🤖 AI

VTarbel: Targeted Label Attack with Minimal Knowledge on Detector-enhanced Vertical Federated Learning

This paper introduces VTarbel, a two-stage targeted label attack framework for Vertical Federated Learning that operates with minimal knowledge to successfully evade anomaly detectors and outperform existing state-of-the-art methods.

Original authors: Juntao Tan, Anran Li, Quanchao Liu, Peng Ran, Lan Zhang

Published 2026-01-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Juntao Tan, Anran Li, Quanchao Liu, Peng Ran, Lan Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: A Secret Team Project

Imagine a group of people trying to solve a mystery (like diagnosing a disease or spotting a fake loan application) by working together.

The Team: Each person holds a different piece of the puzzle. One person has the patient's age and income, another has their medical history, and a third has their location.
The Rule: They cannot share their private papers (raw data) with each other. Instead, they only share "clues" (mathematical summaries called embeddings) to build a master detective (the AI model).
The Guard: To keep things safe, the team leader (the "Active Party") has a security guard (an Anomaly Detector) who checks every clue. If a clue looks weird or suspicious, the guard throws it out and says, "No entry!"

The Problem: The Sneaky Saboteur

The paper focuses on a specific type of bad actor: a Passive Party (a team member who only provides clues but doesn't hold the final answer key).

This bad actor wants to trick the team into making a specific mistake. For example, they want the AI to say "This person is healthy" when they are actually sick, or "This loan is safe" when it's risky. This is called a Targeted Label Attack.

Why is this hard?

Blindfolded: The bad actor doesn't know the full details of the team's master detective (the model).
Limited Power: They can only change their own clues, not everyone else's.
The Guard: The security guard is watching closely. If the bad actor tries to change their clues too much to trick the AI, the guard will spot the weirdness and block the entry.

Previous attempts to hack this system failed because they tried to force the clues to be so "perfect" for the trick that they looked obviously fake to the security guard.

The Solution: VTarbel (The Two-Stage Heist)

The authors created a new method called VTarbel. Instead of trying to break in all at once, they split the job into two phases: Preparation and The Attack.

Phase 1: The Reconnaissance (Preparation Stage)

Before trying to trick the system, the bad actor plays by the rules for a little while.

The Analogy: Imagine a spy entering a bank. Instead of robbing it immediately, they stand in line for a few minutes, watching how the security guard reacts to normal customers.
What they do: The attacker sends in a small, carefully chosen group of normal-looking clues. They listen to what the team says about them.
The Goal: By watching the results, the attacker builds two fake tools on their own computer:
1. A Fake Security Guard: They learn how the real guard decides what is "weird."
2. A Fake Detective: They build a copy of the team's master detective to practice on.
The Secret Sauce: They don't just pick random clues to test. They use a special math trick (called MMD) to pick the most expressive clues—ones that tell them the most about how the system works with the fewest number of tries.

Phase 2: The Heist (Attack Stage)

Now that the attacker has their fake tools, they launch the real attack on the remaining clues.

The Analogy: The spy now knows exactly how the guard thinks. They craft a disguise that is just "weird enough" to trick the master detective, but "normal enough" to pass the security guard.
What they do: They tweak their clues slightly. They use their Fake Detective to make sure the tweak tricks the AI into giving the wrong answer. Simultaneously, they use their Fake Guard to make sure the tweak doesn't look suspicious.
The Result: The clues slip past the real guard and successfully trick the team's AI into making the specific mistake the attacker wanted.

Why This Matters

The paper tested this method against four different types of AI models and seven different datasets (like images of cars, text reviews, and financial data).

The Results: VTarbel was a huge success. While old hacking methods failed almost completely when a security guard was present (getting 0% success), VTarbel succeeded in 80% to 90% of cases.
The Defense: The authors also tried to stop VTarbel using common defenses (like adding noise or compressing data). While some defenses helped a little, none could completely stop the attack without also hurting the team's ability to do its actual job (like diagnosing patients correctly).

The Takeaway

The paper reveals a blind spot in how Vertical Federated Learning systems are currently secured. Even with a security guard watching, a smart attacker who plays the "long game" (learning the system first) can slip past the guard and manipulate the results. The authors argue that we need new, stronger defenses because this type of "minimal knowledge" attack is very practical and dangerous.

Technical Summary: VTarbel

Problem Definition

Vertical Federated Learning (VFL) enables multiple parties with disjoint feature sets to collaboratively train models without sharing raw data. While privacy vulnerabilities (e.g., feature reconstruction and label inference) are well-studied, the security robustness of VFL against targeted label attacks during the inference phase remains underexplored. In such attacks, a compromised passive party manipulates its input features to force the global model to misclassify samples into an adversary-chosen label.

Existing targeted label attack methods suffer from two critical limitations in practical scenarios:

Unrealistic Adversarial Knowledge: Prior works often assume the attacker has access to labeled auxiliary datasets, global model outputs (logits/probabilities), or test samples from other participants. In reality, labels are proprietary to the active party and are never shared.
Neglect of Anomaly Detection: Real-world VFL deployments often employ anomaly detectors (e.g., statistical or ML-based) to filter suspicious feature embeddings. Existing attacks generate overly optimized embeddings that deviate significantly from the benign distribution, making them easily detectable and causing the system to reject the input (outputting a "REJ" label) rather than the targeted label.

The core challenge is to design an attack that operates under minimal adversarial knowledge (no access to labels, global outputs, or other parties' data) while effectively evading detector-enhanced VFL systems.

Methodology: VTarbel Framework

The authors propose VTarbel (VFL Inference Targeted Label Attack), a two-stage framework designed to bridge the gap between minimal knowledge and effective evasion. The framework partitions the inference phase into a Preparation Stage and an Attack Stage.

1. Preparation Stage (Knowledge Gathering)

The goal is to collect essential knowledge to train local surrogate models without consuming the majority of the test set.

Sample Selection: The attacker selects a minimal set of "high-expressiveness" benign samples from the unlabeled test set. This selection is driven by Maximum Mean Discrepancy (MMD). The attacker iteratively selects samples that maximize the reduction in MMD between the selected subset and the full test set distribution, ensuring the subset is representative.
Label Acquisition: These selected samples are submitted to the VFL system following the standard protocol. The returned predicted labels (excluding "REJ") are treated as pseudo-labels.
Local Model Training: Using the selected samples and their pseudo-labels, the attacker locally trains two critical components:
- Estimated Detector: An approximation of the defender's anomaly detector (e.g., DeepAE or KDE) to estimate detection boundaries.
- Surrogate Model: A model constructed by appending an inference head to the attacker's trained bottom model, mimicking the global VFL model's behavior.

2. Attack Stage (Adversarial Crafting)

The attacker uses the trained surrogate model and estimated detector to generate adversarial instances for the remaining test samples.

Optimization Objective: The attacker performs gradient-based optimization (Projected Gradient Descent) to perturb the remaining raw features. The objective function minimizes the cross-entropy loss between the surrogate model's prediction and the targeted label, while simultaneously minimizing the anomaly score predicted by the estimated detector.
Constraints: The perturbations are constrained by a distance bound ( $L_p$ -norm) to ensure the modified features remain valid and imperceptible.
Execution: The optimized malicious embeddings are submitted to the VFL system. Due to the transferability of adversarial examples, these embeddings are designed to induce the global model to predict the targeted label while remaining within the "normal" distribution accepted by the defender's detector.

Key Contributions

Formalization of the Problem: The authors formalize the targeted label attack in VFL as a combinatorial optimization problem: selecting an optimal subset of test samples to maximize the number of misclassifications into a specific label. They identify this as NP-hard and propose a two-stage partitioning to solve it practically.
Minimal-Knowledge Attack Framework: VTarbel is the first framework designed to operate under realistic constraints (no labels, no global outputs) while explicitly accounting for anomaly detectors. It utilizes a two-stage paradigm where the preparation stage minimizes sample usage to train expressive local models, preserving the majority of samples for the attack.
Extensive Evaluation: The framework is evaluated across four model architectures (MLP3, VGG13, ResNet18, DistilBERT), seven multimodal datasets (TabFMNIST, CIFAR10, CINIC10, CIFAR100, TREC, IMDB), and two anomaly detectors (DeepAE, KDE).

Experimental Results

Superior Performance: VTarbel consistently outperforms four state-of-the-art baselines (LR-BA, HijackVFL, ADI, TIFS'23). For instance, on the VGG13 model with a DeepAE detector, VTarbel achieves an Attack Success Rate (ASR) of 90.39%, whereas the best baseline achieves only 49.62%. In many configurations, baselines drop to near-zero ASR when detectors are active, while VTarbel maintains high success rates.
Detector Evasion: The framework successfully evades detection. The authors demonstrate that VTarbel's ASR remains high even when the defender's detection threshold is tightened, whereas other methods fail completely.
Robustness to Defenses: The paper evaluates three common privacy-preserving defenses (Noisy Embedding, Discrete Embedding, Compressed Embedding). While Compressed Embedding shows some mitigation (reducing ASR to ~47-7% depending on the dataset), it comes at a significant cost to the main task's inference accuracy (dropping by >10-20%). The other two defenses are largely ineffective against VTarbel.
Ablation Studies: Experiments confirm that both stages are necessary; removing the preparation stage (Only-Attack) results in 0% ASR due to the lack of a trained surrogate model. Furthermore, the MMD-based sample selection significantly outperforms random selection, especially in imbalanced datasets.

Significance and Claims

The paper claims that VTarbel reveals critical security blind spots in current VFL deployments. It demonstrates that even with minimal knowledge and in the presence of anomaly detectors, a passive party can effectively manipulate VFL inference outcomes. The authors emphasize that existing defenses are insufficient, as they either fail to stop the attack or severely degrade the utility of the VFL system. The work underscores an urgent need for developing robust, attack-aware defenses that can maintain high inference accuracy while mitigating targeted label attacks. The authors do not claim to have solved the defense problem but rather highlight the severity of the threat to motivate future research.