Understanding Backdoor Vulnerabilities in Vertical Federated Learning: The Gap Between Research and Practice

Abstract: Vertical Federated Learning (VFL) enables organizations holding complementary features of shared entities to collaborate and train models. In this setting, the initiator can withhold information about the learning task, while other contributors participate without exposing their local datasets, creating an asymmetric information structure aligned with growing privacy demands. However, this asymmetry is a double-edged sword. Among various threats, backdoor attacks are particularly concerning because VFL not only enables malicious contributors to poison the model during training, but also allows them to activate the backdoor at inference time to manipulate predictions. Although prior work has reported near-perfect attack success rates and proposed effective defenses, we find that most findings fail to hold under realistic conditions, exposing a fundamental gap between research and practice. In this paper, we present a systematic, practice-oriented study of backdoor vulnerabilities in VFL, revealing this gap in both methodological design and evaluation practices. We show that existing approaches overlook key practical constraints and therefore rely on unrealistic prior knowledge. Furthermore, these limitations have remained hidden due to poorly designed evaluation practices in the literature. To bridge this gap, we redefine threat models under realistic constraints, propose practical backdoor workflows, and introduce BVBench, a backdoor-centric benchmark that enables fair, practical, and comprehensive evaluation, preloaded with state-of-the-art baselines. BVBench provides strong evidence of the fragility of the current understanding of VFL backdoor risks and establishes a foundation for steering research toward uncovering practical vulnerabilities and developing more meaningful defenses.

• The paper shows that existing VFL backdoor attacks rely on unrealistic task knowledge, with reported attack success rates often falling below 30% under fair configurations and no surveyed attack remaining feasible without such knowledge.
• The paper introduces BVBench, a benchmark spanning five realistic datasets, nine attacks, and eight defenses, using standardized metrics for efficacy, stability, stealthiness, robustness, and computational overhead.
• The paper finds that no evaluated defense simultaneously preserves model utility, suppresses attacks, and restores correct predictions, while effective attacks are often highly detectable and defenses weaken against multiple adversaries.

This paper presents a systematic, practice-oriented study of backdoor vulnerabilities in Vertical Federated Learning (VFL), arguing that the current literature substantially overstates both attack effectiveness and defense reliability because of unrealistic threat models and flawed evaluation practices (2608.12962). The authors—researchers at The University of Hong Kong—systematize existing attacks and defenses, redefine practical threat models grounded in VFL's inherent information asymmetry, and introduce BVBench, a backdoor-centric benchmark that enforces fair configurations, realistic datasets, and comprehensive metrics. Their empirical results indicate that no existing attack remains feasible under a realistic threat model and that no existing defense simultaneously preserves utility, suppresses attacks, and recovers correct predictions.

Background: VFL structure and backdoor threats

VFL enables an active party (which holds labels and defines the task) to collaborate with passive parties holding complementary features of shared entities. Passive parties process raw data locally through bottom models $\mathcal{F}^B_i$, exchange embeddings $\boldsymbol{\mathcal{E}}_i$ during forward passes, and receive gradients w.r.t. their embeddings during backward passes; the active party aggregates embeddings via a top model classifier $\mathcal{F}^T$. This creates a fundamental information asymmetry: passive parties never observe labels or class semantics, while the active party never observes raw data.

Backdoor attacks exploit this asymmetry in two ways. A malicious passive party participates in training, where it can poison the model by establishing trigger–target associations, and in inference, where it can inject triggers directly into the embedding space—bypassing input-space constraints such as valid pixel ranges. However, the same asymmetry also imposes challenges: passive parties cannot observe ground-truth labels, complicating the construction of trigger–target shortcuts, and each adversary controls only its own bottom model rather than the full pipeline. Defenses, conversely, benefit from cross-party visibility (the active party sees all embeddings) but cannot simply exclude a suspected party, since all parties are required at inference and exclusion would require system reconstruction.

Systematizing attacks: unrealistic knowledge assumptions

The paper's central methodological critique concerns attacker prior knowledge. All surveyed attacks (BackSplitVFL, LMP, PMP, VILLAIN, BadVFL variants, LFBA, HijackVFL, BAEVFL) assume some form of task-related knowledge: target-class labels ($\mathcal{L}_{target}$), the full label space ($\mathcal{L}_{full}$), or access to the top model posterior $\mathcal{P}$ during inference. The authors argue these assumptions conflict with VFL's design—the active party has no obligation to disclose task semantics, and passive parties do not even know the number of classes. Relaxing these assumptions significantly reduces reported attack success rates. Under the paper's redefined practical threat model—an adversary with standard passive-party capabilities but no task-related prior knowledge—no existing attack remains feasible. This is a strong claim: it implies the entire body of VFL backdoor attack literature evaluates attacks under conditions unlikely to occur in deployment.

Beyond threat models, the paper identifies three design-level gaps relative to a proposed "practical backdoor workflow" (unsupervised label clustering, pseudo-labeling with per-cluster triggers, multi-target learning):

• Label acquisition: existing methods infer labels from gradients or embeddings, but both signals are unstable across training—gradients are informative only early, embeddings only after the bottom model matures.
• Trigger design: fixed, class-agnostic triggers (used by VILLAIN, BadVFL*, LFBA) cannot support multi-target learning, and even class-aware triggers suffer from inter-trigger interference that can drastically degrade effectiveness on some targets.
• Stealthiness: current stealthiness definitions rely on weak heuristics (norm bounds, standard-deviation-based patterns). BackSplitVFL's norm constraint still yields highly anomalous embeddings detectable via a 99% quantile check. The paper proposes defender-driven, embedding-space stealthiness criteria instead.

Systematizing defenses: reference-data dependence and recovery failure

On the defense side, all four VFL-specific defenses (VFLMonitor, VFLIP, GBD, UBD) explicitly or implicitly require clean reference embeddings or knowledge of the adversarial environment (number of attackers, target classes)—assumptions the authors deem impractical. Under their redefined defense threat model, no existing VFL-specific defense remains practical. Additional design weaknesses include hyperparameter sensitivity (e.g., VFLMonitor's top-$k$ parameter drastically shifts the TPR/FPR trade-off yet cannot be tuned without dataset-specific validation) and single-target assumptions (UBD).

The most consequential gap is post-attack utility recovery. Even defenses claiming recovery capability fail to restore correct predictions: suppressing ASR alone leaves defended samples misclassified. By analogy to Robust Accuracy in BackdoorBench, the authors argue such defenses should be considered failed.

Evaluation flaws motivating BVBench

The paper documents systematic evaluation deficiencies across the literature: incomplete baseline comparisons (over half the surveyed methods lack official code), heterogeneous and highly sensitive configurations (model depth, optimizer, learning rate differ across studies, so reported gains may reflect configuration bias), reliance on artificial datasets (predominantly CIFAR-10 with arbitrary feature splits), fragmented metrics, and poor reproducibility. Existing VFL benchmarks (VertiBench, MARS-VFL, VFLAIR) provide engines and datasets but little backdoor-specific support.

BVBench addresses this with a unified VFL engine enforcing strict information asymmetry, five realistic datasets spanning image, tabular, and multimodal modalities (Satellite with 16 parties, KUHAR, PTB-XL, Vehicle, NUSWIDE with 269,648 samples), nine reimplemented attacks and eight defenses (over 20,000 lines of PyTorch), and standardized recipes covering efficacy, dependency, stability, robustness, stealthiness, and overhead. Notably, it adopts macro-averaged MTA and ASR to prevent majority-class bias—a deliberate departure from conventional metric definitions.

Empirical findings on attacks

The benchmark results substantially revise prior claims:

Finding	Evidence
Utility degradation on realistic data	MTA drops up to 50.50% (KUHAR), 13.39% (Satellite), 17.78% (PTB-XL)
Inflated ASR claims	Attacks reporting >80% ASR on CIFAR-10 fall below 30% under fair configuration
Dataset sensitivity	BadVFL* ASR varies by 92.39% between best and worst cases
Majority-class bias	Nearly all attacks peak on Satellite's Class 2; BackSplitVFL achieves 100% ASR there while failing completely on others

Dependency analysis using LFBA shows label quality is decisive where attacks work (a 20% reduction in label quality costs over 25% ASR) but insufficient elsewhere—even perfect labels yield zero ASR on Satellite. Stability analysis reveals severe randomness sensitivity: BAEVFL's ASR on Vehicle oscillates between 100% and 0% within consecutive epochs, meaning favorable results may reflect checkpoint selection rather than genuine capability. Environment robustness experiments show embedding-space attacks consistently outperform input-space attacks regardless of feature fraction controlled, and colluding attackers reinforce one another while conflicting attackers interfere. Stealthiness analysis yields perhaps the paper's sharpest conclusion: effective attacks are highly detectable—when ASR is high, ROC-AUC of the stealthiness metric approaches 1.0, dropping to 0.6–0.7 only when attacks fail. Label-free stealthiness estimation correlates with oracle-mode detection at up to 0.98, providing a deployable approximation. The implication is that practical VFL backdoors may be considerably easier to detect than previously assumed.

Empirical findings on defenses

No evaluated defense simultaneously satisfies the three objectives of utility preservation, attack suppression, and recovery. The utility–security trade-off is stark: VFLIP reduces ASR from 20.48% to 6.18% on KUHAR but collapses MTA to 0.31%; GBD preserves utility (MTA 59.98%) but leaves ASR at 15.23%. Recovery is uniformly poor—VFLMonitor cuts ASR from 73.68% to 29.03% on Vehicle yet recovers only 31.79% UR against 62.52% MTA. Per-class analysis exposes uneven protection: VFLIP suppresses some classes below 10% ASR while strengthening the attack on the majority class. Multi-adversary experiments show defenses provide marginal protection against colluding attackers and can inadvertently facilitate attacks when adversaries pursue conflicting targets. These results imply that aggregate-metric evaluations systematically conceal failure modes that matter operationally.

Limitations and open questions

The authors state plainly that the study is not exhaustive: it covers neural-network-based VFL and single-label classification only, excluding tree-based, graph-based, and other VFL paradigms. The work recalibrates understanding rather than proposing new attacks or defenses, so whether any attack can satisfy the practical workflow (robust unsupervised label acquisition, balanced multi-target triggering, defender-driven stealthiness) remains open. Similarly unresolved are why attacks fail even with perfect label knowledge on some datasets, how to achieve a favorable efficacy–stealthiness trade-off, and how defenses can achieve reliable utility recovery and balanced protection under multi-adversary conditions. The redefined threat models themselves rest on the assumption that task-related knowledge is genuinely inaccessible—a reasonable reading of VFL protocol but one that could be challenged in deployments with loose information boundaries.

Conclusion

This paper demonstrates that the reported near-perfect success rates of VFL backdoor attacks and the claimed effectiveness of corresponding defenses do not survive contact with realistic threat models, fair configurations, and realistic datasets. Through systematization and the BVBench benchmark, it establishes that current attacks depend on inaccessible knowledge and are unstable, non-stealthy, and dataset-sensitive, while current defenses trade off utility against protection, fail at recovery, and degrade under multi-adversary settings. The benchmark, evaluation recipes, and redefined threat models provide a foundation for future work aimed at uncovering genuinely practical vulnerabilities and designing defenses whose value can be measured reliably (2608.12962).