提出首个垂直联邦学习推理审计框架，有效检测数据方篡改推理结果的行为。
On the Inference (In-)Security of Vertical Federated Learning: Efficient Auditing against Inference Tampering Attack
- 设计新型推理篡改攻击VeFIT，可使任务方准确率下降34.49%。
- 提出VeFIA审计框架，99.99%概率检测超过5.4%被篡改的推理。
- 无需额外延迟且不泄露隐私，适合大规模在线推理场景使用。
垂直联邦学习（VFL）是一种跨组织协作的分布式学习范式，避免直接访问各方数据。然而现有工作缺乏对数据方推理正确性的审计机制。恶意数据方可通过修改本地数据或模型，误导联合推理结果。为此，我们设计了新型垂直联邦推理篡改攻击（VeFIT），使任务方推理准确率平均下降34.49%。现有防御手段无法有效检测该攻击，检测性能接近随机猜测。为应对该问题，我们进一步提出垂直联邦推理审计框架（VeFIA），帮助任务方在大规模在线推理中验证数据方计算结果是否合规。VeFIA不泄露数据隐私，且无额外延迟。其核心是任务方利用可信执行环境（TEE）框架与协调方提供的推理结果进行验证。只要被攻击比例超过5.4%，任务方即可以99.99%的概率检测到恶意行为。随机采样验证实现100%精确率、召回率与真阳性率。我们在真实数据集上验证了其隐私保护性与可扩展性。据我们所知，这是首篇系统讨论VFL推理审计问题的论文。
原文摘要 · Abstract (English)
Vertical Federated Learning (VFL) is an emerging distributed learning paradigm for cross-silo collaboration without accessing participants' data. However, existing VFL work lacks a mechanism to audit the inference correctness of the data party. The malicious data party can modify the local data and model to mislead the joint inference results. To exploit this vulnerability, we design a novel Vertical Federated Inference Tampering (VeFIT) attack, allowing the data party to covertly tamper with the local inference and mislead results on the task party's final prediction. VeFIT can decrease the task party's inference accuracy by an average of 34.49%. Existing defense mechanisms can not effectively detect this attack, and the detection performance is near random guessing. To mitigate the attack, we further design a Vertical Federated Inference Auditing (VeFIA) framework. VeFIA helps the task party to audit whether the data party's inferences are executed as expected during large-scale online inference. VeFIA does not leak the data party's privacy nor introduce additional latency. The core design is that the task party can use the inference results from a framework with Trusted Execution Environments (TEE) and the coordinator to validate the correctness of the data party's computation results. VeFIA guarantees that, as long as the proportion of inferences attacked by VeFIT exceeds 5.4%, the task party can detect the malicious behavior of the data party with a probability of 99.99%, without any additional online overhead. VeFIA's random sampling validation of VeFIA achieves 100% positive predictive value, negative predictive value, and true positive rate in detecting VeFIT. We further validate VeFIA's effectiveness in terms of privacy protection and scalability on real-world datasets. To the best of our knowledge, this is the first paper discussing the inference auditing problem towards VFL.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。