Aug 2026· IEEE Transactions on Pattern Analysis and Machine Intelligence· Vol PP· 0 citations
Medicine
TL;DR
This article proposes a novel adaptive obfuscation mechanism, coined FedAdOb, to protect private data without yielding original model performances, and utilizes passport-based adaptive obfuscation to ensure data privacy in both horizontal and vertical federated learning settings.
Abstract
Federated learning (FL) has emerged as a collaborative approach that allows multiple clients to jointly learn a machine learning model without sharing their private data. The concern about privacy leakage, albeit demonstrated under specific conditions [1], has triggered numerous follow-up research in designing powerful attacking methods and effective defending mechanisms aiming to thwart these attacking methods. Nevertheless, privacy-preserving mechanisms employed in these defending methods invariably lead to compromised model performances due to a fixed obfuscation applied to private data or gradients. In this article, we, therefore, propose a novel adaptive obfuscation mechanism, coined FedAdOb, to protect private data without yielding original model performances. Technically, FedAdOb utilizes passport-based adaptive obfuscation to ensure data privacy in both horizontal and vertical federated learning settings. The privacy-preserving capabilities of FedAdOb, specifically with regard to private features and labels, are theoretically proven through Theorems 1 and 2. Furthermore, extensive experimental evaluations conducted on various datasets and network architectures demonstrate the effectiveness of FedAdOb by manifesting its superior trade-off between privacy preservation and model performance, surpassing existing methods.
Vertical Federated Learning (VFL) allows multiple organizations with disjoint feature spaces and overlapping sample identities to collaboratively train machine learning models while keeping local data. Despite its privacy-preserving design, recent studies have shown that VFL is vulnerable to backdoor attacks. In particular, a malicious passive party can inject a carefully crafted trigger into its local inputs or intermediate embeddings, causing the global model to produce targeted mispredictions at inference time. Existing backdoor attacks in VFL (e.g., BadVFL) rely on the assumption that the malicious client can obtain additional knowledge about task labels, which contradicts the core privacy assumptions of VFL. In this paper, we propose GOFA, a new backdoor attack method for VFL scenarios. GOFA uses the gradient feedback from the server to construct a poisoned dataset and employs an adversarial example attack (e.g., FGSM) for masking the original features of the data to enhance trigger learning. We use the CIFAR-10 and UCI-HAR datasets. Our experiments demonstrate the effectiveness of our method in various settings.
Ye Cheng, Naotoshi Adachi· 2026 6th International Confe...· 0 citations
This study implemented a comprehensive experimental framework for analysing FL performance using standard FL aggregation protocols FedAvg, FedProx, and SCAFFOLD in conjunction with Differential Privacy mechanisms; specifically, the Gaussian noise mechanism with Rényi Differential Privacy (RDP) accountants.
Federated learning is appealing for privacy-sensitive network systems, yet its practical deployment remains hindered by the following three recurring challenges: (1) client drift under non-IID data, (2) vulnerability to corrupted updates, and (3) the communication cost of repeated model exchange. Most existing approaches address these issues in isolation. While analytically convenient, this separation often fails to reflect real-world conditions. For instance, defenses against poisoning may suppress useful updates, while personalization and compression can alter the aggregation geometry itself. In this paper, we study these effects jointly and propose URP-FL, a compact training framework that integrates reliability-aware aggregation, local regularization for drift control, and sparse client uploads. We provide theoretical analysis establishing a convergence bound with distinct terms capturing optimization error, data heterogeneity, and adversarial impact. Experiments on a non-IID image classification benchmark with sign-flip and label-flip attacks demonstrate the benefits of the unified design. Compared to FedAvg and FedProx, this URP-FL maintains accuracy under attack while reducing transmitted parameters by approximately 75%. Rather than presenting a production ready system, it offers a reproducible and technically coherent step toward federated learning that is more robust under realistic conditions.
Hua Kun, Wei Wang· 2026 International Conferenc...· 0 citations
Federated Learning (FL) facilitates distributed training while preserving privacy, yet remains highly vulnerable to backdoor attacks. Existing defenses primarily address these threats via robust aggregation, which reduces the influence of malicious contributions (e.g., pruning, reweighting), or through detection-based filtering that discards anomalous updates prior to aggregation. Nevertheless, existing defenses primarily suppress or discard malicious updates, inevitably sacrificing task-relevant knowledge and leading to reduced clean-task accuracy. To this end, we propose FedPurify, a framework that performs post-training data-free purification to remove malicious backdoors while preserving task-relevant knowledge. Specifically, following global convergence without loss of task-relevant knowledge, FedPurify proposes a fully data-free sample synthesis scheme to generate diverse and representative samples from the converged global model, thereby inherently preserving client privacy in FL. Building upon these synthetic samples, FedPurify further leverages data-free trigger inversion to effectively expose latent backdoor behaviors. Finally, FedPurify combines contrastive feature alignment with knowledge-preserving self-distillation to remove backdoor effects while preserving benign task performance. Extensive experiments verify that FedPurify effectively removes backdoors from the global model with negligible impact on clean performance, outperforming existing defense methods.
Baolu Xue, Hanyuan Zheng, T. Man et al.· Proceedings of the 32nd ACM...· 0 citations
This work provides a unified approach for aiding the design of state-of-the-art privacy-preserving distributed learning systems that are also utility-optimal and is an important step towards using such approaches in high-stakes domains like healthcare or finance.
A. M., Nitish Kumar· International Journal of Mat...· 0 citations
FedRGD is a federated risk-guided dynamic defense framework that enables efficient fine-grained protection against backdoor attacks in non-IID environments, and combines feature inconsistency detection with lightweight masking and robust aggregation to achieve both accuracy and efficiency.
Rui-Ying Wang· Poster Volume 0008 The 2026...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
