Label Leakage in Vertical Federated Learning: A Survey

1 Introduction

Federated learning (FL) [McMahan et al., 2016] is a distributed machine learning paradigm that enables multiple participants to train a model collaboratively. FL can be classified into three different forms based on the different divisions of data characteristics [Yang et al., 2019]: horizontal federated learning (HFL), vertical federated learning (VFL), and federated transfer learning (FTL). In VFL, only one participant (active party) owns sample labels (and may also own the features simultaneously), while the other participants (passive party) exclusively hold the sample features. The models between the passive and active parties are not accessible to each other. While this setup provides some level of privacy preservation, VFL still faces numerous threats, including reconstruction attacks [Vepakomma et al., 2019; Sun et al., 2021], feature inference attacks [Abuadbba et al., 2020; Pasquini et al., 2021], and label inference attacks (LIA) [Fu et al., 2022a; Liu and Lyu, 2022; Kariyappa and Qureshi, 2023]. Among these challenges, LIA is typically launched by the honestbut-curious passive parties who act as attackers attempting to infer labels owned by the active party from gradients or embeddings. LIA is a specific attack in VFL scenarios because the sample features and labels are not simultaneously owned by the participating parties. Therefore, studying LIA under VFL presents an intriguing and interesting challenge.

* corresponding author

In addition, extensive research has been conducted on FL, leading to ample surveys covering various aspects such as FL challenges and applications [Wen et al., 2023], communication and computation [Almanifi et al., 2023], security and privacy threats [Rodr´ıguez-Barroso et al., 2023], and others [Kairouz et al., 2021; Soltani et al., 2023]. However, it is important to note that most of these surveys provide an overall perspective on FL but do not delve into VFL aspects. Therefore, despite the widespread use of VFL in the real world, there is a lack of surveys specifically focused on VFL. Liu et al. [2024] provided an overall overview of VFL, but unfortunately, the discussion of LIA was limited and several pertinent details were not included.

To fill the existing gap in the comprehensive summary of the VFL-specific label leakage threat and promote further research on VFL, we conduct this survey on label leakage in VFL scenarios. We focus on two aspects: attack and defense, and propose two new taxonomies for each of them. In addition to summarizing existing research, we highlight techniques that we believe hold potential and could significantly influence future studies. To facilitate a fair and effective evaluation of LIA research, we also compile a summary of experimental benchmark datasets and evaluation metrics.

2 Vertical Federated Learning

VFL, a distributed collaborative machine learning paradigm designed for distributed environments, is primarily derived from FL. According to the classification of FL [Yang et al., 2019], HFL participants share the same feature space but have different samples [McMahan et al., 2016; Zeng et al., 2023; Xue et al., 2024], and VFL participants share the same sample or user space but have different features [Gu et al., 2023; Li et al., 2023; Wu et al., 2023b]. Therefore, the VFL architecture typically consists of multiple passive parties with different features and one active party with additional labels. Due to the inaccessibility between VFL embedding models

(bottom models) and the prediction model (top model), VFL can offer stronger privacy preservation compared to HFL models with shared parameters.

In addition, it is worth noting that the structure of the VFL model also satisfies the split learning (SL) [Vepakomma et al., 2018] concept. SL decomposes the machine learning model into multiple parts and trains it by multiple participants collaboratively. The classical architectures of SL can be classified into three categories based on the form of data cuts: simple vanilla split learning, U-shaped split learning, and vertical split learning (VSL). However, among these architectures, simple vanilla split learning can be considered a two-party VFL. VSL enables multiple participants with different data partitions to collaboratively train the model, which can be regarded as a special and state-of-the-art VFL method [Bai et al., 2023]. Therefore, in the paper, we will focus on label inference attacks and defenses using the VFL concept.

As shown in Figure 1, VFL [Yang et al., 2019] collaboratively trains a machine learning model with K participants and N samples, including only one active party that owns the data labels {yi}Ni=1 , and multiple passive parties with nonlabel data. Each passive party k owns the different feature datasets {xki }Ni=1 . Note that the active party can also have the feature dataset. Without loss of generality, we assume that all participants have a feature dataset and a local model fk (·) parameterized by θk, while the active party has a prediction model pred (·) parameterized by ϕ additionally. Then the collaborative training task can be formulated as:

Forward Propagation. Each participant trains its local model and sends corresponding embedding vectors embki = fk (θk; xki ) to the active party. The active party aggregates these embedding vectors into whole embedding embi = agg (emb1i , . . . , embKi ) by a certain aggregation function and trains the prediction model through labels with the loss function as follows:

where ℓ (·) denotes the sample loss such as cross-entropy loss and mean squared error loss.

Backpropagation. The active party backpropagates the gradient ∇embki L = ∂L ∂embki to each participant and gradient ∇ϕL to its own. With the chain rule, each participant computes the gradient of the local model and both the local and prediction models update the parameters as shown below:

where t denotes the iteration and η denotes the learning rate.

3 Label Inference Attacks

As a specific attack designed for VFL scenarios, LIA is typically initiated by the passive parties to infer the label for its privacy or commercial value. The security assumptions of LIA can be defined as follows.

Threat Model. In most cases, LIA assumes that all passive parties are honest-but-curious and do not collude with each other, and they can not access the labels of the active party. They possess different local datasets and corresponding indexes, but they are unable to modify the orders. So they need to follow the VFL protocol mentioned in Section 2 to collaboratively train the model. However, these passive parties can also act as attackers and attempt to infer labels using the available information, such as embeddings, gradients, and a limited amount of auxiliary data. In the worst case, they can even use a malicious local optimizer to maximize their attack performance [Fu et al., 2022a]. Different LIA approaches have different auxiliary data assumptions (e.g., labeled samples and label distribution) that will be introduced later. Moreover, attacks can be launched at any epoch or iteration of VFL, including the training and inference phases.

In this section, we propose a new taxonomy of LIA and provide a comprehensive summary of existing LIA approaches. The taxonomy first separates LIA into two categories based on the VFL models, including the neural networks and other models (tree-based models and regression models). Since most LIAs focus on neural networks, we further classify LIA on neural networks into the attack approaches it uses. This taxonomy provides a clear overview of the existing LIA research landscape. In addition, we explore the related techniques and works in this field and hope to inspire future research on LIA.

3.1 Attacks on Neural Networks

Neural networks serve as the most commonly utilized model in VFL, making them a prime target for LIA. It is worth mentioning that besides the classification presented below, these attacks can be further subdivided based on the type of neural network employed, such as CNN [Kariyappa and Qureshi, 2023; Liu and Lyu, 2022] and GNN [Arazzi et al., 2023], as well as the specific task they aim to exploit, including classification, recognition [Liu and Lyu, 2022; Zheng et al., 2022; Kariyappa and Qureshi, 2023], and recommendation [Fu et al., 2022a; Sun et al., 2022; Kariyappa and Qureshi, 2023].

LIA with Gradient Sign and Magnitude

During the training of VFL models, the most direct labelrelated information attackers can obtain is the gradients backpropagated by the active party. Therefore, an intuitive approach is to infer the label from them. Zhao et al. [2020] were the first to discover and propose the following property regarding the relationship between gradient signs and labels:

Property 1. In the classification task, when the last layer of the neural network is predicted using the softmax function and cross-entropy loss function with one-hot labels, only the gradient corresponding to the ground-truth label in the last layer has a negative sign, while the gradients for the other labels are positive.

Based on the aforementioned findings, a series of studies [Liu et al., 2020; Wainakh et al., 2022; Wainakh et al., 2021; Zhang et al., 2022; Fu et al., 2022a; Liu and Lyu, 2022; Zou et al., 2022] have utilized Property 1 to implement LIA in VFL scenario.

Notably, for VFL, the gradient of the active party backpropagation can be written as:

To satisfy Equation (4), no network structure should be included between embedding vectors embi and the logit zi. Otherwise, ∂zi ∂embi will contain parameters that are not accessible to the passive party. An alternative approach is that the attacker can directly access the gradients of the last layer, but this is a strong assumption for LIA. Furthermore, it is worth noting that this approach has another limitation: the attack can only be performed during the training phase since there are no gradients available in the inference phase.

In addition, Wainakh et al. [2021] found the relationship between gradients and labels from the batch perspective:

Property 2. The gradient magnitude correlates with the number of label occurrences in the batch of training data and is independent of the label types.

For example, gi denotes the gradient corresponding to label i. One occurrence of label i in the training batch results in a gradient value gi-α, so two occurrences of label j result in a gradient value gj -2α. Based on Properties 1 and 2, Wainakh et al. [2021] proposed the LLG algorithm to implement the LIA for batch training.

Except for gradient sign and gradient magnitude, Aggarwal et al. [2021] found that for any finite number of label classes, the labels of a dataset can be accurately inferred from the reported log-loss scores of a single carefully constructed prediction vector if arbitrary precision arithmetic is allowed. They also proposed some practical attack algorithms that can infer labels without the need for model training. These algorithms leverage concepts from number theory and combinatorics, offering a novel approach to label inference.

LIA with Classification and Cluster

Considering that the gradient can reflect the label information, attackers can utilize the backpropagated gradients to train a gradient classifier. Meanwhile, by combining relevant auxiliary data, they can infer the labels corresponding to different gradients. Li et al. [2022] focused on LIA in the two-party scenario. They observed that during training, the model tends to be less confident about a positive example being positive than a negative example being negative. This observation is reflected in the gradients, as the norm of the gradient corresponding to the target label is typically larger than that of the non-target label. Therefore, it is possible to infer whether a gradient is derived from the target label by training an adversarial gradient binary classifier.

Additionally, based on the relationship between the forwarded embeddings and the gradients of the backpropagation, Bai et al. [2023] proposed an algorithm to infer whether a sample belongs to the target label. They argued that for a well-trained local embedding model, sending an unchanged embedding will result in a smaller gradient, while a larger gradient indicates that an embedding with a non-target label was sent. Therefore, combined with a small amount of auxiliary data with known labels, the gradient classifier can be obtained by replacing the embedding to infer label categories.

Furthermore, apart from gradients, labels can also be leaked through forward-propagating embeddings, which was first noticed by [Sun et al., 2022]. They employed the spectral attack [Tran et al., 2018] (a singular value decomposition based method) to differentiate the embedding distribution between target and non-target samples. By leveraging known label distributions or data imbalances, they assigned labels based on the differentiated embedding distribution.

Another similar approach considers the spatial distribution characteristics of gradients and embeddings. It observes that gradients with the same labels tend to be close to each other, while gradients with different labels are far apart. This clustering pattern also holds for embeddings of well-trained models, indicating that both gradients and embeddings exhibit clustering characteristics. In the studies conducted by [Liu and Lyu, 2022; Arazzi et al., 2023], different clustering algorithms for LIA were employed to perform gradient or embedding classification. Specifically, Liu and Lyu [2022] used the K-means algorithm and proposed the cosine similarity metric for gradients and Euclidean distance for embeddings. They also demonstrated that these two metrics are interchangeable under normalized data samples to develop a unified attack for both gradients and embeddings to improve LIA efficiency. On the other hand, Arazzi et al. [2023] first investigated LIA in VFL scenarios using a zero-background knowledge strategy with a particular focus on GNN structures. They leveraged an unsupervised learning algorithm to identify optimal clusters for embeddings generated by the attacker-controlled local model when the number of classes is unknown.

LIA with Model Reconstruction

Model reconstruction, also known as gradient inversion, was initially proposed in the HFL scenario for recovering the raw training data, with DLG [Zhu et al., 2019] being the most prominent method. This approach is also applicable in VFL scenarios. For model reconstruction-based LIA, the attacker simulates the active party's prediction model M and the ground-truth label y by constructing the surrogate model M′ and surrogate label y′ . The attacker then trains the surrogate model M′ to minimize the difference between its loss gradient ∇embL′ and the real gradient ∇embL and updates the surrogate label to achieve the inference.

In [Zhang et al., 2022; Erdo˘gan et al., 2022; Zou et al., 2022; Arazzi et al., 2023; Kariyappa and Qureshi, 2023], model reconstruction was employed to infer labels. In addition, Zhang et al. [2022] proposed to construct surrogate labels with Label Smoothing instead of one-hot labels. It avoids the model being overconfident in label predictions. For example, when considering categories, planes are correlated with birds but differ from tables. However, using one-hot labels would treat planes as equally different from both birds and tables, which does not accurately reflect the real distribution.

Furthermore, Arazzi et al. [2023] found a correspondence between the peak in gradient magnitude and the significant drop in attack accuracy. To address this, they proposed Early Stopping Strategy to enhance the performance of the attack. The strategy aims to identify the optimal point at which to stop the attack process, improving the overall attack accuracy.

Moreover, Kariyappa and Qureshi [2023] introduced a novel loss function called ExPloit Loss for model reconstruction. This loss function satisfies the following optimization objectives when the real gradient and the ground-truth label distribution are known: 1) ensuring that the gradient of the surrogate model closely matches the real gradient; 2) aligning the surrogate label distribution with the ground-truth distribution; 3) minimizing the entropy of surrogate labels to resemble one-hot type ground-truth labels; and 4) achieving high prediction accuracy for the surrogate model, where the predicted labels closely match the surrogate labels. Due to this loss function, the attacker can infer the label by optimizing the surrogate model and label.

LIA with Model Completion

Model completion is a fine-tuning approach used in VFL. At the end of VFL training, passive parties are given a welltrained local embedding model (bottom model). The embeddings generated by this model exhibit a strong correlation with the labels. Leveraging this correlation, attackers can perform fine-tuning on the bottom model using a small amount of auxiliary labeled data, which enables the model to predict or infer labels more accurately.

According to [Fu et al., 2022a], the attacker can employ a specially designed optimizer to train the local model. This optimizer ensures that improved embeddings are sent to the active party in each iteration, thereby increasing the dependency of the prediction model (top model) on the bottom model and enhancing the accuracy of the attack. Additionally, the study found that by abusing the bottom model, the attacker can even infer labels outside of the training dataset.

Furthermore, Zheng et al. [2022] explored defense methods against such an attack approach, which will be discussed in detail later.

3.2 Attacks on Other Models

Except for neural network models, LIA has also been studied in regression models and tree-based models.

In the context of regression models, Tan et al. [2022] proposed the attacker can utilize the residual variables to infer labels in logistic regression models. Specifically, the residual variable is calculated by solving a system of linear equations constructed from the local dataset and the received decrypted gradients. Xie et al. [2023] focused on LIA against continuous labels instead of discrete types. In their study, the target labels are scores rather than categories, and they employed model reconstruction for label reconstruction and inference.

In the context of tree-based models, Takahashi et al. [2023] conducted the attack by extracting graph structures from the data records used to train the tree-based model. They then applied community detection to cluster the learned graphs, where clusters with the same labels imply the same labels.

3.3 Limitations and Future Directions

A successful LIA relies not only on the approaches mentioned above but also on the utilization of important techniques. Therefore, this section also presents some related works and techniques in the field, which may inspire future directions.

Auxiliary Data. Almost all approaches use auxiliary data when implementing LIA, whose types can be summarized as:

• Small amount of data with known labels (which can be involved in training) [Wainakh et al., 2021; Liu and Lyu, 2022; Fu et al., 2022a; Xie et al., 2023].
• Prior distribution of labels [Sun et al., 2022; Kariyappa and Qureshi, 2023].
• Number of label classes [Kariyappa and Qureshi, 2023].
• Imbalanced or biased labels (e.g., the percentage of people with a certain disease in the natural population is almost always much lower than 50%) [Li et al., 2022; Sun et al., 2022].

Different quantities and qualities of auxiliary data typically imply different levels of security assumptions for LIA, with a lesser dependence on auxiliary data indicating more robust LIA capabilities. We recommend that future research should incorporate more realistic auxiliary data, and we also advocate for considering this factor during comparisons.

LIA from Embeddings. The majority of current LIA approaches primarily rely on backpropagated gradients and often overlook the potential leakage of labels through embeddings generated by well-trained local models. However, in the case of well-trained local models, embeddings sent by passive parties can also reveal label information. For instance, as mentioned earlier, Sun et al. [2022] employed the spectral attack to classify embeddings to infer label categories. Additionally, Zheng et al. [2022] devised a specific loss function for embeddings to prevent them from clustering and inadvertently leaking labels.

Learning Rate Adjustment. In VFL scenarios, the attacker is typically the party with less influence or control. However, in specific LIA approaches (model completion [Fu et al., 2022a] and embedding replacement [Bai et al., 2023]), the attack accuracy can be effectively increased by using malicious local optimizer adjusting the learning rate to make the top prediction model more dependent on the attacker's bottom model. Therefore, when the attacker performs LIA using the embeddings generated by the bottom model (e.g., cluster and model completion), it will get better attack performance.

Backdoor Attacks. Backdoor attacks aim to train a model with a hidden backdoor implant that behaves normally on clean inputs and misclassifies inputs that contain triggers. In certain backdoor attacks against VFL [Bai et al., 2023; Naseri et al., 2023], attackers only want to add triggers to data with the target label and not change other data. To achieve this, they first need to infer the labels, which means that LIA is sometimes employed as a part of backdoor attacks.

4 Defenses

There are various defenses to mitigate the label leakage threat. In this section, we propose a new taxonomy of them. It first categorizes these defenses into four main types: generic defenses and specific defenses against gradients, embeddings, and labels. Then we classify these defenses into particular techniques as demonstrated in Figure 2. Specifically, generic defenses are not only designed for LIA, but also can generally defend against other attacks in VFL scenarios, such as feature inference attacks, reconstruction attacks, and sample ID attacks. In contrast, specific defenses are tailored to address different attack approaches used in LIA. These defense strategies primarily focus on safeguarding components that have the potential to leak labels, such as gradients, embeddings, and even labels per se.

4.1 Generic Defenses

Commonly used generic defenses are summarized and recalled in this section.

Homomorphic Encryption. Different from conventional encryption, homomorphic encryption (HE) is a special cryptosystem that supports arithmetic operations on ciphertexts and ensures that the ciphertext computation after decryption is the same as the plaintext computation. In VFL, HE serves as a defense mechanism that prevents attackers from exploiting information in gradients or embeddings [Mohassel and Zhang, 2017; Fu et al., 2022b; Tan et al., 2022; Zhou et al., 2022]. Cheng et al. [2021] focused on addressing the privacy concerns associated with tree-based models and proposed the SecureBoost algorithm to protect the privacy of each participant.

Mutual Information. The essence of LIA is to exploit the mutual information among labels, gradients, and embeddings. Therefore, an intuitive defense is to eliminate this mutual information. Takahashi et al. [2023] proposed a defense mechanism called ID-LMID to reduce the mutual information between labels and instance spaces. In addition, some specific defenses against raw data and intermediate outputs [Zou et al., 2023], gradients [Zou et al., 2022], embeddings [Sun et al., 2022; Erdo˘gan et al., 2022], and labels [Zou et al., 2022; Qiu et al., 2023] can also be considered as mutual information-based methods.

Privacy-preserving Deep Learning. Privacy-preserving deep learning (PPDL) [Shokri and Shmatikov, 2015] is a comprehensive privacy-enhancing method that contains three defense strategies: differential privacy, gradient compression, and random selection. In [Fu et al., 2022a; Bai et al., 2023], they utilized this method to defend against LIA. However, it is important to note that while PPDL effectively protects privacy, it may also lead to a reduction in the model's quality due to the application of DP and gradient compression.

Secure Multi-party Computation. Secure multi-party computation [Knott et al., 2021] leverages cryptographic techniques to facilitate private computation of distributed data held by multiple parties. These techniques involve cryptographic primitives such as secret sharing [Mohassel and Zhang, 2017; Zhou et al., 2022] and homomorphic encryption. Unfortunately, due to their substantial computation and communication overheads, these methods are not commonly employed in VFL scenarios.

Trusted Execution Environments. Trusted execution environments (TEE) [Mo et al., 2021] establish a secure region in the central processor using a combination of hardware and software techniques. This ensures the protection of programs and data loaded inside fulfill confidentiality and integrity. However, TEE is primarily designed for CPU, which can result in underwhelming performance when it comes to VFL computation on GPU. Additionally, the specialized hardware required for TEE implementation can increase costs and potentially limit the generalizability of the solution.

4.2 Specific Defenses against Gradients

Exploiting the properties of gradients (such as gradient sign and magnitude) and the correlation between gradients and labels is a widely used approach in LIA. As a result, numerous defenses against gradients have been derived.

Gradient Compression and Sparsification. Gradient compression is a defense strategy aimed at improving communication efficiency and preserving privacy. One specific technique within gradient compression is gradient sparsification, which involves sharing only a subset of the most important gradients, typically those with the largest absolute values. In various studies [Wainakh et al., 2022; Zou et al., 2022; Fu et al., 2022a; Liu and Lyu, 2022; Arazzi et al., 2023; Bai et al., 2023], researchers have employed this strategy and evaluated parameters like compression ratio and sparsification ratio. However, the experimental results indicate that gradient compression and sparsification have a negative impact on the model's quality and are not particularly effective in defending against LIA. This is because the compressed or sparsified gradients still retain the most significant features, which are often highly correlated with the labels.

Differential Privacy. Differential privacy (DP) [Dwork, 2006] is a widely used privacy-preserving technique that limits the impact of individual data on the overall dataset within a certain range, thereby mitigating the risk of differential attacks. In the context of FL, the DP-SGD algorithm [Abadi et al., 2016] is a famous approach. It involves clipping the gradient and adding noise that satisfies DP during model updating. Researchers in [Liu and Lyu, 2022; Bai et al., 2023] have successfully applied this algorithm to reduce the risk of privacy leakage from gradients. Additionally, the shuffle method [Erlingsson et al., 2019; Cheu et al., 2019] can be used to achieve privacy amplification for DP.

Noise Perturbation. Adding noise to the gradient [Li et al., 2022; Wainakh et al., 2022; Zhang et al., 2022; Fu et al., 2022a; Arazzi et al., 2023; Xie et al., 2023; Kariyappa and Qureshi, 2023] is an intuitive way to perturb the gradient. These noises can alter the distribution of the gradients and in some cases, even change the gradient sign, directly impacting LIA. Moreover, the addition of noise is often associated with DP, with Gaussian and Laplace noise being commonly used. Although these noises may reduce the accuracy of the model, they serve as effective defenses against LIA.

4.3 Specific Defenses against Embeddings

For the well-trained models, since embeddings and labels are highly correlated, an intuitive defense is to reduce this correlation. Inspired by the electrostatic equilibrium and Coulomb's law, particularly the phenomenon of mutual repulsion between like charges (electric charges of the same sign), Zheng et al. [2022] proposed a potential energy loss function. This loss function makes it challenging for an attacker to finetune the bottom model using a small number of samples to infer labels. In addition, Sun et al. [2022] proposed an additional optimization objective dCor (f (X) , Y ) for the active party, which aims to reduce the distance correlation between the embedding and the label. To address the potential data leakage through embeddings, Vepakomma et al. [2019] introduced an additional loss function during training: the logarithm of the distance correlation (DCOR) [Sz´ekely et al., 2007] between the input and the embedding, which was also used in [Pasquini et al., 2021; Erdo˘gan et al., 2022].

4.4 Specific Defenses against Labels

The variability of the labels per se plays a crucial role in information leakage, which has prompted research efforts to develop defenses specifically targeting labels.

Label Differential Privacy. Label DP is a relaxation of DP in which only the privacy of the labels needs to be protected, while the features are public or non-sensitive. Ghazi et al. [2021] used randomized responses to flip the labels and used the generated noisy labels to calculate the loss for training. They demonstrated that their algorithm can achieve label DP. In contrast, Wu et al. [2023a] investigated the connection between the label DP and LIA. Their study showed that it is not reasonable to equate label DP privacy with limiting the accuracy of LIA. In other words, high privacy does not imply the infeasibility of label inference. Similarly, the study by [Busa-Fekete et al., 2021] suggests the idea that label DP may be more vulnerable than initially thought.

Label Extension. Label extension [Qiu et al., 2023] is a method used to obfuscate the label information contained in the gradient by extending the labels. This prevents attackers from using gradients to reconstruct the label inference models. Qiu et al. [2023] proposed the random label extension (RLE) method, which simply extends the original labels with random vectors. Additionally, they proposed a modelbased adaptive label extension (MLE) method. In MLE, the dimension where locating the original label is designed to dominate the training process, which aims to improve the performance of the original task when applying the defense.

Label Disguise. Label disguise [Zou et al., 2022] is a method that transforms original labels to soft fake labels on the active party. It has an encoder-decoder structure that maps the original labels into the fake label space via a confusional autoencoder and recovers the labels from the fake labels via a decoder. Zou et al. [2022] devised a specific loss function for this structure, which incorporates the following objectives: 1) the fake labels should be less relevant to the original labels; 2) the recovered labels should be close to the original labels; and 3) the fake labels entropy should be large since high entropy implies low confidence in the prediction.

5 Experimental Datasets andMetrics

To guide the evaluation of future LIA approaches, we provide a summary of the experimental benchmark datasets and evaluation metrics in this section.

• 3 StatLib, California Housing dataset, https://www.dcc.fc.up.pt/∼ltorgo/Regression/cal housing.html

Table 1: Summary of benchmark datasets used in LIA.

when comparing the different LIA approaches.

In addition, some classification-based LIA approaches also plot the receiver operating characteristic (ROC) curve and calculate the area under the curve (AUC) to evaluate the accuracy of the classifier [Li et al., 2022; Sun et al., 2022]. In some cluster-based approaches, the performance of the clusters formed by gradients or embeddings directly impacts the effectiveness of the attack. To visually evaluate it, these approaches often plot the clusters using t-SNE [Fu et al., 2022a] or principal component analysis (PCA) [Liu and Lyu, 2022].

In LIA based on model reconstruction, the accuracy of the attack is often positively correlated with the accuracy of the model. Therefore, the model accuracy is also considered an important evaluation metric in such cases [Erdo˘gan et al., 2022; Arazzi et al., 2023; Kariyappa and Qureshi, 2023].

6 Conclusion

Focusing on the VFL-specific label leakage threat, this survey aims to provide a comprehensive summary of existing research from both attack and defense perspectives. It proposes two new taxonomies to categorize these attack and defense approaches, while also highlighting the importance of experimental benchmark datasets and evaluation metrics. Although many attack approaches have been proposed, there is a notable deficiency in studying the impact of auxiliary datasets on LIA and detecting malicious local optimizers. It is recommended that future research investigates these aspects to further enhance the understanding of LIA. As a rapidly evolving field, LIA holds great potential for future advancements. This survey serves to consolidate existing knowledge and provide a foundation for future work in this area. We hope that researchers in VFL will recognize the threats posed by LIA and take appropriate measures to mitigate them.

5.1 Benchmark Datasets

Similar to other attacks in the VFL scenario, LIA focuses on various tasks across multiple models, with a particular emphasis on classification and recognition tasks. In this section, we summarize the benchmark datasets commonly used for different models and tasks in Table 1.

Specifically, these benchmark datasets are typically utilized in the context of neural networks and regression models. Under the neural networks, the benchmark datasets are further categorized into two parts classification and recognition and recommendation based on the tasks, while the main task of the regression model is prediction.

We recommend that future LIA studies should be evaluated on these benchmark datasets to ensure fairness and facilitate meaningful comparisons.

5.2 EvaluationMetrics

To evaluate the performance of LIA, the majority of approaches [Wainakh et al., 2021; Wainakh et al., 2022; Liu and Lyu, 2022; Fu et al., 2022a; Zheng et al., 2022; Arazzi et al., 2023; Kariyappa and Qureshi, 2023] use a classical metric Attack Accuracy, which denotes the percentage of all attack samples whose labels are inferred correctly. A higher attack accuracy typically indicates a more successful attack. Additionally, this metric often considers the accuracy of the first k inferences like Top-1 and Top-5 accuracy.

As part of LIA, the quality and the quantity of auxiliary data have a direct impact on the success of the attack [Wainakh et al., 2021; Fu et al., 2022a; Xie et al., 2023]. Even a small amount of auxiliary data can significantly enhance the attack accuracy [Fu et al., 2022a]. We recommend that the impact of auxiliary data on attacks should be evaluated in all LIA approaches that utilize auxiliary data. Furthermore, it is important to keep the auxiliary data consistent

Acknowledgments

This work was supported by the National Key R&D Program of China under Grant 2021YFF1201102, the National Natural Science Foundation of China under Grants 62172016, 61932001 and 61972005, and the Tsinghua University (AIR)- Asiainfo Technologies (China) Inc. Joint Research Center.