TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning

2026-08-07

AI Summary

This work addresses the vulnerability of Split Federated Learning (Split FL) to poisoning attacks due to model partitioning, where existing defenses struggle to detect and suppress malicious behavior at early stages. The paper proposes TOFD, a novel framework that, for the first time in Split FL, jointly enables attack objective identification, adaptive data sanitization, and disentanglement of adversarial influence. TOFD achieves this through a three-stage synergistic mechanism comprising class-specific margin perturbations, cross-class min-max normalized threshold calibration, and an adversarially guided model update strategy. The method provides theoretical convergence guarantees and demonstrates significant superiority over state-of-the-art defenses across five benchmark datasets, offering strong robustness, low computational overhead, and practical deployability.

Abstract

Split Federated Learning (SFL) facilitates privacy-preserving collaborative training with reduced client-side overhead. However, its split architecture introduces unique attack surfaces, rendering it vulnerable to diverse poisoning attacks. Most existing defenses fail to exploit the split paradigm, limiting their ability to detect and contain malicious behaviors at an early stage. To bridge this gap, we propose Target-Oriented Feature Decoupling (TOFD), a unified framework that jointly enables proactive detection and robust optimization against a wide range of poisoning attacks. TOFD operates in three stages: (1) Target Inference, which identifies potential attack targets by refining class-wise safe zones via class-specific Margin Perturbation (MP); (2) Sample Purification, which adaptively filters poisoned smashed data using thresholds calibrated through cross-class min-max normalization of MP; and (3) Decoupling Optimization, which leverages an adversarial guidance model to capture attack-induced patterns and decouple their influence during optimization, thereby suppressing residual adversarial effects. We provide theoretical guarantees for the convergence of TOFD. Extensive experiments on five datasets demonstrate that TOFD consistently outperforms state-of-the-art defenses under diverse attack scenarios, achieving superior robustness with low computational overhead suitable for practical deployment.

Problem

• Split Federated Learning
• Poisoning Attacks
• Attack Detection
• Robust Optimization
• Privacy-Preserving Learning

Innovation

• Target-Oriented Feature Decoupling
• Split Federated Learning
• Poisoning Attacks
• Margin Perturbation
• Adversarial Guidance