We investigate poisoning attacks that exploit the intermediate representations exchanged in split federated learning and develop an evaluation framework for safer real-world deployment.
Split Federated Learning (SFL) has attracted attention as an efficient machine learning framework for securely using data that may contain personal or confidential information. In SFL, multiple clients and a server collaboratively train a model while dividing the model computation between them. This structure supports parallel and distributed learning without requiring clients to directly share their original data.
However, SFL exchanges intermediate representations, often called smashed data, during training. This characteristic creates security threats that differ from those in conventional centralized learning. In particular, poisoning attacks that inject malicious perturbations into the training process can seriously reduce the accuracy and reliability of the resulting model.
This research proposes two poisoning attacks against intermediate representations. The first continuously accumulates loss gradients and uses the accumulated value as a perturbation. The second combines this accumulated-gradient attack with a dataset-based perturbation, representing a more practical hybrid threat. By evaluating these attacks, we aim to clarify long-term vulnerabilities in SFL and provide guidance for designing effective defenses.
SFL relies on intermediate representations exchanged between clients and the server. An attacker who manipulates these representations can influence learning without directly modifying the original training data.
Malicious perturbations injected during training can degrade model accuracy, destabilize optimization, or create behavior that is difficult to detect from the final model alone.
A practical security evaluation must determine whether an attack remains effective across many epochs rather than only causing a temporary decrease in performance.
Smash Poisoning (SP) is an attack designed specifically for SFL. Conventional SP adds the loss gradient of an intermediate representation as a perturbation to the smashed data and thereby reduces model performance.
Our first method, called Accumulated-Gradient Smash Poisoning, continuously accumulates the loss gradients of intermediate representations over the course of training. The accumulated gradient is then used to generate the perturbation applied to the current intermediate representation.
Conventional SP uses the gradient calculated at the current training step. Its effect may therefore weaken as learning progresses and the model adapts to the injected perturbation. In contrast, the proposed method retains information from previous gradients. This allows the perturbation to reflect the training history and maintain its influence even in later epochs.
By accumulating gradients across training, the method provides a framework for evaluating persistent poisoning effects that arise from the repeated exchange of intermediate representations in SFL.
The perturbation incorporates information from gradients generated in previous epochs.
The attack is designed to avoid the rapid decay in effectiveness observed with conventional SP.
The method exploits the repeated transmission of intermediate representations between clients and the server.
The second method is a hybrid poisoning attack that replaces the conventional SP component in a dataset-based poisoning framework with the accumulated-gradient attack proposed in Method 1. It simultaneously introduces perturbations through the input space and through the intermediate representations exchanged during SFL.
An attacker may be able to manipulate part of the training dataset while also interfering with the intermediate representations generated during collaborative learning. This combined scenario is more realistic than assuming that the attacker can operate through only one attack path.
The dataset-side perturbation changes the inputs used for learning, while the accumulated-gradient perturbation continuously contaminates the intermediate representations. Their combined effect can influence both the input space and the optimization process.
Evaluating this hybrid attack makes it possible to analyze interactions between multiple poisoning mechanisms. The results can reveal whether the two components strengthen each other, whether their effects persist over time, and which parts of the SFL pipeline require defensive monitoring.
Dataset-based perturbations influence the samples supplied to the local learning process.
Accumulated loss gradients contaminate the smashed data exchanged between the client and server.
The method supports evaluation of compound threats that may occur in practical SFL environments.
The proposed attacks can be evaluated by measuring clean-model accuracy, poisoned-model accuracy, accuracy degradation across epochs, convergence behavior, and the persistence of attack effects. Comparing conventional SP, Method 1, and Method 2 makes it possible to identify when gradient accumulation and hybrid poisoning create additional risk.
These findings can guide defenses such as anomaly detection for intermediate representations, gradient-history monitoring, robust aggregation, client authentication, and validation of local training data.