# Secure Vertical Federated Learning Under Unreliable Connectivity

Xinchi Qiu  Heng Pan  Wanru Zhao  Yan Gao  Pedro P. B. Gusmao  William F. Shen
Chenyang Ma  Nicholas D. Lane

###### Abstract

Most work in privacy-preserving federated learning (FL) has focused on
horizontally partitioned datasets where clients hold the same features and
train complete client-level models independently. However, individual data
points are often scattered across different institutions, known as clients, in
vertical FL (VFL) settings. Addressing this category of FL necessitates the
exchange of intermediate outputs and gradients among participants, resulting
in potential privacy leakage risks and slow convergence rates. Additionally,
in many real-world scenarios, VFL training also faces the acute issue of
client stragglers and drop-outs, a serious challenge that can significantly
hinder the training process but has been largely overlooked in existing
studies. In this work, we present _vFedSec_ , a first dropout-tolerant VFL
protocol, which can support the most generalized vertical framework. It
achieves secure and efficient model training by using an innovative _Secure
Layer_ alongside an embedding-padding technique. We provide theoretical proof
that our design attains enhanced security while maintaining training
performance. Empirical results from extensive experiments also demonstrate
_vFedSec_ is robust to client dropout and provides secure training with
negligible computation and communication overhead. Compared to widely adopted
homomorphic encryption (HE) methods, our approach achieves a remarkable $\geq
690\times$ speedup and reduces communication costs significantly by $\geq
9.6\times$.

Machine Learning, Federated Learning, ICML

##  1 Introduction

Federated learning (FL) is a machine learning paradigm that enables individual
institutions or devices to train a global model collaboratively without
sharing raw and sensitive data (McMahan et al., 2017). FL can be categorized
according to how datasets are partitioned across clients. Most existing works
focus on horizontal FL (HFL), where all participants use the same feature
space whilst holding different data samples (Yang et al., 2019b). This
partitioning scheme can often be found in _cross-device_ setups where clients
are often thousands of intermittent mobile or IoT devices holding different
data points, each point covering the entire input space (Yu & Li, 2021; Qiu et
al., 2022). Another case is vertical FL (VFL) (Wei et al., 2022), where data
points are partitioned across clients, which means different clients hold
different features of the same sample. VFL was historically only considered
for the _cross-silo_ setups involving a limited number of participating
clients with generally reliable connections. In such setups, participating
clients could be institutions holding complementary information on the same
data points. An illustrative example is different hospitals each hold
different clinical data of the same patient.

However, assuming all participating clients to have a constantly reliable
connection with the server dangerously oversimplifies the challenges faced by
VFL in real-world scenarios, either due to the specific setup of the system or
the practical difficulties of maintaining reliable connectivity due to
physical or geographical restrictions. The former could be found in systems
where models are jointly trained by data from institutional clients, which
have generally reliable connections with the server, and IoT devices, which
can suffer from dropping out during the course of training. For the latter, a
notable example is the increasingly popular low Earth orbit (LEO) satellite
system that aims at creating a moving infrastructure for seamless global
coverage and unlocking real societal benefits by carring out improved Earth
observation. While FL is poised to enable more efficient data transmission,
the link between individual satellites and ground stations (GS) breaks from
time to time due to the visiting pattern of the satellites to the location at
which the GS is positioned (Razmi et al., 2022).

Additionally, HFL and VFL can have greatly different training procedures and
client dependencies due to different data structures and, therefore, require
different levels of robustness. Each client in HFL trains a complete copy of
the global model on their local dataset and sends updated model parameters to
a centralized server for aggregation. The effect of having a single client
drop-out on the overall training is usually negligible. On the other hand,
under VFL, each client holds a specific subset of features and is responsible
for training a specific sub-module of the global model, and _the absence of a
single client can potentially cripple the entire training process_. Existing
VFL research has mainly focused on small client cohorts with reliable
communication between clients and the server, and has largely overlooked the
realistic but significant issue of client disconnection or drop-out. While the
standard way of tackling this problem is to completely discard the training
round, which suffers client drop-out, after the pre-defined time-out limit,
completely discarding a round can result in a waste of computing power and
slower training convergence. Furthermore, the setup of VFL entails the
intrinsic risk of privacy leakage as intermediate activations or gradients
must be shared between clients during the training process, a process that
potentially allows the reconstruction of original raw features (Zhu et al.,
2019; Zhao et al., 2020; Jin et al., 2021; Yin et al., 2021). Therefore, it is
critical that any optimization of the VFL training process cannot compromise
the security of the system. As such, we introduce _vFedSec_ , the novel
embedding-padding method, which is a dropout-tolerant method and can largely
reduce the waiting time, provide a similar convergence rate as the no drop-out
baseline, and maintain the model performance. In this work:

  * •

We present _vFedSec_ \- the first dropout-tolerant VFL framework that
implements an efficient and privacy-preserving training via an architecture-
agnostic _Secure Layer_. Section 3 describes our proposed design and its core
component.

  * •

We provide a robust theoretical justification proving that our proposed method
does not adversely affect training performance and private information is
protected through the _Secure Layer_.

  * •

To validate our claims empirically, we have conducted comprehensive
experiments over four varied datasets of differing data volumes and model
architectures, as detailed in Section 5. The results substantiate that our
_vFedSec_ imposes negligible overhead in all cases. Moreover, our method
demonstrates a remarkable $\geq 690$x speedup and $\geq 9.6$x decrease in
communication costs when compared to the resource-intensive homomorphic
encryption (HE) techniques, thus affirming its superior computational and
communication efficiency. We also demonstrate that with our dropout-tolerance
method, we can maintain the training speed while maintaining the model
performance.

##  2 Background and Related Work

In the context of an efficient privacy-preserving framework for VFL, several
related papers have contributed to the understanding and improvement of
privacy, utility, and security aspects in VFL. A comprehensive literature
review (Liu et al., 2022) provides an overview of VFL and discusses various
protection algorithms. However, it does not specifically address the
efficiency aspect of it. Another study (Ranbaduge & Ding, 2022) focuses on
integrating differential privacy (DP) techniques into VFL, but it does not
explicitly cover efficiency either. Kang et al. (2022b) propose a framework to
evaluate the privacy-utility trade-off in VFL, highlighting the limitations of
existing approaches like homomorphic encryption (HE) and multi-party
computation (MPC) in terms of computation and communication overheads, and Cai
et al. (2023) apply HE to split neural networks (Split NN) for improved
security. Zheng et al. (2022) presents a heuristic approach to make split
learning resilient to label leakage, albeit at the cost of accuracy. Sun et
al. (2022) explore label leakages from forward embeddings and their associated
protection methods, which can cause a decrease in accuracy. The method
proposed by Liu et al. (2020) only tries to protect the sample IDs, rather
than all the raw private data; Chen et al. (2020) perturb local embedding to
ensure data privacy and improve communication efficiency, which has strict
requirements for the embedding and can impact the overall performance. There
are also BlindFL (Fu et al., 2022), ACML (Zhang & Zhu, 2020), and PrADA (Kang
et al., 2022a) which are all homomorphic encryption (HE) based solutions.
These approaches often incur significant communication and computation
overheads. Moreover, existing approache (Hardy et al., 2017; Yang et al.,
2019a) and are restricted to (approximated) linear models and just two
parties.

In the realm of VFL, several studies have delved into the issue of robustness
and stragglers problem. Gu et al. (2021) present AFSGD-VP, tailored for
environments without a central server, ensuring embedded privacy through a
tree-structured aggregation. Yan et al. (2022) introduce AMVFL, which focuses
on asynchronous gradient aggregation for linear and logistic regression, with
local embeddings shielded by secret-shared masks. VAFL (Chen et al., 2020) is
designed for intermittently connected clients, incorporating differential
privacy (DP) but with some performance compromises compared to our _vFedSec_.
FedVS (Li et al., 2023) utilizes polynomial interpolation to efficiently
handle stragglers, yet it falls short in addressing the drop-out challenge.

##  3 Methodology

###  3.1 Problem Settings

##### Generalized VFL Framework

In our generalized VFL setting, data is partitioned across both feature and
sample spaces. Let the complete feature set be denoted as $\mathcal{X}$ and
the entire sample set as $\mathcal{D}$. Clients are organized into groups
based on the specific features they possess. For group $i$, the dataset
$\mathcal{D}_{i}$ encompasses all samples corresponding to a distinct feature
subset $\mathcal{X}_{i}$, such that
$\mathcal{X}_{i}\cap\mathcal{X}_{j}=\emptyset$ for all $j\neq i$, and
$\mathcal{X}=\bigcup_{i}\mathcal{X}_{i}$,
$\mathcal{D}=\bigcup_{i}\mathcal{D}_{i}$. Within each group $i$, client
$C_{i}^{(k)}$, the $k$-th client in group $i$, holds a partial dataset
$\mathcal{D}_{i}^{(k)}$ associated with features $\mathcal{X}_{i}$. These
partial datasets contain distinct subsets of samples, ensuring that
$\bigcup_{k}\mathcal{D}_{i}^{(k)}=\mathcal{D}_{i}$. The first group is
considered the active party, comprising a single client, denoted as $C_{0}$,
who possesses the entire label set $\mathcal{Y}$. Other clients are considered
to be the passive parties. Importantly, our approach is also compatible with
conventional VFL settings (the setting considered in all previous papers),
simply by assuming that each group contains only one client. For the sake of
simplicity, the active party client $C_{0}$ is distinguished from other
groups, i.e., $C_{0}$ does not belong to any group. The number of groups is
$M$.

##### Classification Task

In this paper, we focus on a $N$-class classification problem, defined within
a compact feature space $\mathcal{X}$ and a discrete label space
$\mathcal{Y}=[N]$, where $[N]=\\{1,\ldots,N\\}$ denotes the set of possible
class labels. The objective is to train a neural network, represented by a
function $f$, parameterized by the model weights $\mathbf{w}$. The performance
of this model is evaluated using the loss function $\mathcal{L}(\mathbf{w})$,
with the widely adopted cross-entropy loss. Notably, our algorithm exhibits a
versatile framework that can be generalized to a variety of other tasks and
loss functions, particularly those amenable to split learning. This
adaptability allows for the application of our model to a broader range of
learning scenarios.

##### Threat Model

Our threat model operates under a semi-honest assumption. In this context, the
server, denoted as $S$, is trusted not to collude with any clients. However,
it may attempt to infer private information from the aggregated data it
receives. Likewise, the clients are assumed to follow the protocol honestly,
but they may attempt to infer other clients’ privacy from all their available
information. Our model considers the possibility of collusion among clients.
Specifically, one or more clients within the same group or from different
groups, can collaborate, posing an increased risk of privacy leakage about
other clients’ local datasets. This model reflects a realistic scenario in FL
environments where the integrity of the server is maintained, but client-to-
client trust boundaries are less stringent.

###  3.2 Training and Testing Pipeline

Figure 1: Detailed illustration of _vFedSec_ with _Secure Layer_ with
embedding padding techniques during forward pass when drop-out occurs. A
client group contains clients with the same set of features, which can be a
single client or multiple clients. Each client group is responsible to
updating part of the embedding vector, which will be fed to the top model on
the server side.

This section describe the training and testing pipeline under _vFedSec_
protocol. An illustration of it can be found in Figure 6 in Appendix A.

Our framework employs split learning and assumes the establishment of an end-
to-end (E2E) encrypted channel between any two clients, enabled by a symmetric
encryption algorithm, such as Secure Sockets Layer (SSL).

The mini-batch selection is assumed to be completed in a privacy-preserving
manner, e.g., through a Private Set Intersection (PSI). The specific approach
varies based on data sensitivity and the specific scenario. In our
experiments, $C_{0}$ initiates the mini-batch selection, communicating the IDs
of chosen samples to the owning clients via the E2E encrypted channel. This
ensures that no party gains additional knowledge about samples not in their
possession, including sample IDs. In the training phase, labels of the
selected samples are sent to the server, but due to the encryption of sample
IDs, the server cannot correlate these labels with any specific samples.

####  3.2.1 Forward Pass

During the forward pass, as illustrated in Figure 1, $C_{0}$ inputs raw
features $x_{0}\in D_{0}$ into its bottom model $f_{0}$, parametrized by
$\theta_{f_{0}}$, obtaining the quantized intermediate embedding
${h_{0}}^{\prime}=q\left(h_{0}\right)\in\mathbb{Z}^{B\times H}$, where
$h_{0}=f_{0}(x_{0})$, $q:\mathbb{R}\rightarrow\mathbb{Z}$ is the quantization
function, $B$ is the batch size, and $H$ is the dimension of $h_{0}$. The
exact details regarding quantization can be referred to Section 3.5.

For each client $C_{i}^{(k)}$ in group $i$ ($k$ represents the $k$-th client
in group $i$), $i=1,2,\ldots,M$, the process involves passing raw features
$x_{i}^{(k)}\in D_{i}^{(k)}$ through its bottom model $f_{i}$, parametrized by
$\theta_{f_{i}}$. This yields
$\bar{h_{i}^{(k)}}=f_{i}\left(x_{i}^{(k)}\right)\in\mathbb{R}^{Bi^{(k)}\times
H_{i}}$, which is then expanded to $h_{i}^{(k)}\in\mathbb{R}^{B\times H_{i}}$
by inserting zeros for missing samples and quantized to
${h_{i}^{(k)}}^{\prime}=q\left(h_{i}^{(k)}\right)$, where
$\sum_{i>0}{H_{i}}=H$. All clients in group $i$ utilize the same bottom model
$f_{i}$ due to shared features space $\mathcal{X}_{i}$.

The mask embedding of group $i$ for all the selected samples is calculated as
${h_{i}}^{\prime}=\sum_{k}{{h_{i}^{(k)}}^{\prime}}$. For example, consider a
scenario where samples $x_{1},x_{2},x_{3}$ are selected and group $i$
comprises two clients. Let client $1$ have $x_{1}$ and client $2$ have
$x_{2},x_{3}$. Denote $s_{j}=q\left(f_{i}(x_{j})\right),j=1,2,3$, as the
quantized intermediate embeddings for each sample. The quantized embedding
${h_{i}}^{\prime}$ of group $i$ is then derived by adding
${h_{i}^{(1)}}^{\prime}$ from client $1$ and ${h_{i}^{(2)}}^{\prime}$ from
client $2$ as shown below:

${h_{i}^{(1)}}^{\prime}+{h_{i}^{(2)}}^{\prime}=\begin{pmatrix}s_{1}\\\ 0\\\
0\end{pmatrix}+\begin{pmatrix}0\\\ s_{2}\\\
s_{3}\end{pmatrix}=\begin{pmatrix}s_{1}\\\ s_{2}\\\
s_{3}\end{pmatrix}={h_{i}}^{\prime}$ (1)

After quantization, $C_{0}$ generates noise $n_{i}\in\mathbb{Z}^{B\times
H_{i}},i=1,2,\ldots,M$, forming the masked intermediate embedding
$\tilde{h_{0}}={h_{0}}^{\prime}+(n_{1}^{\top},n_{2}^{\top},\ldots,n_{M}^{\top})^{\top}$.
Each client $C_{i}^{(k)}$ in group $i$ similarly produces noise
$n_{i}^{(k)}\in\mathbb{Z}^{B\times H_{i}}$, resulting in
$\tilde{h_{i}^{(k)}}={h_{i}^{(k)}}^{\prime}+n_{i}^{(k)}$. The design ensures
that, for all $i$, the aggregate noise $n_{i}+\sum_{k\in C_{i}}{n_{i}^{(k)}}$
is reconstructable on the server side, without revealing individual noises
$n_{i}^{(k)}$ or $n_{i}$ (as discussed in detail in Section 3.4).

All masked embeddings, including $\tilde{h_{0}}$ and $\tilde{h_{i}^{(k)}}$ are
sent to the server along with the necessary information for noise
reconstruction. Let $\tilde{h_{i}}=\sum_{k}{\tilde{h_{i}^{(k)}}}$ for all $i$.
The server reconstructs the aggregated noise $n$ and then calculates the
aggregated quantized intermediate embedding $h^{\prime}$ as follows:

$\displaystyle\small h^{\prime}$
$\displaystyle=\tilde{h}-n=\tilde{h_{0}}+\left(\tilde{h_{1}}^{\top},\ldots,\tilde{h_{M}}^{\top}\right)^{\top}-n$
(2)
$\displaystyle={h_{0}}^{\prime}+({h_{1}}^{\prime\top},\ldots,{h_{M}}^{\prime\top})^{\top}$

where

$\small
n=\left(\left(n_{1}+\sum_{k}{n_{1}^{(k)}}\right)^{\top},\ldots,\left(n_{M}+\sum_{k}{n_{M}^{(k)}}\right)^{\top}\right)^{\top}$
(3)

The server then dequantizes and feeds the aggregated embedding
$h=q^{-1}\left(h^{\prime}\right)$ into the top model $g$, parametrized by
$\theta_{g}$, to obtain the final output $\hat{y}=g\left(h\right)$.

####  3.2.2 Backward Pass

After computing the output $\hat{y}$ of the top model $g$, the server
calculates the loss $\mathcal{L}(\hat{y},y)$ and its gradient
$\nabla\mathcal{L}(\hat{y},y)$. The server then back-propagates this gradient
through the first layer of the top model, updates the model parameters, and
sends the intermediate gradients back to the clients.

Upon receiving these gradients, each client proceeds to complete the
backpropagation process. The active party, client $C_{0}$, directly updates
its bottom model $f_{0}$. For a client $C_{i}^{(k)}$ in group $i$, the update
strategy depends on the number of clients in the group. If group $i$ comprises
a single client, then $C_{i}^{(k)}$ updates its bottom model $f_{i}$ directly.
In group $i$ with multiple clients, client $C_{i}^{(k)}$ computes the model
parameters update as
$\Delta\theta_{i}^{(k)}=-\eta\nabla_{\theta_{f_{i}}}\mathcal{L}(\hat{y},y)$
and go through the process of quantization to obtain
${\Delta\theta_{i}^{(k)}}^{\prime}=q\left(\Delta\theta_{i}^{(k)}\right)$ like
in the forward pass, where $\eta$ denotes the learning rate.

For clients $C_{i}^{(k)}$ in multi-client group $i$, model updates are masked
as
$\tilde{\Delta\theta_{i}^{(k)}}={\Delta\theta_{i}^{(k)}}^{\prime}+\epsilon_{i}^{(k)}$,
where $\epsilon_{i}^{(k)}$ represents noise generated following the same
protocol in the forward pass. This ensures that the aggregated noise from all
clients’ updates in the group $i$, $\sum_{k}{\epsilon_{i}^{(k)}}$, is
reconstructable server-side (See Section 3.4). Each client then sends the
masked model update $\tilde{\Delta\theta_{i}^{(k)}}$ along with the necessary
information for noise reconstruction to the server.

Upon receiving $\tilde{\Delta\theta_{i}^{(k)}}$ from all clients in group $i$,
the server reconstructs the aggregate noise and obtains the quantized model
update as:

${\Delta\theta_{i}}^{\prime}=\sum_{k}{\tilde{\Delta\theta_{i}^{(k)}}}-\sum_{k}{\epsilon_{i}^{(k)}}=\sum_{k}{{\Delta\theta_{i}^{(k)}}^{\prime}}$
(4)

The server then dequantizes this model update to
$\Delta\theta_{i}=q^{-1}\left({\Delta\theta_{i}}^{\prime}\right)$ and applies
it to the bottom model $f_{i}$. The updated model parameters are subsequently
sent to the corresponding clients in the next forward pass.

###  3.3 Drop-out Tolenrance

Our approach is robust to client drop-out through embedding padding, as
illustrated in Figure 1. If a client drop-out within group $i$, the server
will discard all masked embeddings $\tilde{h_{i}^{(k)}}$ from group $i$ and
the corresponding segment $[\tilde{h_{0}}]_{i}\in\mathbb{Z}^{B\times H_{i}}$
of $\tilde{h_{0}}\in\mathbb{Z}^{B\times H}$. Consequently, in the aggregated
masked embedding $\tilde{h}$, the segment $[\tilde{h_{0}}]_{i}+\tilde{h_{i}}$
is replaced with N/A.

After noise removal and dequantization of the embedding $h$, the server passes
$h$ through a BatchNorm layer. Then, N/A fields within $\textsc{BatchNorm}(h)$
are replaced with zeros. This padded embedding is then input to the top model
to generate the final output. This approach ensures the model’s resilience to
potential disruptions caused by client drop-outs, hence increasing the
convergence rate.

###  3.4 Noise Generation

In a system of $N$ clients, for any two clients $u$ and $v$, a pair of noise
$n_{u,v}$ and $n_{v,u}$ are generated, satisfying the condition
$n_{u,v}=-n_{v,u}$. To facilitate this, a shared seed is established between
any two clients, which must be confidential and undisclosed to any third
parties. Assuming $u>v$, both client $u$ and $v$ utilize this shared seed to
generate identical pseudo-random noise $p$ within the finite field
$Z_{R}^{m}=\\{0,1,\ldots,R-1\\}$, thereby deriving $n_{u,v}=p$ and
$n_{v,u}=-p$. The shared seed generation can leverage a list of pre-shared
keys, the Elliptic Curve Diffie-Hellman (ECDH) key agreement (Bonawitz et al.,
2016; Barker et al., 2017), or similar methods. For each client $u$, noise
$n_{u,v}$ is generated in relation to client $v$ for all $v\neq u$, computing
$n_{u}=\sum_{v\neq u}{n_{u,v}}$. Adding $n_{u}$ to the client’s intermediate
embedding effectively makes it indistinguishable from a random sequence,
thereby protecting the client’s privacy (see Section 4.1). Given that $\forall
u\neq v,n_{u,v}+n_{v,u}=0$, the reconstruction and cancellation of the
aggregated noises can easily be performed by summation, because the sum of all
client noises $n_{u}$ is zero, as shown below:

$\sum_{u}{n_{u}}=\sum_{u}{\sum_{v\neq u}{n_{u,v}}}=\frac{1}{2}\sum_{u,v,u\neq
v}{\left(n_{u,v}+n_{v,u}\right)}=0$ (5)

Although not used in this paper, the reconstructable sum of noises can
alternatively be implemented using techniques such as Lagrange Coded Computing
(LCC) (So et al., 2022).

###  3.5 Quantization

Cryptographic operations depend on integer-based computations, thus requiring
the quantization of intermediate embeddings. Our method is compatible with any
quantization algorithm that facilitates the dequantization of summed quantized
vectors. We use a naive quantization algorithm in this work. The quantization
process for a real number $x\in\mathbb{R}$ is as follows: define the clipping
range as $[-t,t]$ and the target range as $[0,R)$, where $t$ is the clipping
threshold and $R$ the size of the target range. The quantized value
$x_{\text{quant}}=q(x)=\textsc{round}\left(\frac{\textsc{clip}(x,-t,t)+t}{2t}\times
R\right)$ involves clipping $x$ to $[-t,t]$ and applying stochastic rounding.
The dequantization is given by
$x_{\text{dequant}}=q^{-1}\left(x_{\text{quant}}\right)=\frac{2t}{R}x_{\text{quant}}-t$.
Our implementation employs float32 to uint32 conversion with $t=4$ and
$N=2^{27}$, ensuring minimal impact on model performance due to high
precision.

##  4 Security Analysis

###  4.1 Privacy Guarantee

The thread model we considered is described in Section 3.1. In our security
arguments, we show theoretically that the modulus of the intermediate
embedding with added noise in integers modulo $R$ ($\mathbb{Z}^{m}_{R}$) will
be the same as random noise in $\mathbb{Z}^{m}_{R}$ for each group of clients.

######  Lemma 4.1.

Let $U_{i}$ be the set of clients in group $i$ and the active client $C_{0}$.
$\\{h^{\prime}_{u}\\}_{u\in U}$ where $\forall u\in
U,h_{u}\in\mathbb{Z}^{m}_{R}$ be the quantized intermediate embedding of each
client; $n_{u,v}$ be the random noise associated with client $u$ and $v$ that
is uniformly sampled from the finite field
$\mathbb{Z}^{m}_{R}=\\{0,1,\dots,R-1\\}^{m}$, and $n_{u,v}=-n_{v,u}$. Then we
have: intermediate embedding associated with random noises associated with
each other clients added: $h^{\prime}_{u}+\sum_{v\in
U\setminus\\{u\\}}n_{u,v}$ has the same distribution as the sum of random
noise: $\sum_{u\in U}w_{u}$ such that $w_{u}$ is uniformly sampled from
$\mathbb{Z}^{m}_{R}$ ($w_{u}\sim\mathbb{Z}^{m}_{R}$), provided the sum is the
same ($\sum_{u\in U}w_{u}=\sum_{u\in U}h_{u}(\mathrm{mod}\ R)$).

$\displaystyle h_{u}+\sum_{v\in U\setminus\\{u\\}}n_{u,v}\equiv\sum_{u\in
U}w_{u}$

where ‘$\equiv$’ denotes that the distributions are identical.

Proof for the lemma can be found in Appendix C. The lemma proves that within
each set of clients $U$, if clients’ values have uniformly random noise added
to them, then the resulting values look uniformly random, conditioned on their
sum being equal to the sum of the client’s intermediate values. In other
words, the noises, as explained in Section 3.4, hide all private information
about the client’s data, apart from the sum. Privacy protection through
_Secure Layer_ is achieved through the use of masking on the intermediate
outputs and gradients before they are sent back to the server, thus preventing
the server from using the received information to gain knowledge about the
sensitive client information. Therefore, our method protects the data from
both data reconstruction and membership inference attacks.

In addition, since _vFedSec_ operates for each group of clients as described
in Section 3.3, and the Lemma theoretically proves conditioned on the group of
clients, making our method a dropout-tolerant privacy-preserving VFL protocol.

Furthermore, while our current implementation could be vulnerable to active
adversaries, our solution can be extrapolated very easily to include
_malicious_ settings by introducing a public-key infrastructure (PKI) that can
verify the identity of the sender (Bonawitz et al., 2017). It can thus be
further protected from malicious attacks.

Although our method does not allow exposing secret keys to other parties and
demonstrates robustness against collusion between the aggregator and passive
parties, in practical settings, the risk of secret key leakage persists, e.g.,
accidental inappropriate practices of engineers. Thus, to ensure privacy, it
is necessary to routinely regenerate keys for symmetric encryption and secure
aggregation, specifically, by executing the setup phase after every K
iterations, in both the training and testing stages. The value of K can vary
in real-world scenarios, but the larger value will inevitably incur higher
risks of keys being compromised. In the event of key leakage, an attacker will
only have access to a limited amount of information instead of all encrypted
information if keys are regenerated periodically.

###  4.2 Other considerations

Generalizability: _vFedSec_ provides a generalized protocol for any kind of
VFL setups as explained in Section 3.1. We design our protocol _vFedSec_ to be
able to cope with any kind of vertical FL setups and any kind of model
architectures residing both in the local module on the client side and the
global module on the server side. Previous papers usually only consider the
vertical setup with two parties: one active and one passive (Liu et al.,
2022), or the feature in passive parties cannot overlap (Jiang et al., 2022;
Fang et al., 2021; Wei et al., 2022). However, in our general setup, there
could be multiple passive parties, and the feature space in passive parties
can be overlapped. Also, our protocol can be further expanded to include
multiple active parties if needed. In this case, we just need to adapt the
mini-batch selection process and the label-sharing process with the server.

Scalability and Efficiency: Our core solution is agnostic to the number of
participating clients and the data partition schemes under the VFL setting. As
a result, our solution’s scalability is only dependent on the underlying FL
framework and on how key generation and key exchange between clients are
handled. Also, our solution is scalable and efficient in the sense that,
unlike many previous methods explained in Section 2 that utilized HE, we
employ lightweight masks through random noise, and the mask can be efficiently
reconstructed as explained in Section 3.4.

##  5 Experiments

###  5.1 Experimental Protocol

Datasets: Experiments are conducted over four datasets: Bank Marketing dataset
(Moro et al., 2011), Adult Income dataset (Kohavi et al., 1996), EMNIST (Cohen
et al., 2017), and Fashion-MNIST (Xiao et al., 2017).

Drop-out Simulation. To simulate the drop-out in the experiments, we introduce
two different coefficients. We simulate the drop-out as a random process in
our experiments. The first one refers to the drop-out probability of a given
round. If the probability is $0.3$, it means that there is a 30$\%$ chance
that at least one client will drop out in this particular round. Another
coefficient refers to the proportion of clients in the client pool dropping
out. If the proportion is $0.1$, it means that there are random $10\%$ of
clients who will drop out in this particular round. We also consider the
baseline case, which we refer to as the ‘discard’ case, which means that if
there exists a client dropping out, we discard this round completely. For
example, if we say discard ($0.3$,$0.1$) it refers to the discard case with
$0.3$ drop-out probability and $0.1$ proportion of clients dropping out. We
aim to simulate the situation when the drop-out probability is relatively high
to demonstrate the superiority of our method compared with simply discarding
the current communication round if the drop-out happens. In our experiments,
we choose two different values for the drop-out probability ($0.3$ and $0.4$)
and choose $0.1$ as the client drop-out proportion.

Other details regarding the datasets, specific partition, model architecture,
and the details of overhead profiling can be found in Appendix B.

Table 1: Results on the CPU time (in seconds). Note that PHE package is less
optimized than SEAL. It is generally not considered in real-world
applications.

| Active Party CPU time (s) | Passive Party CPU time (s)
---|---|---
| Training phase | Testing phase | Training phase | Testing phase
Dataset | Total | Overhead | Total | Overhead | Total | Overhead | Total | Overhead
Bank(Ours) | 1.044 | 0.1881 | 0.3057 | 0.1864 | 0.1633 | 0.1089 | 0.1363 | 0.1075
Bank(SEAL) | $1.075\times 10^{3}$ | $1.075\times 10^{3}$ | $1.075\times 10^{3}$ | $1.075\times 10^{3}$ | $1.113\times 10^{2}$ | $1.113\times 10^{2}$ | $1.113\times 10^{2}$ | $1.113\times 10^{2}$
Bank(PHE) | $1.565\times 10^{4}$ | $1.565\times 10^{4}$ | $1.565\times 10^{4}$ | $1.565\times 10^{4}$ | $1.993\times 10^{3}$ | $1.993\times 10^{3}$ | $1.993\times 10^{3}$ | $1.993\times 10^{3}$
Income(Ours) | 0.7379 | 0.1909 | 0.2738 | 0.1889 | 0.1588 | 0.1143 | 0.1413 | 0.1124
Income(SEAL) | $5.093\times 10^{2}$ | $5.092\times 10^{2}$ | $5.093\times 10^{2}$ | $5.092\times 10^{2}$ | $3.885\times 10^{2}$ | $3.884\times 10^{2}$ | $3.884\times 10^{2}$ | $3.884\times 10^{2}$
Income(PHE) | $7.413\times 10^{3}$ | $7.413\times 10^{3}$ | $7.413\times 10^{3}$ | $7.413\times 10^{3}$ | $6.853\times 10^{3}$ | $6.853\times 10^{3}$ | $6.853\times 10^{3}$ | $6.853\times 10^{3}$
EMNIST(Ours) | 1.040 | 0.3334 | 0.6671 | 0.3300 | 0.8538 | 0.2314 | 0.5386 | 0.2314
EMNIST(SEAL) | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$
EMNIST(PHE) | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$
Fashion-MNIST(Ours) | 1.016 | 0.3240 | 0.6286 | 0.3189 | 0.8504 | 0.2301 | 0.5282 | 0.2300
Fashion-MNIST(SEAL) | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$ | $7.918\times 10^{4}$
Fashion-MNIST(PHE) | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$ | $1.153\times 10^{6}$

Table 2: Results on the communication both in size (MB).

| Active Party Data Transmission (MB) | Passive Party Data Transmission (MB)
---|---|---
| Training phase | Testing phase | Training phase | Testing phase
Dataset |  Total |  Overhead |  Total |  Overhead |  Total |  Overhead |  Total |  Overhead
Bank(Ours) |  0.88 |  0.14 |  0.57 |  0.14 |  0.79 |  0.13 |  0.44 |  0.13
Bank(SEAL) |  8.41 |  7.67 |  8.10 |  7.67 |  8.32 |  7.57 |  7.97 |  7.57
Bank(PHE) |  68.70 |  67.95 |  68.38 |  67.95 |  68.60 |  67.85 |  68.26 |  67.85
Income(Ours) |  0.88 |  0.14 |  0.57 |  0.14 |  0.85 |  0.13 |  0.44 |  0.13
Income(SEAL) |  8.41 |  7.67 |  8.10 |  7.67 |  8.39 |  7.57 |  7.97 |  7.57
Income(PHE) |  68.70 |  67.95 |  68.38 |  67.95 |  68.67 |  67.85 |  68.26 |  67.85
EMNIST(Ours) |  6.24 |  0.21 |  3.31 |  0.21 |  5.99 |  0.05 |  3.06 |  0.05
EMNIST(SEAL) |  76.85 |  70.82 |  73.92 |  70.82 |  76.60 |  70.66 |  73.67 |  70.66
EMNIST(PHE) |  641.98 |  635.95 |  639.05 |  635.95 |  641.73 |  635.79 |  638.80 |  635.79
Fashion-MNIST(Ours) |  6.24 |  0.21 |  3.31 |  0.21 |  5.99 |  0.05 |  3.06 |  0.05
Fashion-MNIST(SEAL) |  76.85 |  70.82 |  73.92 |  70.82 |  76.60 |  70.66 |  73.67 |  70.66
Fashion-MNIST(PHE) |  641.98 |  635.95 |  639.05 |  635.95 |  641.73 |  635.79 |  638.80 |  635.79

###  5.2 Efficientcy Results

_vFedSec_ is agnostic to the number of participating clients, and is efficient
in terms of both computation and communication. In this section, we conduct
experiments over four datasets to measure both the computation and the
communication cost of _vFedSec_ training.

The computation cost is measured through CPU time, and the communication cost
is measured through the transmission size. We also measure the overhead cost
that shows the extra CPU time or communication compared to unsecured VFL
training. Communication overheads are from the length of ciphertext (encrypted
Sample IDs) over plaintext and the exchange of public keys. Computation
overheads are caused by creating key pairs and shared secrets, noise
generation and reconstruction, and encryption and decryption. As transferring
parameters/gradients and updating models are necessary for VFL training and
split learning, they are not counted as overheads. All experiments are
reported with 1 setup phase and 5 training rounds, and each experiment is
repeated 10 times, and averages are reported.

As mentioned in Section 4.1, in practice, each party should create new key
pairs routinely to mitigate the risk of adversaries from accessing
confidential information in the event of secret key leakage. In our
experiments, the key pairs and the shared secrets will be re-generated for
every 5 iterations.

Table 1 reports the CPU time as a measure to show the computation cost using
_vFedSec_. The equivalence of certain total times to overhead times can be
attributed to the substantial overhead of HE, which overshadows other
computational processes. The CPU time is reported separately for the active
party and passive parties. The overhead columns show extra CPU time compared
with unsecured VFL training. We use HE functions from Python module _Phe_
(Data61, 2013) and _SEAL-Python_ (Huelse, 2023). _Phe_ module implements the
Pallier cryptosystem in Python, and _SEAL-Python_ creates Python bindings for
APIs in Microsoft SEAL (SEAL, ) using Pybind11 (Jakob et al., 2017).
Considering that the protocols proposed by many HE VFL papers, such as
BlindFL(Fu et al., 2022), ACML(Zhang & Zhu, 2020), and PrADA(Kang et al.,
2022a), they entail encrypting a matrix and computing matrix multiplication
between an encrypted matrix and a plaintext matrix, we estimated the overhead
of above operations through (1) encrypt a weight matrix in each aggregation;
(2) compute a matmul between a plaintext matrix and an encrypted weight matrix
in each aggregation. It is worth noting that, in reality, most HE VFL
protocols require multiple rounds of communication, repetitively
encrypt/decrypt matrices, and conduct matmul. But, in our estimated cases, we
only encrypt and matmul once in each forward pass, and exclude the overhead of
decryption (as decryption may happen on the server side). Thus, our estimation
is the minimum overhead incurred by HE VFL protocols, while the real overheads
of adopting those protocols can be multiple times larger than our estimation
if using the same HE libraries.

Table 2 shows the transmission size and is also demonstrated on both the
active and passive parties. As demonstrated in both tables, the overhead
accounts for a relatively small part of the total amount, in both CPU time and
communication size. The CPU time overhead is caused by parties adding masks to
their original output and encryption/decryption of sample IDs. The
communication overhead is introduced by broadcasting encrypted sample IDs,
which are larger than plain text. As the masks can be reconstructed by
summation, the unmasking process is very efficient.

Also, as reported in Table 3, the client-side overheads of _vFedSec_ grow
linearly with increasing the number of clients and the batch size. The server-
side computation and storage overheads are negligible, and the communication
overheads are incurred by broadcasting encrypted sample IDs to all clients,
instead of only forwarding sample IDs to the sample holders. More results can
be found in Appendix D.

###  5.3 Drop-out Results

As mentioned in the introduction, clients in real-world scenarios could drop
out from the current round of training. In contrast to the standard solution
(i.e. completely discard this round of training after the pre-defined time-out
limit), which yields slow convergence due to waste of computing power,
_vFedSec_ introduces the novel dropout-tolerant embedding padding method,
which greatly reduces the waiting time when drop-out occurs and eliminates the
gap between the drop-out scenario and no drop-out baseline in terms of
convergence rate while maintaining the model performance.

Figure LABEL:fig:dropout shows the results for Fashion-MNIST and EMNIST under
different drop-out scenarios. The plots show that our method can maintain the
model performance with a similar convergence rate under different feature
partition setups, but the discard baseline fails to do so. Similar results can
be found in Table 6 for other datasets too in Appendix E. These results also
show that with more partitions, the discard baselines perform worse while our
method still holds the same level of performance. This is mainly because, when
drop-out occurs, the part that requires padding reduces as the number of
partitions increases. Hence, it might have less impact on the model
performance.

###  5.4 Ablation Study

| Client | Server
---|---|---
Computation | $O(hN+B)$ | $O(1)$
Communication | $O(N+B)$ | $O(BN)$
Storage | $O(N)$ | $O(1)$

Table 3:  Overhead summary of _vFedSec_ in one training/testing round. $h$ is
the size of intermediate output, $B$ is the batch size, and $N$ is the number
of clients.  Figure 5: Comparison of average CPU time for different batch
sizes, using _vFedSec_ and HE from Phe and SEAL-Python. The Y-axis is in the
log scale. The results are from 10 experiments.

We demonstrate the efficiency of _vFedSec_ through an ablation study to
compare our method and widely adopted method HE. The experiments compare how
_vFedSec_ and HE process matrix multiplications.

Assume the input tensor is of size (Batch size, 8), and the weight tenor is
(8, 8). Tensor shapes in the comparison are smaller than tensors used by a
passive party in experiments. Given that the HE libraries do not support
matrix operations, both _vFedSec_ and HE implementations are not optimized by
any Python modules, such as _numpy_. The HE implementation in this comparison
inevitably involves nested Python loops. For large matrices or more advanced
operations, implementations in other languages, e.g., C++, C#, are more
suitable. The results can be found in Fig. 5, which clearly shows the
efficiency of our method. It indicates that our approach yields a
$9.1\text{\times}{10}^{2}$ $\sim$ $3.8\text{\times}{10}^{4}$ times speedup
when evaluating the computational overheads attributed solely to our method in
contrast to HE.

##  6 Conclusion

In this work, we tackle the challenge of privacy-preserving training in
vertical FL settings. We propose _vFedSec_ , the first framework that works
securely, robustly, and efficiently under the most generalized vertical FL
setting and unreliable client connectivity. We introduce innovative _Secure
Layer_ and provide theoretical proof that its design attains enhanced security
while maintaining model performance. We further demonstrate through empirical
results that our method, while effectively and efficiently protecting
sensitive private information, also maintains model performance in the event
of unreliable connectivity and a high drop-out rate. Furthermore, this novel
method not only provides a significantly faster convergence rate compared with
the standard method of tacking client drop-out, but also eliminates the gap
between the drop-out scenario and no drop-out baseline in terms of convergence
rate while maintaining the model performance. Finally, we also benchmarked our
method against HE-based solutions using two HE libraries, which indicated a
remarkable reduction in computational costs by at least $690\times$, and a
significant decrease in communication costs by more than $9.6\times$.

## Impact Statement

This paper presents work whose goal is to provide a privacy-preserving
vertical federated learning framework. There are many potential societal
consequences of our work, none of which we feel must be specifically
highlighted here.

## References

  * Barker et al. (2017) Barker, E., Chen, L., Keller, S., Roginsky, A., Vassilev, A., and Davis, R.  Recommendation for pair-wise key-establishment schemes using discrete logarithm cryptography.  Technical report, National Institute of Standards and Technology, 2017.
  * Bonawitz et al. (2016) Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., and Seth, K.  Practical secure aggregation for federated learning on user-held data.  _arXiv preprint arXiv:1611.04482_ , 2016.
  * Bonawitz et al. (2017) Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., and Seth, K.  Practical secure aggregation for privacy-preserving machine learning.  In _proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security_ , pp. 1175–1191, 2017.
  * Cai et al. (2023) Cai, S., Chai, D., Yang, L., Zhang, J., Jin, Y., Wang, L., Guo, K., and Chen, K.  Secure forward aggregation for vertical federated neural networks.  In _Trustworthy Federated Learning: First International Workshop, FL 2022, Held in Conjunction with IJCAI 2022, Vienna, Austria, July 23, 2022, Revised Selected Papers_ , pp. 115–129. Springer, 2023.
  * Chen et al. (2020) Chen, T., Jin, X., Sun, Y., and Yin, W.  Vafl: a method of vertical asynchronous federated learning.  _arXiv preprint arXiv:2007.06081_ , 2020.
  * Cohen et al. (2017) Cohen, G., Afshar, S., Tapson, J., and Van Schaik, A.  Emnist: Extending mnist to handwritten letters.  In _2017 international joint conference on neural networks (IJCNN)_ , pp. 2921–2926. IEEE, 2017.
  * Data61 (2013) Data61, C.  Python paillier library.  https://github.com/data61/python-paillier, 2013.
  * Fang et al. (2021) Fang, W., Zhao, D., Tan, J., Chen, C., Yu, C., Wang, L., Wang, L., Zhou, J., and Zhang, B.  Large-scale secure xgb for vertical federated learning.  In _Proceedings of the 30th ACM International Conference on Information & Knowledge Management_, pp. 443–452, 2021.
  * Fu et al. (2022) Fu, F., Xue, H., Cheng, Y., Tao, Y., and Cui, B.  Blindfl: Vertical federated machine learning without peeking into your data.  In _Proceedings of the 2022 International Conference on Management of Data_ , pp. 1316–1330, 2022.
  * Gu et al. (2021) Gu, B., Xu, A., Huo, Z., Deng, C., and Huang, H.  Privacy-preserving asynchronous vertical federated learning algorithms for multiparty collaborative learning.  _IEEE transactions on neural networks and learning systems_ , 33(11):6103–6115, 2021.
  * Hardy et al. (2017) Hardy, S., Henecka, W., Ivey-Law, H., Nock, R., Patrini, G., Smith, G., and Thorne, B.  Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption.  _ArXiv_ , abs/1711.10677, 2017.  URL https://api.semanticscholar.org/CorpusID:26233593.
  * Huelse (2023) Huelse.  Microsoft seal for python.  https://github.com/Huelse/SEAL-Python, 2023.
  * Jakob et al. (2017) Jakob, W., Rhinelander, J., and Moldovan, D.  pybind11 – seamless operability between c++11 and python, 2017.  https://github.com/pybind/pybind11.
  * Jiang et al. (2022) Jiang, J., Burkhalter, L., Fu, F., Ding, B., Du, B., Hithnawi, A., Li, B., and Zhang, C.  VF-PS: How to select important participants in vertical federated learning, efficiently and securely?  In Oh, A. H., Agarwal, A., Belgrave, D., and Cho, K. (eds.), _Advances in Neural Information Processing Systems_ , 2022.  URL https://openreview.net/forum?id=vNrSXIFJ9wz.
  * Jin et al. (2021) Jin, X., Chen, P.-Y., Hsu, C.-Y., Yu, C.-M., and Chen, T.  Cafe: Catastrophic data leakage in vertical federated learning.  _Advances in Neural Information Processing Systems_ , 34:994–1006, 2021.
  * Kang et al. (2022a) Kang, Y., He, Y., Luo, J., Fan, T., Liu, Y., and Yang, Q.  Privacy-preserving federated adversarial domain adaptation over feature groups for interpretability.  _IEEE Transactions on Big Data_ , 2022a.
  * Kang et al. (2022b) Kang, Y., Luo, J., He, Y., Zhang, X., Fan, L., and Yang, Q.  A framework for evaluating privacy-utility trade-off in vertical federated learning, 2022b.
  * Kohavi et al. (1996) Kohavi, R. et al.  Scaling up the accuracy of naive-bayes classifiers: A decision-tree hybrid.  In _Kdd_ , volume 96, pp. 202–207, 1996.
  * Li et al. (2023) Li, S., Yao, D., and Liu, J.  Fedvs: Straggler-resilient and privacy-preserving vertical federated learning for split models, 2023.
  * Liu et al. (2020) Liu, Y., Zhang, X., and Wang, L.  Asymmetrical vertical federated learning.  _arXiv preprint arXiv:2004.07427_ , 2020.
  * Liu et al. (2022) Liu, Y., Kang, Y., Zou, T., Pu, Y., He, Y., Ye, X., Ouyang, Y., Zhang, Y.-Q., and Yang, Q.  Vertical federated learning.  2022\.
  * McMahan et al. (2017) McMahan, B., Moore, E., Ramage, D., Hampson, S., and y Arcas, B. A.  Communication-efficient learning of deep networks from decentralized data.  In _Artificial intelligence and statistics_ , pp. 1273–1282. PMLR, 2017.
  * Moro et al. (2011) Moro, S., Laureano, R., and Cortez, P.  Using data mining for bank direct marketing: An application of the crisp-dm methodology.  2011\.
  * Qiu et al. (2022) Qiu, X., Fernandez-Marques, J., Porto Buarque de Gusmão, P., Gao, Y., Parcollet, T., and Lane, N. D.  Zerofl: Efficient on-device training for federated learning with local sparsity.  In _International Conference on Learning Representations (ICLR)_ , 2022.
  * Ranbaduge & Ding (2022) Ranbaduge, T. and Ding, M.  Differentially private vertical federated learning, 2022.
  * Razmi et al. (2022) Razmi, N., Matthiesen, B., Dekorsy, A., and Popovski, P.  Scheduling for ground-assisted federated learning in leo satellite constellations.  In _2022 30th European Signal Processing Conference (EUSIPCO)_ , pp. 1102–1106. IEEE, 2022.
  * (27) SEAL.  Microsoft SEAL (release 4.1).  https://github.com/Microsoft/SEAL, January 2023.  Microsoft Research, Redmond, WA.
  * So et al. (2022) So, J., Nolet, C. J., Yang, C.-S., Li, S., Yu, Q., E Ali, R., Guler, B., and Avestimehr, S.  Lightsecagg: a lightweight and versatile design for secure aggregation in federated learning.  _Proceedings of Machine Learning and Systems_ , 4:694–720, 2022.
  * Sun et al. (2022) Sun, J., Yang, X., Yao, Y., and Wang, C.  Label leakage and protection from forward embedding in vertical federated learning, 2022.
  * Wei et al. (2022) Wei, K., Li, J., Ma, C., Ding, M., Wei, S., Wu, F., Chen, G., and Ranbaduge, T.  Vertical federated learning: Challenges, methodologies and experiments.  _arXiv preprint arXiv:2202.04309_ , 2022.
  * Xiao et al. (2017) Xiao, H., Rasul, K., and Vollgraf, R.  Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms.  _arXiv preprint arXiv:1708.07747_ , 2017.
  * Yan et al. (2022) Yan, Y., Yang, G., Gao, Y., Zang, C., Chen, J., and Wang, Q.  Multi-participant vertical federated learning based time series prediction.  In _Proceedings of the 8th International Conference on Computing and Artificial Intelligence_ , ICCAI ’22, pp. 165–171, New York, NY, USA, 2022. Association for Computing Machinery.  ISBN 9781450396110.  doi: 10.1145/3532213.3532238.  URL https://doi.org/10.1145/3532213.3532238.
  * Yang et al. (2019a) Yang, K., Fan, T., Chen, T., Shi, Y., and Yang, Q.  A quasi-newton method based vertical federated learning framework for logistic regression.  _arXiv preprint arXiv:1912.00513_ , 2019a.
  * Yang et al. (2019b) Yang, Q., Liu, Y., Chen, T., and Tong, Y.  Federated machine learning: Concept and applications.  _ACM Transactions on Intelligent Systems and Technology (TIST)_ , 10(2):1–19, 2019b.
  * Yin et al. (2021) Yin, H., Mallya, A., Vahdat, A., Alvarez, J. M., Kautz, J., and Molchanov, P.  See through gradients: Image batch recovery via gradinversion.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 16337–16346, 2021.
  * Yu & Li (2021) Yu, R. and Li, P.  Toward resource-efficient federated learning in mobile edge computing.  _IEEE Network_ , 35(1):148–155, 2021.
  * Zhang & Zhu (2020) Zhang, Y. and Zhu, H.  Additively homomorphical encryption based deep neural network for asymmetrically collaborative machine learning.  _arXiv preprint arXiv:2007.06849_ , 2020.
  * Zhao et al. (2020) Zhao, B., Mopuri, K. R., and Bilen, H.  idlg: Improved deep leakage from gradients.  _arXiv preprint arXiv:2001.02610_ , 2020.
  * Zheng et al. (2022) Zheng, F., Chen, C., Yao, B., and Zheng, X.  Making split learning resilient to label leakage by potential energy loss.  _arXiv preprint arXiv:2210.09617_ , 2022.
  * Zhu et al. (2019) Zhu, L., Liu, Z., and Han, S.  Deep leakage from gradients.  _Advances in neural information processing systems_ , 32, 2019.

##  Appendix A Illustration of our protocol

Figure 6 illustrate on a high-level of our protocol.

Figure 6: A high-level view of our protocol.  Labels  in the forward pass
section are only required in training.

##  Appendix B Experiment Setup

Banking Datasets: The Bank dataset is related to the direct marketing
campaigns of a Portuguese banking institution. It contains $45,211$ rows and
$18$ columns ordered by date. We keep the housing, loan, contact, day, month,
campaign, pdays, previous, poutcome features in the _active party_. Features
default, balance are seen in Client $1$ and $2$, while age, job, marital,
education are kept in Client $3$ and $4$. In this case, Client $1$ and $2$ are
in the same group, while Client $3$ and $4$ are in the same group.

Adult Income Dataset: The Adult Income dataset is a classification dataset
aiming to predict whether the income exceeds 50K a year based on census data.
It contains $48,842$ and $14$ columns. We keep features workclass, occupation,
capital-gain, capital-loss, hours-per-week in the active party and race,
marital-status, relationship, age gender, native-country are kept by Client
$1$ and $2$, while education is held by Client $3$ and $4$. In this case,
Client $1$ and $2$ are in the same group, while Client $3$ and $4$ are in the
same group.

EMNIST: The EMNIST balanced dataset is an expansion of the original MNIST to
include handwritten characters, which contains $131,600$ images from 47
balanced classes. The size of images in the dataset is $28\times 28$. To
emulate VFL, each image is equally partitioned into 4 ”slices”, sized $7\times
28$, and held by 4 different parties, i.e., one active party and three passive
parties.

Fashion-MNIST: The Fashion-MNIST dataset, i.e., the Fashion MNIST dataset,
comprises $70,000$ grayscale images of clothing items and accessories. The
image size of this dataset is the same as that of EMNIST, and hence we adopt
the same approach to partitioning the dataset.

Drop-out partitions: To simulate the drop-out performance for different
numbers of partitions. We consider randomly partition features for different
numbers of partitions for each client. In this case, each group only contains
1 client.

Model Architecture. We consider different model architectures for each
dataset. Features and models are partitioned among different parties in
experimental settings. For the Banking dataset, the active party used
Linear(57, 64); Client $1$ and $2$ used unbiased Linear(3, 64); Client $3$ and
$4$ used unbiased Linear(20, 64). The three local modules combined are
equivalent to Linear(80, 64). The global module owned by the aggregator
comprised Linear(64, 1). For the Adult Income dataset, the active party,
Client $1$ and $2$, and Client $3$ and $4$ possessed Linear(27, 64), unbiased
Linear(63, 64), and unbiased Linear(16, 64) respectively. The three are
equivalent to Linear(106, 64). The global module had Linear(64, 1). We conduct
experiments with CNN/MLP models on EMNIST/FMNIST datasets. For CNN on EMNIST,
each passive party has Conv3x3 with 32 channels followed by Conv1x1 with 64
channels; each conv layer is followed by BatchNorm, ReLU, and MaxPool2x2; the
active party has Linear(600, 120) and Linear(120, 47). For MLP on EMNIST, each
passive party has Linear(196, 32) and Linear(32, 128); the active party has
Linear(128, 256), Linear(256, 128), Liner(128, 64), and Linear(64, 47). The
CNN and MLP used for FMNIST are the same as those for EMNIST; only the number
of classes differs. All models in the drop-out simulations are CNN/MLP models
for consistency.

Overhead profiling. To quantify the additional communication and computation
expenses associated with our method, we measured the total CPU time and the
total amount of upload/ download bytes, including their respective overheads,
compared to the unsecured split learning for VFL. In practice, parties should
create new key pairs routinely, which mitigates the risk of adversaries
potentially accessing all confidential information in the event of secret keys
used in some iterations being unexpectedly leaked. In experiments, the key
pairs and the shared secrets will be regenerated for every 5 iterations.

We used a learning rate of 0.01 and a batch size of 256. We applied ReLU
activation to all layers except the output layer.

##  Appendix C Proof for the Lemma

###### Proof.

One thing we would like to make clear is that everything related to the
cryptography is based on the positive integers. Therefore, before adding
masks, we need to perform quantization to the intermediate output or gradients
and then make them into the positive integers space, and everything is
operated in the space of the integers modulo R ($\mathbb{Z}_{R}$).

According to distributive law, we have:

$(a\mod R+b\mod R)\mod R=(a+b)\mod R$ (6)

The number R is chosen that both the sum of intermediate output or gradient
and the mask generated by the PRG is in the integer space $Z_{R}$.

We can prove by induction on the number of clients (N) in set $U$.

First, assume there are 2 clients in the system: client 1 and client 2. We let
the mask generated by the $\mathrm{PRG}(ss_{12})$ be $M$, which is uniformly
distributed in the integer space $Z_{R}$. For a given intermediate output
value $v_{1}$ and $v_{2}$ for client 1 and 2, the output after the mask is
($v_{1}+M$) and ($v_{2}-M$), so according to the distributive law, the results
($v_{1}+M$) and ($v_{2}-M$) are both uniformly distributed in $Z_{R}$.

Then, by induction and distributive law, with more clients in the system,
since we are adding more uniformly distributed masks into the equation, the
results are still uniformly distributed in $Z_{R}$. ∎

##  Appendix D Additional Results

Table 4 and 5 provides additional overhead results. Both tables show that our
method provides significantly less overhead both in terms of computation and
communication costs.

Table 4: Results of MLP on the CPU time (in seconds)

| Active Party CPU time (s) | Passive Party CPU time (s)
---|---|---
| Training phase | Testing phase | Training phase | Testing phase
Dataset | Total | Overhead | Total | Overhead | Total | Overhead | Total | Overhead
EMNIST(Ours) | 0.5551 | 0.3282 | 0.4786 | 0.3277 | 0.4000 | 0.1949 | 0.3423 | 0.1949
EMNIST(SEAL) | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$
EMNIST(PHE) | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$
FMNIST(Ours) | 0.5438 | 0.3304 | 0.4723 | 0.3301 | 0.3947 | 0.2003 | 0.3338 | 0.2003
FMNIST(SEAL) | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$ | $1.207\times 10^{3}$
FMNIST(PHE) | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$ | $1.757\times 10^{4}$

Table 5: Results of MLP on the communication both in size (MB).

| Active Party Data Transmission (MB) | Passive Party Data Transmission (MB)
---|---|---
| Training phase | Testing phase | Training phase | Testing phase
Dataset | Total | Overhead | Total | Overhead | Total | Overhead | Total | Overhead
EMNIST(Ours) | 1.63 | 0.21 | 1.01 | 0.21 | 1.38 | 0.05 | 0.75 | 0.05
EMNIST(SEAL) | 16.70 | 15.27 | 16.07 | 15.27 | 16.44 | 15.12 | 15.82 | 15.12
EMNIST(PHE) | 137.26 | 135.83 | 136.63 | 135.83 | 137.01 | 135.68 | 136.38 | 135.68
FMNIST(Ours) | 1.63 | 0.21 | 1.01 | 0.21 | 1.38 | 0.05 | 0.75 | 0.05
FMNIST(SEAL) | 16.70 | 15.27 | 16.07 | 15.27 | 16.44 | 15.12 | 15.82 | 15.12
FMNIST(PHE) | 137.26 | 135.83 | 136.63 | 135.83 | 137.01 | 135.68 | 136.38 | 135.68

##  Appendix E Addtional Drop-out results

Table 6: Results to show the performance in different drop-out setups on Bank
Marketing and Adult Income datasets. The experimental protocol can be found in
Section 5.1. We report the AUC at the round number 30 and 50, to demonstrate
the faster convergence rate when using our method.

Dataset | Partition | Setup | AUC(30) | AUC(50) | Partition | Setup | AUC(30) | AUC(50)
---|---|---|---|---|---|---|---|---
Bank | 5 | Discard(0.3,0.1) | 82.19$\%$ | 82.19$\%$ | 8 | Discard(0.3,0.1) | 74.54$\%$ | 79.15$\%$
Our(0.3,0.1) | 83.25$\%$ | 83.28$\%$ | Our(0.3,0.1) | 82.49$\%$ | 82.53$\%$
Discard(0.4,0.1) | 62.73$\%$ | 82.20$\%$ | Discard(0.4,0.1) | 73.27$\%$ | 81.56$\%$
Our(0.4,0.1) | 80.19$\%$ | 82.37$\%$ | Our(0.4,0.1) | 78.55$\%$ | 82.61$\%$
Income | 5 | Discard(0.3,0.1) | 79.88$\%$ | 81.38$\%$ | 8 | Discard(0.3,0.1) | 76.15$\%$ | 81.08$\%$
Our(0.3,0.1) | 82.63$\%$ | 83.28$\%$ | Our(0.3,0.1) | 79.95$\%$ | 82.32$\%$
Discard(0.4,0.1) | 74.41$\%$ | 78.63$\%$ | Discard(0.4,0.1) | 75.36$\%$ | 78.88$\%$
Our(0.4,0.1) | 80.18$\%$ | 82.45$\%$ | Our(0.4,0.1) | 80.18$\%$ | 82.45$\%$

Table 6 shows the performance in different drop-out setups on Bank marketing
and Adult income dataset. Since both datasets are binary classification task,
we report the AUC rather than the simple accuracy. The experimental protocol
can be found in Section 5.1. The table demonstrates that our method can endure
a high drop-out rate with minimal performance degradation while maintaining
the training speed. All experiments are repeated $5$ times, and the average is
reported.


#  Unique continuation for a mean field game system

1 Oleg Imanuvilov, 2 Hongyu Liu and 3 Masahiro Yamamoto

###### Abstract.

For a mean field game system, we prove the unique continuation which asserts
that if Cauchy data are zero on arbitrarily chosen lateral subboundary, then
the solution identically vanishes.

1 Department of Mathematics, Colorado State University, 101 Weber Building,
Fort Collins CO 80523-1874, USA e-mail<EMAIL_ADDRESS>
2 Department of Mathematics, City University of Hong Kong, Kowloon, Hong Kong
SAR, China email<EMAIL_ADDRESS>
3 Graduate School of Mathematical Sciences, The University of Tokyo, Komaba,
Meguro, Tokyo 153-8914, Japan e-mail<EMAIL_ADDRESS>
##  1\. Introduction and key Carleman estimate

Let $\Omega\subset\mathbb{R}^{n}$ be a bounded domain with smooth boundary
$\partial\Omega$, let $T>0$, and $Q:=\Omega\times(0,T)$. In this article, we
consider a system of the mean field game:

$None$ $\left\\{\begin{array}[]{rl}&\partial_{t}u(x,t)+a_{1}(x,t)\Delta
u(x,t)-\frac{1}{2}\kappa(x,t)|\nabla u(x,t)|^{2}-h(x,t)u=F,\\\
&\partial_{t}v(x,t)-\Delta(a_{2}(x,t)v)-\mbox{div}\thinspace(\kappa(x,t)v(x,t)\nabla
u(x,t))=G\quad\mbox{in $Q$}.\end{array}\right.$

Throughout this article, we assume

$None$ $a_{1},a_{2}\in C^{2}(\overline{Q}),\,>0\quad\mbox{on
$\overline{Q}$},\quad\kappa\in C^{1,0}(\overline{Q}),\quad h\in
L^{\infty}(Q).$

Here and henceforth we set $C^{2,2}(\overline{Q}):=\\{a\in
C(\overline{Q});\,\partial_{t}^{k}a,\partial_{i}\partial_{j}a,\partial_{i}a,a\in
C(\overline{Q})$ for $0\leq k\leq 2$
and $1\leq i,j\leq n\\}$, $C^{1,0}(\overline{Q}):=\\{a\in
C(\overline{Q});\,\partial_{j}a\in C(\overline{Q}),\quad 1\leq j\leq n\\}$ and
$H^{2,1}(Q):=\\{w\in
L^{2}(Q);\,w,\partial_{t}w,\partial_{i}w,\partial_{i}\partial_{j}w\in
L^{2}(Q)\,\,\mbox{for $1\leq i,j\leq n$}\\}$.

In (1.1), $x$ and $t$ are the state and the time variables, and $u$ and $v$
denote the value of the game and the population density of players
respectively (e.g., Achdou, Cardaliaguet, Delarue, Porretta and Santambrogio
[1], Lasry and Lions [10]).

The main purpose of this article is establish the unique continuation for
(1.1):
Theorem 1. Let $\gamma\subset\partial\Omega$ be arbitrarily chosen non-empty
relatively open subboundary. We assume that
$(u,v),(\widetilde{u},\widetilde{v})\in H^{2,1}(Q)\times H^{2,1}(Q)$ satisfy
(1.1) and

$None$ $\left\\{\begin{array}[]{rl}&u,\nabla u,\Delta
u,\widetilde{u},\nabla\widetilde{u},\Delta\widetilde{u}\in L^{\infty}(Q),\\\
&v,\nabla v,\widetilde{v},\nabla\widetilde{v}\in
L^{\infty}(Q),\quad\partial_{t}(u-\widetilde{u}),\partial_{t}(v-\widetilde{v})\in
L^{2}((\partial\Omega\setminus\Gamma)\times(0,T)).\end{array}\right.$

Then $u=\widetilde{u}$, $\nabla u=\nabla\widetilde{u}$, $v=\widetilde{v}$ and
$\nabla v=\nabla\widetilde{v}$ on $\Gamma\times(0,T)$ implies
$u=\widetilde{u}$ and $v=\widetilde{v}$ in $Q$.

The unique continuation for a single parabolic equation is well-known and as
early works we can refer to Mizohata [15], Saut and Scheurer [16] among many
other works.

The mean field game system is a mixed type of backward and forward parabolic
equations for $u$ and $v$ respectively, and so the initial boundary value
problem requires special cares. However, it is straightforward to establish a
Carleman estimate which is applicable to the unique continuation and other
problems such as inverse problems.

It is known that a relevant Carleman estimate can derive the conditional
stability in determining $u$ and $v$ by Cauchy data on $\Gamma\times(0,T)$.
For example we can refer to Klibanov and Timonov [9] under geometric
constraints on $\Gamma$. We can establish the conditional stability from
arbitrary subboundary by the same way as Huang, Imanuvilov and Yamamoto [3],
but here we omit the details.

Our key Carleman estimate is stated as Theorem 2 in Section 2, and is derived
directly thanks to that the second-order coupling terms of $u$ appear in the
equation in $v$ as $\Delta u$. For general cases, such coupling should be a
linear combination of $\partial_{i}\partial_{j}u$, $1\leq i,j\leq n$. The
derivation of a relevant Carleman estimate is more complicated and in a
forthcoming work we will pursue.

As for inverse problems, we refer to Klibanov [5], Klibanov and Averboukh [6],
Klibanov, Li and Liu [7], [8], Liu, Mou and Zhang [11], Liu and Yamamoto [12],
Liu and Zhang [13], [14]

This article is composed of three sections. In Section 2, we prove a key
Carleman estimate for (1.1) and Section 3 is devoted to the completion of the
proof of Theorem 1.

##  2\. Key Carleman estimate

For subboundary $\Gamma\subset\partial\Omega$, we see that there exists $d\in
C^{2}(\overline{\Omega})$ such that

$None$ $d>0\quad\mbox{in $\Omega$},\quad|\nabla d|>0\quad\mbox{on
$\overline{\Omega}$},\quad d=0\quad\mbox{on
$\partial\Omega\setminus\Gamma$},\quad\nabla d\cdot\nu\leq 0\quad\mbox{on
$\partial\Omega\setminus\Gamma$}$

(e.g, Imanuvilov [4]). Here $\nu$ denotes the unit outward normal vector to
$\partial\Omega$.

For arbitrarily fixed $t_{0}\in(0,T)$ and $\delta>0$ such that
$0<t_{0}-\delta\leq t_{0}+\delta<T$, we set

$I=(t_{0}-\delta,t_{0}+\delta),\quad Q_{I}=\Omega\times I.$

We set

$P_{k}v(x,t):=\partial_{t}v+(-1)^{k}a(x,t)\Delta v+R(x,t,v),\quad k=1,2,$

where $a\in C^{2}(\overline{Q_{I}})$, $>0$ on $\overline{Q_{I}}$, and

$None$ $|R(x,t,v)|\leq C_{0}(|v(x,t)|+|\nabla v(x,t)|),\quad(x,t)\in Q_{I}.$

Moreover, let

$\varphi(x,t)=e^{\lambda(d(x)-\beta(t-t_{0})^{2})},$

where $\lambda>0$ is a sufficiently large parameter and $\beta>0$ is
arbitrarily given. Henceforth $C>0$ denote generic constants which independent
of $s>0$, but depends on $\lambda,\beta,C_{0}$ in (2.2). Then
Lemma 1. There exist constants $s_{0}>0$ and $C>0$ such that

$None$ $\int_{Q_{I}}\left(\frac{1}{s}(|\partial_{t}v|^{2}+|\Delta
v|^{2})+s|\nabla v|^{2}+s^{3}|v|^{2}\right)e^{2s\varphi}dxdt\leq
Cs^{4}\int_{Q_{I}}|P_{k}v|^{2}e^{2s\varphi}dxdt+C\mathcal{B}(v),\quad k=1,2$

for all $s>s_{0}$ and $v\in H^{2,1}(Q_{I})$ satisfying $v\in
H^{1}(\partial\Omega\times I)$. Here and henceforth we set

$\displaystyle\mathcal{B}(v):=e^{Cs}\|v\|^{2}_{H^{1}(\Gamma\times
I)}+s^{3}\int_{(\partial\Omega\setminus\Gamma)\times
I}(|v|^{2}+|\nabla_{x,t}v|^{2})e^{2s}dSdt$ $\displaystyle+$ $\displaystyle
s^{2}\int_{\Omega}(|v(x,t_{0}-\delta)|^{2}+|\nabla
v(x,t_{0}-\delta)|^{2}+|v(x,t_{0}+\delta)|^{2}+|\nabla
v(x,t_{0}+\delta)|^{2})e^{2s\varphi(x,t_{0}-\delta)}dx.$

The proof of the lemma with $k=1$ is done similarly to Lemma 7.1 (p.186) in
Bellassoued and Yamamoto [2] or Theorem 3.2 in Yamamoto [17] by keeping all
the boundary integral terms $v|_{\partial Q}$ which are produced by
integration by parts and using $d|_{\partial\Omega\setminus\Gamma}=0$ in
(2.1). The proof for $k=2$ follows directly from the case $k=1$ by setting
$V(x,t):=v(x,2t_{0}-t)$ and using $\varphi(x,t)=\varphi(x,2t_{0}-t)$ for
$(x,t)\in Q_{I}$.

We emphasize that the backward parabolic Carleman estimate is the same as the
forward parabolic Carleman estimate thanks to the symmetry of the weight
$\varphi(x,t)$ with respect to $t$ centered at $t_{0}$.

Using the Carleman estimate (2.3) we prove a Carleman estimate for a mean
field game system. Setting $y:=u-\widetilde{u}$ and $z:=v-\widetilde{v}$ and
subtracting the system (1.1) with
$(\widetilde{u},\widetilde{v},\widetilde{F},\widetilde{G})$ from (1.1) with
$(u,v,F,G)$, we reach

$None$ $\left\\{\begin{array}[]{rl}&\partial_{t}y+a_{1}(x,t)\Delta
y+R_{1}(x,t,y)=h(x,t)z+F-\widetilde{F},\\\ &\partial_{t}z-a_{2}(x,t)\Delta
z+R_{2}(x,t,z)=\kappa v\Delta y+R_{3}(x,t,y)+G-\widetilde{G}\quad\mbox{in
$Q_{I}$}.\end{array}\right.$

Here by (1.2) and (1.3), we can verify

$None$ $|R_{j}(x,t,y)|\leq C_{0}\sum^{1}_{k=0}|\nabla^{k}y(x,t)|,\quad
j=1,3,\quad|R_{2}(x,t,z)|\leq
C_{0}\sum^{1}_{k=0}|\nabla^{k}z(x,t)|,\quad(x,t)\in Q_{I}.$

We apply Carleman estimate (2.3) to the first equation in (2.4), and multiply
the resulting equality by $s$: $y$ and obtain

$\int_{Q_{I}}(|\partial_{t}y|^{2}+|\Delta y|^{2}+s^{2}|\nabla
y|^{2}+s^{4}|y|^{2})e^{2s\varphi}dxdt$ $None$ $\leq
C\int_{Q_{I}}s|hz|^{2}e^{2s\varphi}dxdt+C\int_{Q_{I}}s|F-\widetilde{F}|^{2}e^{2s\varphi}dxdt+Cs\mathcal{B}(y)$

for all $s>s_{0}$. In terms of (2.5), application of (2.3) with $k=1$ to $z$
yields

$\int_{Q_{I}}\left(\frac{1}{s}(|\partial_{t}z|^{2}+|\Delta z|^{2})+s|\nabla
z|^{2}+s^{3}|z|^{2}\right)e^{2s\varphi}dxdt$ $None$ $\leq
C\int_{Q_{I}}(|\kappa\Delta y|^{2}+|y|^{2}+|\nabla
y|^{2})e^{2s\varphi}dxdt+C\int_{Q_{I}}|G-\widetilde{G}|^{2}e^{2s\varphi}dxdt+C\mathcal{B}(z)$

for all $s>s_{0}$.

Using $\kappa\in L^{\infty}(Q_{I})$ and substituting (2.6) into the terms
including $\Delta y,\nabla y,y$ on the right-hand side of (2.7), we have

$\displaystyle\int_{Q_{I}}\left(\frac{1}{s}(|\partial_{t}z|^{2}+|\Delta
z|^{2})+s|\nabla z|^{2}+s^{3}|z|^{2}\right)e^{2s\varphi}dxdt$
$\displaystyle\leq$ $\displaystyle
C\int_{Q_{I}}s|z|^{2}e^{2s\varphi}dxdt+C\int_{Q_{I}}(s|F-\widetilde{F}|^{2}+|G-\widetilde{G}|^{2})e^{2s\varphi}dxdt+Cs(\mathcal{B}(y)+\mathcal{B}(z))$

for all large $s>0$. Absorbing the first term on the right-hand side into the
left-hand side by choosing $s>0$ sufficiently large, we see

$\int_{Q_{I}}\left(\frac{1}{s}(|\partial_{t}z|^{2}+|\Delta z|^{2})+s|\nabla
z|^{2}+s^{3}|z|^{2}\right)e^{2s\varphi}dxdt$ $None$ $\leq
C\int_{Q_{I}}(s|F-\widetilde{F}|^{2}+|G-\widetilde{G}|^{2})e^{2s\varphi}dxdt+Cs(\mathcal{B}(y)+\mathcal{B}(z))$

for all $s>s_{0}$. Adding (2.8) and (2.6) and choosing $s>0$ large again to
absorb the term $\int_{Q_{I}}s|hz|^{2}e^{2s\varphi}dxdt$ on the right-hand
side into the left-hand side, we obtain
Theorem 2 (Carleman estimate for a mean field game). There exist constants
$s_{0}>0$ and $C>0$ such that

$\displaystyle\int_{Q_{I}}\biggl{(}|\partial_{t}(u-\widetilde{u})|^{2}+|(\Delta(u-\widetilde{u})|^{2}+s^{2}|\nabla(u-\widetilde{u})|^{2}+s^{4}|u-\widetilde{u}|^{2}+\frac{1}{s}(|\partial_{t}(v-\widetilde{v})|^{2}+|\Delta(v-\widetilde{v})|^{2})$
$\displaystyle+$ $\displaystyle
s|\nabla(v-\widetilde{v})|^{2}+s^{3}|v-\widetilde{v}|^{2}\biggr{)}e^{2s\varphi}dxdt\leq
C\int_{Q_{I}}(s|F-\widetilde{F}|^{2}+|G-\widetilde{G}|^{2})e^{2s\varphi}dxdt$
$\displaystyle+$ $\displaystyle
Cs(\mathcal{B}(u-\widetilde{u})+\mathcal{B}(v-\widetilde{v}))\quad\mbox{for
all $s>s_{0}$}.$

##  3\. Proof of Theorem 1

We arbitrarily choose $t_{0}\in(0,T)$ and $\delta>0$ such that
$0<t_{0}-\delta<t_{0}+\delta<T$. We define

$None$ $d_{0}:=\min_{x\in\overline{\Omega}}d(x),\quad
d_{1}:=\max_{x\in\overline{\Omega}}d(x),\quad
0<r<\left(\frac{d_{0}}{d_{1}}\right)^{\frac{1}{2}}<1.$

We note that $0<r<1$.

We now show
Lemma 2. Under regularity condition (1.3), if $u=\widetilde{u}$,
$v=\widetilde{v}$, $\nabla u=\nabla\widetilde{u}$ and $\nabla
v=\nabla\widetilde{v}$ on $\Gamma\times(t_{0}-\delta,\,t_{0}+\delta)$ imply
$u=\widetilde{u}$ and $v=\widetilde{v}$ in
$\Omega\times(t_{0}-r\delta,\,t_{0}+r\delta)$.

For the proof of Theorem 1, it suffices to prove Lemma 2. Indeed, since
$t_{0}\in(0,T)$ and $\delta>0$ can be arbitrarily chosen and the Carleman
estimate is invariant with respect to $t_{0}$ provided that
$0<t_{0}-\delta<t_{0}+\delta<T$, we can apply Lemma 2 by changing $t_{0}$ over
$(\delta,T-\delta)$ to obtain $u=\widetilde{u}$ and $v=\widetilde{v}$ in
$\Omega\times((1-r)\delta,\,T-(1-r)\delta)$. Since $\delta>0$ can be
arbitrary, this means that $u=\widetilde{u}$ and $v=\widetilde{v}$ in
$\Omega\times(0,T)$.
Proof of Lemma 2. Once we derived the relevant Carleman estimate in Theorem 2,
the proof of Lemma 2 is done similarly to Proposition 2 in [3] as follows.
First we determine the constant $\beta>0$ in the weight of the Carleman
estimate such that

$None$
$\frac{d_{1}-d_{0}}{\delta^{2}-r^{2}\delta^{2}}<\beta<\frac{d_{0}}{r^{2}\delta^{2}}.$

Here we note that (3.1) verifies
$0<\frac{d_{1}-d_{0}}{\delta^{2}-r^{2}\delta^{2}}<\frac{d_{0}}{r^{2}\delta^{2}}$,
which allows us to choose $\beta$ satisfying (3.2).

For short descriptions, we set

$\displaystyle
M_{1}:=\sum_{k=0}^{1}(\|\nabla^{k}_{x,t}(u-\widetilde{u})\|^{2}_{L^{2}((\partial\Omega\setminus\Gamma)\times
I)}+\|\nabla^{k}_{x,t}(v-\widetilde{v})\|^{2}_{L^{2}((\partial\Omega\setminus\Gamma)\times
I)}),$ $\displaystyle
M_{2}:=\sum_{k=0}^{1}(\|(u-\widetilde{u})(\cdot,t_{0}+(-1)^{k}\delta)\|^{2}_{H^{1}(\Omega)}+\|(v-\widetilde{v})(\cdot,t_{0}+(-1)^{k}\delta)\|^{2}_{H^{1}(\Omega)}$

and $\mu_{1}:=e^{\lambda(d_{1}-\beta\delta^{2})}$. Since $u=\widetilde{u}$ and
$v=\widetilde{v}$ on $\Gamma\times I$, Theorem 2 yields

$s^{3}\int_{Q_{I}}(|u-\widetilde{u}|^{2}+|v-\widetilde{v}|^{2})e^{2s\varphi}dxdt\leq
Cs^{5}M_{1}e^{2s}+Cs^{5}M_{2}e^{2s\mu_{1}}$

for all large $s>0$. We shrink the integration region of the left-hand side to
$\Omega\times(t_{0}-r\delta,\,t_{0}+r\delta)$. Then, since
$\varphi(x,t)=e^{\lambda(d(x)-\beta(t-t_{0})^{2})}\geq e^{\lambda(d_{0}-\beta
r^{2}\delta^{2})}=:\mu_{2}$ in $\Omega\times(t_{0}-r\delta,\,t_{0}+r\delta)$,
we obtain

$e^{2s\mu_{2}}\int_{\Omega\times(t_{0}-r\delta,\,t_{0}+r\delta)}(|u-\widetilde{u}|^{2}+|v-\widetilde{v}|^{2})dxdt\leq
Cs^{2}M_{1}e^{2s}+Cs^{2}M_{2}e^{2s\mu_{1}},$

that is,

$None$
$\|u-\widetilde{u}\|^{2}_{L^{2}(\Omega\times(t_{0}-r\delta,\,t_{0}+r\delta))}+\|v-\widetilde{v}\|^{2}_{L^{2}(\Omega\times(t_{0}-r\delta,\,t_{0}+r\delta))}\leq
Cs^{2}M_{1}e^{-2s(\mu_{2}-1)}+Cs^{2}M_{2}e^{-2s(\mu_{2}-\mu_{1})}$

for all large $s>0$. Here, by (3.2), we see that
$\mu_{2}>\max\\{1,\,\mu_{1}\\}$, and so we let $s\to\infty$ in (3.3), so that
$u=\widetilde{u}$ and $v=\widetilde{v}$ in
$\Omega\times(t_{0}-r\delta,\,t_{0}+r\delta)$. Thus the proof of Lemma 2, and
so Theorem 1 are complete. $\blacksquare$

Acknowledgments. The work was supported by Grant-in-Aid for Scientific
Research (A) 20H00117 of Japan Society for the Promotion of Science.

## References

  * [1] Y. Achdou, P. Cardaliaguet, F. Delarue, A. Porretta and F. Santambrogio, Mean field games, Cetraro, Italy 2019, Lecture Notes in Mathematics, C.I.M.E. Foundation Subseries, Volume 2281, Springer, 2019.
  * [2] M. Bellassoued and M. Yamamoto, Carleman Estimates and Applications to Inverse Problems for Hyperbolic Systems, Springer-Japan, Tokyo, 2017.
  * [3] X. Huang, O.Y. Imanuvilov and M. Yamamoto, Stability for inverse source problems by Carleman estimates,  Inverse Problems 36 (2020) 125006
  * [4] O.Y. Imanuvilov, Controllability of parabolic equations, Sbornik Math. 186 (1995) 879-900.
  * [5] M. V. Klibanov, The mean field games system: Carleman estimates, Lipschitz stability and uniqueness, published online in J. Inverse and Ill-posed Problems, 2023 arXiv:2303.03928
  * [6] M. V. Klibanov and Y. Averboukh, Lipschitz stability estimate and uniqueness in the retrospective analysis for the mean field games system via two Carleman estimates, preprint arXiv:2302.10709
  * [7] M. V. Klibanov, J. Li and H. Liu, Hölder stability and uniqueness for the mean field games system via Carleman estimates, preprint, arXiv:2304.00646
  * [8] M. V. Klibanov, J. Li and H. Liu, On the mean field games system with the lateral Cauchy data via Carleman estimates, preprint, arXiv:2303.07556
  * [9] M. V. Klibanov and A.A. Timonov, Carleman Estimates for Coefficient Inverse Problems and Numerical Applications, VSP, Utrecht, 2004.
  * [10] J.-M. Lasry and P.-L. Lions, Mean field games, Japanese Journal of Mathematics, 2 (2007) 229-260.
  * [11] H. Liu, C. Mou and S. Zhang, Inverse problems for mean field games,  preprint, arXiv:2205.11350
  * [12] H. Liu and M. Yamamoto, Stability in determination of states for the mean field game equations, preprint, arXiv:2304.05896
  * [13] H. Liu and S. Zhang, On an inverse boundary problem for mean field games, preprint, arXiv:2212.09110
  * [14] H. Liu and S. Zhang, Simultaneously recovering running cost and Hamiltonian in mean field games system, preprint, arXiv:2303.13096
  * [15] S. Mizohata, Unicité du prolongement des solutions pour quelques opérateurs différentiels paraboliques, Mem. College Sci. Univ. Kyoto A31 (1958) 219-239.
  * [16] J.-C. Saut and B. Scheurer, Unique continuation for some evolution equations, J. Diff. Eqns 66 (1987) 118-139.
  * [17] M. Yamamoto, Carleman estimates for parabolic equations and applications,  Inverse Problems 25 (2009) 123013