Research map / Federated learning and privacy / Personalized and heterogeneous FL
Integer Is Enough: When Vertical Federated Learning Meets Rounding
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a rounding layer that converts intermediate results in vertical federated learning to integers (with straight-through gradient estimation), reporting reduced computation/memory, privacy, attribution consistency and adversarial robustness gains on MNIST, Fashion-MNIST and CIFAR10.
Problem
Vertical federated learning suffers from computational and communication overhead from floating-point intermediate results under homomorphic encryption, privacy leakage of intermediate results, and adversarial vulnerability.
Approach
Insert a rounding layer (ceil(x-0.5)) at the client bottom-model outputs so intermediate results are integers usable directly with Paillier HE, with a straight-through estimator for backpropagation; the paper argues this also gives DP-like privacy and enlarges certified robust radius.
Key results
- On CIFAR10 with dimensional size 16, Round achieves 75.67% accuracy vs 75.34% Base and 70.07% Binary.
- Mean certified robust radius on CIFAR10 rises to 3.01 for Round vs 1.92 for Base and 1.12 for Binary.
- Feature attribution consistency on CIFAR10 (Integrated Gradients): Round absolute error 0.17 and Kendall's tau 0.47 vs Binary error 0.34 and tau -0.13.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Round intermediate results to integers instead of leaving them unchanged | VFL with ResNet bottom model and MLP top model · MNIST test, d=16 | accuracy: 98.77 -> 98.66 | No clear effect |
| Round intermediate results to integers instead of leaving them unchanged | VFL with ResNet bottom model and MLP top model · Fashion-MNIST test, d=16 | accuracy: 90.87 -> 90.91 | No clear effect |
| Round intermediate results to integers instead of leaving them unchanged | VFL with ResNet bottom model and MLP top model · CIFAR10 test, d=16 | accuracy: 75.34 -> 75.67 | No clear effect |
| Binarize intermediate results instead of rounding them to integers | VFL with ResNet bottom model and MLP top model · CIFAR10 test, d=16 | accuracy: 75.34 -> 70.07 | Hurt |
| Round intermediate results to integers instead of leaving them unchanged | VFL with ResNet bottom model and MLP top model · MNIST, certified robustness radius | mean radius: 2.20 -> 2.96 | Helped |
| Round intermediate results to integers instead of leaving them unchanged | VFL with ResNet bottom model and MLP top model · Fashion-MNIST, certified robustness radius | mean radius: 4.11 -> 4.28 | Helped |
| Round intermediate results to integers instead of leaving them unchanged | VFL with ResNet bottom model and MLP top model · CIFAR10, certified robustness radius | mean radius: 1.92 -> 3.01 | Helped |
| Round intermediate results to integers instead of leaving them unchanged | VFL under PGD attack (ω=1, s=1.0) · MNIST | attack success rate: 74% -> 43% | Helped |
| Round intermediate results to integers instead of leaving them unchanged | VFL under PGD attack (ω=1, s=1.0) · Fashion-MNIST | attack success rate: 15% -> 10% | Helped |
| Round intermediate results to integers instead of leaving them unchanged | VFL under PGD attack (ω=1, s=1.0) · CIFAR10 | attack success rate: 66% -> 25% | Helped |
| Binarize intermediate results instead of rounding them to integers | VFL under PGD attack (ω=1, s=1.0) · CIFAR10 | attack success rate: 66% -> 85% | Hurt |
| Round intermediate results to integers instead of binarizing them | VFL feature attribution using Integrated Gradients · CIFAR10 | Euclidean distance: 0.3394 -> 0.1702 | Helped |
Surprising findings
- Rounding sometimes outperforms the unmodified base architecture in accuracy, which the authors attribute to FP redundancy causing confusion in classification.
- Binarization becomes weaker than the base architecture at mitigating adversarial attacks when perturbations exceed the restriction.
Limitations
- Efficiency gains are argued theoretically; no measured runtime or communication results are reported.
- Experiments are limited to two-party VFL on three image datasets with ResNet bottom models.
- Privacy analysis relies on an argument about Laplace noise tolerance rather than a full formal DP guarantee; the authors note backward gradients remain a leakage risk.
Experimental setup
Datasets: MNIST Fashion-MNIST CIFAR10
Benchmarks: MNIST Fashion-MNIST CIFAR10
Metrics: accuracy Euclidean distance correlation distance Kendall's tau attack success rate certified robust radius
Baselines: Base (unmodified VFL) Binary (binarized intermediate results) B-SL HashVFL
Builds on: Paillier homomorphic encryption Straight-Through Estimator PGD randomized smoothing B-SL HashVFL
Closest papers by meaning
- VFLAIR: A Research Library and Benchmark for Vertical Federated Learning (ICLR 2024 · similarity 0.88)
- PubSub-VFL: Towards Efficient Two-Party Split Learning in Heterogeneous Environments via Publisher/Subscriber Architecture (NeurIPS 2025 · similarity 0.87)
- Federated Transformer: Multi-Party Vertical Federated Learning on Practical Fuzzily Linked Data (NeurIPS 2024 · similarity 0.85)
- Fair and Efficient Contribution Valuation for Vertical Federated Learning (ICLR 2024 · similarity 0.84)
- Constructing Adversarial Examples for Vertical Federated Learning: Optimal Client Corruption through Multi-Armed Bandit (ICLR 2024 · similarity 0.84)
- A-FedPD: Aligning Dual-Drift is All Federated Primal-Dual Learning Needs (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.