Homomorphic Encryption for VFL

Computational homomorphism is the defining property of an encryption scheme that allows specific algebraic operations (e.g., addition, multiplication) to be performed directly on ciphertexts. The result, when decrypted, matches the outcome of performing the same operations on the original plaintexts. In VFL, this enables the label owner to perform critical calculations—like aggregating encrypted intermediate outputs from feature owners or computing loss gradients—without ever decrypting sensitive data. Schemes are categorized by their supported operations:

• Partially Homomorphic Encryption (PHE): Supports only one operation (e.g., addition or multiplication) indefinitely.
• Somewhat Homomorphic Encryption (SHE): Supports both addition and multiplication but for a limited number of operations (limited "circuit depth").
• Fully Homomorphic Encryption (FHE): Supports both operations an unlimited number of times, enabling arbitrary computations.

Ciphertext expansion refers to the significant increase in data size when plaintext is encrypted using HE schemes. A single floating-point number (plaintext) can become a ciphertext composed of thousands or millions of bits. This directly translates to vertical communication overhead, a major bottleneck in VFL. Transmitting encrypted intermediate outputs and gradients between parties consumes substantially more bandwidth compared to using plaintext or lightweight secure aggregation. The overhead is influenced by:

• Encryption parameters (e.g., polynomial degree, modulus size) which trade off security for size.
• The HE scheme used (FHE typically has larger expansion than PHE).
• Batching techniques, which pack multiple plaintext values into a single ciphertext to amortize costs, are essential for practical VFL.

Homomorphic operations are orders of magnitude slower than their plaintext equivalents. This creates vertical computation overhead for all parties in the VFL pipeline. The label owner, which performs homomorphic operations on aggregated ciphertexts, bears the heaviest load. Key computational costs include:

• Encryption/Decryption: Converting data to/from ciphertext.
• Homomorphic Evaluation: Performing addition or multiplication on ciphertexts, which involves complex polynomial arithmetic.
• Noise Management: In FHE, each multiplication increases "noise" in the ciphertext; bootstrapping—a computationally intensive procedure—is periodically required to reset the noise, allowing further computations. This latency impacts training round time and overall system feasibility, often requiring specialized hardware acceleration.

HE provides strong, cryptographically proven security under specific threat models, typically formalized as semantic security. This means ciphertexts reveal no information about the plaintext, even to a computationally unbounded adversary, except its length. For VFL, this directly protects the feature owners' raw data and the label owner's model gradients. The security level is parameterized by a security parameter (e.g., 128-bit security). It's crucial to distinguish HE's guarantees:

• Data Confidentiality: HE protects data at rest (as ciphertext) and in process (during computation).
• Complementary to Other Techniques: HE does not inherently provide differential privacy (which limits inference from the model output) or protect against all protocol-level leaks (e.g., from the magnitude of updates). It is often combined with these techniques for a layered defense.

HE schemes operate over different algebraic structures, determining the type of computations they can natively support. This dictates how VFL algorithms must be designed and implemented.

• Arithmetic Circuit Schemes (e.g., BFV, CKKS): Operate natively on integers or fixed-point/approximate numbers. They efficiently support addition and multiplication, making them suitable for the linear algebra operations (matrix multiplications, additions) that dominate neural network training in VFL. CKKS is particularly popular for VFL as it supports approximate arithmetic on real numbers.
• Boolean Circuit Schemes (e.g., BGV, TFHE): Operate on binary bits. They can perform logical gates (AND, XOR, NOT) homomorphically. While they can emulate arithmetic, it is less efficient. They are more suited for non-linear comparison operations (e.g., secure evaluation of a ReLU activation function) which may be required in certain VFL architectures.

In VFL, HE is not applied to the entire training process but is strategically integrated into the split neural network architecture. The primary use case is securing the transmission across the cut layer. Common integration patterns include:

• Encrypting Intermediate Outputs: The feature owner encrypts its local intermediate output before sending it to the label owner. The label owner then performs homomorphic operations (e.g., multiplying by its model weights) on this ciphertext.
• Encrypting Gradients: During vertical backpropagation, the label owner may encrypt gradient messages sent back to feature owners for local model updates.
• Hybrid Cryptographic Protocols: HE is often used in conjunction with Multi-Party Computation (MPC) or Secure Aggregation protocols. For example, HE can be used for the heavy computation of a global sum, while lighter-weight MPC handles secure comparisons or non-linearities, optimizing the overall system performance.

Functional Encryption (FE) is an advanced cryptographic scheme where decrypting a ciphertext yields the result of a specific function on the underlying plaintext, rather than the plaintext itself.

• Core Mechanism: A secret key is tied to a specific function f. Decryption with this key reveals only f(data), not the original data.
• VFL Application: Potentially allows a feature owner to send encrypted data to the label owner, who can then compute a specific gradient function on it using a functional key, learning only the gradient result.
• Advantage over HE: Can provide more granular control over what information is revealed by the computation.

Gradient Encryption is the specific application of cryptographic techniques (often HE or MPC) to protect the model gradients exchanged during VFL training.

• Purpose: Prevents the label owner from inferring raw feature values from the gradients sent by feature owners.
• Common Scheme: Feature owners encrypt their local gradient contributions using an additive HE scheme (like Paillier). The label owner aggregates these encrypted gradients, and the resulting ciphertext is decrypted (often via threshold decryption) to obtain the global gradient update.
• Critical for VFL: A primary defense against model inversion and membership inference attacks in the vertical setting.