An improved defense mechanism that combines adversarial training and differential-privacy-style noise injection to collectively enhance the robustness of the existing KDk defense mechanism with marginal model utility trade-off is introduced.
Abstract
The adoption of federated learning (FL) has been on the rise in recent years due to the decentralized approach to data handling. Vertical federated learning is a type of FL that allows different parties to train shared models on complementary feature spaces without the direct exchange of data. However, the gradients these parties exchange can inadvertently carry sensitive information. Adversaries exploit this leakage to mount label inference attacks (LIAs) and adversarial attacks. To curb this, defense mechanisms have been deployed, but most of them either trade robustness for privacy and model utility or vice versa. This study addresses this gap by introducing an improved defense mechanism that combines adversarial training (to harden the model against adversarial perturbations) and differential-privacy-style noise injection (aimed at restoring the label privacy weakened by adversarial training) to collectively enhance the robustness of the existing KDk defense mechanism with marginal model utility trade-off. Instead of relying on heavy encryption or post-processing techniques, it builds privacy directly into the learning dynamics of the model. It was evaluated using five publicly available datasets spanning three data modalities with the proposed mechanism achieving competitive near-baseline accuracy while significantly reducing label-inference success. Under FGSM-based adversarial evaluation, the robustness gap of this mechanism was found to be approximately 1% compared to the 36% robustness gap of the existing KDk mechanism. The Privacy Leakage Index (PLI) reached 81.32%, 96.08%, 82.41%, 86.68% and 73.88% for CIFAR-10, CIFAR-100, CINIC-10, Yahoo! Answers and Criteo datasets, respectively. The results suggest that robustness and privacy security objectives can coexist to secure VFL with minimal effect on model accuracy.
To mitigate the attacks of transferable adversarial examples, a defense mechanism stemming from the transferability of model robustness by adversarial training is designed, gaining insights into adversarial examples and the vulnerability of federated learning systems.
Zuobin Xiong, Deval Mukherjee, Homook Cho et al.· International Conference on...· 0 citations
GradLock is introduced, a novel training-time injection attack that stealthily injects sensitive training data directly into the model parameters and employs dynamic gradient locking to prevent payload degradation during the optimization process.
Jin-Seong Kim, Han-Ju Lee, Seok-Won Hong et al.· 0 citations
The proliferation of Internet of Things (IoT) devices has amplified the attack surface for large-scale cyber threats, with rapidly evolving malware families such as Mirai posing significant detection challenges. Existing side-channel and host-based approaches are limited by poor generalization to unseen variants and the absence of robust privacy protections during training. In this paper, we propose SecShield, a federated deep learning framework for privacy-preserving malware detection in resource-constrained IoT environments. SecShield employs a three-party secure computation model, where clients locally train a shared deep neural network on power side-channel traces and transmit only noisy parameter updates to a central server via an aggregator, preventing raw data exposure. Differential privacy is incorporated by injecting calibrated noise into gradients, mitigating inference risks such as data reconstruction and poisoning attacks. This decentralized architecture enables continuous adaptation to zero-day malware, reduces communication overhead, and ensures robustness against adversarial manipulation. Experimental evaluations on IoT power trace datasets demonstrate that SecShield achieves high detection accuracy over 98% while preserving client data confidentiality and maintaining computational efficiency.
Damodar Dhital, Sabir Ahmed Khan, A.L.M.U.S.T.A.P.H.A.A. Wakili et al.· International Conference on...· 0 citations
Federated Learning (FL) facilitates distributed training while preserving privacy, yet remains highly vulnerable to backdoor attacks. Existing defenses primarily address these threats via robust aggregation, which reduces the influence of malicious contributions (e.g., pruning, reweighting), or through detection-based filtering that discards anomalous updates prior to aggregation. Nevertheless, existing defenses primarily suppress or discard malicious updates, inevitably sacrificing task-relevant knowledge and leading to reduced clean-task accuracy. To this end, we propose FedPurify, a framework that performs post-training data-free purification to remove malicious backdoors while preserving task-relevant knowledge. Specifically, following global convergence without loss of task-relevant knowledge, FedPurify proposes a fully data-free sample synthesis scheme to generate diverse and representative samples from the converged global model, thereby inherently preserving client privacy in FL. Building upon these synthetic samples, FedPurify further leverages data-free trigger inversion to effectively expose latent backdoor behaviors. Finally, FedPurify combines contrastive feature alignment with knowledge-preserving self-distillation to remove backdoor effects while preserving benign task performance. Extensive experiments verify that FedPurify effectively removes backdoors from the global model with negligible impact on clean performance, outperforming existing defense methods.
Baolu Xue, Hanyuan Zheng, T. Man et al.· Proceedings of the 32nd ACM...· 0 citations
Vertical Federated Learning (VFL) allows multiple organizations with disjoint feature spaces and overlapping sample identities to collaboratively train machine learning models while keeping local data. Despite its privacy-preserving design, recent studies have shown that VFL is vulnerable to backdoor attacks. In particular, a malicious passive party can inject a carefully crafted trigger into its local inputs or intermediate embeddings, causing the global model to produce targeted mispredictions at inference time. Existing backdoor attacks in VFL (e.g., BadVFL) rely on the assumption that the malicious client can obtain additional knowledge about task labels, which contradicts the core privacy assumptions of VFL. In this paper, we propose GOFA, a new backdoor attack method for VFL scenarios. GOFA uses the gradient feedback from the server to construct a poisoned dataset and employs an adversarial example attack (e.g., FGSM) for masking the original features of the data to enhance trigger learning. We use the CIFAR-10 and UCI-HAR datasets. Our experiments demonstrate the effectiveness of our method in various settings.
Ye Cheng, Naotoshi Adachi· 2026 6th International Confe...· 0 citations