Research map / Federated learning and privacy / Personalized and heterogeneous FL
VFLAIR: A Research Library and Benchmark for Vertical Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Presents VFLAIR, a lightweight extensible vertical federated learning library with standardized attack/defense modules, and benchmarks 11 attacks and 8 defenses using a new Defense Capability Score (DCS) metric.
Problem
Existing VFL projects are industry-oriented and heavy-weight, and there is no unified framework or metric to comprehensively evaluate VFL main-task performance, communication efficiency, and robustness to attacks and defenses.
Approach
A modular VFL library supporting aggVFL/splitVFL, multiple communication protocols and tree/NN local models, plus a Defense Capability Score (DCS) that combines attack performance and main-task performance into one distance-based metric (with T-DCS and C-DCS aggregates) to rank defenses.
Key results
- MID, L-DP and G-DP are reported as effective across a wide range of attacks, with above-average T-DCS and C-DCS.
- FedBCD and CELU-VFL reach comparable main-task performance to FedSGD with fewer communication rounds (e.g., MNIST 150 to 113 and 105 rounds).
- Paillier encryption increases execution time by roughly 3 to 20 times while leaving main-task performance unchanged for tree-based VFL.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FedBCD (Q=5) instead of FedSGD | aggVFL · MNIST and NUSWIDE | communication rounds: 150 / 113; 60 / 26 | Helped |
| Use FedBCD (Q=5) instead of FedSGD | aggVFL · MNIST and NUSWIDE | MP: 0.972$\pm$0.001 -> 0.971$\pm$0.001; 0.887$\pm$0.001 -> 0.882$\pm$0.001 | No clear effect |
| Use Quantize (b=16) instead of FedSGD | aggVFL · MNIST and NUSWIDE | Amount (MB) per round: 0.156 -> 0.117; 0.039 -> 0.029 | Helped |
| Use Quantize (b=16) instead of FedSGD | aggVFL · MNIST and NUSWIDE | MP: 0.972$\pm$0.001 -> 0.959$\pm$0.006; 0.887$\pm$0.001 -> 0.881$\pm$0.002 | Hurt |
| Use Top-k compression (r=0.9) instead of FedSGD | aggVFL · MNIST and NUSWIDE | MP: 0.972$\pm$0.001 -> 0.968$\pm$0.001; 0.887$\pm$0.001 -> 0.887$\pm$0.001 | No clear effect |
| Use splitVFL instead of aggVFL | NN-based VFL with FedSGD · MNIST, NUSWIDE, Breast Cancer, Diabetes, Adult Income | MP: 0.972$\pm$0.001 -> 0.973$\pm$0.001; 0.887$\pm$0.001 -> 0.888$\pm$0.001; 0.914$\pm$0.033 -> 0.925$\pm$0.028; 0.755$\pm$0. | Mixed |
| Increase participants from 2 to 4 | aggVFL with FedSGD · CIFAR10 and CIFAR100 | MP: 0.790$\pm$0.003 -> 0.747$\pm$0.003; 0.454$\pm$0.006 -> 0.417$\pm$0.008 | Hurt |
| Add Paillier Encryption | tree-based VFL · Credit and Nursery | MP: 0.816$\pm$0.005 -> 0.816$\pm$0.005; 0.884$\pm$0.010 -> 0.884$\pm$0.010 | No clear effect |
| Add Paillier Encryption | tree-based VFL · Credit and Nursery | execution time: 138$\pm$4 -> 410$\pm$10; 29$\pm$2 -> 243$\pm$5 | Hurt |
| Increase noise level, sparsification rate, or regularization/confusion strength | DP-G, DP-L, GS, dCor, CAE, DCAE, and MID · MNIST, CIFAR10, and NUSWIDE attack-defense evaluations | MP | Hurt |
| Increase noise level, sparsification rate, or regularization/confusion strength | DP-G, DP-L, GS, dCor, CAE, DCAE, and MID · MNIST, CIFAR10, and NUSWIDE attack-defense evaluations | attack performance | Helped |
| Use MID instead of most other defenses | VFL defense · MNIST, CIFAR10, and NUSWIDE | attack performance while maintaining MP | Helped |
Surprising findings
- FR attacks are harder to defend than other attack types, with T-DCS_FR much lower than other types.
- splitVFL is reported as less vulnerable to attacks than aggVFL, and FedBCD less vulnerable than FedSGD.
Limitations
- Limited implementations of cryptographic techniques; only Paillier encryption supported.
- Defenses are not forced onto attacks outside their design scope, so coverage is incomplete across attack-defense pairs.
Experimental setup
Datasets: MNIST CIFAR10 CIFAR100 NUSWIDE Breast Cancer Diabetes Adult Income Criteo Avazu Cora News20 Credit
Benchmarks: MNIST CIFAR10 CIFAR100 NUSWIDE Breast Cancer Diabetes Adult Income Criteo Avazu Cora News20 Credit
Metrics: main task performance (accuracy) attack performance defense capability score communication rounds execution time
Baselines: FATE FedBCD CELU-VFL Quantize Top-k
Builds on: FedBCD SecureBoost CELU-VFL Paillier encryption
Closest papers by meaning
- PubSub-VFL: Towards Efficient Two-Party Split Learning in Heterogeneous Environments via Publisher/Subscriber Architecture (NeurIPS 2025 · similarity 0.88)
- Integer Is Enough: When Vertical Federated Learning Meets Rounding (AAAI 2024 · similarity 0.88)
- Label-Free Backdoor Attacks in Vertical Federated Learning (AAAI 2025 · similarity 0.88)
- MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.87)
- Federated Behavioural Planes: Explaining the Evolution of Client Behaviour in Federated Learning (NeurIPS 2024 · similarity 0.86)
- Constructing Adversarial Examples for Vertical Federated Learning: Optimal Client Corruption through Multi-Armed Bandit (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.