Universal Backdoor Defense via Label Consistency in Vertical Federated Learning

1 Introduction

With the rise of deep learning, data privacy and security have gained significant attention. Federated Learning (FL), a collaborative training paradigm that maintains data locally, has garnered significant attention. FL are principally categorized into Horizontal Federated Learning (HFL) and Vertical Federated Learning (VFL) based on the data distribution across participating parties [Yang et al., 2019]. VFL is applicable when datasets share the same sample space (e.g., the same users) but possess different feature spaces. For example, a bank could enhance its credit assessment model by integrating more features from local retailers (the same users) and maintaining data privacy [Fu et al., 2022; Qiu et al., 2024; Zheng et al., 2024; Zheng et al., 2023; Xu et al., 2025; Xiang et al., 2024].

∗Corresponding Author

While FL is designed to enhance data security, it is nonetheless vulnerable to attacks such as backdoor injection, which leverages the exchange of intermediate training information [Jin et al., 2023]. A backdoor attack involves an adversary embedding a specific trigger pattern into a subset of poisoned data, aiming to establish a connection between the trigger and a chosen target class during model training. The result is a compromised model that, during inference, consistently classifies any input containing the trigger as the backdoor target class. Because these attacks generally do not impact the model's performance on clean, trigger-free data, they are inherently stealthy, seriously threatening the integrity of model decision-making, especially in VFL with model and data splitting structure [Li et al., 2024b].

Backdoor attacks in VFL can be classified as dirty-label and clean-label variants. In dirty-label attacks, the adversary, acting as a passive participant party, substitutes local feature embeddings and gradients of poisoned and clean samples, linking them to the clean target label by tampering with intermediate feature embeddings [Zou et al., 2022]. In contrast, clean-label attacks leverage prior knowledge or label inference to identify target samples and embed triggers into their local inputs, associating them with the target class during the VFL training process without altering the labels or feature embeddings. [Naseri et al., 2024; Bai et al., 2023; Chen et al., 2023; Chen et al., 2024].

Existing VFL backdoor defense methods fall into two main categories: label protection and backdoor purification methods. Label protection methods [Li et al., 2022; Fu et al., 2022] attempt to prevent attacks by limiting information leakage, particularly ground truth labels, which the adversary exploits. Purification methods [Liu et al., 2022; Bai et al., 2023; Wu and Wang, 2021] focus on pruning poisoned model neurons or filtering malicious samples to suppress backdoor effects. However, both approaches are significantly hampered by the information asymmetry inherent in VFL: the active party acting as the defender lacks access to the passive parties' data and local bottom models. This prevents tailored label protection against varied poisoning strategies targeting unseen data and limits the scope of purification methods that require visibility into the fully distributed model. Consequently, these methods often result in suboptimal backdoor defensive performance while simultaneously degrading the utility of the VFL model.

To address these challenges, this paper proposes a Universal Backdoor Defense (UBD) framework designed to defend against both dirty-label and clean-label backdoor attacks, which consists of Label Consistent Clustering (LCC) and Linear Probing (LP) mitigation modules. The LCC module identifies the backdoor target class and synthesizes triggers within the latent feature space controlled by the defender. It predicts potential poisoned samples by analyzing the consistency between ground truths and prediction results, combined with a clustering method. Backdoor triggers are then generated in the latent feature space by examining discrepancies between the predicted poisoned samples and a small set of clean validation data. LP mitigates attacks by fine-tuning the defender's top model using the identified backdoor class and triggers, with Batch Normalization (BN) statistics constraint to preserve the utility of the VFL model.

In summary, the main contributions of this paper can be summarized as:

• We propose a backdoor defense framework, UBD, for VFL systems that efficiently defends against generic backdoor attacks, including dirty-label and clean-label variants, without accessing models and data of passive parties, requiring only 5% of clean validation data.
• The proposed LCC module features a backdoor trigger inversion strategy that enables the identification of latent triggers and backdoor target class using minimal clean validation data without requiring model training.
• We design an efficient backdoor mitigation module LP with BN statistics constraint to achieve state-of-the-art defense performance, which does not need to fine-tune the whole VFL model.
• We perform extensive experiments on multiple datasets to validate the effectiveness, robustness, and efficiency of the proposed defense method in VFL.

2 RelatedWork

2.1 Backdoor Attacks in VFL

Backdoor attacks in VFL can be classified as dirty-label and clean-label variants, distinguished by whether or not the labels are tampered with during poisoning. As a typical dirtylabel backdoor attack, LRB [Zou et al., 2022] assumes the adversary has a few clean samples of the target class. Then, the adversary exchanges the intermediate information of poisoned and target samples, establishing an implicit connection between the target class and poisoned samples. Although labels in the active party cannot be directly modified, the replacement operation in the intermediate layer realizes a dirtylabel backdoor attack [Chen et al., 2017; Doan et al., 2021; Li et al., 2024b]. In contrast, Methods [Chen et al., 2024; Bai et al., 2023] utilize label inference to identify samples belonging to the target class, subsequently injecting the backdoor by directly embedding triggers into the inputs of these samples. Similarly, approaches described in [Naseri et al., 2024; He et al., 2023; Chen et al., 2023] assume the adversary has access to a limited number of target samples and conducts clean-label backdoor attacks by directly associating triggers with these target samples.

2.2 Backdoor Defenses in VFL

Existing VFL backdoor defense methods fall into two main categories: label protection and backdoor purification methods. Label protection methods [Li et al., 2022; Fu et al., 2022; Wu et al., 2022; Bai et al., 2023] attempt to disrupt the malicious mapping between poisoned samples and the target label by interfering with label-derived information, often by perturbing transmitted gradients. Backdoor purification methods [Wu and Wang, 2021; Bai et al., 2023; Xu et al., 2024] aim to eliminate backdoor effects within the VFL model, for instance, by devising masks to identify and suppress poisoned features or neurons.

However, both approaches are significantly limited by the VFL setting. Label protection often leads to substantial utility decreases due to indiscriminate application to all training data, while purification is hampered by the defender's lack of access to passive parties' bottom models and data, preventing comprehensive fine-tuning or pruning. To address these limitations, this paper aims to design a generic backdoor defense framework capable of addressing both dirty-label and clean-label attacks. This framework conducts solely on the defender's accessible top model and requires only a minimal validation dataset, enabling efficient and practical defense against VFL backdoors.

3 Preliminaries

3.1 Backdoor Attacks in Vertical Federated Learning

VFL is a collaborative distributed machine learning system in which data is vertically partitioned into different participants. The system consists of K passive parties and one active party. Passive parties only possess local feature data, while the active party has access to and controls the labels. For a classification task with the training dataset D △= {(xki , yi )Kk=1}N i=1 in VFL, where xki denotes the i-th samples of k-th passive participant. The objective of VFL can be formulated as [Liu et al., 2024; Ye et al., 2024]:

where Θ = {θ1, · · · , θK; θtop} and L(·) denote the whole model parameters and loss function of VFL respectively; γ(·) and λ represent the regularizer and corresponding hyperparameter. We omit the k-th notation in x for simplicity.

During the training stage of VFL, each passive party computes the local feature embedding Hk i = Φk(xki , θk) with its local data and bottom model, and then, the active party receives all feature embeddings from passive parties and utilizes the top model and labels to compute the objective function in Eq.(1). Next, the active party computes the gradients ∂ℓ ∂θtop to update its top model θtop. Afterwards, the gradients of the loss function with respect to feature embeddings ∂ℓ ∂Hk i are transmitted to each passive party. Finally, each passive party k updates its local bottom model θk with the gradients. In the inference phase, the active party outputs predictions based on feature embeddings sent by the bottom model of each passive party, where input samples are locally split.

Backdoor attacks aim to implant a hidden task in the VFL model during training, causing it to misclassify inputs with the specific trigger while maintaining main task performance on clean inputs during inference [Li et al., 2024b]. The objective of backdoor attacks in VFL can be formulated as:

where Dc and Dp denote the clean and poisoned data respectively, D = Dc ∪Dp; δ and τ represent backdoor triggers and target class; x and y refer to the set of inputs and labels, respectively. For simplicity, the regularizer in Eq.(1) is omitted.

3.2 Threat Model

Adversary's capacity. Since the active party controls the top model and labels, it can easily modify labels or manipulate the predictions of the top model. Therefore, this paper investigates scenarios where the adversary is a malicious passive party. This adversary strictly adheres to the VFL protocol, limiting its actions to exchanging local feature embeddings and gradients with the active party.

Defender's capacity. The defender, acting as the active party in VFL, also adheres to the VFL protocol. The defender's goal is to detect the backdoor target class and mitigate backdoor attacks during the inference stage of VFL. In accordance with the VFL protocol, the defender has access to the feature embeddings from all passive parties, as well as the labels and prediction results for the training dataset. In addition, the defender has access to an extra validation dataset Dval, which consists of a small number of clean samples from each class. This is a reasonable assumption, as model performance must be validated during the VFL training stage and aligns with existing backdoor defense efforts [Xu et al., 2024; Zhu et al., 2024; Guo et al., 2023; Ma et al., 2023].

4 Universal Backdoor Defense Framework

The goal of the Universal Backdoor Defense (UBD) framework is to mitigate backdoor attacks in VFL systems. As depicted in Fig.1, UBD achieves this through the integration of two core modules: the Label Consistent Clustering (LCC) module and the Linear Probing (LP) module. The LCC module identifies the backdoor target class and generates latent backdoor triggers, while the LP module utilizes the identified backdoor class and triggers to mitigate the backdoor effects in the VFL model.

4.1 LCC Backdoor Detection

The LCC method comprises two modules for generating triggers of the backdoor target class in VFL: Label Consistency Purification (LCP) and Feature Clustering Detection (FCD). The LCP module identifies suspicious poisoned training samples by analyzing the consistency between predictions and ground truth labels. Subsequently, the FCDmodule leverages the clustering of these suspicious samples to directly infer the backdoor target class and corresponding triggers.

Label Consistency Purification. Considering a scenario where the VFL model has already completed the training process, the backdoor has already been injected into the model. Consequently, the backdoor triggers are strongly associated with the target class, leading the VFL model to classify poisoned samples containing these triggers as the backdoor target class. In this context, the defender retains all feature embeddings and labels of the training data obtained during training and controls the VFL outputs through ownership of the top model in the active party.

For both clean-label and dirty-label backdoor attacks, any poisoned sample x ∈ Dp is directly mapped to the backdoor target τ:

where Φ(·) denotes the feature mapping function of VFL, respectively.

In clean-label attacks, the adversary injects triggers directly into samples whose true label is already τ , further tightening the connection Φ(x) ↦→ τ. By contrast, dirty-label attacks substitute Dp with target samples in ways that induce Φ(x) ↦→ τ . From the defender's perspective, regardless of the specific backdoor injection method, the observed outcome is consistently the same: all poisoned feature embeddings concentrate in a region identified with the target label τ .

Definition 1 (Label Consistency Property). Let G be the label mapping function, and suppose F poi = G ◦ Φ represents the victim VFL model. For each training example (x, y) ∈ D with y = τ, define a trigger function η(·) that injects the backdoor triggers (if any) into x. We say (x, y) satisfies label consistency with respect to τ if

Then the set of all such samples that satisfy the label consistency property is

In essence, every sample in DτLCP is one whose true label is τ but also predicted as τ by the poisoned model whether or not the backdoor η(·) is applied. Such label consistency may indicate suspicious poisoned samples.

According to Eq.(5), the defender can identify suspicious poisoned samples for the target class by selecting those where the predictions match their true labels. Utilizing label consistency, the process of identifying poisoned samples within the target class can be framed as a binary classification task [Xiang et al., 2023b; Xiang et al., 2023a].

Algorithm 1 LCC backdoor detection on the VFL system.

Require:

Pretrained model parameters Θ; Training and validation dataset D, Dval.

Ensure:

Backdoor target class τ and latent triggers ˆ δ

• 1: for each batch B in D do
• 2: for each party k = 1, 2, . . . , K in parallel do
• 3: k computes feature embeddings {Hk
• i }i∈B according to its bottommodel fk; % Feature embeddings are actually retained from
• the VFL training process
• 4: end for
• 5: end for
• 6: Active party (Defender):
• 7: for each category m= 1, 2, · · · ,M do
• 8: % Step 1: Label Consistency Purification
• 9: computes Eq. (5), and then purify the training data D to get the Dm LCP for class m;
• 10: % Step 2: Feature Clustering Detection
• 11: C Sm = clustering(Dm LCP )
• 12: candidate backdoor triggers ˆ δm are computed according to Eq. (6) using Dm val and C Sm;
• 13: computes ASRSm for category mwith Eq. (7);
• 14: end for
• 15: identifies the backdoor class as:
• 16: S = argmaxMm=1 ASRSm;
• 17: Output backdoor target class S; latent triggers ˆ δS

backdoor target class in advance. Without loss of generality, LCC is suitable for each category in the VFL classification task. More importantly, the method evaluates all categories individually to calculate the ASR for each category using Eq. (7). The category with the highest backdoor ASR is identified as the backdoor target class, and the corresponding latent triggers ˆ δ are obtained simultaneously.

Analysis of LCC for dirty-label and clean-label attacks. With the LCP method iteratively performed on each category, the data obtained by the defender consisted of two parts:

Feature Clustering Detection. Furthermore, as a binary classification task, the suspicious poisoned samples DLCP can be decomposed by the clustering algorithm. This is because the identified samples now contain at most two categories: clean samples and poisoned samples with triggers for the same ground truth category.

Specifically, we adopt the K-means clustering method to locate the poisoned samples with triggers. For the concatenated feature embeddings sent from passive parties H = [H1 ,H2 , · · · ,HK ], where H refers to the set of feature embeddings of suspicious poisoned data DLCP , the FCD method leverages the K-means clustering algorithm to obtain two clusters Cm τ ,m ∈ {0, 1}. The poisoning rate of backdoor attacks maintains a low level because they are typically constrained by limited adversary's knowledge. This means the number of poisoned samples is significantly smaller than that of clean samples. As a result, the FCD method identifies the cluster with fewer samples as the poisoned cluster, denoted as C S τ . Using the available validation dataset, the defender can then infer the backdoor triggers in the latent feature space. [Guo et al., 2023].

where ˆ δ denotes latent backdoor triggers with respect to η(x); Dτval refers to the subset of the validation dataset Dval with class τ ; E[·] represents the element-wise average operation.

Furthermore, the latent backdoor triggers ˆ δ can cause the benign samples to be incorrectly classified as the backdoor target class:

where ASRS τ represents the attack success rate for the category τ; I(·) denotes the indicator function; the data used in Eq.(7) consists of all samples in the validation set Dval , excluding those belonging to category τ , resulting in a total size of N¬τ; latent backdoor triggers ˆ δ is added to the concatenated feature embeddings H in an element-wise operation.

Remark 1. For the sake of illustration, the LCC method described above assumes the ground truth is the backdoor target τ. However, in practice, the defender does not know the clean samples correctly classified in each category and poisoned samples misclassified into the target class. Then, the FCD module utilizes K-means clustering to identify poisoned samples of the target class by iteratively evaluating all categories. The intuition is to treat the backdoor target class as ground truth and frame the problem as a binary classification task, using the clustering method to distinguish poisoned from clean samples. The feature embeddings of poisoned and clean samples for the backdoor target class inherently exhibit distinguishable inter-cluster distances, which K-means clustering exploits for binary classification.

In the case of clean-label backdoor attacks, poisoned and clean samples from the target class differ only in the backdoor triggers, which enlarge inter-cluster distances for clustering. Similarly, in dirty-label backdoor attacks, while the poisoned feature embeddings received by the defender exhibit a strong connection to the target class, they also retain intrinsic non-target features. These non-target features, combined with backdoor triggers, further amplify the inter-cluster distances between poisoned and clean samples. In essence, the inter-cluster distances can be interpreted as the backdoor triggers themselves. Using these generated backdoor triggers, along with the known validation set, the defender can reliably identify the backdoor target class. In fact, there are various clustering methods that can be employed in the LCC module, such as DBSCAN, etc., and we use K-means only because of its easy applicability to the binary classification task.

As outlined in Algorithm 1, after the VFL training process, the defender retains the labels and feature embeddings of the training dataset. The defender locally executes the LCC backdoor detection to identify the backdoor target class and its associated triggers. Specifically, the defender iteratively applies LCP and FCD modules to each category. By evaluating the ASR and the suspicious latent triggers for each category, the defender selects the category with the highest ASR as the backdoor target class and assigns the corresponding generated trigger as its associated triggers.

4.2 LP Backdoor Mitigation

The LCC detection method allows the defender to identify the backdoor target class and triggers. However, detection is insufficient as the backdoor has already been implanted into the model, threatening the VFL system. To address this issue, the UBD framework adopts a linear probing (LP) backdoor mitigation method to eliminate the backdoor in VFL.

We observed that for the backdoor target class, the clustering method in the embedded feature space could effectively separate poisoned samples from clean ones. However, in the output space, the top model predicts poisoned and clean samples as the target class, rendering them indistinguishable. In other words, top model parameters have a remarkable impact on the backdoor manipulation. Therefore, LP aims to finetune the top model parameters to remove the triggers' impact on poisoned samples.

With the identified backdoor target class and triggers, the defender can directly formulate the loss function to fine-tune the top model. In particular, the objective function can be formalized as:

where Nv denotes the number of samples in the validation dataset Dval; S refers to the identified backdoor target class of LCC backdoor detection; Hi represents concatenated feature embeddings of the i-th sample in the validation dataset Dval; λ1, λ2, λ3 and λ4 are hyperparameters to balance the loss function.

In Eq.(8), the first part of the loss function aims to constrain the top model parameters with the cross-entropy loss on clean samples to prevent deviation from the main task of VFL. The second part aims to eliminate the connection between backdoor triggers and the target class in the top model, while at the same time, the third part wants to re-establish the link between poisoned samples and their ground truth. The specific loss functions can be expressed respectively as [Zhu et al., 2024]:

where GS , Gy and Gk denote the probability of predicting concatenated feature embeddings H to label S, y and q by the active party G respectively. The latent triggers ˆ δ are added to concatenated feature embeddings H, etc.H ⊕ ˆ δ.

It is worth noting that Eq.(8) includes a regularization term RBN, which indicates that LP is based on the running statistics of the BN layer as prior constraints. This aims to reduce sensitivity to poisoned samples while enhancing the generalization of the main task by leveraging the stable statistics obtained during the BN training process, as expressed below:

where µl(H)and σ2 l (H) are the batch-wise mean and variance estimates of feature maps corresponding to the l-th layer of the top model. BNl(mean) and BNl(variance) represent the running mean and variance of the l-th batch normalization layer during training.

5 Experiments

In this section, we conduct comprehensive experiments to evaluate the effectiveness of the proposed UBD framework. Specifically, we first briefly illustrate the experiment setup. Then, we assess the UBD framework on the state-of-the-art dirty-label and clean-label backdoor attacks. In addition, we also introduce the defensive baseline of VFL to validate the superiority of the proposed backdoor defense approach. Finally, we implement an overall ablation study to analyze the UBD framework.

5.1 Experiment Setup

Datasets and Models. This section conducts extensive experiments on four datasets to evaluate the performance of the UBD framework: three image datasets, i.e. CIFAR10 [Krizhevsky et al., 2009; Li et al., 2024a], Imagenette [Howard and Gugger, 2020], CINIC-10 [Darlow et al., 2018] and one image-text multimodal dataset i.e. NUS-WIDE [Chua et al., 2009]. For CIFAR-10, CINIC-10 and Imagenette, we employed ResNet-18 as the model structure. For NUSWIDE, we adopt a 3-layer MLP as the VFL model. The feature extractor of ResNet-18 and the first two fully connected layers of MLP serve as the bottom models of passive parties in VFL. While the UBD framework supports multiple participants in VFL, we conducted experiments using a two-participant setting for simplicity, consistent with related works [Bai et al., 2023; Fu et al., 2022; Qiu et al., 2024]. The experiments randomly divide 5% from the training set as the validation set for the defender.

EvaluationMetrics. For a fair comparison, we evaluate the effectiveness of the backdoor defense in the UBD framework using Benign Accuracy (BA) and Attack Success Rate (ASR), following prior studies [Li et al., 2024b]. Additionally, we report TPR, FPR, and AUC metrics to assess the performance of the LCC method, consistent with related works [Guo et al., 2023; Mo et al., 2024].

Attack Baselines. We exploit two representative and advanced backdoor attacks to evaluate the UBD framework, including (1) a dirty-label backdoor attack: LRB [Zou et al., 2022], (2) a clean-label backdoor attack: VILLAIN [Bai et al., 2023]. To verify the defense performance of UBD, we adjusted the hyperparameters of the related work [Zou et al., 2022; Bai et al., 2023] to achieve the best attack performance. Specifically, we set the poisoning rate as 1% and 5% for LRB and VILLAIN respectively.

Defense Baselines. To evaluate the effectiveness of UBD, we compare it with two representative and advanced defense methods: DP-SGD [Wu et al., 2022; Bai et al., 2023] and BTI-DBF [Xu et al., 2024]. These methods represent the two primary defense categories outlined in Section 2: label protection and backdoor mitigation. The ratio of DP-SGD is set to 1.0 and the hyperparameters of BTI-DBF are configured following the original paper [Xu et al., 2024].

Training Details. The experiments are conducted with PyTorch with two NVIDIA 3090 GPU cards. Each experiment is repeated 5 times with random seeds. The hyperparameters λ1, λ2, λ3 and λ4 are set to 1, 0.1, 1, 1. We used Adam optimizer to train LP, with learning rates ranging from 0.001 to 0.1 for different datasets.

5.2 Experimental Results

Performance of UBD. We systematically compare the performance of the UBD framework with current mainstream defense methods under dirty-label and clean-label backdoor attacks. Tab.1 illustrates the results of comparison. In terms of ASR metric, the UBD framework almost achieves the best performance compared with DP-SGD and BTI-DBF, especially for CIFAR10, CINIC-10 and Imagenette datasets. For the NUS-WIDE dataset, the UBD method achieved the best performance under the VILLAIN attack. In contrast, under the LRB attack, the DP-SGD method outperformed UBD on the ASR metric, achieving a 2.15% lower ASR and a 4.26% variance advantage. However, considering the BA metric, DP-SGD's lower ASR comes at the cost of a significant BA loss, with a 13.17% decrease compared to the LRB attack baseline. This characteristic is consistent across other datasets, where reductions in ASR are accompanied by substantial losses in BA. This trade-off highlights the limitations of label protection methods such as DP-SGD. For BTI-DBF, the trigger generator can only be added at the intermediate layer of the VFL, as the defender lacks access to the passive party's input data and bottom model. The method's inability to synchronize fine-tuning with bottom models not only hinders its effectiveness in eliminating ASR but also adversely affects the BA metric.

Impact of LCC. To evaluate the effectiveness of the LCC module, the comparison results for the use of label consistency in the LCC module are presented in Tab. 2. The experimental results indicate that incorporating prediction ground truth consistency provides a notable advantage in detecting poisoned samples, particularly for the VILLAIN method. For instance, on the CINIC-10 dataset, the use of label consistency improves AUC performance for backdoor detection by 9.26%. It should be noted that, for the LRB approach, label consistency does not appear to provide a significant advantage, particularly on the CIFAR-10 and Imagenette datasets. This limitation may stem from a performance bottleneck in the BA metric. For instance, on the Imagenette dataset, LRB shows a 13.55% lower BA compared to VILLAIN. This disparity reduces the label consistency strategy's ability to identify sufficient suspicious poisoned samples, thereby impacting the backdoor detection performance of the LCC module. Nevertheless, label consistency successfully achieved effective backdoor detection across all four datasets.

Impact of BN. To demonstrate the effectiveness of the LP module, we present a comparison of results with and without BN statistics in Fig.2. The experimental results clearly show that incorporating BN parameters significantly mitigates or even eliminates backdoor effects. For instance, against the VILLAIN attack, the LP method effectively mitigates backdoor effects across all four datasets, achieving an ASR of no more than 6% on the CINIC-10 dataset while limiting BA performance degradation to within 4%.

Impact of poison rate. In Fig.3, we illustrate the impact of varying proportions of poisoned samples on the UBD framework, using the CINIC-10 dataset as an example. The results demonstrate that even with only 1% poisoned samples, UBD remains effective in defending against both dirty-label and clean-label backdoor attacks. For the VILLAIN attack, some variance in UBD performance is observed with 1% poisoned samples. Nonetheless, clean-label backdoor attacks like VILLAIN, which rely on label inference, typically can obtain a large number of poisoned pseudo samples to inject backdoors. Therefore, UBD remains effective and valuable in mitigating clean-label backdoor attacks.

6 Conclusion

This paper proposes a novel backdoor defense VFL framework called UBD, which integrates the LCC and LP modules to detect and mitigate backdoor attacks simultaneously. Specifically, the LCC module synthesizes latent triggers of the backdoor class with the label consistency strategy. Furthermore, the LP module combines the identified backdoor class and generated triggers to efficiently mitigate backdoors in the VFL system by leveraging the statistics of the BN layer, requiring only linear probing of the classifier header. Extensive experiments across multiple datasets demonstrate that UBD significantly outperforms state-of-the-art backdoor defense methods in terms of both model utility and backdoor elimination.

Acknowledgements

This work was supported by the Jiangsu Provincial Major Project on Basic Research of Cutting-edge and Leading Technologies, under grant no. BK20232032, and National Key Research and Development Program of China under grant (2022YFC3302300), Yangtze River Delta Science and Technology Innovation Community Joint Research Project under grant (YDZX20233100004031), National Natural Science Foundation of China under Grant (No. 61873309, No. 92046024, No. 92146002) and Shanghai Science and Technology Project under Grant (No. 22510761000).