FedPass: Privacy-Preserving Vertical Federated Deep Learning with Adaptive Obfuscation

1 Introduction

Vertical federated learning (VFL) [Yang et al., 2019] allows multiple organizations to exploit in a privacy-preserving manner their private datasets, which may have some sample IDs in common but are significantly different from each other in terms of features. VFL found a great deal of successful applications, especially in collaborations between banks, healthcare institutes, e-commerce platforms, etc. [Yang et al., 2019; Li et al., 2020].

Despite of these successful VFL applications, privacy risks ascribed to certain corner cases were reported, e.g., in [Jin et al., 2021; Fu et al., 2022a; He et al., 2019]. On one hand, active parties in VFL are concerned by the risk of leaking labels to passive parties. On the other hand, passive parties are keen to protect their private features from being reconstructed by the active party. To this end, a variety of privacy defense mechanisms include adding noise [Fu et al., 2022a; Liu et al., 2021], gradient discretization [Dryden et al., 2016], gradient sparsification [Aji and Heafield, 2017], gradient compression [Lin et al., 2018], and mixup [Huang et al., 2020; Zhang et al., 2018] has been proposed to boost the privacypreserving capability of VFL. Nevertheless, as shown by detailed analysis and empirical study in this paper (see Sect. 4.2), all the aforementioned defense mechanisms suffer from deteriorated model performance to a certain extent. In this paper, we analyze the root cause of compromised model performance and propose an effective privacy-preserving method, which not only provides a strong privacy guarantee under various privacy attacks but also maintains unbending model performance for a variety of experimental settings.

Existing privacy defense mechanisms [Fu et al., 2022a; Liu et al., 2020; Dryden et al., 2016; Aji and Heafield, 2017; Lin et al., 2018; Huang et al., 2020] can be essentially viewed as an obfuscation mechanism that provides privacy guarantees by adopting an obfuscation function g(·) acting on private features x or labels y, illustrated as follows:

in which H is the forward embedding that the passive party transfers to the active party; ℓ is loss; G and F represent the passive and active model parameterized by θ and ω, respectively. Note that in Eq. (1), the strength of privacy-preserving capability is prescribed by the extent of obfuscation (a.k.a. distortion) via a fixed hyper-parameter. As investigated in [Zhang et al., 2022; Kang et al., 2022c], significant obfuscations inevitably bring about the loss of information in g(x) and g(y) and thus lead to the loss of model performance (empirical study in Sect. 4.2). We argue that a fixed obfuscation strategy does not consider the dynamic learning process and constitutes the root cause of model performance degradation.

As a remedy to shortcomings of the fixed obfuscation, we propose to adapt obfuscation function gθ and gω during the learning of model Fθ and Gω, such that the obfuscation itself is also optimized during the learning stage. That is to say, the learning of the obfuscation function also aims to preserve model performance by tweaking model parameters θ and ω:

We regard this adaptive obfuscation as the gist of the proposed method. In this work, we implement the adaptive obfuscation based on the passport technique originally designed for protecting the intellectual property of deep neural networks (DNN) [Fan et al., 2021; Li et al., 2022a]. More specifically, we propose to embed private passports in both active and passive party models of VFL to effectively defend against privacy attacks. We therefore name the proposed method FedPass, which has three advantages: i) Private passports embedded in passive and active models prevent attackers from inferring features and labels. It is exponentially hard to infer features by launching various attacks, while attackers are defeated by a non-zero recovery error when attempting to infer private labels (see Sect. 3.4). ii) Passport-based obfuscation is learned in tandem with the optimization of model parameters, thus, preserving model performance (see Sect. 3.3). iii) The learnable obfuscation is efficient, with only minor computational costs incurred since no computationally extensive encryption operations are needed (see Sect. 4.2).

As Figure 1 illustrated, FedPass achieves almost lossless main task accuracy while obtaining the largest data recovery error in defending against three privacy attacks investigated in our experiments (see Sect. 4 for more results).

2 RelatedWork

We review related work from three aspects, namely, vertical federated learning (VFL) and privacy attacks in VFL, and protection mechanism

Vertical Federated Learning A variety of VFL methods has been proposed. [Hardy et al., 2017] proposed vertical logistic regression (VLR) using homomorphic encryption (HE) to protect feature privacy. [Fu et al., 2022b] proposed vertical neural network that employs a hybrid privacy-preserving strategy combining HE and secret sharing (SS) to protect feature. [Cheng et al., 2021] proposed the SecureBoost, a VFL version of XGBoost, that leverages HE to protect the information exchanged among parties. To tackle the data deficiency issue of VFL, [Kang et al., 2022b] combined semisupervised learning and cross-view training to estimate missing features and labels for further training, [Liu et al., 2020; Kang et al., 2022a] integrated transfer learning into VFL to help the target party predict labels, while [He et al., 2022] proposed a federated hybrid self-supervised learning framework to boost the VFL model performance through selfsupervised learning based on unlabeled data.

Privacy Attacks in VFL There are two categories of privacy attacks in VFL: feature inference (FI) attacks and label inference (LI) attacks. FI attacks are typically launched by the active party to infer the features of a passive party. They can be tailored to shallow models such as logistic regression [Hu et al., 2022] and decision trees [Luo et al., 2021]. For deep neural networks, model inversion [He et al., 2019] and CAFE [Jin et al., 2021] are two representative FI attacks that infer private features through inverting passive parties' local models. LI attacks are mounted by a passive party to infer labels owned by the active party. The literature has proposed two kinds of LI attacks: the gradient-based [Li et al., 2022b] and the model-based [Fu et al., 2022a]. The former infers labels though analyzing the norm or direction of gradients back-propagated to the passive party, while the latter infers labels based on a pre-trained attacking model.

Defense mechanism We divide defense mechanisms applied to VFL into three categories: Protect features, labels and model parameters (or gradients). Specifically, most existing defense mechanisms typically apply to either model parameters or gradients to protect private data (features or labels). General defense mechanisms such as differential privacy [Abadi et al., 2016] and sparsification [Fu et al., 2022a; Lin et al., 2018] can be used to defend against both the feature and label inference attacks by distorting (i.e., adding noise or compressing) model parameters or gradients. Specialized defense mechanisms such as MARVELL [Li et al., 2022b] and Max-Norm [Li et al., 2022b] are tailored to thwart label inference attacks by adding noise to gradients. InstaHide [Huang et al., 2020] and Confusional AutoEncoder [Zou et al., 2022] are two representative defense mechanisms that encode private data directly to protect data privacy. Cryptography-based defense mechanisms such as HE [Hardy et al., 2017] and MPC [Gasc´on et al., 2016] can protect both features and labels, but they impose a huge burden on computation and communication, especially for deep neural networks.

3 The ProposedMethod

We introduce the VFL setting and threat models in Sect. 3.1 and Sect. 3.2, followed by elaboration on the proposed adaptive obfuscation framework, FedPass, in Sect. 3.3. We analyze the privacy preserving capability of FedPass in Sect. 3.4.

3.1 Vertical Federated Learning Setting

We assume that a vertical federated learning setting consists of one active party P0 and K passive parties {P1, · · · , PK} who collaboratively train a VFL model Θ = (θ, ω) to optimize the following objective:

in which Party Pk owns features Dk = (xk,1, · · · , xk,n) ∈ Xk and the passive model Gθk , the active party owns the labels y ∈ Y and active model Fω, Xk and Y are the feature space of party Pk and the label space respectively. Each passive party k transfers its forward embedding Hk to the active party to compute the loss. The active model Fω and passive models Gθk , k ∈ {1, . . . ,K} are trained based on backward gradients (See Figure 2 for illustration). Note that, before training, all parties leverage Private Set Intersection (PSI) protocols to align data records with the same IDs.

3.2 Threat Model

We assume all participating parties are semi-honest and do not collude with each other. An adversary (i.e., the attacker) Pk, k = 0, · · · ,K faithfully executes the training protocol but may launch privacy attacks to infer the private data (features or labels) for other parties.

We consider two types of threat models: i) The active party wants to reconstruct the private features of a passive party through the model inversion attack [He et al., 2019] or CAFE attack [Jin et al., 2021]. ii) A passive party wants to infer the private labels of the active party through the model completion attack [Fu et al., 2022a]. Table 1 summarizes threat models considered in this work.

3.3 FedPass

This section illustrates two critical steps of the proposed FedPass, i) embedding private passports to adapt obfuscation; ii) generating passports randomly to improve privacy preserving capability.

Embedding Private Passports

In this work, we adopt the DNN passport technique proposed by [Fan et al., 2019; Fan et al., 2021] as an implementation for the adaptive obfuscation framework of FedPass. Specifically, the adaptive obfuscation is determined as follows:

where W denotes the model parameters of the neural network layer for inserting passports, xin is the input fed toW, γ and β are the scale factor and the bias term. Note that the determination of the crucial parameters γ and β involves the model parameter W with private passports sγ and sβ, followed by a autoencoder (Encoder E and Decoder D with parameters W ′ ) and a average pooling operation Avg(·). Learning adaptive obfuscation formulated in Eq.(4) brings about two desired properties:

• Passport-based parameters γ and β provide strong privacy guarantee (refer to Sect. 3.4): without knowing passports it is exponentially hard for attacker to infer layer input xin from layer output gW(xin, s), because attacker have no access to γ and β (see Theorem 1).
• Learning adaptive obfuscation formulated in Eq. (4) optimizes the model parameter W through three backpropagation paths via β, γ, W, respectively, which helps preserve model performance. This is essentially equivalent to adapting the obfuscation (parameterized by γ and β) to the model parameter W (more explanations in Appendix C); This adaptive obfuscation scheme offers superior model performance compared to fixed obfuscation schemes (see Sect. 4.2).

The training procedure of FedPass in Vertical Federated Learning is illustrated as follows (described in Algorithm 1):

1. Each passive party k applies the adaptive obfuscation to its private features with its private passports spk and then sends the forward embedding Hk to the active party (line 3-9 of Algo. 1);
2. The active party sums over all Hk, k ∈ {1, . . . ,K} as H, and applies the adaptive obfuscation to H with its private passports sa , generating ˜H. Then, the active party computes the loss ˜ ℓ and updates its model through back-propagation. Next, the active party computes gradients ∇Hk ˜ ℓ for each passive party k and sends ∇Hk ˜ ℓ to passive party k (line 10-19 of Algo. 1);
3. Each passive party k updates its model θk according to ∇Hk ˜ ℓ (line 20-22 of Algo. 1).

The three steps iterate until the performance of the joint model does not improve.

Random Passport Generation

How passports are generated is crucial in protecting data privacy. Specifically, when the passports are embedded in a convolution layer or linear layer with c channels 1 , for each channel j ∈ [c], the passport s(j) (the jth element of vector s) is randomly generated as follows:

where all µj, j = 1, · · · , c are different from each other, σ2 is the variance of Gaussian distribution and N is the passport range, which are two crucial parameters of FedPass. The strong privacy-preserving capabilities rooted in such a random passport generation strategy are justified by theoretical analysis in Theorems 1 and 2 as well as experiment results in Sect. 4.2.

3.4 Privacy-Preserving Capability of FedPass

We investigate the privacy-preserving capability of FedPass against feature reconstruction attack and label inference attack. Note that we conduct the privacy analysis with linear regression models, for the sake of brevity. Proofs are deferred to Appendix D.

Definition 1. Define the forward function of the passive model G and the active model F :

• For passive layer: H = G(x) =Wpspγ · Wpx+Wpspβ .
• For active layer: y = F(H) =Wasaγ · WaH +Wasaβ .

where Wp, Wa are 2D matrices of the passive and active models; · denotes the inner product, spγ , spβ are passports of the passive party, saγ , saβ are passports of the active party.

Hardness of Feature Restoration with FedPass

Consider the white-box Model Inversion (MI) attack (i.e., model inversion step in CAFE [Jin et al., 2021; He et al., 2019]) that aims to inverse the model Wp to recover features

1 For the convolution layer, the passport s ∈ Rc×h1×h2 , where c is channel number, h1 and h2 are height and width; for the linear layer, s ∈ Rc×h1 , where c is channel number, h1 is height.

Algorithm 1 FedPass

Input: Communication rounds T, Passive parties number K, learning rate η, batch size b, the passport range and variance {N a , σa } and {N pk , σpk } for the active party and passive party k respectively, the feature dataset Dk = (xk,1, · · · , xk,nk ) owned by passive party k, the aligned label y = (y1, · · · , yn0 ) owned by the active party.

Output: Model parameters θ1, · · · , θK, ω

• 1: Initialize model weights θ1, · · · , θK, ω.
• 2: for t in communication round T do
• 3: ▷ Passive parties perform:
• 4: for Passive Party k in {1, . . . , K} do:
• Sample a batch Bk = (xk,1, · · · , xk,b) from the
• 6: Sample the passport tuple spk = (spk γ , spk β ) according to Eq. (5) and N pk , σpk
• 5: dataset Dk
• 7: Compute ˜ Bk = gθk (Bk, spk )
• 8: Compute Hk ←Gθk ( ˜ Bk)
• 9: Send Hk to the active party
• 10: ▷ The active party performs:
• 11: Obtain the label y matched with {Bk}Kk=1 .
• 12: H = ∑Kk=1 Hk
• 13: Sample the passport tuple sa = (saγ , saβ ) via Eq. (5) and N a , σa
• 14: Compute ˜H = gω(H, sa )
• 15: Sample a batch of the label Y = (y1, · · · , yb)
• 16: Compute cross-entropy loss: ˜ ℓ = ℓ(Fω( ˜H), Y )
• 17: Update the active model as: ω = ω - η∇ω ˜ ℓ
• 18: for k in {1, . . . ,K} do:

19:

ℓ to each passive party k

Compute and send ∇Hk ˜

• 20: ▷ Passive parties perform:
• 21: for Passive Party k ∈ {1, . . . , K} do:
• 22: Update θk by θk = θk - η[∇Hk ˜ ℓ][∇θk Hk ] return θ1, · · · , θK, ω

Algorithm 2 Adaptive Obfuscation (g(·))

Input: Model parameters W of the neural network layer for inserting passports; the input xin to which the adaptive obfuscation applies to; passport keys s = (sγ, sβ). Output: The obfuscated version of the input.

• 1: Compute γ = Avg (D(E(W ∗ sγ)))
• 2: Compute β = Avg (D(E(W ∗ sβ)))
• 3: return γ(W ∗ xin) +β

ˆx approximating original features x. In this case, the attacker (i.e., the active party) knows the passive model parameters Wp, forward embedding H and the way of embedding passport, but does not know the passport.

Theorem 1. Suppose the passive party protects features x by inserting the spβ . The probability of recovering features by the attacker via white-boxMI attack is at most πm/2 ϵm Γ(1+m/2)N m such that the recovering error is less than ϵ, i.e., ∥x- ˆx∥2 ≤ ϵ, where m denotes the dimension of the passport via flattening, N denotes the passport range formulated in Eq. (5) and Γ(·) denotes the Gamma distribution. Theorem 1 demonstrates the attacker's probability of recovering features within error ϵ is exponentially small in the dimension of passport size m. The successful recovering probability is inversely proportional to the passport range N to the power of m.

Hardness of Label Recovery with FedPass

Consider the passive model competition attack [Fu et al., 2022a] that aims to recover labels owned by the active party. The attacker (i.e., the passive party) leverages a small auxiliary labeled dataset {xi, yi}na i=1 belonging to the original training data to train the attack model Watt, and then infer labels for the test data. Note that the attacker knows the trained passive model G and forward embedding Hi = G(xi). Therefore, they optimizes the attack model Watt by minimizing ℓ = ∑na i=1 ∥WattHi - yi∥2.

Assumption 1. Suppose the original main algorithm of VFL is convergent. For the attack model, we assume the error of the optimized attack model W ∗ att on test data ˜ ℓt is larger than that of the auxiliary labeled dataset ˜ ℓa.

Theorem 2. Suppose the active party protect y by embedding saγ , and adversaries aim to recover labels on the test data with the error ˜ ℓt satisfying:

where Ti = diag(Wasaγ,i )Wa and saγ,i is the passport for the label yi embedded in the active model. Moreover, if Hi1 = Hi2 = H for any 1 ≤ i1, i2 ≤ na, then

Proposition 1. Since passports are randomly generated and Wa and H are fixed, if the Wa = I,H = ⃗1, then it follows that:

Theorem 2 and Proposition 1 show that the label recovery error ˜ ℓt has a lower bound, which deserves further explanations. First, when passports are randomly generated for all data, i.e., saγ,i1 ̸= saγ,i2 , then a non-zero label recovery error is guaranteed no matter how adversaries attempt to minimize it. The recovery error thus acts as a protective random noise imposed on true labels. Second, the magnitude of the recovery error monotonically increases with the variance σ2 of the Gaussian distribution passports sample from (in Eq. (5)), which is a crucial parameter to control privacy-preserving capability (see Experiment results in Appendix B) are in accordance with Theorem 2. Third, it is worth noting that the lower bound is based on the training error of the auxiliary data used by adversaries to launch PMC attacks. Given possible discrepancies between the auxiliary data and private labels, e.g., in terms of distributions and the number of dataset samples, the actual recovery error of private labels can be much larger than the lower bound. Again, this strong protection is observed in experiments (see Sect. 4.2).

4 Experiment

We present empirical studies of FedPass in defending against feature reconstruction attack and label inference attack.

4.1 Experiment Setting

Models & Datasets & VFL Setting

We conduct experiments on three datasets: MNIST [LeCun et al., 2010], CIFAR10 [Krizhevsky et al., 2014] and ModelNet [Wu et al., 2015]. We adopt LeNet [LeCun et al., 1998] for conducting experiments on MNIST and adopt AlexNet [Krizhevsky et al., 2012] and ResNet18 [He et al., 2016] on CIFAR10. For each dataset, passive party only provides private data while active party only provides labels.

We simulate a VFL scenario by splitting a neural network into a bottom model and a top model and assigning the bottom model to each passive party and the top model to the active party (see details of the experimental setting in Appendix A).

Privacy Attack Methods

We investigate the effectiveness of FedPass through three privacy attacks designed for VFL, namely, Passive Model Completion (PMC) attack [Fu et al., 2022a], CAFE attack [Jin et al., 2021] and Model Inversion (MI) attack [He et al., 2019]. The first attack is a label inference attack, whereas the last two are feature reconstruction attacks (see details in Appendix A).

Baseline Defense Methods

We adopt four defense mechanisms as baselines to evaluate the effectiveness of FedPass in defending against feature reconstruction and label inference attacks. Each defense mechanism is controlled by a defense strength parameter to trade-off privacy leakage and model performance. For Differential Privacy (DP) [Abadi et al., 2016], we experiment with Gaussian noise levels ranging from 5e-5 to 1.0. We add noise to gradients for defending against MC attack while add noise to forward embeddings for thwarting CAFE and MI attacks. For Sparsification [Fu et al., 2022a; Lin et al., 2018], we implement gradient sparsification [Fu et al., 2022a] and forward embedding sparsification [Lin et al., 2018] for defending against label inference attack and feature reconstruction attack, respectively. Sparsification level are chosen from 0.1% to 50.0%. For Confusional AutoEncoder (CAE) [Zou et al., 2022], we follow the implementation of the original paper. That is, both the encoder and decoder of CAE have the architecture of 2 FC layers. Values of the hyperparameter that controls the confusion level are chosen from 0.0 to 2.0. For InstaHide [Huang et al., 2020], we mix up 1 to 4 of images to trade-off privacy and utility. For FedPass, the range of the mean of Gaussian distribution N is from 2 to 200, the variance is from 1 to 64. Passports are embedded in the last convolution layer of the passive party's model and first fully connected layer of the active party's model.

Evaluation Metrics

We use data (feature or label) recovery error and main task accuracy to evaluate defense mechanisms. We adopt the ratio of incorrectly labeled samples by a label inference attack to all labeled samples to measure the performance of that label inference attack. We adopt Mean Square Error (MSE) [Zhu et al., 2019] between original images and images recovered by a feature reconstruction attack to measure the performance of that feature reconstruction attack. MSE is widely used to assess the quality of recovered images. A higher MSE value indicates a higher image recovery error. In addition, we leverage Calibrated Averaged Performance (CAP) [Fan et al., 2020] to quantify the trade-off between main task accuracy and data recovery error. CAP is defined as follows:

Definition 2 (Calibrated Averaged Performance (CAP)). For a given Privacy-Preserving Mechanism gs ∈ G (s denotes the controlled parameter of g, e.g., the sparsification level, noise level and passport range) and attack mechanism a ∈ A, the Calibrated Averaged Performance is defined as:

where Acc(·) denotes the main task accuracy and Rerr(·) denotes the recovery error between original data x and estimated data ˆxs via attack a.

4.2 Experiment Results

Defending against the Feature Reconstruction Attack

Figure 4 (a)-(f) compare the trade-offs between feature recovery error (y-axis) and main task accuracy (x-axis) of FedPass with those of baselines against MI and CAFE attacks on three models. We observe: i) DP and Sparsification can generally achieve either a high main task performance or a large feature recovery error (low privacy leakage), but not both. For example, DP and Sparsification can achieve a main task performance as high as ≥ 0.90 while obtaining a feature recovery error as low as ≤ 0.06 on ResNet-CIFAR10. At the other extreme, DP and Sparsification can achieve ≥ 0.11 feature recovery error but obtain ≤ 0.70 main task performance on ResNet-CIFAR10. ii) InstaHide generally can not thwart MI and CAFE attacks. Even mixing up with more data, InstaHide still leads to a relatively small feature recovery error while its main task performance degrades significantly. iii) The trade-off curves of FedPass reside near the top-right corner under both attacks on all models, indicating that FedPass achieves the best performance on preserving feature privacy while maintaining the model performance. For example, FedPass achieves ≥ 0.91 main task accuracy and ≥ 0.12 feature recovery error under MI and CAFE attacks on ResNet-CIFAR10. Table 2 also demonstrates that FedPass has the best trade-off between privacy and performance under MI and CAFE attacks.

Figure 5 showcases that, when protected by FedPass (r8), reconstructed images under the CAFE attack on all three datasets are essentially random noise, manifesting that FedPass can thwart the CAFE attack effectively. At the same time, the model performance of FedPass is almost lossless compared to that of the original model (w/o defense) on every dataset (see Figure 4). This superior trade-off of FedPass is in sharp contrast to existing methods, among which DP and Sparsification with high protection levels (r5 and r7) lead to significantly deteriorated model performance.

Defending against the Label Inference Attack

Figure 4 (g)-(i) compare the trade-offs between label recovery error (y-axis) and main task accuracy (x-axis) of FedPass with those of baselines in the face of the PMC attack on three models. It is observed DP, Sparsification, and CAE fail to achieve the goal of obtaining a low level of privacy leakage while maintaining model performance, whereas FedPass is more toward the top-right corner, indicating that FedPass has a better trade-off between privacy and performance. Table 2

reinforce the observation that FedPass achieves the best tradeoff between privacy and performance under PMC attack.

Training and Inference Time

Table 3 investigates the training time (for one epoch) and inference time for FedPass and baseline defense methods. It shows that the FedPass is as efficient as the VFL w/o defense for both training and inference procedures (the training time on MNIST for each epoch is 7.03s and inference time is 1.48s) because embedding passport only introduces a few model parameters to train. It is worth noting that the training time of InstaHide is almost twice that of other methods because InstaHide involves mixing-up multiple feature vectors or labels, which is time-consuming.

5 Conclusion

This paper proposes a novel privacy-preserving vertical federated deep learning framework called FedPass, which leverages adaptive obfuscation to protect the label and data simultaneously. Specifically, the proposed adaptive obfuscation is implemented by embedding private passports in the passive and active models to adapt the deep learning model such that the model performance is preserved. The extensive experiments on multiple datasets and theoretical analysis demonstrate that the FedPass can achieve significant improvements over the other protected methods in terms of model performance and privacy-preserving ability.

Acknowledgements

This work is partly supported by National Key Research and Development Program of China (2020YFB1805501).

Contribution Statement

Hanlin Gu and Jiahuan Luo contributed equally to this work. Lixin Fan is the corresponding author.