Back to #federated learning

HBA: Hijacking-Based Backdoor Attack for Vertical Federated Learning

Sep 2026 · IEEE Internet of Things Journal · Vol 13, pp. 38642-38652 · 0 citations · 35 references

Abstract

Vertical federated learning (VFL) is a distributed machine learning paradigm designed for scenarios with vertically partitioned data features, making it highly compatible with Internet of Things (IoT) ecosystems. While promoting collaborative modeling among IoT devices, VFL also introduces new security risks, particularly backdoor attacks. Existing VFL backdoor attacks typically establish associations between triggers and target labels during the training phase by manipulating intermediate model outputs, making them easily detectable by advanced defense mechanisms. This article proposes a hijacking-based backdoor attack (HBA), which, for the first time, innovatively achieves a backdoor attack by exchanging the forward embeddings during the VFL prediction phase, without embedding traditional triggers. HBA leverages intrinsic semantic relationships in the embedding space to hijack the decision-making process of the top model during inference. HBA’s effectiveness depends on the discriminative nature of the features extracted by the bottom model, and since it does not alter the training process, it can evade most defense mechanisms based on training behavior monitoring. Experiments demonstrate that HBA achieves an attack success rate of 99.9% in classification tasks without compromising the original task’s accuracy. Furthermore, existing defense mechanisms struggle to effectively counter HBA without degrading the model’s original task performance.

View source

Similar papers

AoI Minimization in Heterogeneous MEC Networks: A Federated Learning-Assisted Hybrid DRL and Convex Approach

This paper investigates a dynamic heterogeneous mobile edge computing network (HMECN), where mobile devices (MDs) could offload their full tasks to a small base station (SBS) directly or the macro base station (MBS) in direct or relay mode. As age of information (AoI) is a comprehensive and accurate metric to capture the freshness of computation results, we formulate a long-term weighted sum AoI (LWSA) minimization problem in the HMECN by jointly optimizing the offloading decisions of MDs as well as the bandwidth and computation resource allocation of all base stations, subject to energy, delay and peak AoI constraints. To address the formulated non-convex mixed integer nonlinear programming problem, we decompose it into the offloading decision optimization (ODO) top-problem and the resource allocation optimization (RAO) sub-problem. Based on the decomposition, we propose a federated learning (FL)-assisted hybrid DRL and convex approach that is comprised of a safe multi-agent DRL algorithm, convex optimization and FL. The ODO top-problem is solved by the safe multi-agent DRL algorithm, which strictly ensures that the actions of each agent do not exceed its energy constraint and then paves the way for using convex optimization to solve the RAO sub-problem. FL is used to alleviate the training instability problem aggravated by multi-agent settings via breaking the limitation of partial knowledge for each individual agent. Simulation results demonstrate the superiority of the proposed approach in terms of the LWSA, convergence, scalability and robustness in dynamic environments.

Xiaoying Liu, Junhao Zheng, Kechen Zheng et al. · 8 citations

A Blockchain-Based Federated Learning Approach for Electricity Theft Detection Through Dual-Verification

Malicious clients participating in data collection and interaction may launch attacks such as model and data poisoning to degrade the performance of the global model and conceal their electricity theft behaviors. Although existing studies have introduced blockchain technology to achieve decentralization, they still suffer from limited pre-aggregation validation dimensions. To address these issues, this paper proposes a blockchain-based federated learning approach with dual-verification (BFL-DV) for electricity theft detection. In the pre-aggregation stage, a multi-metric reputation-based consensus committee verification strategy is designed, which effectively mitigates the impact of malicious participants. In the post-aggregation stage, a dynamic threshold-based blockchain verification strategy is developed to counter security risks during the transmission process, which can refuse malicious global updates adaptively. Experimental results demonstrate that BFL-DV can accurately reduce the impact of all malicious clients under the data poisoning attack. Notably, across various proportions of malicious clients, the proposed framework achieves an average AUC improvement of 32.68% compared with SOTA methods, demonstrating its consistent performance advantage.

Fanghong Guo, Yaoming Lang, Shengwei Li et al. · 1 citation

Efficient Backdoor Mitigation in Federated Learning With Contrastive Loss

The rapid adoption of Internet of Things (IoT) devices has accelerated the need for privacy-preserving machine learning techniques, such as federated learning (FL). However, the decentralized and collaborative nature of FL makes it vulnerable to backdoor attacks, where adversaries locally update their malicious models before contributing to the global aggregation, subtly injecting backdoors without degrading the normal performance. An affected model behaves as expected during regular operations but exhibits malicious behavior when an embedded trigger is presented. In this article, we propose a novel self-supervised contrastive-learning-based approach to detect and mitigate backdoor attacks in FL within IoT environments. Unlike conventional reverse-engineering methods that iterate through each class in the dataset to reconstruct triggers, our approach directly regenerates triggers from compromised global models without class iteration. This is achieved by comparing last-layer feature representations of a potentially compromised model with those of a relatively clean model under the guidance of contrastive loss. The reverse-engineered trigger is then leveraged to patch the global model and remove the backdoors. We evaluate our method on three benchmark datasets under two federated backdoor attack scenarios, simulating IoT device collaborations. Extended experiments are also conducted on a transformer-based model and two mitigation methods to assess the robustness of our approach. Our results demonstrate that while traditional reverse-engineering techniques are effective in centralized settings, they struggle to detect backdoors in FL. Comparatively, our method is resilient against backdoor attacks across various settings. In addition, our method is more time-efficient because of its capability of generating the backdoor trigger directly without iterating through all classes.

Hal Ferguson, Rui Ning, Hongyi Wu et al. · 0 citations

Related blog posts