Snail: Scheduler-Driven Backdoor Injection in Split Federated Learning via Gradual Perturbation

Abstract

Split Federated Learning (SFL) reduces client-side computation by partitioning neural networks between clients and a server, but its cut-layer interaction also creates a new surface for backdoor injection. Existing attacks often rely on persistent poisoning or privileged server-side knowledge, limiting their practicality under stochastic participation and modern defenses. We propose snail, a scheduler-driven backdoor attack for SFL that optimizes injection timing, attacker selection, and poisoning intensity using only client-visible signals. snail identifies locally stable injection windows, selects statistically benign-looking malicious clients from participation histories, and coordinates gradient-consistent attackers to amplify backdoor effects while preserving stealth. Experiments on four datasets show that snail consistently outperforms prior attacks, achieving over 94% ASR on all three image datasets, including 97.5% on CIFAR-10, while maintaining comparable main-task accuracy even under representative defenses. These results reveal a practical SFL attack surface in which adaptive scheduling and coordinated low-variance poisoning enable effective backdoors under strict observability constraints.