BlindFL: Vertical Federated Machine Learning without Peeking into Your Data

Abstract

Due to the rising concerns on privacy protection, how to build machine learning (ML) models over different data sources with security guarantees is gaining more popularity. Vertical federated learning (VFL) describes such a case where ML models are built upon the private data of different participated parties that own disjoint features for the same set of instances, which fits many real-world collaborative tasks. Nevertheless, we find that existing solutions for VFL either support limited kinds of input features or suffer from potential data leakage during the federated execution. To this end, this paper aims to investigate both the functionality and security of ML modes in the VFL scenario.To be specific, we introduce BlindFL, a novel framework for VFL training and inference. First, to address the functionality of VFL models, we propose the federated source layers to unite the data from different parties. Various kinds of features can be supported efficiently by the federated source layers, including dense, sparse, numerical, and categorical features. Second, we carefully analyze the security during the federated execution and formalize the privacy requirements. Based on the analysis, we devise secure and accurate algorithm protocols, and further prove the security guarantees under the ideal-real simulation paradigm. Extensive experiments show that BlindFL supports diverse datasets and models efficiently whilst achieves robust privacy guarantees. CCS CONCEPTS• Computing methodologies → Machine learning; • Security and privacy → Privacy-preserving protocols.

GTV: Generating Tabular Data via Vertical Federated Learning

“…In line with many previous works in the field of VFL [9,13,14,44], we focus on the semi-honest model in the design of our proposed GTV architecture. Specifically, we assume that the clients and server are honest but curious, meaning that they adhere to the GTV protocol, but may seek to acquire additional information through the computation process.…”

“…However, in real-world scenarios, it is possible for clients to have instances that are not present in other clients' data. In this study, we do not address this issue and assume that data alignment can be addressed through the use of the Private Set Intersection technique [4,7], a common approach in other VFL studies [13,14,44]. In real-world scenarios, it is possible for clients to possess overlapping features.…”

“…In this process the generator G takes the loss Loss G (D 𝑡 (D 𝑡 𝑖𝑛𝑆 )) as input and updates its model parameters using the Stochastic Gradient Descent (SGD) method. Leakage of labels is a significant concern in the backpropagation process of traditional VFL classification models [11,14]. However, this risk does not apply for G because (i) the backpropagation of G does not involve the use of real dataset 𝑇 𝑖 , as outlined in Section 3.1.4; (ii) G is not a classifier, and thus, the concept of 'label' is not applicable.…”

“…Additionally, it is each client who labels real and fake for the data instances. Therefore, the threat models mentioned in [11,14,27] do not apply for D, since they all assume that a malicious client, or multiple clients, attempt to infer the label column which they do not possess.…”

A survey on security and privacy threats to federated learning

“…Furthermore, Chamani and Papadopoulos [29] uses TEE to design PSFT algorithm. [90,69,217,36] further improve the security of PSFT algorithms by fusing SMPC and HE. Recently, Liu et al [129] provides an overview of federal learning algorithms by features.…”