Split federated learning (SFL) is renowned for its low computational overhead, extremely suitable for resource-constrained edge computing scenarios while inheriting privacy-preserving characteristics from federated learning (FL). In this framework, clients employ lightweight models to process private data locally and transmit intermediate outputs to a powerful server for further computation. However, SFL is a double-edged sword: while it enables edge computing and enhances privacy, it also introduces intellectual property ambiguity as both clients and the server jointly contribute to training. Existing watermarking techniques fail to protect both sides since no single participant possesses the complete model. To address this, we propose a robust model intellectual property protection scheme using client–server watermark embedding (RISE) for SFL. Specifically, RISE adopts an asymmetric client–server watermarking design: the server embeds feature-based watermarks through a loss regularization term, while clients embed backdoor-based watermarks by injecting predefined trigger samples into private datasets. This co-embedding strategy enables both clients and the server to verify model ownership. Experimental results on standard datasets and multiple network architectures show that RISE achieves over 95% watermark detection rate ( $p$ -value $\lt {\,}0.03$ ) across most settings. It exhibits no mutual interference between client- and server-side watermarks and remains robust against common removal attacks. Our source code is available at GitHub
Jia-Xiong Tang, Zhengchunmin Dai, Liantao Wu et al.· IEEE Internet of Things Jour...· 0 citations
Federated learning (FL) is susceptible to poisoning attacks, where malicious clients manipulate local data or models to disrupt training. The system and data heterogeneity inherent in practical FL systems exacerbates these vulnerabilities, rendering existing defense mechanisms ineffective or infeasible. Specifically, distinguishing benign local models, trained on heterogeneous client data, from poisoned ones presents a significant challenge. Moreover, semi-asynchronous FL (SAFL) paradigms, commonly employed to address system heterogeneity, further complicate this issue by preventing fair evaluation of local models originating from different global models (i.e., with varying staleness). In this work, we propose a novel defensive framework (namely Fed-Beta) for robust and accurate FL model training under system and data heterogeneity. First, we introduce a staleness-aware SAFL paradigm, where the server accepts only a fixed number of local models per round and groups them based on their staleness. Then, we implement a two-stage aggregation mechanism. Specifically, we develop a robust intra-group aggregation method using model inversion to evaluate data-domain discrepancies among clients. This method accurately identifies and excludes malicious local models from aggregation, producing a reliable representative model for each group. Moreover, we design a model-consistency-aware inter-group aggregation method, which selectively aggregates group representative models with consistent update directions to update the global model. Theoretically, we conduct rigorous convergence analysis of Fed-Beta, offering insights into how system and data heterogeneity affect the defensive performance. Empirically, extensive experiments corroborate its superiority over existing schemes.
Peng Sun, Tao Liu, Yang Xu et al.· IEEE Transactions on Mobile...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
