PRIVEE: Privacy-Preserving Vertical Federated Learning Against Feature Inference Attacks
This addresses a critical privacy problem for organizations using VFL to collaborate on model training without sharing data, offering a novel defense against attacks that could compromise sensitive features.
The paper tackles the vulnerability of Vertical Federated Learning (VFL) to feature inference attacks, where adversarial parties can reconstruct private input features from shared confidence scores, and proposes PRIVEE, a defense mechanism that obfuscates these scores while preserving model accuracy, achieving a threefold improvement in privacy protection over state-of-the-art defenses.
Vertical Federated Learning (VFL) enables collaborative model training across organizations that share common user samples but hold disjoint feature spaces. Despite its potential, VFL is susceptible to feature inference attacks, in which adversarial parties exploit shared confidence scores (i.e., prediction probabilities) during inference to reconstruct private input features of other participants. To counter this threat, we propose PRIVEE (PRIvacy-preserving Vertical fEderated lEarning), a novel defense mechanism named after the French word privée, meaning "private." PRIVEE obfuscates confidence scores while preserving critical properties such as relative ranking and inter-score distances. Rather than exposing raw scores, PRIVEE shares only the transformed representations, mitigating the risk of reconstruction attacks without degrading model prediction accuracy. Extensive experiments show that PRIVEE achieves a threefold improvement in privacy protection compared to state-of-the-art defenses, while preserving full predictive performance against advanced feature inference attacks.