ADI：垂直联邦学习系统中的对抗性支配输入
ADI: Adversarial Dominating Inputs in Vertical Federated Learning Systems
AI总结：
本文揭示了垂直联邦学习系统中存在的对抗性支配输入（ADI）攻击，攻击者借此主导联合推断并剥夺受害者贡献与奖励，研究通过理论证明、梯度合成与灰盒模糊测试系统探索了该攻击面。
摘要：
垂直联邦学习（Vertical Federated Learning, VFL）系统近期作为一种处理分布在众多独立源上的数据而无需集中化的概念而变得突出。多个参与者以保护隐私的方式基于其本地数据协作训练模型。迄今为止，VFL已成为在组织间安全学习模型的事实标准解决方案，允许在不损害任何个人隐私的情况下共享知识。尽管VFL系统发展繁荣，但我们发现参与者的某些输入，被称为对抗性支配输入，能够按照攻击者的意愿主导联合推断，并迫使其他（受害者）参与者做出可忽略的贡献，从而失去在联邦学习场景中通常根据其贡献重要性而提供的奖励。我们通过首先证明ADI在典型VFL系统中的存在性，对ADI进行了系统研究。随后，我们提出了基于梯度的方法来合成各种格式的ADI，并利用常见的VFL系统。我们进一步发起了灰盒模糊测试，在“受害者”参与者显著性分数的引导下，扰动攻击者控制的输入，并以保护隐私的方式系统地探索VFL攻击面。我们对合成ADI时关键参数和设置的影响进行了深入研究。我们的研究揭示了新的VFL攻击机会，促进了在违规发生前识别未知威胁，并构建更安全的VFL系统。
英文摘要：
Vertical federated learning (VFL) system has recently become prominent as a concept to process data distributed across many individual sources without the need to centralize it. Multiple participants collaboratively train models based on their local data in a privacy-aware manner. To date, VFL has become a de facto solution to securely learn a model among organizations, allowing knowledge to be shared without compromising privacy of any individuals. Despite the prosperous development of VFL systems, we find that certain inputs of a participant, named adversarial dominating inputs (ADIs), can dominate the joint inference towards the direction of the adversary's will and force other (victim) participants to make negligible contributions, losing rewards that are usually offered regarding the importance of their contributions in federated learning scenarios. We conduct a systematic study on ADIs by first proving their existence in typical VFL systems. We then propose gradient-based methods to synthesize ADIs of various formats and exploit common VFL systems. We further launch greybox fuzz testing, guided by the saliency score of ``victim'' participants, to perturb adversary-controlled inputs and systematically explore the VFL attack surface in a privacy-preserving manner. We conduct an in-depth study on the influence of critical parameters and settings in synthesizing ADIs. Our study reveals new VFL attack opportunities, promoting the identification of unknown threats before breaches and building more secure VFL systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
