Label theft in vertical federated learning now leaves a readable signal: the server spots it in embeddings it already holds
Synopsis
Active label inference in vertical federated learning leaves a class-separability anomaly in the adversary's embeddings, letting the server trigger a defense that acts on the adversary alone and pushes label inference below what honest training already leaks on CIFAR-10, CIFAR-100 and CINIC-10, at under two points of task-accuracy cost.
Interpretation
Vertical federated learning lets organizations train a shared model over features they hold separately while one party keeps the labels private; an active label inference attack lets a feature-holding party modify its own optimizer to force class structure into its embeddings and then recover labels with semi-supervised learning. Earlier defenses perturb the shared gradient, but the attack acts on the party's internal optimizer rather than on the message it sends, so those defenses fail. The adversary's Fisher class-separability pulls away from the honest party's, and the gap is visible within a few epochs in the embeddings the server already receives.
The defense is triggered by that signal and acts only on the party identified as the adversary, breaking the alignment between embedding clusters and labels rather than destroying the embedding. Scaling the adversary's gradient down handles few-class tasks, while a norm non-expansive projection handles many-class tasks, with the Discriminative Coverage Ratio explaining why the projection rank must grow with the class count. Across four seeds on CIFAR-10, CIFAR-100 and CINIC-10, label inference falls below what honest training already leaks, at under two points of task-accuracy cost.
Perspective
This report covers summary-level results: the detection signal comes from embeddings the server already receives, the defense acts only on the party judged to be the adversary, and evaluation is on classification over CIFAR-10, CIFAR-100 and CINIC-10 with four seeds per dataset. It suits researchers and engineers working on federated-learning privacy and deployment. The material states no next experiment.
The material is a summary and does not say how the detection threshold is chosen or how false positives affect the honest party, nor does it report validation beyond the listed datasets. The claim that label inference falls below honest-training leakage is limited to those three datasets and four seeds.