Research map / Federated learning and privacy / Privacy attacks and secure learning

Label-Free Backdoor Attacks in Vertical Federated Learning

AAAI 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Defending federated learning against poisoning · 12 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes LFBA, a label-free clean-label backdoor attack for vertical federated learning that builds a target poison set from embedding gradients and selectively switches hard poison samples to strengthen trigger learning.

Problem

Backdoor attacks in vertical federated learning (VFL) typically assume the malicious passive client knows task labels or a target-class sample set, which is unrealistic since only the active client holds labels.

Approach

Use the consistency of embedding gradients (returned to all clients) with an anchor sample to select a poison set from the target class without labels, then switch features of the hardest poison samples with other local samples while adding the trigger, so the model learns the trigger instead of the original features.

Key results

• LFBA reaches attack success rates up to 99.96% (UCI-HAR, K=2) with clean accuracy largely maintained, e.g., 83.93% on NUS-WIDE vs 83.98% Vanilla.
• On average LFBA's trade-off score improves by 1.55% over RS-GPC, and switching gives an average 8.63% ASR gain over random-switch-free RGPC.
• The GPC poison set is consistently from the target class, with consistent rates up to 99.92% across poison ratios on NUS-WIDE.

Measured effects reported in the paper

Surprising findings

• Triggers tend to be ignored and under-fitted because poison samples share the target's original features, so disrupting feature learning by switching helps backdoor learning.

Limitations

• Attack performance may drop when the number of clients grows and the attacker's feature share is very small.
• Sample switching may be sub-optimal due to discrepancies between switched features and the backdoor target.
• Poison ratio above about 0.2 reduces consistency of the poison set and attack performance.

Experimental setup

Datasets: NUS-WIDE UCI-HAR Phishing CIFAR-10

Benchmarks: NUS-WIDE UCI-HAR Phishing CIFAR-10

Metrics: clean accuracy (M) attack success rate (A) trade-off mean (V)

Baselines: Vanilla DGPC RGPC RS-GPC

Builds on: BadNets clean-label backdoor attacks LR-BA TECB

Closest papers by meaning

• Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · similarity 0.91)
• VFLAIR: A Research Library and Benchmark for Vertical Federated Learning (ICLR 2024 · similarity 0.88)
• Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.88)
• MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.88)
• IBAS:Imperceptible Backdoor Attacks in Split Learning with Limited Information (AAAI 2025 · similarity 0.87)
• Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.87)