Federated learning enables collaborative training of machine learning models by keeping the raw data of the involved workers private. One of its main objectives is to improve the models' privacy, security, and scalability. Vertical Federated Learning (VFL) offers an efficient cross-silo setting where a few parties collaboratively train a model without sharing the same features. In such a scenario, classification labels are commonly considered sensitive information held exclusively by one (active) party, while other (passive) parties use only their local information. Recent works have uncovered important flaws of VFL, leading to possible label inference attacks under the assumption that the attacker has some, even limited, background knowledge on the relation between labels and data. In this work, we are the first (to the best of our knowledge) to investigate label inference attacks on VFL using a zero-background knowledge strategy. To concretely formulate our proposal, we focus on Graph Neural Networks (GNNs) as a target model for the underlying VFL. In particular, we refer to node classification tasks, which are widely studied, and GNNs have shown promising results. Our proposed attack, BlindSage, provides impressive results in the experiments, achieving nearly 100% accuracy in most cases. Even when the attacker has no information about the used architecture or the number of classes, the accuracy remained above 85% in most instances. Finally, we observe that well-known defenses cannot mitigate our attack without affecting the model's performance on the main classification task.

翻译：联邦学习通过保持参与工作者的原始数据私密性，实现机器学习模型的协同训练。其主要目标之一是提升模型的隐私性、安全性和可扩展性。纵向联邦学习（VFL）提供了一种高效的跨孤岛场景设置，其中少数参与方在不共享相同特征的情况下协同训练模型。在此类场景中，分类标签通常被视为由单一（主动）参与方独占的敏感信息，而其他（被动）参与方仅使用其本地信息。近期研究揭示了VFL存在的重大缺陷，导致在假设攻击者具备一定（即使有限）关于标签与数据关系的背景知识的情况下，可能实施标签推断攻击。本文首次（据我们所知）研究了采用零背景知识策略对VFL进行标签推断攻击。为具体阐述我们的方案，我们聚焦于图神经网络（GNN）作为底层VFL的目标模型，特别针对广泛研究且GNN已展现显著成效的节点分类任务。我们提出的攻击方法BlindSage在实验中取得了显著成果，在多数情况下实现了近乎100%的准确率。即使攻击者不了解所用架构或类别数量，多数实例的准确率仍保持在85%以上。最后，我们观察到，在不影响模型主分类任务性能的前提下，现有知名防御措施无法有效缓解我们的攻击。