{"id":"https://openalex.org/W7139926246","doi":"https://doi.org/10.48550/arxiv.2603.18680","title":"Revisiting Label Inference Attacks in Vertical Federated Learning: Why They Are Vulnerable and How to Defend","display_name":"Revisiting Label Inference Attacks in Vertical Federated Learning: Why They Are Vulnerable and How to Defend","publication_year":2026,"publication_date":"2026-03-19","ids":{"openalex":"https://openalex.org/W7139926246","doi":"https://doi.org/10.48550/arxiv.2603.18680"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.18680","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.18680","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.18680","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126800083","display_name":"Yige Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yige","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069390870","display_name":"Dexuan Xu","orcid":"https://orcid.org/0000-0003-3100-5886"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xu, Dexuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130229698","display_name":"Zimai Guo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guo, Zimai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126796049","display_name":"Yongzhi Cao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cao, Yongzhi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5130225489","display_name":"Hanpin Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Hanpin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6003000140190125,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6003000140190125,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.2825999855995178,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11307","display_name":"Domain Adaptation and Few-Shot Learning","score":0.028200000524520874,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.7197999954223633},{"id":"https://openalex.org/keywords/layer","display_name":"Layer (electronics)","score":0.6586999893188477},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6420999765396118},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.57669997215271},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5594000220298767},{"id":"https://openalex.org/keywords/top-down-and-bottom-up-design","display_name":"Top-down and bottom-up design","score":0.41659998893737793},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.40400001406669617}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7235000133514404},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.7197999954223633},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.6586999893188477},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6420999765396118},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.57669997215271},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5594000220298767},{"id":"https://openalex.org/C135798126","wikidata":"https://www.wikidata.org/wiki/Q2167279","display_name":"Top-down and bottom-up design","level":2,"score":0.41659998893737793},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.40400001406669617},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.36980000138282776},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3691999912261963},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.36910000443458557},{"id":"https://openalex.org/C99221444","wikidata":"https://www.wikidata.org/wiki/Q1532069","display_name":"Private information retrieval","level":2,"score":0.34439998865127563},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32919999957084656},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3133000135421753},{"id":"https://openalex.org/C152139883","wikidata":"https://www.wikidata.org/wiki/Q252973","display_name":"Mutual information","level":2,"score":0.29440000653266907},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2856999933719635},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.2754000127315521}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.18680","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.18680","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.18680","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.18680","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Vertical":[0],"federated":[1],"learning":[2],"(VFL)":[3],"allows":[4],"an":[5],"active":[6,33],"party":[7],"with":[8,16,104],"a":[9,42,176],"top":[10,117,205],"model,":[11],"and":[12,66,101,146,189],"multiple":[13],"passive":[14,24],"parties":[15,25],"bottom":[17,52,109],"models":[18,53,110],"to":[19,31,130,200,216],"collaborate.":[20],"In":[21],"this":[22,62,124,149,167],"scenario,":[23],"possessing":[26],"only":[27,213],"features":[28,145],"may":[29],"attempt":[30],"infer":[32],"party's":[34],"private":[35],"labels,":[36],"making":[37],"label":[38,120],"inference":[39],"attacks":[40],"(LIAs)":[41],"significant":[43],"threat.":[44],"Previous":[45],"LIA":[46],"studies":[47],"have":[48],"claimed":[49],"that":[50,61,108,132,195],"well-trained":[51],"can":[54],"effectively":[55],"represent":[56],"labels.":[57,147],"However,":[58],"we":[59,77,126],"demonstrate":[60],"view":[63],"is":[64,151],"misleading":[65],"exposes":[67],"the":[68,79,83,95,116,133,141,153,164,202,209],"vulnerability":[69],"of":[70,82,135,155,166,204],"existing":[71,136],"LIAs.":[72],"By":[73],"leveraging":[74],"mutual":[75,96],"information,":[76],"present":[78],"first":[80],"observation":[81],"\"model":[84],"compensation\"":[85],"phenomenon":[86],"in":[87,93,208],"VFL.":[88],"We":[89,174],"theoretically":[90],"prove":[91],"that,":[92],"VFL,":[94],"information":[97,114],"between":[98,144],"layer":[99,105,182],"outputs":[100],"labels":[102],"increases":[103],"depth,":[106],"indicating":[107],"primarily":[111],"extract":[112],"feature":[113],"while":[115],"model":[118,192,206,211],"handles":[119],"mapping.":[121],"Building":[122],"on":[123,181],"insight,":[125],"introduce":[127],"task":[128],"reassignment":[129],"show":[131],"success":[134],"LIAs":[137,156,217],"actually":[138],"stems":[139],"from":[140],"distribution":[142],"alignment":[143,150],"When":[148],"disrupted,":[152],"performance":[154],"declines":[157],"sharply":[158],"or":[159],"even":[160],"fails":[161],"entirely.":[162],"Furthermore,":[163],"implications":[165],"insight":[168],"for":[169],"defenses":[170],"are":[171],"also":[172,219],"investigated.":[173],"propose":[175],"zero-overhead":[177],"defense":[178],"technique":[179],"based":[180],"adjustment.":[183],"Extensive":[184],"experiments":[185],"across":[186],"five":[187,190],"datasets":[188],"representative":[191],"architectures":[193],"indicate":[194],"shifting":[196],"cut":[197],"layers":[198,207],"forward":[199],"increase":[201],"proportion":[203],"entire":[210],"not":[212],"improves":[214],"resistance":[215],"but":[218],"enhances":[220],"other":[221],"defenses.":[222]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-03-21T00:00:00"}