发表机构
Shanghai University of Finance and Economics（上海财经大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对分裂式联邦学习的投毒攻击，本文提出TOFD框架，通过目标推理、样本净化、解耦优化三阶段防御，在五个数据集上优于现有最优防御，鲁棒性高且开销低，适用于实际部署。
AI 中文摘要
分裂式联邦学习（Split Federated Learning, SFL）可在降低客户端开销的前提下实现隐私保护的协同训练，但其分裂架构引入了独特的攻击面，易受各类投毒攻击影响。现有多数防御方法未利用分裂式范式的特性，难以在早期检测和遏制恶意行为。为此，本文提出统一框架TOFD（Target-Oriented Feature Decoupling，面向目标的特征解耦），可同时实现对各类投毒攻击的主动检测与鲁棒优化。TOFD分三阶段运行：（1）目标推理阶段，通过类特定的边际扰动（Margin Perturbation, MP）优化按类别划分的安全区域，识别潜在攻击目标；（2）样本净化阶段，利用经MP的跨类最小-最大归一化校准的阈值，自适应过滤被投毒的粉碎数据；（3）解耦优化阶段，借助对抗引导模型捕获攻击诱导的模式，在优化过程中解耦其影响，从而抑制残留的对抗效应。本文为TOFD的收敛性提供了理论保证，在五个数据集上开展的大量实验表明，TOFD在各类攻击场景下均始终优于当前最优防御方法，以低计算开销实现了出色的鲁棒性，适用于实际部署。
英文摘要
Split Federated Learning (SFL) facilitates privacy-preserving collaborative training with reduced client-side overhead. However, its split architecture introduces unique attack surfaces, rendering it vulnerable to diverse poisoning attacks. Most existing defenses fail to exploit the split paradigm, limiting their ability to detect and contain malicious behaviors at an early stage. To bridge this gap, we propose Target-Oriented Feature Decoupling (TOFD), a unified framework that jointly enables proactive detection and robust optimization against a wide range of poisoning attacks. TOFD operates in three stages: (1) Target Inference, which identifies potential attack targets by refining class-wise safe zones via class-specific Margin Perturbation (MP); (2) Sample Purification, which adaptively filters poisoned smashed data using thresholds calibrated through cross-class min-max normalization of MP; and (3) Decoupling Optimization, which leverages an adversarial guidance model to capture attack-induced patterns and decouple their influence during optimization, thereby suppressing residual adversarial effects. We provide theoretical guarantees for the convergence of TOFD. Extensive experiments on five datasets demonstrate that TOFD consistently outperforms state-of-the-art defenses under diverse attack scenarios, achieving superior robustness with low computational overhead suitable for practical deployment.
