Backdoor attacks and defenses in feature-partitioned collaborative learning
Open accessAbstract
Since there are multiple parties in collaborative learning, malicious parties might manipulate the learning process for their own purposes through backdoor attacks. However, most of existing works only consider the federated learning scenario where data are partitioned by samples. The feature-partitioned learning can be another important scenario since in many real world applications, features are often distributed across different parties. Attacks and defenses in such scenario are especially challenging when the attackers have no labels and the defenders are not able to access the data and model parameters of other participants. In this paper, we show that even parties with no access to labels can successfully inject backdoor attacks, achieving high accuracy on both main and backdoor tasks. Next, we introduce several defense techniques, demonstrating that the backdoor can be successfully blocked by a combination of these techniques without hurting main task accuracy. To the best of our knowledge, this is the first systematical study to deal with backdoor attacks in the feature-partitioned collaborative learning framework.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Examples of adversarial attacks include data poisoning, model update poisoning, and model evasion attacks.
“Examples of adversarial attacks include data poisoning [69, 319], model update poisoning [44, 67], and model evasion attacks [441, 69, 211].”
From Advances and Open Problems in Federated Learning (2021) · cites this paper as [69]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322 · see citing works
Self-citationDwork, C. (2006) · Lecture notes in computer science · doi:10.1007/11787006_1 · Cited by 5,945 · see citing works
Protocols for secure computations
Yao, A. C.-C. (1982) · 23rd Annual Symposium on Foundations of Computer Science (sfcs 1982) · doi:10.1109/sfcs.1982.88 · Cited by 2,693 · see citing works
Zhu, L., & Han, S. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-63076-8_2 · Cited by 1,906 · see citing works
(1978) · Cited by 1,875 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
A Survey on Homomorphic Encryption Schemes: Theory and Implementation
Acar, A., Aksu, H., Uluagac, A. S., & Conti, M. (2019) · ACM Computing Surveys · doi:10.1145/3214303 · Cited by 1,397 · see citing works
Deep Gradient Compression: Reducing the Communication Bandwidth for Distributed Training
Lin, Y., Han, S., Mao, H., Wang, Y., & Dally, W. J. (2017) · arXiv · doi:10.48550/arxiv.1712.01887 · Cited by 1,134 · see citing works
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061 · see citing works
Federated Learning of Deep Networks using Model AveragingPreprint
McMahan, H. B., Moore, E., Ramage, D., & y Arcas, B. A. (2016) · arXiv (Cornell University) · Cited by 923 · see citing works
SecureBoost: A Lossless Federated Learning Framework
Cheng, K., Fan, T., Jin, Y., Liu, Y., Chen, T., Papadopoulos, D., & Yang, Q. (2021) · IEEE Intelligent Systems · doi:10.1109/mis.2021.3082561 · Cited by 669 · see citing works
Self-citationHardy, S., Henecka, W., Ivey-Law, H., Nock, R., Patrini, G., Smith, G., & Thorne, B. (2017) · arXiv · doi:10.48550/arxiv.1711.10677 · Cited by 431 · see citing works
Can You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
FDML: A Collaborative Machine Learning Framework for Distributed Features
Hu, Y., Niu, D., Yang, J., & Zhou, S. (2019) · Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining · doi:10.1145/3292500.3330765 · Cited by 163 · see citing works
Byzantine-Robust Federated Machine Learning through Adaptive Model AveragingPreprint
Muñoz-González, L., Co, K. T., & Lupu, E. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1909.05125 · Cited by 153 · see citing works
A Communication Efficient Collaborative Learning Framework for Distributed FeaturesPreprint
Liu, Y., Kang, Y., Zhang, X., Li, L., Cheng, Y. J., Chen, T., Hong, M., & Yang, Q. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.11187 · Cited by 53 · see citing works
Self-citationLearning Privately over Distributed Features: An ADMM Sharing Approach
Hu, Y., Liu, P., Kong, L., & Niu, D. (2019) · arXiv · doi:10.48550/arxiv.1907.07735 · Cited by 30 · see citing works
Distributed Ridge Regression with Feature Partitioning
Gratton, C., Venkategowda, N. K. D., Arablouei, R., & Werner, S. (2018) · Asilomar Conference on Signals, Systems and Computers (ACSSC) · doi:10.1109/acssc.2018.8645549 · Cited by 22 · see citing works
Privacy-Preserving Multiple Linear Regression of Vertically Partitioned Real Medical Datasets
Kikuchi, H., Hamanaga, C., Yasunaga, H., Matsui, H., & Hashimoto, H. (2017) · International Conference on Advanced Information Networking and Applications (AINA) · doi:10.1109/aina.2017.52 · Cited by 14 · see citing works
Flagged first, then by citations
Research works printed but not linked: 5
- Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning , volume 97 of Proceedings of Machine Learning Research , pages 634-643, Long Beach, California, USA, 09-15 Jun 2019. PMLR.
- Yang Liu, Tianjian Chen, and Qiang Yang. Secure federated transfer learning. CoRR , abs/1812.03337, 2018. · arXiv
- Jacob Steinhardt, Pang Wei Koh, and Percy Liang. Certified defenses for data poisoning attacks. CoRR , abs/1706.03691, 2017. · arXiv
- Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. { DBA } : Distributed backdoor attacks against federated learning. In International Conference on Learning Representations , 2020.
- Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and applications. CoRR , abs/1902.04885, 2019. · arXiv
Cited by
Sorted by citations
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
Self-citationLi, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Vertical Federated Learning: Concepts, Advances, and Challenges
Liu, Y., Kang, Y., Zou, T., Pu, Y., He, Y., Ye, X., Ouyang, Y., Zhang, Y.-Q., & Yang, Q. (2024) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/tkde.2024.3352628 · Cited by 496 · see citing works
Self-citationFedML: A Research Library and Benchmark for Federated Machine LearningPreprint
He, C., Li, S., So, J., Zeng, X., Zhang, M., Wang, H., Wang, X., Vepakomma, P., Singh, A., Qiu, H., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.13518 · Cited by 667 · see citing works
Self-citationDataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., & Goldstein, T. (2023) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2022.3162397 · Cited by 362 · see citing works
Rodríguez-Barroso, N., Jiménez-López, D., Luzón, M. V., Herrera, F., & Martínez-Cámara, E. (2023) · Information Fusion · doi:10.1016/j.inffus.2022.09.011 · Cited by 296 · see citing works
Machine Learning for Large-Scale Optimization in 6G Wireless Networks
Shi, Y., Lian, L., Shi, Y., Wang, Z., Zhou, Y., Fu, L., Bai, L., Zhang, J., & Zhang, W. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3300664 · Cited by 239 · see citing works
Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive ReviewPreprint
Gao, Y., Doan, B. G., Zhang, Z., Ma, S., Zhang, J., Fu, A., Nepal, ., & Kim, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.10760 · Cited by 276 · see citing works
Nguyen, T. D., Nguyen, T., Nguyen, P. L., Pham, H. H., Doan, K. D., & Wong, K.-S. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107166 · Cited by 130 · see citing works
Coordinated Backdoor Attacks against Federated Learning with Model-Dependent Triggers
Gong, X., Chen, Y., Huang, H., Liao, Y., Wang, S., & Wang, Q. (2022) · IEEE Network · doi:10.1109/mnet.011.2000783 · Cited by 72 · see citing works
Federated Learning with Privacy-preserving and Model IP-right-protection
Yang, Q., Huang, A., Fan, L., Chan, C. S., Lim, J. H., Ng, K. W., Ong, D. S., & Li, B. (2023) · Machine Intelligence Research · doi:10.1007/s11633-022-1343-2 · Cited by 78 · see citing works
Defending Batch-Level Label Inference and Replacement Attacks in Vertical Federated Learning
Zou, T., Liu, Y., Kang, Y., Liu, W., He, Y., Yi, Z., Yang, Q., & Zhang, Y.-Q. (2022) · IEEE Transactions on Big Data · doi:10.1109/tbdata.2022.3192121 · Cited by 61 · see citing works
Self-citationVertical Federated Learning for Effectiveness, Security, Applicability: A Survey
Ye, M., Shen, W., Du, B., Snezhko, E. V., Kovalev, V. A., & Yuen, P. C. (2025) · ACM Computing Surveys · doi:10.1145/3720539 · Cited by 51 · see citing works
Backdoor Attacks to Deep Learning Models and Countermeasures: A Survey
Li, Y., Zhang, S., Wang, W., & Song, H. T. (2023) · IEEE Open Journal of the Computer Society · doi:10.1109/ojcs.2023.3267221 · Cited by 37 · see citing works
An Exploratory Analysis on Users’ Contributions in Federated Learning
Huang, J., Talbi, R., Zhao, Z., Bouchenak, S., Chen, L. Y., & Roos, S. (2020) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa50397.2020.00014 · Cited by 35 · see citing works
Zhao, Y., Zhang, J., & Cao, Y. (2022) · Knowledge-Based Systems · doi:10.1016/j.knosys.2022.110072 · Cited by 30 · see citing works
Redeem Myself: Purifying Backdoors in Deep Learning Models using Self Attention Distillation
Gong, X., Chen, Y., Wang, Y., Wang, Q., Gu, Y., Huang, H., & Shen, C. Q. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179375 · Cited by 28 · see citing works
Backdoor attacks and defense mechanisms in federated learning: A survey
Li, Z., Lan, J., Yan, Z., & Erol Gelenbe, A. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103248 · Cited by 20 · see citing works
ATTEQ-NN: Attention-based QoE-aware Evasive Backdoor Attacks
Gong, X., Chen, Y., Dong, J., & Wang, Q. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24012 · Cited by 18 · see citing works
Improving Privacy-Preserving Vertical Federated Learning by Efficient Communication with ADMM
Xie, C., Chen, P., Li, Q., Nourian, A., Zhang, C., & Li, B. (2024) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml59370.2024.00029 · Cited by 16 · see citing works
BatFL: Backdoor Detection on Federated Learning in e-Health
Xi, B., Li, S., Li, J., Liu, H., Liu, H., & Zhu, H. (2021) · International Workshop on Quality of Service · doi:10.1109/iwqos52092.2021.9521339 · Cited by 16 · see citing works
Hijack Vertical Federated Learning Models as One Party
Qiu, P., Zhang, X., Ji, S., Li, C., Pu, Y., Yang, X., & Wang, T. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3358081 · Cited by 12 · see citing works
FDNet: Imperceptible backdoor attacks via frequency domain steganography and negative sampling
Dong, L., Fu, Z., Chen, L., Ding, H., Zheng, C., Cui, X., & Shen, Z. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.127546 · Cited by 9 · see citing works
Distributed GAN-Based Privacy-Preserving Publication of Vertically-Partitioned Data
Jiang, X., Zhang, Y., Zhou, X., & Großklags, J. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0050 · Cited by 8 · see citing works
Desirable Companion for Vertical Federated Learning
Zhang, Q., Gu, B., Dang, Z., Deng, C. D., & Huang, H. (2021) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3459637.3482249 · Cited by 8 · see citing works
Backdoor Attack on Encryption-Protected Vertical Federated Learning
Chen, J., Chen, D. Z., Cui, J., & Zhong, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3581095 · Cited by 3 · see citing works
Exploiting edge features for transferable adversarial attacks in distributed machine learning
Rossolini, G., Brau, F., Biondi, A., Biggio, B., & Buttazzo, G. (2025) · Internet of Things · doi:10.1016/j.iot.2025.101795 · Cited by 3 · see citing works
Zou, T., Liu, Y., Ye, X., Ouyang, Y., & Zhang, Y.-Q. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825545 · Cited by 3 · see citing works
Self-citationRoPA: Robust Privacy-Preserving Forward Aggregation for Split Vertical Federated Learning
Wang, L., Zhang, Z., Huang, M., Gai, K., Wang, J., & Shen, Y. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3569228 · Cited by 2 · see citing works
PPoison: A Pluggable Poisoning attack against distributed training of split learning
Liu, J., Lyu, X., Zheng, L., Ren, C., & Cui, Q. (2025) · Future Generation Computer Systems · doi:10.1016/j.future.2025.108045 · Cited by 2 · see citing works
Chen, Z., Zhang, M., Mostyn, C., Jiang, H., & Feng, X. (2024) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/ipccc59868.2024.10850041 · Cited by 1 · see citing works
A defense mechanism for federated learning in AIoT through critical gradient dimension extraction
Xu, J. H., Guo, B., Chen, F., Yan, S., Dai, S., Dai, C., & Hu, Y. (2025) · Computer Communications · doi:10.1016/j.comcom.2025.108114 · Cited by 3 · see citing works
VerifyVFL: Practical Verifiable Vertical Federated Learning
Hou, J., & Zhang, L. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00022 · Cited by 1 · see citing works
Exploiting Edge Features for Transferable Adversarial Attacks in Distributed Machine LearningPreprint
Rossolini, G., Brau, F., Biondi, A., Biggio, B., & Buttazzo, G. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5351376 · Cited by 1 · see citing works
Amiruddin, A., & Musdalifah, M. (2021) · Jurnal Abdimas Indonesia · doi:10.53769/jai.v1i4.149
Assessing vulnerabilities and securing federated learning
Chakraborty, S., & Bhagoji, A. N. (2024) · Elsevier eBooks · doi:10.1016/b978-0-44-319037-7.00012-0
Backdoor Attacks and Defense in FL
Li, S., Zhu, H., Wu, W., & Shen, X. (2024) · Wireless networks · doi:10.1007/978-3-031-57389-7_5
Federated Learning Defense Mechanism Based on Critical Gradient Dimension ExtractionPreprint
Xu, J. X., guo, B., Chen, F., Yan, S., Dai, S., Dai, C., & Hu, Y. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4867965
- Authors
- Liu, Y., Yi, Z., & Chen, T.
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2020
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2007.03608
- OpenAlex
- W3041668106
- Cited by
- 38
- References
- 19
- Citations by year
- 2025: 9 · 2024: 9 · 2023: 6 · 2022: 7 · 2021: 3 · 2020: 4
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- backdoor attacks, backdoor defense, malicious participants, federated learning, adversarial learning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
