GOFA: Gradient-Oriented Backdoor Attack in Vertical Federated Learning
Vertical Federated Learning (VFL) allows multiple organizations with disjoint feature spaces and overlapping sample identities to collaboratively train machine learning models while keeping local data. Despite its privacy-preserving design, recent studies have shown that VFL is vulnerable to backdoor attacks. In particular, a malicious passive party can inject a carefully crafted trigger into its local inputs or intermediate embeddings, causing the global model to produce targeted mispredictions at inference time. Existing backdoor attacks in VFL (e.g., BadVFL) rely on the assumption that the malicious client can obtain additional knowledge about task labels, which contradicts the core privacy assumptions of VFL. In this paper, we propose GOFA, a new backdoor attack method for VFL scenarios. GOFA uses the gradient feedback from the server to construct a poisoned dataset and employs an adversarial example attack (e.g., FGSM) for masking the original features of the data to enhance trigger learning. We use the CIFAR-10 and UCI-HAR datasets. Our experiments demonstrate the effectiveness of our method in various settings.