SFLGuard: Model Poisoning Mitigation in Split Federated Learning via Activation-Level Attestation

Split federated learning (SFL) enables collaborative training by partitioning models between clients, a federated server responsible for aggregation, and a central server responsible for completing the forward and backward passes of the remaining model layers. However, intermediate activations exchanged during training remain susceptible to poisoning attacks, allowing adversaries to bias global updates. To address this gap, we propose SFLGuard, a class-conditional likelihood-based attestation mechanism that detects and filters out out-of-distribution (OOD) client updates before aggregation. By modeling class-conditional activation distributions on the server using Gaussian/Gaussian-mixture likelihoods, SFLGuard enforces statistical consistency at the smashed-activation interface. Experiments on CIFAR-10 and ResNet-18 show that SFLGuard restores up to 30% of poisoned accuracy loss and detects more than 80% of OOD client updates.