OPUS-VFL: Incentivizing Optimal Privacy-Utility Tradeoffs in Vertical Federated Learning

TL;DR

OPUS-VFL addresses incentive alignment and privacy in vertical federated learning by formulating a bi-level optimization where the global model optimizes accuracy under a fixed reward budget $\tau$ and clients optimize their own rewards minus costs subject to privacy and resource constraints. It introduces a privacy-aware contribution measure based on a lightweight leave-one-out score $\mathcal{I}_i$ and an adaptive differential privacy budget $\varepsilon_i$ that clients tune via gradient feedback. The server aggregates client signals to allocate rewards while ensuring budget balance and individual rationality, and clients decide participation via utilities $\mathcal{U}_{it}=\tau_{it}-\mathcal{B}_{it}$. OPUS-VFL demonstrates robustness against label/feature inference and backdoor attacks, reduces attack success rates and increases reconstruction errors, while maintaining efficiency (per-round time) and scalability to many clients. The work provides a practical, fair, secure VFL framework for settings with heterogeneous clients in healthcare/finance.

Abstract

Vertical Federated Learning (VFL) enables organizations with disjoint feature spaces but shared user bases to collaboratively train models without sharing raw data. However, existing VFL systems face critical limitations: they often lack effective incentive mechanisms, struggle to balance privacy-utility tradeoffs, and fail to accommodate clients with heterogeneous resource capabilities. These challenges hinder meaningful participation, degrade model performance, and limit practical deployment. To address these issues, we propose OPUS-VFL, an Optimal Privacy-Utility tradeoff Strategy for VFL. OPUS-VFL introduces a novel, privacy-aware incentive mechanism that rewards clients based on a principled combination of model contribution, privacy preservation, and resource investment. It employs a lightweight leave-one-out (LOO) strategy to quantify feature importance per client, and integrates an adaptive differential privacy mechanism that enables clients to dynamically calibrate noise levels to optimize their individual utility. Our framework is designed to be scalable, budget-balanced, and robust to inference and poisoning attacks. Extensive experiments on benchmark datasets (MNIST, CIFAR-10, and CIFAR-100) demonstrate that OPUS-VFL significantly outperforms state-of-the-art VFL baselines in both efficiency and robustness. It reduces label inference attack success rates by up to 20%, increases feature inference reconstruction error (MSE) by over 30%, and achieves up to 25% higher incentives for clients that contribute meaningfully while respecting privacy and cost constraints. These results highlight the practicality and innovation of OPUS-VFL as a secure, fair, and performance-driven solution for real-world VFL.

Figures (6)

• Figure 2: Evolution of Contributions, Rewards, and Differential Privacy Parameter $\varepsilon$ Values: Contributions, rewards, and differential privacy parameter $\varepsilon$ values generated by OPUS-VFL on the CIFAR-10 dataset over 60 training rounds. The $\varepsilon$ values remain relatively stable across epochs, resulting in similar trends for rewards and contributions. The magnitude of change in $\varepsilon$ can be controlled via a step size parameter.
• Figure 3: Evolution of Contributions, Rewards, and Privacy Parameter $\varepsilon$ for Each Client over 60 Epochs on CIFAR-100.
• Figure 4: Reward dynamics and model convergence in OPUS-VFL: (a) Reward distribution over training rounds when all five organizations (i.e., clients) allocate the same fraction $\mathcal{C}_i$ of their available resources. (b) Reward distribution when clients allocate different fractions of their resources illustrates our incentive mechanism's fairness. For example, a moderately contributing client with higher resource allocation (e.g., Organization 4) may receive more reward than a higher contributing client with lower resource use (e.g., Organization 2). (c) Global model convergence is maintained despite the injection of differential privacy noise and dynamic adjustment of $\varepsilon_{it}$ by each client to maximize individual rewards.
• Figure 5: Contributions on the CIFAR-10 dataset over 100 training rounds for 5 clients under a backdoor poisoning budget 0.5.
• Figure 6: Contributions on the MINIST dataset when the step size for changing $\varepsilon$ is 0 and $\varepsilon$ is initialized to $10^6$, indicating negligible noise.