  In a vertical federated learning (VFL) scenario where features and model are
split into different parties, communications of sample-specific updates are
required for correct gradient calculations but can be used to deduce important
sample-level label information. An immediate defense strategy is to protect
sample-level messages communicated with Homomorphic Encryption (HE), and in
this way only the batch-averaged local gradients are exposed to each party
(termed black-boxed VFL). In this paper, we first explore the possibility of
recovering labels in the vertical federated learning setting with HE-protected
communication, and show that private labels can be reconstructed with high
accuracy by training a gradient inversion model. Furthermore, we show that
label replacement backdoor attacks can be conducted in black-boxed VFL by
directly replacing encrypted communicated messages (termed gradient-replacement
attack). As it is a common presumption that batch-averaged information is safe
to share, batch label inference and replacement attacks are a severe challenge
to VFL. To defend against batch label inference attack, we further evaluate
several defense strategies, including confusional autoencoder (CoAE), a
technique we proposed based on autoencoder and entropy regularization. We
demonstrate that label inference and replacement attacks can be successfully
blocked by this technique without hurting as much main task accuracy as
compared to existing methods.
