TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning

TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning Yuhan Xie∗

Jingrong Huang∗

Chen Lyu✉†

Shanghai University of Finance and Economics MoE Key Laboratory of Interdisciplinary Research of Computation and Economics Shanghai, China yhtse@stu.sufe.edu.cn

Shanghai University of Finance and Economics Shanghai, China jingrhuang@stu.sufe.edu.cn

Shanghai University of Finance and Economics MoE Key Laboratory of Interdisciplinary Research of Computation and Economics Shanghai, China lyu.chen@mail.shufe.edu.cn

Malicious

Split Federated Learning (SFL) facilitates privacy-preserving collaborative training with reduced client-side overhead. However, its split architecture introduces unique attack surfaces, rendering it vulnerable to diverse poisoning attacks. Most existing defenses fail to exploit the split paradigm, limiting their ability to detect and contain malicious behaviors at an early stage. To bridge this gap, we propose Target-Oriented Feature Decoupling (TOFD), a unified framework that jointly enables proactive detection and robust optimization against a wide range of poisoning attacks. TOFD operates in three stages: (1) Target Inference, which identifies potential attack targets by refining class-wise safe zones via class-specific Margin Perturbation (MP); (2) Sample Purification, which adaptively filters poisoned smashed data using thresholds calibrated through cross-class min–max normalization of MP; and (3) Decoupling Optimization, which leverages an adversarial guidance model to capture attack-induced patterns and decouple their influence during optimization, thereby suppressing residual adversarial effects. We provide theoretical guarantees for the convergence of TOFD. Extensive experiments on five datasets demonstrate that TOFD consistently outperforms state-of-the-art defenses under diverse attack scenarios, achieving superior robustness with low computational overhead suitable for practical deployment.

CCS Concepts

Benign Non-IID

Frequent Communication

Benign IID Attacker

Purify

(a) Detection Overhead

Target class class i

(b) Malicious vs. Non-IID Purify

(c) Residual Poisoning Effects

Inference

arXiv:2608.07274v1 [cs.LG] 7 Aug 2026

Abstract

class j

Malicious Non-IID Adaptively Discrimination Optimization Trajectory Benign Low-Loss Basin

Figure 1: Motivation: Illustration of poisoning defense challenges in SFL and the intuition behind TOFD.

Multimedia (MM ’26). ACM, New York, NY, USA, 9 pages. https://doi.org/10. 1145/3767308.3835033

• Security and privacy → Distributed systems security.

Keywords Split Federated Learning, Poisoning Defense, Feature Decoupling ACM Reference Format: Yuhan Xie, Jingrong Huang, and Chen Lyu. 2026. TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning. In Proceedings of Proceedings of the 34th ACM International Conference on ∗ Both authors contributed equally to this research. † Corresponding author.

This work is licensed under a Creative Commons Attribution 4.0 International License. MM ’26, Rio de Janeiro, Brazil. © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2213-4/2026/11 https://doi.org/10.1145/3767308.3835033

1

Introduction

Split Federated Learning (SFL) [18, 26] enables collaborative training on decentralized data by combining the strengths of Federated Learning (FL) [33] and Split Learning (SL) [20]. This paradigm preserves data privacy while significantly reducing the computational burden on resource-constrained clients. Specifically, SFL partitions the global model into client and server components. Clients execute the initial forward pass and transmit intermediate representations, known as smashed data, to the server. The server then completes the remaining computations and propagates gradients back to facilitate local updates. Finally, a dual-aggregation mechanism is employed to coordinate the system: the fed server aggregates client-side components, while the main server aggregates server-side components. Despite its promise as a computationally efficient and privacypreserving paradigm [32], SFL is inherently susceptible to diverse poisoning attacks [24, 28]. This vulnerability primarily stems from

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil.

its partitioned and collaborative training architecture, exposing multiple attack surfaces throughout the learning pipeline [31]. Hence, by exploiting these attack surfaces, attackers can strategically manipulate various segments of the training process, including local feature representations [19], labels [11, 12], smashed data [28], and client-side model weights [5, 33]. Such multifaceted interventions facilitate the injection of destructive signals into the training process, thereby undermining aggregation and ultimately degrading global model performance. To defend against poisoning attacks in SFL, most existing countermeasures [3, 6, 15, 17, 28, 34] primarily adapt defense strategies originally designed for conventional FL. However, these methods offer limited efficacy in practice, as they fail to exploit SFL’s partitioned architecture for early-stage intervention. This limitation largely arises from overlooking the pivotal role of smashed data [32]. Unlike standard FL, server-side optimization in SFL is explicitly dependent on client-transmitted smashed data, which serves as the primary conduit through which poisoning signals propagate across training stages [18]. We argue that this dependency, while increasing vulnerability, simultaneously introduces a unique defensive opportunity. Since diverse adversarial perturbations from any source tend to manifest as anomalies in this intermediate representation, intercepting these signals prior to server-side computation establishes a strategic checkpoint capable of alleviating a wide spectrum of poisoning attacks. This insight naturally raises a fundamental question: how to reliably identify poisoned smashed data and prevent it from compromising server-side optimization in SFL? In practice, effectively realizing this defensive opportunity in SFL faces several challenges. First, the training process involves frequent transmission of smashed data, which incurs substantial communication and detection overhead, thereby necessitating lightweight and low-cost defense mechanisms [28]. Second, in dynamic SFL systems, the presence of benign non-IID clients alongside malicious ones leads to complex distributional shifts, making it difficult to distinguish non-IID behavior from adversarial manipulation and increasing the risk of misdetection [13, 30]. Third, even when poisoned smashed data are filtered, malicious client-side models may still contaminate SFL optimization through aggregation, necessitating system-level mitigation of residual adversarial effects. Based on the outlined challenges, Figure 1 illustrates the corresponding design insights that guided our framework development. Building upon these insights, we propose Target-Oriented Feature Decoupling (TOFD), a unified defense framework that synergizes early-stage detection with server-side optimization to counter a broad spectrum of poisoning attacks in SFL. TOFD is built upon three complementary pillars. First, TOFD leverages class-wise inference to localize potential attack targets, thereby enabling lowoverhead detection. By narrowing the scope to suspicious classes, the framework establishes client-level safe zones, which are further refined via Margin Perturbation (MP) to effectively disentangle adversarial behavior from benign non-IID variation. Second, TOFD adopts fine-grained, class-aware sample filtering to mitigate poisoning effects while preserving data diversity. Rather than discarding entire clients, the framework selectively prunes anomalous samples within identified target classes using thresholds calibrated via min–max normalization of the MP [1]. Consequently, only retained benign representations are utilized to update global distributions

Yuhan Xie, Jingrong Huang, & Chen Lyu

and optimize the server-side model. Third, to address residual adversarial influence that may persist beyond detection, TOFD integrates a decoupling objective into the SFL optimization. Specifically, an adversarial guidance model is developed to capture attack-induced patterns from malicious data, allowing the server to suppress adversarial representations while preserving benign feature integrity. Once converged, the adversarial guidance model serves as a stable, plug-and-play component for SFL optimization. Our main contributions can be summarized as follows: • We propose TOFD, the first framework to systematically integrate fine-grained detection with SFL optimization, enabling effective mitigation of a wide range of poisoning attacks, including data, weight, smashed, label, and multi-vector poisoning. • By leveraging class-wise inference and MP, TOFD disentangles malicious behavior from benign non-IID variations while preserving data diversity. Furthermore, an adversarial guidance–based decoupling strategy is developed to suppress residual attack influence. • We provide a formal theoretical analysis of TOFD, characterizing its computational complexity and establishing convergence guarantees. • Extensive experiments across five benchmarks and diverse model architectures demonstrate that TOFD consistently outperforms state-of-the-art defenses in both robustness and efficiency, even under extreme data heterogeneity.

2 Related Work 2.1 Defenses in Split Federated Learning Existing defenses for SFL can be broadly categorized into model validation and data validation approaches. Model validation strategies mitigate adversarial influence by scrutinizing the integrity of model updates. Classical Byzantine-resilient methods, such as Krum [2], Trimmed Mean [34], and Bulyan [6], employ geometric or order-based statistics to suppress outlier updates. Building on these, FLTrust [3] incorporates a small trusted dataset on the server side to assign trust scores and normalize update magnitudes, thereby bounding the impact of malicious contributions. In contrast, data validation strategies seek to evaluate the reliability of client data. FedBary [17] treats client valuation as a Wasserstein barycenter problem, quantifying distributional discrepancies to enable contribution-aware aggregation. Similarly, FAVD [15] implements a privacy-preserving mechanism to assess client-side data quality through density comparisons. However, most existing approaches remain extensions of conventional FL and are not explicitly tailored to the SFL architecture, where split-model optimization introduces unique and vulnerable attack surfaces [28]. While HealSplit [31] represents a pioneering effort specifically designed for SFL via multi-teacher adversarial distillation, its reliance on generative modeling and exhaustive inspection incurs substantial computational overhead. This limitation underscores the need for more efficient and architecture-aware defense mechanisms in SFL.

TOFD

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil.

Class-Wise Attack Target Inference

Fed Server

Initial Safe Zone

Smashed Data

3 MAD

3 Modified Z-score

Class K  i−,k

Class 1

Malicious  i−,1

1

MPmax

Suspicious Clients

Class K Class 1

1

2

Move In

Non-IID

1

2

Class→ 1 2 ... K Client↓ √ × ... √ 1 ... ... ... ... ... C × × ... ×

MP

Inference

Move Out

DCS

Final Safe Zone



Benign

 k = Q3,k + 1 + 

MPk − MPmin   IQR k MPmax − MPmin 

Malicious Feature Decoupling Sever-side Joint Model Loss Function Train    total =  CE +   MFD Benign

Adversarial Guidance Model



Train

− i ,k

k

Malicious Data

Malicious Feature Space

Construct

DCS

 i+,k

 i+,1

i ,k

Malicious Clients

Benign Clients

Input Data

Attack Target Classes

Distributional Consistency

Main Server

MPmin

K

Mk

Malicious

Client-side Model

Construct

Class-Calibrated Sample Purification

+ i ,k

  k

+ 1,k

k

+ 2,k

 

+ 3,k

  Server-side Model k

Data

Maximum KL Distance

Benign Feature Space

MP

  k

+ N ,k

Gradients of the smashed data

Figure 2: The framework of TOFD. After the smashed data are transmitted to the server, TOFD first constructs an initial class-wise safe zone using a modified Z-score and then refines it by evaluating the Distributional Consistency Score (DCS) against the MP threshold. Clients that fall outside the safe zone are inferred to be attacking the corresponding class. For the + and identified target classes, poisoned samples are filtered using an adaptive threshold 𝜏𝑘 , yielding validated benign sets Z𝑖,𝑘 Ð − − detected malicious sets Z𝑖,𝑘 for each client 𝑐𝑖 . An adversarial guidance model trained on 𝑖,𝑘 Z𝑖,𝑘 is incorporated into the SFL system to decouple residual adversarial influence through a joint loss. Finally, the updated client- and server-side models are aggregated by the fed server and main server, respectively, completing the defense and optimization process.

2.2

Defenses in FL under Data Heterogeneity

Defending FL under data heterogeneity requires a delicate balance between filtering malicious updates and preserving the benign contributions of diverse clients. Recent studies address this challenge through various perspectives. PRFL [35] introduces a defenseoriented personalized framework that suppresses malicious participants via similarity-based trust modeling and adaptive knowledge sharing. FedREDefense [30] leverages distilled local knowledge to distinguish genuine training dynamics from poisoning-induced deviations. Furthermore, FDCR [9] enhances backdoor robustness in heterogeneous settings by detecting malicious clients through parameter importance and gradient discrepancies, subsequently rescaling critical updates during aggregation. Despite their effectiveness, these defenses are often specialized for individual attack types (e.g., either data or model poisoning) and struggle to maintain efficacy in more complex adversarial scenarios involving composite poisoning attacks.

3 Background 3.1 Problem Setup 𝑁 , comprising Let the SFL system consist of 𝑁 clients C = {𝑐𝑖 }𝑖=1 benign clients Cben and malicious clients Catt = C \ Cben . Each client 𝑐𝑖 holds a private dataset D𝑖 = D𝑖tr ∪ D𝑖te ∼ P𝑖 containing 𝐾 classes, where D𝑖tr and D𝑖te denote local training and test sets, and P𝑖 represents the local data distribution. At each communication round 𝑡, the client-side model 𝑔𝜃𝑐𝑖 maps a local mini-batch of inputs {𝑥 𝑗 }𝐵𝑗=1 into smashed data {𝑧 𝑗 }𝐵𝑗=1 , which are transmitted with their corresponding labels {𝑦 𝑗 }𝐵𝑗=1 to the server-side model ℎ𝜃𝑠𝑖 for forward computation. The resulting

gradients are back-propagated to update the client-side parameters 𝑁 and server-side 𝜃𝑐𝑖 . Subsequently, client-side parameters {𝜃𝑐𝑖 }𝑖=1 𝑁 are aggregated by the fed server and the main parameters {𝜃 𝑠𝑖 }𝑖=1 server, respectively, yielding the global model 𝑓𝜃 = 𝑔𝜃𝑐 ◦ ℎ𝜃𝑠 . Defender Objective. The first objective is to accurately identify malicious smashed data, measured by the Malicious Sample Detection Rate (MSDR): 1 ∑︁ MSDR = I𝑚𝑎𝑙 (𝑧), (1) |M| 𝑧∈M

where M denotes the set of malicious smashed data, and I𝑚𝑎𝑙 (𝑧) is an indicator function. The second objective is to achieve robustness against diverse poisoning attacks while maintaining clean performance: min E (𝑥,𝑦)∼D𝑡𝑒 [ℓ (𝑓𝜃 (𝑥), 𝑦)] + 𝜇R robust (𝜃 ),

(2)

𝜃

where ℓ (·, ·) is a task-specific loss function, R robust (𝜃 ) measures the sensitivity to attacks, and 𝜇 weights the robustness regularization.

3.2

Threat Model

In SFL, malicious clients with heterogeneous knowledge may inject perturbations at different stages of the training workflow, giving rise to a broad spectrum of poisoning threats, which are categorized into five representative attack types: Data Poisoning (DP, 𝑂 1 ): The local dataset is manipulated as ′ D𝑘′ = {(𝑥 𝑗 + 𝛿𝑥 , 𝑦 𝑗 )}𝑚 𝑗=1 , where 𝛿𝑥 is the input perturbation. Weight Poisoning (WP, 𝑂 2 ): The model parameters are manipulated before aggregation as 𝜃 ′ = 𝜃 + Δ𝜃 , where Δ𝜃 represents the weight perturbation. Smashed Poisoning (SP, 𝑂 3 ): The smashed dataset is manipu′ lated as Z𝑘′ = {𝑧 𝑗 + 𝛿𝑧 }𝑚 𝑗=1 , where 𝛿𝑧 is the applied perturbation.

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil.

Label Poisoning (LP, 𝑂 4 ): The label set is manipulated as Y𝑘′ = ′ {(𝑦 𝑗 + 𝛿 𝑦 ) mod 𝐾 }𝑚 𝑗=1 , where 𝛿 𝑦 is the label shift. Multi-Vector Poisoning: Multiple attack strategies may be Ð4 applied simultaneously: 𝑂 multi = 𝑖=1 I𝑖 𝑂𝑖 , I𝑖 ∈ {0, 1}, where I𝑖 indicates whether the 𝑖-th attack is applied.

4

Methodology

In this section, we introduce the details of TOFD for defending SFL. TOFD integrates detection and optimization in a three-stage pipeline: it first infers the attack target classes of malicious clients, then filters poisoned samples within the inferred classes, and finally suppresses residual adversarial influence. Figure 2 illustrates the overall framework.

4.1

Class-Wise Attack Target Inference

At communication round 𝑡, each client 𝑐𝑖 transmits a batch of smashed data, where the subset corresponding to class 𝑘 is denoted (𝑡 ) by B𝑖,𝑘 . Definition 1 (Empirical Gaussian Modeling). Given a smashed dataset Z = {𝑧 𝑗 }𝑛𝑗=1 , the empirical Gaussian modeling operator G(·) maps Z to a diagonal Gaussian distribution N (𝜇, Σ), whose parameters are estimated as 𝑛 𝑛  1 ∑︁  1 ∑︁ 𝜙 (𝑧 𝑗 ), Σ = D (𝜙 (𝑧 𝑗 ) − 𝜇)(𝜙 (𝑧 𝑗 ) − 𝜇) ⊤ , 𝜇= 𝑛 𝑗=1 𝑛 𝑗=1 where 𝜙 (·) maps samples into a low-dimensional space and D(·) extracts the diagonal elements. According to Definition 1, the class-𝑘 feature distribution of (𝑡 ) (𝑡 ) client 𝑐𝑖 is given by P𝑖,𝑘 = G(B𝑖,𝑘 ). 4.1.1 Initial Class-Wise Safe Zone Construction. To establish a class-wise safe zone for benign clients, we first measure the distance (𝑡 ) between the local distribution P𝑖,𝑘 and the historical global distri(𝑡 −1) bution P𝐺,𝑘 , which is maintained using identified clean smashed data:   (𝑡 ) (𝑡 ) (𝑡 −1) W𝑖,𝑘 = 𝑑𝑖𝑠𝑡 P𝑖,𝑘 , P𝐺,𝑘 . (3)

where 𝑑𝑖𝑠𝑡 (·, ·) denotes the 2-Wasserstein distance. Based on these distances, the initial safe zone C𝑘(𝑡 ) , consisting of high-confidence benign clients, is constructed via the modified Z-score: (𝑡 ) W𝑖,𝑘 − 𝑀𝑘(𝑡 ) C𝑘(𝑡 ) = {𝑐𝑖 ∈ C : ≤ 3𝜎 }. (4) MAD𝑘(𝑡 ) /𝜌 where 𝜌 is a constant set to 0.6745, as recommended in [10], 𝑀𝑘(𝑡 ) and MAD𝑘(𝑡 ) denote the median and median absolute deviation of (𝑡 ) {W𝑖,𝑘 }𝑐𝑖 ∈ C , respectively. Clients that fall outside C𝑘(𝑡 ) form the set

of suspicious clients, denoted as C̃𝑘(𝑡 ) . 4.1.2 Distributional Consistency Verification. Practical SFL systems exhibit inherently heterogeneous data, which complicates the reliable detection of malicious participants. To further identify malicious clients within the suspicious client set, we propose a distributional consistency verification mechanism that distinguishes adversarial behavior from benign non-IID variations.

Yuhan Xie, Jingrong Huang, & Chen Lyu

Definition 2 (Distributional Consistency). Let Z(S, 𝑘) = {𝑧 𝑗 | (𝑡 ) 𝑧 𝑗 ∈ B𝑖,𝑘 , 𝑐𝑖 ∈ S} denote the class-𝑘 features of clients in S. Given two client sets S1 and S2 , the distributional consistency of class 𝑘 between them is quantified as   Δ(S1, S2, 𝑘) = 𝑑𝑖𝑠𝑡 G(Z(S1, 𝑘)), G(Z(S2, 𝑘)) , (5) Based on Definition 2, the impact of each suspicious client 𝑐𝑖 ∈ C̃𝑘(𝑡 ) on the class-wise safe zone C𝑘(𝑡 ) is measured by the induced distributional shift, formalized as the Distributional Consistency Score:
(𝑡 ) DCS𝑖,𝑘 = Δ C𝑘(𝑡 ) , C𝑘(𝑡 ) ∪ {𝑐𝑖 } , 𝑘 . (6) To capture the intrinsic dispersion of class-𝑘 features within the safe zone, we define the MP as a threshold quantifying the permissible deviations in the benign distribution:
MP𝑘(𝑡 ) = max Δ C𝑘(𝑡 ) , C𝑘(𝑡 ) \ {𝑐𝑖 }, 𝑘 , (7) (𝑡 )

𝑐𝑖 ∈ C𝑘

Suspicious clients whose scores fall within the MP𝑘(𝑡 ) are regarded as benign and retained within the safe zone: (𝑡 ) ≤ MP𝑘(𝑡 ) }. C𝑘(𝑡 ) ← C𝑘(𝑡 ) ∪ {𝑐𝑖 ∈ C̃𝑘(𝑡 ) : DCS𝑖,𝑘

(8)

Clients excluded from C𝑘(𝑡 ) are thus identified as malicious and inferred to be targeting class 𝑘.

4.2

Class-Calibrated Sample Purification

Although the first stage identifies class-wise attack targets, directly discarding all samples from these classes would severely reduce data diversity and consequently degrade model performance. To balance robustness and data utility, we perform fine-grained purification that selectively removes poisoned samples within the identified target classes. For each sample 𝑧 𝑗 within the identified target class 𝑘, we quantify its deviation from the corresponding global class-𝑘 distribution (𝑡 −1) P𝐺,𝑘 as: (𝑡 −1) ⊤ (𝑡 −1) −1 (𝑡 −1) 𝐷𝑘 (𝑧 𝑗 ) = (𝜙 (𝑧 𝑗 ) − 𝜇𝐺,𝑘 ) (Σ𝐺,𝑘 ) (𝜙 (𝑧 𝑗 ) − 𝜇𝐺,𝑘 ).

(9)

Existing methods typically rely on a single global threshold to identify anomalous samples [1, 4]. However, such thresholds fail to capture class-wise variations in feature dispersion, which can lead to misclassification. To address this limitation, we introduce a class-calibrated threshold that dynamically adjusts according to the class-wise dispersion measured by MP𝑘(𝑡 ) : (𝑡 ) ! MP𝑘(𝑡 ) − MPmin (𝑡 ) (𝑡 ) 𝜏𝑘 = 𝑄 3,𝑘 + 1 + 𝐼𝑄𝑅𝑘(𝑡 ) , (10) (𝑡 ) (𝑡 ) MPmax − MPmin (𝑡 ) (𝑡 ) (𝑡 ) where MPmin = min𝑘 MP𝑘(𝑡 ) , MPmax = max𝑘 MP𝑘(𝑡 ) , 𝑄 3,𝑘 and 𝐼𝑄𝑅𝑘(𝑡 ) denote the third quartile and interquartile range of the benign (𝑡 ) distances {𝐷𝑘 (𝑧 𝑗 ) | 𝑧 𝑗 ∈ B𝑖,𝑘 , 𝑐𝑖 ∈ C𝑘(𝑡 ) }.

For benign clients 𝑐𝑖 ∈ C𝑘(𝑡 ) , all class-𝑘 smashed data are con+ = B (𝑡 ) . For malicious clients 𝑐 ∉ C (𝑡 ) , the sidered benign: Z𝑖,𝑘 𝑖 𝑖,𝑘 𝑘

class-𝑘 samples are partitioned using the threshold 𝜏𝑘(𝑡 ) into a be+ = {𝑧 ∈ B (𝑡 ) | 𝐷 (𝑧 ) ≤ 𝜏 (𝑡 ) } and a malicious set nign set Z𝑖,𝑘 𝑗 𝑘 𝑗 𝑖,𝑘 𝑘 − = {𝑧 ∈ B (𝑡 ) | 𝐷 (𝑧 ) > 𝜏 (𝑡 ) }. Z𝑖,𝑘 𝑗 𝑘 𝑗 𝑖,𝑘 𝑘

TOFD

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil.

Table 1: Comprehensive overview of the default experimental setup. Total Clients

Dataset HAM10k [27] MNIST [16] F-MNIST [29] CIFAR10 [14] CIFAR100 [14]

64 100 100 100 64

Non-IID parameter 𝜅

Model

Total Epochs

Batch Size

Attack Settings

Other Settings

0.1, 0.5, 0.3, 1 (Default), 5

DenseNet121 ResNet18 ResNet18 ResNet18 ResNet50

200 300 300 300 200

64 128 128 128 128

Malicious ratio = 20%, Coordinate updates = 3 × 104 , Attack learning rate = 1 × 10−2 , Image update rate = 1 × 104

SFL learning rate = 1 × 10−4 , 𝜌 = 0.6745, Dataset (MNIST), 𝜆, 𝛽 = 0.2, Attack method (DP+SP), Adversarial guidance model (Server-side model)

Based on the validated benign set Z𝑘+ =

+ 𝑖 Z𝑖,𝑘 , we estimate a round-wise empirical distribution P̂𝑘(𝑡 ) = G(Z𝑘+ ), which is then

Ð

used to update the global distribution: (𝑡 ) (𝑡 −1) P𝐺,𝑘 = (1 − 𝛽)P𝐺,𝑘 + 𝛽 P̂𝑘(𝑡 ) ,

(11)

where 𝛽 is the exponential moving average coefficient.

4.3

Malicious Feature Decoupling

Despite effective filtering of smashed data, client-side models trained under adversarial control can still introduce malicious patterns into the global model through aggregation. To mitigate these residual effects, we propose a decoupling mechanism for adversarial features. Specifically, an adversarial guidance model R, with the same architecture as the server-side model ℎ𝜃𝑠 , is fine-tuned on the deÐ − in each communicatected malicious smashed data Z− = 𝑖,𝑘 Z𝑖,𝑘 tion round to capture attack-induced patterns. After convergence, R serves as a stable module across rounds. To enforce decoupling, the server-side model ℎ𝜃𝑠𝑖 is encouraged to diverge from R by maximizing the predictive discrepancy on Z− , yielding the following objective:   1 ∑︁ (12) LMFD = − − KL 𝑓 (𝑧; R) 𝑓 (𝑧; ℎ𝜃𝑠𝑖 ) , |Z | 𝑧 ∈Z− where KL denotes the Kullback–Leibler divergence, and 𝑓 (·; ·) represents the softmax output of the model. The server-side model of client 𝑐𝑖 is trained on the validated benign smashed data using the cross-entropy loss:

Algorithm 1 Framework of TOFD 1: Input: current round 𝑡, number of classes 𝐾, Clients C, smashed (𝑡 ) 𝑁 ,𝐾 data {B𝑖,𝑘 }𝑖=1,𝑗=1 , and parameters 𝜆, 𝛽 2: for each class 𝑘 ∈ {1, . . . , 𝐾 } do − ← ∅, benign set Z+ ← ∅ for 3: Initialize malicious set Z𝑖,𝑘 𝑖,𝑘 each participating clients 4: for each client 𝑐𝑖 ∈ C do (𝑡 ) 5: Calculate distribution distance W𝑖,𝑘 using Eq.(3) 6: end for (𝑡 ) 7: Construct initial safe zone C𝑘(𝑡 ) based on {W𝑖,𝑘 }𝑐𝑖 ∈ C

8:

Compute MP𝑘(𝑡 ) using C𝑘(𝑡 ) via Eq.(7)

9:

for each suspicious client 𝑐𝑖 ∉ C𝑘(𝑡 ) do

10: 11: 12:

(𝑡 ) if DCS𝑖,𝑘 ≤ MP𝑘(𝑡 ) then add 𝑐𝑖 to C𝑘(𝑡 ) end for (𝑡 ) for each 𝑧 𝑗 ∈ B𝑖,𝑘 where 𝑐𝑖 ∉ C𝑘(𝑡 ) do

− if 𝐷𝑘 (𝑧 𝑗 ) > 𝜏𝑘(𝑡 ) then add 𝑧 𝑗 to Z𝑖,𝑘 14: end for + ← B (𝑡 ) \ Z − 15: Set Z𝑖,𝑘 𝑖,𝑘 𝑖,𝑘 Ð + (𝑡 ) 16: Update P𝐺,𝑘 using Z𝑘+ = 𝑖 Z𝑖,𝑘 via Eq.(11) 17: end for Ð − 18: Fine-tune model R on Z − = 𝑖,𝑘 Z𝑖,𝑘 19: for client 𝑐 𝑖 in C do Ð + 20: Optimize SFL on Z𝑖+ = 𝑘 Z𝑖,𝑘 using R and Ltotal 21: end for 22: return Aggregated global model 𝑓𝜃

13:

𝐾

∑︁ ∑︁ 1 −𝑦 ⊤(𝑘 ) log 𝑓 (𝑧; ℎ𝜃𝑠𝑖 ). LCE = Ð + | 𝑘 Z𝑖,𝑘 | +

(13)

𝑘=1 𝑧 ∈Z

𝑖,𝑘

where 𝑦 (𝑘 ) is the one-hot label vector for class 𝑘. The overall optimization objective for each participating client combines task supervision with adversarial decoupling: Ltotal = LCE + 𝜆 LMFD,

(14)

where 𝜆 balances task performance with suppression of residual adversarial influence.

5

Theoretical Analysis of TOFD

In this section, we present the analysis of the time complexity and convergence guarantees of TOFD, with detailed proofs deferred to Appendix A.

Assumption 2. Reconstruction Error. Let 𝜓 (·) denote an operator that maps compressed smashed data back to the original feature space. For benign smashed data 𝑧 + , the reconstruction error satisfies |𝑧 + − 𝜓 (𝜙 (𝑧 + ))| ≤ 𝜎sp . Assumption 3. Representation Covariance. For each class 𝑘, let Σ𝑘(𝑡 ) denote the covariance matrix of compressed benign smashed data at round 𝑡. We assume   sup 𝜆max Σ𝑘(𝑡 ) ≤ Λ𝑘 < ∞. 𝑡

Assumption 4. Discard-Induced Deviation. Let 𝛿 denote the mean deviation induced by discarding benign samples whose distance exceeds 𝜏𝑘 . We assume that lim 𝛿 = 0.

Assumption 1. Lipschitz Smoothness. The gradient ∇𝜃 ℓ (𝜃, 𝑧) is 𝐿𝑧 -Lipschitz with respect to the smashed data 𝑧, i.e, ∥∇𝜃 ℓ (𝜃, 𝑧 1 ) − ∇𝜃 ℓ (𝜃, 𝑧 2 )∥ ≤ 𝐿𝑧 ∥𝑧 1 − 𝑧 2 ∥

𝜏𝑘 →∞

Lemma 1 (Time-Complexity Analysis). The time complexity of each server-side training step is O (|D𝑖tr | · 𝑇 · 𝑁 p ), where 𝑁 p is the number of model parameters. TOFD introduces an additional cost of

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil.

Yuhan Xie, Jingrong Huang, & Chen Lyu

Table 2: Performance comparison of TOFD against baselines on the MNIST dataset under Uniform and Non-IID settings (𝜅 = 1). The upper block reports accuracy (ACC ↑), while the lower block presents poisoning impact (U ↓). Bold and underlined numbers indicate the best and second-best results, respectively. Method

DP WP SP LP DP+SP WP+SP LP+SP Uniform NIID Uniform NIID Uniform NIID Uniform NIID Uniform NIID Uniform NIID Uniform NIID

Accuracy (ACC ↑) FedAvg [22] 10.73 Trim-Mean [34] 10.28 Median [34] 88.85 Sparsefed [23] 10.65 Krum [2] 91.96 Bulyan [6] 10.33 FLTrust [3] 11.01 DnC [25] 11.48 ShieldFL [21] 11.29 PRFL [35] 89.82 FAVD [15] 10.47 91.28 HealSplit [31] TOFD 92.92 Poisoning Impact (U ↓)

10.29 10.03 85.14 10.19 87.15 10.45 9.97 10.21 10.78 85.19 10.46 88.15 90.08

18.56 38.31 89.34 32.44 91.83 18.89 71.59 91.04 92.93 90.89 82.93 91.86 93.95

16.21 32.76 85.69 14.80 84.03 16.36 61.92 87.84 90.28 83.09 75.11 86.27 91.33

91.87 92.59 75.13 61.33 77.91 91.71 30.09 79.04 69.10 78.60 84.49 93.59 95.35

74.95 86.99 64.21 42.77 64.61 84.73 11.55 67.89 55.52 72.88 73.57 80.86 92.09

60.02 55.43 83.00 62.54 89.80 59.29 69.39 66.50 70.54 90.95 64.47 67.17 92.69

48.53 49.90 87.78 53.98 86.44 47.14 43.07 50.45 67.61 86.20 49.17 54.56 89.95

10.69 10.43 75.94 10.89 78.90 10.99 10.84 10.62 11.36 78.67 11.12 80.34 85.81

10.66 10.25 72.94 10.51 72.90 10.44 9.96 11.23 11.14 74.21 9.71 75.11 81.79

65.72 65.68 74.74 62.20 84.29 66.98 63.57 91.30 92.56 83.05 88.54 88.19 93.35

56.27 59.40 69.88 52.30 72.91 60.51 54.55 86.89 86.74 67.07 55.74 81.16 88.02

43.01 40.12 76.34 31.93 78.45 47.20 15.54 76.51 66.96 77.74 64.51 49.53 83.70

29.34 39.60 75.22 20.08 73.63 43.21 11.92 67.00 59.47 71.74 61.47 36.14 80.48

FedAvg [22] Trim-Mean [34] Median [34] Sparsefed [23] Krum [2] Bulyan [6] FLTrust [3] DnC [25] ShieldFL [21] PRFL [35] FAVD [15] HealSplit [31] TOFD

83.34 85.15 6.38 66.86 1.06 83.16 83.55 82.04 81.66 3.66 78.22 5.13 2.40

77.02 57.51 2.97 62.27 2.09 76.75 24.35 3.87 2.35 2.99 11.96 3.64 2.07

77.42 62.42 5.83 62.25 4.18 77.25 31.60 4.41 2.16 5.76 13.57 7.01 1.15

3.71 3.23 17.18 33.38 16.01 3.93 65.85 15.87 26.18 15.28 10.40 1.91 0.67

18.68 8.19 27.31 34.28 23.60 8.88 81.97 24.36 36.92 15.97 15.11 12.42 0.39

35.56 40.39 9.31 32.17 4.12 36.35 26.55 28.41 24.74 2.93 30.42 28.33 3.33

45.10 45.28 3.74 23.07 1.77 46.47 50.45 41.80 24.83 2.65 39.51 38.72 2.53

84.89 85.39 16.37 83.82 15.02 84.65 85.10 84.29 83.92 15.21 83.77 15.16 10.21

82.97 84.93 18.58 66.54 15.31 83.17 83.56 81.02 81.30 14.64 78.97 18.17 10.69

29.86 30.14 17.57 32.51 9.63 28.66 32.37 3.61 2.72 10.83 6.35 7.31 2.67

37.36 35.78 21.64 24.75 15.30 33.10 38.97 5.36 5.70 21.78 32.94 12.12 4.46

52.57 55.70 15.97 62.78 15.47 48.44 80.40 18.40 28.32 16.14 30.38 45.97 12.32

64.29 55.58 16.30 56.97 14.58 50.40 81.60 25.25 32.97 17.11 27.21 57.14 12.00

O (|Z− | · 𝑇R · 𝑁 p ), where 𝑇R denotes the number of training rounds for R. In typical SFL settings, the additional overhead is negligible because |Z− | ≪ |D𝑖tr | and 𝑇R ≪ 𝑇 . Lemma 2 (Bounded Gradient Bias). Let 𝛼 ∈ [0, 1) denote an upper bound on the fraction of undetected malicious samples, and let 𝑆 denote the compressed dimension of the smashed data after applying 𝜙 (·) during detection. Under assumptions 1 to 4, the gradient bias satisfies: √︁  √ 1 √︁ ∥𝑏𝑡 ∥ ≤ 𝜀 := max 𝑆𝐿𝑧 𝑆Λ𝑘 + 𝛿 + 𝜏𝑘 Λ𝑘 + 4𝐿𝑧 𝜎𝑠𝑝 , 1−𝛼 𝑘 Building on Lemma 2 and assumptions, the following convergence guarantee is established for TOFD. √ Theorem 3 (Convergence of TOFD). With stepsize 𝜂 = O (1/ 𝑇 ), 𝑇 −1 the iterates {𝜃 𝑡 }𝑡 =0 produced by TOFD satisfy   𝑇 −1
1 ∑︁ 1 E∥∇𝑄 (𝜃 𝑡 )∥ 2 ≤ O √ + O 𝜀 2 . 𝑇 𝑡 =0 𝑇

6 Evaluation 6.1 Experiment Setup Datasets and Baselines: TOFD is evaluated on five image classification benchmarks: MNIST [16], Fashion-MNIST [29], HAM10k [27],

85 Accuracy (%)

84.85 85.54 3.46 84.06 1.96 85.31 84.93 83.43 83.99 4.06 84.42 4.22 3.10

80 75 70 10

TOFD(Ours) HealSplit Median

FLTrust

15 Time Cost (hours)

PRFL

Krum

20

Figure 3: Comparison of accuracy and time cost.

CIFAR10 [14], and CIFAR-100. To simulate realistic SFL scenarios, client data are partitioned in a non-IID manner according to a Dirichlet distribution 𝐷𝑖𝑟 (𝜅), with smaller values of 𝜅 corresponding to higher data heterogeneity. Experiments are performed using three widely adopted backbone architectures: DenseNet121 [8], ResNet-18 [7], and ResNet-50. To assess TOFD’s robustness, we evaluate individual attack strategies including DP, WP, SP, and LP, as well as more complex combinations such as DP + SP, WP + SP, and LP + SP. TOFD is then compared with a diverse set of state-of-the-art defense methods, including FedAvg [22], Trimmed-Mean, Median, SparseFed [23],

TOFD

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil.

DP

LP +SP WP +SP

SP

DP

LP +SP

15% WP 10% 5%

WP +SP

DP LP +SP F-MNIST

DP

LP +SP

9% WP 6% 3% SP

12% WP 8% 4%

WP +SP

DP LP +SP HAM10K

SP

DP

LP +SP

12% WP 8% 4%

WP +SP

Median Krum PRFL HealSplit TOFD

SP

DP LP +SP CIFAR10

DP LP +SP CIFAR100

Figure 4: Comparison of metric 𝑈 ↓ across datasets for different defense strategies under various attacks.

FedAvg HealSplit Krum

30 0.1

0.3

0.5

Median PRFL TOFD

1

Non-IID Parameter ( )

5

Figure 5: Performance under different Non-IID degrees (𝜅).

80 60 40

0.1

0.3

0.5

1

5

Non-IID Parameter ( )

IID

Figure 6: Comparison of MSDR under different Non-IID degrees (𝜅).

Krum [2], Bulyan [6], FLTrust [3], DnC [25], ShieldFL [21], PRFL [35], FAVD [15], and HealSplit [31] . Settings and Metrics. To simulate realistic SFL systems, we vary the experimental settings by adjusting key factors such as dataset, model architecture, and data heterogeneity. A summary of the default configurations used in our experiments is provided in Table 1. All experiments were conducted on an NVIDIA A100 GPU. The experimental results are evaluated using four metrics: test accuracy A, which reflects the defense performance; the poisoning impact 𝑈 = A ∗ − A, A ∗ measuring the performance degradation caused by poisoning attacks in the presence of the defense, where A ∗ denotes the accuracy without attacks; MSDR, which measures the rate of detected malicious smashed data; and time cost, which quantifies the computational overhead of the defense mechanism.

6.2

HealSplit

Accuracy (%)

60

0

TOFD

100

MSDR (%)

Accuracy (%)

90

Evaluation Results

6.2.1 Robustness under Diverse Attacks. Our first set of experiments evaluates TOFD under various poisoning attacks in both IID and non-IID settings. Table 2 reports the test accuracy and poisoning impact under different attack scenarios. Figure 3 further presents the computational cost of state-of-the-art methods. TOFD consistently achieves strong defense performance across diverse attack types and remains robust under composite attacks, maintaining over 92% accuracy under single attacks and 83% under composite attacks in the uniform setting. Unlike most coarsegrained defenses that discard entire client updates, TOFD filters poisoned smashed data at a fine-grained level while preserving informative benign samples. This advantage is particularly evident under composite attacks. For example, Trimmed-Mean only achieves 10.43% accuracy under DP+SP attacks in uniform settings, with a high poisoning impact of 85.39%, whereas TOFD still maintains 85.81% accuracy with a much lower poisoning impact of 10.21%, demonstrating its robustness under complex attack scenarios.

80 60 40

0.1

0.2

0.3

Value of /

0.4

0.5

Figure 7: Performance under different hyperparameters (𝛽 and 𝜆).

TOFD also maintains strong defense performance under heterogeneous data settings. Under the WP+SP attack, shifting from IID to non-IID causes FAVD’s accuracy to drop sharply, with the poisoning impact rising by 26.59%. In contrast, TOFD maintains high accuracy, while the poisoning impact increases by only 1.79%. This improvement arises because baseline methods relying on fixed criteria often fail to distinguish benign non-IID variations from malicious samples, whereas TOFD employs adaptive, class-specific metrics to effectively isolate adversarial behavior. Meanwhile, TOFD maintains competitive computational cost while achieving the highest average accuracy among all methods, indicating a favorable trade-off between defense effectiveness and runtime efficiency for practical SFL systems.

6.2.2 Defense Generalization Across Data. Our second set of experiments investigates TOFD’s performance under different attack strategies across four datasets. Figure 4 summarizes the poisoning impact across these datasets, highlighting the consistency of performance under diverse data distributions. We analyze the generalization of representative defenses across four datasets with default heterogeneous class distributions. TOFD achieves superior performance across all datasets compared to the state-of-the-art baseline. While Median and Krum show moderate resilience, their fixed thresholds struggle to accommodate datasetspecific variations, and PRFL and HealSplit, despite incorporating sample purification, still exhibit residual vulnerability under complex attacks. In contrast, TOFD adaptively calibrates its detection thresholds based on observed class-wise statistics, allowing it to account for differences in class distributions across datasets. This class-adaptive mechanism effectively separates malicious perturbations from benign variations, enabling TOFD to maintain consistently low deviations and robust defense performance across diverse datasets in heterogeneous SFL settings.

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil.

Yuhan Xie, Jingrong Huang, & Chen Lyu

Table 3: Accuracy (%) of different methods under different malicious client ratio.

Median [34] Krum [2] PRFL [35] HealSplit [31] TOFD

5% 87.85 85.09 86.69 89.79 91.04

82.37 82.54 83.09 86.08 88.50

77.24 77.81 78.47 81.00 85.38

72.94 72.90 74.21 75.11 81.79

71.19 70.02 72.57 73.79 79.09

6.2.3 Robustness under Varying Data Heterogeneity. Our third set of experiments evaluates the robustness of TOFD under varying degrees of data heterogeneity. The test accuracy and MSDR results are reported in Figures 5 and 6, respectively. As non-IID heterogeneity increases, TOFD’s performance advantage becomes more pronounced. While baseline defenses degrade significantly under stronger heterogeneity, TOFD consistently maintains stable accuracy across all levels. This trend is further supported by the MSDR results. TOFD consistently achieves higher MSDR than HealSplit across all heterogeneity levels, and the performance gap widens under stronger heterogeneity, demonstrating its ability to handle heterogeneous data distributions effectively. 6.2.4 Hyperparameters and Attack Intensity. Our fourth set of experiments assesses TOFD’s sensitivity to hyperparameter choices and malicious client ratio. Results are shown in Figure 7 and Table 3. We first investigate the impact of the decoupling weight 𝜆 and the EMA coefficient 𝛽 on performance. TOFD demonstrates stable test accuracy over a broad range of values, indicating robustness to hyperparameter variations. Varying 𝜆 results in peak performance at 𝜆 = 0.2, with neighboring values yielding comparable results. A similar pattern is observed for 𝛽. Based on these findings, we adopt 𝜆 = 𝛽 = 0.2 as the default configuration for all experiments. To further evaluate TOFD’s robustness under practical attack scenarios, we investigate its performance across different fractions of malicious clients. As the ratio of malicious clients increases from 5% to 25%, TOFD maintains the highest accuracy with minimal performance drop, unlike baseline methods that suffer significant degradation, demonstrating strong resilience to intensified adversarial participation. 6.2.5 Ablation Study. Our fifth experiment conducts an ablation study on both uniform and non-IID distributions to quantify the contribution of each TOFD component. The accuracy results are summarized in Table 4. With the complementary contributions of its components, TOFD exhibits amplified benefits under heterogeneous data distributions. Among all components, removing the purification module, which discards entire malicious clients, results in the largest performance drop, especially under non-IID distributions, underscoring the importance of fine-grained filtering. Ablating MP𝑘 or 𝜏𝑘 individually also degrades accuracy, as replacing adaptive, class-specific thresholds with global averages eliminates class-wise adaptation and weakens the separation between adversarial and benign variations. Removing the malicious feature decoupling loss LMFD leads to a smaller yet consistent decline, confirming its role in mitigating residual adversarial effects.

Component

MNIST Uniform NIID

F-MNIST Uniform NIID

TOFD w/o Purification w/o MP𝑘 w/o 𝜏𝑘 w/o LMFD

85.81±0.8 77.20±0.7 80.50±0.3 83.70±0.6 84.39±0.9

77.97±0.8 68.71±0.8 73.86±0.9 75.15±0.4 76.39±1.0

Accuracy (%)

Method

Malicious Client Ratio 10% 15% 20% 25%

Table 4: Results of ablation study.

100

Vanilla Attack

81.79±0.6 71.53±1.1 74.48±0.5 78.54±0.8 79.98±0.7

Adaptive Attack

74.83±0.9 63.55±1.3 69.23±0.7 71.60±0.5 72.83±0.7 Healsplit

75 50 25

MNIST F-MNIST HAM10K CIFAR10CIFAR100

Figure 8: Comparison of adaptive attacks. 6.2.6 Adaptive Attack. The sixth set of experiments evaluates the resilience of TOFD against adaptive attacks across five datasets. The accuracy results are presented in Fig. 8. In this scenario, the attacker constrains the induced DCS within the margin perturbation MP𝑘 , exploiting benign non-IID variability to bypass distributional consistency verification. These subtle deviations partially evade threshold-based sample purification and weaken malicious feature decoupling, leaving residual adversarial patterns in the SFL system that accumulate through aggregation, gradually impacting overall performance. Despite this intensified threat, TOFD maintains a clear advantage, consistently outperforming the strongest baselines. This robustness stems from TOFD’s class-adaptive mechanism, which dynamically calibrates defense based on class-wise statistics rather than a fixed global criterion, enabling effective separation of malicious perturbations from benign non-IID variations and suppressing their propagation through aggregation.

7

Conclusion

In this work, we propose TOFD, a unified defense framework against diverse poisoning attacks for SFL. Existing defenses largely adapt conventional FL strategies and thus fail to leverage the split architecture for early-stage intervention. TOFD addresses this limitation by integrating detection and optimization to protect SFL through securing smashed data. It first performs class-wise target inference to identify attacked classes by constructing refined safe zones, and then selectively filters malicious smashed data within these classes. Building on this detection stage, TOFD mitigates residual adversarial influence by incorporating an adversarial guidance model to enforce a decoupling objective during SFL optimization. Extensive experiments show that TOFD consistently outperforms state-of-the-art defenses in robustness and efficiency across diverse attacks, offering a practical and generalizable solution for secure SFL.

Acknowledgment This work was supported by the National Key R&D Program of China (2023YFA1009500).

TOFD

References [1] Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. 2022. Dos and don’ts of machine learning in computer security. In 31st USENIX Security Symposium (USENIX Security 22). 3971–3988. [2] Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. 2017. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems 30 (2017). [3] Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. 2020. Fltrust: Byzantine-robust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995 (2020). [4] Binbin Ding, Penghui Yang, and Sheng-Jun Huang. 2025. FedDLAD: A Federated Learning Dual-Layer Anomaly Detection Framework for Enhancing Resilience Against Backdoor Attacks. In Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence, IJCAI-25. 5021–5029. [5] Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020. Local model poisoning attacks to Byzantine-Robust federated learning. In 29th USENIX security symposium (USENIX Security 20). 1605–1622. [6] Rachid Guerraoui, Sébastien Rouault, et al. 2018. The hidden vulnerability of distributed learning in byzantium. In International conference on machine learning. PMLR, 3521–3530. [7] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition. 770–778. [8] Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. 2017. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition. 4700–4708. [9] Wenke Huang, Mang Ye, Zekun Shi, Guancheng Wan, He Li, and Bo Du. 2024. Parameter disparities dissection for backdoor defense in heterogeneous federated learning. Advances in Neural Information Processing Systems 37 (2024), 120951– 120973. [10] Boris Iglewicz and David C Hoaglin. 1993. Volume 16: how to detect and handle outliers. Quality Press. [11] Rishi Jha, Jonathan Hayase, and Sewoong Oh. 2023. Label poisoning is all you need. Advances in Neural Information Processing Systems 36 (2023), 71029–71052. [12] Xiaoqian Jiang and Jing Zhang. 2025. FedClean: A General Robust Label Noise Correction for Federated Learning. In Forty-second International Conference on Machine Learning. [13] Torsten Krauß and Alexandra Dmitrienko. 2023. Mesas: Poisoning defense for federated learning resilient against adaptive attackers. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 1526–1540. [14] Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009). [15] K Naveen Kumar, Ranjeet Ranjan Jha, C Krishna Mohan, and Ravindra Babu Tallamraju. 2025. Fortifying Federated Learning Towards Trustworthiness via Auditable Data Valuation and Verifiable Client Contribution. In Proceedings of the Computer Vision and Pattern Recognition Conference. 4999–5009. [16] Yann LeCun, Corinna Cortes, and Christopher J. C. Burges. 1998. MNIST Handwritten Digit Database. Available: http://yann.lecun.com/exdb/mnist. [17] Wenqian Li, Shuran Fu, Fengrui Zhang, and Yan Pang. 2024. Data valuation and detections in federated learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 12027–12036. [18] Yehui Li, Dalin Qin, H Vincent Poor, and Yi Wang. 2024. Introducing edge intelligence to smart meters via federated split learning. Nature communications 15, 1 (2024), 9044.

MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil.

[19] Ye Li, Yanchao Zhao, Chengcheng Zhu, and Jiale Zhang. 2025. Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning. In Proceedings of the Computer Vision and Pattern Recognition Conference. 25770–25779. [20] Zheng Lin, Guangyu Zhu, Yiqin Deng, Xianhao Chen, Yue Gao, Kaibin Huang, and Yuguang Fang. 2024. Efficient parallel split learning over resource-constrained wireless edge networks. IEEE Transactions on Mobile Computing 23, 10 (2024), 9224–9239. [21] Zhuoran Ma, Jianfeng Ma, Yinbin Miao, Yingjiu Li, and Robert H Deng. 2022. ShieldFL: Mitigating model poisoning attacks in privacy-preserving federated learning. IEEE Transactions on Information Forensics and Security 17 (2022), 1639–1654. [22] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics. PMLR, 1273–1282. [23] Ashwinee Panda, Saeed Mahloujifar, Arjun Nitin Bhagoji, Supriyo Chakraborty, and Prateek Mittal. 2022. Sparsefed: Mitigating model poisoning attacks in federated learning with sparsification. In International Conference on Artificial Intelligence and Statistics. PMLR, 7587–7624. [24] Chamara Sandeepa, Bartlomiej Siniarski, Shen Wang, and Madhusanka Liyanage. 2024. Sherpa: Explainable robust algorithms for privacy-preserved federated learning in future networks to defend against data poisoning attacks. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 4772–4790. [25] Virat Shejwalkar and Amir Houmansadr. 2021. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS. [26] Chandra Thapa, Pathum Chamikara Mahawaga Arachchige, Seyit Camtepe, and Lichao Sun. 2022. Splitfed: When federated learning meets split learning. In Proceedings of the AAAI conference on artificial intelligence, Vol. 36. 8485–8493. [27] Philipp Tschandl, Cliff Rosendahl, and Harald Kittler. 2018. The HAM10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions. Scientific data 5, 1 (2018), 1–9. [28] Xiaodong Wu, Henry Yuan, Xiangman Li, Jianbing Ni, and Rongxing Lu. 2024. Evaluating security and robustness for split federated learning against poisoning attacks. IEEE Transactions on Information Forensics and Security (2024). [29] Han Xiao, Kashif Rasul, and Roland Vollgraf. 2017. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747 (2017). [30] Yueqi Xie, Minghong Fang, and Neil Zhenqiang Gong. 2024. Fedredefense: Defending against model poisoning attacks for federated learning using model update reconstruction error. International Conference on Machine Learning. [31] Yuhan Xie and Chen Lyu. 2026. Healsplit: Towards self-healing through adversarial distillation in split federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40. 35931–35939. [32] Yuhan Xie, Chen Lyu, and Jingrong Huang. 2026. BESplit: Bias-Compensated Split Federated Learning with Evidential Aggregation. In Forty-third International Conference on Machine Learning. [33] Abbas Yazdinejad, Ali Dehghantanha, Hadis Karimipour, Gautam Srivastava, and Reza M Parizi. 2024. A robust privacy-preserving federated learning model against model poisoning attacks. IEEE Transactions on Information Forensics and Security 19 (2024), 6693–6708. [34] Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. 2018. Byzantine-robust distributed learning: Towards optimal statistical rates. In International conference on machine learning. Pmlr, 5650–5659. [35] Lixiang Yuan, Jiapeng Zhang, Mingxing Duan, Guoqing Xiao, Zhuo Tang, and Kenli Li. 2025. PRFL: Personalized and Robust Federated Learning for Non-IID Data with Malicious Participants. IEEE Transactions on Mobile Computing (2025).

Related documents

• Enhanced Security and Privacy via Fragmented Federated Learning#400577
• Auditing Privacy Defenses in Federated Learning via Generative Gradient Leakage#177295
• RingSFL: An Adaptive Split Federated Learning Towards Taming Client Heterogeneity#177326
• Efficient Resource Optimization for Split Federated Learning#463228
• Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning#1117295