MISA: Unveiling the Vulnerabilities in Split Federated Learning

$\mathit{\text{Federated}}\mathit{\text{learning}}$ (FL) and $\mathit{\text{split}}\mathit{\text{learning}}$ (SL) are prevailing distributed paradigms in recent years. They both enable shared global model training while keeping data localized on users’ devices. The former excels in parallel execution capabilities, while the latter enjoys low dependence on edge computing resources and strong privacy protection. $\mathit{\text{Split}}\mathit{\text{federated}}\mathit{\text{learning}}$ (SFL) combines the strengths of both FL and SL, making it one of the most popular distributed architectures. Furthermore, a recent study has claimed that SFL exhibits robustness against poisoning attacks, with a fivefold improvement compared to FL in terms of robustness. In this paper, we present a novel poisoning attack known as MISA. It poisons both the top and bottom models, causing a $\underset{‾}{\mathbf{\text{misa}}}$lignment in the global model, ultimately leading to a drastic accuracy collapse. This attack unveils the vulnerabilities in SFL, challenging the conventional belief that SFL is robust against poisoning attacks. Extensive experiments demonstrate that our proposed MISA poses a significant threat to the availability of SFL, underscoring the imperative for academia and industry to accord this matter due attention.