SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Ganyu Wang
Western University
gwang382@uwo.ca
Bin Gu *
Jilin University and MBZUAI
jsgubin@gmail.com
Qingsong Zhang
Xidian University hang1995@gmail.com
Xiang Li
Western University lixiang41@126.com
Boyu Wang
Western University bwang@csd.uwo.ca
Charles X. Ling *
charles.ling@uwo.ca
Vertical Federated Learning (VFL) is a collaborative machine learning paradigm that enables multiple participants to jointly train a model on their private data without sharing it. To make VFL practical, privacy security and communication efficiency should both be satisfied. Recent research has shown that Zero-Order Optimization (ZOO) in VFL can effectively conceal the internal information of the model without adding costly privacy protective add-ons, making it a promising approach for privacy and efficiency. However, there are still two key problems that have yet to be resolved. First, the convergence rate of ZOO-based VFL is significantly slower compared to gradient-based VFL, resulting in low efficiency in model training and more communication round, which hinders its application on large neural networks. Second, although ZOO-based VFL has demonstrated resistance to state-of-the-art (SOTA) attacks, its privacy guarantee lacks a theoretical explanation. To address these challenges, we propose a novel cascaded hybrid optimization approach that employs a zeroth-order (ZO) gradient on the most critical output layer of the clients, with other parts utilizing the first-order (FO) gradient. This approach preserves the privacy protection of ZOO while significantly enhancing convergence. Moreover, we theoretically prove that applying ZOO to the VFL is equivalent to adding Gaussian Mechanism to the gradient information, which offers an implicit differential privacy guarantee. Experimental results demonstrate that our proposed framework achieves similar utility as the Gaussian mechanism under the same privacy budget, while also having significantly lower communication costs compared with SOTA communication-efficient VFL frameworks.
Federated Learning [30, 22, 23, 18, 31] is an emerging technique that has raised wide attention recently. It has become one of the most important distributed learning frameworks for enabling multiple data holders to train a model collaboratively without sharing their local privacy data explicitly.
*Co-corresponding authors
(a) FOO-based VFL
(b) ZOO-based VFL
(c) VFL-CZOFO (Ours)
Figure 1: Comparing the Asyn-VFL Frameworks
Our research focuses on VFL, where each client possesses all the data points, but only a non-intersecting subset of the features (vertically distributed). In VFL, all participants collaborate to train a single global model. The client trains a feature extraction model that maps its local data sample to embeddings, and the server collects the embeddings from all clients to make a prediction [21, 34, 6, 39, 16, 37, 14, 42, 43, 13].
Ensuring both privacy and computation-communication efficiency is crucial for practical VFL implementations. One common approach to achieve this is starting with a basic VFL [5, 6, 28] and subsequently applying privacy protection techniques, such as Secure Multiparty Computation (SMC) [8], Differential Privacy (DP) [32, 36], and Homomorphic Encryption (HE) [36, 32] to protect privacy. However, the addition of these protection techniques often increases computation-communication costs. To avoid these costly protective add-ons, research attention has turned to Zero-Order Optimization (ZOO). Literature reports that ZOO-based VFL is able to conceal the internal information of the model (gradient/model parameter) making the SOTA privacy inference attack ineffective [41]. This finding highlights the potential of ZOO for efficient and secure VFL.
However, two critical problems remained. First, the convergence rate of ZOO-based VFL is significantly slower [41] compared to VFL frameworks optimized with gradient, resulting in a high number of communication rounds and increased communication costs. Furthermore, the convergence rate is negatively correlated to the size of the parameters optimized using ZOO [41, 27, 12], which hinders the application of ZOO-based VFL on large neural networks. Second, although ZO-based VFL has demonstrated resistance to SOTA attacks, its privacy guarantee has not been theoretically explained.
To solve the first problem, we reevaluate the advantages and disadvantages of applying first-order (FO) or zero-order (ZO) gradient methods for each component of the VFL, and find an optimal balance between efficiency and privacy protection. This analysis leads to a novel cascaded hybrid optimization framework that efficiently solves the convergence problems while fully preserving privacy protection. Specifically, our proposed framework (VFL-CZOFO) utilizes the ZO gradient for optimizing the most critical output layer of the clients, while other parts are optimized with the FO gradient<sup>2</sup>. To address the second problem, we theoretically prove that applying ZOO on VFL is equivalent to adding Gaussian Mechanism [7] to the gradient information and can provide a corresponding intrinsic  $(\epsilon, \delta)$ -DP guarantee.
For a clear illustration, a schematic diagram of our proposed framework is presented in Figure 1-(c). The advantage of our framework is two-fold. First, it greatly alleviates the slow convergence problem of ZOO-based VFL (Figure 1-b), where our framework's convergence is solely limited by the output size of the clients, rather than the parameter size of the entire model. Second, compared with the FOO-based VFL (Figure 1-a), the connection layer of our framework used ZOO, allowing the backward messages to be solely losses, thus inheriting the privacy protection of the ZOO-based VFL.
The primary innovations of our paper are as follows: 1) Our framework employs a novel cascaded hybrid optimization method, in which different optimization methods are applied to different layers of the global model in each iteration, which significantly improves the convergence rate of ZOO-based VFL while preserving privacy. To the best of our knowledge, no prior research in VFL has proposed a similar method that cascaded a hybrid optimization and exploits its advantages. 2) We provide
2Additionally, we apply compression to further reduce the communication cost of our framework.
a theoretical explanation of the intrinsic privacy guarantee of ZOO, based on  $(\epsilon, \delta)$ -DP, which is fundamentally different from the common DP mechanism, where noise is added to items afterward.
In summary, the contributions of our paper are:
- We propose the cascade hybrid optimization method in VFL, where ZOO is applied to the most essential part of the VFL, which provides intrinsic privacy protection and significantly improves the convergence rate compared with the ZOO-based VFL.
- Theoretically analysis shows: 1) the intrinsic  $(\epsilon, \delta)$ -differential privacy guarantee provided by ZOO within our framework, 2) the convergence of our framework and its superiority compared with the ZOO-based VFL, 3) the compatibility of communication compression for both forward and backward messages within our framework.
- Extensive experiments show: 1) with the same  $(\epsilon, \delta)$ -differential privacy guarantee, our method can achieve a similar utility as the Gaussian Mechanism, 2) Our method significantly reduces the communication cost compared with the SOTA communication-efficient VFL.
2 A Detailed Comparison with SOTA VFL Frameworks
Table 1 presents a comparison of our VFL framework with other SOTA VFL frameworks, including "split-learning" [34], "compressed-VFL" [5], "Syn-ZOO-VFL"3, "VAFL" [6], "ZOO-VFL" [41]. In the table, Asyn/Syn are abbreviations for asynchronous and synchronous. The  $T$  is the iteration of the model.  $d$  and  $d_h$  represent the size of the entire global model's parameter and the size of the client's output embeddings, respectively. The "communication size per iteration" column summarizes the number of elements in the original messages before any post-processing, such as compression.  $B$  is the batch size.  $q$  is the sampling times for multiple point estimation of ZOO [27].
Compared to the FOO-based VFL [34, 5, 6] our framework has two distinct advantages. First, our framework leverages the intrinsic privacy protection of ZOO, which is a result of its stochastic characteristics and the concealment of internal information. Second, we leverage the advantage of ZOO to reduce the communication cost from the server to the client where the backward message consists of merely  $q$  elements, which is typically significantly smaller than the FO-based VFL with  $d_h B$  elements. The key difference between our framework and the FOO-based framework is that our approach reduces communication costs while simultaneously ensuring privacy protection. In contrast, FOO-based VFL typically shares internal information (parameters/gradient) [6, 5] and then applies for extra privacy protection mechanism [36, 32].
Compared with the ZOO-based VFL [41], this framework and ours both leverage the privacy protection of ZOO in VFL. However, ZOO-based VFL suffers from a slow convergence rate of  $\mathcal{O}(d / \sqrt{T})$  which is constrained by the global model parameter size  $d$ . This hinders its effectiveness when dealing with "larger" networks containing millions of parameters, causing higher communication costs due to increased communication rounds. To address this issue, we applied ZOO to the crucial connection layer between the server and the client. By doing so, we maintained the privacy protection offered by ZOO while significantly mitigating the slow convergence problem, reducing the constraint from the entire global model size  $d$  to merely the output size of the clients  $d_h$ .
Table 1: Compare with Different VFL Algorithm
Framework	Privacy	Asyn/Syn	Optimization	Convergence O(·)	Comm. Size per Iter. (Forward + Backward)
Split learning [34]	X	Syn	FO	1/√T	dhB + dhB
Compressed-VFL [5]	X	Syn	FO	1/√T	dhB + dhB
VAFL [6]	X	Asyn	FO	1/√T	dhB + dhB
Syn-ZOO-VFL	✓	Syn	ZO	d/√T	2dhB + 1
ZOO-VFL [41]	✓	Asyn	ZO	d/√T	2dhB + 1
VFL-CZOFO (Ours)	✓	Asyn	ZO&FO	dh/√T	dhB + q
This is the synchronous version of ZOO-VFL, the algorithm is in Appendix E.1.
Problem Definition In the VFL framework, there is one server and  $M$  clients. The server holds the label  $y_{i}$  for each sample  $i \in [n]$ ,  $([n] \triangleq \{1, 2 \cdots n\})$ , while each client holds a non-intersecting feature set for all the samples. Specifically, the features for sample  $i$  on client  $m$  are denoted as  $x_{m,i}$ . Client  $m$ 's model,  $h_m(w_m; x_{m,i})$ , is parameterized by  $w_{m}$  and takes local feature  $x_{m,i}$  as input, outputting the embedding. The server inputs the embeddings from all clients into its own model, which is parameterized by  $w_{0}$ , and then calculates the losses for updating the parameters. The VFL framework can be viewed as solving a finite-sum problem in composite form:
$$
f \left(w _ {0}, \mathbf {w}; X, Y\right) = \frac {1}{n} \sum_ {i = 1} ^ {n} \underbrace {\left[ \mathcal {L} \left(w _ {0} , h _ {1 , i} , \dots , h _ {M , i} ; y _ {i}\right) \right]} _ {f _ {i} \left(w _ {0}, h _ {1, i}, \dots , h _ {M, i}\right)} \text {w i t h} h _ {m, i} = h _ {m} \left(w _ {m}; x _ {m, i}\right) \quad \forall m \in [ M ] \tag {1}
$$
where  $\mathbf{w} = [w_1, \dots, w_M]$  denotes the parameter for all clients,  $X$  denotes the entire feature set across all clients, and  $y$  denotes the labels for all samples. For notation brevity, we define the outputs from all clients as  $\Phi_i(\mathbf{w}) = [h_1(w_1; x_{1,i}), \dots, h_M(w_M; x_{M,i})] = [h_{1,i}, \dots, h_{M,i}]$ . Therefore, the loss for the  $i$ -th sample can be represented as  $f_i(w_0, \Phi)$ .  $\mathcal{L}(\cdot; y_{true})$  is the loss function.
Cascaded and Minimal Application of ZOO on the Connection Layer Applying ZOO on VFL resolves the privacy leakage issue from the gradient [41], but simply applying ZOO to the entire VFL has a slow convergence problem, leading to a high number of communication rounds. Specifically, the major problem of ZOO is that with more dimensions on the gradient that need to be estimated, more variance will be introduced in the estimation of the gradient [27, 3]. This is especially problematic for machine learning scenarios where even relatively small models may have millions of parameters. To address the slow convergence problem of ZOO-based VFL, we precisely apply ZOO to the client's output layer, while the rest of the model utilizes the FO gradient. This approach significantly improves the convergence of the ZOO-based VFL, since only a small portion of the entire model uses ZOO.
ZOO [12] estimates the gradient of a function by sampling a random perturbation within the function's domain of definition and evaluating its shift on the value domain. To estimate the partial derivative with respect to the output layer of the client's model, we apply the average random gradient estimation (Avg-RandGradEst) [27, 25] which utilizes  $q$  i.i.d. samples  $\{u_{m,i}^{j}\}_{j = 1}^{q}$  on the objective function:
$$
\hat {\nabla} _ {h _ {m, i}} f _ {i} \left(w _ {0}, h _ {1, i}, \dots , h _ {M, i}\right) = \frac {\phi \left(d _ {h _ {m}}\right)}{q \mu_ {m}} \sum_ {j = 1} ^ {q} [ \underbrace {f _ {i} \left(h _ {m , i} + \mu_ {m} u _ {m , i} ^ {j}\right) - f _ {i} \left(h _ {m , i}\right)} _ {\delta_ {m, i} ^ {j}} ] u _ {m, i} ^ {j} \tag {2}
$$
where  $f_{i}(h_{m,i} + \mu_{m}u_{m,i})$  is the abbreviation for  $f_{i}(w_{0},h_{1,i},\dots h_{m,i} + \mu_{m}u_{m,i}\dots ,h_{M,i})$ ,  $d_{h_m}$  is the size of the output layer of client  $m$ .  $\phi (d_{h_m})$  is a dimension-dependent factor [26] related to the choice of the distribution  $p$  of the random vector  $u_{m,i}^{j}$ . If  $p$  is the multivariate uniform distribution  $\mathcal{U}(\mathcal{S}(\mathbf{0},1))$  on a unit sphere centered at  $\mathbf{0}$  with radius 1, then  $\phi (d_{h_m}) = d_{h_m}$ . If  $p$  is the multivariate normal distribution  $\mathcal{N}(\mathbf{0},\mathbf{I})$ , then  $\phi (d_{h_m}) = 1$ .  $q$  is the sampling times. The clients cannot calculate  $\delta_{m,i}^{j}$  by themselves because the loss function  $f_{i}(\cdot)$  is held by the server, therefore the server has to send the  $\delta_{m,i}^{j}$  back to the clients<sup>6</sup>. To implement multiple-point estimation, the server must transmit multiple distinct values of  $\delta_{m,i}^{j}$  to the client, with the number of values sent equaling the number of sampling points  $q$  used in the Avg-RandGradEst.
The theoretical difficulty in analyzing our framework is that different optimization methods are cascaded within a single model. Unlike most VFL research [34, 5, 28, 6, 41] which updates the global model with a unified optimization method, e.g.  $\nabla f_{i}(w_{m})$  (VAFL [6]) or the  $\hat{\nabla} f_{i}(w_{m})$  (ZOOVFL [41]), we apply a cascaded hybrid gradient via chain rule, i.e.  $\hat{\nabla}_{h_m}f_i(h_{m,i})\cdot \nabla_{w_m}h_{m,i}$ , where  $\hat{\nabla}_{h_m}f_i(h_{m,i})$  is the stochastic gradient estimator of the partial derivative w.r.t. the output layer of the client, and  $\nabla_{w_m}h_m(w_m)$  is the local gradient of the client.
4Server and clients are the roles in the framework, in practice, one participant may take more than one role.
Although sample  $i$  was used throughout this paper, it is easy to generalize our approach to a mini-batch  $B$ .
The server and the client also need to share an identical random sequence  $u_{m,i}$ , but this can be achieved by sharing one random seed at the beginning of the training, or use the sample ID as the random seed.
Compress the Communication Furthermore, we demonstrate that compression is compatible with our approach, and can be applied to all communications in the framework, including the forward message [5] and the backward message [35]. We define the compressor of the client as  $\mathcal{C}_m(\cdot)$ , and the compressor of the server as  $\mathcal{C}_0(\cdot)$ . In each communication round, the client  $m$  sends compressed embeddings instead of the raw message to the server, and the server replies with the compressed messages. We apply the uniform scale compressor [2] in the experiment. However, other compression schemes such as Top-K [24], sign-SGD [4], and lattice quantization [40] can also be applied to the different parts of our framework to further reduce the message size.
The theoretical challenge in proving the convergence with compression lies in that two errors (forward and backward) are introduced in the analysis. The first error affects the embeddings sent from the client to the server, where the error influences the server's model input, creating uncertainty in the loss value and gradients for updating the parameter. We bound this error by imposing assumptions on the curvature of the loss function, i.e. an upper bound for the norm of the Hessian matrix. The second error affects the message sent from the server to the clients, which then updates using the hybrid gradient with compression error. As a result, there are three different sources of uncertainty in the clients' parameter update: the two mentioned above, as well as the error caused by ZOO.
Algorithm In this section, we propose our asynchronous VFL<sup>7</sup> with ZOO on the connection layer and compression on the communication messages. Starting with the client, which randomly selects a sample  $i$  and sends its local model output to the server. Receiving the forward message from the client  $m$ , the server calculates the  $\delta_{m,i}^{j}$  with Avg-RandGradEst (Eq. 2) and group  $\delta_{m,i}^{j}$  with  $j = 1,2,\dots,q$  into a vector  $\Delta_{m,i}$ . The server compresses  $\Delta_{m,i}$  and sends it back to the client. Then the server and client update their local model with the "gradient".
Algorithm 1 VFL-CZOFO
Input: Learning rate  $\eta_{m}$ , smoothing parameter  $\mu_{m}$ , compressor  $\mathcal{C}_m$  for  $m\in \{0,1,\dots M\}$ .  
Output: Parameter  $w_{m}$  for  $m\in \{0,1,\dots M\}$ .  
0: Initialize model parameter  $w_{m}$  for all participants  $m\in \{0,1,\dots M\}$   
1: while not convergent do  
2: when a client  $m$  is activated, do:  
3: Randomly select a sample  $x_{m,i}$   
4: Compute and send  $\mathcal{C}_m(h_m(w_m;x_{m,i}))$  to server  
5: Receive  $\mathcal{C}_0(\Delta_{m,i})$  from the server (in a listen manner)  
6: Compute  $\hat{\nabla}_{h_{m,i}}f_i(w_0,\Phi_i)$  via Avg-RandGradEst (Eq. 2)  
7: Compute  $\nabla_{w_m}h_m(w_m;x_{m,i})$  via backpropagation.  
8: Compute  $v_{m} = \hat{\nabla}_{h_{m,i}}f_{i}(w_{0},\Phi_{i})\cdot \nabla_{w_{m}}h_{m,i}$   
9: Update  $w_{m}\gets w_{m} - \eta_{m}v_{m}$   
10: when server receives from client  $m$ , do:  
11: Compute  $\delta^{l}_{m,i}$  and group into  $\Delta_{m,i}$   
12: Send  $\mathcal{C}_0(\Delta_{m,i})$  to the client  $m$   
13: Compute  $v_{0} = \nabla_{w_{0}}f_{i}(w_{0},\Phi_{i})$ , (FOO)  
14: Update  $w_{0}\gets w_{0} - \eta_{0}v_{0}$   
15: end while
4 Security Analysis
Threat Model We discuss privacy under two scenarios: "honest-but-curious" and "honest-but-colluded". In both scenarios, all participants are assumed to follow the protocol and perform their assigned tasks. Under the "honest-but-curious" scenario, a curious client attempts to obtain private information from other participants using the information they have received. In the "honest-but-colluded" scenario, some participants collude to obtain private information from other participants. The attacker in this scenario can access all information and messages from the colluding participants. In the "honest-but-colluded" scenario, the attacker's capability is either equal to or stronger than in the "honest-but-curious" scenario. This is because the attacker can acquire more information from other participants when colluding, therefore increasing their ability to infer sensitive data.
<sup>7</sup>A schematic graph and illustration of asynchronous VFL is in the Appendix section D.1
Theorem 4.1. Differential Privacy Guarantee of Sharing the ZO Gradient: Under the "honest-but-colluded" threat model where the attacker can access all information of all clients through the entire training process, including the client's dataset, model, and the ZO gradient received from the server. Under algorithm 1, with  $q$  being sufficiently large,  $\zeta$  being the maximum  $l_{2}$ -norm of the partial gradient w.r.t. any client's output through the entire training. If the following condition holds:
$$
\sigma_ {m _ {t}, s} = \sqrt {\frac {1}{q d _ {h} T} \sum_ {t = 0} ^ {T - 1} \operatorname {t r} \left(\Psi_ {m _ {t}} ^ {t}\right)} > \frac {2 \zeta \sqrt {2 \ln (1 . 2 5 / \delta)}}{N \cdot \epsilon} \tag {3}
$$
we can derive that sharing the stochastic gradient estimation from the server ensures  $(\bar{\epsilon},\bar{\delta})$ -DP for all  $\epsilon, \delta, \delta' > 0$ , where  $\bar{\epsilon} = \sqrt{2T\ln(1 / \delta')\epsilon} + T\epsilon(e^{\epsilon} - 1)$ ,  $\bar{\delta} = T\delta + \delta'$ .
Proof sketch: The proof can be found in Appendix C.1. Firstly, we establish that each client's update can be modeled with an ideal sequence, where the unbiased parameter is updated with the gradient of the smoothed loss function  $f_{\mathbf{u},i}(w_0^t,\Phi_i) = \mathbb{E}_{\mathbf{u}}[f_i(w_0,\Phi (\mathbf{w})) + \mu \mathbf{u}]$ . Since Avg-RandGradEst in Eq. 2 is an average of  $q$  independently and identically distributed samples from  $f_{i}(\cdot)$ , applying the central limit theorem, the estimated gradient is normally distributed for sufficiently large  $q$ . We can then apply the differential privacy guarantee for the Gaussian Mechanism to the estimated gradient. Finally, the accumulated privacy guarantee is derived from the advanced composition theorem.
Remark 4.2. This theorem tells that under the worse case where a strong attacker has obtained all of the ZO information  $\Delta_{m,i}$  from all client  $m\in [M]$ , of all sample  $i\in [N]$ , during the entire training process  $t\in [T]$ , the attacker cannot differ a single data point in the dataset, with  $(\bar{\epsilon},\bar{\delta})$ -DP guarantee. Remark 4.3. Since the ZO gradient is shared from the server to clients, this theorem mainly provides a privacy guarantee for the label on the server.
Remark 4.4. For a weaker attacker, where the attacker can only access the information from fewer clients ("honest-but-colluded"), or only one client ("honest-but-curious"), the privacy guarantee either remains the same or is strengthened.
Additionally, in Appendix C.2, we provided a detailed discussion of the privacy protection of our approach at the framework level, plus a discussion on the SOTA inference attacks under "honest-but-curious" [10, 33, 45, 45, 44, 17, 9] and "honest-but-colluded"[10, 45, 29, 38] threat model.
Assumption 5.1. The formal definition and detailed discussion of the assumptions are in Appendix B. We assume that there is a feasible optimal solution for  $f(\cdot), \nabla f_{i}(\cdot)$  is  $L$ -Lipschitz continuous,  $f_{i}(\cdot)$  has an unbiased gradient, bounded Hessian  $H_{m}$  and bounded block-coordinate gradient  $\mathbf{G}_m$ . The activation of the clients is independent, and the client has a uniformly bounded delay  $\tau$ .
Theorem 5.2. Under assumption 5.1, to solve the problem 1 with algorithm 1, the following inequality holds.
$$
\begin{array}{l} \frac {1}{T} \sum_ {t = 0} ^ {T - 1} \mathbb {E} \left\| \nabla f \left(w _ {0} ^ {t}, \mathbf {w} ^ {t}\right) \right\| ^ {2} \leq \frac {4 p _ {*} \mathbb {E} \left(f ^ {0} - f ^ {*}\right)}{T \eta} + 2 \eta p _ {*} L _ {*} \left(4 d _ {*} \mathbf {G} _ {*} ^ {4} + \mu_ {*} ^ {2} L _ {*} ^ {2} d _ {*} ^ {2} \mathbf {G} _ {*} ^ {2} + 2 \sigma_ {0} ^ {2}\right) \\ + 7 \eta^ {2} p _ {*} \tau \mathbf {G} _ {*} ^ {2} \left(4 d _ {*} \mathbf {G} _ {*} ^ {2} + \mu_ {*} ^ {2} L _ {*} ^ {4} d _ {*} ^ {2} + 2 L _ {*} ^ {2} \Gamma\right) \\ + \mu_ {*} ^ {2} p _ {*} L _ {*} ^ {2} d _ {*} ^ {2} \mathbf {G} _ {*} ^ {2} + \mathcal {E} p _ {*} H _ {*} ^ {2} (6 + 1 6 \mathbf {G} _ {*} ^ {2}) + 1 7 \Gamma p _ {*} \mathbf {G} _ {*} ^ {2} \\ \end{array}
$$