🤖 machine learning

TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning

This paper proposes Target-Oriented Feature Decoupling (TOFD), a unified framework for Split Federated Learning that integrates target inference, sample purification, and decoupling optimization to proactively detect and robustly mitigate diverse poisoning attacks while maintaining low computational overhead.

Original authors: Yuhan Xie, Jingrong Huang, Chen Lyu

Published 2026-08-10

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yuhan Xie, Jingrong Huang, Chen Lyu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where your smartphone, your smartwatch, and your neighbor's laptop all team up to learn a new skill, like recognizing rare birds or diagnosing skin conditions, without ever sharing their private photos. This is the promise of Federated Learning: a way for computers to learn together while keeping data locked on their own devices. But there's a catch. To make this work on phones with limited battery and power, scientists invented Split Federated Learning. Think of it like a relay race where the first runner (your phone) runs part of the track, hands the baton (a compressed, scrambled version of the data) to the coach (a powerful central server), who finishes the race. This saves your phone's energy and keeps your photos private.

However, just like any relay race, there's a risk of a saboteur. A malicious player could try to swap the baton for a fake one, or run the wrong path, tricking the whole team into learning the wrong thing. This is called a poisoning attack. In the past, defenses against these attacks were often too heavy for the server to handle or too slow to catch the cheaters before they ruined the game. The big question researchers are trying to answer is: How do we spot the fake batons and the cheaters instantly, without slowing down the race or throwing out the honest runners?

This is where a new framework called TOFD (Target-Oriented Feature Decoupling) comes in. The authors, Yuhan Xie, Jingrong Huang, and Chen Lyu, propose a clever three-step system to protect Split Federated Learning from these poisoning attacks. They argue that because the "baton" (the smashed data) passes through the server, it's the perfect place to catch the troublemakers.

First, TOFD plays detective to figure out who is trying to cheat and what they are targeting. Instead of checking every single runner, it looks for "safe zones" for each type of data (like a specific bird species). If a runner's baton looks weirdly different from the group's usual pattern, the system flags them. But here's the trick: it knows that sometimes honest runners might just be running a bit differently because they have different data (like a different camera). So, it uses a special "Margin Perturbation" test to tell the difference between a harmless variation and a malicious attack.

Second, once the system knows which class of data is under attack, it doesn't just ban the whole runner. Instead, it performs Sample Purification. Imagine a bouncer at a club who doesn't kick out the whole group, but carefully checks each person's ID. TOFD filters out only the specific "poisoned" batons from the suspicious runners while keeping the honest ones. This ensures the team still has enough data to learn from without getting contaminated.

Finally, even after filtering, some sneaky patterns might slip through. To handle this, TOFD uses a Decoupling Optimization strategy. It trains a special "guidance model" that learns what the poison looks like. Then, during the main training, it actively pushes the server's model away from those bad patterns, effectively neutralizing the poison's influence.

The researchers tested this system on five different datasets, including images of skin lesions and handwritten digits. Their results suggest that TOFD is highly effective at catching various types of attacks—whether the cheaters are faking the data, the labels, or the model weights—while keeping the system fast and efficient. They also provided mathematical proofs to show that the system will eventually settle down and learn correctly. In short, TOFD offers a robust, lightweight shield that lets collaborative AI learn safely, even when some participants try to play dirty.

Technical Summary: TOFD – Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning

1. Problem Statement

Split Federated Learning (SFL) combines the privacy benefits of Federated Learning (FL) with the computational efficiency of Split Learning (SL) by partitioning models between clients and servers. While clients transmit intermediate representations ("smashed data") to the server for further processing, this architecture introduces unique vulnerabilities. Unlike standard FL, where defenses often focus on model updates, SFL is susceptible to poisoning attacks targeting specific stages of the pipeline, including local feature representations, labels, smashed data, and client-side weights.

Existing defense mechanisms, largely adapted from conventional FL, fail to leverage the specific characteristics of the SFL architecture. They often overlook the pivotal role of smashed data as the primary conduit for poisoning signals. Consequently, current methods struggle with three main challenges:

High Overhead: Frequent transmission of smashed data necessitates lightweight detection mechanisms to avoid prohibitive communication costs.
Non-IID Confusion: In dynamic systems, distinguishing between benign non-IID data distributions and malicious adversarial manipulation is difficult, leading to high false-positive rates.
Residual Effects: Even if poisoned data is filtered, malicious client-side models may still contaminate the global model through aggregation, leaving residual adversarial effects.

2. Methodology: TOFD Framework

The authors propose Target-Oriented Feature Decoupling (TOFD), a unified framework that integrates proactive detection with robust optimization. TOFD operates through a three-stage pipeline:

Stage 1: Target Inference (Class-Wise Attack Target Inference)

This stage aims to identify potential attack targets with low overhead by narrowing the scope to suspicious classes.

Initial Safe Zone Construction: The system models the class-wise feature distribution of smashed data using an empirical Gaussian approach. It calculates the 2-Wasserstein distance between a client's local distribution and the historical global distribution. A modified Z-score identifies an initial set of "suspicious clients" falling outside a safe zone.
Distributional Consistency Verification: To distinguish malicious behavior from benign non-IID variations, the framework introduces a Distributional Consistency Score (DCS). It measures the distributional shift induced by a suspicious client.
Margin Perturbation (MP): A threshold is established based on the maximum permissible deviation within the benign distribution (MP). Clients whose DCS falls within the MP are retained as benign; those exceeding it are identified as malicious and inferred to be targeting specific classes.

Stage 2: Sample Purification (Class-Calibrated Sample Purification)

Rather than discarding entire clients (which reduces data diversity), TOFD performs fine-grained filtering on the identified target classes.

Adaptive Thresholding: For samples within a target class, the deviation from the global distribution is quantified. A class-calibrated threshold ( $\tau_k$ ) is dynamically calculated using the interquartile range (IQR) and the MP values. This threshold adapts to the specific dispersion characteristics of each class.
Filtering: Samples exceeding the threshold are classified as malicious ( $Z^-$ ), while those below are retained as benign ( $Z^+$ ). This ensures that only validated benign representations update the global distribution and server-side model.

Stage 3: Decoupling Optimization (Malicious Feature Decoupling)

To address residual adversarial influence from malicious client-side models that may persist after filtering, TOFD integrates a decoupling objective into the server-side optimization.

Adversarial Guidance Model: A guidance model ( $R$ ), sharing the architecture of the server-side model, is fine-tuned on the detected malicious smashed data ( $Z^-$ ) to capture attack-induced patterns.
Joint Loss Function: The server-side model is optimized using a joint loss function comprising:
1. Cross-Entropy Loss ( $L_{CE}$ ): Trained on the validated benign data ( $Z^+$ ) to maintain task performance.
2. Decoupling Loss ( $L_{MFD}$ ): Maximizes the Kullback–Leibler (KL) divergence between the server-side model and the adversarial guidance model on the malicious data ( $Z^-$ ). This forces the server to diverge from the attack patterns while preserving benign feature integrity.

3. Key Contributions

The paper outlines four primary contributions:

Unified Framework: TOFD is presented as a framework that systematically integrates fine-grained detection with SFL optimization, enabling effective mitigation of a wide range of poisoning attacks (data, weight, smashed, label, and multi-vector).
Disentanglement Mechanism: By leveraging class-wise inference and Margin Perturbation, the method disentangles malicious behavior from benign non-IID variations without sacrificing data diversity.
Residual Suppression: An adversarial guidance-based decoupling strategy is developed to suppress residual attack influence that persists beyond the detection phase.
Theoretical Guarantees: The authors provide a formal theoretical analysis characterizing the computational complexity and establishing convergence guarantees for the TOFD framework.

4. Experimental Results

Extensive experiments were conducted across five datasets (HAM10k, MNIST, F-MNIST, CIFAR10, CIFAR100) and diverse model architectures (DenseNet121, ResNet18, ResNet50).

Performance: TOFD consistently outperformed state-of-the-art defenses across diverse attack scenarios, including extreme data heterogeneity.
Metrics: The framework demonstrated superior robustness (maintaining high accuracy under attack) while incurring low computational overhead, making it suitable for practical deployment.
Efficiency: The method achieved high Malicious Sample Detection Rates (MSDR) while preserving the performance of benign clients.

5. Significance and Claims

The paper claims that TOFD addresses a critical gap in SFL security by moving beyond simple adaptation of FL defenses. Its significance lies in:

Exploiting the Split Paradigm: It uniquely utilizes the smashed data interface as a strategic checkpoint for early-stage intervention, a feature specific to SFL that previous works overlooked.
Balancing Robustness and Utility: By employing class-calibrated filtering rather than client-level exclusion, it maintains data diversity and model performance in non-IID settings.
Systemic Mitigation: The integration of decoupling optimization ensures that even if some malicious signals bypass detection, their influence on the final global model is suppressed.

The authors conclude that TOFD offers a theoretically grounded, efficient, and robust solution for securing Split Federated Learning against complex poisoning threats.