Lan Zhang

Vertical federated learning (VFL) enables multiple parties with non-overlapping features to collaboratively train a model without sharing raw data. However, its split-learning architecture makes VFL particularly vulnerable to targeted backdoor attacks, while also limiting access to raw features and complete model parameters. These constraints render defenses developed for horizontal federated learning inapplicable. Moreover, existing VFL defenses neglect the defender’s privileged role as the label holder, leaving them vulnerable to adaptive backdoor strategies. In this paper, we propose CONFIRM, a post-training defense framework that leverages this privileged position to detect poisoned samples. Our approach is driven by a key insight: poisoned samples exhibit abnormally stable prediction confidence under model perturbations, an intrinsic property of backdoor attacks. By actively perturbing the top model and measuring the consistency of prediction confidence, CONFIRM detects poisoned samples based on their perturbation robustness. Extensive experiments across multiple benchmarks show that CONFIRM consistently outperforms state-of-the-art methods, achieving AUROC scores exceeding 99.9% and up to 21.2% higher F1-scores. Furthermore, CONFIRM remains effective against adaptive attacks. We believe that our findings highlight a promising direction for backdoor defense in VFL, and pave the way for more secure VFL systems.

Vertical federated learning (VFL) enables multiple parties with disjoint features to collaboratively train models without sharing raw data. While privacy vulnerabilities of VFL are extensively-studied, its security threats—particularly targeted label attacks—remain underexplored. In such attacks, a passive party perturbs inputs at inference to force misclassification into adversary-chosen labels. Existing methods rely on unrealistic assumptions (e.g., accessing VFL-model’s outputs) and ignore anomaly detectors deployed in real-world systems. To bridge this gap, we introduce VTarbel, a two-stage, minimal-knowledge attack framework explicitly designed to evade detector-enhanced VFL inference. During the preparation stage, the attacker selects a minimal set of high-expressiveness samples (via maximum mean discrepancy), submits them through VFL protocol to collect predicted labels, and uses these pseudo-labels to train estimated detector and surrogate model on local features. In attack stage, these models guide gradient-based perturbations of remaining samples, crafting adversarial instances that induce targeted misclassifications and evade detection. We implement VTarbel and evaluate it against four model architectures, seven multimodal datasets, and two anomaly detectors. Across all settings, VTarbel outperforms four state-of-the-art baselines, evades detection, and retains effective against three representative privacy-preserving defenses. These results reveal critical security blind spots in current VFL deployments and underscore urgent need for robust, attack-aware defenses.

Autoregressive and diffusion models represent two complementary generative paradigms. Autoregressive models excel at sequential planning and constraint composition, yet struggle with tasks that require explicit spatial or physical grounding. Diffusion models, in contrast, capture rich spatial structure through high-dimensional generation, but lack the stepwise logical control needed to satisfy complex, multi-stage constraints or to reliably identify and correct errors. We introduce Collaborative Thoughts, a unified collaborative framework that enables autoregressive and diffusion models to reason and generate jointly through a closed-loop interaction. In Collaborative Thoughts, autoregressive models perform structured planning and constraint management, diffusion models instantiate these constraints as intermediate visual thoughts, and a vision-based critic module evaluates whether the visual thoughts satisfy the intended structural and physical requirements. This feedback is then used to iteratively refine subsequent planning and generation steps, mitigating error propagation across modalities. Importantly, Collaborative Thoughts uses the same collaborative loop regardless of whether the task is autoregressive question answering or diffusion-based visual generation. Through representative examples, we illustrate how Collaborative Thoughts can improve the reliability of spatial reasoning and the controllability of generation.

As model modification techniques are increasingly employed to obtain high-performing machine learning models at reduced costs, identifying lineage relationships—i.e., whether one model is derived from another—has garnered significant research interest. However, existing approaches are largely empirical, lack theoretical grounding, and are often ineffective against high-impact modifications. Furthermore, none have addressed the measurement of lineage closeness, which quantifies the degree of modification between models. In this paper, we reformulate the model lineage determination problem as a question of whether two models’ parameters reside within the same local optimum of the loss landscape. Based on this formulation, we propose a simple yet effective method for lineage determination. We further explore the impact of various modification techniques on models’ decision boundaries using visualization techniques, and observe that changes in decision boundaries serve as an accurate metric for lineage closeness. Leveraging this insight, we propose a task-agnostic and modification-type-agnostic method to measure lineage closeness by computing the mean adversarial distance from data points to decision boundaries and the matching rate of data point predictions. To reduce computational overhead, we design an efficient sampling strategy for data point selection. Extensive experiments demonstrate that our approach achieves 100% accuracy in model lineage determination and provides precise, quantitative measurements of lineage closeness across a wide range of modification scenarios.