# MISA: Unveiling the Vulnerabilities in Split Federated Learning

arXiv: https://arxiv.org/abs/2312.11026 · HTML: https://mlsanity.com/paper/2312.11026/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 19 references that are in the map.
- First posted on arXiv 18 Dec 2023.

## Builds on (most cited first, 12 of 12)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates](https://mlsanity.com/paper/1803.01498/) (2018)
- [Local Model Poisoning Attacks to Byzantine-Robust Federated Learning](https://mlsanity.com/paper/1911.11815/) (2019)
- [Split learning for health: Distributed deep learning without sharing raw patient data](https://mlsanity.com/paper/1812.00564/) (2018)
- [SplitFed: When Federated Learning Meets Split Learning](https://mlsanity.com/paper/2004.12088/) (2020)
- [A Little Is Enough: Circumventing Defenses For Distributed Learning](https://mlsanity.com/paper/1902.06156/) (2019)
- [Fall of Empires: Breaking Byzantine-tolerant SGD by Inner Product Manipulation](https://mlsanity.com/paper/1903.03936/) (2019)
- [Challenges and Approaches for Mitigating Byzantine Attacks in Federated Learning](https://mlsanity.com/paper/2112.14468/) (2021)
- [Shielding Federated Learning: Robust Aggregation with Adaptive Client Selection](https://mlsanity.com/paper/2204.13256/) (2022)
- [A Four-Pronged Defense Against Byzantine Attacks in Federated Learning](https://mlsanity.com/paper/2308.03331/) (2023)
- [Security Analysis of SplitFed Learning](https://mlsanity.com/paper/2212.01716/) (2022)
- [Analyzing the vulnerabilities in SplitFed Learning: Assessing the robustness against Data Poisoning Attacks](https://mlsanity.com/paper/2307.03197/) (2023)

## Built on by (most cited first, 3 of 3)

- [MARS: A Malignity-Aware Backdoor Defense in Federated Learning](https://mlsanity.com/paper/2509.20383/) (2025)
- [Training on Fake Labels: Mitigating Label Leakage in Split Learning via Secure Dimension Transformation](https://mlsanity.com/paper/2410.09125/) (2024)
- [Oops!... They Stole it Again: Attacks on Split Learning](https://mlsanity.com/paper/2508.10598/) (2025)

## Abstract (arXiv)

textitFederated learning (FL) and textitsplit learning (SL) are prevailing distributed paradigms in recent years. They both enable shared global model training while keeping data localized on users' devices. The former excels in parallel execution capabilities, while the latter enjoys low dependence on edge computing resources and strong privacy protection. textitSplit federated learning (SFL) combines the strengths of both FL and SL, making it one of the most popular distributed architectures. Furthermore, a recent study has claimed that SFL exhibits robustness against poisoning attacks, with a fivefold improvement compared to FL in terms of robustness. In this paper, we present a novel poisoning attack known as MISA. It poisons both the top and bottom models, causing a textbfunderlinemisalignment in the global model, ultimately leading to a drastic accuracy collapse. This attack unveils the vulnerabilities in SFL, challenging the conventional belief that SFL is robust against poisoning attacks. Extensive experiments demonstrate that our proposed MISA poses a significant threat to the availability of SFL, underscoring the imperative for academia and industry to accord this matter due attention.