GAN-based Vertical Federated Learning for Label Protection

【Q1】The author needs to provide a sufficient explanation for the ability of GAFM to mitigate label leakage. In section 3.4, the author claimed that GAFM has more mixed intermediate gradients but does not provide further explanation of the reasons for this phenomenon and the motivation for combining the GAN method.

【A1】Thanks for your question. We explained the mechanism behind GAFM's protection against label leakage in Section 3.4, Appendix B: Heuristic Justification for Improved Gradient Mixing, and Appendix C.1: Intermediate Gradients on Additional Datasets through experiments and analysis. We found that the protection arises from the mutual cancellation of GAN gradients and CE gradients. If you have other confusions regarding these analyses, we would be happy to provide further clarification.

【Q2】In Figure 3, both the GAN method and the CE method cause a decrease in model utility due to less label information leakage. However, their combination increases model AUC and leak AUC compared to the GAN-only model. It needs to be fully explained.

【A2】Sorry for the confusion regarding Figure 3. The CE loss does not cause a decrease in model utility, and there is no reduction in label information leakage for CE Loss. On the contrary, based on Figure 3 and Table 3, we can observe that the increased model utility of the CE loss is accompanied by poorer privacy protection.

【Q3】GAFM does not provide sufficient privacy protection, as the attack AUC is mostly above 0.6, while the baseline Marvell in its original article can reduce the normal attack to 0.5.

【A3】There is typically a trade-off between privacy protection and utility. As we emphasized in our paper, actually both GAFM and Marvell can sacrifice some utility for privacy protection, but GAFM exhibits greater stability. To better demonstrate the advantages of GAFM, we have depicted the utility-privacy trade-off curve of GAFM and Marvell on the Spambase and ISIC datasets (please refer to Common Response [A2]). From the results, we can observe that compared to Marvell, regardless of the Norm, Mean, or Median attack, GAFM achieves higher utility (test AUC) when privacy (leak AUC) is similar, and GAFM achieves lower privacy when utility is similar. Additionally, GAFM exhibits lower variance in its changes compared to Marvell, making it more stable.

【Q4】The paper needs to provide information on how to partition the features in its experiment. Different feature partitions will result in very different experimental results.

【A4】Please see the Model Architecture section (page 7) and Section C.2: Evaluation in the Multi-Party Setting, where we describe how we allocated features in our experiments for both the two-party setting and the multi-party setting.

【Q5】In this paper, why does Marvell perform much worse than the original paper? In the original Marvell paper, Norm Attack AUC can be reduced to 0.5 by Marvell on the same dataset, e.g., Criteo. Since the experimental results are not clearly explained, it is hard to tell the contributions made in the paper.

【A5】We apologize if our previous explanation was not clear. We would like to provide further clarification on our empirical experiments. The main message we aim to convey is that GAFM, as a novel gradient-perturbation framework that does not solely rely on random noise, demonstrates an improved utility-privacy trade-off compared to the vanilla splitNN structure and existing label protection methods such as Marvell and MaxNorm. In Table 2 of our paper, we demonstrated that GAFM achieves label protection comparable to Marvell under three attacks (norm, mean, median), while also achieving a slightly improved test AUC (utility) across repetitions with different random seeds. Furthermore, in Table 2 of our paper, we also observe GAFM exhibits greater stability compared to Marvell, which can also be observed through the Pareto curves for the utility-privacy trade-off, as presented in Common Response [A2].

It is worth noting that the privacy of Marvell is influenced by its parameter S. In the original paper, when S=4, Marvell indeed reduces the normal attack to 0.5, but it also leads to a decrease in model utility (as discussed in Common Response [A1]). Since we do not have information about the random seed and S used for each dataset in Marvell, we utilized the default parameter S=1 and our own random seeds in our paper. Based on our analysis of S in the [Common Response [A1], we believe that S=1 is a reasonable choice that strikes a balance between privacy and utility for the ISIC and Spambase datasets.

We hope that our clarification has addressed your concerns. If you have any further questions, we are more than happy to discuss them.

Dear reviewer KHth,

We appreciate your time in reviewing our paper! After carefully reviewing your comments, we have made clarifications by conducting additional experiments and providing further explanations. As the author-review discussion period is concluding, we kindly request your feedback on whether your previous concerns have been adequately addressed. We are also available to address any additional inquiries you may have. Your constructive feedback has been invaluable in improving the quality of our work, and we sincerely thank you for it.

Authors

Dear reviewer KHth,

Thank you for your reply. We are glad that you agree with our viewpoint that GAFM provides protection through the mutual cancellation of GAN gradients and CE gradients, and think GAFM represents an intriguing step towards improved label protection. We also hope that the idea of GAFM which implicitly learns the target label distributions instead of labels can bring new inspiration to the community.

As mentioned in the introduction (page 2), our motivation for using GANs is to avoid the issue of label leakage from gradients (LLG) caused by directly inferring sample labels from gradient calculations. The gradients here are obtained by directly involving sample labels in the computation. Instead, we use GANs to learn the distribution of labels in learning the instance class information while avoiding the LLG caused by the direct use of labels. Our experimental results (table 2) have indeed observed the privacy protection brought by this implicit utilization of labels. Additionally, we do not emphasize that GAFM is the state-of-the-art compared to Marvell, but rather highlight the larger variance that Marvell faces in terms of utility and privacy as the shown in the tabel 2 and Common Response [A1] [A2]. In the revised version, we will add the utility-privacy trade-off curve to better demonstrate the advantages of GAFM.

We express our gratitude for the time and effort you have dedicated as the reviewer of our paper. Your valuable suggestions have significantly contributed to the improvement of our article.

Authors

【Q1】This paper only investigates a specific kind of vertical federated learning. In the setting, the authors assume that all the participants without labels share the same model architecture, which is not so practical. Besides, they only investigate on the binary tasks.

【A1】Thank you for your comment. We want to emphasize that GAFM does not impose a constraint that all participants without labels must share the same model architecture. Whether the gradients between GAN and CE loss perturb each other is not directly related to the local model architectures of each unlabeled party.

Regarding binary tasks, as mentioned in the Introduction section, binary tasks often face a severe Label Leakage Gradient (LLG) problem due to the use of cross-entropy loss, resulting in significant gradient differences between positive and negative samples. However, limited research has been conducted to address this issue. Moreover, binary classification is widely used in various federated scenarios, such as healthcare, finance, credit risk, and smart cities. Therefore, in this paper, similar to our baselines (Marvell and MaxNorm), we also focus on binary classification tasks. We agree with your viewpoint that exploring the extension of GAFM to multi-class problems is important. We will consider it as a direction for future work, although it is beyond the scope of this paper.

【Q2】The GAN-based approach to protect labels seems similar to [1]. They seem to prevent the attacks by transforming the uploaded embedding. This paper may be improved by adding some comparative experiments or some analysis in related work.

【A2】Thank you for suggesting this very interesting work which also utilizes generative models for protecting the data privacy. We will include this paper in the related work section. However, it is worth noting that although both our work and the referenced paper [1] employ the idea of perturbing gradients for gradient protection by generative models, we address different problems. Our focus is on preserving the privacy of labels rather than preventing the leakage of training data. Additionally, our problem scenario specifically revolves around vertical federated learning.

【Q3】what is the model architecture of the label party? What would be the experiment comparison between the different approaches in the context of the label party owning many layers of a neural network?

【A3】Thanks for your question. We provide the details of the model architecture of the "label party" in Table 1 and the Model Architecture section. We found that 1-layer DNNs are sufficient as the generator and discriminator since their inputs are very simple.

We also provide additional experimental results using the Spambase dataset as an example, considering the label party with varying numbers of layers (from 1 to 3) in a neural network. We observed that the number of layers has almost no impact on the results.

• Experiments on Spambase across 10 repeats. We observed that the number of layers had little to no effect on GAFM.

Thank you for your suggestion. We hope the above clarification answers your question. If you have other questions, we are happy to answer them.

Dear reviewer wbsE,

Thank you for dedicating your time to review our paper and for your support of our work! We have thoroughly reviewed your comments and made necessary adjustments by conducting additional experiments and providing further explanations. As the author-review discussion period is coming to a close, we kindly ask for your feedback on whether your previous concerns have been adequately addressed. We are also here to address any further inquiries you may have. We sincerely appreciate your constructive feedback, as it has contributed to enhancing the quality of our work. Thank you!

Authors

【Q1】The value of the hyperparameter S significantly affects the performance of Marvell, yet it is not mentioned in this paper. The details of training and evaluating Marvell should be provided.

【A1】Thank you for your valuable suggestion. In our experiments, we uniformly used the default value of $S=1$ in Marvell due to the lack of detailed descriptions regarding the use of parameter $S$ for each dataset. However, we acknowledge your perspective on parameter $S$. As a result, we supplemented the impact of hyperparameter $S$ on Marvell for both Spambase and ISIC in our numerical experiments. Please refer to the Common Response 【A1】 for more details.

We observed that increasing $S$ improves the privacy protection of Marvell but simultaneously leads to a decrease in performance. For Spambase and ISIC, $S=1$ is a reasonable choice that balances performance and privacy protection. Further adjusting the parameter to control the privacy protection capability of Marvell around 0.5 will result in a more noticeable difference between utility and GAFM. However, it does not alleviate the instability issue of Marvell.

【Q2】It would be more insightful to display a utility-privacy trade-off curve for a more intuitive performance comparison. (e.g., varying S for Marvel to generate its dot-curve and varying Δ to produce GAFM's dot-curve, as shown in Figure 4 of the Marvell paper)

【A2】Thank you for your suggestion. We also demonstrated the utility-privacy trade-off curve for both Marvell and GAFM on Spambase and ISIC datasets. Please refer to the conclusion provided in Common Response 【A2】. In summary, we observed that across the Norm Attack, Mean Attack, and Median Attack scenarios, GAFM consistently exhibits a better trade-off curve than Marvell. When the test AUC is similar, GAFM consistently achieves a lower leak AUC than Marvell, and Marvell's leak AUC exhibits significant variance.

【Q3】 As depicted in Figure 3, 'GAN only' demonstrates extremely poor performance on Criteo and IMDB.. Perhaps any other method that provides the opposite gradient center with respect to CE loss could replace the GAN module. I hope the authors can provide a reasonable explanation for this.

【A3】 We agree with your point that methods other than GANs can potentially be utilized to cancel the gradients of the original CE loss. The challenge lies in finding a method that cancels the gradients effectively while minimizing the loss in utility. The advantage of using GANs is that they provide a reasonable loss function that allows us to learn the target distribution. Additionally, we have observed that even in cases where a GAN-only model fails to generate accurate predictions by aligning the label distribution, it does not significantly harm the overall prediction performance.

【Q4】What is the underlying intuition behind designing the CE loss to measure the distance between f(x) and the randomized response ? Why is it reasonable or necessary to reduce the dimension of f(x) to 1 by averaging? Would using a single FC layer be an alternative to achieve this purpose? A clear explanation is needed here.

【A4】For the 'underlying intuition of f(x)', f(x) represents the distribution generated jointly by the unlabeled participants. The active party with labels transforms this joint distribution using the generator and discriminator into a predictive distribution that closely matches the label distribution. We introduce the CE loss to incorporate more label information, aiming to make the predictive distribution obtained from f(x) more accurately reflect the label distribution. Our ablation study (4.2.2 ABLATION STUDY) also supports our viewpoint that using only the GAN loss sometimes leads to less accurate predictions, while the CE loss can introduce more label information to improve accuracy.

Regarding 'reduce the dimension of f(x) to 1', the design in the paper is not the only option. We used the simplest method of gradient aggregation, as it allows for visualization of the gradients' change and facilitates the convenient introduction of label information through the CE loss. However, an appropriate single FC layer can also be used to achieve this objective, and the one-dimensional f(x) obtained through summation can be seen as a single FC layer with equal weights. We want to emphasize that if GAFM can guarantee mutual cancellation of GAN Loss and CE Loss in the aggregated one-dimensional f(x), it can also guarantee mutual cancellation in each dimension $f_i(x)$. This is because, according to the chain rule, $\frac{\partial Loss}{\partial f_i(x)} = \frac{\partial Loss}{\partial f(x)}\frac{\partial f(x)}{\partial f_i(x)} \propto \frac{\partial Loss}{\partial f(x)}$, where $f(x)=\frac{1}{d}\sum^d_i f_i(X)$.

Dear reviewer vM2y,

Thank you again for taking the time to review our paper and for your support of our work! We have carefully considered your comments and incorporated additional experiments and explanations. As the author-review discussion period is nearing its end, we kindly request your feedback on whether your previous concerns have been adequately addressed. We are also available to address any further questions you may have. We appreciate your constructive feedback, which has greatly contributed to improving the quality of our work. Thank you!

Authors

【Q1】Applying GAN to a binary classification seems unprincipled

【A1】We want to clarify that while the phenomenon that the reviewer raised is fair, this is not an issue in our setting: the active party knows the true labels during the training. As long as the GAN can learn the distributions of different classes, even if the learned distributions are completely opposite, such as mapping all positive instances to $\mathcal{N}(0,\sigma^2)$ and negative instances to $\mathcal{N}(1,\sigma^2)$. After training is completed, the active party can easily impose a rule of probability/label swapping to achieve a higher training AUC.

【Q2】Too much variation in the AUC performance measured for Marvell.

【A2】Thank you for your question.

We would like to point out that Marvell did not report important random parameters such as random seed and precise experimental numbers. Therefore, our experimental results are based on our own parameters. We conducted re-experiments on the Spambase and ISIC datasets and indeed observed variance in the changes made by Marvell. For example, the test AUC of Spambase changed from 0.60 (seed=9) to 0.82 (seed=6). We have printed all the training details for your reference in the GAFM_Marvell_Spam_variance.ipynb file.

Additionally, we tried different values of S and found that the high variance in Marvell is not only a problem when S=1. For instance, for the Spambase dataset, when S=0.25, the Marvell test AUC was only 0.3 (seed=2 in Curve_Spam.ipynb). And the Pareto graph also demonstrates the larger variance of Marvell. For detailed results, please refer to the Common Response [A2].

We acknowledge that our speculation about the higher variance in Marvell potentially being due to the addition of noise may not be correct. We will further clarify this speculation in our article.

【Q3】Norm leak AUC of max_norm

【A3】Taking ISIC as an example, we once again observed the failure of MaxNorm in defending against norm attacks. In 250 epochs, it gradually decreased from 1 to 0.9. Please directly refer to the file ISIC_MaxNorm.ipynb for more details.

Meanwhile, it is worth noting that our experiments are not the only ones that have observed the failure of MaxNorm defense against Norm Attack. In this experiment, the researchers also observed that MaxNorm was ineffective in defending against Norm Attack on the Credit Card Fraud Detection dataset, with a (flipped) leak AUC of 0.92.

【Q4】 Lack of privacy utility trade-off visualization.

【A4】Thank you for your suggestion. We have incorporated the privacy utility trade-off on the spambase and ISIC datasets. Please refer to the Common Response [A2] for more details. We will include these experimental results in the revised version.

【Q5】The authors mention on page 6 that the relationship between the sign and the cluster of gradients maybe not be as straightforward (and thus haven’t experimented with the cosine attack). However, this explanation is not clear and deserves more elaboration. Besides, regardless of the exact formulation of GAFM, the cosine leak AUC can still be evaluated and should be reported.

【A5】Cosine attack depends on which labeled samples available and the mean/median attacks are more like a stabilized version of it, and also doe assume any sign. If the norm is 1, then $cos(\theta_1, \theta_2)=1-0.5\||\theta_1-\theta_2\||^2_2$, $\theta_1$ is mean/median vector rather than one sample in positive or negative class and $\theta_2$ is the one sample under investigation. In addition, the results in Table 2 of the paper indeed demonstrate that the Mean/Median Attack is a threatening attack method. Thank you for your suggestion. We also plan to add results of the cosine attack in the revised version.

【Q6】Practicality of mean attack and median attack.

【A6】Thanks for your question. Like Marvell, we define an oracle attack that has access to more accurate and strong information, such as the gradient mean/median of class 0 and class 1 in the mean/median attack, and the clean gradient of one positive example in the cosine attack. In this case, any protection method capable of defending against this oracle attack would also protect against the more practical one (the same attack without this accurate and strong information).

【Q7】The typo at the end of page 4.

【A7】Thank you for pointing it out. We have fixed this typo.

Dear Reviewer ph6x,

Thank you once again for your valuable feedback on our paper. We have taken your comments into serious consideration and conducted additional experiments to address the raised questions. As the author-review discussion period is reaching its conclusion, we kindly request your feedback on whether your previous concerns have been satisfactorily resolved. Given the time constraint, please let us know if there are any other questions or concerns you would like us to address. We highly appreciate your support and truly value your guidance in improving the quality of our work. Thanks!

Authors

We thank the reviewer for raising this question and are happy to clarify it. In our case, the input f(x) to the GAN structure is also the input of the CE loss, which encourages f(x) to be close to a noisy version of the true y and, consequently, encourages closeness in the GAN's output given the limited learning complexity in our GAN structure.

Considering the example that the reviewer is describing: Suppose we have (z1, ...., zn) from N(0, sigma^2), and (x1,...., xn) from N(1, sigma^2), and we use (z1,...., zn), (x1,...,xn) as our inputs to the GAN, discriminating them against 1/2N(0, sigma^2) + 1/2 N(1, sigma^2). The shallow and narrow GAN initialized at the identity is expected to maintain the majority of the relative distances among the points to achieve a low loss. To a certain extent, our GAN's output is conditional on the input f(x). Previous work has employed a similar idea for cross-modality or cross-condition mapping and has achieved good empirical results. For example, in [1], the authors transformed gene expression data into images by applying GAN to the embedded latent space, and in [2], the authors transformed observations from one batch to another using GAN.

We agree with the reviewer on the importance of being cautious when relying on GANs for prediction (the potential risks apply to both label alignment and multi-dimensional settings). It is crucial to use relevant input and restrict the learning capacity of the GAN by employing a simple structure or regularizations.

[1] Yang, Karren Dai, et al. "Multi-domain translation between single-cell imaging and sequencing data using autoencoders." Nature communications 12.1 (2021): 31.

[2] Wang, Yuge, Tianyu Liu, and Hongyu Zhao. "ResPAN: a powerful batch correction model for scRNA-seq data through residual adversarial networks." Bioinformatics 38.16 (2022): 3942-3949.

Again, we thank the reviewer for the valuable comments!

[Incorrect computation of utility metrics] We agree that it is better to calculate test AUC using the final trained model. The test AUC results are comparable to the old results, with the differences depending on the data sets. For example, for Marvel, the re-calculated test AUCs for Spambase are [0.761, 0.630, 0.808, 0.726, 0.684, 0.837, 0.760, 0.718, 0.521, 0.577] using seeds 0-9, with a mean test AUC being 0.70 (previously 0.71); the re-calculated test AUCs for ISIC are [0.707,0.773,0.723,0.6621,0.556,0.660,0.731,0.708,0.761,0.671], with a mean test AUC being 0.69 (previously 0.64). We will update our test AUC results using the final model in the revised manuscript.

[Computing the privacy metrics] We currently used the mean of leak AUC from individual batches instead of 95% percentile because we believe the mean is more stable and equally accounts for all samples without further human interference (e.g., why 95%, not 80% or 50%). However, we do agree that the same measure of in Marvel can help with the comparisons across manuscripts and will add the new evaluations in our revised supplement.

[Are the optimization done correctly for Marvell] We did not specifically adjust the learning rate parameters and have used a a fixed learning rate of 1e-4 for both vanilla splitNN, Marvel, and GAFM in the spambase example. We are currently retraining Marvell model with 10% (1e-5) of currently used learning rate to examine if it has a huge impact.