Feature Reconstruction Attacks and Countermeasures in DNN Training in Vertical Federated Learning

The paper studies the feature security problem in DNN training in vertical federated learning (VFL), namely whether the active party that holds the labels and initiates training can extract the passive party's feature data; the authors call this the first study of the problem. In a setting where the DNN model is partitioned between the active and passive parties, and the passive party holds only a subset of the input layer that includes binary class features, the paper proves by reduction from the Exact Cover problem that reconstructing these binary features is NP-hard, while also pointing out that as long as the feature dimension is not extremely large, efficient search-based attack algorithms are feasible in both theory and practice and can outperform existing feature protection techniques. To this end, the authors propose a new feature protection scheme that misdirects the attack search toward preset random values; extensive experiments show that the scheme can resist feature reconstruction attacks in various VFL applications without loss of accuracy.