Vertically Federated Graph Neural Network for Privacy-Preserving Node Classification

1 Introduction

• The paper targets vertically partitioned node classification, where data holders split node features and may hold distinct edge relations, with labels held by one party.The motivating setup has three holders with four shared nodes; one holder has the labels.Source: §1 · p. 1
• VFGNN divides the GNN computation graph, keeping private-data computations with holders and delegating the remaining computations to a semi-honest server.The private data include features, edges, and labels.Source: §1 · p. 2
• The proposed paradigm applies differential privacy to exchanged information to further protect against potential information leakage from the server.Examples of exchanged information include local node embeddings and gradient updates.Source: §1 · p. 2
• The paper proposes server-side strategies for combining local node embeddings and evaluates VFGNN on three real-world datasets.The authors state that the paradigm can be generalized to most existing GNNs.Source: §1 · p. 2

2.1 Security Model

• The security model assumes parties follow the protocol but may use intermediate results to infer information, and the server does not collude with data holders.The authors describe this as an honest-but-curious, or semi-honest, setting.Source: §2.1 · p. 2

2.2 Additive Secret Sharing

• Additive secret sharing distributes random shares of a value, reconstructs it by summing shares modulo 2^ell, and supports local addition; multiplication usually uses Beaver’s triplet technique.Each party retains one share while sending the others to the other parties.Source: §2.2 · p. 2

2.3 Differential Privacy

• The preliminaries define differential privacy and ℓ2-sensitivity, introduce the Gaussian mechanism, and state that it preserves (ϵ, δ)-DP at each publication step.Source: §2.3 · p. 2

3.1 Overview of VFGNN

• VFGNN keeps private feature and edge computations with data holders, while a semi-honest server performs non-private computations and combines local embeddings.The label holder computes predictions from the final hidden layer returned by the server.Source: §3.1 · pp. 2–3

3.2 Generate Initial Node Embeddings

• Collaborative initial-embedding generation uses vertically partitioned node features while keeping them secure; individual generation can lose information by missing relationships across holders’ features.The paper uses additive secret sharing for collaboration, citing its high efficiency.Source: §3.2 · p. 3

3.3 Generate Local Node Embeddings

• Data holders generate local node embeddings through separate multi-hop neighborhood aggregation, protecting private edge information before sending embeddings to the server.GraphSAGE is given as an example, with Mean, LSTM, and Pooling aggregator functions.Source: §3.3 · p. 3

3.4 Generate Global Node Embeddings

• The server combines local embeddings using Concat, Mean, or Regression strategies; Regression addresses cases where holders’ embeddings contribute differently.Concat preserves local embeddings, while Mean assumes holders contribute equally.Source: §3.4 · pp. 3–4

3.5 Enhancing Privacy by Adopting DP

• Gaussian Mechanism and James-Stein Estimator publish local information with differential privacy, and the James-Stein estimator reduces mean squared error while both methods preserve (ϵ, δ)-DP.The procedure clips local information, adds Gaussian noise, and can return the James-Stein estimate.Source: §3.5 · p. 4, §3.4 · p. 4

3.6 Putting Together

• VFGNN uses gradient descent to minimize cross-entropy over labeled training examples, with private-data and model components held across data holders and the server.Initial-embedding and neighborhood-aggregation weights stay with holders; server holds hidden-layer weights, and the label holder holds output-layer weights.Source: §3.6 · p. 4

4.1 Experimental Setup

• The evaluation uses four benchmarks, five-fold cross-validation with average accuracy, and validation-tuned parameters evaluated on test data.The comparison setup includes isolated-data and mixed-plaintext GraphSAGE baselines.Source: §4.1 · pp. 4–5, Table 1 · p. 5

4.2 Comparison Results and Analysis

• Across three datasets, VFGNN variants significantly outperform isolated GraphSAGE; vs. GraphSAGEA+B, accuracy is 0.8090 vs. 0.8150 on Cora and 0.6950 vs. 0.7001 on Citeseer.The authors characterize VFGNN performance as comparable to GraphSAGEA+B.Source: §4.2 · pp. 5–6, Table 2 · p. 5
• On Pubmed, VFGNN vs. SecureGNN reached 0.8090 vs. 0.7970 accuracy and 18.65 vs. 166.81 seconds per epoch on a local area network.The authors attribute SecureGNN's slower runtime to time-consuming MPC for non-linear computations.Source: §4.2 · p. 6

4.3 Ablation Study

• On Cora, as A:B shifts from 9:1 toward 7:3, most strategies tend to decline; Mean suits even splits, while Regression handles unequal shares.Table 3 compares combination operators across the specified data proportions.Source: §4.3 · p. 6, Table 3 · p. 6
• On Cora, accuracy decreases as the number of data holders increases from two to four, with less edge data per holder reducing neighborhood information.The authors explain that individual neighborhood aggregation leaves each holder with less edge data as participants increase.Source: §4.3 · p. 6, Table 4 · p. 6
• On Cora, accuracy increases with ε, trading stronger privacy at smaller ε for lower accuracy; James-Stein consistently outperforms the Gaussian mechanism.The experiments fix δ = 1e−4; the authors attribute the estimator's advantage to reduced MSE.Source: §4.3 · p. 6, Table 5 · p. 6

• VFGNN is a vertically federated GNN paradigm for privacy-preserving node classification.Source: §5 · p. 6
• VFGNN keeps private-data computations on data holders and delegates the remaining computations to a server.Source: §5 · p. 6
• VFGNN significantly outperforms GNNs using isolated data and performs comparably to a traditional GNN using insecure mixed plaintext data.Source: §5 · p. 6

• Beaver-triple multiplication uses shared random values u, w, and z = uw mod 2^ℓ to multiply secret-shared inputs.Source: A Multiplication of Secret Sharing · p. 8
• After reconstructing masked differences e and f, each party computes a share of the product, with the two output shares summing to the result.Source: A Multiplication of Secret Sharing · p. 8
• The protocols can be vectorized, operate over a finite field, and use fixed-point representation to approximate decimal arithmetic.Source: A Multiplication of Secret Sharing · p. 8

• Cryptographic neural networks use techniques such as secret sharing and homomorphic encryption, but their communication and computation costs make scaling to deep networks and large datasets difficult.Source: B Related Work in Details · p. 8
• A mature federated GNN solution for vertically partitioned data was still missing, which VFGNN addresses.Source: B Related Work in Details · p. 8
• Unlike prior split-computation neural networks, VFGNN trains a GNN and uses cryptography for holders to calculate initial node embeddings collaboratively rather than individually from plaintext data.Source: B Related Work in Details · p. 8

• Traditionally, initial node embeddings are computed as h0 = x^T · W from node features x and weight matrix W.Source: C Algorithm of Generating Initial Node… · p. 9
• With vertically partitioned features, holders secretly share x and concatenate their received shares in order before computing the embedding.Source: C Algorithm of Generating Initial Node… · p. 9
• Holders apply the distributive law to compute x^T · W across shares, then reconstruct it by summing all shares.Source: C Algorithm of Generating Initial Node… · p. 9