🤖 AI Summary
This work addresses a novel privacy threat in vertical federated learning (VFL): active parties—equipped with ground-truth labels—perform “agnostic inference attacks” (AIAs) against passive parties’ features, inferring sensitive information without requiring prior knowledge of sample confidence scores. We formally define AIA for the first time and propose a parameter-controllable privacy-preserving mechanism. Methodologically, we design a confidence-augmented logistic regression model, integrating randomized perturbation of passive-party features with a joint privacy-utility optimization framework—preserving model interpretability while enabling rigorous privacy-utility trade-offs. Experiments on benchmark datasets (e.g., CIFAR-10) demonstrate that our approach reduces AIA success rates by over 60%, with less than 2% degradation in model accuracy. This establishes a principled, practical defense against label-leakage-driven inference attacks in VFL settings.
📝 Abstract
A novel form of inference attack in vertical federated learning (VFL) is proposed, where two parties collaborate in training a machine learning (ML) model. Logistic regression is considered for the VFL model. One party, referred to as the active party, possesses the ground truth labels of the samples in the training phase, while the other, referred to as the passive party, only shares a separate set of features corresponding to these samples. It is shown that the active party can carry out inference attacks on both training and prediction phase samples by acquiring an ML model independently trained on the training samples available to them. This type of inference attack does not require the active party to be aware of the score of a specific sample, hence it is referred to as an agnostic inference attack. It is shown that utilizing the observed confidence scores during the prediction phase, before the time of the attack, can improve the performance of the active party's autonomous model, and thus improve the quality of the agnostic inference attack. As a countermeasure, privacy-preserving schemes (PPSs) are proposed. While the proposed schemes preserve the utility of the VFL model, they systematically distort the VFL parameters corresponding to the passive party's features. The level of the distortion imposed on the passive party's parameters is adjustable, giving rise to a trade-off between privacy of the passive party and interpretabiliy of the VFL outcomes by the active party. The distortion level of the passive party's parameters could be chosen carefully according to the privacy and interpretabiliy concerns of the passive and active parties, respectively, with the hope of keeping both parties (partially) satisfied. Finally, experimental results demonstrate the effectiveness of the proposed attack and the PPSs.
