通过恢复嵌入几何窃取分割学习底层模型
Stealing Split Learning Bottom Models by Recovering Embedding Geometry
对做隐私保护视觉模型部署的人，这篇给出一个可复用的攻击探针：用对比空间+邻域图匹配来检验嵌入通道的防御是否真的抹掉了关系结构，可作为评估分割式协同推理/联邦视觉系统泄露风险的标准基线。
原文依据 VENOM first learns a contrastive space over server-observed embeddings, then builds a neighborhood graph
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论纵向联邦学习（VFL）通过在客户端与服务器之间分割计算来训练模型，双方仅交换中间嵌入。近期工作表明，即使是诚实但好奇的服务器，也能通过查询系统并对返回的嵌入做回归来窃取客户端的底层模型；对此，防御方会扰动或解耦嵌入通道。我们证明这些防御仍然脆弱。我们提出 VENOM，一种几何感知的窃取攻击。VENOM 首先在服务器观测到的嵌入上学习一个对比空间，然后构建邻域图，并训练一个代理底层模型，使其在匹配目标的同时通过邻域匹配损失以及逐点对齐和特征形状对齐来尊重局部几何。该策略保留了防御无法抹去的关系结构，有效重新耦合了多分支防御和基于噪声的防御所产生的嵌入。在六个数据集上，VENOM 在无防御和多种防御下均持续优于标准窃取方法，并且在分布外（OOD）辅助数据下仍然有效。
英文原文摘要 1083 字符
Vertical federated learning (VFL) trains models by splitting computation across clients and a server that only exchange intermediate embeddings. Recent work shows that a server even if honest-but-curious can steal a client's bottom model by querying the system and regressing on the returned embeddings, and in response, defenses perturb or decouple the embedding channel. We show these defenses remain vulnerable. We propose VENOM, a geometry-aware stealing attack. VENOM first learns a contrastive space over server-observed embeddings, then builds a neighborhood graph and trains a surrogate bottom model to match targets and respect local geometry via a neighbor-matching loss alongside pointwise and feature-shape alignment. This strategy preserves the relational structure that defenses fail to erase, effectively recoupling the embeddings produced by multi-branch and noise-based defenses. Across six datasets, VENOM consistently outperforms standard stealing methods under no defense and multiple defenses, and remains effective with out-of-distribution (OOD) auxiliary data.