Graph-based vertical federated learning (GVFL) enables multiple parties to collaboratively train and infer over aligned nodes, where each party contributes its own local embedding derived from different attributes and adjacency relations. Adversarial inputs injected by an attacker can skew the joint prediction toward its desired outcomes while diminishing the influence of benign parties and undermining contribution. However, most attacks typically have pre-set assumptions, such as access to the server architecture, model queries, or in-domain auxiliary graphs. In this paper, we propose SGAC, an attack framework that enables domination of joint inference without relying on above assumptions. SGAC learns label-indicative embeddings and class-transferable probabilities to generate a surrogate that closely mimics the server-side classification behavior by exploiting auxiliary graphs from non-training domains. SGAC then leverages saliency over node attributes and edges on the auxiliary graphs to construct a diverse set of shadow inputs resembling highly influential test instances. With the surrogate fidelity and input diversity, SGAC crafts transferable contribution-monopoly adversarial inputs that hijack GVFL incentives. Extensive experiments across diverse model architectures validate SGAC's effectiveness.

Cryptographic access control guarantees that authorized users can access data while unauthorized get nothing. Such an all-or-nothing access mode achieves secrecy but does not fit strong-privacy scenarios. FE-based access control breaks it and reaches a balance between data privacy and data utilization. To resist malicious senders, Damgard et al. introduced sanitizable functional encryption that enables a bi-directional control to both senders and receivers. However, its centralized structure means that the compromise of the authority incurs massive secret leakage and undermines the system’s reliability. In this work, we present SanIdea, a sanitizable, decentralized and privacy-preserving access control framework which embraces a sanitizer in the distributed-authority-domain access control setting. We instantiate it by proposing a cryptographic primitive named sMABE, which adds a$\mathsf {Sanitize}$algorithm over multi-authority attribute-based encryption. We formally prove its security in the IND-CPA model and the Sanitization Security model under the DBDH assumption. We demonstrate its reasonable efficiency through algorithm simulation, where the sanitization time is less than 0.1s with the configuration of 5 attribute authorities and 25 user attributes. We design an SABC system by integrating SanIdea with the blockchain, where SABC uses a smart contract to ensure the correctness of the distributed secret key parts. We implement SABC in an Ethereum testbed and the experiment results show that the$\mathsf {upload}$algorithm costs about 163000 user gas and the$\mathsf {download}$algorithm costs about 84000 user gas, which is cost-reasonable.

Access control encryption enables access control on both senders and receivers, and enhances message sanitization compared with traditionally cryptographic access control mechanisms. However, it is usually built on top of encrypted messages, which makes it difficult to identify malicious data and amplifies abusive message transmission. The message franking and source tracing mechanisms facilitate a report of abusive messages while support only plain-data moderation in end-to-end encryption. In this work, we present sMAC, a sanitizable and moderate access control framework which supports both sanitization and moderation over the encrypted messages as well as the data privacy, sender anonymity and backward security. We instantiate it by proposing a cryptographic primitive named amenable ACE, which expands the message accountability algorithm module in addition to access control encryption. We give formal security proof of amenable ACE in the standard model. The experimental results show that amenable ACE is efficient where the computational cost of Decrypt, Stamp, Verify and Inspect is independent of the message size.