HealSplit：拆分联邦学习中基于对抗蒸馏的自修复研究
HealSplit: Towards Self-Healing through Adversarial Distillation in Split Federated Learning
AI总结：
针对拆分联邦学习易受数据投毒攻击、现有防御效果不佳的问题，本文提出定制化统一防御框架HealSplit，结合拓扑异常检测、生成式恢复与对抗多教师蒸馏，在多场景下防御表现优于十种现有最优方法。
AI中文摘要：
拆分联邦学习（SFL）是面向隐私保护的分布式学习新兴范式，但它仍易受针对本地特征、标签、粉碎数据和模型权重的复杂数据投毒攻击。现有防御方案主要改编自传统联邦学习（FL），由于无法获取完整模型更新，在SFL场景下防御效果较差。本文提出首个专为SFL定制的统一防御框架HealSplit，可针对五类复杂投毒攻击实现端到端检测与恢复。HealSplit包含三个核心组件：一是拓扑感知检测模块，基于粉碎数据构建图结构，通过拓扑异常评分（TAS）识别投毒样本；二是生成式恢复流水线，为检测到的异常样本合成语义一致的替代样本，由一致性验证学生模型完成校验；三是对抗多教师蒸馏框架，在拓扑交互矩阵与梯度交互矩阵对齐的引导下，利用普通教师提供的语义监督、异常影响去偏（AD）教师提供的异常感知信号训练学生模型。在四个基准数据集上开展的大量实验表明，HealSplit的表现始终优于十种现有最优防御方案，在多种攻击场景下均实现了更出色的鲁棒性与防御效果。
英文摘要：
Split Federated Learning (SFL) is an emerging paradigm for privacy-preserving distributed learning. However, it remains vulnerable to sophisticated data poisoning attacks targeting local features, labels, smashed data, and model weights. Existing defenses, primarily adapted from traditional Federated Learning (FL), are less effective under SFL due to limited access to complete model updates. This paper presents HealSplit, the first unified defense framework tailored for SFL, offering end-to-end detection and recovery against five sophisticated types of poisoning attacks. HealSplit comprises three key components: (1) a topology-aware detection module that constructs graphs over smashed data to identify poisoned samples via topological anomaly scoring (TAS); (2) a generative recovery pipeline that synthesizes semantically consistent substitutes for detected anomalies, validated by a consistency validation student; and (3) an adversarial multi-teacher distillation framework trains the student using semantic supervision from a Vanilla Teacher and anomaly-aware signals from an Anomaly-Influence Debiasing (AD) Teacher, guided by the alignment between topological and gradient-based interaction matrices. Extensive experiments on four benchmark datasets demonstrate that HealSplit consistently outperforms ten state-of-the-art defenses, achieving superior robustness and defense effectiveness across diverse attack scenarios.
