URVFL: Undetectable Data Reconstruction Attack on Vertical Federated Learning

TL;DR

URVFL introduces a stealthy data reconstruction attack on vertical federated learning that leverages label information and a discriminator to generate indistinguishable malicious gradients, effectively evading detection.

Contribution

This paper presents URVFL, a novel attack method that improves data reconstruction in VFL while avoiding existing detection mechanisms, enhancing attack stealthiness and effectiveness.

Findings

URVFL outperforms existing attacks in reconstruction quality.

URVFL successfully evades state-of-the-art detection methods.

The attack remains robust against various defenses.

Abstract

Launching effective malicious attacks in VFL presents unique challenges: 1) Firstly, given the distributed nature of clients' data features and models, each client rigorously guards its privacy and prohibits direct querying, complicating any attempts to steal data; 2) Existing malicious attacks alter the underlying VFL training task, and are hence easily detected by comparing the received gradients with the ones received in honest training. To overcome these challenges, we develop URVFL, a novel attack strategy that evades current detection mechanisms. The key idea is to integrate a discriminator with auxiliary classifier that takes a full advantage of the label information and generates malicious gradients to the victim clients: on one hand, label information helps to better characterize embeddings of samples from distinct classes, yielding an improved reconstruction performance; on the other hand, computing malicious gradients with label information better mimics the honest training, making the malicious gradients indistinguishable from the honest ones, and the attack much more stealthy. Our comprehensive experiments demonstrate that URVFL significantly outperforms existing attacks, and successfully circumvents SOTA detection methods for malicious attacks. Additional ablation studies and evaluations on defenses further underscore the robustness and effectiveness of URVFL. Our code will be available at https://github.com/duanyiyao/URVFL.