ProtoGuard-SL: Prototype Consistency Based Backdoor Defense for Vertical Split Learning

1. Problem Statement

Vertical Split Learning (SL) is a collaborative learning paradigm where multiple clients hold complementary feature subsets of the same samples, while a central server holds the labels. Clients train local "bottom" models to generate intermediate embeddings, which are sent to the server to train a "top" model. While this preserves raw data privacy, it introduces a critical vulnerability: embedding-space backdoor attacks.

• The Threat: Malicious clients can compromise the training process by injecting "triggers" into the intermediate embeddings. Unlike data-level poisoning, these attacks manipulate the representation space directly.
• The Challenge: Existing defenses (e.g., Differential Privacy, Model Pruning) often fail against stealthy, adaptive attacks (like VILLAIN or SplitNN backdoors). In these attacks, poisoned embeddings are designed to have distributions that heavily overlap with benign embeddings in the original feature space, making them indistinguishable using standard geometric or anomaly detection criteria.

2. Methodology: ProtoGuard-SL

The authors propose ProtoGuard-SL, a server-side defense mechanism that exploits the observation that while backdoor attacks can evade geometric detection, they inevitably disrupt the semantic consistency shared by benign samples within the same class.

The method operates in a two-stage framework:

Stage 1: Prototype-Based Consistency Representation

Instead of analyzing embeddings in their original high-dimensional space, ProtoGuard-SL transforms them into a relational space based on class prototypes.

1. Class Prototype Construction: The server computes a robust prototype ($p_c$) for each class $c$ using the coordinate-wise median of the embeddings belonging to that class. The median is used to ensure robustness against a small fraction of poisoned samples.
2. Consistency Transformation: Each embedding $E_k$ is transformed into a consistency vector $v_k$. This vector consists of the cosine similarities between $E_k$ and all class prototypes ($p_1, p_2, ..., p_{|C|}$).
   • Effect: Benign samples exhibit stable similarity patterns relative to their class prototype. Poisoned samples, due to semantic distortion, produce anomalous similarity profiles, creating a clear separation in this new space (as visualized in the paper's Fig. 1).

Stage 2: Class-Conditional Conformal Filtering

Once embeddings are mapped to the consistency space, the system identifies and removes anomalies without assuming a specific parametric distribution.

1. Deviation Scoring: For each class, a reference pattern ($\mu_c$) is calculated as the median of the consistency vectors for that class. A deviation score ($s_k$) is computed as the Euclidean distance between an embedding's vector and its class reference.
2. Conformal Filtering: The system calculates a conformal p-value for each embedding based on its rank among the deviation scores of its own class.
   • If the p-value is below a significance level $\alpha$, the embedding is flagged as poisoned and removed.
   • This approach is distribution-free, making it robust to scale variations and class imbalances.

3. Key Contributions

1. Identification of a Fundamental Property: The paper identifies class-conditional representation consistency as a core property of benign embeddings in SL and demonstrates how backdoor attacks disrupt this structure even when they evade geometric detection.
2. Novel Representation Space: The proposal of a prototype-based consistency representation that maps embeddings into a relational space, significantly enhancing the separability between benign and poisoned samples.
3. Robust Filtering Mechanism: The design of a class-conditional, distribution-free conformal filter that effectively mitigates attacks while preserving benign data and overall model performance, avoiding the need for assumptions about data distributions.

4. Experimental Results

The authors evaluated ProtoGuard-SL on three datasets (CIFAR-10, SVHN, and Bank Marketing) under three distinct attack scenarios (VILLAIN, SplitNN, and BadVFL).

• Performance Metrics:
  • Main Accuracy (MA): Measures the model's performance on clean data.
  • Attack Success Rate (ASR): Measures the percentage of triggered samples misclassified as the target.
• Key Findings:
  • State-of-the-Art (SOTA) Performance: ProtoGuard-SL consistently outperformed baselines (DP, MP, ANP, VFLIP). It achieved the highest MA (often >0.83) while reducing ASR to near-zero levels (0.03–0.08).
  • Comparison with Baselines: Existing defenses either failed to reduce ASR significantly or caused a severe drop in MA (e.g., VFLIP reduced ASR but dropped MA significantly on CIFAR-10).
  • Ablation Studies: Removing the consistency representation caused the most severe performance degradation, confirming its critical role.
  • Scalability: The method maintained high robustness as the number of participating clients increased (from 2 to 8), whereas baseline defenses degraded.
  • Architecture Independence: The defense worked effectively across different bottom model architectures (ResNet-18, VGG-19, FCN).

5. Significance

• Security for Vertical Learning: This work addresses a critical gap in the security of Vertical Split Learning, a growing paradigm for privacy-preserving collaboration in sectors like healthcare and finance.
• Stealth Attack Mitigation: By shifting the detection focus from geometric outliers to semantic consistency, ProtoGuard-SL effectively counters sophisticated, adaptive backdoor attacks that are designed to look "normal" in the original feature space.
• Practical Deployment: The method is server-side, requires no changes to client architectures, and does not rely on strict distributional assumptions, making it highly practical for real-world deployment in heterogeneous environments.

In conclusion, ProtoGuard-SL provides a robust, theoretically grounded, and empirically validated solution to secure Vertical Split Learning against embedding-level backdoor attacks, balancing high model utility with strong security guarantees.