Pith. sign in

REVIEW 4 major objections 7 minor 20 references

ProtoGuard-SL: Prototype Consistency Based Backdoor Defense for Vertical Split Learning

T0 review · 4 major / 7 minor · reviewed 2026-07-13 · grok-4.5

Challenge this review Download PDF Read on arXiv ↗

Pith's one-line read A server can strip stealthy backdoor embeddings from vertical split learning by rewriting them as class-prototype consistency scores and filtering outliers.

desk verdict Solid server-side packaging of median prototypes + conformal filtering for vertical SL backdoors; SOTA numbers are real under non-adaptive attacks but untested against consistency-preserving adaptive ones. read the letter →

arxiv 2604.03595 v1 submitted 2026-04-04 cs.CR

Yuhan Shui , Ruobin Jin , Zhihao Dou , Zhiqiang Gao This is my paper · ORCID
classification cs.CR
keywords splitlearningbackdoorattacksverticalfederatedembeddingdefenseprototypeconsistencyconformalfilteringpoisoning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Vertical split learning lets parties train a shared model on complementary features without exchanging raw data, but malicious clients can poison the intermediate embeddings they send and implant backdoors that are hard to see in the original space. This paper claims that clean embeddings of the same class share a stable semantic alignment, while poisoned ones disrupt that alignment even when they look ordinary geometrically. ProtoGuard-SL builds robust median class prototypes on the server, maps every embedding to its cosine similarities with those prototypes, then applies a class-conditional conformal test to drop anomalous points. On CIFAR-10, SVHN, and Bank Marketing under three standard attacks, the method drives attack success down to a few percent while holding or improving clean accuracy. A sympathetic reader cares because split learning is already attractive for privacy-sensitive settings, yet earlier defenses either leave the backdoor strong or sacrifice too much utility.

What carries the argument

Prototype-consistency representation: each embedding becomes the vector of its cosine similarities to robust (median) class prototypes; a class-conditional, distribution-free conformal filter then scores deviation from the class median of those vectors and rejects low p-value points. The relational rewrite, not raw geometry, is what creates separability.

What would settle it

Construct an adaptive attack that keeps poisoned embeddings’ cosine-similarity vectors to the median class prototypes statistically indistinguishable from clean same-class vectors, yet still achieves high attack success after ProtoGuard-SL filtering at the paper’s default α=0.5.

Watch

Extended reading notes

Core claim

Poisoned embeddings in vertical split learning inevitably disrupt the class-conditional representation consistency that benign embeddings of the same class share. By building median class prototypes, transforming each embedding into a vector of cosine similarities to all prototypes, and filtering with class-conditional conformal p-values, a server can separate and remove the poisons while preserving main-task accuracy, outperforming prior defenses across the attacks and datasets tested.

Load-bearing premise

Clean samples of the same class keep a stable relational pattern to class prototypes that any useful poison will break enough for a fixed conformal threshold to catch.

Editorial extensions

If this is right

  • Servers in vertical split learning can filter embeddings without client cooperation or parametric distribution assumptions.
  • Defenses that only inspect norms or simple similarity in the original embedding space will keep missing stealthy poisons.
  • High clean accuracy together with near-zero attack success is achievable on both image and tabular vertical splits.
  • The same consistency check can be reapplied whenever the server receives embeddings, including at inference.
  • Increasing the number of clients need not break the defense if class prototypes remain well estimated.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An adaptive attacker that explicitly preserves cosine-to-prototype profiles could force a new arms race beyond the three attacks evaluated.
  • Median-prototype consistency may transfer to other intermediate-representation pipelines where labels sit on one side, such as multi-party collaborative inference.
  • If labels available to the server can be partly corrupted, prototype construction becomes the new single point of failure.
  • A fixed conformal threshold may need online recalibration when class balance or embedding dimension drifts over long training.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes ProtoGuard-SL, a server-side defense against embedding-space backdoor attacks in vertical split learning. Motivated by the claim that benign embeddings of a class share stable semantic alignment while poisoned embeddings disrupt it (Fig. 1, §III.A), the method builds coordinate-wise median class prototypes (Eq. 1), maps each embedding to a vector of cosine similarities to all prototypes (Eq. 2), scores L2 deviation from the class median consistency pattern (Eqs. 3–4), and applies class-conditional conformal p-value filtering at significance α (Eq. 5; Algorithm 1). Experiments on CIFAR-10, SVHN, and Bank Marketing under VILLAIN, SplitNN, and BadVFL report ASR reduced to 0.03–0.08 with maintained or improved main accuracy versus DP, MP, ANP, and VFLIP (Table I), with ablations (Table II), bottom-model swaps (Table III), α sensitivity (Table IV), and client-count plots (Fig. 2).

Significance. Vertical split learning is a practically relevant collaborative setting with a clear embedding-interface attack surface; a simple, label-aware server-side filter that does not require client cooperation is a useful contribution if it holds under realistic adversaries. Strengths include a coherent two-stage design, explicit ablations isolating consistency representation and class-conditional scoring, multi-dataset multi-attack tables, and architecture generalization beyond the default FCN bottoms. The work is empirical rather than theorem-driven; its value hinges on whether the “inevitably disrupt” premise and the reported SOTA numbers survive adaptive attackers who preserve class-consistency profiles—the natural threat the method itself invites.

major comments (4)
  1. [§III.A, Eqs. (1)–(5), Table I] The SOTA claim (Abstract; Table I) and the motivating premise that poisoned embeddings “inevitably disrupt” class-conditional consistency (§III.A, Fig. 1) are evaluated only against the original non-adaptive VILLAIN, SplitNN, and BadVFL formulations. None of these is constrained to keep cos(E_k, p_c) profiles near μ_y while still implanting a backdoor. An adaptive client that approximates server prototypes (labels are known to the server and often partially inferable) and projects malicious embeddings onto typical consistency vectors would keep s_k small and p_k > α, so the filter retains poison. The paper criticizes prior defenses for limited adaptive robustness but does not evaluate this natural adaptive variant against ProtoGuard-SL. Without that check, the central empirical claim remains untested under the threat model the method invites.
  2. [§III.B, Eqs. (1), (3), (5)] Prototypes p_c, reference patterns μ_c, and conformal p-values (Eqs. 1, 3, 5) are all computed on the same contaminated embedding set observed at the server. Median aggregation provides some robustness, but the paper asserts a “distribution-free” class-conditional filter without discussing exchangeability or contamination bias when calibration scores include poisons. At the stated 5% poison rate this may be mild, yet the validity of treating p_k as a calibrated anomaly score—and the informal security guarantee at the end of §III—needs either a clear finite-sample argument under contamination or an empirical protocol that builds prototypes/μ_c on a held-out clean or majority-vote subset.
  3. [§IV.A, Table IV, Eq. (5)] Default α = 0.5 (and the best operating point in Table IV) discards roughly half of each class’s embeddings by rank. With only 5% poison, most removed samples are benign. High MA under such aggressive filtering may partly reflect data cleaning or easier residual training sets rather than selective poison removal alone. The paper should quantify the fraction of clean vs. poisoned embeddings removed, report MA/ASR as a function of retained-data fraction, and justify α = 0.5 relative to the poison rate; otherwise the utility–security trade-off is hard to interpret.
  4. [§IV.A, §IV.E, Table I] Load-bearing sensitivity results for poison rate, malicious-client fraction, and poisoning start round are deferred to an unavailable supplement (§IV.E). Table I and Fig. 2 fix one malicious client out of four and 5% poison. For a robustness paper whose main claim is SOTA under poisoning, those curves (or equivalent tables) should appear in the main text or the claim should be scoped to the fixed setting actually reported.
minor comments (7)
  1. [§IV.A] §IV.A states “four widely used image classification benchmarks: CIFAR-10, SVHN and Bank Market” but only three datasets are used, and Bank Marketing is tabular, not image.
  2. [§IV.A, Abstract, §III] Typos and wording: “maclious” (malicious), “Bank Market,” “class-conditional representation consistencyin,” “OurProtoGuard-SL,” and “ACC” vs “MA” inconsistency in the metrics paragraph.
  3. [Fig. 2] Fig. 2 axis/legend text is garbled in the manuscript PDF source; regenerate with readable labels and a clear caption defining each curve.
  4. [§III.B (end)] The closing paragraph of §III claims ProtoGuard-SL “does not leak sensitive information” and “guarantee[s] the security” under unspecified constraints, without a privacy analysis. Either remove or move to a dedicated, supported privacy discussion; the paper’s contribution is backdoor filtering, not privacy.
  5. [§IV.B, Related Work] Terminology mixes “vertical split learning,” “vertical federated learning,” and “VFL” (e.g., end of §IV.B). Use one primary term consistently.
  6. [§IV.A, Table III] Default client bottoms are 4-layer FCNs on CIFAR-10/SVHN; Table III helps, but briefly justify why FCN is the primary setting for image data.
  7. [Table I–IV] No error bars or repeated-seed statistics appear in Tables I–IV; even 3–5 runs with std would strengthen the SOTA comparison.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: ProtoGuard-SL is an empirical defense whose MA/ASR results are measured on external attacks and baselines, not forced by construction from fitted inputs.

full rationale

The paper’s load-bearing chain is observational and algorithmic, not a first-principles derivation that equates a claimed prediction to its inputs. Class prototypes (Eq. 1) are coordinate-wise medians of labeled embeddings; consistency vectors (Eq. 2) are cosine similarities to those prototypes; class reference patterns (Eq. 3) and L2 deviation scores (Eq. 4) are standard robust summaries; conformal p-values (Eq. 5) are rank-based filters with free threshold α. None of these steps defines the reported main accuracy or attack success rate by construction: MA and ASR are measured after filtering on held-out clean and triggered test samples under VILLAIN, SplitNN, and BadVFL, and are compared to independent baselines (DP, MP, ANP, VFLIP). α is treated as a hyperparameter with sensitivity analysis (Table IV), not fitted to redefine ASR. Citations to prior attacks and defenses are external benchmarks, not self-citation uniqueness theorems that force the method. The motivational claim that poisoned embeddings “inevitably disrupt” class-conditional consistency is an empirical premise (Fig. 1, §III.A), not a circular reduction; whether it fails under adaptive attacks is a threat-model/correctness concern, not circularity. The work is self-contained against external datasets and attack implementations, so the circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 2 invented entities

The central claim rests on empirical ML assumptions and a few hand-chosen thresholds rather than new physics entities. Load-bearing pieces are the class-consistency hypothesis, median robustness under partial poisoning, validity of rank-based conformal filtering without exchangeability proof under adversarial contamination, and experimental knobs (α, poison rate, client mix) that define the reported operating point.

free parameters (3)
  • conformal significance level α
    Default α=0.5 is chosen by sensitivity table; α=0.3 leaves high ASR and α=0.9 destroys MA, so reported SOTA depends on this hand-selected threshold.
  • poison rate / malicious client fraction / trigger magnitude
    Main results fix poison rate 5%, one of four clients malicious, trigger magnitude 1.0; these define the attack strength against which SOTA is claimed.
  • poisoning start round and training schedule
    Poisoning begins at round 20 of 80 with fixed LR and batch size; defense behavior may depend on when prototypes are estimated relative to attack onset.
assumptions (4)
  • domain assumption Benign same-class embeddings exhibit stable semantic/relational alignment that poisoned embeddings disrupt enough to separate in prototype-consistency space.
    Core motivation in abstract and §III.A; without it, conformal filtering on consistency scores has no signal.
  • domain assumption Coordinate-wise median prototypes remain representative under a small fraction of poisoned embeddings per class.
    Eq. (1) and surrounding text; robustness of the prototype is assumed rather than proved under adaptive contamination.
  • ad hoc to paper Class-conditional rank-based conformal p-values (Eq. 5) validly flag anomalies without parametric distributional assumptions, even though scores are computed on the same contaminated set used to form prototypes and µ_c.
    Standard conformal theory needs exchangeability; adversarial poisoning and in-sample prototype construction violate that, yet the paper treats the filter as distribution-free.
  • domain assumption Server holds ground-truth labels for all training embeddings and can filter before top-model updates.
    Standard vertical SL label placement; required for class-conditional prototypes and filtering.
invented entities (2)
  • prototype-consistency representation v_k
    purpose: Map each embedding to cosine similarities with all class prototypes so relational anomalies become separable.
    Defined in Eq. (2); the paper’s main representational device. Independent evidence is only the paper’s own t-SNE-style plots and ablations, not an external theory result.
  • ProtoGuard-SL two-stage defense pipeline
    purpose: Server-side detection/removal of poisoned embeddings via prototypes + conformal filtering.
    Named system combining known pieces; evaluated only in this manuscript’s experiments.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ProtoGuard-SL: Prototype Consistency Based Backdoor Defense for Vertical Split Learning." pith.science (2026). https://pith.science/paper/2604.03595

@misc{pith2026260403595,
  author       = {Pith},
  title        = {Pith review of: ProtoGuard-SL: Prototype Consistency Based Backdoor Defense for Vertical Split Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2604.03595}},
  note         = {Machine review of arXiv:2604.03595}
}
read the original abstract

Vertical split learning (SL) enables collaborative model training across parties holding complementary features without sharing raw data, but recent work has shown that it is highly vulnerable to poisoning-based backdoor attacks operating on intermediate embeddings. By compromising malicious clients, adversaries can inject stealthy triggers that manipulate the server-side model while remaining difficult to detect, and existing defenses provide limited robustness against adaptive attacks. In this paper, we propose ProtoGuard-SL, a server-side defense that improves the robustness of split learning by exploiting class-conditional representation consistency in the embedding space. Our approach is motivated by the observation that benign embeddings within the same class exhibit stable semantic alignment, whereas poisoned embeddings inevitably disrupt this structure. ProtoGuard-SL adopts a two-stage framework that constructs robust class prototypes and transforms embeddings into a prototype-consistency representation, followed by a class-conditional, distribution-free conformal filtering strategy to identify and remove anomalous embeddings. Extensive experiments are conducted on three datasets, CIFAR-10, SVHN, and Bank Marketing, under three different attack settings demonstrate that our method achieves state-of-the-art performance.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 5 linked inside Pith

  1. [1]

    Blindfl: Vertical federated machine learning without peeking into your data,

    Fangcheng Fu, Huanran Xue, Yong Cheng, Yangyu Tao, and Bin Cui, “Blindfl: Vertical federated machine learning without peeking into your data,” inSIGMOD, 2022

    2022

  2. [2]

    Pyvertical: A vertical federated learning frame- work for multi-headed splitnn,

    Daniele Romanini, Adam James Hall, Pavlos Papadopoulos, Tom Tit- combe, Abbas Ismail, Tudor Cebere, Robert Sandmann, Robin Roehm, and Michael A Hoeh, “Pyvertical: A vertical federated learning frame- work for multi-headed splitnn,”arXiv preprint arXiv:2104.00489, 2021

    arXiv 2021

  3. [3]

    Asymmetrical vertical federated learning,

    Yang Liu, Xiong Zhang, and Libin Wang, “Asymmetrical vertical federated learning,”arXiv preprint arXiv:2004.07427, 2020

    arXiv 2004

  4. [4]

    Splitfed: When federated learning meets split learning,

    Chandra Thapa, Pathum Chamikara Mahawaga Arachchige, Seyit Camtepe, and Lichao Sun, “Splitfed: When federated learning meets split learning,” inAAAI, 2022

    2022

  5. [5]

    Split learn- ing for collaborative deep learning in healthcare,

    Maarten G Poirot, Praneeth Vepakomma, Ken Chang, Jayashree Kalpathy-Cramer, Rajiv Gupta, and Ramesh Raskar, “Split learn- ing for collaborative deep learning in healthcare,”arXiv preprint arXiv:1912.12115, 2019

    arXiv 1912

  6. [6]

    Split learning for health: Distributed deep learning without sharing raw patient data,

    Praneeth Vepakomma, Otkrist Gupta, Tristan Swedish, and Ramesh Raskar, “Split learning for health: Distributed deep learning without sharing raw patient data,”arXiv preprint arXiv:1812.00564, 2018

    arXiv 2018

  7. [7]

    Detailed comparison of communication efficiency of split learning and federated learning,

    Abhishek Singh, Praneeth Vepakomma, Otkrist Gupta, and Ramesh Raskar, “Detailed comparison of communication efficiency of split learning and federated learning,”arXiv preprint arXiv:1909.09145, 2019

    arXiv 1909

  8. [8]

    Communication-efficient learning of deep networks from decentralized data,

    H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Ag ¨uera y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inAISTATS, 2017

    2017

Show all 20 references
  1. [9]

    Split learning for distributed collaborative training of deep learning models in health informatics,

    Zhuohang Li, Chao Yan, Xinmeng Zhang, Gharib Gharibi, Zhijun Yin, Xiaoqian Jiang, and Bradley A Malin, “Split learning for distributed collaborative training of deep learning models in health informatics,” in AMIA Annual Symposium Proceedings, 2024, vol. 2023, p. 1047

    2024

  2. [10]

    Split learning optimized for the medical field: Reducing communication overhead,

    Shuai Guo, Zhi Lu, Songfeng Lu, Yongquan Cui, Xueming Tang, and Junjun Wu, “Split learning optimized for the medical field: Reducing communication overhead,” in2024 IEEE International Conference on Bioinformatics and Biomedicine (BIBM). IEEE, 2024, pp. 3226–3231

    2024

  3. [11]

    Villain: Backdoor attacks against vertical split learning,

    Yijie Bai, Yanjiao Chen, Hanlei Zhang, Wenyuan Xu, Haiqin Weng, and Dou Goodman, “Villain: Backdoor attacks against vertical split learning,” inUSENIX Security Symposium, 2023

    2023

  4. [12]

    Backdoor attack against split neural network-based vertical federated learning,

    Ying He, Zhili Shen, Jingyu Hua, Qixuan Dong, Jiacheng Niu, Wei Tong, Xu Huang, Chen Li, and Sheng Zhong, “Backdoor attack against split neural network-based vertical federated learning,”IEEE Transactions on Information F orensics and Security, vol. 19, pp. 748–763, 2023

    2023

  5. [13]

    Badvfl: Backdoor attacks in vertical federated learning,

    Mohammad Naseri, Yufei Han, and Emiliano De Cristofaro, “Badvfl: Backdoor attacks in vertical federated learning,” pp. 2013–2028, 2024

    2013

  6. [14]

    Securesplit: Mitigating backdoor attacks in split learning,

    Zhihao Dou, Dongfei Cui, Weida Wang, Anjun Gao, Yueyang Quan, Mengyao Ma, Viet V o, Guangdong Bai, Zhuqing Liu, and Minghong Fang, “Securesplit: Mitigating backdoor attacks in split learning,”WWW, 2026

    2026

  7. [15]

    Vflip: A backdoor defense for vertical federated learning via identification and purification,

    Yungi Cho, Woorim Han, Miseon Yu, Younghan Lee, Ho Bae, and Yunheung Paek, “Vflip: A backdoor defense for vertical federated learning via identification and purification,” inEuropean Symposium on Research in Computer Security, 2024

    2024

  8. [16]

    A data-driven approach to predict the success of bank telemarketing,

    S ´ergio Moro, Paulo Cortez, and Paulo Rita, “A data-driven approach to predict the success of bank telemarketing,”Decision Support Systems, vol. 62, pp. 22–31, 2014

    2014

  9. [17]

    Deep learning with differential privacy,

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang, “Deep learning with differential privacy,” inProceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318

    2016

  10. [18]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International symposium on research in attacks, intrusions, and defenses. Springer, 2018, pp. 273–294

    2018

  11. [19]

    Adversarial neuron pruning purifies backdoored deep models,

    Dongxian Wu and Yisen Wang, “Adversarial neuron pruning purifies backdoored deep models,”Advances in Neural Information Processing Systems, vol. 34, pp. 16913–16925, 2021

    2021

  12. [20]

    Safesplit: A novel defense against client-side backdoor attacks in split learning,

    Phillip Rieger, Alessandro Pegoraro, Kavita Kumari, Tigist Abera, Jonathan Knauer, and Ahmad-Reza Sadeghi, “Safesplit: A novel defense against client-side backdoor attacks in split learning,” inNDSS, 2025

    2025

Pith tools

Reviewed July 13, 2026 · model on record in the stance chip above.