Paper deep dive
TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning
Yuhan Xie, Jingrong Huang, Chen Lyu
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Split Federated Learning (SFL) facilitates privacy-preserving collaborative training with reduced client-side overhead. However, its split architecture introduces unique attack surfaces, rendering it vulnerable to diverse poisoning attacks. Most existing defenses fail to exploit the split paradigm, limiting their ability to detect and contain malicious behaviors at an early stage. To bridge this gap, we propose Target-Oriented Feature Decoupling (TOFD), a unified framework that jointly enables proactive detection and robust optimization against a wide range of poisoning attacks. TOFD operates in three stages: (1) Target Inference, which identifies potential attack targets by refining class-wise safe zones via class-specific Margin Perturbation (MP); (2) Sample Purification, which adaptively filters poisoned smashed data using thresholds calibrated through cross-class min-max normalization of MP; and (3) Decoupling Optimization, which leverages an adversarial guidance model to capture attack-induced patterns and decouple their influence during optimization, thereby suppressing residual adversarial effects. We provide theoretical guarantees for the convergence of TOFD. Extensive experiments on five datasets demonstrate that TOFD consistently outperforms state-of-the-art defenses under diverse attack scenarios, achieving superior robustness with low computational overhead suitable for practical deployment.
Tags
Links
- Source: https://arxiv.org/abs/2608.07274v1
- Canonical: https://arxiv.org/abs/2608.07274v1
Trouble viewing inline? Open PDF directly →
Full Text
54,258 characters extracted from source content.
Expand or collapse full text
by TOFD: Target-Oriented Feature Decoupling against Poisoning Attacks in Split Federated Learning Yuhan Xie https://orcid.org/0009-0007-3301-0888 Shanghai University of Finance and EconomicsMoE Key Laboratory of Interdisciplinary Research of Computation and EconomicsShanghaiChina yhtse@stu.sufe.edu.cn , Jingrong Huang https://orcid.org/0009-0009-4694-1344 Shanghai University of Finance and EconomicsShanghaiChina jingrhuang@stu.sufe.edu.cn and Chen Lyu https://orcid.org/0000-0002-4373-9898 Shanghai University of Finance and EconomicsMoE Key Laboratory of Interdisciplinary Research of Computation and EconomicsShanghaiChina lyu.chen@mail.shufe.edu.cn (2026) Abstract. Split Federated Learning (SFL) facilitates privacy-preserving collaborative training with reduced client-side overhead. However, its split architecture introduces unique attack surfaces, rendering it vulnerable to diverse poisoning attacks. Most existing defenses fail to exploit the split paradigm, limiting their ability to detect and contain malicious behaviors at an early stage. To bridge this gap, we propose Target-Oriented Feature Decoupling (TOFD), a unified framework that jointly enables proactive detection and robust optimization against a wide range of poisoning attacks. TOFD operates in three stages: (1) Target Inference, which identifies potential attack targets by refining class-wise safe zones via class-specific Margin Perturbation (MP); (2) Sample Purification, which adaptively filters poisoned smashed data using thresholds calibrated through cross-class min–max normalization of MP; and (3) Decoupling Optimization, which leverages an adversarial guidance model to capture attack-induced patterns and decouple their influence during optimization, thereby suppressing residual adversarial effects. We provide theoretical guarantees for the convergence of TOFD. Extensive experiments on five datasets demonstrate that TOFD consistently outperforms state-of-the-art defenses under diverse attack scenarios, achieving superior robustness with low computational overhead suitable for practical deployment. Split Federated Learning, Poisoning Defense, Feature Decoupling †copyright: acmlicensed†journalyear: 2026†copyright: c†doi: 10.1145/3767308.3835033†conference: Proceedings of the 34th ACM International Conference on Multimedia; November 10–14, 2026; Rio de Janeiro, Brazil.†isbn: 979-8-4007-2213-4/2026/11†ccs: Security and privacy Distributed systems security 1. Introduction Figure 1. Motivation: Illustration of poisoning defense challenges in SFL and the intuition behind TOFD. Split Federated Learning (SFL) (Thapa et al., 2022; Li et al., 2024b) enables collaborative training on decentralized data by combining the strengths of Federated Learning (FL) (Yazdinejad et al., 2024) and Split Learning (SL) (Lin et al., 2024). This paradigm preserves data privacy while significantly reducing the computational burden on resource-constrained clients. Specifically, SFL partitions the global model into client and server components. Clients execute the initial forward pass and transmit intermediate representations, known as smashed data, to the server. The server then completes the remaining computations and propagates gradients back to facilitate local updates. Finally, a dual-aggregation mechanism is employed to coordinate the system: the fed server aggregates client-side components, while the main server aggregates server-side components. Despite its promise as a computationally efficient and privacy-preserving paradigm (Xie et al., 2026), SFL is inherently susceptible to diverse poisoning attacks (Sandeepa et al., 2024; Wu et al., 2024). This vulnerability primarily stems from its partitioned and collaborative training architecture, exposing multiple attack surfaces throughout the learning pipeline (Xie and Lyu, 2026). Hence, by exploiting these attack surfaces, attackers can strategically manipulate various segments of the training process, including local feature representations (Li et al., 2025), labels (Jha et al., 2023; Jiang and Zhang, 2025), smashed data (Wu et al., 2024), and client-side model weights (Fang et al., 2020; Yazdinejad et al., 2024). Such multifaceted interventions facilitate the injection of destructive signals into the training process, thereby undermining aggregation and ultimately degrading global model performance. To defend against poisoning attacks in SFL, most existing countermeasures (Yin et al., 2018; Guerraoui et al., 2018; Cao et al., 2020; Wu et al., 2024; Li et al., 2024a; Kumar et al., 2025) primarily adapt defense strategies originally designed for conventional FL. However, these methods offer limited efficacy in practice, as they fail to exploit SFL’s partitioned architecture for early-stage intervention. This limitation largely arises from overlooking the pivotal role of smashed data (Xie et al., 2026). Unlike standard FL, server-side optimization in SFL is explicitly dependent on client-transmitted smashed data, which serves as the primary conduit through which poisoning signals propagate across training stages (Li et al., 2024b). We argue that this dependency, while increasing vulnerability, simultaneously introduces a unique defensive opportunity. Since diverse adversarial perturbations from any source tend to manifest as anomalies in this intermediate representation, intercepting these signals prior to server-side computation establishes a strategic checkpoint capable of alleviating a wide spectrum of poisoning attacks. This insight naturally raises a fundamental question: how to reliably identify poisoned smashed data and prevent it from compromising server-side optimization in SFL? In practice, effectively realizing this defensive opportunity in SFL faces several challenges. First, the training process involves frequent transmission of smashed data, which incurs substantial communication and detection overhead, thereby necessitating lightweight and low-cost defense mechanisms (Wu et al., 2024). Second, in dynamic SFL systems, the presence of benign non-IID clients alongside malicious ones leads to complex distributional shifts, making it difficult to distinguish non-IID behavior from adversarial manipulation and increasing the risk of misdetection (Krauß and Dmitrienko, 2023; Xie et al., 2024). Third, even when poisoned smashed data are filtered, malicious client-side models may still contaminate SFL optimization through aggregation, necessitating system-level mitigation of residual adversarial effects. Based on the outlined challenges, Figure 1 illustrates the corresponding design insights that guided our framework development. Building upon these insights, we propose Target-Oriented Feature Decoupling (TOFD), a unified defense framework that synergizes early-stage detection with server-side optimization to counter a broad spectrum of poisoning attacks in SFL. TOFD is built upon three complementary pillars. First, TOFD leverages class-wise inference to localize potential attack targets, thereby enabling low-overhead detection. By narrowing the scope to suspicious classes, the framework establishes client-level safe zones, which are further refined via Margin Perturbation (MP) to effectively disentangle adversarial behavior from benign non-IID variation. Second, TOFD adopts fine-grained, class-aware sample filtering to mitigate poisoning effects while preserving data diversity. Rather than discarding entire clients, the framework selectively prunes anomalous samples within identified target classes using thresholds calibrated via min–max normalization of the MP (Arp et al., 2022). Consequently, only retained benign representations are utilized to update global distributions and optimize the server-side model. Third, to address residual adversarial influence that may persist beyond detection, TOFD integrates a decoupling objective into the SFL optimization. Specifically, an adversarial guidance model is developed to capture attack-induced patterns from malicious data, allowing the server to suppress adversarial representations while preserving benign feature integrity. Once converged, the adversarial guidance model serves as a stable, plug-and-play component for SFL optimization. Our main contributions can be summarized as follows: • We propose TOFD, the first framework to systematically integrate fine-grained detection with SFL optimization, enabling effective mitigation of a wide range of poisoning attacks, including data, weight, smashed, label, and multi-vector poisoning. • By leveraging class-wise inference and MP, TOFD disentangles malicious behavior from benign non-IID variations while preserving data diversity. Furthermore, an adversarial guidance–based decoupling strategy is developed to suppress residual attack influence. • We provide a formal theoretical analysis of TOFD, characterizing its computational complexity and establishing convergence guarantees. • Extensive experiments across five benchmarks and diverse model architectures demonstrate that TOFD consistently outperforms state-of-the-art defenses in both robustness and efficiency, even under extreme data heterogeneity. Figure 2. The framework of TOFD. After the smashed data are transmitted to the server, TOFD first constructs an initial class-wise safe zone using a modified Z-score and then refines it by evaluating the Distributional Consistency Score (DCS) against the MP threshold. Clients that fall outside the safe zone are inferred to be attacking the corresponding class. For the identified target classes, poisoned samples are filtered using an adaptive threshold τk _k, yielding validated benign sets i,k+Z_i,k^+ and detected malicious sets i,k−Z_i,k^- for each client cic_i. An adversarial guidance model trained on ⋃i,ki,k− _i,kZ^-_i,k is incorporated into the SFL system to decouple residual adversarial influence through a joint loss. Finally, the updated client- and server-side models are aggregated by the fed server and main server, respectively, completing the defense and optimization process. 2. Related Work 2.1. Defenses in Split Federated Learning Existing defenses for SFL can be broadly categorized into model validation and data validation approaches. Model validation strategies mitigate adversarial influence by scrutinizing the integrity of model updates. Classical Byzantine-resilient methods, such as Krum (Blanchard et al., 2017), Trimmed Mean (Yin et al., 2018), and Bulyan (Guerraoui et al., 2018), employ geometric or order-based statistics to suppress outlier updates. Building on these, FLTrust (Cao et al., 2020) incorporates a small trusted dataset on the server side to assign trust scores and normalize update magnitudes, thereby bounding the impact of malicious contributions. In contrast, data validation strategies seek to evaluate the reliability of client data. FedBary (Li et al., 2024a) treats client valuation as a Wasserstein barycenter problem, quantifying distributional discrepancies to enable contribution-aware aggregation. Similarly, FAVD (Kumar et al., 2025) implements a privacy-preserving mechanism to assess client-side data quality through density comparisons. However, most existing approaches remain extensions of conventional FL and are not explicitly tailored to the SFL architecture, where split-model optimization introduces unique and vulnerable attack surfaces (Wu et al., 2024). While HealSplit (Xie and Lyu, 2026) represents a pioneering effort specifically designed for SFL via multi-teacher adversarial distillation, its reliance on generative modeling and exhaustive inspection incurs substantial computational overhead. This limitation underscores the need for more efficient and architecture-aware defense mechanisms in SFL. 2.2. Defenses in FL under Data Heterogeneity Defending FL under data heterogeneity requires a delicate balance between filtering malicious updates and preserving the benign contributions of diverse clients. Recent studies address this challenge through various perspectives. PRFL (Yuan et al., 2025) introduces a defense-oriented personalized framework that suppresses malicious participants via similarity-based trust modeling and adaptive knowledge sharing. FedREDefense (Xie et al., 2024) leverages distilled local knowledge to distinguish genuine training dynamics from poisoning-induced deviations. Furthermore, FDCR (Huang et al., 2024) enhances backdoor robustness in heterogeneous settings by detecting malicious clients through parameter importance and gradient discrepancies, subsequently rescaling critical updates during aggregation. Despite their effectiveness, these defenses are often specialized for individual attack types (e.g., either data or model poisoning) and struggle to maintain efficacy in more complex adversarial scenarios involving composite poisoning attacks. 3. Background 3.1. Problem Setup Let the SFL system consist of N clients =cii=1NC=\c_i\_i=1^N, comprising benign clients benC_ben and malicious clients att=∖benC_att=C _ben. Each client cic_i holds a private dataset i=itr∪ite∼iD_i=D_i^tr _i^te _i containing K classes, where itrD_i^tr and iteD_i^te denote local training and test sets, and iP_i represents the local data distribution. At each communication round t, the client-side model gθcig_ _c_i maps a local mini-batch of inputs xjj=1B\x_j\_j=1^B into smashed data zjj=1B\z_j\_j=1^B, which are transmitted with their corresponding labels yjj=1B\y_j\_j=1^B to the server-side model hθsih_ _s_i for forward computation. The resulting gradients are back-propagated to update the client-side parameters θci _c_i. Subsequently, client-side parameters θcii=1N\ _c_i\_i=1^N and server-side parameters θsii=1N\ _s_i\_i=1^N are aggregated by the fed server and the main server, respectively, yielding the global model fθ=gθc∘hθsf_θ=g_ _c h_ _s. Defender Objective. The first objective is to accurately identify malicious smashed data, measured by the Malicious Sample Detection Rate (MSDR): (1) MSDR=1|ℳ|∑z∈ℳmal(z),MSDR= 1|M| _z I_mal(z), where ℳM denotes the set of malicious smashed data, and mal(z)I_mal(z) is an indicator function. The second objective is to achieve robustness against diverse poisoning attacks while maintaining clean performance: (2) minθ(x,y)∼te[ℓ(fθ(x),y)]+μℛrobust(θ), _θE_(x,y) ^te [ (f_θ(x),y) ]+ _robust(θ), where ℓ(⋅,⋅) (·,·) is a task-specific loss function, ℛrobust(θ)R_robust(θ) measures the sensitivity to attacks, and μ weights the robustness regularization. 3.2. Threat Model In SFL, malicious clients with heterogeneous knowledge may inject perturbations at different stages of the training workflow, giving rise to a broad spectrum of poisoning threats, which are categorized into five representative attack types: Data Poisoning (DP, O1O_1): The local dataset is manipulated as k′=(xj+δx,yj)j=1m′D_k =\(x_j+ _x,y_j)\_j=1^m , where δx _x is the input perturbation. Weight Poisoning (WP, O2O_2): The model parameters are manipulated before aggregation as θ′=θ+Δθ =θ+ _θ, where Δθ _θ represents the weight perturbation. Smashed Poisoning (SP, O3O_3): The smashed dataset is manipulated as k′=zj+δzj=1m′Z_k =\z_j+ _z\_j=1^m , where δz _z is the applied perturbation. Label Poisoning (LP, O4O_4): The label set is manipulated as k′=(yj+δy)modKj=1m′Y_k =\(y_j+ _y) K\_j=1^m , where δy _y is the label shift. Multi-Vector Poisoning: Multiple attack strategies may be applied simultaneously: Omulti=⋃i=14iOi,i∈0,1O_multi= _i=1^4I_iO_i,\,I_i∈\0,1\, where iI_i indicates whether the i-th attack is applied. 4. Methodology In this section, we introduce the details of TOFD for defending SFL. TOFD integrates detection and optimization in a three-stage pipeline: it first infers the attack target classes of malicious clients, then filters poisoned samples within the inferred classes, and finally suppresses residual adversarial influence. Figure 2 illustrates the overall framework. 4.1. Class-Wise Attack Target Inference Table 1. Comprehensive overview of the default experimental setup. !15 Dataset Total Clients Non-IID parameter κ Model Total Epochs Batch Size Attack Settings Other Settings HAM10k (Tschandl et al., 2018) 64 0.1, 0.5, 0.3, 1 (Default), 5 DenseNet121 200 64 Malicious ratio = 20%, Coordinate updates = 3×1043× 10^4, Attack learning rate = 1×10−21× 10^-2, Image update rate = 1×1041× 10^4 SFL learning rate = 1×10−41× 10^-4, ρ=0.6745ρ=0.6745, Dataset (MNIST), λ,β=0.2λ,β=0.2, Attack method (DP+SP), Adversarial guidance model (Server-side model) MNIST (LeCun et al., 1998) 100 ResNet18 300 128 F-MNIST (Xiao et al., 2017) 100 ResNet18 300 128 CIFAR10 (Krizhevsky et al., 2009) 100 ResNet18 300 128 CIFAR100 (Krizhevsky et al., 2009) 64 ResNet50 200 128 At communication round t, each client cic_i transmits a batch of smashed data, where the subset corresponding to class k is denoted by ℬi,k(t)B_i,k^(t). Definition 1 (Empirical Gaussian Modeling). Given a smashed dataset =zjj=1nZ=\z_j\_j=1^n, the empirical Gaussian modeling operator (⋅)G(·) maps Z to a diagonal Gaussian distribution (μ,Σ)N(μ, ), whose parameters are estimated as μ=1n∑j=1nϕ(zj),Σ=(1n∑j=1n(ϕ(zj)−μ)(ϕ(zj)−μ)⊤),μ= 1n _j=1^nφ(z_j), =D ( 1n _j=1^n(φ(z_j)-μ)(φ(z_j)-μ) ), where ϕ(⋅)φ(·) maps samples into a low-dimensional space and (⋅)D(·) extracts the diagonal elements. According to Definition 1, the class-k feature distribution of client cic_i is given by i,k(t)=(ℬi,k(t))P_i,k^(t)=G(B_i,k^(t)). 4.1.1. Initial Class-Wise Safe Zone Construction To establish a class-wise safe zone for benign clients, we first measure the distance between the local distribution i,k(t)P_i,k^(t) and the historical global distribution G,k(t−1)P_G,k^(t-1), which is maintained using identified clean smashed data: (3) i,k(t)=dist(i,k(t),G,k(t−1)).W_i,k^(t)=dist (P_i,k^(t),\,P_G,k^(t-1) ). where dist(⋅,⋅)dist(·,·) denotes the 2-Wasserstein distance. Based on these distances, the initial safe zone k(t)C_k^(t), consisting of high-confidence benign clients, is constructed via the modified Z-score: (4) k(t)=ci∈:i,k(t)−Mk(t)MADk(t)/ρ≤3σ.C_k^(t)=\c_i : W_i,k^(t)-M_k^(t)MAD_k^(t)/ρ≤ 3σ\. where ρ is a constant set to 0.6745, as recommended in (Iglewicz and Hoaglin, 1993), Mk(t)M_k^(t) and MADk(t)MAD_k^(t) denote the median and median absolute deviation of i,k(t)ci∈\W_i,k^(t)\_c_i , respectively. Clients that fall outside k(t)C_k^(t) form the set of suspicious clients, denoted as ~k(t) C_k^(t). 4.1.2. Distributional Consistency Verification Practical SFL systems exhibit inherently heterogeneous data, which complicates the reliable detection of malicious participants. To further identify malicious clients within the suspicious client set, we propose a distributional consistency verification mechanism that distinguishes adversarial behavior from benign non-IID variations. Definition 2 (Distributional Consistency). Let (,k)=zj∣zj∈ℬi,k(t),ci∈Z(S,k)=\z_j z_j _i,k^(t),\,c_i \ denote the class-k features of clients in S. Given two client sets 1S_1 and 2S_2, the distributional consistency of class k between them is quantified as (5) Δ(1,2,k)=dist(((1,k)),((2,k))), (S_1,S_2,k)=dist (G(Z(S_1,k)),\,G(Z(S_2,k)) ), Based on Definition 2, the impact of each suspicious client ci∈~k(t)c_i∈ C^(t)_k on the class-wise safe zone k(t)C_k^(t) is measured by the induced distributional shift, formalized as the Distributional Consistency Score: (6) DCSi,k(t)=Δ(k(t),k(t)∪ci,k).DCS_i,k^(t)= (C_k^(t),\,C_k^(t)∪\c_i\\,,k ). To capture the intrinsic dispersion of class-k features within the safe zone, we define the MP as a threshold quantifying the permissible deviations in the benign distribution: (7) MPk(t)=maxci∈k(t)Δ(k(t),k(t)∖ci,k),MP_k^(t)= _c_i _k^(t) (C_k^(t),\,C_k^(t) \c_i\,\,k ), Suspicious clients whose scores fall within the MPk(t)MP_k^(t) are regarded as benign and retained within the safe zone: (8) k(t)←k(t)∪ci∈~k(t):DCSi,k(t)≤MPk(t).C_k^(t) _k^(t)∪\c_i∈ C^(t)_k:DCS^(t)_i,k _k^(t)\. Clients excluded from k(t)C_k^(t) are thus identified as malicious and inferred to be targeting class k. 4.2. Class-Calibrated Sample Purification Although the first stage identifies class-wise attack targets, directly discarding all samples from these classes would severely reduce data diversity and consequently degrade model performance. To balance robustness and data utility, we perform fine-grained purification that selectively removes poisoned samples within the identified target classes. For each sample zjz_j within the identified target class k, we quantify its deviation from the corresponding global class-k distribution G,k(t−1)P_G,k^(t-1) as: (9) Dk(zj)=(ϕ(zj)−μG,k(t−1))⊤(ΣG,k(t−1))−1(ϕ(zj)−μG,k(t−1)).D_k(z_j)=(φ(z_j)- _G,k^(t-1)) ( _G,k^(t-1))^-1(φ(z_j)- _G,k^(t-1)). Existing methods typically rely on a single global threshold to identify anomalous samples (Arp et al., 2022; Ding et al., 2025). However, such thresholds fail to capture class-wise variations in feature dispersion, which can lead to misclassification. To address this limitation, we introduce a class-calibrated threshold that dynamically adjusts according to the class-wise dispersion measured by MPk(t)MP_k^(t): (10) τk(t)=Q3,k(t)+(1+MPk(t)−MPmin(t)MPmax(t)−MPmin(t))IQRk(t), _k^(t)=Q^(t)_3,k+ (1+ MP^(t)_k-MP^(t)_ MP^(t)_ -MP^(t)_ )\,IQR^(t)_k, where MPmin(t)=minkMPk(t)MP_ ^(t)= _kMP_k^(t), MPmax(t)=maxkMPk(t)MP_ ^(t)= _kMP_k^(t), Q3,k(t)Q^(t)_3,k and IQRk(t)IQR^(t)_k denote the third quartile and interquartile range of the benign distances Dk(zj)∣zj∈ℬi,k(t),ci∈k(t)\D_k(z_j) z_j _i,k^(t),c_i _k^(t)\. For benign clients ci∈k(t)c_i _k^(t), all class-k smashed data are considered benign: i,k+=ℬi,k(t)Z_i,k^+=B_i,k^(t). For malicious clients ci∉k(t)c_i _k^(t), the class-k samples are partitioned using the threshold τk(t) _k^(t) into a benign set i,k+=zj∈ℬi,k(t)∣Dk(zj)≤τk(t)Z_i,k^+=\z_j _i,k^(t) D_k(z_j)≤ _k^(t)\ and a malicious set i,k−=zj∈ℬi,k(t)∣Dk(zj)>τk(t)Z_i,k^-=\z_j _i,k^(t) D_k(z_j)> _k^(t)\. Based on the validated benign set k+=⋃i,k+Z^+_k= _iZ_i,k^+, we estimate a round-wise empirical distribution ^k(t)=(k+) P_k^(t)=G(Z^+_k), which is then used to update the global distribution: (11) G,k(t)=(1−β)G,k(t−1)+β^k(t),P_G,k^(t)=(1-β)P_G,k^(t-1)+β P_k^(t), where β is the exponential moving average coefficient. 4.3. Malicious Feature Decoupling Table 2. Performance comparison of TOFD against baselines on the MNIST dataset under Uniform and Non-IID settings (κ=1κ=1). The upper block reports accuracy (ACC ↑ ), while the lower block presents poisoning impact (U ↓ ). Bold and underlined numbers indicate the best and second-best results, respectively. DP WP SP LP DP+SP WP+SP LP+SP Method Uniform NIID Uniform NIID Uniform NIID Uniform NIID Uniform NIID Uniform NIID Uniform NIID Accuracy (ACC ↑ ) FedAvg (McMahan et al., 2017) 10.73 10.29 18.56 16.21 91.87 74.95 60.02 48.53 10.69 10.66 65.72 56.27 43.01 29.34 Trim-Mean (Yin et al., 2018) 10.28 10.03 38.31 32.76 92.59 86.99 55.43 49.90 10.43 10.25 65.68 59.40 40.12 39.60 Median (Yin et al., 2018) 88.85 85.14 89.34 85.69 75.13 64.21 83.00 87.78 75.94 72.94 74.74 69.88 76.34 75.22 Sparsefed (Panda et al., 2022) 10.65 10.19 32.44 14.80 61.33 42.77 62.54 53.98 10.89 10.51 62.20 52.30 31.93 20.08 Krum (Blanchard et al., 2017) 91.96 87.15 91.83 84.03 77.91 64.61 89.80 86.44 78.90 72.90 84.29 72.91 78.45 73.63 Bulyan (Guerraoui et al., 2018) 10.33 10.45 18.89 16.36 91.71 84.73 59.29 47.14 10.99 10.44 66.98 60.51 47.20 43.21 FLTrust (Cao et al., 2020) 11.01 9.97 71.59 61.92 30.09 11.55 69.39 43.07 10.84 9.96 63.57 54.55 15.54 11.92 DnC (Shejwalkar and Houmansadr, 2021) 11.48 10.21 91.04 87.84 79.04 67.89 66.50 50.45 10.62 11.23 91.30 86.89 76.51 67.00 ShieldFL (Ma et al., 2022) 11.29 10.78 92.93 90.28 69.10 55.52 70.54 67.61 11.36 11.14 92.56 86.74 66.96 59.47 PRFL (Yuan et al., 2025) 89.82 85.19 90.89 83.09 78.60 72.88 90.95 86.20 78.67 74.21 83.05 67.07 77.74 71.74 FAVD (Kumar et al., 2025) 10.47 10.46 82.93 75.11 84.49 73.57 64.47 49.17 11.12 9.71 88.54 55.74 64.51 61.47 HealSplit (Xie and Lyu, 2026) 91.28 88.15 91.86 86.27 93.59 80.86 67.17 54.56 80.34 75.11 88.19 81.16 49.53 36.14 TOFD 92.92 90.08 93.95 91.33 95.35 92.09 92.69 89.95 85.81 81.79 93.35 88.02 83.70 80.48 Poisoning Impact (U ↓ ) FedAvg (McMahan et al., 2017) 84.85 83.34 77.02 77.42 3.71 18.68 35.56 45.10 84.89 82.97 29.86 37.36 52.57 64.29 Trim-Mean (Yin et al., 2018) 85.54 85.15 57.51 62.42 3.23 8.19 40.39 45.28 85.39 84.93 30.14 35.78 55.70 55.58 Median (Yin et al., 2018) 3.46 6.38 2.97 5.83 17.18 27.31 9.31 3.74 16.37 18.58 17.57 21.64 15.97 16.30 Sparsefed (Panda et al., 2022) 84.06 66.86 62.27 62.25 33.38 34.28 32.17 23.07 83.82 66.54 32.51 24.75 62.78 56.97 Krum (Blanchard et al., 2017) 1.96 1.06 2.09 4.18 16.01 23.60 4.12 1.77 15.02 15.31 9.63 15.30 15.47 14.58 Bulyan (Guerraoui et al., 2018) 85.31 83.16 76.75 77.25 3.93 8.88 36.35 46.47 84.65 83.17 28.66 33.10 48.44 50.40 FLTrust (Cao et al., 2020) 84.93 83.55 24.35 31.60 65.85 81.97 26.55 50.45 85.10 83.56 32.37 38.97 80.40 81.60 DnC (Shejwalkar and Houmansadr, 2021) 83.43 82.04 3.87 4.41 15.87 24.36 28.41 41.80 84.29 81.02 3.61 5.36 18.40 25.25 ShieldFL (Ma et al., 2022) 83.99 81.66 2.35 2.16 26.18 36.92 24.74 24.83 83.92 81.30 2.72 5.70 28.32 32.97 PRFL (Yuan et al., 2025) 4.06 3.66 2.99 5.76 15.28 15.97 2.93 2.65 15.21 14.64 10.83 21.78 16.14 17.11 FAVD (Kumar et al., 2025) 84.42 78.22 11.96 13.57 10.40 15.11 30.42 39.51 83.77 78.97 6.35 32.94 30.38 27.21 HealSplit (Xie and Lyu, 2026) 4.22 5.13 3.64 7.01 1.91 12.42 28.33 38.72 15.16 18.17 7.31 12.12 45.97 57.14 TOFD 3.10 2.40 2.07 1.15 0.67 0.39 3.33 2.53 10.21 10.69 2.67 4.46 12.32 12.00 Despite effective filtering of smashed data, client-side models trained under adversarial control can still introduce malicious patterns into the global model through aggregation. To mitigate these residual effects, we propose a decoupling mechanism for adversarial features. Specifically, an adversarial guidance model ℛR, with the same architecture as the server-side model hθsh_ _s, is fine-tuned on the detected malicious smashed data −=⋃i,ki,k−Z^-= _i,kZ^-_i,k in each communication round to capture attack-induced patterns. After convergence, ℛR serves as a stable module across rounds. To enforce decoupling, the server-side model hθsih_ _s_i is encouraged to diverge from ℛR by maximizing the predictive discrepancy on −Z^-, yielding the following objective: (12) ℒMFD=−1|−|∑z∈−KL(f(z;ℛ)∥f(z;hθsi)),L_MFD=- 1|Z^-| _z∈Z^-KL (f(z;R)\; \|\;f(z;h_ _s_i) ), where KLKL denotes the Kullback–Leibler divergence, and f(⋅;⋅)f(·;·) represents the softmax output of the model. The server-side model of client cic_i is trained on the validated benign smashed data using the cross-entropy loss: (13) ℒCE=1|⋃ki,k+|∑k=1K∑z∈i,k+−y(k)⊤logf(z;hθsi).L_CE= 1| _kZ_i,k^+| _k=1^K _z _i,k^+-y_(k) f(z;h_ _s_i). where y(k)y_(k) is the one-hot label vector for class k. The overall optimization objective for each participating client combines task supervision with adversarial decoupling: (14) ℒtotal=ℒCE+λℒMFD,L_total=L_CE+λ\,L_MFD, where λ balances task performance with suppression of residual adversarial influence. 5. Theoretical Analysis of TOFD In this section, we present the analysis of the time complexity and convergence guarantees of TOFD, with detailed proofs deferred to Appendix A. Assumption 1. Lipschitz Smoothness. The gradient ∇θℓ(θ,z) _θ (θ,z) is LzL_z-Lipschitz with respect to the smashed data z, i.e, ‖∇θℓ(θ,z1)−∇θℓ(θ,z2)‖≤Lz‖z1−z2‖\| _θ (θ,z_1)- _θ (θ,z_2)\|≤ L_z\|z_1-z_2\| Algorithm 1 Framework of TOFD 1: Input: current round t, number of classes K, Clients C, smashed data ℬi,k(t)i=1,j=1N,K\B_i,k^(t)\_i=1,j=1^N,K, and parameters λ,βλ,β 2: for each class k∈1,…,Kk∈\1,…,K\ do 3: Initialize malicious set i,k−←∅Z_i,k^-← , benign set i,k+←∅Z_i,k^+← for each participating clients 4: for each client ci∈c_i do 5: Calculate distribution distance i,k(t)W_i,k^(t) using Eq.(3) 6: end for 7: Construct initial safe zone k(t)C_k^(t) based on i,k(t)ci∈\W_i,k^(t)\_c_i 8: Compute MPk(t)MP_k^(t) using k(t)C_k^(t) via Eq.(7) 9: for each suspicious client ci∉k(t)c_i _k^(t) do 10: if DCSi,k(t)≤MPk(t)DCS_i,k^(t) _k^(t) then add cic_i to k(t)C_k^(t) 11: end for 12: for each zj∈ℬi,k(t)z_j _i,k^(t) where ci∉k(t)c_i _k^(t) do 13: if Dk(zj)>τk(t)D_k(z_j)> _k^(t) then add zjz_j to i,k−Z_i,k^- 14: end for 15: Set i,k+←ℬi,k(t)∖i,k−Z_i,k^+ _i,k^(t) _i,k^- 16: Update G,k(t)P_G,k^(t) using k+=⋃i,k+Z_k^+= _iZ_i,k^+ via Eq.(11) 17: end for 18: Fine-tune model ℛR on −=⋃i,ki,k−Z^-= _i,kZ_i,k^- 19: for client cic_i in C do 20: Optimize SFL on i+=⋃ki,k+Z_i^+= _kZ_i,k^+ using ℛR and ℒtotalL_total 21: end for 22: return Aggregated global model fθf_θ Assumption 2. Reconstruction Error. Let ψ(⋅)ψ(·) denote an operator that maps compressed smashed data back to the original feature space. For benign smashed data z+z^+, the reconstruction error satisfies |z+−ψ(ϕ(z+))|≤σsp|z^+-ψ(φ(z^+))|≤ _sp. Assumption 3. Representation Covariance. For each class k, let Σk(t) _k^(t) denote the covariance matrix of compressed benign smashed data at round t. We assume suptλmax(Σk(t))≤Λk<∞. _t _ \! ( _k^(t) )≤ _k<∞. Assumption 4. Discard-Induced Deviation. Let δ denote the mean deviation induced by discarding benign samples whose distance exceeds τk _k. We assume that limτk→∞δ=0. _ _k→∞δ=0. Lemma 0 (Time-Complexity Analysis). The time complexity of each server-side training step is (|itr|⋅T⋅Np)O(|D^tr_i|· T· N_p), where NpN_p is the number of model parameters. TOFD introduces an additional cost of (|−|⋅Tℛ⋅Np)O(|Z^-|· T_R· N_p), where TℛT_R denotes the number of training rounds for ℛR. In typical SFL settings, the additional overhead is negligible because |−|≪|itr||Z^-| |D_i^tr| and Tℛ≪T_R T. Lemma 0 (Bounded Gradient Bias). Let α∈[0,1)α∈[0,1) denote an upper bound on the fraction of undetected malicious samples, and let S denote the compressed dimension of the smashed data after applying ϕ(⋅)φ(·) during detection. Under assumptions 1 to 4, the gradient bias satisfies: ‖bt‖≤ε:=maxkSLz(SΛk+δ+11−ατkΛk)+4Lzσsp,\|b_t\|≤ := _k SL_z ( S _k+δ+ 11-α\, _k _k )+4L_z _sp, Building on Lemma 2 and assumptions, the following convergence guarantee is established for TOFD. Theorem 3 (Convergence of TOFD). With stepsize η=(1/T)η=O(1/ T), the iterates θtt=0T−1\ _t\_t=0^T-1 produced by TOFD satisfy 1T∑t=0T−1‖∇Q(θt)‖2≤(1T)+(ε2). 1T _t=0^T-1E\|∇ Q( _t)\|^2 \! ( 1 T )+O\! ( ^2 ). 6. Evaluation Figure 3. Comparison of accuracy and time cost. Figure 4. Comparison of metric U↓U across datasets for different defense strategies under various attacks. Figure 5. Performance under different Non-IID degrees (κ). Figure 6. Comparison of MSDR under different Non-IID degrees (κ). Figure 7. Performance under different hyperparameters (β and λ). 6.1. Experiment Setup Datasets and Baselines: TOFD is evaluated on five image classification benchmarks: MNIST (LeCun et al., 1998), Fashion-MNIST (Xiao et al., 2017), HAM10k (Tschandl et al., 2018), CIFAR10 (Krizhevsky et al., 2009), and CIFAR-100. To simulate realistic SFL scenarios, client data are partitioned in a non-IID manner according to a Dirichlet distribution Dir(κ)Dir(κ), with smaller values of κ corresponding to higher data heterogeneity. Experiments are performed using three widely adopted backbone architectures: DenseNet121 (Huang et al., 2017), ResNet-18 (He et al., 2016), and ResNet-50. To assess TOFD’s robustness, we evaluate individual attack strategies including DP, WP, SP, and LP, as well as more complex combinations such as DP + SP, WP + SP, and LP + SP. TOFD is then compared with a diverse set of state-of-the-art defense methods, including FedAvg (McMahan et al., 2017), Trimmed-Mean, Median, SparseFed (Panda et al., 2022), Krum (Blanchard et al., 2017), Bulyan (Guerraoui et al., 2018), FLTrust (Cao et al., 2020), DnC (Shejwalkar and Houmansadr, 2021), ShieldFL (Ma et al., 2022), PRFL (Yuan et al., 2025), FAVD (Kumar et al., 2025), and HealSplit (Xie and Lyu, 2026) . Settings and Metrics To simulate realistic SFL systems, we vary the experimental settings by adjusting key factors such as dataset, model architecture, and data heterogeneity. A summary of the default configurations used in our experiments is provided in Table 1. All experiments were conducted on an NVIDIA A100 GPU. The experimental results are evaluated using four metrics: test accuracy A, which reflects the defense performance; the poisoning impact U=∗−U=A^*-A, ∗A^* measuring the performance degradation caused by poisoning attacks in the presence of the defense, where ∗A^* denotes the accuracy without attacks; MSDR, which measures the rate of detected malicious smashed data; and time cost, which quantifies the computational overhead of the defense mechanism. 6.2. Evaluation Results 6.2.1. Robustness under Diverse Attacks. Our first set of experiments evaluates TOFD under various poisoning attacks in both IID and non-IID settings. Table 2 reports the test accuracy and poisoning impact under different attack scenarios. Figure 3 further presents the computational cost of state-of-the-art methods. TOFD consistently achieves strong defense performance across diverse attack types and remains robust under composite attacks, maintaining over 92% accuracy under single attacks and 83% under composite attacks in the uniform setting. Unlike most coarse-grained defenses that discard entire client updates, TOFD filters poisoned smashed data at a fine-grained level while preserving informative benign samples. This advantage is particularly evident under composite attacks. For example, Trimmed-Mean only achieves 10.43% accuracy under DP+SP attacks in uniform settings, with a high poisoning impact of 85.39%, whereas TOFD still maintains 85.81% accuracy with a much lower poisoning impact of 10.21%, demonstrating its robustness under complex attack scenarios. TOFD also maintains strong defense performance under heterogeneous data settings. Under the WP+SP attack, shifting from IID to non-IID causes FAVD’s accuracy to drop sharply, with the poisoning impact rising by 26.59%. In contrast, TOFD maintains high accuracy, while the poisoning impact increases by only 1.79%. This improvement arises because baseline methods relying on fixed criteria often fail to distinguish benign non-IID variations from malicious samples, whereas TOFD employs adaptive, class-specific metrics to effectively isolate adversarial behavior. Meanwhile, TOFD maintains competitive computational cost while achieving the highest average accuracy among all methods, indicating a favorable trade-off between defense effectiveness and runtime efficiency for practical SFL systems. 6.2.2. Defense Generalization Across Data. Our second set of experiments investigates TOFD’s performance under different attack strategies across four datasets. Figure 4 summarizes the poisoning impact across these datasets, highlighting the consistency of performance under diverse data distributions. We analyze the generalization of representative defenses across four datasets with default heterogeneous class distributions. TOFD achieves superior performance across all datasets compared to the state-of-the-art baseline. While Median and Krum show moderate resilience, their fixed thresholds struggle to accommodate dataset-specific variations, and PRFL and HealSplit, despite incorporating sample purification, still exhibit residual vulnerability under complex attacks. In contrast, TOFD adaptively calibrates its detection thresholds based on observed class-wise statistics, allowing it to account for differences in class distributions across datasets. This class-adaptive mechanism effectively separates malicious perturbations from benign variations, enabling TOFD to maintain consistently low deviations and robust defense performance across diverse datasets in heterogeneous SFL settings. 6.2.3. Robustness under Varying Data Heterogeneity. Our third set of experiments evaluates the robustness of TOFD under varying degrees of data heterogeneity. The test accuracy and MSDR results are reported in Figures 7 and 7, respectively. As non-IID heterogeneity increases, TOFD’s performance advantage becomes more pronounced. While baseline defenses degrade significantly under stronger heterogeneity, TOFD consistently maintains stable accuracy across all levels. This trend is further supported by the MSDR results. TOFD consistently achieves higher MSDR than HealSplit across all heterogeneity levels, and the performance gap widens under stronger heterogeneity, demonstrating its ability to handle heterogeneous data distributions effectively. 6.2.4. Hyperparameters and Attack Intensity Our fourth set of experiments assesses TOFD’s sensitivity to hyperparameter choices and malicious client ratio. Results are shown in Figure 7 and Table 3. Table 3. Accuracy (%) of different methods under different malicious client ratio. Malicious Client Ratio Method 5% 10% 15% 20% 25% Median (Yin et al., 2018) 87.85 82.37 77.24 72.94 71.19 Krum (Blanchard et al., 2017) 85.09 82.54 77.81 72.90 70.02 PRFL (Yuan et al., 2025) 86.69 83.09 78.47 74.21 72.57 HealSplit (Xie and Lyu, 2026) 89.79 86.08 81.00 75.11 73.79 TOFD 91.04 88.50 85.38 81.79 79.09 We first investigate the impact of the decoupling weight λ and the EMA coefficient β on performance. TOFD demonstrates stable test accuracy over a broad range of values, indicating robustness to hyperparameter variations. Varying λ results in peak performance at λ=0.2λ=0.2, with neighboring values yielding comparable results. A similar pattern is observed for β. Based on these findings, we adopt λ=β=0.2λ=β=0.2 as the default configuration for all experiments. To further evaluate TOFD’s robustness under practical attack scenarios, we investigate its performance across different fractions of malicious clients. As the ratio of malicious clients increases from 5% to 25%, TOFD maintains the highest accuracy with minimal performance drop, unlike baseline methods that suffer significant degradation, demonstrating strong resilience to intensified adversarial participation. 6.2.5. Ablation Study. Our fifth experiment conducts an ablation study on both uniform and non-IID distributions to quantify the contribution of each TOFD component. The accuracy results are summarized in Table 4. With the complementary contributions of its components, TOFD exhibits amplified benefits under heterogeneous data distributions. Among all components, removing the purification module, which discards entire malicious clients, results in the largest performance drop, especially under non-IID distributions, underscoring the importance of fine-grained filtering. Ablating MPkMP_k or τk _k individually also degrades accuracy, as replacing adaptive, class-specific thresholds with global averages eliminates class-wise adaptation and weakens the separation between adversarial and benign variations. Removing the malicious feature decoupling loss ℒMFDL_MFD leads to a smaller yet consistent decline, confirming its role in mitigating residual adversarial effects. 6.2.6. Adaptive Attack. The sixth set of experiments evaluates the resilience of TOFD against adaptive attacks across five datasets. The accuracy results are presented in Fig. 8. In this scenario, the attacker constrains the induced DCS within the margin perturbation MPkMP_k, exploiting benign non-IID variability to bypass distributional consistency verification. These subtle deviations partially evade threshold-based sample purification and weaken malicious feature decoupling, leaving residual adversarial patterns in the SFL system that accumulate through aggregation, gradually impacting overall performance. Despite this intensified threat, TOFD maintains a clear advantage, consistently outperforming the strongest baselines. This robustness stems from TOFD’s class-adaptive mechanism, which dynamically calibrates defense based on class-wise statistics rather than a fixed global criterion, enabling effective separation of malicious perturbations from benign non-IID variations and suppressing their propagation through aggregation. Table 4. Results of ablation study. MNIST F-MNIST Component Uniform NIID Uniform NIID TOFD 85.81± 0.8 81.79± 0.6 77.97± 0.8 74.83± 0.9 w/o Purification 77.20± 0.7 71.53± 1.1 68.71± 0.8 63.55± 1.3 w/o MPkMP_k 80.50± 0.3 74.48± 0.5 73.86± 0.9 69.23± 0.7 w/o τk _k 83.70± 0.6 78.54± 0.8 75.15± 0.4 71.60± 0.5 w/o ℒMFDL_MFD 84.39± 0.9 79.98± 0.7 76.39± 1.0 72.83± 0.7 Figure 8. Comparison of adaptive attacks. 7. Conclusion In this work, we propose TOFD, a unified defense framework against diverse poisoning attacks for SFL. Existing defenses largely adapt conventional FL strategies and thus fail to leverage the split architecture for early-stage intervention. TOFD addresses this limitation by integrating detection and optimization to protect SFL through securing smashed data. It first performs class-wise target inference to identify attacked classes by constructing refined safe zones, and then selectively filters malicious smashed data within these classes. Building on this detection stage, TOFD mitigates residual adversarial influence by incorporating an adversarial guidance model to enforce a decoupling objective during SFL optimization. Extensive experiments show that TOFD consistently outperforms state-of-the-art defenses in robustness and efficiency across diverse attacks, offering a practical and generalizable solution for secure SFL. Acknowledgment This work was supported by the National Key R&D Program of China (2023YFA1009500). References D. Arp, E. Quiring, F. Pendlebury, A. Warnecke, F. Pierazzi, C. Wressnegger, L. Cavallaro, and K. Rieck (2022) Dos and don’ts of machine learning in computer security. In 31st USENIX Security Symposium (USENIX Security 22), p. 3971–3988. Cited by: §1, §4.2. P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer (2017) Machine learning with adversaries: byzantine tolerant gradient descent. Advances in neural information processing systems 30. Cited by: §2.1, Table 2, Table 2, §6.1, Table 3. X. Cao, M. Fang, J. Liu, and N. Z. Gong (2020) Fltrust: byzantine-robust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995. Cited by: §1, §2.1, Table 2, Table 2, §6.1. B. Ding, P. Yang, and S. Huang (2025) FedDLAD: a federated learning dual-layer anomaly detection framework for enhancing resilience against backdoor attacks. In Proceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence, IJCAI-25, p. 5021–5029. Cited by: §4.2. M. Fang, X. Cao, J. Jia, and N. Gong (2020) Local model poisoning attacks to byzantine-robust federated learning. In 29th USENIX security symposium (USENIX Security 20), p. 1605–1622. Cited by: §1. R. Guerraoui, S. Rouault, et al. (2018) The hidden vulnerability of distributed learning in byzantium. In International conference on machine learning, p. 3521–3530. Cited by: §1, §2.1, Table 2, Table 2, §6.1. K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, p. 770–778. Cited by: §6.1. G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger (2017) Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, p. 4700–4708. Cited by: §6.1. W. Huang, M. Ye, Z. Shi, G. Wan, H. Li, and B. Du (2024) Parameter disparities dissection for backdoor defense in heterogeneous federated learning. Advances in Neural Information Processing Systems 37, p. 120951–120973. Cited by: §2.2. B. Iglewicz and D. C. Hoaglin (1993) Volume 16: how to detect and handle outliers. Quality Press. Cited by: §4.1.1. R. Jha, J. Hayase, and S. Oh (2023) Label poisoning is all you need. Advances in Neural Information Processing Systems 36, p. 71029–71052. Cited by: §1. X. Jiang and J. Zhang (2025) FedClean: a general robust label noise correction for federated learning. In Forty-second International Conference on Machine Learning, Cited by: §1. T. Krauß and A. Dmitrienko (2023) Mesas: poisoning defense for federated learning resilient against adaptive attackers. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, p. 1526–1540. Cited by: §1. A. Krizhevsky, G. Hinton, et al. (2009) Learning multiple layers of features from tiny images. Cited by: Table 1, Table 1, §6.1. K. N. Kumar, R. R. Jha, C. K. Mohan, and R. B. Tallamraju (2025) Fortifying federated learning towards trustworthiness via auditable data valuation and verifiable client contribution. In Proceedings of the Computer Vision and Pattern Recognition Conference, p. 4999–5009. Cited by: §1, §2.1, Table 2, Table 2, §6.1. Y. LeCun, C. Cortes, and C. J. C. Burges (1998) MNIST handwritten digit database. Note: Available: http://yann.lecun.com/exdb/mnist Cited by: Table 1, §6.1. W. Li, S. Fu, F. Zhang, and Y. Pang (2024a) Data valuation and detections in federated learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 12027–12036. Cited by: §1, §2.1. Y. Li, Y. Zhao, C. Zhu, and J. Zhang (2025) Infighting in the dark: multi-label backdoor attack in federated learning. In Proceedings of the Computer Vision and Pattern Recognition Conference, p. 25770–25779. Cited by: §1. Y. Li, D. Qin, H. V. Poor, and Y. Wang (2024b) Introducing edge intelligence to smart meters via federated split learning. Nature communications 15 (1), p. 9044. Cited by: §1, §1. Z. Lin, G. Zhu, Y. Deng, X. Chen, Y. Gao, K. Huang, and Y. Fang (2024) Efficient parallel split learning over resource-constrained wireless edge networks. IEEE Transactions on Mobile Computing 23 (10), p. 9224–9239. Cited by: §1. Z. Ma, J. Ma, Y. Miao, Y. Li, and R. H. Deng (2022) ShieldFL: mitigating model poisoning attacks in privacy-preserving federated learning. IEEE Transactions on Information Forensics and Security 17, p. 1639–1654. Cited by: Table 2, Table 2, §6.1. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas (2017) Communication-efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics, p. 1273–1282. Cited by: Table 2, Table 2, §6.1. A. Panda, S. Mahloujifar, A. N. Bhagoji, S. Chakraborty, and P. Mittal (2022) Sparsefed: mitigating model poisoning attacks in federated learning with sparsification. In International Conference on Artificial Intelligence and Statistics, p. 7587–7624. Cited by: Table 2, Table 2, §6.1. C. Sandeepa, B. Siniarski, S. Wang, and M. Liyanage (2024) Sherpa: explainable robust algorithms for privacy-preserved federated learning in future networks to defend against data poisoning attacks. In 2024 IEEE Symposium on Security and Privacy (SP), p. 4772–4790. Cited by: §1. V. Shejwalkar and A. Houmansadr (2021) Manipulating the byzantine: optimizing model poisoning attacks and defenses for federated learning. In NDSS, Cited by: Table 2, Table 2, §6.1. C. Thapa, P. C. M. Arachchige, S. Camtepe, and L. Sun (2022) Splitfed: when federated learning meets split learning. In Proceedings of the AAAI conference on artificial intelligence, Vol. 36, p. 8485–8493. Cited by: §1. P. Tschandl, C. Rosendahl, and H. Kittler (2018) The ham10000 dataset, a large collection of multi-source dermatoscopic images of common pigmented skin lesions. Scientific data 5 (1), p. 1–9. Cited by: Table 1, §6.1. X. Wu, H. Yuan, X. Li, J. Ni, and R. Lu (2024) Evaluating security and robustness for split federated learning against poisoning attacks. IEEE Transactions on Information Forensics and Security. Cited by: §1, §1, §1, §2.1. H. Xiao, K. Rasul, and R. Vollgraf (2017) Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747. Cited by: Table 1, §6.1. Y. Xie, M. Fang, and N. Z. Gong (2024) Fedredefense: defending against model poisoning attacks for federated learning using model update reconstruction error. Cited by: §1, §2.2. Y. Xie, C. Lyu, and J. Huang (2026) BESplit: bias-compensated split federated learning with evidential aggregation. In Forty-third International Conference on Machine Learning, Cited by: §1, §1. Y. Xie and C. Lyu (2026) Healsplit: towards self-healing through adversarial distillation in split federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40, p. 35931–35939. Cited by: §1, §2.1, Table 2, Table 2, §6.1, Table 3. A. Yazdinejad, A. Dehghantanha, H. Karimipour, G. Srivastava, and R. M. Parizi (2024) A robust privacy-preserving federated learning model against model poisoning attacks. IEEE Transactions on Information Forensics and Security 19, p. 6693–6708. Cited by: §1, §1. D. Yin, Y. Chen, R. Kannan, and P. Bartlett (2018) Byzantine-robust distributed learning: towards optimal statistical rates. In International conference on machine learning, p. 5650–5659. Cited by: §1, §2.1, Table 2, Table 2, Table 2, Table 2, Table 3. L. Yuan, J. Zhang, M. Duan, G. Xiao, Z. Tang, and K. Li (2025) PRFL: personalized and robust federated learning for non-iid data with malicious participants. IEEE Transactions on Mobile Computing. Cited by: §2.2, Table 2, Table 2, §6.1, Table 3.