Defending Label Inference and Backdoor Attacks in Vertical Federated Learning

Since there are multiple parties in collaborative learning settings like federated learning, curious parities might be honest but are attempted to infer other parties’ private data through inference attacks while malicious parties might manipulate the learning process for their own purposes through backdoor attacks. However, most existing works only consider the federated learning scenario where data are partitioned by samples (HFL). The feature-partitioned federated learning (VFL) can be another important scenario in many real-world applications. Attacks and defenses in such scenarios are especially challenging when the attackers and the defenders are not able to access the features or model parameters of other participants. Previous work have only shown that private labels can be reconstructed from communication of per-sample gradients. In this paper, we first show that private labels can be reconstructed even when only batch-averaged gradients instead of sample-level gradients are revealed. It is a common presumption that batch-averaged information is safe to share, therefore batch label inference attack is a severe challenge to VFL. In addition, we show that a passive party (a party without labels) in VFL can even replace its corresponding labels in the active party with a target label through a gradientreplacement attack. To defend against batch label inference attack, we introduce a novel technique termed confusional autoencoder (CoAE), based on autoencoder and entropy regularization. We demonstrate that label inference attacks can be successfully blocked by this technique without hurting as much main task accuracy as compared to existing methods. Our CoAE technique is also effective in defending the gradient-replacement backdoor attack, making it an universal and practical defense strategy with no change to the original VFL protocol. We demonstrate the effectiveness of our approaches under both two-party and multi-party VFL settings. To the best of our knowledge, this is the first systematic study to deal with label inference and backdoor attacks in the feature-partitioned federated learning framework.


Introduction
Federated Learning (FL) (McMahan et al. 2016;Yang et al. 2019;Kairouz et al. 2019) is a collaborative learning framework for training deep learning models with data privacy protection. In the original proposal of cross-device FL (McMahan et al. 2016), data samples are distributed among different participants, thus these works can be regarded as sample-partitioned federated learning, or horizontal federated learning (HFL) . However, featurepartitioned federated learning, or vertical federated learning (VFL) Hu et al. 2019b;Liu et al. 2019;Liu, Chen, and Yang 2018;Cheng et al. 2021;He, Annavaram, and Avestimehr 2020) is another important scenario for many real-world applications. For example, when a bank and an E-commerce company collaboratively train a credit risk model, different features of the same group of users are partitioned among different parties. It is important to safeguard the VFL framework from attacks and data leakages.
Because FL is a collaboration system that requires parties to exchange gradient or model level information, it has been of great research interest to study the potential information leakage from gradients. Previous work (Zhu, Liu, and Han 2019;Zhao, Mopuri, and Bilen 2020;Yin et al. 2021) have shown that it is possible to recover pixel-level (deep leakage) raw data from transmitted gradients information. Previous studies on label leakage of VFL (Li et al. 2021) have made the assumption that per-sample gradient is communicated and revealed in VFL, therefore the value of the gradients can be used to induce the label. However, sample-level information is not necessarily available in VFL with Homomorphic Encryption (HE) or Multi-Party Secure Computation (MPC) protection , where the encrypted intermediate results are communicated, and both data and local model parameters are kept secret. Therefore attacks and defenses in this scenario are both challenging since only batch-leveled local gradients are available. In addition, FL opens doors to new backdoor attacks. A typical example is backdoor attacks with model poisoning. Many recent works (Bagdasaryan et al. 2018;Bhagoji et al. 2019) have shown that FL is vulnerable to model poisoning where the attacker manipulates the model's performance on an attacker-chosen backdoor task while maintaining the performance of the main task. These attacks only apply to HFL where model parameters are exposed.
In this paper, we first demonstrate that private labels can be reconstructed when only local batch-averaged gradients are revealed, which is against the common presumption that batch-averaged information is safe to share in VFL. Furthermore, we show that a passive party (a party without labels) in VFL can replace its corresponding labels in the active party with a target label through performing a gradientreplacement attack. Experiments on multiple datasets show that accuracy on both tasks can achieve over 90%. Finally, we introduce a novel technique termed confusional autoencoder (CoAE), based on autoencoder and entropy regularization to defend against label inference attack. We demonstrate that our technique can successfully block both label inference attack and gradient-replacement attack without hurting as much main task accuracy as existing methods like differential privacy (DP) and gradient sparsification(GS), making it an universal and practical defense strategy without changing the original VFL protocol.

Related Work
Recently, deep neural networks have been adopted to learn sensitive information from the exposed gradients in FL (Zhu, Liu, and Han 2019;Zhao, Mopuri, and Bilen 2020;Yin et al. 2021). Differential Privacy (DP) (Bagdasaryan et al. 2018;Xie et al. 2020) and gradient sparsification (GS) (Lin et al. 2017) are techniques commonly adopted to preserve privacy in these scenarios. A data augmentation approach (Gao et al. 2020) is also recently proposed to defend the gradientbased information reconstruction attacks. Bagdasaryan et al. (2018) introduced a backdoor attack to federated learning by replacing the global model with a targeted poisoning model and discussed effectiveness of possible defense strategies. Bhagoji et al. (2019) carried out stealthy model poisoning attack to federated learning by alternatively optimizing for stealth and the adversarial objectives. Xie et al. (2020) introduced distributed backdoor attacks to federated learning. Sun et al. (2019) studied backdoor and defense strategies in federated learning and show that norm clipping and "weak" differential privacy mitigate the attacks. All the works above consider the HFL scenario.
VFL frameworks have been developed for models including trees (Cheng et al. 2021), linear and logistic regression (Gratton et al. 2018;Kikuchi et al. 2017;Hu et al. 2019a), and neural networks (Liu, Chen, and Yang 2018;Hu et al. 2019b). Privacy-preserving techniques such as Homomorphic Encryption (HE) (Rivest, Adleman, and Dertouzos 1978;Acar et al. 2018), Secure Multi-party Computation (SMPC) (Yao 1982) and Differential Privacy (DP) (Dwork 2006) are typically applied in these frameworks to preserve user privacy and data confidentiality. Recently, label leakage and protection for the vertical federated learning (VFL) framework is studied in (Li et al. 2021). This study is limited to two-class scenario and plain-text communication so per-sample gradient information is available. In our work, we attack and defense a more challenging system, where we assume the communicated messages are also protected (e.g. by HE), and only the final local model gradients are accessible to attackers. A Privacy-Preserving Feature-partitioned collaborative learning framework In a typical VFL system , K data owners collaboratively train a machine learning model based on a set of data {x i , y i } N i=1 and only one party has labels. This is a reasonable assumption in cross-organizational collaborative learning scenarios, because in reality labels (such as users' credit scores, patients' diagnosis etc) are expensive to obtain and only exist in one or few of the organizations. Suppose that the feature vector x i can be further decomposed into K blocks {x k i } K k=1 , where each block belongs to one owner. Without loss of generality, assume that the labels are located in party K. Then the collaborative training problem can be formulated as where θ k denote the training parameters of the kth party; Θ = [θ 1 ; . . . ; θ K ]; N denote the total number of training samples; f (·) and γ(·) denote the prediction function and regularizer and λ is the hyperparameter; Following previous work, we assume each party adopts a sub-model G k which generates local predictions, i. e, local latent representations H k i and the final prediction is made by merging H k with an nonlinear operation, such as softmax function. That is, where G k can adopt a wide range of models such as linear and logistic regression, support vector machines, neural networks etc. Let H i = K k=1 H k i , then the gradient function has the form We refer the party having the labels the active party, and the rest passive parties. In a feature-partitioned collaborative learning protocol, each passive party sends {H k i } to active party, and the active party calculates { ∂ ∂Hi } and sends it back to passive parties for gradient update. To further protect information leakage from intermediate results, privacy-preserving techniques such as HE, denoted as [[·]], are applied to protect sample-level information {H k i }, and the gradients calculations are performed under encryption. The computed encrypted gradients are then sent to a Trusted Third Party (TTP) for decryption. This process ensures that only batch-averaged gradients rather than sample-level gradients are available to the passive party. See Algorithm 1 and Figure 1(A).

Attacks Threat Model
Based on Algorithm 1, we consider the following attack model: (i) the attacker has access to the training data of one or more data parties and it controls the training procedure and the local model of attacked parties. (ii) The attacker only receives batched-averaged local gradients in plain text from TTP, but does not receive encrypted per-sample intermediate results. (iii) The attacker can modify local updates such as training weight and gradients before sending transmitted data to other parties. (iii) The attacker does not control any benign party's training nor does the attacker control the global communication and aggregation protocols. (iv) Contrary to traditional data poisoning attacks which focus on poisoning training data, the attacker in collaborative learning focus on learning sensitive information from other parties or poisoning gradients and model updates that are communicated among parties in the protocol, similar to previous works (Steinhardt, Koh, and Liang 2017). The fundamental difference between our threat model and the model adopted in previous HFL works is the following. First, for all kinds of attacks, under previous HFL settings, the attacker has access to the entire feature and label space information and the entire set of model parameters, while in our scenario, the attacker only has access to a portion of the feature space and the model parameters of parts that it controls, and it may not have access to labels if it does not control the active party; Secondly, for backdoor attacks, under HFL settings, the attacker controls only a portion of the entire dataset and any model updates it sends get averaged in the server. While under our VFL setting, the backdoor will survive and propagate throughout the communication protocols. Due to these differences, the attacks and defense strategies for VFL are fundamentally different from those for HFL. The differences between our model and the VFL framework considered in (Li et al. 2021) is that our threat model further assumes that the communicated messages between parties are private and encrypted, so that per-sample gradient-related information is not available for inference, therefore our attack is on the batch or population level.

Adversarial Objectives
The attacker in our setting aims to train a model which achieves high performance on both the original task and the attacking task. Label inference attack. The label inference task is aimed to infer the information about labels at a passive party (the party that does not obtain the label information in VFL setting). Backdoor attack. Unlike Byzantine attacks (Muñoz-González, Co, and Lupu 2019), preventing convergence is not the attacker's goal under our setting. The backdoor task is to assign an attacker-chosen label to input data with a specific pattern (i. e. , a trigger), as shown in Figure 2. We will elaborate our discussion on both attacks and how these attacks are inter-connected in the following parts.

Label Inference Attack
Inspired by the attack performed by (Zhu, Liu, and Han 2019), we adopted a deep learning approach to accomplish this attack, see Figure 1(A, B) and Algorithm 2. Specifically, the passive party (attacker) p set up an internal model which tries to guess the labels and communicated intermediate results H a for every sample in a batch so that the simulated local gradients match the observed ones. First, for each sample in each batch B it randomly initializes y and H a , then computes its gradients using: Then the final objective is to match the observed and simulated gradients: We show experimentally that this reconstruction can be quite powerful, achieving an over 90% label reconstruction rate. Therefore, we conclude that batch averaging is not sufficient to protect the label information in VFL setting. In the next section, we propose a novel defense technique to protect labels.

Gradient-Replacement Backdoor
With the backdoor adversarial objectives in mind, it is easy to see from Figure 2 that the active party who has labels is able to replace the loss function of the original model with a new loss function to inject backdoor attacks: where o K i is defined in equation 1, D cln ,N cln ,D poi ,N poi denote the clean dataset, number of samples in clean dataset, poisoned dataset and number of samples in poisoned dataset, respectively. r K i denotes the target label. Since the active party has labels, it can directly modify the label of the poisoned dataset without affecting the training protocol. During training, the active party just needs to send { ∂L b ∂Hi }instead of { ∂L ∂Hi } to successfully inject the attack. In this work, we focus on the more challenging problem, injecting backdoor from passive parties who have no access to either labels or other passive parties' contributions at every iteration. From algorithm 1, the only information the passive parties obtain is the batch-averaged gradients. Therefore the main challenge is for the passive parties to assign targeted labels to specific input data with trigger features without direct access to labels.
This backdoor task is built on the label inference attack since once a passive party learns the corresponding true labels of the each sample, it can carefully design the communicated messages to replace the true label with a target label, shown as the following. In equation 4, if f represents a softmax function and represents a cross-entropy loss, then g i H = ∂ ∂Hi is a m-dimension vector where m is the number of labels with the jth element being: where S j is the softmax function S j = e h j i e h i over H i . Here we abuse the notation y to denote the index of the true label. If g i H is revealed, the label information is known because the yth element of g i H will have opposite sign as compared to others. To inject the attack, the passive party only needs to replace g i H with Where τ is the target label. Note this injection can be performed under HE encryption without knowing the plain-text value of S j due to the additive property of HE.
, j = y Therefore if we can recover per-sample label information, which is exactly what batch label inference attack aims to achieve, we can further exploit the recovered labels to perform backdoor attacks. However, such a backdoor attack requires the label inference step as a prerequisite, which requires running and observing the VFL process separately first. In the following, we propose another backdoor approach which does not require prior knowledge about the true labels of every sample to be poisoned. Instead, we only assume that the passive attacker knows a few clean samples which have the same label as the targeted label of the backdoor task. We mark this sample set D target . We use this assumption because it's usually not too difficult to get the label of a few samples in practice. With this assumption, we propose to inject a gradientreplacement backdoor to the learning process directly as follows: • In the forward propagation, the attacker performs local computations of H k i , but for each poisoned sample i, it randomly selects one sample j from D ∂H k i ∂θ k according to equation 5 where ∂ ∂Hj is replaced by g j ; Here γ is an amplify rate that we adjust to control the level of backdoor. This can also be understood as an identity steal strategy where the backdoor sample steals a target's identity. By using such a strategy, the passive party will obtain the corresponding gradients with respect to the targeted label instead of its own therefore its local backdoor updates will be successful. To further prevent the active party from learning a reasonable mapping of the labels and intermediate results H i of the poisoned samples, the passive party can instead output a random-valued vector to the active party for each poisoned sample during training. See Algorithm 3 and Figure 1(A, C)

Defense
In the previous sections, we have shown that label leakage and backdoor attacks are both challenging problems to VFL. In this section, we discuss possible routes for protection. Especially, the active party needs to establish a stronger defense mechanism. The common defense mechanisms previously adopted include differential privacy and gradient sparsification. However these techniques usually suffer from accuracy loss, which might be unacceptable in certain scenarios. Another line of work is to exploit the distribution differences of per-sample gradient values (Li et al. 2021), but they are not always accessible. Here we propose a simple yet effective label disguise technique where the active party learns to transform the original labels to a set of "soft fake labels" so that 1) these soft fake labels contrast with the original ones, i.e. the fake labels and the original ones are likely not the same after the transformation; 2) the original labels can be reconstructed almost losslessly; 3) the fake labels should introduce as much confusion as possible to prevent the passive party to infer the true labels. For example, a simple mapping function (e.g., a function that assigns label "dog" to "cat" and "cat" to "dog") would satisfy the first two conditions but not the last one, since if a party knows the true label of one sample, it would know the true labels of all samples belonging to the same class. To increase confusion, we propose learning a confusional autoencoder (CoAE) to establish a mapping such that one label will be transformed into a soft label with higher probability for each alternative class. For example, a dog is mapped to [0.5,0.5] probability of dog and cat, respectively. Whereas autoencoder is simple and effective for hiding true labels, confusion is important in changing the probability distribution of classes, making backdoor attacks harder to succeed.

Algorithm 4 Label Disguise via training CoAE
Input: the learning rate η, number of classes c, batch size N , the maximum number of epochs E. Output: trained W e , W d . 1: for i ← 1 to E do 2: Randomly generate one-hot labels: y ∈ R N×c 3: Generate fake and reconstructed labels by eq. (9); 4: Compute total loss L by eq. (11) and update parameters: W e ← W e − η · ∂L/∂W e W d ← W d − η · ∂L/∂W d 5: end for 6: return W e and W d Algorithm 4 and Figure 1 (D) describe the training procedure. The encoder takes as input ground-truth labels y and outputs fake labelsỹ, while the decoder takes as input fake labelsỹ and reconstruct original true labelsŷ. That is: Where W e and W d are the parameters for encoder and decoder,respectively. To satisfy our conditions, we introduce a contrastive loss and an entropy loss, respectively: Where CE(·) is the cross-entropy loss. Then, we form the final learning objective function as: L = L contra − λ 2 L entropy (11) Here L contra is the contrastive loss that enables the CoAE to reconstruct true labels from fake ones while forcing the fake labels to be different from the original labels; L entropy is the entropy loss that maps each true label to multiple alternative labels ("confusion"); λ s , s ∈ {1, 2} are loss weights. After trained, the active party can leverage the CoAE to produce fake labels and use these fakes labels to compute gradients in VFL, thereby preventing label leakage and backdoor attacks (Algorithm 5). When performing inference, the active party transforms the predicted labels back to true labels using decoder.
Note that the assumption for such a defense mechanism to work is not different from that of the VFL attacks. That is, we assume the passive party does not know the model structure or parameters of the active party. The passive party may only know a few clean labels at most, which may be enough to inject backdoor attacks but not enough to learn a good mapping between the true labels and fake labels. By replacing true labels with soft fake labels locally, the active party does not need to make any changes to the protocol, preserving both label privacy and protocol integrity.

Experiments
In our experiments, we evaluate the effectiveness of our proposed attacks: batch label inference attack and gradientreplacement backdoor at the passive party, as well as our proposed CoAE defense at the active party in a VFL training protocol.

Models and Dataset
NUS-WIDE dataset In this dataset, each sample has 634 image features and 1000 text features. We partition the data into an active party with image features, and the passive party with text features. The backdoor trigger is that the last text feature equals 1. The data samples that satisfy this feature are less that 1% in both training set and testing set, thus it's difficult to detect this backdoor using a validation set. In the following experiments, we choose five labels: ['buildings', 'grass', 'animal', 'water', 'person'], except for the batch label inference attack, where all 81 labels are used to study the impact of number of classes. The target label is set to class 0 and ten target samples are randomly chosen. A 2layer MLP model is used for this dataset with 32 neurons in the middle layer. MNIST and CIFAR dataset For these two datasets, We evenly split each image into two halves and assign them to the active and passive party, respectively. Following (Gu, Dolan-Gavitt, and Garg 2017), we inject trigger 255 at pixel positions [25,27], [27,25], [26,26] and [27,27] for the MNIST dataset. We randomly select 600 samples from the 60000 training samples and 100 samples from the 10000 testing samples and mark them with this trigger. As for the CIFAR dataset, pixels [29,31] and [30,30] are set to [0,255,0] along the channels, and pixels [31,29] and [31,31] are set to [255,0,255] (see Figure 2). We randomly mark 100 samples from 10000 training data and 20 samples from 2000 test data with this trigger. (D backdoor ). The target label is randomly chosen. Then 10 target samples are randomly chosen from that class. A 2-layer MLP model is used for MNIST dataset with 32 neurons in the middle layer. Resnet18 is used as the backbone model for CIFAR dataset.

Attacks at Passive Party
Label Inference Attack To test the effectiveness of the label inference attack, we use recovery accuracy as our metric. If the predicted label matches the true label, the recovery is successful for that sample. The recovery accuracy is then the ratio of successfully reconstructed samples. The samples and the classes are randomly selected for each experiment and each run is repeated 30 times. The results are shown in Figure 3 with different batch size and different number of classes. It can be seen that the batch label inference attack can be quite successfully for various batch size and number of classes, despite the fact the only clue is the batchaveraged gradients. As the batch size increases, the recovery rate gradually drops, indicating the inference task is more difficult. Another interesting finding is that as the number of classes increases, the recovery rate increases at first, likely due to the fact that the diversity of the labels reduces the possible combinations in the search space. This is consistent with (Yin et al. 2021), where the assumption for successfully guessing the labels in a batch is that the number of classes exceeds the batch size. As the number of classes continues to grow (e.g. to 81 in NUS-WIDE), we also observe a drop in recovery rate, likely due to increasing difficulty for solving the optimization problem.

Gradient-Replacement Backdoor
The left column of Figure 4 shows the backdoor task accuracy at various levels of backdoor, indicated by the amplify rate γ. Some of which are more than 90%, meaning that the backdoor task has succeeded. The right column of Figure 4 shows the main task accuracy, which stays high for various attack levels. When γ is set too large the backdoor task succeeded while the main task failed. In the following experiments, we set γ to 10, at which the main task and the backdoor task both work well.

Defenses at Active Party
We evaluate our proposed label defense mechanism on both batch label inference attack and gradient replacement backdoor attack, and compared our methods with three baselines: Differential Privacy (DP), Gradient Sparsification (GS) and optiMized perturbAtion to pReVEnt Label Leakage (MARVELL) following previous work (Li et al. 2021). Both encoder and decoder of the CoAE have the architecture: fc((6c) 2 )-relu-fc(c)-softmax, where fc denotes fully- connected layer and c denotes the class number. We evaluate the performance of CoAE with various λ 2 from 0.05 to 2.0. For DP, gaussian differential private mechanism (DP-G) and Laplacian (DP-L) differential private mechanism are employed to defense backdoor attack. Gradients were 2norm clipped with 0.2. Then, a Gaussian or Laplacian noise was added. The standard deviation of the applied noise ranges from 0.001 to 0.1. The form of added noise are shown below: For GS, we evaluate the defense performance of gradient sparsification strategy with various drop rates, from 99.0 to 99.9.
For MARVELL, as it only supports binary classification and is designed to defend label inference attack, we evaluate its defense performance against our method, CoAE, separately using only the data from two classes ('clouds' and 'person') since these data form a relative balanced dataset. The power constraint hyperparameter various from 1 to 10 times the norm of gradients.
The defence experiment results will be reported separately on batch label inference attack and backdoor attack in the following paragraphs.
Batch Label Inference Attack The results of batch label inference defense of several strategies are shown in Figure  5. The left column of Figure 5 shows the results of defense under multi-class classification task (10, 5, 20 classes for MNIST, NUSWIDE and CIFAR separately), while the right column shows the results of binary classification task. In each figure, the upper left indicates high attack performance and low main task accuracy, so a better defense should be towards the lower right. Compared to other approaches, we see that our CoAE defense consistently achieves better trade-off performance, with high main task accuracy and low attack task accuracy for multi-class classification task, and relative the same main task accuracy and low attack accuracy for binary classification task. The above proves that CoAE is superior in defending batch label inference attack. Also, for this task, GS has a better performance than DP-based meth-ods. And a change in the power constraint hyperparameter for MARVELL do not lead to a significant variation in the result.
Gradient-Replacement Backdoor After demonstrating that our method CoAE can successfully defend the label inference attack, we want to show that our defense mechanism is still effective when faced with another kind of attack, namely gradient-replacement backdoor attack. We also evaluate our CoAE defense and several other baseline defending methods against gradient-replacement backdoor attack. The results are shown in Figure 6. This experiment is carried out under multi-class classification task setting (10, 5, 20 classes for MNIST, NUSWIDE and CIFAR separately). Same as the batch label inference attack, a better defense should be towards the lower right in each figure. It's clear to see from Figure 6 that results of gradient sparsification (GS) are in the upper left corner, indicating a high backdoor accuracy and low main task accuracy. This suggests that GS is inferior to defend our backdoor attack. Comparing to DP and GS mechanism, our CoAE method can defend backdoor attack to the same level, while retaining a high accuracy of the main task.
We further evaluate our defense strategy under distributed backdoor attack settings as the one proposed in previous work (Xie et al. 2020). We compare our method, CoAE, with three baseline methods on CIFAR100 dataset astill using only images from 20 classes. In this experiment, the feature of data is equally partitioned into four parties with only one active party owning the labels and three other passive parties without label information. Similar as previous work (Xie et al. 2020), the three passive parties work together and conduct gradient-replacement-backdoor attack to the active party. Each attacker has their one-pixel trigger at the lower right corner of each data sample of their own which together forming a three-pixel trigger. Notice that trigger is smaller than the four-pixel trigger we use in previous experiments mentioned above. The result is shown in Figure 6(d). It's clear that our method beats all the baseline methods, achieving a low backdoor task accuracy at a high main task accuracy. Also, comparing with Figure6(c), although distributed backdoor attack is much stronger than single-party backdoor attack (comparing the two black square in each plot which demonstrate the pure attacking results without defense), our defense strategy as well as the baseline strategies can achieve similar defending results.
Impact of Defense strategies In both batch label inference attack and gradient-replacement backdoor attack, as the noise level of DP or the drop rate of GS increases, both label recovery rate and backdoor accuracy decreases at the expense of significant drop in main task accuracy.
Notice the opposite trends in the performance of CoAE in label recovery and gradient-replacement backdoor. In defending batch label inference attacks, as the confusion coefficient increases, the label recovery rate gradually goes up, because higher confusion means higher probability for the soft fake labels to be mapped into the true labels. For the backdoor attacks, the backdoor accuracy decreases as the confusion level grows, indicating confusion is important for defending the attack. Without confusion (λ 2 = 0), the backdoor attack will still succeed since then the autoencoder's sole function is to switch labels among classes and the transformation would work the same for the backdoor samples and other samples. Figure 7 depicts the probability distribution (PD) over labels restored by the passive party conducting batch label inference attack (Algo 2) on CIFAR10, when the active party is performing CoAE protection (Algo 5). Specifically, each element in the PD matrix is computed by Cij j Cij , where C ij denotes the number of samples having ground-truth label i but is restored with label j. Figure 7(b) and Figure 7(a) depict the probability distribution when the CoAE is trained with (λ 2 = 1) and without (λ 2 = 0) entropy loss L entropy , respectively. Without entropy loss, the PD matrix is sparse so the attacker can learn all samples having the same label belong to the same class. With confusion, samples belonging to the same class are restored as multiple alternative labels, demonstrating that the passive party cannot classify its samples based on restored labels.

Conclusion and Future Work
We systematically study the batch label inference attack and gradient-replacement backdoor attack for featurepartitioned federated learning (VFL) problem and show that both these attacks can be conducted at passive party without knowing the labels. Then, we defined confusional autoencoder (CoAE) based on autoencoder and entropy regularization and used it as a novel defending strategy against these two attacks. Our experiments testify that when implementing our CoAE defense mechanism, both attacks can be prevented with superior performance over existing methods regardless of the number of classes for classification and the number of attack parties in VFL setting. All these demonstrate the effectiveness and universality of our CoAE defending method in preserving the privacy in VFL scenario.