Secure and Privacy-Preserving Vertical Federated Learning

Shan Jin; Sai Rahul Rachuri; Yizhen Wang; Anderson C. A. Nascimento; Yiwei Cai

cs.CRApr 15, 2026

Secure and Privacy-Preserving Vertical Federated Learning

Authors: Shan Jin, Sai Rahul Rachuri, Yizhen Wang, Anderson C. A. Nascimento, Yiwei Cai

Organizations: Visa Research

Abstract

We propose a novel end-to-end privacy-preserving framework, instantiated by three efficient protocols for different deployment scenarios, covering both input and output privacy, for the vertically split scenario in federated learning (FL), where features are split across clients and labels are not shared by all parties. We do so by distributing the role of the aggregator in FL into multiple servers and having them run secure multiparty computation (MPC) protocols to perform model and feature aggregation and apply differential privacy (DP) to the final released model. While a naive solution would have the clients delegating the entirety of training to run in MPC between the servers, our optimized solution, which supports purely global and also global-local models updates with privacy-preserving, drastically reduces the amount of computation and communication performed using multiparty computation. The experimental results also show the effectiveness of our protocols.

Figures & tables

Panel of Figure 1 — Figure 1. Training a Global model with Frozen Local models under Gaussian Mechanism with Shuffling

Panel of Figure 2 — Figure 2. Training a Global model with Frozen Local models under Banded Matrix Factorization Mechanism

Panel of Figure 3 — Figure 3. Training a Global model and Local models under Banded Matrix Factorization Mechanism

Dataset	Method	Pre-ImageNet					Pre-Cifar100
CIFAR-10		Non-DP					Non-DP
	Plain	90.01					91.42
		DP					DP
		${\varepsilon=1}$	${\varepsilon=2}$	${\varepsilon=5}$	${\varepsilon=8}$	${\varepsilon=10}$	${\varepsilon=1}$	${\varepsilon=2}$	${\varepsilon=5}$	${\varepsilon=8}$	${\varepsilon=10}$
	G-Shuff	69.38	71.78	73.27	73.69	73.76	81.19	81.51	81.62	81.67	81.69
	G-BMF (Setting 1)	69.25	70.73	71.19	71.22	71.24	77.22	77.28	77.31	77.34	77.37

Table 1. Test Accuracy (

\%

) versus Different Datasets, Pre-training, and Privacy Budgets (20 epochs)

Dataset	$\epsilon$	Method
Dataset	$\epsilon$	G-Shuff	G-BMF (Setting 1)	G-BMF (Setting 2)	GL-BMF (Setting 1)	GL-BMF (Setting 2)	LDP-G	LDP-GL
CIFAR-10	$1$	63.71	65.14	49.14	65.97	51.32	10.29	10.56
	$2$	69.09	70.66	55.16	71.23	56.26	11.14	11.36
	$5$	71.93	73.63	61.47	74.09	62.29	16.69	17.14
	$8$	72.89	74.25	64.42	74.59	65.32	23.97	24.51
	$10$	73.88	74.41	65.85	74.78	66.61	28.16	28.89

Table 2. Test Accuracy (

\%

) versus Different Privacy Budgets, LDP (100 epochs)

Dataset	$\epsilon$	Method
Dataset	$\epsilon$	G-Shuff	G-BMF	GL-BMF	ADMM	FedBCD	Split Learning	Ada-VFed
CIFAR-10	$1$	66.71	67.14	68.49	65.79	68.22	29.66	61.31
	$4$	71.25	70.96	72.52	68.84	70.43	34.41	62.13
	$8$	72.37	71.91	73.63	70.03	71.68	40.37	63.50

Table 3. Test Accuracy (

\%

) versus Different Privacy Budgets, Baselines (20 epochs,

\gamma=2

)

Dataset	Method
Dataset	Plain	G-Shuff	G-BMF (Setting 1)	G-BMF (Setting 2)	GL-BMF (Setting 1)	GL-BMF (Setting 2)
CIFAR-10	0.68	0.52	0.51	0.51	0.51	0.51

Table 4. AUC Score versus Different Protocols under P-Attack (100 epochs,

\epsilon=8

)

Dataset	Method	Pre-ImageNet		Pre-Cifar100
Dataset	Method	Runtime (s)	Communication (MB)	Runtime (s)	Communication (MB)
CIFAR-10	G-Shuff	14.88	473.63	7.80	244.03
	G-BMF	14.57	453.6	7.65	233.77
	GL-BMF	132.8	6220.87	83.5	3186.62
EMNIST	G-Shuff	32.80	1228.56	18.89	632.52
	G-BMF	32.00	1178.64	18.50	606.96

Table 5. Runtime and Communication cost of the MPC over LAN

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Description
$\boldsymbol{\mathcal{W}}$	Global model
$\boldsymbol{\mathcal{F}}_{i}$	Local model at client $i$
$\boldsymbol{\theta}$	Parameters of the global model $\boldsymbol{\mathcal{W}}$
$\boldsymbol{\phi}_{i}$	Parameters of local model $\boldsymbol{\mathcal{F}}_{i}$
$\boldsymbol{x}^{(i)}_{b,j}$	Client $i$ ’s local data of the $j$ -the sample in the $b$ -th batch
$\boldsymbol{H}^{(i)}_{b,j}$	Output of local model $\boldsymbol{\mathcal{F}}_{i}$ over $\boldsymbol{x}^{(i)}_{b,j}$

Appendix

Table 6. Notation Table

Dataset	Method	Pre-ImageNet					Pre-Cifar100
CIFAR-10		Non-DP					Non-DP
	Plain	93.5					93.89
		DP					DP
		${\varepsilon=1}$	${\varepsilon=2}$	${\varepsilon=5}$	${\varepsilon=8}$	${\varepsilon=10}$	${\varepsilon=1}$	${\varepsilon=2}$	${\varepsilon=5}$	${\varepsilon=8}$	${\varepsilon=10}$
	G-Shuff	63.71	69.09	71.93	72.89	73.88	80.16	82.11	82.85	82.98	83.02
	G-BMF (Setting 1)	65.14	70.66	73.63	74.25	74.41	79.51	80.41	80.57	80.59	80.64

Appendix

Table 7. Test Accuracy (

\%

) versus Different Datasets, Pre-training, and Privacy Budgets (100 epochs)

Dataset	Method	Pre-ImageNet		Pre-Cifar100
Dataset	Method	Runtime (s)	Communication (MB)	Runtime (s)	Communication (MB)
CIFAR-10	G-Shuff	83.94	473.63	44.62	244.03
	G-BMF	82.60	453.6	43.92	233.77
	GL-BMF	686.60	6220.87	468.19	3186.62
EMNIST	G-Shuff	194.17	1228.56	108.34	632.52
	G-BMF	190.75	1178.64	106.65	606.96

Appendix

Table 8. Runtime and Communication cost of the MPC over WAN

Dataset	Method
Dataset	GL-BMF	GL-Sub	ADMM	FedBCD
CIFAR-10	75.47	84.46	69.64	71.82

Appendix

Table 9. Test Accuracy (%) versus Different Baselines (100 epochs,

\epsilon=4

\gamma=2

)

Privacy-Preserving Federated Learning

See all 41 papers

Scalable and Private Federated Learning Using Distributed Differential Privacy and Secure Aggregation
Apr 8, 2026Wenjing Wei, Farid Nait-Abdesselam, Alla JamminePrivacy-Preserving Federated Learning Differentially Private Federated Learning
Université Paris Cité, Paris, France
OPFL: Optimistic Verification of Federated Learning via Empirical Boundary
Sep 29, 2026Hongxu Su, Jianzhu Yao, Xuechao Wang +1Federated Learning Privacy-Preserving Federated Learning
DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning
May 13, 2026Haaris Mehmood, Giorgos Tatsis, Dimitrios Alexopoulos +4Federated Learning Aggregation Communication-Efficient Distributed Training
Samsung R&D Institute UK (SRUK) · Information Technologies Institute (CERTH-ITI)

Apr 8, 2026J/K move · Enter open · S save

Scalable and Private Federated Learning Using Distributed Differential Privacy and Secure Aggregation

Wenjing Wei, Farid Nait-Abdesselam, Alla Jammine

Université Paris Cité, Paris, France

Privacy-Preserving Federated Learning Differentially Private Federated Learning Federated Learning Aggregation Differential Privacy

Open paper AskPDF arXiv

This article presents DDP-SA, a scalable privacy-preserving federated learning framework that jointly leverages client-side local differential privacy (LDP) and full-threshold additive secret sharing (ASS) for secure aggregation. Unlike existing methods that rely solely on differential privacy or on secure multi-party computation (MPC), DDP-SA integrates both techniques to deliver stronger end-to-end privacy guarantees while remaining computationally practical. The framework introduces a two-stage protection mechanism: clients first perturb their local gradients with calibrated Laplace noise, then decompose the noisy gradients into additive secret shares that are distributed across multiple intermediate servers. This design ensures that (i) no single compromised server or communication channel can reveal any information about individual client updates, and (ii) the parameter server reconstructs only the aggregated noisy gradient, never any client-specific contribution. Extensive experiments show that DDP-SA achieves substantially higher model accuracy than standalone LDP while providing stronger privacy protection than MPC-only approaches. The proposed framework scales linearly with the number of participants and offers a practical, privacy-preserving solution for federated learning applications with controllable computational and communication overhead.

Abstract

Privacy-Preserving Federated Learning

Explore similar work

Scalable and Private Federated Learning Using Distributed Differential Privacy and Secure Aggregation

OPFL: Optimistic Verification of Federated Learning via Empirical Boundary

DisAgg: Distributed Aggregators for Efficient Secure Aggregation in Federated Learning