Cross-Silo Training of Differentially Private Models with  Secure Multiparty Computation
Authors: Sikha Pentyala
Davis Railsback
Ricardo José Menezes Maia
David Melanson
Rafael Dowsley
Anderson Nascimento
Martine De Cock
Venue: Submitted to ICLR 2023 (2023)
Keywords: Privacy-preserving machine learning
Secure multi party computation
Differential privacy

Abstract: We address the problem of learning a machine learning model from training data that originates at multiple data holders in a cross-silo federated setup, while providing formal privacy guarantees regarding the protection of each holder's data. Existing solutions based on Differential Privacy (DP) achieve this at the cost of a drop in accuracy. Solutions based on Secure Multiparty Computation (MPC) do not incur such accuracy loss but leak information when the trained model is made publicly available. We propose an MPC solution for training differentially private models. Our solution relies on an MPC protocol for model training, and an MPC protocol for perturbing the trained model coefficients with Laplace noise in a privacy-preserving manner. The resulting MPC+DP approach achieves higher accuracy than a pure DP approach, while providing the same formal privacy guarantees. 

Under review as a conference paper at ICLR 2023
CROSS-SILO TRAINING OF DIFFERENTIALLY PRIVATE MODELS WITH SECURE MULTIPARTY COMPUTATION
Anonymous authors Paper under double-blind review
ABSTRACT
We address the problem of learning a machine learning model from training data that originates at multiple data owners in cross-silo federated setup, while providing formal privacy guarantees regarding the protection of cach owner's 's data, Existing solutions based on Differential Privacy (DP) achieve this at the cost of a drop in accuracy. Solutions based on Secure Multiparty Computation (MPC) do not incur such accuracy loss but leak information when the trained model is made publicly available. We propose an MPC solution for training differentially private models. Our solution relies on an MPC protocol for model training, and an MPC protocol for perturbing the trained model coefficients with Laplace noise in a
manner. The resulting MPC+DP approach achieves higher accuracy than pure DP approach, while providing the same formal privacy guarantees.
INTRODUCTION
The ability to induce a machine learning (ML) model from data that originates at multiple data owners (clients) cross-silo federated setup, while protecting the privacy of each data owner, is of great practical value in a wide range of applications, for a variety of reasons. Most prominently, training more data typically yields higher quality MI. models. For instance, more accurate model to predict the length of hospital stay of COVID-19 19 patients when combining data from multiple clinics. This is cross-silo application where the data is horizontally distributed, meaning that each data owner (clinic) has records/rows of the data (HFL.. Furthermore, being able to combine different data sets enables new applications that pool together data from multiple data owners, or even from different data owners within the same organization. An example of this is an ML model that relies on lab test results as well as healthcare bill payment information about patients, which are usually managed by different departments within hospital system. This an example of a cross-silo application where the data is vertically distributed, i.e. each data owner has their own columns (VFL). While there clear advantages training ML models over data that is distributed across multiple data owners, in practice often these data owners do not want to disclose their data to each other, because the data in itself constitutes competitive advantage, because the data owners need comply with data privacy regulations.
could train
The importance of enabling large research effort in this domain, most notably in the development and of Finhac--nnanncin Technologies (PETs), prominently including Federated Learning (FL) (Kairouz et al. (202I)). Dif- ferential Privacy (DP) (Dwork et al. (2014)). Secure Multiparty Computation (MPC) CCramer et al. (2015)), and Homomorphic Encryption (HE) (Lauter (202T)). Each of these techniques has its own (dis)advantages. Approaches based on (combinations of) FI., MPC, or HE alone do not provide sufficient protection if the trained model is to be made publicly known, or even if it only made available for black-box query access, because information about the model and its training data is leaked through the ability to query the model (Fredrikson al. (2015): Tramer et al.] (2017); Carlini et al. (2019)). Formal privacy guarantees in this case can be provided by DP. however at cost of accuracy loss that is inversely proportional to the privacy budger (see Sec. 2 To
model training in federated setups has spurred a
(2016); 6); Soog
mitigate this accuracy loss, we propose an MPC solution for training DP models.
Our Approach. Rather than having each party training local models on their own data sets, we have the parties running an MPC protocol on the totality of the data sets without requiring each party to disclose their private information to anyone. Since we restrict our analysis to generalized linear models, we then have these parties using MPC generate the necessary noise and privately adding

---

Under review as a conference paper at ICLR 2023
it to the weights of the trained classifier to satisfy DP requirements. We show that this procedure yields the same accuracy and DP guarantees as the global DP model however without requiring the parties to reveal their data, model parameters, or gradients to a central aggregator, or to anyone else for that matter. Indeed, the MPC protocols effectively play the role of a trusted curator implementing global DP. The resulting classifier can be published in the clear, or used for private inference on top of MPC. Our solution is applicable in cross-silo federated scenarios in which the data is horizontally distributed as well as in cross-silo federated scenarios where the data is vertically distributed. obtained the highest accuracy in the iDASH2021 Track IIII competition where the challenge was to propose a federated learning algorithm for training of a model to predict the risk of wild-type transthyretin amyloid cardiomyopathy using medical claims data from different hospitals, while providing DP guarantees
confidential computing,
2 PRELIMINARIES
Differential Privacy. DP is concerned with providing aggregate information about a data set D without disclosing information about specific individuals in D (Dwork et al. (2014)). A data set D that differs in a single entry from D called a neighboring database. A randomized algorithm A
is called (c, 8DD if for all pairs of neighboring databases D and D', and for all subsets S of A's range,
P(A(D) E S) S e P(A(D') S) 8
(1)
In other words, A DP if A generates similar probability distributions over outputs on neighboring
data sets D and D'. The parameter e 2 0 denotes the privacy budget or privacy loss, while ò 2 0 denotes the probability of violation of privacy, with smaller values indicating stronger privacy guarantees in both cases. c-DP is a shorthand for (c. O)-DP. A can for instance be an algorithm that takes as input data set D of training examples and outputs ML model. An (e, 6)-DP randomized algorithm A is commonly created out of an algorithm A by adding noise that is proportional to the sensitivity of A". We describe the Laplace noise technique that we use to this end in detail in Sec. J
Secure Multiparty Computation. MPC an umbrella term for cryptographic approaches that allow two or more parties to jointly compute a specified output from their private information in a distributed fashion, without revealing the private information to each other (Cramer et al. (2015)). MPC is concerned with the protocol execution coming under attack by an adversary which may corrupt one more of the parties to learn private information cause the result of the computation to be incorrect. MPC protocols are designed to prevent such attacks being successful, and can be mathematically proven to guarantee privacy and correctness. We follow the standard definition of the Universal Composability (UC) framework (Canetti) (2000), in which the security of protocols is analyzed by comparing a real world with an ideal world. For details, see Evans et al. (2018).
An adversary can corrupt a certain number of parties. In dishonest-majorit setting the adversary is able to corrupt half of the parties or more if he wants, while in an honest-majority setting. more than half of the parties are always honest (not corrupted). Furthermore, the adversary can have different levels of adversarial power. In the semi-honest model, even corrupted parties follow the instructions of the protocol, but the adversary attempts to learn private information from the internal state of the corrupted parties and the messages that they receive. MPC protocols that are secure against semi- honest or "passive" adversaries prevent such leakage of information. In the malicious adversarial model, the corrupted parties can arbitrarily deviate from the protocol specification. Providing security in the presence of malicious or "active" adversaries, i.c. ensuring that no such adversarial attack can succeed, comes at higher computational cost than in the passive case. The protocols in Sec. 4 are sufficiently generic to be used in misjontst-mmaority as well as honest-majority settings, with passive or active adversaries. This is achieved by changing the underlying MPC scheme to align with the desired security setting.
As an illustration, we describe the well-known additive secret-sharing scheme for dishonest-majority 2PC with passive adversaries. In Sec. [ we additionally present results for honest-majority 3PC and 4PC schemes with passive and active adversaries; for details about those MPC schemes we refer to Araki et al. (2016); Dalskov et al. (2021). In the additive secret-sharing 2PC scheme there are two computing parties, nicknamed Alice and Bob. All computations are done on integers, modulo an integer q. The modulo is a hyperparameter that defines the algebraic structure in which the computations are done. A value x in Z, (0, 1, ..................... 1) secret shared between Alice and Bob
http:/ http:///www.hnnaggennneprrrp wnspeppivvvayyyco vacy crg/ 2021 http://///////eo/ii/i///e/ wwwppppettiioootttttooo.o.. html
2

---

Under review as a conference paper at ICLR 2023
by picking uniformly random values 21, E Zg such that 21 + 22 x mod q. Ii and 22 additive shares of x (which are delivered to Alice and Bob, respectively). Note that no information about the secret value æ: is recovered by any of the individual shares 21 2/2, but the secret-shared value x can be trivially revealed by combining both shares z1 and 22. The parties Alice and Bob can jointly perform computations on numbers by performing computations on their own shares, without the parties learning the values of the numbers themselves.
For protocols in the passive-security setting, we use [æ] as a shorthand for a secret sharing of æ, i.c. [x]]] (2). Given secret-shared values [x] = (2) and [y] (11,32), and a constant
Alice and Bob can jointly perform the following operations, each by doing only local computations
on their own shares
Addition of constant (z = x + c): Alice and Bob compute (21 + c, 22). Note that Alice adds to
her share 11, while Bob keeps the same share Z2- This operation is denoted by [*]] < [ + c.
Addition (z = x + y): Alice and Bob compute (xr + 21, + y2) by adding their local shares of
and y. This operation is denoted by [^] < [x] + ltv.
Multiplication by constant (z c- x): Alice and Bob compute (c- -1, by multiplying their local shares of by c. This operation is denoted by +
Multiplication of secret-shared values [x]] and [v] is done using so-called multiplicatiinn triple (Beaver (192)), ). which is a triple of secret-shared values [u], [o]. [w]. such that and are uniformly random values in Zg and w = u V. Given that they have a multiplication triple, Alice and Bob can compute [d]] = [x]] [w] and [e] = [y] - [[], and, in a communication step, open d and e by disclosing their respective shares of d and to each other. Next, they can compute [2] [w] + d [v] + e. [u] + d which is equal to [æ y/. We denote this operation by [ f MMLL [y]). Each multiplication requires a fresh multiplication triple. Such triples can be predistributed by trusted initializer (TT). In case TT is not available or desirable, Alice and Bob can simulate the role of the TI, at the cost of additional pre-processing time and computational assumptions, see Mohassel and Zhang 2017).
Building on these cryptographic primitives, MPC protocols for other operations can be developed, including for privacy-presevvnng training of ML models and noise generation to provide DP guar- antees (see Sec. 4 Our protocols use well known subprotocols for division TDIV of secret-shared values, square root ITSRRT of secret-shared values, and generation of random values from uniform distribution TGR RANDOM (Keller (2020)).
3 RELATED WORK
Our approach preserves input privacy, i.e., ensures that the training data sets are not exposed (except under e-DP guarantees) to anyone but their original holders during (1) model training and (2) publication or inference. As we describe below, existing methods either do not fully protect input privacy, or they do so at the cost of higher accuracy loss than our approach.
MPC/HE based Model Training. Many cryptography based methods have been proposed for
privacy-preservee learning of ML models with data from multiple data owners, including for linear and
regression models (Gascón et al. (2017); Agarwal et al. (2019)) (ensembles of) decision trees (Lindell
and Pinkas 2000); Hoogh et al. (2. Abspoel et al. (202 [Adams et al. (2022)), and neural
network architectures (Mohassel and Zhang (2017); Wagh et al. (2019): Guo et al. (2020); De Cock al. (20TT). These techniques protect input privacy during training while still, in principle, producing the same ML models that one would obtain in the clear (i.e. when no encryption is used).
The latter is both a blessing, as there is accuracy loss, and problem, as upon model publication or
during inference, the trained models leak the same kind of information as models trained in-the-clear (Fredrikson et al. (2015); Tramer et al. 2016); Song al. 2017); Carlini et al. (201)). ). Because these methods do not provide DP guarantees, we do not compare with them in Sec. 5
DP and FL based Model Training, Much of the literature on training DP models (Abadi et al. (2016) is developed for the global DP (a.k.a. central DP) paradigm, which assumes the existence of a trusted curator (aggregator) who collects all the data and then trains a DP model over it, e.g. by adding noise to the gradients or the model coefficients. These methods do not preserve input privacy, since data owners need to disclose their data sets to the aggregator. A local DP approach in which privacy loss is controlled by having the data owners add noise to their input data before disclosing
We often omit the modular notation for conciseness.
3

---

Under review as a conference paper at ICLR 2023
to the aggregator, results in substantial utility degradation. We eliminate the need for trusted curator by simulating this entity through MPC protocols that are run directly by the parties themselves.
Another related existing approach combines Federated Learning (FL) with DP. In FL, each of the data owners participates in model training on their end and only exchanges trained model parameters or gradients with the central server (Kairouz et al. (202T)). To provide DP guarantees, the data owners can add noise protect the values that they send to the central server. In Sec. we compare with such an approach in which the data owners perturb their model coefficients before sending them to the central server for aggregation. This approach works only in the horizontally distributed data setting, while our approach (see Sec. works in the vertically distributed setting as well.
Combinations of MPC and DP. The key idea in our proposed approach is to train DP models while performing as much of the computations as possible in MPC protocols in order preserve accuracy. MPC and DP for ML have been well studied in isolation, but the strong privacy protections that can result from their synergy are still being explored (Wagh et al. (202I)) We combine MPC and DP to protect training data privacy during training and during inference. In practice, we simulate the trusted curator present in the centralized DP model by using MPC. While in the past such approach was avoided, due to the high computational cost of training the models on top of MPC, we argue that, with advances in protocols and computing power, the higher utility provided by such approach justifies its adoption in several situations. The idea to replace the trusted curator from the global DP paradigm with MPC to get better privacy at the same high utility will gain traction. [öhhee and Kerschbaum (2021) for instance have recently explored this idea for detecting the top l most frequent items across different data sets. They let each party locally compute partial noises which are then combined, which is different from our approach of letting the parties execute an MPC protocol to jointly sample secret-shared noise.
Combining MPC with DP has been proposed in the context of FL, where the data is horizontally distributed (see e.g. Acar et al. (2017)
et al. (2018); ; Pathak et al. (2010)) No solutions for the vertically partitioned scenario exist. Another possible approach is to use cryptographic protocols (not necessarily MPC) and differential privacy, such in Jayaraman al. (0118); Pathak
jet al. (2010); Chase et a (217); Byrd and Polychroniadou (2020); Truex et al. (2019). in order to train individual models on the data sets in possession of the computing parties and aggregate these models by averaging their coefficients. Again, this approach does not work for vertically partitioned data. Moreover, our solution trains the final model on the union of all the individual data sets, thus essentially obtaining the same utility that is achievable in the trusted curator scenario. Protocols for obliviously sampling from biased coins on MPC have been proposed in Champion et al. (2019). In Gu et al. (2021), framework for combining MPC and Federated learning proposed, but only works for the case of horizontally partitioned data. Moreover, the noise generation process described in Gu et al. (202I) happens in the clear (by each server) and it is combined by using secret sharing. That requires more noise than in our proposal (where the noise generated within MPC), thus reducing the utility of the data.
4 METHOD
Overview. We work in the scenario described in Fig. distinguushin between the data owners who hold the training data sets, and the computing parties who run the MPC protocols for model training and noise addition. Our solution works in scenarios in which each data owner (e.g. hospital or bank) is also a computing party, as well as in scenarios where the data owners outsource the computations to untrusted servers (computing parties) instead. The data holders secret share their data with a set of computing servers. The servers run an MPC protocol and produce an MI. model protected by DP. We implement our solution for 2, 3 and 4 computing servers, but they are general and work with any number of computing servers as well as data holders, by choosing an appropriate underlying MPC scheme for the desired number of computing parties (see Sec. 2). The resulting model can be used for private inference (on top of the underlying MPC protocol) or made open to the public.
The core of our solution is an MPC protocol TDP implementing a mechanism for providing c-DP by perturbing the coefficients of a trained logistic regression (LR) model with the addition of a noise vector y) that is sampled according to the density function
(2) In the above expression, n is the number of instances that were used to train the LR model, and A is the regularization strength parameter used during training. This technique provides c-DP provided
h(n))
- mil
4

---

Under review as a conference paper at ICLR 2023
that (C1) each input feature vector has an L2 norm of most 1; and (C2) the LR model is trained
using L2 regularization. If (C1) and (C2) are fulfilled, then the sensitivity of LR with regularization Chaudhuri and Monteleoni (2008); Chaudhuri et al. 2011
parameter A is at most
2 Rλ
data
data
data
holder Dr
holder Da
holder D2
Protocol 1: NNORM for secure L2 normalization
Input :A secret-shared vector [x] of length df : L2 normalized vector [x"orm]
Declare vector [x"orm] of length d'
2 [S] 0
MPC-protocols Tue and xpp
for i to d do
[S] [$] + MMUL ([>,), [m:])
compuicn party P.
compotiing party Ps
compattin party P.
5 end
6 [t] = TDw (SSRRT([S]))
7 for i 1o do
8
[x. [x:orm] 1 + MuuL [I=:] [o])
end
DD model
return [x [x
Figure| 1: criacc-preservvng training of an e-DP model with MPC
In all MPC protocols used in this paper, secret sharings are in Zg with 2^, i.e. a power 2 ring.
In Sec. 5 we present results with À = 64 for a varying number of data owners, and for 2, 3, and computing parties. Since all computations in MPC are done over integers in Z,y (see Sec. 2 the data owners first convert the real numbers in their data to integers using fixed-point representation (Catrina and Saxena (2010)) and subsequently split the integer values into secret shares which are sent to the computing parties (see Fig. [). While the original value of secret-shared number can be trivially revealed by combining the shares, the secret-sharing based MPC schemes ensure that nothing about the inputs is revealed to any subset of the computing parties that can be corrupted by an ad adversary. This means, in particular, that no computing party by itself learns anything about the actual values of the inputs. Next, the computing parties proceed by performing computations on the shares. In particular, the computing parties:
1. Jointly run MPC protocol TLR to L2 normalize the training data, and to subsequently infer a LR model using L2 regularization from the normalized data. At the end of this protocol, the coefficients of the model are secret-shared between the parties.
2. Jointly run MPC protocol TDP to add a noise vector to the secret-shared model coefficients. At the end of this protocol, the noisy coefficients of the model are secret shared between the parties.
3. Disclose their shares of the LR coefficients so that they can be combined in a final e-DP LR model.
As the noise in step 2 is generated and added to the weights using MPC, the computing parties will not learn it, hence they will not be able to retrieve the actual model coefficients from the noisy coefficients that are disclosed in step 3.
Protocol TLR for Model Training. At the beginning of the LR training protocol, the computing
parties have secret shares of set of labeled training examples 5 = {[xx), [{]]], each consisting of a secret-shared input feature vector x of length on an existing MPC protocol for training a LR with full gradient descent (GD) (Keller (2020)). We extended this protocol in two ways. First, to satisfy condition (CI), before the start of model training, we let the computing parties apply L2 normalization to the secret shares of each training example [x by running TNORM- Pseudocode for TNORM is provided separately in Prot. because we also need as subprotocol for DPP If the data is horizontally distributed across the data owners, then each data owner can apply sample-wise L2 normalization to their own instances before secret sharing the training instances with the computing parties. The computing parties in this case can skip the use of TNORM for this purpose, which will reduce the training runtime. Second, to comply with condition (C2), implemented regularization by changing the weight update rule to [Aw]= + C[Aw]= - a[Aw] gradients as maintained in secret-shared form throughout the model training; C is the momentum; the learning rate; and A is the regularization penalty. Pseudocode for TLR provided in Appendix
and secret shared label ML is based
Aa[w La[w]. In this expression. [w] and [Aw] are the weights and
A
5

---

Under review as a conference paper at ICLR 2023
Protocol 2: TDP for secure output pertur- bation
Protocol 3: wGss for secure sampling of a vector from a Gaussian distribution Input
Input :A secret-shares vector [w] with model coefficients w;; regularization
Vector length d.
Output :A secret-shared vector [s] of length d sampled from Gaussian distribution with mean 0 and variance Declare vector [s] of length d'
penalty A; total number n of training
examples; privacy budget e.
Output: :Sccret-shared vector [w] with
perturbed model coefficients
for i = 0 to d/'2 do
Tass (d)
[ <- RANDOM (0, 1)
TNORM([ (s).dd
TGR RANDOM (0, 1)
[7]
[0]
r
TSSRT( 2 ))
4 for:
d do
0 t 2n [0]
5.
[u] <- (TGR-RANDOR (0, 1)
82i + mmui ([r] acos ([0))
M < [LN([
[2++1] f TMUL (SIN (P))
< [>] + [u]
end
end
10 if cl is odd then
ce 2/(
11
[p] + Toss (2) [a- + [Po]
10 1-]+ + c[>]]
12
11 Initialize vector [w] of length df to [0]
13 end
12 for 1 to d do
14 return [s]
13
TMUL ([s:), bD))
10 [wa] + [8
15 end
16 return
[w]
Protocol TDP for Noise Generation. At the end of MPC protocol TLR, the coefficients w of the trained LR model are secret-shared between the parties. Next, the parties run the MPC protocol TDP, presented in pseudocode in Prot. 2 to generate noise and add it to the model coefficients to provide DP guarantees. Protocol TDP implements the output perturbation method (or sensitivity method) (Chaudhuri and Monteleoni (2008): Chaudhuri et al. (20TT)) in a privacy-preserving way. While the original output perturbation method relies on the fact that the model coefficients are known or disclosed to single entity, such as trusted curator, we do not make such an assumption. Instead, the model coefficients remain secret-shared among the computing parties, neither of which knows the true values. The challenge is for the parties to jointly generate noise that is appropriate for the true model coefficients that they cannot see, without learning the true value of the noise. Indeed, no entity safely be disclosed at
should learn the true value of the noise, so that the noisy model coefficients the end of the process (see step 3 in the overview at the beginning of this section), without Icaking information that would violate the DP guarantees.
In the output perturbation method, sensitivity is defined using the L.2 norm, and the noise vector is sampled from a particular instance of a multidimensional power exponential distribution h(п) oc et al. (2002), the computing parties can obtain secret shares of a vector s sampled according to the distribution (())). by following these steps, in which d the length of the vector (i.e. the number of model coefficients):
2 Ivl. Following Sánchez-
Generate a d-dimensional Gaussian vector s. That is, each coordinate of the vector sampled from a Gaussian distribution with mean zero and variance one. To this end, Line 1 in Prot. 2 calls TesS (see pseudocode in Prot. 3 which relies on the transform by Box and Muller (1958) to generate samples of the Gaussian untary distribution, namely [d/2] pairs of Gaussian samples. For each pair, on Line 3-4 in Prot. 3 the computing parties securely generate secret shares of two random numbers и and o uniformly distributed in [0.1] by executing -TR-RANNOM- In TGR (TGR-RANN RAAD-RANOMM each party generates / random bits, where / is the fractional precision of the power 2 ring representation of real numbers, and then the parties define the bitwise XOR of these bits as the binary representation of the random number jointly generated. On Line 5-8 in Prot. 3 the parties then jointly compute a secret sharing of (n2ln(u) (n((2)) and of 2-2 ln()) (2.rv) using MPC protocols TSQRT. TSIN, Tcos. and TL (Keller (2020)) In case is odd, one more sample needs to be generated. The parties do so on Line 1 11112 in Prot. by executing Tass to sample vector of length 2 and only retain the first coordinate.
2. Normalize s, that is divide each coordinate of s by its L2 norm (Line 2 in Prot 2 After steps 1-2, the parties have secret-shares of random d-dimensional vector on the unit sphere (this follows from the spherical symmetry of the multivariate Gaussian distribution).

---

Under review as a conference paper at ICLR 2023
3. In this step the computing parties change the magnitude of the vector obtained above to appro- priate value by sampling the gamma distribution [(d, mcx) to obtain a value 7, and multiplying each coordinate of the normalized vector produced in step 2 with 7. To generate a secret-shared sample [y]] from the r(d, neA distribution, on Line 3-8 in Prot. 2 the computing parties generate secret shares of d independent samples from the exponential distribution with rate parameter one (here denoted by Exp( 1)) and add them. To generate secret shares of one such sample we use the inverse transform sampling over MPC, which consists of computing - Inn u, where u is a random number with precision equal to bits generated by the computing parties within the interval [0, 1]: as in Prot. 3 to generate a random number with precision / in [0, 1]. Denote this number by u.
(a) On Line 5 the parties execute
(b) On Line 6 the parties compute secret shares of In(u).
Finally, on Line 9-11 the parties scale the sum by multiplying the secret shares with the factor 2 On Line 13, they then multiply each coordinate of s with y to obtain the appropriate magnitude.
The obtained vector is then added to the vector of model coefficients on Line 14.
The importance of protocol Tpp stems from the fact that enables the parties to generate secret shares of noise, without each party learning the true value of the noise that they add to the model coefficients in Line 14 of Prot. 2 The correctness of the protocol follows from the correctness of the inverse
transform sampling algorithm, and the fact that Exp(1) = r(1, 1) and that Ei, I(1, = ['d. 1). Moreover, it follows from the definition of the Gamma distribution that e Tdd 1) = [(d, c). The security of the whole protocol follows from the security guarantees provided by the cryptographic primitives (Keller ).020).
5 RESULTS
iDASH 2021 Results. We submitted our approach to a competition hosted by a National Center for Biomedical Computing funded by the NIH. In Track III of the iDASH 2021 competition, participants were invited to submit solutions for learning a ML model from training data hosted by two virtual centers, while providing DP guarantees. The centers represent data owners who have medical records of respectively 831 patients and 882 patients. Both data sets have the same schema, consisting of 1,874 boolean input attributes and a boolean target variable. The goal is to train a classifier for diagnosis of transthyretin amyloid cardiomyopathy using medical claims data (Huda al. (202T)) Solutions submitted to the competition were required to run on two machines. They were evaluated in terms of (1) training runtime two nodes with Intel Xeon E3- v5 processors (4 physical cores, hyper-threading enabled) and 64 GiB memory; (2) accuracy on a held-out test of 429 patients.
Tab. 1 contains the results for the best performing teams satisfying the c-D requirement (with set as 3 by the organizers). The first row corresponds to the approach presented in Sec. 4 We implemented the TLR and TDP protocols in MP-SPDZ, an open source framework for MPC (Keller (020)) Being aware of the pitfalls of implementing DP with floating point arithmetic, our implementation follows the best practice of using fixed-point and integer arithmetic as recommended by, for example, OpenDPPISee See Appendix C for more details. As the underlying MPC scheme for the iDASH2021 competition, we used semī2k (a semi-honest adaptation of Cramer et al. (2018)) with mixed circuits bits; edaBits)
that employ techniques using secret random bits (extended (Escudero et al.) (2020)). This MPC scheme enables secure 2PC against semi-honest adversaries and complied with the requirements of the competition. As the regularizer for LR training, we used N N(w) 1 w, in which w denotes the vector of weights (coefficients) of the LR model, i.e. we used A
All methods in Tab. D provide e-D guarantees. The differences among the methods are in the utility (accuracy) and the time taken to train DP model. Our aiR +Ppp approach achieved the highest accuracy of all methods, while taking the longest time to complete. Indeed, the runtime for the ølr +TDP approach is orders of magnitude larger than the runtimes for the other methods. This because the TRR +PPP approach is the only method in Tab. [ that uses MPC, while the other methods do not rely on cryptographic techniques. Approach 2 was based feature selection and training an ensemble of I.R models on selected feature subsets, while approach was based on training a decision tree in DP manner; these approaches were not created by us, and, to the best of our knowledge, their description has not been published in the open literature. In addition to the method from Sec. 4 we
'See hesthttts///nnmmmett 4 4open. sci wcw.nce/eeennccc.c ance/r/ IDASH MrCheavyCCaaay--eeo 6969 for our code. httts:://peedpp.r
7

---

Under review as a conference paper at ICLR 2023
Table Results for e-DP with and data from two data owners, as provided by the iDASH2021 competition organizers
Approach
PETs
Accuracy²
Runtime
1. m mLt (Sec. feat, sel. and LR ensemble
MPC & DP
86.25%
15,000
DP
85.31%
31.942 see
baseline (Sec.
DP
84.85%
0.27 sec
decision tree based
DP
84.38%
0.09 sec
Table 2: 5-fold CV accuracy results for varying number of data owners for e-DP with 1.
horizontally distributed TLR +TDP
vertically distributed baseline
data owners
baseline
*LR +TDP
2
85.79%
87.98%
87.98%
4
83.36%
87.98%
87.98%
8
76.92%
87.98%
87.98%
submitted an MPC-free baseline method to iDASH2021. We describe this method, which corresponds to approach 3 in Tab. below as we also use it for further analysis and comparison in Sec.
Baseline Method. The baseline technique follows FL setup with horizontally distributed data in which each data owner locally trains a model on their own data and adds noise to the model parameters at their end. Each data owner then shares its noisy parameters with a central server who performs averaging of the noisy model parameters and sends the result to the data owners. At the end of this process, each data owner holds the aggregated trained model. In more detail, in the baseline technique, each data owner:
1. Applies L2 normalization to its own instances;
2. Trains a LR model on its normalized instances
3. Adds noise to the trained LR coefficients as per the output perturbation method Chaudhuri et al. ()
After going through steps 1-3, the data owners can each publish their perturbed LR coefficients, which we subsequently average to create a final model. Because steps 1-3 provide e-DP (Chaudhuri al. (20TT). and since the data sets do not have common entries (a case of parallel composition), the overall solution provides c-D due to the post-processing property of differential privacy.
Utility on Horizontally and Vertically Distributed Data. For the results in Tab. 2 we distributed the data evenly among different numbers of data owners, both horizontally and vertically. The baseline technique is only applicable when the data is horizontally distributed, while the TLR +TPP approach works the vertically distributed scenario as well. Even the horizontally distributed scenario, the TLR +TDP approach is preferable because it yields higher accuracy, which becomes even more evident when the data is distributed among multiple data owners. The accuracy of the TLR +TDP approach is independent of the number of data owners and the partitioning of data, as regardless of the partitioning, the computing parties still train model over all the training data with TLR and subsequently add noise once to the globally trained model coefficients with TDP, effectively simulating the global DP paradigm but without the involvement of trusted curator. The baseline technique on the other hand adheres to the local DP paradigm in which each data owner adds noise to its local model, resulting in more noise in the final aggregated model. Furthermore, the utility of the TRR +PPP approach is independent of the number of instances and/or features owned by each individual data owner, while the accuracy of the baseline technique degrades when individual data owners do not have sufficient instances to train local models that generalize well. This is especially relevant in biomedical applications that are characterized by high-dimensional data sets with relatively few instances.
Runtime, As Tab. 3 showss the number of computing parties, the corruption threshold, and respective MPC schemes do have a substantial effect on the training time. The experiments for Tab. 3 were run
with the same training data as in Tab. on co-located F32s V2 Azure virtual machines each of which
'e used the LR implementation from skleam for this with penalty='12' (L2 regularization) and C' =1 (the inverse of A).
8

---

Under review as a conference paper at ICLR 2023
Table 3: Runtimes of TLR +PD for different number r of computing parties
r
Security
Horizontally distributed
Vertically distributed
MPC scheme
Passive
35687 see
38056.92 see
Cramer et al.
2018
Passive
75.83 sec
454.83 sec
Araki et al.
2016
Active
500,28 sec
1649.07 007 sec
Dālskov et al.
2021
4 Active
160.50 see
838.02 sec
Daiskov et al.
202T)
contains 32 cores, 64 GiB of memory, and network bandwidth of upto 14 Gb/s. Every computing party ran on separate VM instance (connected with Gigabit Ethernet network). The times reported include computing as well as communication times. The training was run for 1000 epochs. with = 1, A = 1 and with edaBits for mixed circuit computations.
In the horizontally distributed case, the data owners can L2-normalize their instances locally while in the vertically partitioned case the computing parties need to run MPC protocol NNRMM: this accounts for the difference in runtime between the horizontal and vertical partitioning. As expected, the corruption threshold has the most effect on the run time. Protocols that are secure for an honest majority of players (the protocols presented in Araki et al. (2016), and Dalskov al. (2021) are much faster than protocols secure against a dishonest majorty (Cramer et al. (2018) 2018)). ). For the same corruption threshold, protocols secure against passive adversaries are faster than protocols secure against active adversaries. The four party protocol proposed in Dalskov et al. (202T) manages to obtain good run times for the case of active adversaries by further reducing the corruption threshold to 25%, i.e. one player out of four can be corrupted by an adversary and the protocol is still secure.
Our results show that MPC implementations for honest majority in the case of realistic sized data sets for genetic studies (a few hundred patients, and few thousand features) are practical. We can train such models and add DP guarantees on top of MPC in less than 1.3 min for the case of honest majority protocols with passive security. Even in the case of stronger adversarial models, the training can be finished in a few hours, which is still practical for many applications where the increased accuracy payoff is valuable, especially with data that is distributed across multiple owners (Tab. 2
6 CONCLUSION
In this paper, we described a practical and efficient adaptation of distributed logistic regression learning: adding tractable privacy guarantees against model inversion in the absence of a trusted curator which, in real-world scenarios, is often impractical, undesirable, or forbidden. This work led to 1st place in Track III of the iDASH 2021 Genome Privacy competition. Despite having been formulated for a competition task, the design is intentionally general: it makes no assumption about the data partitioning scenario, number of computing parties/ data owners, or the security setting in which it is applied. On the basis of linearity, MLR interchangeable with all linear learners with no need to reevaluate noise variance. Moreover, the exponential noise mechanism is straightforward to replace by the Gaussian mechanism for scenarios where (c. 6DD guarantees are acceptable. As such, the MPC+DP method can be harnessed for model training across a broad range of use cases without requiring extensive tuning by privacy experts.
The proposed approach effectively offers the advantages of global DP but without the involvement of a trusted curator, because this curator is simulated by an MPC protocol instead. The trade-off between this MPC for global DP approach and the baseline federated method with local DP can be summarized as operating cost (or running time) versus model accuracy. We empirically showed the added utility of collaborative learning with MPC over the standard federated approach. The effect is particularly apparent as the number of disjoint collaborators grows. We also remark that the baseline method, and existing methods that combine MPC with DP in FL, cannot be applied in cases where data is vertically partitioned which a commonly- such, our MPC+DP method allows collaboration in strictly larger space of applications. Based on performance results, our protocol is extensible to larger data sets while remaining realistic time span for model learning, but could be improved further by custom protocol implementations or given the existence of correlated randomness dealer in suitable scenarios. To further improve upon accuracy, a probable research direction is to introduce MPC protocols for feature selection [i et al. (2021) in both horizontal and vertical partitioning schemes.
scenario in medicine and advertising. As

---

Under review as a conference paper at ICLR 2023
REFERENCES
Martin Abadi, Andy Chu, lan Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Procedings of the 23rd ACM SIGSAC Conference on Computer and Communications Security, pages 308-318, 2016.
Mark Abspoel, Daniel Escudero, and Nicolaj Volgushev. Secure training of decision trees with continuous attributes. Proceedings on Privacy Enhancing Technologies, (1):167-187, 2021.
Abbas Acar, Z Berkay Celik, Hidayet Aksu, A Sclcuk Uluagac, and Patrick McDaniel. Achieving secure and differentially private computations in multiparty settings. IEEE Symposium on Privacy-Aware Computing, pages 49-59. 2017.
Samuel Adams, Chaitali Choudhary, Martine De Cock, Rafael Dowsley, David Melanson, Ander- son CA Nascimento, Davis Railsback, and Jianwei Shen. ensembles over continuous data. Proceedings on Privacy Enhancing Technologies, (2):205-226, 2022.
training of tree
Anisha Agarwal, Rafael Dowsley, Nicholas D. McKinney, Dongrui Wu, Chin-Teng Lin, Martine De Cock, and Anderson C. A. Nascimento. Protecting privacy of users in brain-computer interface applications. IEEE Transactions Neural Systems and Rehabilitation Engineering, 27(8): 1546- 1555, 2019.
T. Araki, J. Furukawa, Y. Lindell, A. Nof, and K. Ohara. High-throughput semi-honest secure three- party computation with an honest majority. In Proceedings of the 23rd ACM SIGSAC Conference on Computer and Communications Security, pages 805-817, 2016.
Donald Beaver. Efficient multiparty protocols using circuit randomization. Joan Feigenbaum, editor, Advances in Cryptology - CRYPTO '91, pages 420-432. Springer Berlin Heidelberg, 1992.
Jonas Böhler and Florian Kerschbaum. Secure multi-party computation of differentially private heavy hitters. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages
2021.
George E.P. Box and Mervin F. Muller, A note on the generation of random normal deviates. Annals of Mathematical Statistics, 29(2):610-611, 1958.
David Byrd and Antigoni Polychroniadou. Differentially private secure multi party computation for federated learning in financial applications. arXiv preprint wrXiv:2010.05800 2020.
R. Canetti. Security and composition of multiparty cryptographic protocols. Journal of Cryptology. 13(1):143-202, 2000.
Nicholas Carlini, Chang Liu, Úlfar Erlingsson, Jernej Kos, and Dawn Song. The secret sharer: Evaluating and testing unintended memorization in neural networks. 28th USENIX Security Symposium, pages 267-284, 2019.
O. Catrina and A. Saxena. Secure computation with fixed-point numbers. In 14th International Conference on Financial Cryptography and Data Security, volume 6052 of Lecture Notes in Computer Science, pages 35-50. Springer, 2010.
Jeffrey Champion, Abhi Shelat, and Jonathan Ullman. Securely sampling biased coins with applica- tions to differential privacy. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 603 2019.
Melissa Chase, Ran Gilad-Bachrand Bachrach, Kim Laine, Kristin Lauter, and Peter Rindal. Private collabora- tive neural network learning. Cryptology ePrint Archive, 2017.
Kamalika Chaudhuri and Claire Monteleoni. Privacy logistic regression. In Advances in Neural Information Processing Systems, pages 289-296, 2008.
Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. Differentially private empirical risk minimization. Journal of Machine Learning Research, 12(3), 2011.
10

---

Under review as a conference paper at ICLR 2023
Koji Chida, Daniel Genkin, Koki Hamada, Dai Ikarashi, Ryo Kikuchi, Yehuda Lindell, and Ariel Nof. Fast large-scale honest-majority mpe for malicious adversaries. In Annual International Cryptology Conference, pages 34-64. Springer, 2018.
Ronald Cramer, Ivan Damgård, and Ueli Maurer. General secure multi-party computation from any linear secret-sharing scheme. In International Conference on the Theory and Applications of Cryptographic Techniques, pages 316-334. Springer, 2000.
Ronald Cramer, Ivan Damgard, and Jesper Nielsen. Secure Multiparty Computation and Secret Sharing. Cambridge University Press Print, New York, 2015.
Ronald Cramer, Ivan Damgård, Daniel Escudero, Peter Scholl, and Chaoping Xing. SDD Efficient MPC mod 2 for dishonest majority. In Annual International Cryptology Conference, pages 769-798. Springer, 2018.
Anders Dalskov, Daniel Escudero, and Marcel Keller. Fantastic four: Honest-majoriy nour-party secure computation with malicious security. In 30th USENIX Security Symposium, 2021.
Martine De Cock, Rafael Dowsley, Anderson C. A. Nascimento, Davis Railsback, Jianwei Shen, and Ariel Todoki. High performance logistic regression for privacy-preservin genome analysis. BMC Medical Genomics, 14(23), 2021.
Sebastiaan de Hoogh, Berry Schoenmakers, Ping Chen, and Harm op den Akker. Practical secure decision tree learning in teletreatment application. In Intern. Conf. Financial Cryptography and Data Security, pages 179-194. Springer, 2014.
Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4)211--00) 2014.
D. Escudero, S. Ghosh, M. Keller, Rachuri, and Scholl. Improved primitives for mpe over mixed arithmetic-binan binary circuits. Cryptology ePrint Archive, Report 2020/338, 2020.
D. Evans, V. Kolesnikov, and M. Rosulek. A pragmatic introduction to secure multi-party computation. Foundations and Trends in Privacy and Security, 2(2-3):70-246, 2018.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic countermeasures. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pages 1322-1333, 2015.
Adrià Gascón, Phillipp Schoppmann, Borja Balle, Mariana Raykova, Jack Doerner, Samee Zahur, distributed linear regression on high-dimensional data.
and David Evans. Proceedings on Privacy Enhancing Technologies, 2017(4):345 364, 2017.
Xavier Glorot and Yoshua Bengio. Understanding the difficulty of training deep feedforward neural networks. In Proceedings of the 13th International Conference on Artificial Intelligence and Statistics, pages 249 256.256,7 2010.
Vipul Goyal, Hanjun Li, Rafail Ostrovsky, Antigoni Polychroniadou, and Yifan Song. Atlas: efficient and scalable mpe in the honest majority setting. In Annual International Cryptology Conference, pages 244-274. Springer, 2021.
Xiaolan Gu, Ming Li, and Li Xiong. Precad: Privacy-preserving and robust federated learning via aiddt differential privacy. arXiv preprint 17X/1:2110.11558,, 2021.
Chuan Guo, Awni Hannun, Brian Knott, Laurens van der Maaten, Mark Tygert, and Ruiyu Zhu. Secure multiparty computations in doating-poin arithmetic. arXiv:2001.00 03/ 2020.
Ahsan Huda, Adam Castaño, Anindita Niyogi, Jennifer Schumacher, Michelle Stewart, Marianna Bruno, Mo Hu, Faraz S Ahmad, Rahul Deo, and Sanjiv Shah. A machine learning model for identifying patients at risk for wild-type transthyretin amyloid cardiomyopathy. Nature communications, 12(1):1-12, 2021.
Bargav Jayaraman, Lingxiao Wang, David Evans, and Quanquan Gu. Distributed learning without empirical risk minimization. In Advances in Neural Information Processing Systems 31, pages 6346-6357, 2018.
distress:

---

Under review as a conference paper at ICLR 2023
Peter Kairouz, H. Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji. Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, Rafael G. D'Oliveira, Hubert Eichner, Salim El Rouayheb, David Evans, Josh Gardner, Zachary Garrett, Adria Gascón. Badih Ghazi, Phillip B. Gibbons, Marco Gruteser, Zaid Harchaoui, Chaoyang He. Lie He. Zhouyuan Huo, Ben Hutchinson, Justin Hsu, Martin Jaggi, Tara Javidi, Gauri Joshi, Mikhail Khodak, Jakub Konečný, Aleksandra Korolova, Farinaz Koushanfar, Sanmi Koyejo, Tancrède Lepoint, Yang Liu, Prateek Mittal, Mehryar Mohri, Richard Nock, Ayfer Özgür, Rasmus Pagh, Mariana Raykova, Hang Qi, Daniel Ramage, Ramesh Raskar, Dawn Song. Weikang Song, Scbastian U. Stich, Ziteng Sun, Ananda Theertha Suresh, Florian Tramèr, Praneeth Vepakomma, Jianyu Wang. Li Xiong. Zheng Xu, Qiang Yang, Felix X. Yu, Han Yu, and Sen Zhao. Advances and open problems in federated learning. https://ariix.or//ah///112222 04977, 2021.
Marcel Keller. MP-SPDZ: versatile framework for multi-party computation. Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, page 1575-1590, 2020.
Kristin E Lauter. Private ai: Machine learning on encrypted data, IACR Cryptol. ePrint Arch., 2021: 324, 2021.
Xiling Li, Rafael Dowsley, and Martine De Cock. privacy-rreeervngg feature selection with secure multiparty computation. arXiv preprint 102.i::2122.331/11 2021.
Yehuda Lindell and Benny Pinkas. Privacy preserving data mining. In Proceedings of the 20th
Annual International Cryptology Conference on Advances in Cryptology, pages 36-54, 2000.
Ilya Mironov. On significance the least significant bits for differential privacy. In Proceedings of the 2012 ACM conference Computer and communications security, pages 650-661, 2012.
Payman Mohassel and Yupeng Zhang. SecureML: A system for scalable privacy-prees preserving machine learning. In IEEE Symposium on Security and Privacy (SP), pages 19-38, 2017.
Manas A Pathak, Shantanu Rane, and Bhiksha Raj. Multiparty differential privacy via aggregation of locally trained classifiers. In Advances in Neural Information Processing Systems 23, pages 1876 1884, 2010.
Eusebio Gómez Manchez-Manzang Miguel Angel Gomez- Villegas, and Juan Stan-Miguel Marín- Diazaraque. A matrix variate generalization of the power exponential family of distributions. Communications in Statistics-Theon and Methods, (1(12)2117-21182 2002.
Congzheng Song. Thomas Ristenpart, and Vitaly Shmatikov. Machine learning models that remember too much. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 587-601, 2017.
Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction APIs. In 25th USENIX Security Symposium, pages 601-618, 2016.
Stacey Truex, Nathalie Baracaldo, Ali Anwar, Thomas Steinke, Heiko Ludwig, Rui Zhang, and Yi Zhou. A hybrid approach to
federated learning. In Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security, pages 1-11, 2019.
Sameer Wagh, Divya Gupta, and Nishanth Chandran. SecureNN: 3- secure computation for neural network training. Proceedings on Privacy Enhancing Technologies, (3):26 2019.
Sameer Wagh, Xi He, Ashwin Machanavajjhala, and Prateek Mittal. DP-cryptography: marrying differential privacy and cryptography emerging applications. Communications of the ACM, 64 (2):84-93, 2021.
Haozhe Xie, Jie Li, Qiaosheng Zhang, and Yadong Wang. Comparison among dimensionality reduction techniques based random projection for cancer classification. Computational Biology and Chemistry, 65:165-177 2016.
12

---

Under review as a conference paper at ICLR 2023
A PSEUDOCODE
Pseudocode for TLR is presented in Prot. + TLR based on an existing MPC protocol for training a LR with gradient descent (Keller (2020), ) which extended in two ways to satisfy the conditions:
(C1) each input feature vector has an L2 norm of at most I; (C2) the I.R model is trained using 1.2 regularization.
At the beginning of protocol MLR, the computing parties have secret shares of set of labeled training examples. To satisfy condition (C1), on Line 1-3 the computing parties first apply 1.2 normalization to the secret shares of each training example by running protocol TNORM; pseudocode for TNORM is provided separately in Prot. in the paper.
The computing parties then begin secure training on the privately L2 normalized data from all the data owners. The training begins with initializing the secret shares of the weights (coefficients) of the LR model using Glorot uniform initializer (Glorot and Bengio (2010). To this end, the computing parties execute protocol TIIT on Line 4. The training is carried out for Pattr number of iterations (epochs), which a public constant agreed upon by all computing parties along with the learning rate a, the regularization penalty A, and the momentum C. In each epoch, the MP-SPDZ module TFWD for a secure forward pass called Line 6, followed by the MP-SPDZ module тeKD for backward pass on Line 7. The secret shares the weights are then updated for every epoch using the MP-SPDZ module for updating the weights. We modified this module satisfy (C2) with 1.2 regularization as per Line 9 in Prot.
Protocol 4: TLR for secure logistic regression training
Input :A set S = [[[x]. [+]] of secret-shared training examples. each consisting of secret secret-shared input feature vector of length m and secret shared label f; learning rate o; regularization penalty A; momentum C: number of iterations Tater.
Output: A secret-shared vector [w] of weights w; that minimize the sum of squared errors over the
training data
for training examples [[x], [t]] in S do
2
[x] f- TNORM [x], m)
end
[w]
P MP-SPDZ module for Glorot uniform initializer
for
to do
Run TFWD
MP-SPDZ module for forward pass MP-SPDZ module for backward pass
Run TBKоD
Run TUPDATE
> Modified MP-SPDZ module for weight updates with the modified update rule for computing Aw: [Aw] +- C[Aw] a/Awl Ao[w]
end
10 return [w]
B ADDITIONAL EXPERIMENTS
B.1 EFFECT OF PRIVACY BUDGET ON ACCURACY OF MODELS TRAINED WITH ALR +ADP
Table shows the effect of the privacy budget e on the accuracy of models trained with the TLR +TPP approach. The accuracy is measured over one of the folds of the train and test data from Sec. 5 The training is done for 1000 epochs and A 1. The results are as expected, with a larger privacy budget i.c. less stringent privacy requirements yyelding more accurate models. The observation that the accuracy for e is par with the accuracy for e =INF (i.e. when no noise added) is explained by the fact that adding some noise can positively impact the generalization capability of the model.
B.2 COMPARISON WITH OTHER PERTURBATION TECHNIQUES
For the TLR +TPP approach (Sec and the baseline technique (Sec. 5) we adopted the sensitivity method that perturbs the model coefficients, i.c. the output perturbation method that was proposed as Algorithm 1 in Chaudhuri et al. (201 In Table compare the output perturbation technique with other perturbation techniques, namely objective perturbation and gradient perturbation. For objective perturbation, experiments with Algorithm 2 from Chaudhuri et al. (201T) that adds noise the
13

---

Under review as a conference paper at ICLR 2023
Table Accuracy of models trained with TLR +TDP for different values of
C
ACCURACY
0.001
37.72%
0.01
50.58%
0.1
62.57%
0.5
72.51 %
1
87.42%
INF
86.84%
objective function itselt For gradient perturbation, we ran experiments with DP-SGD (Abadi et al. (2016)) that adds noise the gradients For DP-SGD, we computed the required noise multiplier for given = 1, = le 5, batch size I, 300 epochs, and the number training examples each data owner holds. This was then passed an argument to DP-SDG optimizer along with clipping threshold of 1, learning rate of 0.1, and number of miero batches equal the batch size.
In the BASELINE-OP OP method in Table 5 each data owner trains a differentially private LR model locally by perturbing the objective function. The resultant coefficients of the local models are then averaged, resulting in a final DP model. The BASELINE-DD DPSGD method entirely similar, but in this method each data owner trains differentially private LR model by perturbing the gradients learned during training, i.e. with DP-SGD.
As can be seen in Table 5 contrary to what one would expect based on the analysis in Chaudhuri et al. 2201), 1, the accuracy results with this objective function perturbation method were not good on the iDASH2021 data, and far worse than those with the output perturbation method. We attribute this to the high-dimensional nature of the iDASH2021 data (many features and relatively few instances) which is very different from the data sets used for evaluation Chaudhuri et al. (2011). I}. Similarly, the LR models trained with DP-SGD on the iDASH2021 data are significantly less accurate than those protected with output perturbation.
Table 5: Accuracy results obtained with 5-fold CV for c-DP with and 2 data owners
APPROACH
ACCURACY
TLR +TDPP (SEC. 87.98%
OUR APPROACH
OUTPUT PERTURBATION
BASELINE (SEC.
85.79%
OBJECTIVE PERTURBATION GRADIENT PERTURBATION
BASELINE-ON 49.40%
OTHER APPROACHES
BASELINE- DDSGG
69.77%
B.3 COMPARISON WITH OTHER METHODS ON HORIZONTALLY PARTITIONED DATA
We evaluate MPC+DP approach and compare against existing literature Pathakk al. (2010) and and Jayaraman et al. (2018) that adopt a combination of PETs to train LR models and provide DP guarantees with the output perturbation technique similar as in the BASELINE method we adopted Sec. 5 these existing approaches let each data owner train a model locally and then add noise to the averaged model parameters using MPC+DP techniques. Because each data owner is required to train a model locally, these existing methods only work in scenarios where the data is horizontally partitioned, unlike our method which is suitable for vertically partitioned scenarios as well. We also note that the amount of noise added by each technique is different.
R The main distinction with method, is that
For the results in Table we distributed the data evenly among different numbers of data owners, in horizontal manner. We report 5-fold CV accuracy results averaged for 100 runs of noise generation mechanism to consider the randomness in the noise generation. We observe that for 2 data owners, all
We implemented this approach using IBM's Diffpriviib library
https: tttp//gtttttt.tct/// com/ wtw//ifffeeente al-pri vacy- vacy-library library
We implemented this approach using PF-Paiy
14

---

Under review as a conference paper at ICLR 2023
the techniques have close performance in terms of accuracy. Similar for the BASELINE method in Sec. [ the accuracy of the models trained by existing methods drops with an increase in the number of data owners. This may be because in existing approach, LR models are trained locally by the data owners, while our approach benefits from training an LR model on the combined data and learns a more generalized model. Moreover, our techniques are independent of how the data is distributed among data owners, unlike the methods in Table (6) that work only for horizontally distributed data.
Table 6: Accuracy results for output perturbation obtained with 5-fold CV for c-DP with c = on horizontally partitioned data
DATA OWNERS
PRIVACY TECHNIQUE
ACCURACY
OUR APPROACH [TRR +TDP, SEC.
87.98%
PATHAK ET AL. (2010)
86.43%
2
JAYARAMAN ET AL. 2018)
MPC OUT P
86.42%
OUR APPROACH (aLR TDP. SEC.
87.98%
PATHAK ET AL. (2010)
85.02%
4
JAYARAMAN ET AL. (0188) MPC OUT P
85.10%
OUR APPROACH (TLR +TDP. SEC.
87.98%
PATHAK ET AL. (2010)
84.10%
8
JAYARAMAN ET AL.
2018)
MPC OUT P
84.24%
B.4 EXPERIMENTS ON OTHER DATA SETS
We further evaluate our approach on the BC-TCGA and GSE2034 data sets of the iDASH 2019 competition Both data sets contain gene expression data from breast cancer patients which are normal tissue/non recurrence samples (negative) or breast cancer tissue/recurrence tumor samples (positive) Xie et al. (2016). We perform experiments with 5-fold CV, where the training data is distributed between 2 data owners in each fold.
GSE2034 Each instance in this train data set characterized by 12,634 continuous input attributes and a boolean target variable. There are 895 instances in total. In each iteration of the 5-fold CV, each data owner owns 447-448 instances, 20% of which held out for testing.
BC-TCGA Each instance in this train data set is characterized by 17,81 888 continuous input attributes and boolean target variable. There are 1,875 instances in total. In each iteration of the 5-fold CV, each data owner owns 937-938 instances, 20% of which are held out for testing.
The secure training is run for 20 epochs for the BC-TCGA data set and 300 epochs for the GSE2034 Table shows accuracy results obtained with a 5-fold CV. To
data set with A 1 and appreciate the inherent difference in difficulty between the GSE2034 and the BC-TCGA classification tasks, the first row of results in Table 7 we include the accuracies obtained with model trained in the central learning paradigm, i.e. when all the training data resides with a single data owner, and no noise is added to the model coefficients, i.e. =INF. The other rows correspond to the federated setup from Sec. 5 with data owners. The results are line with the observation from Sec. that the TLR +TPp approach provides higher utility.
We additionally report the runtime train the model using TLR +MDP for these data sets to illustrate the variability in runtimes with respect to the number of training samples, epochs and a number of features in the data We see an increase in runtimes for per epoch when compared the runtimes per epoch on iDASH, which is attributed to a large number features (about 10x of iDASH2021 for BC-TCGA and 7x for GSE2034). The runtimes for other threat models will follow a similar trend. We see that for larger datasets like these is still practical to maintain the utility of the model while providing complete privacy guarantees.
B.5 SCALABILITY OF TLR WITH NUMBER OF COMPUTING PARTIES
The number of data holders in solution is distinct from the number of computing parties. Our solution is general and works with any number of computing servers as well as data holders. In Table
http:/ /wwww/wwwww/o/ www.hhhamnnnnnr.r..o www.eeppriiviacccooooo org/ compet t html
15

---

Under review as a conference paper at ICLR 2023
Table Accuracy averaged over 5-fold CV with A
GSE2034
BC-TCGA
INSTANCES
895
1,875
FEATURES
12,634
17,814
CENTRAL LEARNING; DATA OWNER
65.55%
98.28%
BASELINE (SEC. 5 DATA OWNERS
51.92%
91.37%
TTR+ (SEC. 2 DATA OWNERS
64.55%
95.69%
RUNTIME TOP+ PASSIVE 3PC
276.38
57.30 SEC
Table 8: Runtimes of TLR +TDP for different number r of computing parties
MPC SCHEME
RUNTIMES
COMM. OVERHEAD
3
954.91 SEC
57922.70 70 MB
4
1022.16 SEC
83667. 90 MB
GOYAL ET AL.
2021
(PASSIVE)
5
2725.58 SEC
366679.00 MB
7
5064.27 SEC
711226.33 MB
3
21213.21 SEC
5247186.89 MB
CRAMER ET AL.
2000 &
4
23244.34 SEC
7248822.0 06 MB
68176.24 SEC
25728263.60 MB
CHIDA ET AL.
2018) (ACTIVE)
7
131391.00 SEC
70080327.38 MB
g we report the runtimes and communication overheads to train a LR model with varying number of computing parties r ranging from 3 to 7. To have comparison of runtimes and communication overhead for different values of r, we use the same MPC scheme for each security setting. The chosen MPC schemes can be used with any value of 2, and are different from the schemes that we use in Table which were specific and efficient schemes for the given value of r. It is due to this use of different schemes that we observe a huge difference in runtimes when compared to the runtimes reported earlier. The schemes Table are run with secret sharings in Z, where g is prime number and with edaBits for mixed circuit computations.
The training was run on the complete training dataset from iDASH2021 consisting of 1713 training samples and 1874 features for 1000 epochs with GD, computing as well as communication times. The total amount of data sent by all the computing parties is shown in the last column. The runtimes and the communication overhead increase with an increasing number of computing parties. This because each party now needs to communicate with higher number of parties, and the runtimes include communication times. Also, the active security settings take longer runtimes than their passive counterparts for a given These results are in line with the literature in MPC. The communication overhead in settings with larger number of computing parties be reduced with the of bulletin board functionality that enables efficient communication among many parties who are simultaneously involved in computations (Agarwal et al. (209)))
and A The runtimes reported include
C IMPLEMENTATION OF DP IN MPC PROTOCOLS
is well documented that implementing DP mechanisms using floating-oiint arithmetic can lead to catastrophic privacy compromises Mironov (2012). The most privacy-conscione choice, taken, for instance, by the OpenDP project is to fixed-point and integer arithmetic whenever possible. Following this paradigm, in our implementation we have replaced Gaussian and Laplace noise with their discrete approximations. The accuracy of the model is another point where the precision of weights could affect the overall result. Keeping this in mind, we used 32 bits of precision, which is more than sufficient to ensure the correct behavior of the training procedure.
10 Defaulls to None in MP-SPDZ and can he a maximum of bit length 256.
hhttps://opendp.orgg
16

---

Under review as a conference paper at ICLR 2023
We would like to stress that the finite precision issue is inherent any implementation of DP digital computer it is not specific to our work on DP implemented by MPC protocols. DP theory was created, for the most part, based continuous distributions. However, all the practical libraries implement DP using finite precision arithmetic. That includes, for example, all the implementations of DP-SGD (which is based on the Gaussian mechanism). It is legitimate to wonder if security guarantees break down in the case when continuous DP mechanisms computers. However, that question, which has to be asked of all implementations of DP mechanisms based on continuous distributions, is outside the scope of this paper.
implemented digital
17


Reviews:
[{"review_id": "h4q-N7OgJF", "reviewer": "Reviewer_d2J7", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies the problem of differentially private federated learning. More specifically, in order to improve the utility of the differentially private model in federated learning, the authors propose to combine secure multiparty computation (MPC) with differential privacy (DP) when solving the regularized logistic regression. The main contribution of the paper is a new framework that allows private training for vertically distributed data.", "summary_of_the_review": "The proposed method seems to be interesting since it can deal with vertically distributed data in federated learning. However, there are some problems that need to be addressed in the current paper (see weaknesses and clarity sections).", "strength_and_weaknesses": "The strength of the paper:\n1. The proposed method enables private training for vertically distributed data, which is an important setting in federated learning.\n2. The authors propose a new method for secure sampling of a vector from a Gaussian distribution inside MPC.\n3. Empirical results validate the advantage of the proposed method.\n\nThe Weaknesses of the paper:\n1. It seems that the proposed method requires communication between computing parties at each iteration, which could be the key bottleneck in federated learning. Compared with the output perturbation-based method, which only requires one communication at the end, the proposed method suffers from high communication complexity.\n2. There are no theoretical guarantees of the proposed method.\n3. The presentation is not clear. For example, the learning problem is not defined. There are lots of undefined notations. More importantly, the random noise magnitudes for several baselines are unclear.\n4. It seems to miss an important baseline, i.e., Gu et al. (2021), in the experiments.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "h4NeTKtjCu", "reviewer": "Reviewer_vZqr", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "the paper studies a method which combines MPC with DP that bypasses utility challenges of federated learning with local DP (with small datasets). authors show that the method achieves good performance by reporting their submission entry being 1st place for an iDASH 2021 challenge, at the cost of substantially more compute time. ", "summary_of_the_review": "the paper studies a method which combines MPC with DP that bypasses utility challenges of federated learning with local DP (with small datasets). authors show that the method achieves good performance by reporting their submission entry being 1st place for an iDASH 2021 challenge, at the cost of substantially more compute time. the paper is well-written, is of high quality, but lacks a little in methodological novelty. ", "strength_and_weaknesses": "strength: the paper is well-written and the empirical results are solid. \n\nweaknesses: \n- the main method in the paper is a combination of existing protocols in MPC and differentially private statistics release, and thus the paper lacks methodological novelty. but this perhaps isn't a super serious issue, given that authors demonstrated their point and showed good performance. \n- the paper only considers a single dataset / benchmark on which results are reported. this makes understanding the robustness of the method and results a bit difficult. \n- the method is likely so far most practical for small (to perhaps moderate) size problems, given the large compute overhead. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "SNSZFjIzJe", "reviewer": "Reviewer_DC85", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper investigates the problem of training a logistic regression (LR) model with differential privacy over distributed data. In order to improve over local DP approaches, it relies on multiparty computation to train a pooled-equivalent model on secret shares, adding differential privacy on the final model thanks to the output perturbation method of Chaudhuri et al. Experiments are performed on several datasets and demonstrate the improved performance, at the expense of a large communication cost (which can be mitigated depending on the protocol used and the threat model)\n\nTo sum up, the main contributions of the paper are:\n1) Proposing an MPC protocol to run the output perturbation of Chaudhuri et al. for logistic regression, working for both horizontal and vertical FL\n2) Extending MP-SPDZ for logistic regression training with L2 regularization\n3) Empirical study of the benefits of the proposed approach in terms of performance (for a given privacy budget) and communication, mainly on the iDASH 2021 track III competition dataset but also on TCGA and GSE2034 in the supplementary", "summary_of_the_review": "This paper proposes a novel protocol for logistic regression with differential privacy in a distributed setting, which seems to reach good results. Although I think the paper would benefit from a restructuring and adding some baselines, I am bending in favor of acceptance, hence the current score.", "strength_and_weaknesses": "# Strengths\n\n1. The paper is very well written, which was not a given given the very technical nature of the topics tackled (MPC *and* DP). I really thank the authors for their writing efforts\n2. The idea proposed is general enough to be applied to any model amenable to the output perturbation method of Chaudhuri et al., which includes e.g. SVMs\n3. The method seems to reach the best performance on the current benchmark\n4. The method should yield results equivalent to centralized training (up to discretization issues), which is great for healthcare applications where there is high heterogeneity and little data per center\n\n# Weaknesses\n\n5. The paper is still limited to the output perturbation method, and only covers the logistic regression\n  - In particular, I think the abstract is misleading and should reflect more the focus on logistic regression\n6. The structure of the paper is unbalanced between the main paper and the supplementary material. The supplementary material addresses many points that are lacking in the main paper, including extension to other datasets, more interesting baselines, issues with finite precision. Several appendices are not even referred to in the main paper.\n7. The choice of baselines (even after the extension in the appendix) is not entirely fair:\n  - DP-SGD is performed with a batch size of 1, which is a worst-case approach.\n  - Further, DP-SGD is only used with local trainings followed by ensembling. The authors do not consider a FedAvg + DP-SGD approach which would be natural in this setting. Such an approach was already used e.g. in the iDASH 2020 competition (Beguier et al. Differentially Private Federated Learning for Cancer Prediction)\n  - For the method of Jayaraman et al. 2018 in table 6, the variant with output perturbation is used, although this paper shows that the gradient perturbation yields better results\n8. Regarding the experimental setup :\n  - It would be better to add error bars (where applicable) to understand the significance of the results. In particular, this could be possible for the cross-validation results of Table 2 and Table 6\n9. For vertical FL, one of the main challenges is to align record across parties. Which method do the authors use to tackle this question?\n\n\nMinor comments:\n- How do you explain the fact that in Table 7, central learning yields a better performance than the proposed MPC method? Is it due to finite precision?\n- how much does the initial secret sharing transfer (encrypted data points) weigh with respect to the total communication cost?\n- For L2 data normalization, for horizontal FL, it is probably simpler to apply it prior to creating shared secrets. When computing the total runtime, is it contained in it?", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "7LE6ImAvRk", "reviewer": "Reviewer_QAdF", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper considers the problem of secure and privacy-preserving distributed ML training (specifically logistic regression model). It does so by combining MPC and DP. The approach by normalizing the data and then adding the noise to the parameters proportional to sensitivity of how this data would change the parameters. The protocol is completely distributed and does not require a trusted party.\nThe paper seems to describe the method that was used in iDash competition last year.", "summary_of_the_review": "This is a really nicely written paper. However contributions seem minor theoretically. Many details that need to be in main body (e.g., other datasets, generalisability, communication overhead appear in appendix) and it is hard to determine what is the generalizability of the methods.", "strength_and_weaknesses": "Strengths:\n- a really well-written paper, extremely easy to follow\n- the problem of cross-silo learning is addressed completely by considering security, privacy and integrity\n- related work is very well-explained (recommendations on expanding are below)\n\nWeaknesses:\n- the novelty of the work compared to existing MPC+DP approaches is not clear\n- DP guarantees need further investigation (e.g., why delta is missing and why not use Gaussian discrete noise)\n- the method seem to work only on LR models\n- baselines method (no DP and no MPC is missing)\n- comparison with other MPC+DP approaches is missing\n- how parties combine their data in vertical setting is not explained", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}]

Author rebuttal:

Decision: Reject