Adversarial Examples on Vertical Federated Split Learning by Using Gradient Sign Prediction

Vertical federated split learning (VFSL) is a technique in which multiple clients and a single server cooperate to train a deep neural network model. In VFSL, the DNN model is split between the clients and the server. They exchange intermediate features and gradients of the loss at the split boundary to perform both training and inference. This approach enables effective model training while preserving data confidentiality, as it avoids directly sharing input data and labels directly. In this paper, we investigate an adversarial examples (AEs) generation attack in a VFSL setting, where clients and the server continue to collaborate during the inference phase. Specifically, a malicious attacker, who is one of the clients, manipulates the intermediate feature sent to the server so that it behaves as AEs to mislead the inference results. To generate AEs, the attacker needs to obtain the gradient of the loss (calculated from the inference result and the ground-truth label) with respect to the intermediate feature. However, during inference, the server does not transmit gradients. Accordingly, the attacker trains an attack model using the intermediate features and gradients available during the training phase, which is then used to estimate the sign of the gradient from the target intermediate feature during inference. A variant of the fast gradient sign method (FGSM) algorithm is used to generate AEs. Our experimental results demonstrate that the generated AEs significantly degrade inference accuracy compared to perturbations generated by random noise.