Defend vertical federated learning from active label inference attacks
Embedding Asymmetry as Attack Signal: Detecting and Defending Active Label Inference in Vertical Federated Learning
Cryptography and Security
Summary
Vertical federated learning allows different organizations to train a shared model without revealing all their data. However, a clever attacker can use a trick called active label inference to guess private labels held by others. The authors found a way to detect this attack by noticing unusual patterns in the data embeddings shared during training. They then developed a defense that adjusts the attacker’s updates to prevent label guessing while keeping the shared model’s accuracy high.
What this means in practice
- •For data security teams: Detect and mitigate active label inference attacks during collaborative model training in vertical federated learning setups.
- •For machine learning engineers: Implement defenses that preserve model accuracy while blocking malicious attempts to extract private labels in multi-party training.
Authors
Soumya Swagata Biswas, Muhammad Abdullah Adnan
Abstract
Vertical federated learning lets organizations train a shared model over features they hold separately, while one party keeps the labels private. The active label inference attack of Fu et al. [12] breaks this: a feature-holding party runs a modified optimizer, MaliciousSGD, that forces class structure into its embeddings and then recovers the labels with semi-supervised learning. Defenses that perturb the shared gradient fail, because the attack acts on the party's internal optimizer, not on the message it sends. We show the attack leaves a signal the server can read from the embeddings it already receives. The adversary's Fisher class-separability pulls away from the honest party's, and the gap is visible within a few epochs. A defense triggered by this signal acts on the adversary alone. Scaling its gradient down handles few-class tasks, and a norm non-expansive projection handles many-class tasks, with the Discriminative Coverage Ratio explaining why the projection rank must grow with the class count. The defense breaks the alignment between embedding clusters and labels rather than destroying the embedding. Across four seeds on CIFAR-10, CIFAR-100, and CINIC-10, label inference falls below what honest training already leaks, at under two points of task-accuracy cost.