SecDVA: A Maliciously Secure Multi-Party Data Valuation Framework for Modern Machine Learning Data Markets

Core problem: in ML data markets, the buyer wants to evaluate the value of the seller's dataset to its own model before purchase, but existing DVA approaches require one party to expose its data or model, bringing privacy leakage and strategic manipulation risks.

• Scenario and importance: data trading can be abstracted as a two-party problem—the buyer holds the target model and test set, and the seller holds the data for sale; the DVA result directly affects pricing. Both existing common approaches (the buyer sends its model and test data to the seller, or the seller sends its data to the buyer) require one party to expose private information, and the seller may also inflate the DVA result to facilitate the transaction.
• Shortcomings of existing methods: the authors state that schemes exchanging only intermediate results still leak information (the buyer can partially reconstruct the seller's data, and the seller can manipulate the valuation accordingly); TEE-based schemes rely on expensive specialized hardware, require trusting the hardware vendor, and carry side-channel attack risks; the MPC-based scheme FullPto [4] assumes the model is public, supports only small-scale conventional models, and does not allow the buyer's and seller's data distributions to differ.
• Two major challenges: first, the tension between Applicability and Efficiency—training large models under MPC is costly, and the authors cite that training even a small model under semi-honest MPC takes more than 3.5 hours; second, the tension between Security/Reliability and Efficiency—malicious security requires detecting inconsistencies between inputs and computation, existing MAC schemes add multiple rounds of communication, distributed ZKPs have quadratic computational overhead, and the Transformer's GeLU/LayerNorm/Softmax nonlinear operations are unfriendly to MPC and require high precision.
• Proposed scheme: the paper proposes SecDVA, which the authors state is the first maliciously secure MPC DVA framework for modern ML data markets; it uses NTK linearization of model updates and mini-batch approximation to reduce overhead, and designs an FSS-based (2+1)-party MPC protocol.
• Threat model (using the paper's terminology verbatim):
  • Attacker goals: a malicious seller wants to inflate the reported data value; a malicious buyer wants to maximize the information it obtains about the seller's dataset.
  • Attacker capabilities: Protocol Deviation (skipping steps, altering hyperparameters or randomness, dropping samples, forging responses) and Dataset Falsification (the seller uses D̃≠D, e.g., cherry-picked, duplicated, poisoned data).
  • Victim system and assets: the seller's dataset D, the buyer's test set T and model fθ, all of which may contain private or commercial assets.
  • Platform assumption: the trading platform is semi-honest, executes the protocol, does not collude with either party, but may infer information from the transcript.

ML Data Markets

• Early work studied arbitrage-free query pricing [39]–[41], and later mechanisms priced predictive capability by selling trained model instances [42]; the authors state that these designs focus on economic properties and rarely make privacy central.
• Dealer [43] introduced differential privacy into pricing and compensation; Peng et al. [4] (FullPto) proposed a maliciously secure multi-party trading framework for utility signaling, but the authors point out that it assumes the model is public, whereas in practice the model is often specified by the buyer and should remain private.

Data Valuation: DV and DS

• DV estimates sample marginal contributions using Leave-One-Out [50] or Shapley Value [51], [52], which is costly and has motivated downsampling [20], [21], training-free estimation [55], [56], and retraining approximations [22], [23]; P-Shapley [23] reduces the effect of noise, and SecSV [57] protects validation data but training remains plaintext. The authors state that DV implicitly assumes the validation data matches the training distribution, which often does not hold in reality.
• DS evaluates transferability before training: dataset-level distances [24], [58] are lightweight but require full raw features and may lose task semantics; model-based DS [25], [26] captures task structure through representation embeddings, but building a model zoo is costly [59], [60].

Secure Data Usage in AI

• Secure training protocols [28], [61] are expensive and cannot scale to modern Transformers, so this paper focuses on secure inference.
• Hybrid schemes BOLT [29], Bumblebee [30], and BLB [31] combine HE with secret sharing and use piecewise polynomials for nonlinearities; there are also FHE non-interactive inference [62], secure three-party frameworks [63], and general maliciously secure MPC [64]. Shark [32] performs maliciously secure inference under a semi-honest dealer, but the authors point out that its approximations are coarse (e.g., approximating the exponential with ReLU and GeLU with a quadratic function), causing precision loss.

Baselines and Benchmarks

• Plaintext comparison baselines: DV methods DAVINZ [55], In-Run DS [87], FreeShap [56]; DS methods WTE [24], Task Vector (TV) [25]; datasets are CIFAR-10/100, PACS, Office-Home, and DomainNet.
• MPC comparison baselines: FullPto's input verification [4], and Shark [32] (including a high-precision reimplementation Shark*).

Authors' positioning: the authors state that existing semi-honest or maliciously secure MPC frameworks are all unsuitable for DVA in modern data markets, and that SecDVA is the first MPC DVA framework that simultaneously satisfies the four requirements of security, reliability, applicability, and efficiency.

Overall approach: first, on the plaintext side, use NTK theory to approximate the DVA process of "training→measuring utility" as a linear computation and make an MPC-friendly approximation; then, on the cryptographic side, build a maliciously secure (2+1)-party MPC framework SecDVA, including input consistency verification and high-precision nonlinear operators.

Problem Setting and Strawman Protocol

• DVA is defined as the mapping V(D, T, fθ) → ν, commonly approximated in two stages: the data usage operator O updates the model to fθD, the utility function U is evaluated on benchmark T, and the value is the utility gain V = U(T, fθD) − U(T, fθ).
• Strawman protocol (Figure 2): the seller first commits to the dataset cD ← Com(D; rD); after the two parties secret-share their inputs, they use maliciously secure 2PC to compute [fθD] = ΠO([fθ], [D]), then compute the baseline and updated utility and reveal ν; Open([D], cD, rD) verifies that the data matches the commitment, preventing Dataset Falsification.
• Difficulties of the Strawman: commitment verification is expensive in MPC; the data usage stage involves training, which is costly under maliciously secure 2PC; operations such as large matrix multiplication, nonlinear activation, normalization, and softmax incur high cryptographic overhead.

Lightweight DVA Design (NTK Linearization and Projection)

• Based on the gradient descent linearization theorem (Theorem V.1), the model output can be approximated to first order as f(X;θ_t) = f(X;θ) + J(X;θ)·(θ_t−θ), i.e., the Jacobian maps parameter changes to output changes.
• To handle the mismatch between buyer and seller data distributions, the parameter displacement produced by training on D is projected onto the displacement direction of training on T (only the feature extractor parameters are projected, to cope with label differences); the value is proportional to V(D,T,θ) ∝ (Y − f(X_T;θ))⟨Δθ_D,Δθ_T⟩/|Δθ_T|₂².
• The parameter displacement takes the minimum-norm solution, equivalent to kernel ridge regression, with closed-form solution Δθ = J(X;θ)ᵀ Θ⁻¹ (Y − f(X;θ)), where Θ is the regularized NTK matrix and ζ = 1/(ηt) corresponds to the early-stopping state; in the implementation ζ = 0.01.

MPC-Friendly Approximations

• Diagonal batch approximation: D is split into batches of size r, only the r×r NTK blocks within each batch are computed and placed on the diagonal, with off-block entries set to zero; the benefit is that matrix inversion can be done independently per block and multiplications can be computed locally. In the implementation the batch size is 32.
• Landmark correction: a landmark set of size Z is uniformly sampled (in the implementation, 1% of the dataset size), Z×Z and Z-dimensional statistics ΣΘ, ΣY are accumulated streaming across batches, a linear system is solved to update the landmark coefficients τ (regularization coefficient µ = 0.01), and then each batch is solved locally using the corrected residual; the total displacement is the sum of the landmark term and the per-batch terms, requiring only O(Z²) memory and a single pass over the data. The authors state that this corrects the error of the diagonal approximation ignoring correlations between batches, and is more suitable for MPC than repeatedly shuffling.

MPC Implementation

• Input verification: committed VOLE (C-VOLE) [75] replaces hash commitments; the seller proves via C-VOLE that the input matches the commitment, and the output can be converted for free into SPDZ authenticated secret sharing; communication requires only O(polylog ℓ) and 2 rounds, which the authors state is 3 orders of magnitude more efficient than prior schemes.
• (2+1)-party maliciously secure MPC: a semi-honest, non-colluding dealer P* (played by the trading platform) performs only input-independent preprocessing; FSS-based DPF/DCF is combined with SPDZ, IT-MACs are encoded with a half-tree, and Grotto optimization is used to build DCF directly from DPF; the authors state that its DPF overhead matches that of semi-honest protocols and is 2× lighter than Shark, and that DCF removes the O(n²) factor (Table I).
• High-precision nonlinear operators: piecewise polynomial approximation combined with oblivious lookup tables implements GeLU, Softmax, and LayerNorm; matrix inversion uses Newton's method (30 iterations) together with a dynamic precision trick (temporarily doubling to 24 bits and then shifting back); the fixed-point representation is 12 bits, the ring is Z_2^128, and values and global keys are in Z_2^64.
• The full protocol and security proof are in supplementary material [78] and are not given in the main text.

Experimental Setup

• Target model: ViT-Tiny is the main target model; the sensitivity analysis additionally tests ViT-Small, ViT-Base, and ViT-Large. Only the last attention layer of the target model is computed, and the task module is a single linear layer.
• Datasets and scale: CIFAR-10/100 are split by class into 5 splits (each with 10,000 samples and a 2,000 test set) to simulate pure label differences; PACS and Office-Home use leave-one-domain-out (the seller set is sampled twice, and the test set is half of the seller set: PACS 1,600, Office-Home 2,400) to simulate pure feature differences; DomainNet→PACS/Office-Home (5,000 per domain for the seller, 800/1,200 per domain for the buyer test) simulates feature + label differences.
• Baselines: In the plaintext setting, comparison is against DAVINZ, FreeShap, In-Run DS, WTE, and TV; for MPC input verification, comparison is against FullPto (both the LowMC and SHA-256 versions), and for operators and end-to-end, comparison is against Shark and a high-precision reimplementation, Shark*.
• Metrics: Pearson (P.C.) and Spearman (S.C.) correlation coefficients with ground-truth data values (adapted from task transfer distance [26]; details in the supplementary material), higher is better; efficiency is measured by wall-clock time; MPC experiments report total overhead (not separated into online/offline).
• MPC environment: AMD EPYC 9555, 512GB RAM, single-threaded, local network 10 Gbps, 0.01 ms RTT (same as FullPto); each microbenchmark is executed 1 million times.
• Key hyperparameters: batch size 32, landmark at 1% of the dataset, ζ = 0.01, µ = 0.01, 12-bit fixed point.

Main Results

P.C./S.C. and time cost of each method in the plaintext setting (according to Table II, CIFAR cross-transfer, ViT-Tiny):

Swipe horizontally to read the table

Method	C10→C100 P.C.	C10→C100 S.C.	C10→C100 Cost(s)	C100→C10 P.C.	C100→C10 S.C.	C100→C10 Cost(s)
DAVINZ	-0.632	-0.400	3923.4	-0.921	-0.800	3950.7
FreeShap	0.394	0.300	7698.3	-0.498	-0.600	7862.2
In-Run DS	0.529	0.400	1108.8	0.445	-0.200	1094.5
WTE	0.500	0.100	2980.5	0.804	0.800	2907.6
TV	0.825	0.900	3098.9	0.826	0.800	3091.4
SecDVA	0.843	0.900	207.4	0.855	0.900	192.5

• The authors state that SecDVA gives the most accurate estimates and the shortest time cost in most dataset pairs in Tables II–IV; baseline performance is unstable, e.g., In-Run DS and TV perform poorly in the Office-Home feature-difference scenario, and TV performs well in the feature + label difference scenario but this does not hold in other scenarios.
• Table III (PACS/Office-Home leave-one-domain-out): SecDVA's P.C. on the four PACS domains is 0.862/0.928/0.922/0.914, with an average time cost of 89.2 s; on the four Office-Home domains the P.C. is 0.833/0.971/0.894/0.835, with a time cost of 147.6 s, both better than the baselines in the same table.
• Table IV (DomainNet→PACS/Office-Home): SecDVA's P.C. on the four PACS domains is 0.934/0.945/0.825/0.836, with a time cost of 245.9 s; on the four Office-Home domains the P.C. is 0.859/0.835/0.940/0.878, with a time cost of 280.2 s.

Ablation and Model-Scale Sensitivity

• Ablation (Table V, DomainNet→Office-Home): After removing landmark correction, the P.C. on the four domains drops to 0.745/0.675/0.802/0.745 (time cost 215.7 s); after removing cumulative correction, it drops to 0.817/0.803/0.864/0.789 (261.6 s); full SecDVA is 0.859/0.835/0.940/0.878 (280.2 s). The authors state that this verifies the necessity of both corrections.
• Model scale (Table VI): On ViT-Tiny/Small/Base/Large, the average P.C. over the four domains is approximately 0.859/0.834/0.846/0.855 respectively (values for domain A), and the time cost rises from 280.2 s to 9377.4 s; the authors state that SecDVA scales effectively.
• Hyperparameter sensitivity (Figure 5): The authors state that performance is stable after ζ falls below some threshold between approximately 0.01 and 0.001 (or corresponds to the NTK convergence state); it is stable when µ is greater than 0.001 and degrades when µ is too small; performance is insensitive to batch size but reducing it increases time cost, and landmark size shows the opposite phenomenon. Only the trends of two polylines across five values and the axis labels are visible in the figure; specific values are not labeled.

MPC Experiments

• Input verification (Table VII, 32MB dataset): SecDVA 2.09 ms (computational security parameter 128, statistical security parameter 2⁻⁴⁰); FullPto LowMC version 3.49 s (64, 0.01), SHA-256 version 119 s (128, 0.01). The authors state that this is 1670× and 56938× faster respectively, and that FullPto's check fails with non-negligible probability.
• Microbenchmarks (Table VIII, against Shark): DPF/DCF communication 2080 vs 3266 MB, time cost 0.45 vs 2.21 s; DReLU time cost is 19.3% of Shark's and communication 70.5%; Truncation is 20.6% and 67.2%; LUT is 58.1% and 91.0%.
• Transformer operators (Table IX): Softmax (197×197) SecDVA mean error 0.0001 vs Shark 0.0051, but communication and time cost are 1.95× and 1.66× those of Shark; GeLU (197×768) Shark mean error 2.3749, SecDVA 0.0013, communication and time cost are 5.30× and 2.36× those of Shark; compared with Shark* at the same precision, the time costs of LayerNorm/Softmax/GeLU are 28.5%/19.1%/26.4% of its time cost respectively; 32×32 matrix inversion 212 MB, 1.27 s, mean error 0.0009 (not implemented in Shark, recorded as "–").
• End-to-end (Figure 6, ViT-Tiny): Full secure inference takes 43.6% of Shark*'s time and 86.9% of its communication; on CIFAR-100, mini-batch parameter displacement computation takes about 8,572 s with 6,674 GB of communication, with cosine similarity 0.933 and Euclidean distance 0.04 to the plaintext result. The authors state that this verifies practical feasibility and note that it can be further optimized through parallelization and GPU acceleration.

Limitations and Future Directions Noted by the Authors

• The paper does not specifically discuss limitations (there is no Limitations section, and the Conclusion and appendix notes list neither limitations nor future directions).
• The main text mentions room for implementation optimization: the MPC computation of parameter displacement "has great potential for introducing implementation optimizations such as parallelization and GPU acceleration" (Section VI-B4), which is an improvement point noted by the authors rather than a stated limitation.

Scope of Experimental Coverage

• The models tested are ViT-Tiny/Small/Base/Large, 4 in total, all image Transformers; the datasets are CIFAR-10, CIFAR-100, PACS, Office-Home, and DomainNet, 5 image datasets in total (Section VI).
• Plaintext comparison covers 5 DV/DS baselines; in the MPC comparison, input verification is compared against FullPto, and operators and end-to-end are compared against Shark/Shark*; the authors explain that because the protocol targets the (2+1)-party setting, comparisons with other configurations were excluded, and that SecDVA includes computations Shark does not support, so it is compared with Shark only on inference (Section VI, Comparison Baselines).
• MPC experiments were measured in a local network simulation environment with a single thread, 10 Gbps bandwidth, and 0.01 ms RTT; each microbenchmark was executed 1 million times (Section VI, Implementation Details).
• The paper does not report the number of repetitions or variance for the plaintext correlation experiments; the construction details of the ground-truth data value, the full MPC protocol, and the security proof are all in supplementary material [78] and are not given in the main text.
• The cosine similarity between the MPC result and the plaintext result for parameter displacement is 0.933, with Euclidean distance 0.04 (Section VI-B4), i.e., not fully exact.

SecDVA is a maliciously secure MPC data valuation (DVA) framework for ML data markets, which the authors state is the first such framework.

• Problem addressed: when a buyer evaluates the value of seller data to its own model before purchase, existing approaches require one party to expose its data or model, posing privacy leakage and seller valuation-inflation risks; the existing MPC scheme FullPto assumes the model is public, supports only small models, and does not allow distribution differences.
• Method highlights: NTK theory is used to linearize the output change caused by gradient descent, and the parameter displacement produced by seller data is projected onto the buyer task direction to handle distribution differences; diagonal batch approximation (batch size 32) plus landmark correction (1% of the dataset) compress the NTK computation; on the cryptographic side, (2+1)-party FSS/SPDZ-MPC with a semi-honest dealer is used, with optimized DPF/DCF, C-VOLE for input consistency verification, and high-precision implementations of GeLU/Softmax/LayerNorm/matrix inversion.
• Plaintext results: on CIFAR-10→CIFAR-100, P.C./S.C. are 0.843/0.900 with a runtime of 207.4 s, outperforming 5 DV/DS baselines (Table II); across the PACS, Office-Home, and DomainNet settings it is also mostly best (Tables III–IV).
• MPC results: input verification for 32MB of data takes 2.09 ms, which the authors state is 56938× faster than FullPto's SHA-256 version (Table VII); end-to-end secure inference on ViT-Tiny takes 43.6% of Shark*'s runtime at the same precision and 86.9% of its communication; CIFAR-100 parameter displacement computation takes about 8,572 s with 6,674 GB of communication, and the cosine similarity with the plaintext is 0.933.
• Authors' conclusion: the authors state that SecDVA's plaintext evaluation utility outperforms baselines, and that it completes DVA under MPC on large models in reasonable time, showing practical feasibility; its high-precision operator design suits precision-sensitive computations such as gradients and matrix inversion.