Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning

Yimin Liu; Peng Jiang; Qi Liu; Liehuang Zhu

doi:10.1609/aaai.v40i42.40878

Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning

Yimin Liu
, Peng Jiang^*
, Qi Liu
, Liehuang Zhu

^*此作品的通讯作者

Beijing Institute of Technology

科研成果: 书/报告/会议事项章节 › 会议稿件 › 同行评审

摘要

Graph-based vertical federated learning (GVFL) enables multiple parties to collaboratively train and infer over aligned nodes, where each party contributes its own local embedding derived from different attributes and adjacency relations. Adversarial inputs injected by an attacker can skew the joint prediction toward its desired outcomes while diminishing the influence of benign parties and undermining contribution. However, most attacks typically have pre-set assumptions, such as access to the server architecture, model queries, or in-domain auxiliary graphs. In this paper, we propose SGAC, an attack framework that enables domination of joint inference without relying on above assumptions. SGAC learns label-indicative embeddings and class-transferable probabilities to generate a surrogate that closely mimics the server-side classification behavior by exploiting auxiliary graphs from non-training domains. SGAC then leverages saliency over node attributes and edges on the auxiliary graphs to construct a diverse set of shadow inputs resembling highly influential test instances. With the surrogate fidelity and input diversity, SGAC crafts transferable contribution-monopoly adversarial inputs that hijack GVFL incentives. Extensive experiments across diverse model architectures validate SGAC’s effectiveness.

源语言	英语
主期刊名	Proceedings of the AAAI Conference on Artificial Intelligence
编辑	Sven Koenig, Chad Jenkins, Matthew E. Taylor
出版商	Association for the Advancement of Artificial Intelligence
页	35662-35670
页数	9
版本	42
ISBN（印刷版）	9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067, 9781577359067
DOI	https://doi.org/10.1609/aaai.v40i42.40878
出版状态	已出版 - 2026
已对外发布	是
活动	40th AAAI Conference on Artificial Intelligence, AAAI 2026 - Singapore, 新加坡期限: 20 1月 2026 → 27 1月 2026

出版系列

姓名	Proceedings of the AAAI Conference on Artificial Intelligence
编号	42
卷	40
ISSN（印刷版）	2159-5399
ISSN（电子版）	2374-3468

会议

会议	40th AAAI Conference on Artificial Intelligence, AAAI 2026
国家/地区	新加坡
市	Singapore
时期	20/01/26 → 27/01/26

访问文件

10.1609/aaai.v40i42.40878

其它文件与链接

链接到 Scopus 的出版物

引用此

Liu, Y., Jiang, P., Liu, Q., & Zhu, L. (2026). Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. 在 S. Koenig, C. Jenkins, & M. E. Taylor (编辑), Proceedings of the AAAI Conference on Artificial Intelligence (42 编辑, 页码 35662-35670). (Proceedings of the AAAI Conference on Artificial Intelligence; 卷 40, 号码 42). Association for the Advancement of Artificial Intelligence. https://doi.org/10.1609/aaai.v40i42.40878

Liu, Yimin ; Jiang, Peng ; Liu, Qi 等. / Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. Proceedings of the AAAI Conference on Artificial Intelligence. 编辑 / Sven Koenig ; Chad Jenkins ; Matthew E. Taylor. 42. 编辑 Association for the Advancement of Artificial Intelligence, 2026. 页码 35662-35670 (Proceedings of the AAAI Conference on Artificial Intelligence; 42).

@inproceedings{9e9eccb584f94108a1cbdfd614aed9f9,

title = "Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning",

abstract = "Graph-based vertical federated learning (GVFL) enables multiple parties to collaboratively train and infer over aligned nodes, where each party contributes its own local embedding derived from different attributes and adjacency relations. Adversarial inputs injected by an attacker can skew the joint prediction toward its desired outcomes while diminishing the influence of benign parties and undermining contribution. However, most attacks typically have pre-set assumptions, such as access to the server architecture, model queries, or in-domain auxiliary graphs. In this paper, we propose SGAC, an attack framework that enables domination of joint inference without relying on above assumptions. SGAC learns label-indicative embeddings and class-transferable probabilities to generate a surrogate that closely mimics the server-side classification behavior by exploiting auxiliary graphs from non-training domains. SGAC then leverages saliency over node attributes and edges on the auxiliary graphs to construct a diverse set of shadow inputs resembling highly influential test instances. With the surrogate fidelity and input diversity, SGAC crafts transferable contribution-monopoly adversarial inputs that hijack GVFL incentives. Extensive experiments across diverse model architectures validate SGAC{\textquoteright}s effectiveness.",

author = "Yimin Liu and Peng Jiang and Qi Liu and Liehuang Zhu",

note = "Publisher Copyright: {\textcopyright} 2026, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved.; 40th AAAI Conference on Artificial Intelligence, AAAI 2026 ; Conference date: 20-01-2026 Through 27-01-2026",

year = "2026",

doi = "10.1609/aaai.v40i42.40878",

language = "English",

isbn = "9781577359067",

series = "Proceedings of the AAAI Conference on Artificial Intelligence",

publisher = "Association for the Advancement of Artificial Intelligence",

number = "42",

pages = "35662--35670",

editor = "Sven Koenig and Chad Jenkins and Taylor, \{Matthew E.\}",

booktitle = "Proceedings of the AAAI Conference on Artificial Intelligence",

edition = "42",

}

Liu, Y, Jiang, P, Liu, Q & Zhu, L 2026, Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. 在 S Koenig, C Jenkins & ME Taylor (编辑), Proceedings of the AAAI Conference on Artificial Intelligence. 42 编辑, Proceedings of the AAAI Conference on Artificial Intelligence, 号码 42, 卷 40, Association for the Advancement of Artificial Intelligence, 页码 35662-35670, 40th AAAI Conference on Artificial Intelligence, AAAI 2026, Singapore, 新加坡, 20/01/26. https://doi.org/10.1609/aaai.v40i42.40878

Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. / Liu, Yimin; Jiang, Peng; Liu, Qi 等.
Proceedings of the AAAI Conference on Artificial Intelligence. 编辑 / Sven Koenig; Chad Jenkins; Matthew E. Taylor. 42. 编辑 Association for the Advancement of Artificial Intelligence, 2026. 页码 35662-35670 (Proceedings of the AAAI Conference on Artificial Intelligence; 卷 40, 号码 42).

科研成果: 书/报告/会议事项章节 › 会议稿件 › 同行评审

TY - GEN

T1 - Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning

AU - Liu, Yimin

AU - Jiang, Peng

AU - Liu, Qi

AU - Zhu, Liehuang

PY - 2026

Y1 - 2026

N2 - Graph-based vertical federated learning (GVFL) enables multiple parties to collaboratively train and infer over aligned nodes, where each party contributes its own local embedding derived from different attributes and adjacency relations. Adversarial inputs injected by an attacker can skew the joint prediction toward its desired outcomes while diminishing the influence of benign parties and undermining contribution. However, most attacks typically have pre-set assumptions, such as access to the server architecture, model queries, or in-domain auxiliary graphs. In this paper, we propose SGAC, an attack framework that enables domination of joint inference without relying on above assumptions. SGAC learns label-indicative embeddings and class-transferable probabilities to generate a surrogate that closely mimics the server-side classification behavior by exploiting auxiliary graphs from non-training domains. SGAC then leverages saliency over node attributes and edges on the auxiliary graphs to construct a diverse set of shadow inputs resembling highly influential test instances. With the surrogate fidelity and input diversity, SGAC crafts transferable contribution-monopoly adversarial inputs that hijack GVFL incentives. Extensive experiments across diverse model architectures validate SGAC’s effectiveness.

AB - Graph-based vertical federated learning (GVFL) enables multiple parties to collaboratively train and infer over aligned nodes, where each party contributes its own local embedding derived from different attributes and adjacency relations. Adversarial inputs injected by an attacker can skew the joint prediction toward its desired outcomes while diminishing the influence of benign parties and undermining contribution. However, most attacks typically have pre-set assumptions, such as access to the server architecture, model queries, or in-domain auxiliary graphs. In this paper, we propose SGAC, an attack framework that enables domination of joint inference without relying on above assumptions. SGAC learns label-indicative embeddings and class-transferable probabilities to generate a surrogate that closely mimics the server-side classification behavior by exploiting auxiliary graphs from non-training domains. SGAC then leverages saliency over node attributes and edges on the auxiliary graphs to construct a diverse set of shadow inputs resembling highly influential test instances. With the surrogate fidelity and input diversity, SGAC crafts transferable contribution-monopoly adversarial inputs that hijack GVFL incentives. Extensive experiments across diverse model architectures validate SGAC’s effectiveness.

UR - https://www.scopus.com/pages/publications/105035004187

U2 - 10.1609/aaai.v40i42.40878

DO - 10.1609/aaai.v40i42.40878

M3 - Conference contribution

AN - SCOPUS:105035004187

SN - 9781577359067

T3 - Proceedings of the AAAI Conference on Artificial Intelligence

SP - 35662

EP - 35670

BT - Proceedings of the AAAI Conference on Artificial Intelligence

A2 - Koenig, Sven

A2 - Jenkins, Chad

A2 - Taylor, Matthew E.

PB - Association for the Advancement of Artificial Intelligence

T2 - 40th AAAI Conference on Artificial Intelligence, AAAI 2026

Y2 - 20 January 2026 through 27 January 2026

ER -

Liu Y, Jiang P, Liu Q, Zhu L. Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning. 在 Koenig S, Jenkins C, Taylor ME, 编辑, Proceedings of the AAAI Conference on Artificial Intelligence. 42 编辑 Association for the Advancement of Artificial Intelligence. 2026. 页码 35662-35670. (Proceedings of the AAAI Conference on Artificial Intelligence; 42). doi: 10.1609/aaai.v40i42.40878

Generic Adversarial Attack Framework Against Graph-based Vertical Federated Learning

摘要

出版系列

会议

访问文件

其它文件与链接

学术指纹

引用此