Toward More Practical Label Inference Attacks Against Graph-Based Vertical Federated Learning

Graph-based vertical federated learning (GVFL) enables an active party who owns a labeled graph to collaborate with passive parties who possess additional node features and edges to improve model performance. GVFL shares representations and gradients, allowing passive parties to retain their optimized bottom models, which makes previous GVFL algorithms unable to resist label inference attacks. However, most attacks assume that the attacker has access to the training data's exact class space, the top model, or labeled auxiliary datasets from the training domain. These strong assumptions are not practical for real-world GVFL applications. In this paper, we propose Knowledge Transfer Attack (KTA), which leverages only auxiliary graphs from non-training domains to infer private labels. To address domain shift and ensure effective supervision transfer, KTA adapts a surrogate classifier in an aligned representation space while mitigating the negative influence of irrelevant outlier-class supervision. Specifically, KTA exploits the global consistency of cross-domain graphs and incorporates adaptive shift parameters into graph encoding. KTA then aligns cross-domain distributions within the shared class space and mitigates negative transfer by filtering outlier source classes. Experiments confirm the effectiveness of KTA in inferring the active party's private labels and superiority over state-of-the-art attacks.