Research map / Adversarial robustness and security / Backdoor and poisoning
IBAS:Imperceptible Backdoor Attacks in Split Learning with Limited Information
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IBAS, a backdoor attack on split learning where a malicious server uses a learned parrot model to replace some client intermediate activations with poisoned ones and target labels, implanting triggers (BadNet, SIG, Blended, WaNet) while preserving main-task accuracy.
Problem
Split learning is vulnerable to server-side backdoor attacks, but the server cannot access client data or model, so prior attacks have weak effects or are detectable; the paper asks whether a backdoor can be implanted in split learning without hurting the main task or being detected.
Approach
A parrot model trained on a small public dataset, sharing the server's frozen top layers, mimics the client's feature space; the server then swaps a fraction of the client's intermediate activations (and their labels) for parrot-generated poisoned activations labeled with the target class, so backprop optimizes both main and backdoor tasks without GANs or altering client tasks.
Key results
- Table 1: IBAS achieves ACC 86.22 / ASR 96.92 (BadNet), 86.32 / 98.62 (SIG), 85.11 / 84.34 (Blended), 84.24 / 77.85 (WaNet) on CIFAR-10, versus baselines that trade off ACC and ASR.
- Attack retains high ASR (nearly 90%) with a public dataset of only 2,000 samples.
- Attack remains effective at a poisoning rate of 1/128 (one poisoned activation per batch of 128).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use IBAS instead of data poisoning | Split learning backdoor attacks · CIFAR-10, BadNet | ASR: 99.12 -> 96.92 | Hurt |
| use IBAS instead of data poisoning | Split learning backdoor attacks · CIFAR-10, SIG | ASR: 98.74 -> 98.62 | Hurt |
| use IBAS instead of data poisoning | Split learning backdoor attacks · CIFAR-10, Blended | ASR: 98.91 -> 84.34 | Hurt |
| use IBAS instead of data poisoning | Split learning backdoor attacks · CIFAR-10, WaNet | ASR: 99.92 -> 77.85 | Hurt |
| use a parrot model with three convolutional layers rather than one (ablation) | IBAS · CIFAR-10, BadNet | ASR: 14.13 -> 96.92 | Helped |
| use a parrot model with three convolutional layers rather than one (ablation) | IBAS · CIFAR-10, SIG | ASR: 19.47 -> 98.62 | Helped |
| use a parrot model with three convolutional layers rather than one (ablation) | IBAS · CIFAR-10, Blended | ASR: 10.54 -> 71.75 | Helped |
| use a parrot model with three convolutional layers rather than one (ablation) | IBAS · CIFAR-10, WaNet | ASR: 2.93 -> 84.34 | Helped |
| change the split strategy among Model1, Model2 and Model3 (ablation) | IBAS · CIFAR-10, BadNet | ASR: 98.42; 98.82; 86.92 | Mixed |
| change the split strategy among Model1, Model2 and Model3 (ablation) | IBAS · CIFAR-10, SIG | ASR: 97.19; 97.42; 98.62 | Mixed |
| change the split strategy among Model1, Model2 and Model3 (ablation) | IBAS · CIFAR-10, Blended | ASR: 93.21; 92.17; 84.34 | Mixed |
| change the split strategy among Model1, Model2 and Model3 (ablation) | IBAS · CIFAR-10, WaNet | ASR: 63.78; 78.90; 77.85 | Mixed |
Surprising findings
- Backdoor succeeds at extremely low poisoning rates (1/batch size), below 1% typical for centralized attacks.
Limitations
- Evaluated only on CIFAR-10 with a modified ResNet18 and a single split setup family.
- WaNet attack success rate is lower (77.85%) and Blended ASR is reduced relative to other triggers in the main comparison.
- Attack relies on the server knowing the split architecture of the client's layers to determine parrot structure; detection defenses beyond SplitGuard/SplitSpy are not evaluated.
Experimental setup
Datasets: CIFAR-10
Benchmarks: CIFAR-10
Metrics: clean accuracy (ACC) attack success rate (ASR)
Baselines: Data poisoning Surrogate Client Injector Autoencoder Chronic Poisoning
Builds on: BadNet FSHA Tajalli server-side backdoor attack Chronic Poisoning
Closest papers by meaning
- Chronic Poisoning: Backdoor Attack against Split Learning (AAAI 2024 · similarity 0.94)
- A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning (CVPR 2024 · similarity 0.88)
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.88)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.88)
- Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security (ICML 2025 · similarity 0.87)
- Label-Free Backdoor Attacks in Vertical Federated Learning (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.