Feature Reconstruction Attacks and Countermeasures of DNN training in Vertical Federated Learning
Federated learning (FL) has increasingly been deployed, in its vertical form, among organizations to facilitate secure collaborative training over siloed data. In vertical FL (VFL), participants hold disjoint features of the same set of sample instances. Among them, only one has labels. This participant, known as the active party, initiates the training and interacts with the other participants, known as the passive parties. Despite the increasing adoption of VFL, it remains largely unknown if and how the active party can extract feature data from the passive party, especially when training deep neural network (DNN) models. This paper makes the first attempt to study the feature security problem of DNN training in VFL. We consider a DNN model partitioned between active and passive parties, where the latter only holds a subset of the input layer and exhibits some categorical features of binary values. Using a reduction from the Exact Cover problem, we prove that reconstructing those binary features is NP-hard. Through analysis, we demonstrate that, unless the feature dimension is exceedingly large, it remains feasible, both theoretically and practically, to launch a reconstruction attack with an efficient search-based algorithm that prevails over current feature protection techniques. To address this problem, we develop a novel feature protection scheme against the reconstruction attack that effectively misleads the search to some pre-specified random values. With an extensive set of experiments, we show that our protection scheme sustains the feature reconstruction attack in various VFL applications at no expense of accuracy loss.
Code (1)
Tasks
Federated LearningReconstruction AttackVertical Federated LearningSimilar Papers 제목 키워드 기반
Just a Simple Transformation is Enough for Data Protection in Vertical Federated Learning
Vertical Federated Learning (VFL) aims to enable collaborative training of deep learning models while maintaining privacy protection. However, the VFL procedure still has components that are vulnerable to attacks by mali…
Federated LearningPrivacy Preserving Deep LearningVertical Federated LearningBadVFL: Backdoor Attacks in Vertical Federated Learning
Federated learning (FL) enables multiple parties to collaboratively train a machine learning model without sharing their data; rather, they train their own model locally and send updates to a central server for aggregati…
Backdoor AttackFederated LearningFraud DetectionVertical Federated LearningPRIVEE: Privacy-Preserving Vertical Federated Learning Against Feature Inference Attacks
Vertical Federated Learning (VFL) enables collaborative model training across organizations that share common user samples but hold disjoint feature spaces. Despite its potential, VFL is susceptible to feature inference …
Federated LearningA Survey of Privacy Threats and Defense in Vertical Federated Learning: From Model Life Cycle Perspective
Vertical Federated Learning (VFL) is a federated learning paradigm where multiple participants, who share the same set of samples but hold different features, jointly train machine learning models. Although VFL enables c…
Federated LearningSurveyVertical Federated LearningDefending against Reconstruction Attack in Vertical Federated Learning
Recently researchers have studied input leakage problems in Federated Learning (FL) where a malicious party can reconstruct sensitive training inputs provided by users from shared gradient. It raises concerns about FL si…
Federated LearningPrivacy PreservingReconstruction AttackVertical Federated Learning