Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning

Yimin Liu; Peng Jiang; Qi Liu; Liehuang Zhu

doi:10.1609/aaai.v40i42.40878

Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning

Yimin Liu
, Peng Jiang^*
, Qi Liu
, Liehuang Zhu

^*Corresponding author for this work

Beijing Institute of Technology

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

Graph-based vertical federated learning (GVFL) enables multiple parties to collaboratively train and infer over aligned nodes, where each party contributes its own local embedding derived from different attributes and adjacency relations. Adversarial inputs injected by an attacker can skew the joint prediction toward its desired outcomes while diminishing the influence of benign parties and undermining contribution. However, most attacks typically have pre-set assumptions, such as access to the server architecture, model queries, or in-domain auxiliary graphs. In this paper, we propose SGAC, an attack framework that enables domination of joint inference without relying on above assumptions. SGAC learns label-indicative embeddings and class-transferable probabilities to generate a surrogate that closely mimics the server-side classification behavior by exploiting auxiliary graphs from non-training domains. SGAC then leverages saliency over node attributes and edges on the auxiliary graphs to construct a diverse set of shadow inputs resembling highly influential test instances. With the surrogate fidelity and input diversity, SGAC crafts transferable contribution-monopoly adversarial inputs that hijack GVFL incentives. Extensive experiments across diverse model architectures validate SGAC’s effectiveness.

Original language	English
Title of host publication	Proceedings of the AAAI Conference on Artificial Intelligence
Editors	Sven Koenig, Chad Jenkins, Matthew E. Taylor
Publisher	Association for the Advancement of Artificial Intelligence
Pages	35662-35670
Number of pages	9
Edition	42
ISBN (Print)	9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067
DOIs	https://doi.org/10.1609/aaai.v40i42.40878
Publication status	Published - 2026
Externally published	Yes
Event	40th AAAI Conference on Artificial Intelligence, AAAI 2026 - Singapore, Singapore Duration: 20 Jan 2026 → 27 Jan 2026

Publication series

Name	Proceedings of the AAAI Conference on Artificial Intelligence
Number	42
Volume	40
ISSN (Print)	2159-5399
ISSN (Electronic)	2374-3468

Conference

Conference	40th AAAI Conference on Artificial Intelligence, AAAI 2026
Country/Territory	Singapore
City	Singapore
Period	20/01/26 → 27/01/26

Access to Document

10.1609/aaai.v40i42.40878

Cite this

Liu, Y., Jiang, P., Liu, Q., & Zhu, L. (2026). Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. In S. Koenig, C. Jenkins, & M. E. Taylor (Eds.), Proceedings of the AAAI Conference on Artificial Intelligence (42 ed., pp. 35662-35670). (Proceedings of the AAAI Conference on Artificial Intelligence; Vol. 40, No. 42). Association for the Advancement of Artificial Intelligence. https://doi.org/10.1609/aaai.v40i42.40878

Liu, Yimin ; Jiang, Peng ; Liu, Qi et al. / Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. Proceedings of the AAAI Conference on Artificial Intelligence. editor / Sven Koenig ; Chad Jenkins ; Matthew E. Taylor. 42. ed. Association for the Advancement of Artificial Intelligence, 2026. pp. 35662-35670 (Proceedings of the AAAI Conference on Artificial Intelligence; 42).

@inproceedings{9e9eccb584f94108a1cbdfd614aed9f9,

title = "Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning",

abstract = "Graph-based vertical federated learning (GVFL) enables multiple parties to collaboratively train and infer over aligned nodes, where each party contributes its own local embedding derived from different attributes and adjacency relations. Adversarial inputs injected by an attacker can skew the joint prediction toward its desired outcomes while diminishing the influence of benign parties and undermining contribution. However, most attacks typically have pre-set assumptions, such as access to the server architecture, model queries, or in-domain auxiliary graphs. In this paper, we propose SGAC, an attack framework that enables domination of joint inference without relying on above assumptions. SGAC learns label-indicative embeddings and class-transferable probabilities to generate a surrogate that closely mimics the server-side classification behavior by exploiting auxiliary graphs from non-training domains. SGAC then leverages saliency over node attributes and edges on the auxiliary graphs to construct a diverse set of shadow inputs resembling highly influential test instances. With the surrogate fidelity and input diversity, SGAC crafts transferable contribution-monopoly adversarial inputs that hijack GVFL incentives. Extensive experiments across diverse model architectures validate SGAC{\textquoteright}s effectiveness.",

author = "Yimin Liu and Peng Jiang and Qi Liu and Liehuang Zhu",

note = "Publisher Copyright: {\textcopyright} 2026, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved.; 40th AAAI Conference on Artificial Intelligence, AAAI 2026 ; Conference date: 20-01-2026 Through 27-01-2026",

year = "2026",

doi = "10.1609/aaai.v40i42.40878",

language = "English",

isbn = "9781577359067",

series = "Proceedings of the AAAI Conference on Artificial Intelligence",

publisher = "Association for the Advancement of Artificial Intelligence",

number = "42",

pages = "35662--35670",

editor = "Sven Koenig and Chad Jenkins and Taylor, \{Matthew E.\}",

booktitle = "Proceedings of the AAAI Conference on Artificial Intelligence",

edition = "42",

}

Liu, Y, Jiang, P, Liu, Q & Zhu, L 2026, Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. in S Koenig, C Jenkins & ME Taylor (eds), Proceedings of the AAAI Conference on Artificial Intelligence. 42 edn, Proceedings of the AAAI Conference on Artificial Intelligence, no. 42, vol. 40, Association for the Advancement of Artificial Intelligence, pp. 35662-35670, 40th AAAI Conference on Artificial Intelligence, AAAI 2026, Singapore, Singapore, 20/01/26. https://doi.org/10.1609/aaai.v40i42.40878

Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. / Liu, Yimin; Jiang, Peng; Liu, Qi et al.
Proceedings of the AAAI Conference on Artificial Intelligence. ed. / Sven Koenig; Chad Jenkins; Matthew E. Taylor. 42. ed. Association for the Advancement of Artificial Intelligence, 2026. p. 35662-35670 (Proceedings of the AAAI Conference on Artificial Intelligence; Vol. 40, No. 42).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning

AU - Liu, Yimin

AU - Jiang, Peng

AU - Liu, Qi

AU - Zhu, Liehuang

PY - 2026

Y1 - 2026

N2 - Graph-based vertical federated learning (GVFL) enables multiple parties to collaboratively train and infer over aligned nodes, where each party contributes its own local embedding derived from different attributes and adjacency relations. Adversarial inputs injected by an attacker can skew the joint prediction toward its desired outcomes while diminishing the influence of benign parties and undermining contribution. However, most attacks typically have pre-set assumptions, such as access to the server architecture, model queries, or in-domain auxiliary graphs. In this paper, we propose SGAC, an attack framework that enables domination of joint inference without relying on above assumptions. SGAC learns label-indicative embeddings and class-transferable probabilities to generate a surrogate that closely mimics the server-side classification behavior by exploiting auxiliary graphs from non-training domains. SGAC then leverages saliency over node attributes and edges on the auxiliary graphs to construct a diverse set of shadow inputs resembling highly influential test instances. With the surrogate fidelity and input diversity, SGAC crafts transferable contribution-monopoly adversarial inputs that hijack GVFL incentives. Extensive experiments across diverse model architectures validate SGAC’s effectiveness.

AB - Graph-based vertical federated learning (GVFL) enables multiple parties to collaboratively train and infer over aligned nodes, where each party contributes its own local embedding derived from different attributes and adjacency relations. Adversarial inputs injected by an attacker can skew the joint prediction toward its desired outcomes while diminishing the influence of benign parties and undermining contribution. However, most attacks typically have pre-set assumptions, such as access to the server architecture, model queries, or in-domain auxiliary graphs. In this paper, we propose SGAC, an attack framework that enables domination of joint inference without relying on above assumptions. SGAC learns label-indicative embeddings and class-transferable probabilities to generate a surrogate that closely mimics the server-side classification behavior by exploiting auxiliary graphs from non-training domains. SGAC then leverages saliency over node attributes and edges on the auxiliary graphs to construct a diverse set of shadow inputs resembling highly influential test instances. With the surrogate fidelity and input diversity, SGAC crafts transferable contribution-monopoly adversarial inputs that hijack GVFL incentives. Extensive experiments across diverse model architectures validate SGAC’s effectiveness.

UR - https://www.scopus.com/pages/publications/105035004187

U2 - 10.1609/aaai.v40i42.40878

DO - 10.1609/aaai.v40i42.40878

M3 - Conference contribution

AN - SCOPUS:105035004187

SN - 9781577359067

T3 - Proceedings of the AAAI Conference on Artificial Intelligence

SP - 35662

EP - 35670

BT - Proceedings of the AAAI Conference on Artificial Intelligence

A2 - Koenig, Sven

A2 - Jenkins, Chad

A2 - Taylor, Matthew E.

PB - Association for the Advancement of Artificial Intelligence

T2 - 40th AAAI Conference on Artificial Intelligence, AAAI 2026

Y2 - 20 January 2026 through 27 January 2026

ER -

Liu Y, Jiang P, Liu Q, Zhu L. Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. In Koenig S, Jenkins C, Taylor ME, editors, Proceedings of the AAAI Conference on Artificial Intelligence. 42 ed. Association for the Advancement of Artificial Intelligence. 2026. p. 35662-35670. (Proceedings of the AAAI Conference on Artificial Intelligence; 42). doi: 10.1609/aaai.v40i42.40878

Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this