---
title: Function Hijacking Attack (FHA) Overview
url: https://www.emergentmind.com/topics/function-hijacking-attack-fha
type: topic
---

# Function Hijacking Attack (FHA) Overview

to=arxiv_search.search ＿影音先锋 ＿一本道 2000
{"query":"all: \"Function Hijacking Attack\" OR all: \"training-hijacking\" OR all: \"feature space hijacking\" OR all: \"model hijacking attack\" OR all: \"Breaking MCP with Function Hijacking Attacks\"","max_results":10,"sort_by":"submittedDate","sort_order":"descending"}
to=arxiv_search.search  大发时时彩 
to=arxiv_search.search  уйғурларға  大发快三是不是 2000
{"query":"ti:\"SplitGuard\" OR ti:\"Feature Space Hijacking Attacks against Differentially Private Split Learning\" OR ti:\"Model Hijacking Attack in Federated Learning\" OR ti:\"SnatchML\" OR ti:\"Breaking MCP with Function Hijacking Attacks\"","max_results":10,"sort_by":"relevance","sort_order":"descending"}
Function Hijacking Attack (FHA) denotes a family of attacks in which an adversary causes a system, model, or exposed capability to execute an attacker-chosen function rather than the one intended by the nominal task, protocol, or user objective. The term is not used uniformly across the literature surveyed here. In split learning, the closest operational term is **training hijacking**, where a malicious server shapes the client-side network through attacker-controlled gradients so that the client learns a different mapping, typically one that improves private input reconstruction [2108.09052]. In federated and vertical federated learning, related work uses **model hijacking** or **hijacking attack** to describe repurposing a trained model or federated predictor for an attacker-chosen task [2408.02131], [2406.01708], [2507.10162]. In function-calling and agentic LLM systems, FHA is used directly for attacks that manipulate tool selection and force invocation of an attacker-chosen function [2604.20994]. This suggests that FHA is best understood as an umbrella label for **function redirection**, with the concrete attack surface determined by the surrounding architecture.

## 1. Terminology and conceptual scope

In the split-learning literature, the most precise formulation is that a malicious server can “direct the client model towards learning any task of its choice,” including outputting representations that are “easily invertible” [2108.09052]. In that setting, the mechanism is **hijacking the optimization process via gradients**, while the outcome is that the client learns the wrong function. The literature summarized here explicitly characterizes this as a close match to what would be called a function hijacking phenomenon in split learning [2108.09052].

A closely related but distinct naming choice appears in the split-learning attack literature under **Feature-Space Hijacking Attack (FSHA)**. FSHA does not define FHA as a separate class, but it actively alters the server-side training procedure so that the client-side model \(f\) is pushed to emit representations that lie in an attacker-chosen feature space, from which an attacker-controlled decoder can reconstruct private inputs [2201.04018]. In this sense, the hijacked object is the **feature function** at the cut layer rather than the entire end-to-end classifier.

Other subfields use different labels for comparable phenomena. In federated learning, **HijackFL** repurposes a global model to perform a different task while preserving utility on the original task [2408.02131]. **SnatchML** studies inference-time repurposing of a deployed model, without training access, by exploiting information already exposed by logits or feature activations [2406.01708]. In function-calling LLMs, FHA is defined directly as a targeted adversarial attack that poisons one function description so that the model selects an attacker-chosen function instead of the semantically correct one [2604.20994]. A plausible implication is that the shared core across these literatures is not any single implementation detail, but the redirection of a learned or exposed function-selection mechanism toward attacker-chosen behavior.

## 2. FHA in split learning: threat model and attack mechanism

Split learning creates a distinctive FHA surface because the client computes the initial layers of a network on private input \(x\), producing smashed data \(f(x)\), while the server computes the rest, chooses the downstream objective, and returns gradients that shape the client-side representation [2108.09052]. The key asymmetry is that the client sees the returned gradient signal but not the full downstream model behavior. This is why the split-learning literature states that the attack vector “does not exist in federated learning” in the same direct form [2108.09052].

The canonical concrete attack is FSHA. The attacker first trains an autoencoder on a public dataset \(X_{pub}\) similar to the client’s private dataset \(X_{priv}\). The autoencoder has an encoder \(\tilde f\) and decoder \(\tilde f^{-1}\). The server then forces the client model’s output space \(f(X_{priv})\) to resemble the encoder feature space \(\tilde f(X_{pub})\), because \(\tilde f^{-1}\) already knows how to invert features from that space [2108.09052]. The attack trains a distinguisher \(D\) with
\[
L_D = \log(1-D(\tilde{f}(X_{pub}))) + \log(D(f(X_{priv}))).
\]
At the same time, it trains the client model \(f\) adversarially to fool the distinguisher by minimizing
\[
L_f = \log(1-D(f(X_{priv}))).
\]
The crucial point is that \(L_f\) is **independent of the original labels** [2108.09052]. The client is therefore no longer being optimized as the front-end of the legitimate classifier; it is being optimized as the front-end of the attacker’s inversion pipeline.

The same mechanism remains relevant when the client applies differential privacy to its optimizer. In that case, the attack still exploits the interactive training protocol and the communicated representations rather than the final released model parameters. The split-learning DP study emphasizes that DP clipping and Gaussian noise are applied to the client-side gradients before updating \(f\), but this does not sanitize the cut-layer activations themselves [2201.04018]. Empirically, FSHA still obtains reconstructions with low error rates at arbitrarily set DP \(\epsilon\) levels, although stronger noise can delay convergence [2201.04018]. This suggests that, in split learning, FHA is fundamentally tied to the backward signal and the intermediate representation channel, not only to memorization in the final model.

## 3. Detection and mitigation in split learning

The main defense developed specifically for split-learning hijacking is **SplitGuard**, a client-side detector that exploits the asymmetry between honest supervised learning and label-independent hijacking objectives [2108.09052]. Its intuition is that, if the client is actually learning the intended task, then deliberately corrupting labels in some batches should change the gradients substantially. If the server is hijacking training with a label-independent objective such as FSHA, fake-label and real-label gradients should remain similar.

Operationally, after an initial ignored prefix of \(N\) batches, the client occasionally sends a fake batch by randomizing a fraction \(B_F\) of labels with probability \(P_F\). The returned fake-batch gradients populate a set \(F\). Regular-batch gradients are split into two disjoint subsets \(R_1\) and \(R_2\), with \(R = R_1 \cup R_2\). Fake-batch parameter updates are discarded [2108.09052]. SplitGuard monitors both average-magnitude discrepancy and gradient-angle discrepancy:
\[
d(A, B) = \Big| \frac{1}{|A|} \sum_{a \in A} \Vert a \Vert - \frac{1}{|B|} \sum_{b \in B} \Vert b \Vert \Big|,
\]
\[
\theta(A,B) = \arccos\Big(\frac{\bar A \cdot \bar B}{\Vert \bar A \Vert \cdot \Vert \bar B \Vert}\Big), \qquad \bar A = \sum_{a \in A} a.
\]
Under honest learning, the empirical invariants are
\[
\theta(F, R) > \theta(R_1, R_2), \qquad d(F,R) > d(R_1, R_2).
\]
These are combined into
\[
S = \frac{ \theta(F,R) \cdot d(F,R) - \theta(R_1,R_2)\cdot d(R_1,R_2) }{ d(F,R) + d(R_1, R_2) + \varepsilon },
\]
followed by
\[
SG = \sigma(\alpha \cdot S)^\beta \in (0,1).
\]
The reported practical default is \(\alpha=7\), \(\beta=1\), with detection threshold \(T=0.9\) [2108.09052].

On four datasets—MNIST, Fashion-MNIST, CIFAR10, and CIFAR100—SplitGuard achieves **TPR = 1** against FSHA across all tested policies over 100 runs, with earlier detection under the Fast policy and lower false positives under more conservative averaging or voting policies [2108.09052]. The paper is explicit that SplitGuard is primarily a **detection** method rather than a cryptographic prevention mechanism. Its mitigation effect comes from enabling the client to stop training early, before useful inversion emerges, while discarding fake-batch updates so as to preserve utility [2108.09052]. The same work argues that DP alone only delays FSHA, but that such delay can be valuable because it gives SplitGuard more time to detect the attack [2108.09052].

## 4. FHA in federated and vertical federated learning

In federated learning, the notion of hijacking shifts from server-controlled gradients to repurposing the global model itself. **HijackFL** studies a malicious client that wants the global model to preserve original-task performance while also performing a different attacker-chosen task [2408.02131]. Instead of modifying model parameters for the hijacking purpose, the attacker learns class-specific pixel-level perturbations, or **cloaks**, that align hijacking-task samples with original-task anchor features:
\[
\min _{\delta_h} \operatorname{Dist}\left(\Phi\left(x_h \oplus \delta_h\right), \Phi_y\right),
\]
with a negative-anchor regularizer to reduce overlearned cloaks. The cloaked sample is formed by
\[
x_h \oplus \delta_h = \alpha x_h +(1-\alpha )  \delta_h,
\]
with \(\alpha = 0.5\) in the implementation [2408.02131]. On CIFAR-10 as the original task and MNIST as the hijacking task, the reported attack success rate reaches **92.75\%** with ResNet-18, while utility on the original task matches the clean model in the reported example [2408.02131].

A different direction is **SnatchML**, which treats hijacking as an inference-time repurposing problem. The attacker needs no access to training and uses the victim model as a representation engine. In black-box mode, the attack extracts logits \(Z_h(x)\); in white-box mode, it uses hidden features \(h_k(x)\). Given a reference set \(\mathcal{D}^* = \{(x_i^*, \ell_i^*)\}\), classification on the hijacking task is performed by nearest-neighbor matching in the victim-induced representation space:
\[
y_{\mathcal{T}'}(x_s)=\ell_k^*, \quad \text{s.t.} \quad k=\arg\min_{i\in [1,m]} \Big[\delta(\zeta_h(x_i^*), \zeta_h(x_s))\Big].
\]
The paper attributes this to excess capacity in over-parameterized models and shows that a model exposed for one task can be used for semantically related or unrelated tasks after deployment [2406.01708].

In **Vertical Federated Learning**, HASSLE makes the function-hijacking objective explicit. The attacker is a malicious passive party that uses returned embedding gradients to infer target-label samples and then poisons training with an optimized adversarial embedding [2507.10162]. The joint VFL objective is
\[
\mathcal{L}=\mathbb{E}_{i\sim U(1,n)} \big[CE(g(f_1(x_{i,1})|| f_2(x_{i,2})||...||f_K(x_{i,K})); y_i)\big],
\]
and the hijacking objective is
\[
\min \mathbb{E}_{h_1, \dots, h_K} [CE(g(h_1||h_{adv}||...||h_K); y_t)].
\]
HASSLE reports attack success rates of over **99%** across four datasets in the two-party scenario and **85% ASR** on CIFAR-100, while maintaining normal performance on clean inputs [2507.10162]. In this setting, FHA is implemented as a targeted, backdoor-style manipulation of the embedding contribution controlled by one party.

## 5. FHA in LLMs and agentic function-calling systems

In LLM-based systems, FHA increasingly refers to manipulation of tool routing, role boundaries, or the temporary function instantiated by context. In in-context learning, adversarial demo suffixes can hijack the induced decision rule without modifying model weights. The attack objective is to force a target label token \(y_T\) by modifying only the demonstrations:
\[
\mathcal{L}(x_Q) = -\log \mathcal{P}(\mathcal{M}(\mathcal{V}(y_T)|p^\prime)),
\]
with optimized suffixes attached to demo inputs [2311.09948]. On SST-2, RT, and AG News, the reported ASR of the gradient-guided attack is often near-complete on binary tasks and remains strong on the multiclass setting [2311.09948]. This is a form of context-conditioned decision-function hijacking.

A more direct use of the FHA label appears in function-calling LLMs. The attack poisons the description of one target function so that the model selects that function instead of the ground-truth tool [2604.20994]. The adversarial objective minimizes the negative log-probability of a target tool-call prefix under a perturbed function description:
\[
\mathcal{L}_{adv}(\hat{x}_{1:s}) = - \text{log}[P_{\pi_{\theta}(\hat{y} \mid \hat{x}_{1:s})].
\]
Using a GCG-style optimization over the target function description, the paper reports **70% to 100% ASR** over BFCL across five model families and configurations, with a separate **slot filling ASR** measuring whether the hijacked call remains executable [2604.20994]. The same work introduces **universal adversarial functions**, in which one poisoned function description generalizes across multiple queries or payload variants [2604.20994].

Agentic systems broaden the surface further. Structural template injection can terminate a tool-response segment and open forged assistant or user turns by injecting chat-template delimiters such as `</tool_response>`, `<|im_start|>assistant`, and `<|im_start|>user` into retrieved content [2602.16958]. The attack can cause the agent to treat injected content as legitimate user instructions or as its own previous tool outputs [2602.16958]. On AgentDojo, the reported average ASR of Phantom is **79.76%**, compared with **54.09%** for Single-Template and **39.86%** for Semantic-Injection, with confirmed vulnerabilities in commercial systems [2602.16958]. A plausible implication is that, in agentic settings, FHA is often less about corrupting a single JSON argument and more about seizing the control plane that governs tool use.

## 6. Related attack families, boundaries, and ambiguities

The literature also contains adjacent usages that overlap only partially with FHA. In Android, **component hijacking** describes a caller app invoking an exported component of another app and coercing it into executing privileged functionality on its behalf, a classic confused-deputy pattern [1609.03322]. In drone systems, “hijacking” can mean control-channel takeover via reconnaissance, interference, and malicious reconnection on an unauthenticated radio protocol rather than software function redirection [2403.03858]. In LLM-based code analysis, a **Familiar Pattern Attack** exploits abstraction bias so that the model reasons about a familiar-looking function as if it had standard behavior even when the implementation contains a subtle semantic change; the paper describes this as hijacking the control flow of the LLM’s interpretation [2508.17361]. In multi-agent systems, **control-flow hijacking** manipulates orchestration mechanisms into unsafe agent invocations, and the proposed mitigation is to generate permitted control-flow graphs and enforce edge-specific contextual rules rather than rely on “related to” or “likely to further” alignment checks [2510.17276].

These neighboring literatures indicate that FHA is not a single standardized taxonomy. This suggests two boundaries. First, the term is strongest when an attacker redirects a learned function, a function-selection mechanism, or an exposed callable capability toward an attacker-chosen behavior while preserving normal appearance on benign inputs. Second, architectural details determine both feasibility and defense. In split learning the decisive surface is the hidden backward signal [2108.09052]; in federated and vertical federated learning it is the shared representation and aggregation pathway [2408.02131], [2507.10162]; in function-calling agents it is the tool-selection and message-serialization interface [2604.20994], [2602.16958]. Across these settings, the common research lesson is that FHA becomes practical when the adversary can influence the mechanism that maps nominal intent to executable function.

Source: https://www.emergentmind.com/topics/function-hijacking-attack-fha