A method and system for security attack verification and defense hardening based on vertical federated learning

Abstract

This invention provides a method and system for security attack verification and defense hardening in vertical federated learning, relating to the fields of artificial intelligence security and federated learning technology. Technical solution: During the collaborative training process of vertical federated learning, a generative covert backdoor attack is executed through a security verification module to simulate highly covert backdoor threats and verify system vulnerabilities; a security hardening module reconstructs the embedding vectors uploaded by participants based on a masked autoencoder (MAE) and calculates the independent prediction entropy of each participant; based on the independent prediction entropy, dual anomaly verification is performed on the participant embeddings to identify malicious embeddings and perform cleanup operations, achieving defense hardening. Beneficial effects: This invention achieves high-covert vulnerability verification through generative attacks, and the defense mechanism based on prediction entropy reduces the backdoor attack success rate to below 5%, with the main task accuracy decreasing by only 1%-7%, filling protection blind spots, having low deployment costs, and effectively improving the security and reliability of the vertical federated learning system.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security and federated learning technology, specifically to a method for verifying the security of backdoor attacks in vertical federated learning based on generative attacks and a corresponding hardening defense mechanism based on prediction entropy, applicable to vertical federated learning systems in sensitive fields such as finance, healthcare, and intelligent manufacturing. Background Technology

[0002] Vertical Federated Learning (VFL) allows multiple participants with the same user group but different feature dimensions to collaboratively train a model without disclosing the original data. However, the collaborative training architecture of VFL also introduces security risks, especially the interaction process of intermediate layer embeddings, which is vulnerable to malicious actors who can implant backdoors, causing the global model to misclassify inputs containing trigger signals, seriously threatening the security of the VFL system.

[0003] Currently, existing backdoor attack methods (such as VILLAIN and LFBA) and their defenses (such as VFLIP) targeting vertical federated learning have the following shortcomings: 1. Existing vertical federated learning backdoor attack methods (such as VILLAIN and LFBA) generate malicious embeddings that differ significantly from normal benign data in statistical distribution, making it impossible to accurately assess the security of vertical federated learning systems when facing more advanced and covert attacks.

[0004] 2. Existing vertical federated learning defense methods, represented by VFLIP, rely on the assumption that "malicious embeddings must have a detectable distributional deviation from benign embeddings" to achieve defense by identifying malicious embeddings through anomaly detection. However, this method cannot deal with generative covert backdoor attacks whose distribution is consistent with benign embeddings, resulting in serious blind spots in protection.

[0005] literature: "VILLAIN: Backdoor Attacks Against Vertical Split Learning" "Label-Free Backdoor Attacks in Vertical Federated Learning" "VFLIP: A Backdoor Defense for Vertical Federated Learning via Identification and Purification" However, with the development of generative adversarial techniques, attackers can utilize generative models such as autoencoders to construct malicious embeddings that are almost identical to the statistical distribution of benign embeddings, making traditional defense methods that rely on distribution bias detection (such as VFLIP) difficult to effectively identify. Currently, there is no systematic security verification of such highly covert generative backdoor attacks, and even fewer robust defense mechanisms to counter them. This results in serious security blind spots for vertical federated learning systems in sensitive fields such as finance and healthcare, potentially leading to unpredictable business losses if attacked. Therefore, there is an urgent need for a security verification method capable of simulating highly covert backdoor attacks, and a robust defense mechanism that does not rely on anomalous distribution assumptions, to comprehensively evaluate and improve the attack resistance of vertical federated learning systems. Summary of the Invention

[0006] To address the technical problems existing in the prior art, this invention aims to provide a security attack verification method that can achieve distributed consistency covert attacks, and based on this, proposes a defense hardening scheme that does not rely on abnormal distribution characteristics, thereby improving the overall security protection capability of the vertical federated learning system.

[0007] To achieve the above objectives, the present invention provides the following technical solution: A security attack verification and defense hardening method for vertical federated learning, comprising the following steps: S1: During the collaborative training process of vertical federated learning, a generative covert backdoor attack is executed through the security verification module to simulate a highly covert backdoor threat and verify system vulnerabilities. S2: The embedding vectors uploaded by the participants are reconstructed by the security hardening module based on the mask autoencoder (MAE), and the independent prediction entropy of each participant is calculated. S3: Based on the independent prediction entropy, perform dual anomaly verification on the participant embedding, identify malicious embedding and perform purification operations to achieve defense reinforcement.

[0008] Furthermore, the generative covert backdoor attack includes dynamic target selection and backdoor implantation; S11: The dynamic target selection includes: the attacker's computing node divides the static target class candidate pool and the non-target class candidate pool based on the cosine similarity of the embedding gradient in the early stage of training, and calculates the embedding gradient L2 norm of the target class candidate pool samples after each round of training, and selects the sample with the largest norm as the poisoning target set for the next round. S12: The backdoor implantation includes: in each training batch, replacing the features of non-target class samples with the features of target class samples by sample switching, generating a malicious embedding consistent with the benign embedding distribution using an autoencoder, and uploading the poisoned embedding to the active party after synthesizing it through a hybrid factor. S13: Receive the gradients fed back by the active party, split them into gradients of benign samples and gradients of poisoned samples, and backpropagate them to update the parameters of the underlying model and the autoencoder, thereby achieving joint optimization of the attack task and the main task.

[0009] Furthermore, the backdoor implantation also includes controlled gradient flow joint optimization: the gradient of the poisoned sample is multiplied by the gradient scaling factor γ to amplify it, thereby enhancing the influence of the attack signal; at the same time, the residual loss is scaled, and its relative weight with the classification loss is adjusted, and the values ​​of γ and the residual loss coefficient β are dynamically adjusted to achieve the optimization focus shift from attack effectiveness in the early stage of training to concealment in the later stage.

[0010] Furthermore, the security hardening module includes MAE training, prediction entropy benchmark calculation, and dual anomaly verification; S21: The MAE training includes: after the active party server receives the embedding vectors uploaded by each participant, it adopts a strategy of randomly selecting one embedding as the reconstruction target and using other embeddings to complete the reconstruction, or randomly selecting two embeddings to reconstruct the other from one, and trains the MAE module to learn the joint distribution features of benign embeddings. S22: The calculation of the prediction entropy benchmark includes: reconstructing the complete embedding based on the single participant embedding using the trained MAE, inputting it into the top-level classification model to obtain the prediction probability distribution, and calculating the average prediction entropy of each participant on all training samples as the benchmark for subsequent anomaly judgment.

[0011] Furthermore, the dual anomaly verification includes: S31: During the inference phase, calculate the independent prediction entropy for the participant embedding of each sample; S32: Self-anomaly judgment: Determine whether the predicted entropy is lower than m1 times the historical average entropy of the participant, where m1 < 1.0; S33: Mutual Anomaly Judgment: Determine whether the predicted entropy is lower than m2 times the maximum predicted entropy of other participants in the same sample, where m2 < 1.0; S34: If both self-abnormal and mutual abnormal conditions are met, it is determined to be malicious embedding, and a cleanup operation is performed. The malicious embedding part is reconstructed and replaced through MAE.

[0012] This invention also includes a security attack verification and defense hardening system based on vertical federated learning, comprising: There are K participating computing nodes, each running the underlying model to extract intermediate layer embedding vectors from local data; An active server runs the top-level classification model and integrates a security verification module and a security hardening module; The security verification module is used to execute generative covert backdoor attacks, simulate highly covert backdoor threats, and verify system vulnerabilities. The security hardening module includes a mask autoencoder (MAE), a predictive entropy calculation unit, and a dual anomaly verification unit, which are used to identify malicious embeddings and perform cleanup operations.

[0013] Furthermore, the security verification module includes a dynamic target selection unit and a backdoor implantation unit; The dynamic target selection unit is used to divide the static candidate pool based on the cosine similarity of the embedded gradient in the early stage of training, and to select the next round of poisoning target set based on the gradient L2 norm after each round of training. The backdoor implantation unit includes a sample switching module, an autoencoder module, and a controlled gradient flow optimization module, which are used to generate malicious embeddings consistent with benign embedding distributions and synthesize poisoned embeddings through hybrid factors, while simultaneously updating the underlying model and autoencoder parameters.

[0014] Furthermore, in the security hardening module: The MAE adopts a fully connected network with a symmetric structure. The training strategy includes using a random embedding as the reconstruction target, using other embeddings for reconstruction, or using one of two random embeddings to reconstruct the other. The prediction entropy calculation unit is used to calculate the independent prediction entropy of each participant based on the complete embedding of MAE reconstruction. The dual anomaly verification unit is used to perform dual judgments on the participant embedding of each sample, including self-anomaly and mutual anomaly, to identify malicious embedding and trigger a cleanup operation.

[0015] The present invention also includes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described above.

[0016] The present invention also includes a vertical federated learning system, comprising multiple participating computing nodes, an active server, and the aforementioned computer-readable storage medium. When the computer program is loaded and executed, it enables backdoor attack verification and defense hardening during the training and inference process of vertical federated learning.

[0017] The beneficial effects of this invention are: Compared with existing technologies, the security attack verification and defense hardening method and system of vertical federated learning described in this invention has the following technical features and beneficial effects: (1) Technical effects The generative covert backdoor attack method achieves a near 100% success rate on three datasets (CIFAR10, CINIC10, and Imagenette) in vertical federated learning architectures with 2 or 4 participants, effectively implanting backdoor triggers into the federated model. The attack method successfully evades detection by existing state-of-the-art hardening defense methods (VFLIP), with a success rate exceeding 92%, demonstrating strong security attack verification capabilities. This method has no significant impact on the accuracy of the main task (image classification) of the vertical federated learning system, with an accuracy deviation of less than 1% compared to normal scenarios, meeting the covertness requirements for security attack verification.

[0018] The predictive entropy defense mechanism is highly effective and targeted, effectively defending against highly concealed generative backdoor attacks, reducing the success rate of backdoor attacks to around 5%, a reduction of over 90%, filling the protection blind spots of existing hardening methods. Simultaneously, it also provides comprehensive hardening against traditional vertical federated learning backdoor threats (VILLAIN, LFBA), reducing their attack success rate to below 5%, on par with no-attack scenarios. Using predictive entropy defense only reduces the accuracy of the main task of the vertical federated learning system by 1%–7%, and this impact can be further reduced through threshold optimization, demonstrating the practicality of the hardening effect. This defense achieves stable results in both 2- and 4-participant vertical federated learning architectures, making it adaptable to vertical federated learning systems of different sizes.

[0019] (2) Economic effects This invention effectively protects against backdoor vulnerabilities in vertical federated learning systems, preventing economic losses such as business misjudgments, data leaks, and system failures caused by model attacks. Furthermore, both modules of this invention can be deployed based on the existing hardware and software architecture of vertical federated learning systems, resulting in low deployment costs. The hardening module reuses the mature Mask Autoencoder (MAE) module, reducing the manpower and time costs of program development, adaptation, and system modification.

[0020] (3) Social effects This invention proposes an integrated solution for verifying highly concealed backdoor vulnerabilities and for targeted security hardening and defense, filling the technological gap in existing vertical federated learning security protection and promoting technological development in the field of federated learning security. This invention enables vertical federated learning systems to effectively resist increasingly complex backdoor threats, improving system security and trustworthiness, making their application in sensitive fields such as finance, healthcare, and intelligent manufacturing more reliable, and complying with national policies and industry needs for data privacy protection. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and detailed embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 The malicious embedding generation and controlled joint optimization data flow graph of this invention consists of a generative poisoning forward computation graph and a controlled gradient flow backpropagation graph; Figure 2 This is a data flow diagram of the MAE-based isolation and reconstruction mechanism of this invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. The following description, in conjunction with the accompanying drawings... Figure 1-2 This paper further explains the security attack verification and defense hardening methods and systems for vertical federated learning.

[0023] Example 1 The technical solution of this invention is a computer program-implemented architecture of "security verification module (generative covert backdoor attack) + security hardening module (low-entropy backdoor sample identification)", which is based on a vertical federated learning (VFL) collaborative training system (K participating computing nodes, active server, encrypted communication module, CPU / GPU computing module, local / server storage module). The two modules work together to complete vulnerability verification and security hardening.

[0024] (a) Security verification method: Generative covert backdoor attack This method simulates backdoor threats under conditions of high concealment and low poisoning rate, accurately detects vulnerabilities in VFL systems, and fundamentally solves three major problems in existing attacks: insufficient concealment, inefficient target location, and gradient conflict between dual tasks.

[0025] The dynamic target selection process focuses on accurate localization in unlabeled scenarios, achieved through a two-stage mechanism of "static candidate pool partitioning + dynamic hard sample mining". After the attacker's computing node reads the features of the local dataset, it runs the underlying model to calculate the intermediate embeddings of the first round of training samples, receives the embedding gradients fed back by the active side, selects anchor samples, and calculates the gradient cosine similarity between all samples and the anchor samples. Based on this, it partitions the target class candidate pool D. t With non-target class candidate pool D n From D n The source of the poisoning was identified in D. sThis candidate pool partitioning is performed only once during the initial training phase to ensure stability. After each training round, D is calculated. t The L2 norm of the embedding gradient of the middle samples is used to select the batch of samples with the largest norm to form the dynamic poisoning target set D. d It adapts to the dynamic changes in the model's decision boundary, maximizing the impact of attack signals under low poisoning rates.

[0026] The backdoor implantation stage is the core execution process, comprising three steps: sample switching, generative poisoning, and joint optimization of controlled gradient flow. In each training batch, the target class sample B within the batch is first identified. d Non-target class sample B n From B n Extraction and B d Equal number of B s And replace B d The system uses feature data to force the construction of a malicious mapping between non-target class features and target class labels. Then, it calculates batch benign embeddings through the underlying model, inputs them into the autoencoder to generate malicious embeddings, and introduces residual loss to constrain the distribution consistency between malicious and benign embeddings. After separating the target class poisoning embedding subset from the computation graph, it synthesizes poisoned embeddings through a mixing factor α and uploads them to the active side. After receiving gradient feedback, it splits the gradients of benign and poisoned samples, backpropagates them to the underlying model and autoencoder respectively, and updates their parameters synchronously. Simultaneously, it uses residual loss gradient adjustment to ensure that the main task performance is not affected by the attack.

[0027] (II) Security Hardening Methods: Low-Entropy Backdoor Sample Identification This method is based on a mature MAE module design. Through a three-step design of "MAE training, prediction entropy benchmark calculation, and dual anomaly verification", it accurately identifies generative covert backdoor attacks and solves the problem that existing defenses cannot cope with the consistent malicious embedding.

[0028] MAE training addresses the challenge of separating the contributions of a single participant in VFL collaborative inference. After receiving embeddings uploaded by each participant, the active server trains the MAE module using two strategies: First, it randomly selects one embedding as the reconstruction target and uses all other embeddings to complete the reconstruction; second, it randomly selects two embeddings, using one as input to reconstruct the other. By enhancing the MAE module's ability to reconstruct missing embeddings, it can accurately generate embeddings for the other K-1 participants based on a single participant's embedding, concatenating them into a complete embedding to simulate a scenario where "global prediction is performed solely based on this participant's embedding," thus achieving independent evaluation of the semantic contribution of a single participant. The computational cost increases linearly with the number of participants K, without adding any additional system burden.

[0029] The prediction entropy benchmark calculation during the training phase achieves quantitative identification based on the inherent characteristics of malicious embeddings. Based on the fully reconstructed embedding using MAE, the prediction probability distribution output by the top-level model allows for the calculation of the individual prediction entropy of each participant.

[0030] Where i represents the sample number, k represents the participant number, and C is the total number of categories. The probability is predicted for the corresponding category. Malicious embeddings, due to carrying strong guiding signals, show significantly lower predicted entropy during isolation evaluation, while the predicted entropy of benign embeddings fluctuates around the historical average. This quantifiable difference provides a core basis for detection. After each round of training, the average predicted entropy of each participant on all training samples is calculated as a benchmark for subsequent anomaly judgment.

[0031] The dual anomaly verification process balances the detection rate and false alarm rate, employing a dual detection method of "self-anomaly + mutual anomaly". During the inference phase, for the participant embedding of each sample, it is first determined whether its predicted entropy is lower than m1 times its own historical average entropy (m1 < 1.0), and then whether it is lower than the maximum predicted entropy of other participants in the same sample, m2 times (m2 < 1.0). Only when both conditions are met is it determined to be a malicious embedding, and a cleanup operation is performed (the malicious embedding part is reconstructed and replaced through MAE).

[0032] Example 2 (a) Implementation Scenarios This invention addresses a vertical federated learning image classification system with fewer than 10 participants, each running a low-level model to extract embedding vectors containing intermediate layer features from the input image. One participant acts as the leader, possessing private label data and running the top-level classification model. The remaining participants are passive participants, using the low-level model for distributed training without transmitting the original image. One of the passive participants is an attacker who implements a backdoor attack.

[0033] The software framework is Python and PyTorch; the experimental validation datasets are CIFAR10 (32×32), CINIC10 (32×32), and Imagenette (160×160); the underlying model of the participants uses ResNet18, and the top-level model of the leader uses a 2-layer fully connected network; the training rounds are 40, the initial learning rate is 0.001, and the poisoning rate is 3%.

[0034] (ii) Generative covert backdoor attack First, there is a two-stage target selection mechanism that includes static candidate pool partitioning and dynamic hard sample mining.

[0035] The attacker selects a specific sample from the local dataset as an "anchor sample," defining the target category of the backdoor attack based on its unknown category. The attacker's core objective is to ensure that all samples containing the backdoor triggering pattern are ultimately classified by the global model into the category of the anchor sample. Following the normal process of vertical federated learning, the attacker uses the lower-level model to calculate the intermediate feature embeddings of all training samples, uploads them to the top-level model, and then receives the gradients of all sample embeddings calculated by deep learning backpropagation. Based on the received gradient information, the attacker calculates the cosine similarity between the gradients of each training sample and the anchor sample embedding to determine their class correlation, thus completing unlabeled class inference. Using the similarity scores of all samples, the attacker can divide the local dataset into two persistent subsets. Samples with higher similarity scores are assigned to the target class candidate pool, while samples with lower similarity scores are assigned to the non-target class candidate pool. These two sets remain unchanged during subsequent training.

[0036] After each training epoch, the L2 norm of the embedding gradients of all samples in the static target class candidate pool is calculated. A larger norm value indicates a higher difficulty in sample classification and a more significant impact on adjusting the model's decision boundary. The top P% (3-5%) samples with the largest L2 norm gradients are selected to form the poisoning target set for the next training epoch. Regularly updating the poisoning target set as the training epochs progress ensures that the poisoning targets always fit the model's current decision boundary, maximizing the attack signal's influence under low poisoning rate constraints and stably guaranteeing attack effectiveness.

[0037] The next step is the backdoor implantation process, which employs a three-stage design.

[0038] The sample switching operation is continuously executed in each training batch, achieving feature replacement between target and source samples. First, a subset of samples belonging to the dynamic poisoning target set is identified in the current training batch; these are the target class samples for which the backdoor needs to be implanted. Simultaneously, a subset of samples belonging to the non-target class candidate pool is identified; these are the source samples for feature replacement. A source sample subset, equal in number to the target class subset, is randomly selected from the non-target class subset for one-to-one matching between target and source samples. Next, data belonging to the target class sample subset in the original feature data of all samples in the current batch is replaced with the feature data of the corresponding source samples. After the feature replacement operation is complete, the forward propagation process of the local underlying model continues.

[0039] The generative poisoning operation employs an autoencoder T composed of fully connected layers to generate sample-specific poisoning embeddings. First, the attacker inputs batch data after sample switching into the local underlying model, and through forward propagation, obtains the benign embeddings for all samples in that batch. These are then input into the autoencoder to generate the malicious embeddings for the entire batch. To strictly control the distribution difference between malicious and benign embeddings and ensure a high degree of consistency between their distributions, the L2 norm of the difference between the malicious and benign embeddings is calculated as the loss function.

[0040] On the other hand, from the full batch of benign embeddings, a subset of target class embeddings corresponding to the dynamic poisoning target set is extracted. At this point, the embedding subset needs to be separated from the model computation graph to cut off its gradient propagation path and prevent the gradient of the attack task from interfering with the main task of the underlying model. After separation, a hybrid poisoning strategy is used to synthesize the final poisoned embeddings. The specific formula is as follows:

[0041] Where H'd represents the final poisoning embedding after synthesis, α is the poisoning mixing factor, and T represents the autoencoder. The original embeddings of the sample subset are used to balance the effectiveness of the attack and the concealment of the embedding. The malicious embeddings (carrying the attack signal) generated by the autoencoder are weighted and fused with the original benign embeddings (ensuring consistent distribution). This can retain the attack signal with sufficient strength while maintaining the distribution similarity between the poisoned embeddings and the benign embeddings to the maximum extent.

[0042] After the final poisoning embedding is synthesized, the target class embedding subset in the original full batch of benign embeddings is replaced with the synthesized poisoning embedding H'd, thus forming the final embedding vector that needs to be uploaded to the active party, completing the generative poisoning operation.

[0043] Finally, there is the controlled gradient flow joint optimization. The attacker uploads the final embedding vector obtained from the generative poisoning process to the active party, and then receives the embedding gradient fed back by the active party. Combining the analysis of the computational graph structure, this feedback gradient can be naturally split into two independent parts: one is the gradient of benign samples, corresponding to the samples in the batch that did not participate in the poisoning, which is mainly used to optimize the main task performance of the underlying model; the other is the gradient of poisoned samples, corresponding to the samples in the batch that participated in the poisoning, whose core role is to guide the autoencoder to learn effective attack signals.

[0044] Considering that this method needs to achieve efficient attack with a low poisoning rate, it is necessary to amplify the gradient of the poisoned sample by multiplying it by the gradient scaling factor γ, so as to enhance the influence of the attack signal.

[0045] After scaling the gradient of the poisoned sample, the backpropagation process of embedding the gradient is executed normally. According to the correlation of the computation graph, the gradient of the benign sample has no relation to the autoencoder T and will be directly propagated to the underlying model along the main task propagation path and accumulate gradients, thereby optimizing the underlying model's ability to extract sample features; while the scaled gradient of the poisoned sample will be propagated to the autoencoder T along the attack task propagation path and accumulate gradients.

[0046] Simultaneously, the locally computed residual loss L needs to be scaled to adjust its relative weight with the classification loss of the top-level model, and then backpropagation is performed. This is because, in the computational graph structure, the underlying model F... m Since the autoencoder T is distributed in series, the backpropagation of the residual loss will proceed in the reverse order of the forward propagation, sequentially at T and F. m Accumulate gradients on the parameters. After all gradients have accumulated, synchronously update the underlying model F. m The parameters of the autoencoder T are used to complete a joint optimization.

[0047] To adapt to the evolution of the model's decision boundary, the values ​​of the gradient scaling factor γ and the residual loss coefficient β are dynamically adjusted during training. This shifts the optimization focus from improving attack effectiveness in the early stages to improving stealth in the later stages. In the early stages of training, a larger γ value is set to strengthen the attack signal, while a smaller β value is set to weaken the residual constraint. As training progresses, the γ value is gradually decreased to reduce the attack signal strength, while the β value is increased to strengthen the constraint effect of the residual loss, guiding the autoencoder to generate poisoned embeddings that are closer to a benign embedding distribution.

[0048] (III) Low-entropy backdoor sample identification The low-entropy backdoor sample identification scheme is fully adapted to the distributed architecture constraints of vertical federated learning, without changing the original collaborative training and inference process. Only a lightweight detection module is added to the active side, which can balance detection performance and system overhead. Its core implementation process consists of three steps: mask autoencoder training, entropy calculation, and dual anomaly verification. The entire process is executed synchronously with the training and inference process of vertical federated learning, and the computational overhead is controllable.

[0049] The masked autoencoder employs a fully connected network with a symmetric structure. Its training strategy includes two reconstruction logics: first, randomly selecting one embedding as the reconstruction target and using all other embeddings as input to complete the reconstruction; second, randomly selecting two embeddings, using one as input to reconstruct the other. The training objective is to minimize the L2 norm of the difference between the reconstructed input and output, enabling it to learn the joint distribution characteristics of benign embeddings and ensuring that it can accurately generate reliable embeddings of all other participants based on the embedding of a single participant.

[0050] Next, the mean of the predicted entropy during the federated learning training phase is calculated as the anomaly detection benchmark. For each training sample i, the embedding fragment for each participant k is calculated. The complete embedding is reconstructed using MAE. The data is then input into the top-level classification model to obtain the predicted probability distribution of the corresponding category for that embedding. Where C is the total number of categories in the classification task. This represents the probability that the embedding is predicted to be of class c. The prediction entropy of the current embedding is calculated according to the mathematical definition of prediction entropy.

[0051]

[0052] After obtaining the set of all entropy values ​​for participant k, calculate the average predicted entropy of participant k across all training samples.

[0053] This serves as the predictive entropy benchmark for subsequent anomaly detection. Here, N represents the number of samples in the training set.

[0054] Finally, there is the dual anomaly detection during the federated learning inference phase. Similar to the calculation of the mean prediction entropy, for each participant's embedding, the MAE is used to reconstruct the complete embedding. The top-level model of the active party outputs the prediction probability distribution, and then the independent prediction entropy is calculated. The dual anomaly detection first checks whether the prediction entropy of the current embedding satisfies the condition. If the conditions are met, it is determined to be an anomaly, indicating that the prediction confidence of the embedding is significantly higher than its normal state; secondly, for the independent prediction entropy of all participants' embeddings in the current sample, the maximum value is extracted. Determine if the current embedding satisfies If the condition is met, it is determined to be mutually abnormal, indicating that the prediction confidence of the embedding is significantly lower than that of the peer embedding.

[0055] Only embeddings that simultaneously satisfy both self-anomaly and mutual anomaly verification can be ultimately identified as malicious embeddings, and a cleanup operation will be performed to prevent them from affecting the inference of the global model. Specifically, using the results of dual anomaly detection, the embeddings of malicious participants are discarded, and the embeddings of benign participants are extracted and input into the MAE module. The MAE module reconstructs the complete embeddings, which are then input into the top-level model to execute the normal inference process.

[0056] Example 3: Generative Covert Backdoor Attacks and Entropy-Based Backdoor Detection 1.1 Overview of Attack Methods This embodiment presents a novel generative covert backdoor attack method. This method is based on the fundamental assumption of a vertical federated learning architecture: the attacker, as a passive participant, can only obtain feature data from local samples but cannot access the private labels held by the active participants, nor can they know the structure and parameters of the top-level classification model. However, the attacker can manipulate the forward propagation process of the local underlying model, read intermediate embedding outputs, and receive residual gradients returned by the active participants. This method revolves around two core objectives: first, to make the global model misclassify samples with specific backdoor patterns as a preset target category, while maintaining the classification accuracy of the main task as much as possible to avoid detection of the attack; second, to make the malicious embeddings statistically as close as possible to normal embeddings, thereby bypassing backdoor defense mechanisms based on embedding anomaly detection.

[0057] Within this framework, the attacker's goal is to covertly implant malicious backdoor patterns into the global model while ensuring its normal convergence. The specific execution flow of the attack method in this chapter can be divided into three stages. First, in the early stages of training, a static candidate pool is divided using gradient similarity recognition to determine the basic range of target class samples. Second, during subsequent training, the attacker continuously uses the gradient norm to filter difficult samples in the candidate pool and dynamically adjusts the final poisoning target selection accordingly. Finally, within each training batch, the autoencoder generates a consistently distributed malicious embedding based on the above optimization objectives and updates the local network parameters through a controlled gradient flow. The implementation details of this process will be further described below.

[0058] 1.2 Target Selection Process 1.2.1 Static Candidate Pool Partition In a vertical federated learning scenario, the attacker acts as a passive participant, only responsible for providing their local partitioned sample data as input data for the global model's collaborative training. The attacker selects a specific sample from their local dataset. As anchor samples, and with their unknown categories To define the target category of backdoor attacks Therefore, the attack aims to cause all samples with implanted backdoor patterns to be misclassified by the global model as belonging to the same category as the anchor sample.

[0059] Once the anchor sample is determined, the attacker needs to narrow down the range of target class samples through static candidate pooling, filtering out a set of samples of the same and different classes as the anchor sample from the local unlabeled samples. This method uses a strategy of calculating gradient cosine similarity to accomplish this partitioning.

[0060] In the first round of training, the attacker Use your own local data and underlying model Perform forward propagation to calculate the embedding matrix, which includes anchor samples. The calculation formula is as follows:

[0061] in, These are the network parameters of the local underlying model. Subsequently, this embedding matrix is ​​uploaded to the active party, which then uses it to classify the data based on the top-level classification model. Combined with real labels Calculate the global classification loss function And apply the loss to the gradient matrix of each embedding. It is sent back to the attacker. For any sample... The formula for calculating the backpropagation gradient is:

[0062] in, The parameters representing the top-level model, That is the sample The true label.

[0063] After obtaining the backpropagation gradient matrix The attacker extracts the tensor row by row, separating the gradient vectors corresponding to the anchor samples. Then, the attacker used the anchor gradient as a fixed reference point to calculate the gradients of the remaining samples in the matrix. Cosine similarity score between the anchor gradient and the anchor point gradient :

[0064] Based on the similarity scores of all samples, an attacker can divide the local dataset into two subsets, thus constructing a static candidate pool. Samples with higher similarity scores enter the target class candidate pool. These samples should theoretically belong to the same category as the anchor samples, which is the target category of backdoor attacks. Samples with low similarity are placed into the non-target class candidate pool. It is important to note that the static partitioning described above is only performed once after the first training epoch and remains unchanged throughout the entire training process. This is because the model's prediction uncertainty is highest in the early stages of training, and it contains more category-related information.

[0065] 1.2.2 Dynamic Hard Sample Mining To ensure the targeting and effectiveness of the attack, the poisoning target needs to be dynamically adjusted as the model's decision boundary changes. In longitudinal federated learning, backdoor attacks must be carried out with a low poisoning rate to maintain the classification accuracy of the main task as much as possible and reduce the risk of detection. However, if the poisoning samples are manipulated frequently and in large quantities, it will disrupt the model's stable learning of the mapping relationship between legitimate features and true labels. This objective constraint of a low poisoning rate weakens the influence of the backdoor signal. To address the above problem, this method prioritizes samples that have a greater impact on model parameter updates, aiming to increase the intervention of poisoning sample manipulation on the model optimization process without violating the low poisoning ratio constraint. This is based on the deep learning optimization principle of gradient descent: in each iteration, the update magnitude of the model weights is positively correlated with the magnitude of the gradient of the loss function relative to the sample features. This means that the gradient... The larger the norm of a sample, the more difficult it is for the global model to classify it, and the more significant its impact on the model's decision boundary. In scenarios with low poisoning rates, prioritizing these difficult samples as targets for backdoor implantation can strengthen the guiding role of the backdoor signal in updating model parameters without increasing the number of poisoned samples.

[0066] In any training round At the end, the attacker first iterates through the static target class candidate pool. All samples (total number of samples) For each sample, the attacker extracts the residual gradient returned by the active party. And calculate the current difficulty metric score for the sample. It is defined as the residual gradient. Norm:

[0067] Then, the algorithm... All samples are scored according to difficulty. Sort in descending order. To strictly meet the stealth requirements of a low poisoning rate, the attacker sets the poisoning ratio to be... Based on this, the maximum number of poisons allowed in the current round can be obtained. The algorithm selects samples that meet the criteria from the queue. As training continues, the global model parameters are continuously updated, and the decision boundary changes accordingly. This dynamic mechanism allows the selection scope to focus on the target category, ensuring that the selection of poisoned samples always closely follows the evolution of the model's decision boundary.

[0068] 1.3 Backdoor Implantation Process 1.3.1 Label Association Based on Input Feature Replacement Feature substitution is an indispensable step in backdoor implantation. In a vertical federated learning scenario, attackers cannot directly tamper with the active party's labels, so they can only manipulate the underlying local feature space. This method uses the dynamically selected poisoning target set from the previous stage in each training epoch. This replaces the local features with features from non-target classes (source classes), thus laying the foundation for establishing the correspondence between backdoor triggering patterns and target labels.

[0069] In each training batch In this process, the attacker first extracts a subset of samples belonging to the dynamic target set. and a subset of samples belonging to the non-target class candidate pool. To construct a replacement source, the attacker would... Randomly select quantity and Identical samples form the source sample set. Specifically, given a target sample set With source sample set In this case, the algorithm will construct a one-to-one replacement mapping relationship. Then, based on this, a tensor slice overlay operation is performed on the local input data within the batch. This process can be represented as:

[0070] 𝑥Among them, Represents the original local feature vector. This represents the replaced feature vector. According to the mapping relationship, only samples in the poisoned target set will be replaced with the features of the original samples, while other benign samples remain unchanged. After the replacement is complete, the data will continue to be input into the underlying model. Propagate forward.

[0071] 1.3.2 Malicious Embedding Generation Based on Autoencoder In a vertical federated learning framework, the underlying model is primarily responsible for feature extraction. The active party only receives highly abstract embedding vectors and cannot directly see the original image or text data. Therefore, the stealth metric pursued by backdoor attacks should shift from "visually invisible" at the original data level to "statistically indistinguishable" at the embedding vector level. If a uniform static trigger is used in the embedding space—that is, the same fixed vector perturbation is superimposed on all target samples—then the poisoned samples will be more likely to cluster in the embedding space, making them easier to detect. Therefore, attackers need to design specific backdoor perturbation patterns for different samples. Autoencoders, through nonlinear feature mapping and combined with reconstruction loss constraints, can dynamically generate input-dependent perturbations, thereby ensuring that the embedding vectors carrying the backdoor pattern still follow the statistical distribution of the original sample embeddings.

[0072] like Figure 1 As shown, the covert backdoor attack method proposed in this embodiment consists of two parts: malicious embedding generation and controlled joint optimization. The forward computation process of the generative poisoning stage will be introduced in detail below.

[0073] observe Figure 1 On the left, the batch data obtained after sample switching processing. First, input the local low-level feature extractor. The set of benign embeddings corresponding to this batch is calculated through forward propagation:

[0074] in This represents the network parameters of the underlying model. Next, the benign embedding is fed into an autoencoder consisting of fully connected layers. This allows us to obtain the malicious embedding corresponding to each sample in the batch.

[0075] To control the distribution deviation between the generated embedding and the original embedding, the algorithm uses... For reference, the residual loss based on the MSE mean square loss function is calculated. Under this reconstruction loss constraint, the autoencoder... It can learn the statistical regularities of benign embeddings and constrain the distribution of malicious patterns in the feature space.

[0076] On the other hand, the algorithm will extract from the entire batch of embeddings Extract the target set corresponding to the dynamic poisoning. target class embedding subset Considering that attack gradients may negatively impact the performance of the underlying model's main task, this method... This involves separating the algorithm from the computational graph and severing the gradient propagation path. Subsequently, to adjust the attack strength, the algorithm introduces a poisoning hybrid factor. The autoencoder output and the original embedding are weighted and fused to obtain the final poisoned embedding:

[0077] This approach preserves the effective attack signals in malicious embeddings while maintaining the greatest possible distributional similarity between them and benign embeddings.

[0078] Finally, the attacker embedded the original batch target subset Replace with synthetically obtained poison embedding This forms the embedding vector that will ultimately be uploaded to the active party. In this way, generative poisoning not only makes up for the shortcomings of traditional backdoor attacks, which are easily identified due to their anomalous embedding distribution, but also ensures that the attack remains robust in more complex federated environments through a hybrid strategy.

[0079] 1.3.3 Joint Optimization Based on Computational Graph Truncation After completing forward feature propagation and calculating the global loss, the algorithm enters the backpropagation and parameter update phase. To prevent attacks from interfering with the normal convergence of the underlying feature extractor, this method introduces a computational graph truncation operation during the embedding generation phase and controls and isolates the gradient flow during backpropagation.

[0080] like Figure 1 As shown in the right half, the backpropagation gradient in the joint optimization consists of two parts: one part comes from the classification loss gradient calculated by the active classifier, and the other part comes from the residual loss gradient calculated locally. Specifically, the entire backpropagation is broken down into four independent gradient flow paths.

[0081] First, the global embedding gradient back propagated by the active party after calculating the classification loss. The system breaks it down into a gradient of poisoned samples. With benign sample gradient Two parts. For the gradient of the poisoned sample, in order to enhance the attack signal strength under low poisoning rate conditions, the algorithm will first combine the gradient with the scaling factor before updating the autoencoder parameters. Multiplying them together, we get:

[0082] This operation amplifies the attack signal without actually increasing the number of poisoned samples.

[0083] When the gradient of the poisoned sample enters the autoencoder After updating its network parameters, gradient propagation stops here because a computation graph truncation mechanism has been set during forward propagation, preventing it from continuing to propagate to the lower-level model. In contrast, the gradient of benign samples It will bypass the autoencoder and directly enter the underlying model along the propagation path of the main task. This ensures that the feature extraction capability of the main task can be optimized normally.

[0084] Secondly, regarding the residual loss calculated locally. The algorithm will multiply it by a scaling factor. :

[0085] This is done to adjust its relative weight to the top-level classification loss. In the context of... During backpropagation, the gradients generated by the reconstructed embedding are first propagated back to the autoencoder. It then continues to propagate downwards into the underlying model. The gradient generated by benign reference features bypasses the autoencoder and goes directly down to the lower-level model. .

[0086] Through the above four paths, the autoencoder It receives amplified poisoning gradients to learn attack patterns, while being constrained by residual gradients to ensure stealth; the underlying model It receives information from the gradients of benign samples and residual gradients, and generates intermediate embeddings that are easier to reconstruct while maintaining the performance of the main task.

[0087] 1.4 Entropy-based backdoor detection To address the shortcomings of existing defense methods, this embodiment proposes an entropy-based backdoor detection (EBD) scheme within a distributed architecture of vertical federated learning. This scheme distinguishes between malicious and benign embeddings by independently evaluating the uncertainty of feature predictions for each participant, without altering the existing federated collaboration process or introducing additional communication overhead.

[0088] 1.4.1 Theoretical Basis of Low-Entropy Detection Mechanism This section proposes an entropy-based backdoor detection scheme primarily targeting generative covert backdoor attacks initiated by a single participant. Its core idea is to combine the feature reconstruction capabilities of a masked autoencoder with a prediction entropy anomaly detection mechanism. This scheme employs an isolation analysis strategy, utilizing the local embeddings of a single participant to supplement missing information from other participants, thereby independently assessing the participant's impact on the global prediction result. This design aims to leverage the low prediction entropy exhibited by generative malicious embeddings during independent evaluation to establish a reliable defense barrier.

[0089] In the collaborative inference process of vertical federated learning, the predictions of the top-level model of the active party usually rely on the joint embedding formed by concatenating features from all participants. Because of the strong coupling between the characteristics of each party and the classification decision, it is often difficult to directly determine the extent of a particular participant's contribution, making anomaly detection challenging. To address this issue, this proposal suggests an isolation analysis strategy that utilizes local embeddings to reconstruct the global distribution, thereby enabling a separate assessment of the impact of specific participants.

[0090] For a given participant K, its local embedding can be achieved by constructing a reconstruction mapping function Φ. Reconstructed into a complete joint embedding :

[0091] At this point, the active party can observe the changes in the classification boundary dominated by the features of participant k.

[0092] The key challenge that isolation analysis aims to address is how to reconstruct a high-confidence global joint embedding based solely on local features when the true features of other participants are lacking. In practice, the active party utilizes the benign embedding joint distribution pattern learned by a masked autoencoder to reconstruct the received local embeddings... With mask vector This process combines and completes the missing features, resulting in the final, fully joint embedding. :

[0093] Since the masked autoencoder learns the possible semantic relationships between the features of different participants during the training phase, this reconstruction operation can infer the matching global joint embedding based on local features.

[0094] After isolating and reconstructing local features, it is necessary to introduce corresponding quantitative metrics to measure the impact of the reconstructed embedding on the global classification decision. This scheme uses Shannon entropy to measure prediction uncertainty. Malicious signals injected by generative backdoor attacks typically exhibit low prediction entropy when evaluated independently. This is because, under the condition of vertical feature segmentation, malicious embeddings must carry clearly directional interference signals in order to suppress the benign features of other participants and forcibly change the global decision. When the malicious embedding is extracted and reconstructed separately, this directionality it carries can cause the top-level classifier to make overconfident predictions.

[0095] To address the problem of malicious embedding identification in complex federated learning environments, this scheme designs a dual anomaly detection mechanism based on entropy. The first step is self-anomaly detection. Since the feature information content of each participant differs, their corresponding normal prediction entropy benchmarks will also differ. The algorithm compares the current independent prediction entropies... The historical average prediction entropy accumulated by the participant during the training phase To judge Whether it deviates from the normal fluctuation range. The second item is mutual anomaly detection. To further avoid global low entropy misjudgment caused by the overall low classification difficulty of the samples (i.e., all participants show high confidence), the algorithm will... The embedding is compared with the maximum independent prediction entropy of other participants in the same batch. This condition leverages the characteristic that benign participants have relatively higher prediction entropy in federated learning, improving the reliability of the judgment through horizontal comparison. This scheme employs a cascaded dual-constraint strategy: the embedding is only judged as malicious when both the self-anomaly and mutual anomaly judgment conditions are met simultaneously. Through this dual judgment, this scheme can control the risk of false positives while maintaining a high detection rate.

[0096] 1.4.2 Design and Implementation of Defense Algorithms This section details the process for identifying and cleaning up low-entropy backdoor samples. This defense mechanism is deployed entirely locally on the active party, identifying and filtering the impact of malicious embeddings through benchmark building during the training phase and real-time detection during the inference phase, without altering the original collaboration protocol.

[0097] (1) Training the mask autoencoder The key foundation for achieving feature reconstruction lies in the training of the masked autoencoder. During the training process of vertical federated learning, the active party concatenates the local embeddings uploaded by each participant into a joint embedding. Subsequently, the active party uses this joint embedding to synchronously train the masked autoencoder module, enabling the model to learn the joint distribution patterns corresponding to benign data.

[0098] For a specific participant k, the initiator will generate a corresponding mask matrix. The visible portion is composed of... This indicates that the obscured part of the target is... This indicates that, for both training strategies, the training objective of the masked autoencoder is to predict the features of the masked portion using the unmasked features. To enable it to grasp the intrinsic relationships between benign embeddings, this scheme sets the feature reconstruction objective as minimizing the mean squared error loss:

[0099] Through the above training, the mask autoencoder module can generate corresponding global reconstructed features based on local features, thereby providing support for subsequent isolation analysis.

[0100] (2) Constructing a participant prediction entropy benchmark Because different participants possess varying feature dimensions and amounts of information, directly setting a uniform global threshold can easily lead to misjudgments. Therefore, the active party needs to establish an entropy benchmark corresponding to the normal prediction level for each participant. For example... Figure 2 As shown, after each round of training, the active party will use the training dataset to complete the benchmark calculation.

[0101] For each training sample The active party is first the participant. Constructing a complete embedding for independent reasoning Specifically, the active party first obtains the concatenated joint embedding vector. Then use participant-oriented mask vector from Extracting participants Uploaded real partial embedding :

[0102] Then, the extracted local embeddings are input into the already trained mask autoencoder module to reconstruct the global joint embedding based on the local visible features:

[0103] Because the reconstructed joint embedding includes participants The features that were already known are now being used with an inverse mask. Extract for other The reconstructed feature parts generated by each participant, and the participants True local embedding By combining them, we obtain the final complete embedding vector for independent evaluation. :

[0104] After completing the isolation reconstruction, the active party obtains the corresponding probability distribution through the top-level classifier and calculates the independent prediction entropy. Then calculate the participants. Historical average predicted entropy This mean reflects the situation under the current model state, using only participants. The average level of uncertainty when making independent predictions based on information can be used as a reference for subsequent anomaly judgment.

[0105] (3) Abnormal sample identification and purification Once in the inference phase, the system identifies malicious embeddings through dual anomaly verification. The entire process combines self-anomaly and mutual anomaly determination to achieve a balance between detection capability and the risk of false positives.

[0106] First, perform self-anomaly verification to determine the current embedded prediction entropy. Is it significantly lower than the participant's historical average? If this condition is met, it indicates that the embedding exhibits significantly higher predictive confidence than the participant's usual state, raising suspicion of malicious intent. In this case, further mutual anomaly verification should be conducted to determine... Is it significantly lower than the maximum entropy value of other participants in the same batch? If this condition also holds, it further indicates that the embedding's predictive confidence is not only anomalous relative to itself, but also significantly anomalous among its peers in the current batch.

[0107] When both of the above conditions are met, the system classifies the local embedding as malicious. To prevent malicious embedding from affecting the global model, the system performs a cleanup operation. Specifically, the system first identifies the set of malicious participants. Then dynamically generate a security mask. Subsequently, the safe, benign embeddings are extracted using this mask and input into a mask autoencoder for reconstruction to obtain the global embedding. Finally, the original malicious features are replaced with the cleaned and reconstructed features, and combined with the benign embeddings to form a complete embedding vector, which is then fed into the top-level model to complete normal global inference. This mechanism can reduce interference from malicious features and achieve filtering of generative poisoning signals.

[0108] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for security attack verification and defense hardening based on vertical federated learning, characterized in that, The steps are as follows: S1: During the collaborative training process of vertical federated learning, a generative covert backdoor attack is executed through the security verification module to simulate a highly covert backdoor threat and verify system vulnerabilities. S2: The embedding vectors uploaded by the participants are reconstructed by the security hardening module based on the mask autoencoder (MAE), and the independent prediction entropy of each participant is calculated. S3: Based on the independent prediction entropy, perform dual anomaly verification on the participant embedding, identify malicious embedding and perform purification operations to achieve defense reinforcement.

2. The security attack verification and defense hardening method for vertical federated learning according to claim 1, characterized in that, The generative covert backdoor attack includes dynamic target selection and backdoor implantation; S11: The dynamic target selection includes: the attacker's computing node divides the static target class candidate pool and the non-target class candidate pool based on the cosine similarity of the embedding gradient in the early stage of training, and calculates the embedding gradient L2 norm of the target class candidate pool samples after each round of training, and selects the sample with the largest norm as the poisoning target set for the next round. S12: The backdoor implantation includes: in each training batch, replacing the features of non-target class samples with the features of target class samples by sample switching, generating a malicious embedding consistent with the benign embedding distribution using an autoencoder, and uploading the poisoned embedding to the active party after synthesizing it through a hybrid factor. S13: Receive the gradients fed back by the active party, split them into gradients of benign samples and gradients of poisoned samples, and backpropagate them to update the parameters of the underlying model and the autoencoder, thereby achieving joint optimization of the attack task and the main task.

3. The security attack verification and defense hardening method for vertical federated learning according to claim 2, characterized in that, The backdoor implantation also includes controlled gradient flow joint optimization: the gradient of the poisoned sample is multiplied by the gradient scaling factor γ to amplify it, so as to enhance the influence of the attack signal; at the same time, the residual loss is scaled and its relative weight with the classification loss is adjusted, and the values ​​of γ and the residual loss coefficient β are dynamically adjusted to achieve the optimization focus shift from attack effectiveness in the early stage of training to concealment in the later stage.

4. The security attack verification and defense hardening method for vertical federated learning according to claim 1, characterized in that, The security hardening module includes MAE training, prediction entropy benchmark calculation, and dual anomaly verification. S21: The MAE training includes: after the active party server receives the embedding vectors uploaded by each participant, it adopts a strategy of randomly selecting one embedding as the reconstruction target and using other embeddings to complete the reconstruction, or randomly selecting two embeddings to reconstruct the other from one, and trains the MAE module to learn the joint distribution features of benign embeddings. S22: The calculation of the prediction entropy benchmark includes: reconstructing the complete embedding based on the single participant embedding using the trained MAE, inputting it into the top-level classification model to obtain the prediction probability distribution, and calculating the average prediction entropy of each participant on all training samples as the benchmark for subsequent anomaly judgment.

5. The security attack verification and defense hardening method for vertical federated learning according to claim 4, characterized in that, The dual anomaly verification includes: S31: During the inference phase, calculate the independent prediction entropy for the participant embedding of each sample; S32: Self-anomaly judgment: Determine whether the predicted entropy is lower than m1 times the historical average entropy of the participant, where m1 < 1.0; S33: Mutual Anomaly Judgment: Determine whether the predicted entropy is lower than m2 times the maximum predicted entropy of other participants in the same sample, where m2 < 1.0; S34: If both self-abnormal and mutual abnormal conditions are met, it is determined to be malicious embedding, and a cleanup operation is performed. The malicious embedding part is reconstructed and replaced through MAE.

6. A security attack verification and defense hardening system for vertical federated learning, characterized in that, include: There are K participating computing nodes, each running the underlying model to extract intermediate layer embedding vectors from local data; An active server runs the top-level classification model and integrates a security verification module and a security hardening module; The security verification module is used to execute generative covert backdoor attacks, simulate highly covert backdoor threats, and verify system vulnerabilities. The security hardening module includes a mask autoencoder (MAE), a predictive entropy calculation unit, and a dual anomaly verification unit, which are used to identify malicious embeddings and perform cleanup operations.

7. The security attack verification and defense hardening system for vertical federated learning according to claim 6, characterized in that, The security verification module includes a dynamic target selection unit and a backdoor implantation unit; The dynamic target selection unit is used to divide the static candidate pool based on the cosine similarity of the embedded gradient in the early stage of training, and to select the next round of poisoning target set based on the gradient L2 norm after each round of training. The backdoor implantation unit includes a sample switching module, an autoencoder module, and a controlled gradient flow optimization module, which are used to generate malicious embeddings consistent with benign embedding distributions and synthesize poisoned embeddings through hybrid factors, while simultaneously updating the underlying model and autoencoder parameters.

8. The security attack verification and defense hardening system for vertical federated learning according to claim 6, characterized in that, In the security hardening module: The MAE adopts a fully connected network with a symmetric structure. The training strategy includes using a random embedding as the reconstruction target, using other embeddings for reconstruction, or using one of two random embeddings to reconstruct the other. The prediction entropy calculation unit is used to calculate the independent prediction entropy of each participant based on the complete embedding of MAE reconstruction. The dual anomaly verification unit is used to perform dual judgments on the participant embedding of each sample, including self-anomaly and mutual anomaly, to identify malicious embedding and trigger a cleanup operation.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A vertical federated learning system, characterized in that, It includes multiple participating computing nodes, an active server, and the computer-readable storage medium as described in claim 9. When the computer program is loaded and executed, it realizes backdoor attack verification and defense hardening in the vertical federated learning training and inference process.

Images