# A TEE-Based Federated Privacy Protection Method: Proposal and Implementation
## 3 Method Introduction  
### Problem Modeling  
In the vertical federation scenario, there are two parties involved in general. The party with the label is defined as the active party, and the party with the feature is defined as the passive party. As shown in Figure 1, participant B is the active party and A is the passive party.  
\(D_{A}\) and \(D_{B}\) represent the datasets of the two parties. \(D_{j}^{i}\) represents the \(j\)th batch of training samples of participant \(i\). We assume that \(B\) is the active party and has the label information of the final training data. The complete dataset should be \(\{D_{A},D_{B}\}\). Based on the \(\delta\)-precision loss model proposed by [PERSON] et al. [5], the neural network algorithm is used for analysis in this study.  
Compared with the traditional neural network structure, considering that the labels and features are in different parties, vertical federated learning is a model-parallel training process, in which one part of the model is trained on the active party, the other part is trained on the passive party, and they are separated by a Cut Layer, whose structure is shown in Figure 1.  
Further, we assume it is a binary classification problem, \(y\in\{0,1\}\), where the passive party trains the model \(f:X\to R^{d}\), and the active party trains \(h:R^{d}\to R\). The yellow part is the forward calculation process, and the green part is the backward gradient training process. Assuming that the activation function of the last layer uses the sigmoid function \(\delta\) for classification prediction, there is an outstanding feature that its derivative and the original function satisfy Equation (1). \(x\) is the feature value in feature space \(X\), \(\delta\) is the sigmoid function, and \(\delta t\) is the derivative of the sigmoid function.  
Figure 1: Two-party vertical federated learning algorithm process.  
\[\delta\prime(x)=\delta(x)(1-\delta(x)) \tag{1}\]  
Finally, cross entropy is used to calculate the loss function, and the formula is as shown in Equation (2).  
\[L=\sum\left[y\log(l)+(1-y)\log(1-l)\right] \tag{2}\]  
where \(l=h(f(X))\); with the help of the chain rule, the overall gradient calculation formula is as shown in Equation (3), where \(\sigma=h(f(x))\), and \(x\) is the feature values of current mini-batch in training dataset.  
\[g:=\
abla_{f(x)}=(\sigma-y)\
abla_{z}h(z)\Big{|}_{z=f(x)} \tag{3}\]  
Among them, since the value of \(y\) is 0 or 1, the information entropy brought by the classification of \(y=0\) is eliminated in Formula (1) when calculating the cross entropy. According to the gradient g, the weight of each neuron can be updated during the backward propagation. Then, both parties update the weights by using Equation (4), where \(\alpha\) is the learning rate.  
\[w:=w-\alpha g \tag{4}\]  
The following will describe the privacy leakage problem faced by the above process.  
In the training process, the active party must calculate the gradient g from Equation (3) and deliver it to the passive party through the Cut Layer. During this process, the data leakage would occur. In the reasoning process, the actual business is facing the fact that the final prediction result needs to be obtained from the active party. Therefore, the passive party must transfer the user's features to the active party for calculation, which causes another kind of data leakage.  
To solve the existing privacy leakage problem, this study proposes a general scheme of federated learning for privacy improvement based on the scalable, secure computing and memory removal provided by the second-generation Intel SGX.  
With the support of the confidentiality, integrity, and remote authentication mechanism of the computing environment provided by Intel SGX, as shown in Figure 2, this scheme proposes an end-to-end privacy protection method, and also provides trusted metrics, confidential execution environments, secure communication channels, and data-encrypted export.