In the era of the Internet of Things (IoT), managing the deluge of data generated by distributed devices presents unique challenges, particularly concerning privacy and the efficient use of computational resources. Vertical Federated Learning (VFL) offers a promising avenue for collaborative machine learning without centralizing data, thereby addressing privacy concerns inherent in traditional approaches. However, as data privacy laws and personal data deletion requests become more prevalent, the necessity for effective machine unlearning strategies within VFL frameworks grows increasingly important. To this end, this paper introduces a novel approach to feature-based machine unlearning tailored specifically for VFL systems in IoT networks. Our methodology enables the selective removal of data influence from trained models without the need for full retraining, thus preserving model utility while ensuring compliance with privacy requirements. By integrating a combination of feature relevance measuring techniques and efficient communication protocols, our solution minimizes the data footprint on network nodes, reduces bandwidth consumption, and maintains the integrity and performance of the learning models. To the best of our knowledge, our proposed framework represents the first practical approach to enable machine unlearning within vertical federated learning environments. We demonstrate the effectiveness of our approach through rigorous evaluation using several IoT datasets, highlighting significant improvements in unlearning efficiency and model robustness compared to existing techniques. Our work not only furthers the development of sustainable and compliant machine learning models in IoT but also sets a foundational framework for future research in secure and efficient data management within federated environments.

To boost the encoder stealing attack under the perturbation-based defense that hinders the attack performance, we propose a boosting encoder stealing attack with perturbation recovery named BESA. It aims to overcome perturbation-based defenses. The core of BESA consists of two modules: perturbation detection and perturbation recovery, which can be combined with canonical encoder stealing attacks. The perturbation detection module utilizes the feature vectors obtained from the target encoder to infer the defense mechanism employed by the service provider. Once the defense mechanism is detected, the perturbation recovery module leverages the well-designed generative model to restore a clean feature vector from the perturbed one. Through extensive evaluations based on various datasets, we demonstrate that BESA significantly enhances the surrogate encoder accuracy of existing encoder stealing attacks by up to 24.63% when facing state-of-the-art defenses and combinations of multiple defenses.

Deep Learning(DL) techniques have gained significant importance in the recent past due to their vast applications. However, DL is still prone to several attacks, such as the Membership Inference Attack (MIA), based on the memorability of training data. MIA aims at determining the presence of specific data in the training dataset of the model with substitute model of similar structure to the objective model. As MIA relies on the substitute model, they can be mitigated if the substitute model is not clear about the network structure of the objective model. To solve the challenge of shadow-model construction, this work presents L-Leaks, a member inference attack based on Logits. L-Leaks allow an adversary to use the substitute model's information to predict the presence of membership if the shadow and objective model are similar enough. Here, the substitute model is built by learning the logits of the objective model, hence making it similar enough. This results in the substitute model having sufficient confidence in the member samples of the objective model. The evaluation of the attack's success shows that the proposed technique can execute the attack more accurately than existing techniques. It also shows that the proposed MIA is significantly robust under different network models and datasets.

Deep neural networks are increasingly used as the critical component of applications, bringing high computational costs. Many practitioners host their models on third-party platforms. This practice exposes DNNs to risks: A third party hosting the model may use a malicious deep learning framework to implement a backdoor attack. Our goal is to develop the realistic potential for backdoor attacks in third-party hosting platforms. We introduce a threatening and realistically implementable backdoor attack that is highly stealthy and flexible. We inject trojans by hijacking the built-in functions of the deep learning framework. Unlike existing backdoor attacks, the proposed sequential trigger is a specific sequence of clean image sets. Moreover, our attack is model agnostic and does not require retraining the model or modifying the parameters. Its stealthy is that injecting trojans will not change the models prediction for a clean image. Its flexibility lies in that adversary can remodify the trojan behavior at any time. Extensive experiments on multiple benchmarks with different frameworks demonstrate that our attack achieves a perfect success rate. And we can inject multiple trojans which do not affect each other at the same time. Analysis and experiments further show that state-of-the-art defenses are ineffective against our attacks.

Federated learning is a distributed machine learning approach that enables multiple participants to collaboratively train a model without sharing their data, thus preserving privacy. However, the decentralized nature of federated learning also makes it susceptible to backdoor attacks, where malicious participants can embed hidden vulnerabilities within the model. Addressing these threats efficiently and effectively is crucial, especially given the impracticality of iterative and resource-intensive detection methods in federated learning environments. This paper presents a novel framework for one-shot backdoor removal in federated learning. Our approach integrates advanced anomaly detection techniques with a unique model update aggregation strategy, allowing for the identification and neutralization of backdoor influences in a single update cycle without the need for extensive data access or communication between participants. Extensive experiments across various federated architectures and data distributions demonstrate that our method effectively mitigates backdoor threats while maintaining model performance and scalability. This work not only enhances the security of federated models but also contributes to the broader applicability of federated learning in sensitive and critical domains.