{"id":"63ae9dba-e821-4f89-bd60-516397701883","arxiv_id":"2507.10162","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"HASSLE combines gradient-based label inference with self-supervised pretraining and adversarial embeddings to hijack vertical federated learning models, achieving over 99% attack success on four datasets and 85% on CIFAR-100.","lead":"HASSLE is a new attack on vertical federated learning that lets a passive party infer other parties' private labels from gradients and then hijack the shared model's predictions. It reaches over 99% attack success on four datasets and 85% on CIFAR-100, showing that current VFL defenses are not sufficient.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'single known instance' label-inference claim is untested across different choices of that instance; if the template sample is not representative, LIA precision and hence the headline >99% ASR could be unreproducible.","rationale":"The reader's weakest assumption (gradient-label correlation for deep top models) is real but partially mitigated by the default 3-layer top model, where CIFAR-100 LIA precision is 100% in Table III. The deep-model collapse is a limitation, not a direct break of the central claim under default settings. The more load-bearing gap is the untested dependence on the identity of the single known sample, since the method's advertised contribution is 'only a single known instance.' Without a sensitivity analysis over template choice, the precision and downstream ASR could be artifacts of a favorable sample or seed. The paper is otherwise well evaluated, with a thorough defense analysis and a self-admitted limitation regarding the adversarial embedding's reliance on poisoning (Sec. III-D1). A concrete template-robustness experiment would settle the concern. Thus no change to the CONDITIONAL verdict is needed, but the condition should explicitly include this test.","tokens_in":21814,"tokens_out":6520,"duration_ms":77851,"concrete_test":"Run the HASSLE LIA on CIFAR-10 and CIFAR-100 with 10 randomly chosen different known target-label samples (e.g., 10 IDs from class 0), plus one class-mean embedding as template, keeping all other hyperparameters fixed; report LIA precision per template and the min/mean/max. If any valid template yields precision below 70% or the range exceeds 20 points, the 'single known instance' claim fails and the ASR in Table IV should be re-reported under the inferred (non-oracle) ID set. If precision is high for all templates, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Central to HASSLE is the LIA, which computes cosine similarity between the gradient of one known target-label sample and every other sample's gradient (Sec. III-C, Algorithm 1), then selects the top n_t/r IDs. The entire attack therefore assumes this single template's gradient direction is a reliable representative of the target class. The paper reports no experiment varying which sample serves as the known ID, no seeds, and no variance; Table III gives one precision number per configuration. The theory (Eqs. 6 and 8) shows only that the returned gradient is label-correlated via the ground-truth weight vector, not that one instance's gradient is a stable centroid under intra-class variation, especially for CIFAR-100 (500 samples/class) or for tabular data with class imbalance. Fig. 5 shows large epoch-to-epoch fluctuations in DS precision, so the averaged HASSLE score is still an average over one fixed template. Additionally, Table IV's hijacking ASR is computed under an oracle assumption of known target ID proportions; the full-framework ASR in Sec. IV-C depends on the single-template LIA. If the known sample is atypical, precision drops, poisoning is misdirected, and the headline ASR is not achieved. This is a load-bearing gap in the paper's strongest contribution: label inference from one known sample.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes HASSLE, a two-phase attack on vertical federated learning. In the label inference phase, a passive adversary with one known sample of a target class computes the cosine similarity between the gradient of that sample and the gradients of all other samples over several early epochs, averages the scores, and selects the top n_t/r instances as target-label samples. In the hijacking phase, the adversary replaces the embeddings of those inferred samples with an adversarial embedding updated by the returned gradients, with the attacker's bottom model initialized by self-supervised learning. Experiments on CIFAR-10, CIFAR-100, ImageNette, NUS-WIDE, and Income report LIA precision at or near 100% and attack success rates above 99% on four datasets and above 80% on CIFAR-100, plus a robustness study against eight defenses.","tokens_in":22078,"tokens_out":7325,"duration_ms":81334,"significance":"If the results hold, HASSLE is a strong and practical attack that advances the state of the art: it requires only one known target-label sample, operates in early training, and combines gradient-based label inference with adversarial embedding poisoning. The paper's strengths include the breadth of the evaluation (five datasets covering image and tabular modalities), sensitivity analyses over attack epochs, filtering ratio, number of parties, embedding dimension, and top-model depth, and the systematic defense evaluation with an explicit taxonomy. The feature-saliency analysis (Fig. 6) provides a plausible mechanism for why SSL pretraining helps. The main reservations concern the strength of the end-to-end claim and the robustness of the single-template inference.","major_comments":[{"comment":"The hijacking evaluation in Table IV is not end-to-end. Section IV-A2 states that \"For a fair comparison among all hijacking attacks, we assume the attacker has the knowledge of p% sample IDs corresponding to the target label after the LIA,\" so the HASSLE ASR values of 99.6-100% in Table IV are obtained with target-label IDs that are given to the attacker, not with IDs produced by the LIA of Algorithm 1. The abstract's headline claim of \"over 99% across four datasets\" is therefore supported only for this partially oracle-assisted setting. The full pipeline is evaluated only in Section IV-C (Figs. 7-11), where ASR values are lower in several configurations, for example on CIFAR-100 and in the four-party CIFAR-10 case. Please separate the two claims and report the end-to-end ASR prominently, or restrict the abstract to that number.","section":"IV-A2, Table IV"},{"comment":"The single-instance LIA is not tested for robustness to the choice of the known sample. Algorithm 1 uses one known ID I_k, and Table III reports a single precision value per configuration with no seeds or standard deviations. Eqs. (6)-(8) establish only that the gradient direction is label-correlated under uniformity and orthogonality assumptions; they do not show that one instance's gradient is a stable centroid under intra-class variation, which matters for CIFAR-100 (500 samples per class) and for imbalanced tabular data. Please add experiments that vary the known sample (e.g., 10-20 random choices per dataset) and report the mean and standard deviation of LIA precision and end-to-end ASR.","section":"III-C, Algorithm 1, Table III"},{"comment":"The \"formal analysis\" of the multi-layer case relies on assumptions that are asserted rather than proven: the early-training outputs are approximated as uniform, the weight vectors w_c are \"expected to be uniformly distributed in early training,\" and the columns of w_1^T are \"assumed to be highly divergent.\" Fig. 4 supports the orthogonality claim only for CIFAR-10 at one-third of training, and the paper itself notes the assumption breaks down on CIFAR-100 with deeper top models. The contribution bullet \"formally analyze the causation\" is stronger than what the derivation delivers; either provide a proof with explicit conditions or present the argument as an empirical heuristic.","section":"III-C, Eqs. (6), (8)"}],"minor_comments":[{"comment":"The equation number (11) is used twice: once for the hijacking objective in Section III-D1 and once for feature saliency in Section IV-B2; the second occurrence should be renumbered.","section":"III-D1, IV-B2"},{"comment":"Line 1 of Algorithm 1 contains a typo: \"RAMDOM INIT\" should read \"RANDOM INIT.\"","section":"Algorithm 1"},{"comment":"The text says that image samples are \"partitioned horizontally\" in Section IV-A1 but later describes \"slicing the image samples vertically\" in Section IV-C1; the slicing geometry should be described consistently.","section":"IV-A1, IV-C1"},{"comment":"The sentence \"For simplicity and without loss of generality, we assume that the top model has two layers\" overstates the case; the later sensitivity analysis in Fig. 9 shows measurable degradation for deeper top models, so this is a simplification, not a WLOG.","section":"III-C"},{"comment":"Section III-D2 refers to \"the abundant unlabeled samples owned by the adversary,\" but the attack model in Section III-B2 only grants partial features for the training IDs; please clarify whether additional unlabeled data are assumed and, if so, how many samples are used for SSL pretraining.","section":"III-D2"},{"comment":"All tables report point estimates without standard deviations or the number of seeds; beyond the robustness experiments requested above, please state the reporting convention in the experimental setup.","section":"II-D, IV-A3"}],"recommendation":"major_revision","confidential_remarks":"The main issue is the gap between the abstract's end-to-end claim and the oracle-assisted evaluation in Table IV. I recommend asking for full-pipeline results and a robustness study over template choices before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nQuick take: this is a serious attack paper, arguably the most thorough VFL hijacking evaluation I've seen in this line of work. It deserves a real referee, but the headline claim—label inference from a single known instance—has an untested soft spot that the referee should push on.\n\nWhat's actually new: the LIA averages cosine-similarity scores across epochs rather than swapping embeddings, which is a simple fix that evidently stabilizes precision; and the hijacking module combines an SSL-pretrained bottom model with an iteratively optimized adversarial embedding. The SSL initialization is a nice idea and they show it increases feature saliency. The empirical scope is the paper's real strength: five datasets, sensitivity analyses on top-model depth, embedding dimension, feature ratio, epoch multiples, plus a defense evaluation against eight defenses including adaptive ones.\n\nSoft spots, in proportion. First, the single-known-sample robustness is genuinely untested. They never vary which sample serves as the known ID, report no seeds or variance, and Table III gives one precision number per configuration. The stress-test point is valid: if that one template is atypical, LIA precision and the downstream ASR could drop. The theory (Eqs. 6 and 8) shows label-level gradient correlation but not instance-level centroid stability. This is a gap, not a fatal flaw—the multi-epoch averaging may well smooth it out—but the headline claim needs that experiment.\n\nSecond, the theory is heuristic. The uniform-early-scores and orthogonal-weight-vectors assumptions are stated, not proven, and the paper itself shows precision collapses on CIFAR-100 with more than three top layers. They acknowledge this, which I credit.\n\nThird, no code and no variance reporting. The oracle-style separation in Table IV is fine for isolating components, but it means the end-to-end ASR rests on the LIA precision.\n\nBottom line: the core mechanism is plausible, the evaluation is broad, and the limitations are honestly acknowledged. This paper should go to peer review. Ask the authors for code, seed variance, and a known-sample robustness study; the single-template issue is the one that could sink the central claim if it fails.","headline":"Solid, well-evaluated VFL hijacking attack; the single-known-sample LIA needs a robustness experiment before the headline claim fully lands.","tokens_in":22565,"tokens_out":1906,"would_cite":true,"duration_ms":21066,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A passive party in vertical federated learning can infer which training samples carry a chosen label from a single known example, then train an adversarial embedding that makes the model predict that label with over 99% success.","keywords":["vertical federated learning","label inference attack","hijacking attack","backdoor attack","self-supervised learning","adversarial embedding","gradient leakage","SplitVFL"],"falsifier":"Train a two-party SplitVFL on CIFAR-100 with a four-layer MLP top model and a randomly initialized ResNet-18 bottom model, then compute the cosine similarity between returned gradients of samples sharing a label in the first five epochs; if same-label similarity is not significantly higher than cross-label similarity, the gradient-direction premise fails and HASSLE's label inference should fall to roughly chance, matching the paper's reported 41.6% precision at that depth.","tokens_in":21627,"feed_emoji":"🎯","tokens_out":5874,"duration_ms":62328,"temperature":0.7,"pith_summary":"Vertical federated learning lets several parties train a model together while each keeps its own feature columns private, with only one active party holding the training labels. This paper argues that even under that design, a passive participant can identify which training samples carry a chosen label using a single known example of that label, and can then force the trained model to output that label at will. The proposed attack, HASSLE, reports label-inference precision near 100% on four datasets and attack success above 99% (above 80% on CIFAR-100) in a two-party setting, without degrading normal accuracy. The claim matters because it turns a minimal information leak into a near-complete model hijack, making VFL integrity depend on defenses that resist both label leakage and embedding manipulation.","feed_headline":"One known sample hijacks vertical federated models 99% of the time","feed_subtitle":"A passive party can read private labels from gradients and force a target prediction, no big auxiliary datasets needed.","key_machinery":"The load-bearing object is the returned gradient $dh_i = \\partial L/\\partial h_i$ that the active party sends back to the passive party. The label inference rests on the identity that, early in training, this gradient is approximately a linear combination of the top model's logit weight vectors in which the ground-truth class's vector has the dominant coefficient; for a one-layer top model, $dh_i = w^\\top(s_i - y_i)$, and near-uniform initial predictions make the coefficient of $w_{y_i}$ about $C-1$ times larger than the others. For multilayer ReLU top models, the same correlation survives because samples of one class activate overlapping first-layer neurons and the first-layer columns become approximately orthogonal. The second mechanism is an adversarial embedding $h_{\\text{adv}}$ optimized by gradient descent on the returned gradients while it is substituted for benign target-label embeddings during training, plus self-supervised pre-training (MoCo-v2 for images, SCARF for tabular data) that raises the attacker's feature saliency so the top model weights its input more heavily.","core_discovery":"On the paper's own terms, the central discovery is that the gradient a passive party receives back from the active party carries a usable label signal even when the top model is a multi-layer network, and that signal can be harvested with only one known instance of the target label. The paper analyzes the returned gradient as a linear combination of top-model weight vectors, showing that in early training the ground-truth class's weight vector dominates the direction; label-specific ReLU activation patterns and near-orthogonal first-layer columns preserve this correlation in deeper top models. On top of that gradient-direction label inference, HASSLE replaces the embeddings of inferred target-label samples with an adversarially optimized embedding and pre-trains its own bottom model with self-supervised learning so the active party's top model relies more heavily on the attacker's features. The result is a two-stage hijack: locate the target-label samples, then train the model to associate the attacker's embedding with the target label. In the two-party setting this yields over 99% attack success on CIFAR-10, ImageNette, NUS-WIDE and Income, and 85% attack success on CIFAR-100.","pith_inferences":["Because the attack relies on early gradient direction, a defense that deliberately decorrelates per-class gradient directions in the first few epochs, such as adding class-dependent isotropic noise before gradients are returned, should attack the mechanism directly and could preserve utility better than global DP noise.","The saliency result implies the active party's own embedding contributes to the hijack; constraining all parties' embedding norms and top-model weight norms from the start may be a cheap general mitigation, though the paper's LIMIT experiments show it does not fully stop the attack.","The single-known-sample assumption could be stress-tested by selecting an atypical or adversarial known sample; if the multi-epoch similarity averaging is not robust to such outliers, the practical threat may be smaller than reported.","The self-supervised pre-training trick is not specific to VFL and could plausibly boost the influence of a malicious participant in other split-learning or collaborative-training settings, which the paper does not explore."],"forward_implications":["A passive party with one leaked label sample can map out essentially the entire target class in the training set, so label confidentiality in VFL cannot rest on the assumption that returned gradients hide the label.","Hijacking attacks no longer need large auxiliary labeled datasets or late-training injection; early, high-precision label inference plus adversarial embedding yields high attack success at low poisoning rates such as 2.5%.","The attack does not sacrifice main task accuracy in the reported experiments, so accuracy-based anomaly detection will not flag it.","The threat weakens as the attacker's share of features shrinks: four-party setups or attacker-held feature ratios below 0.3 degrade the attack, which points to influence limitation as a practical line of defense.","Among the eight tested defenses, DPSGD, VFLIP and LIMIT reduce the attack most, but none eliminates it, suggesting that VFL integrity needs combined defenses rather than a single countermeasure."],"supporting_citations":[{"why":"Fu-LIA supplies the surrogate-top-model label inference baseline that HASSLE improves on and compares against.","marker":"[7]"},{"why":"ADI introduces adversarial dominating inputs, the embedding-level hijacking idea that HASSLE extends into a training-time poisoning attack.","marker":"[8]"},{"why":"Li et al. establish that returned gradient direction correlates with label in binary split learning, the foundation of HASSLE's gradient-direction analysis.","marker":"[12]"},{"why":"BadVFL provides the embedding-swapping label inference and backdoor baseline whose limitations motivate HASSLE's design.","marker":"[13]"},{"why":"VILLAIN provides the embedding-level trigger backdoor baseline and its weak label inference is used to motivate HASSLE's multi-epoch similarity scoring.","marker":"[14]"},{"why":"The mean-shift backdoor attack on split neural networks is a direct baseline for hijacking performance.","marker":"[17]"},{"why":"LR-BA provides the surrogate-model adversarial embedding baseline that HASSLE compares against in hijacking evaluation.","marker":"[18]"},{"why":"MoCo-v2 supplies the self-supervised pre-training method used to initialize the attacker's bottom model on image datasets.","marker":"[24]"},{"why":"SCARF supplies the self-supervised pre-training method used to initialize the attacker's bottom model on tabular datasets.","marker":"[25]"}],"fun_headline_variants":["One labeled sample, 99% hijack success in vertical federated learning","HASSLE: self-supervised leak hijacks VFL with one known sample","Gradient leak: one known label reaps 99% success in VFL hijack","HASSLE: one sample gives 99% hijack success in VFL"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The label inference module assumes that early in training the direction of the returned gradient is dominated by the ground-truth label's weight vector, which requires near-orthogonal class weight vectors and near-uniform initial predictions; for many-class tasks or deeper top models this correlation fades, and the paper itself reports label inference precision falling to 41.6% on CIFAR-100 with a four-layer top model.","fun_headline_variants_meta":{"raw":{"variants":["One labeled sample, 99% hijack success in vertical federated learning","HASSLE: self-supervised leak hijacks VFL with one known sample","Gradient leak: one known label reaps 99% success in VFL hijack","HASSLE: one sample gives 99% hijack success in VFL"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001069,"raw_usage":{"total_tokens":4501,"prompt_tokens":990,"completion_tokens":3511,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":606,"completion_tokens_details":{"reasoning_tokens":3423}},"tokens_in":606,"tokens_out":3511,"duration_ms":25549,"temperature":1.0,"reasoning_tokens":3423,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T17:37:39.938894+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a two-party SplitVFL on CIFAR-100 with a four-layer MLP top model and a randomly initialized ResNet-18 bottom model, then compute the cosine similarity between returned gradients of samples sharing a label in the first five epochs; if same-label similarity is not significantly higher than cross-label similarity, the gradient-direction premise fails and HASSLE's label inference should fall to roughly chance, matching the paper's reported 41.6% precision at that depth.","supporting_citations":[{"cited_title":"ADI: Adversarial Dominating Inputs in Vertical Federated Learning Systems","cited_arxiv_id":"2201.02775","evidence_quote":"ADI introduces adversarial dominating inputs, the embedding-level hijacking idea that HASSLE extends into a training-time poisoning attack."},{"cited_title":"Label leakage and protection in two-party split learning,","cited_arxiv_id":null,"evidence_quote":"Li et al. establish that returned gradient direction correlates with label in binary split learning, the foundation of HASSLE's gradient-direction analysis."},{"cited_title":"Practical and general backdoor attacks against vertical federated learning,","cited_arxiv_id":null,"evidence_quote":"BadVFL provides the embedding-swapping label inference and backdoor baseline whose limitations motivate HASSLE's design."},{"cited_title":"{VILLAIN}: Backdoor attacks against vertical split learning,","cited_arxiv_id":null,"evidence_quote":"VILLAIN provides the embedding-level trigger backdoor baseline and its weak label inference is used to motivate HASSLE's multi-epoch similarity scoring."},{"cited_title":"Backdoor attack against split neural network-based vertical federated learning,","cited_arxiv_id":null,"evidence_quote":"The mean-shift backdoor attack on split neural networks is a direct baseline for hijacking performance."},{"cited_title":"Lr-ba: Backdoor attack against vertical federated learning using local latent representations,","cited_arxiv_id":null,"evidence_quote":"LR-BA provides the surrogate-model adversarial embedding baseline that HASSLE compares against in hijacking evaluation."},{"cited_title":"Scarf: Self-supervised contrastive learning using random feature corruption,","cited_arxiv_id":null,"evidence_quote":"SCARF supplies the self-supervised pre-training method used to initialize the attacker's bottom model on tabular datasets."}],"review_version":1}