SecretKeeper: Robust Vertical Federated Learning Against Label Inference Attacks

Federated learning (FL) is a privacy-preserving machine learning paradigm that allows multiple participants to collaboratively train one model without revealing their local datasets. As one variant of FL, vertical federated learning (VFL) is designed for the scenario where a few participants’ local datasets share the same sample space but differ in the feature space, with the training labels owned by one of the participants. The participant owning the training labels is referred to as the active party, while the remaining participants are known as passive parties. Though VFL is considered to be able to protect each participant’s local data, recent studies find that VFL has potential risks of privacy leakage. A typical privacy risk of VFL is the leakage of labels. By abusing the parameters of the trained local bottom model, a malicious passive party can infer training labels privately owned by the active party and even labels of testing samples. Existing defense methods against label inference attacks are limited to a specific type of VFL framework. Specifically, existing defenses are designed for VFL without model splitting and cannot be applied to VFL with model splitting. To bridge this gap, we propose the first defense for split-learning-based VFL against label inference attacks. The experimental results across multiple datasets and model architectures demonstrate the efficacy of our defense in reducing the label inference accuracy of the malicious party, while incurring only minimal performance degradation in the federated models’ original task.