Scholarlink

<p>Vertical Federated Learning (VFL) is widely adopted in industries like healthcare, enabling collaborators to enhance model performance using disparate data sources. Split Neural Networks (SplitNN) are central to two-party VFL setups, providing enhanced data privacy during collaboration. However, an untrustworthy server owner, referred to as the host, may exploit its position to infer sensitive client-side features during training. Our research introduces Hitchhike Feature Inference Attack (HFIA), where the host leverages a minimal auxiliary dataset (less than 1% of total data) to infer sensitive features with high accuracy (up to 99%) before VFL training is completed. To mitigate this privacy risk, we propose a client-side defense strategy. Clients construct shadow models to simulate the attacker’s approach and introduce gradient-based adversarial noise to local embeddings, significantly reducing feature leakage. Experiments demonstrate that HFIA achieves high attack success rates, while defense method can reduce attack macro_auc to approximately 60%, with minimal impact (<InlineEquation ID="IEq1"> <InlineMediaObject> <ImageObject Color="BlackWhite" FileRef="10994_2025_6804_Article_IEq1.gif" Format="GIF" Height="16" Rendition="HTML" Resolution="72" Type="Linedraw" Width="41" /> </InlineMediaObject> <EquationSource Format="TEX">\(&lt;5\%\)</EquationSource> <EquationSource Format="MATHML"><math> <mrow> <mo>&lt;</mo> <mn>5</mn> <mo>%</mo> </mrow> </math></EquationSource> </InlineEquation> decrease) on the normal VFL task. The defense can reduce attack macro_auc by over 20% and does not impose restrictions on VFL model construction. In practical applications, participants can adopt this approach to effectively mitigate training-time privacy leakage and protect sensitive client-side data from malicious inference.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

HFIA: a parasitic feature inference attack and gradient-based defense strategy in SplitNN-based vertical federated learning

  • 期刊论文

  • 发表日期：

    2025年6月17日

查看全文
  • Qixuan Dong,
  • Boyang Zhou,
  • ZhiQiang Ru,
  • Ying He,
  • Jingyu Hua,
  • Sheng Zhong

摘要

Vertical Federated Learning (VFL) is widely adopted in industries like healthcare, enabling collaborators to enhance model performance using disparate data sources. Split Neural Networks (SplitNN) are central to two-party VFL setups, providing enhanced data privacy during collaboration. However, an untrustworthy server owner, referred to as the host, may exploit its position to infer sensitive client-side features during training. Our research introduces Hitchhike Feature Inference Attack (HFIA), where the host leverages a minimal auxiliary dataset (less than 1% of total data) to infer sensitive features with high accuracy (up to 99%) before VFL training is completed. To mitigate this privacy risk, we propose a client-side defense strategy. Clients construct shadow models to simulate the attacker’s approach and introduce gradient-based adversarial noise to local embeddings, significantly reducing feature leakage. Experiments demonstrate that HFIA achieves high attack success rates, while defense method can reduce attack macro_auc to approximately 60%, with minimal impact ( \(<5\%\) < 5 % decrease) on the normal VFL task. The defense can reduce attack macro_auc by over 20% and does not impose restrictions on VFL model construction. In practical applications, participants can adopt this approach to effectively mitigate training-time privacy leakage and protect sensitive client-side data from malicious inference.