# Understanding Backdoor Vulnerabilities in Vertical Federated Learning: The Gap Between Research and Practice

arXiv: https://arxiv.org/abs/2608.12962 · HTML: https://mlsanity.com/paper/2608.12962/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 21 of its 47 references that are in the map.
- First posted on arXiv 13 Aug 2026.

## Builds on (most cited first, 21 of 21)

- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning](https://mlsanity.com/paper/1712.05526/) (2017)
- [Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks](https://mlsanity.com/paper/1805.12185/) (2018)
- [Spectral Signatures in Backdoor Attacks](https://mlsanity.com/paper/1811.00636/) (2018)
- [Split learning for health: Distributed deep learning without sharing raw patient data](https://mlsanity.com/paper/1812.00564/) (2018)
- [BackdoorBench: A Comprehensive Benchmark of Backdoor Learning](https://mlsanity.com/paper/2206.12654/) (2022)
- [Vertical Federated Learning: Concepts, Advances and Challenges](https://mlsanity.com/paper/2211.12814/) (2022)
- [Privacy Preserving Vertical Federated Learning for Tree-based Models](https://mlsanity.com/paper/2008.06170/) (2020)
- [Vertically Federated Graph Neural Network for Privacy-Preserving Node Classification](https://mlsanity.com/paper/2005.11903/) (2020)
- [Vertical Federated Knowledge Transfer via Representation Distillation for Healthcare Collaboration Networks](https://mlsanity.com/paper/2302.05675/) (2023)
- [A Vertical Federated Learning Method for Interpretable Scorecard and Its Application in Credit Scoring](https://mlsanity.com/paper/2009.06218/) (2020)
- [Vertical Federated Learning for Effectiveness, Security, Applicability: A Survey](https://mlsanity.com/paper/2405.17495/) (2024)
- [BadVFL: Backdoor Attacks in Vertical Federated Learning](https://mlsanity.com/paper/2304.08847/) (2023)
- [ADI: Adversarial Dominating Inputs in Vertical Federated Learning Systems](https://mlsanity.com/paper/2201.02775/) (2022)
- [VFLAIR: A Research Library and Benchmark for Vertical Federated Learning](https://mlsanity.com/paper/2310.09827/) (2023)
- [FedAds: A Benchmark for Privacy-Preserving CVR Estimation with Vertical Federated Learning](https://mlsanity.com/paper/2305.08328/) (2023)
- [Practical and General Backdoor Attacks against Vertical Federated Learning](https://mlsanity.com/paper/2306.10746/) (2023)
- [VertiBench: Advancing Feature Distribution Diversity in Vertical Federated Learning Benchmarks](https://mlsanity.com/paper/2307.02040/) (2023)
- [Hijack Vertical Federated Learning Models As One Party](https://mlsanity.com/paper/2212.00322/) (2022)
- [VFLIP: A Backdoor Defense for Vertical Federated Learning via Identification and Purification](https://mlsanity.com/paper/2408.15591/) (2024)
- [Tree-based Models for Vertical Federated Learning: A Survey](https://mlsanity.com/paper/2504.02285/) (2025)

## Abstract (arXiv)

Vertical Federated Learning (VFL) enables organizations holding complementary features of shared entities to collaborate and train models. In this setting, the initiator can withhold information about the learning task, while other contributors participate without exposing their local datasets, creating an asymmetric information structure aligned with growing privacy demands. However, this asymmetry is a double-edged sword. Among various threats, backdoor attacks are particularly concerning because VFL not only enables malicious contributors to poison the model during training, but also allows them to activate the backdoor at inference time to manipulate predictions. Although prior work has reported near-perfect attack success rates and proposed effective defenses, we find that most findings fail to hold under realistic conditions, exposing a fundamental gap between research and practice. In this paper, we present a systematic, practice-oriented study of backdoor vulnerabilities in VFL, revealing this gap in both methodological design and evaluation practices. We show that existing approaches overlook key practical constraints and therefore rely on unrealistic prior knowledge. Furthermore, these limitations have remained hidden due to poorly designed evaluation practices in the literature. To bridge this gap, we redefine threat models under realistic constraints, propose practical backdoor workflows, and introduce BVBench, a backdoor-centric benchmark that enables fair, practical, and comprehensive evaluation, preloaded with state-of-the-art baselines. BVBench provides strong evidence of the fragility of the current understanding of VFL backdoor risks and establishes a foundation for steering research toward uncovering practical vulnerabilities and developing more meaningful defenses.