PRIVEE: Privacy-Preserving Vertical Federated Learning Against Feature Inference Attacks

• URL: http://arxiv.org/abs/2512.12840v1
• Date: Sun, 14 Dec 2025 21:05:19 GMT
• Title: PRIVEE: Privacy-Preserving Vertical Federated Learning Against Feature Inference Attacks
• Abstract summary: We propose a novel defense mechanism named after the French word privée, meaning "private"<n>PRIvacy-preserving Vertical fEderated lEarning obfuscates confidence scores while preserving critical properties such as relative ranking and inter-score distances.<n>Experiments show that PRIVEE achieves a threefold improvement in privacy protection compared to state-of-the-art defenses.
• Score: 20.61987420750636
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Vertical Federated Learning (VFL) enables collaborative model training across organizations that share common user samples but hold disjoint feature spaces. Despite its potential, VFL is susceptible to feature inference attacks, in which adversarial parties exploit shared confidence scores (i.e., prediction probabilities) during inference to reconstruct private input features of other participants. To counter this threat, we propose PRIVEE (PRIvacy-preserving Vertical fEderated lEarning), a novel defense mechanism named after the French word privée, meaning "private." PRIVEE obfuscates confidence scores while preserving critical properties such as relative ranking and inter-score distances. Rather than exposing raw scores, PRIVEE shares only the transformed representations, mitigating the risk of reconstruction attacks without degrading model prediction accuracy. Extensive experiments show that PRIVEE achieves a threefold improvement in privacy protection compared to state-of-the-art defenses, while preserving full predictive performance against advanced feature inference attacks.

Related papers

• CausShield: Sample Reconstruction-Resilient Vertical FL via Causal Representation Learning [11.295359490102522]
  VFL is a distributed learning paradigm that leverages vertically partitioned features across isolated parties without sharing raw samples.<n>Existing defenses fail to achieve a satisfactory trade-off between model utility and privacy protection.<n>We introduce CausShield, which decomposes the shared representations between the client and the coordinating server in VFL into task-relevant and task-irrelevant components.
  arXiv  Detail & Related papers  (2026-06-06T07:40:11Z)
• Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy [51.758416625168]
  Randomized smoothing is a powerful tool for certifying robustness to adversarial perturbations.<n>We propose a framework for certification of complex, composed mechanisms.<n>We provide a principled and general framework for using composite mechanisms to certify robustness under complex threat models.
  arXiv  Detail & Related papers  (2026-05-20T22:17:29Z)
• Toward Individual Fairness Without Centralized Data: Selective Counterfactual Consistency for Vertical Federated Learning [16.277579974537996]
  We propose a server-centric framework for enforcing selective counterfactual consistency ( SCC-VFL) at the individual level in vertical federated learning (VFL)<n> SCC-VFL maintains or improves predictive accuracy while sharply reducing decision flip rates by up to 98% relative to strong baselines.<n>It also lowers attribute-inference attack success and improves robustness, demonstrating favorable utility-fairness-privacy trade-offs in realistic VFL deployments.
  arXiv  Detail & Related papers  (2026-05-08T01:50:06Z)
• Your Privacy Depends on Others: Collusion Vulnerabilities in Individual Differential Privacy [50.66105844449181]
  Individual Differential Privacy (iDP) promises users control over their privacy, but this promise can be broken in practice.<n>We reveal a previously overlooked vulnerability in sampling-based iDP mechanisms.<n>We propose $(varepsilon_i,_i,overline)$-iDP a privacy contract that uses $$-divergences to provide users with a hard upper bound on their excess vulnerability.
  arXiv  Detail & Related papers  (2026-01-19T10:26:12Z)
• Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning [24.914116986408327]
  We propose PromptMIA, a membership inference attack tailored to federated prompt-tuning.<n>We empirically show that PromptMIA consistently attains high advantage in this game across diverse benchmark datasets.<n>The results highlight non-trivial challenges for current defenses and offer insights into their limitations.
  arXiv  Detail & Related papers  (2026-01-10T17:50:05Z)
• GuardFed: A Trustworthy Federated Learning Framework Against Dual-Facet Attacks [56.983319121358555]
  Federated learning (FL) enables privacy-preserving collaborative model training but remains vulnerable to adversarial behaviors.<n>We introduce the Dual-Facet Attack (DFA), a novel threat model that concurrently undermines predictive accuracy and group fairness.<n>We propose GuardFed, a self-adaptive defense framework that maintains a fairness-aware reference model using a small amount of clean server data.
  arXiv  Detail & Related papers  (2025-11-12T13:02:45Z)
• Fast, Private, and Protected: Safeguarding Data Privacy and Defending Against Model Poisoning Attacks in Federated Learning [0.3441021278275805]
  We present Fast, Private, and Protected (FPP), a novel approach that aims to safeguard federated training while enabling secure aggregation.<n>FPP employs a reputation-based mechanism to mitigate the participation of attackers.<n>Our experiments demonstrate that FPP achieves a rapid convergence rate and can converge even in the presence of malicious participants performing model poisoning attacks.
  arXiv  Detail & Related papers  (2025-11-04T18:20:45Z)
• VoxGuard: Evaluating User and Attribute Privacy in Speech via Membership Inference Attacks [51.68795949691009]
  We introduce VoxGuard, a framework grounded in differential privacy and membership inference.<n>For attributes, we show that simple transparent attacks recover gender and accent with near-perfect accuracy even after anonymization.<n>Our results demonstrate that EER substantially underestimates leakage, highlighting the need for low-FPR evaluation.
  arXiv  Detail & Related papers  (2025-09-22T20:57:48Z)
• Confidential Guardian: Cryptographically Prohibiting the Abuse of Model Abstention [65.47632669243657]
  A dishonest institution can exploit mechanisms to discriminate or unjustly deny services under the guise of uncertainty.<n>We demonstrate the practicality of this threat by introducing an uncertainty-inducing attack called Mirage.<n>We propose Confidential Guardian, a framework that analyzes calibration metrics on a reference dataset to detect artificially suppressed confidence.
  arXiv  Detail & Related papers  (2025-05-29T19:47:50Z)
• Do Fairness Interventions Come at the Cost of Privacy: Evaluations for Binary Classifiers [17.243744418309593]
  We assess the privacy risks of fairness-enhanced binary classifiers via membership inference attacks (MIAs) and attribute inference attacks (AIAs)<n>We uncover a potential threat mechanism that exploits prediction discrepancies between fair and biased models, leading to advanced attack results for both MIAs and AIAs.<n>Our study exposes the under-explored privacy threats in fairness studies, advocating for thorough evaluations of potential security vulnerabilities before model deployments.
  arXiv  Detail & Related papers  (2025-03-08T10:21:21Z)
• Evaluations of Machine Learning Privacy Defenses are Misleading [25.007083740549845]
  Empirical defenses for machine learning privacy forgo the provable guarantees of differential privacy. We show that prior evaluations fail to characterize the privacy leakage of the most vulnerable samples.
  arXiv  Detail & Related papers  (2024-04-26T13:21:30Z)
• Secure Aggregation is Not Private Against Membership Inference Attacks [66.59892736942953]
  We investigate the privacy implications of SecAgg in federated learning. We show that SecAgg offers weak privacy against membership inference attacks even in a single training round. Our findings underscore the imperative for additional privacy-enhancing mechanisms, such as noise injection.
  arXiv  Detail & Related papers  (2024-03-26T15:07:58Z)
• Flexible Differentially Private Vertical Federated Learning with Adaptive Feature Embeddings [24.36847069007795]
  Vertical federated learning (VFL) has stimulated concerns about the imperfection in privacy protection. This paper studies the delicate equilibrium between data privacy and task utility goals of VFL under differential privacy (DP) We propose a flexible and generic approach that decouples the two goals and addresses them successively.
  arXiv  Detail & Related papers  (2023-07-26T04:40:51Z)
• Defending against Reconstruction Attacks with R\'enyi Differential Privacy [72.1188520352079]
  Reconstruction attacks allow an adversary to regenerate data samples of the training set using access to only a trained model. Differential privacy is a known solution to such attacks, but is often used with a relatively large privacy budget. We show that, for a same mechanism, we can derive privacy guarantees for reconstruction attacks that are better than the traditional ones from the literature.
  arXiv  Detail & Related papers  (2022-02-15T18:09:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.