## 3 Method
### Security Analysis  
In this section, we aim to determine whether one party participating in federal training can learn the other party's data from the parameter set \(H^{k}\) exchanged during training. Previous studies mainly introduced the leakage of the whole set of model parameters or gradient in the training process [45; 46; 47]. However, in our framework, the model's parameters are confidential, and only the intermediate results in the tag prediction layer may reveal information.  
**Theorem 1**.: _According to our definition, the federated transfer learning framework based on domain heterogeneous adaptation is secure, provided that the underlying encryption parameter sharing scheme is secure._  
Figure 2: System Architecture of Federated Domain Adaptation.  
Proof.: In our framework, the model's parameters are confidential, and only the intermediate results in the label classifier layer may reveal information. In the domain classifier layer, each party can only receive the information of the domain but not the information of the data. Let \(S_{j}\) be the set of data points sampled in the \(t\)-th iteration and \(i_{j}\) be the \(i\)-th sample in the \(j\)-th iteration. \(H_{i_{j}}\) refers to the contribution of the \(i\)-th sample to other parties. In the \(j+1\)-th iteration, we can obtain the weight update of the label classifier according to Equation (19):  
\[\Theta_{j+1}^{y}=\Theta_{j}^{y}-\eta_{i}\left(\frac{1}{N_{S_{j}}}\sum_{i_{j} \in S_{j}}\left(-\frac{1}{2}y_{i_{j}}+\frac{1}{4}y_{i_{j}}^{2}H_{i_{j}}\right)\right) \tag{21}\]  
where \(H_{i_{j}}=\varphi(x_{i_{j}})\Theta_{j}^{y}\). For any participant \(k\) with unpublished datasets \(D_{k}\) and training parameters \(\Theta_{k}^{y}\) following our defined framework, there is an infinite solution of \(\{x_{i_{j}}^{k}\}_{i\in S_{ji}=0,1\cdots}\) that produces the same contribution set \(\{H_{i_{j}}^{k}\}_{j=0,1\cdots}\). That is to say, no matter the number of iterations, the data of participant \(k\) cannot be uniquely determined from its exchanged information \(\{H_{i_{j}}^{k}\}_{j=0,1\cdots}\). This definition of security is consistent with the previous definition of security proposed in privacy protection and secure multiple computation of machine learning [48]. Under this definition, when some prior knowledge about data are known, the other party may exclude some alternative solutions but cannot infer accurate original data. This model provides a flexible trade-off between privacy and efficiency.  
**Theorem 2**.: _According to our definition, the federated transfer learning framework based on domain heterogeneous adaptation is secure, provided that the homomorphic encryption scheme used is secure._  
Proof.: In our scheme, all the learning and training data are encrypted by a homomorphic encryption mechanism. The parameters and intermediate data of the model are encrypted in the whole federated learning process. In each iteration, both sides will create a new random encryption mask \(m\). This randomness and confidentiality also ensure the security of the whole training and learning process. Therefore, as long as the encryption scheme is secure, the federated learning framework we defined is also secure.