Revisiting Label Inference Attacks in Vertical Federated Learning: Why They Are Vulnerable and How to Defend

Yige Liu; Dexuan Xu; Zimai Guo; Yongzhi Cao; Hanpin Wang

cs.LGMar 19, 2026

Revisiting Label Inference Attacks in Vertical Federated Learning: Why They Are Vulnerable and How to Defend

Authors: Yige Liu, Dexuan Xu, Zimai Guo, Yongzhi Cao, Hanpin Wang

Organizations: Key Laboratory of High Confidence Software Technologies (Peking University), Ministry of Education; School of Computer Science, Peking University, Beijing, China. · Zhongguancun Laboratory, Beijing, China.

Abstract

Vertical federated learning (VFL) allows an active party with a top model, and multiple passive parties with bottom models to collaborate. In this scenario, passive parties possessing only features may attempt to infer active party's private labels, making label inference attacks (LIAs) a significant threat. Previous LIA studies have claimed that well-trained bottom models can effectively represent labels. However, we demonstrate that this view is misleading and exposes the vulnerability of existing LIAs. By leveraging mutual information, we present the first observation of the "model compensation" phenomenon in VFL. We theoretically prove that, in VFL, the mutual information between layer outputs and labels increases with layer depth, indicating that bottom models primarily extract feature information while the top model handles label mapping. Building on this insight, we introduce task reassignment to show that the success of existing LIAs actually stems from the distribution alignment between features and labels. When this alignment is disrupted, the performance of LIAs declines sharply or even fails entirely. Furthermore, the implications of this insight for defenses are also investigated. We propose a zero-overhead defense technique based on layer adjustment. Extensive experiments across five datasets and five representative model architectures indicate that shifting cut layers forward to increase the proportion of top model layers in the entire model not only improves resistance to LIAs but also enhances other defenses.

Figures & tables

Fig. 1: An illustration of the vertical federated learning framework. Solid lines represent forward propagation and dashed lines denote backpropagation.

Panel of Figure 2 — Fig. 2: Mutual information between the outputs of each layer and the labels for different datasets and models. In each subfigure, the left side of the gray dotted line corresponds to the bottom model, while the right side corresponds to the top model. Lines of different colors indicate different passive parties. From left to right, the number of passive parties gradually increases.

Fig. 3: The mutual information between the cut layer of the bottom model and the labels decreases as the number of passive parties increases.

Panel of Figure 4 — Fig. 4: The topology of the lumped Markov chains in VFL.

LIA	Dataset	Original Task		New Task 1		New Task 2		New Task 3
LIA	Dataset	Attack Acc.	MTA	Attack Acc.	$\Delta$ MTA	Attack Acc.	$\Delta$ MTA	Attack Acc.	$\Delta$ MTA
Cluster	MNIST	85.54 $\pm$ 6.54%	97.10 $\pm$ 0.06%	37.48 $\pm$ 3.50%	-0.002	25.56 $\pm$ 4.02%	-0.000	17.00 $\pm$ 4.27%	0.003
	CIFAR-10	18.66 $\pm$ 3.92%	60.44 $\pm$ 0.95%	17.29 $\pm$ 1.37%	-0.004	11.62 $\pm$ 3.67%	0.004	10.89 $\pm$ 0.85%	-0.006
	CINIC-10	13.78 $\pm$ 0.68%	74.82 $\pm$ 1.34%	12.32 $\pm$ 1.28%	-0.012	11.79 $\pm$ 1.95%	0.004	10.79 $\pm$ 0.65%	-0.005
	SVHN	20.50 $\pm$ 6.21%	90.11 $\pm$ 0.90%	11.46 $\pm$ 1.57%	0.001	9.70 $\pm$ 0.31%	-0.001	9.56 $\pm$ 0.62%	-0.004
	GTSRB	36.33 $\pm$ 3.21%	73.71 $\pm$ 3.87%	12.69 $\pm$ 1.65%	-0.008	11.47 $\pm$ 2.14%	-0.001	4.42 $\pm$ 2.06%	-0.012

TABLE I: Performance of LIAs under newly assigned tasks

Fig. 5: Trends of attack accuracy and mutual information under different tasks. The first column presents the attack accuracy of LIA with cluster method. The second column presents the attack accuracy of LIA with model completion method. The third column presents the mutual information between the dataset features and the labels.

LIA	Dataset	Cut Layer Position: -2		Cut Layer Position: -3		Cut Layer Position: -4		Cut Layer Position: -5
LIA	Dataset	Attack Acc.	MTA	Attack Acc.	$\Delta$ MTA	Attack Acc.	$\Delta$ MTA	Attack Acc.	$\Delta$ MTA
Cluster	MNIST	94.72 $\pm$ 4.70%	97.04 $\pm$ 0.09%	88.25 $\pm$ 6.68%	0.002	86.83 $\pm$ 6.22%	0.001	85.54 $\pm$ 6.54%	0.001
	CIFAR-10	37.93 $\pm$ 7.35%	60.09 $\pm$ 1.79%	28.56 $\pm$ 5.90%	0.010	19.44 $\pm$ 3.36%	0.009	18.66 $\pm$ 3.92%	0.004
	CINIC-10	44.31 $\pm$ 10.81%	73.35 $\pm$ 2.78%	24.35 $\pm$ 7.47%	0.007	16.96 $\pm$ 4.41%	-0.003	13.78 $\pm$ 0.68%	0.015
	SVHN	72.96 $\pm$ 8.20%	89.80 $\pm$ 0.61%	40.61 $\pm$ 10.24%	0.002	30.10 $\pm$ 4.20%	0.001	20.50 $\pm$ 6.21%	0.003
	GTSRB	55.50 $\pm$ 4.67%	72.52 $\pm$ 2.48%	54.58 $\pm$ 5.22%	0.000	49.59 $\pm$ 5.02%	0.003	36.33 $\pm$ 3.21%	0.012

TABLE II: The impact of cut layer position on MTA and attack accuracy

Fig. 6: An illustration of moving the cut layer position. Each layer of the model is depicted as an ellipse. We keep the total number of layers in the VFL model unchanged and only adjust the position of the cut layer.

Fig. 7: Mutual information decreases when the cut layer is moved closer to the bottom of the model.

Panel of Figure 10 — Fig. 8: Moving the cut layer closer to bottom models can effectively enhance other defenses against LIAs.

Panel of Figure 11 — Fig. 9: Robustness of the defense effect across networks with varying widths.

Panel of Figure 12 — Fig. 10: Robustness of the defense effect across networks of different depths.

Panel of Figure 13 — Fig. 11: Robustness of the defense effect across distinct model architectures.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 943 papers

LEA: Label Enumeration Attack in Vertical Federated Learning
Mar 4, 2026Wenhao Jiang, Shaojing Fu, Yuchuan Luo +1Federated Learning
College of Computer Science and Technology, National University of Defense Technology, Changsha, China
Is the Trigger Essential? A Feature-Based Triggerless Backdoor Attack in Vertical Federated Learning
Feb 24, 2026Yige Liu, Yiwei Lou, Che Wang +2Backdoor Attacks Backdoor Attacks in Federated Learning
Key Laboratory of High Confidence Software Technologies (Peking University), Ministry of Education; School of Computer Science, Peking University, Beijing, China. · Zhongguancun Laboratory, Beijing, China.
Understanding Backdoor Vulnerabilities in Vertical Federated Learning: The Gap Between Research and Practice
Aug 13, 2026Ziqi Zhao, Jialin Lu, Junjie Shan +3Backdoor Attacks Backdoor Attacks in Federated Learning
School of Computing and Data Science, The University of Hong Kong, Hong Kong SAR, China

Mar 4, 2026J/K move · Enter open · S save

LEA: Label Enumeration Attack in Vertical Federated Learning

Wenhao Jiang, Shaojing Fu, Yuchuan Luo, Lin Liu

College of Computer Science and Technology, National University of Defense Technology, Changsha, China

Federated Learning

Open paper AskPDF arXiv

A typical Vertical Federated Learning (VFL) scenario involves several participants collaboratively training a machine learning model, where each party has different features for the same samples, with labels held exclusively by one party. Since labels contain sensitive information, VFL must ensure the privacy of labels. However, existing VFL-targeted label inference attacks are either limited to specific scenarios or require auxiliary data, rendering them impractical in real-world applications. We introduce a novel Label Enumeration Attack (LEA) that, for the first time, achieves applicability across multiple VFL scenarios and eschews the need for auxiliary data. Our intuition is that an adversary, employing clustering to enumerate mappings between samples and labels, ascertains the accurate label mappings by evaluating the similarity between the benign model and the simulated models trained under each mapping. To achieve that, the first challenge is how to measure model similarity, as models trained on the same data can have different weights. Drawing from our findings, we propose an efficient approach for assessing congruence based on the cosine similarity of the first-round loss gradients, which offers superior efficiency and precision compared to the comparison of parameter similarities. However, the computational cost may be prohibitive due to the necessity of training and comparing the vast number of simulated models generated through enumeration. To overcome this challenge, we propose Binary-LEA from the perspective of reducing the number of models and eliminating futile training, which lowers the number of enumerations from n! to n^3. Moreover, LEA is resilient against common defense mechanisms such as gradient noise and gradient compression.

Abstract

Federated Learning

Explore similar work

LEA: Label Enumeration Attack in Vertical Federated Learning

Is the Trigger Essential? A Feature-Based Triggerless Backdoor Attack in Vertical Federated Learning

Understanding Backdoor Vulnerabilities in Vertical Federated Learning: The Gap Between Research and Practice