean training | ResNet18 split learning · CIFAR100, Split A | main-task accuracy: 0.584 -> 0.528 | Hurt |
| Apply SFI instead of clean training | ResNet18 split learning · CIFAR100, Split B | main-task accuracy: 0.561 -> 0.514 | Hurt |
| Use Split B instead of Split A | SFI · MNIST | backdoor accuracy: 0.885 -> 0.928 | Helped |
| Use Split B instead of Split A | SFI · Fashion-MNIST | backdoor accuracy: 0.955 -> 0.974 | Helped |
Surprising findings
- Backdoor can be implanted in the client model without any poisoned client data, purely through server-side gradient manipulation.
Limitations
- Assumes the main task is classification and a fixed trigger (white square) backdoor.
- Performance degrades under non-iid data distribution and as the shadow dataset grows relative to backdoor sample count.
- Attack may be detectable by clients in principle, though authors argue it is transparent.
Experimental setup
Datasets: MNIST Fashion-MNIST CIFAR10 CIFAR100
Benchmarks: MNIST Fashion-MNIST CIFAR10 CIFAR100
Metrics: main task accuracy backdoor attack success rate
Baselines: FSHA
Builds on: Feature space hijacking attack (FSHA) Generative adversarial networks
Closest papers by meaning
- IBAS:Imperceptible Backdoor Attacks in Split Learning with Limited Information (AAAI 2025 · similarity 0.94)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.87)
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.87)
- Backdoor Attacks via Machine Unlearning (AAAI 2024 · similarity 0.87)
- Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.87)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.