Pith. sign in

REVIEW 3 major objections 5 minor 57 references

Bilateral Differentially Private Vertical Federated Boosted Decision Trees

T0 review · 3 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read MaskedXGBoost claims a bilateral differential privacy guarantee for vertical federated XGBoost by injecting noise that mostly cancels in the split score.

desk verdict Null-space noise trick for VFL XGBoost is genuinely novel and the utility results are strong, but the bilateral DP guarantee only covers intermediate messages, not the published split structure, so the main privacy claim is not yet established. read the letter →

arxiv 2504.21739 v1 pith:V7LIPQ7S submitted 2025-04-30 cs.CR

Bokang Zhang , Zhikun Zhang , Haodong Jiang , Yang Liu , Lihao Zheng , Yuxiao Zhou , Shuaiting Huang , Junfeng Wu This is my paper · ORCID
classification cs.CR
keywords verticalfederatedlearningXGBoostgradientboostingdecisiontreesdifferentialprivacylocalnoisecalibrationsplitfindingbilateral
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

MaskedXGBoost is a protocol for training XGBoost on vertically partitioned data, where one party holds the labels and gradients and the other holds raw features, without exchanging plaintext. The paper's central claim is that both parties can get a formal differential privacy guarantee at the same time: the label-holding active party's noised gradient and Hessian vectors satisfy local differential privacy, and the feature-holding passive party's noise matrices satisfy differential privacy. The trick is to build the noise so that its dominant components lie in the null space of the inner product $m_i^\top(\cdot)$ that XGBoost uses to score a candidate split, leaving only a small disturbing component to degrade accuracy. If the claim holds, vertical federated XGBoost can have provable two-sided privacy with training times 4.82 to 6.72 times faster than homomorphic-encryption baselines and better utility than generic Gaussian-noise local DP.

What carries the argument

The load-bearing object is the calibrated noise matrix $B_i=[b_{i1},\ldots,b_{iW}]$ built from three ingredients: active noise, inactive noise, and disturbing noise. For a candidate splitting vector $m_i$, the active and inactive components are constructed so that $m_i^\top u_{ij}=m_i^\top v_{ij}=0$, meaning they sit exactly in the null space of the aggregation operation $m_i^\top(\cdot)$ that XGBoost uses to compute left-node sums; the disturbing component is ordinary Gaussian noise spread over all coordinates. When the active party forms $\langle g\rangle_i=g+\sum_{k=1}^W c_{ik}b_{ik}$ and the analogous $\langle h\rangle_i$, only the $r_{ik}$ terms survive in $m_i^\top\langle g\rangle_i$, so utility loss concentrates around the variance $\kappa^2=n_{A,i}C\sigma_2^2$. The same decomposition drives the two-sided privacy accounting: the active party's guarantee depends on total noise energy, while the passive party's guarantee depends on the energy ratio of the null-space components to the disturbing component.

What would settle it

Train MaskedXGBoost to completion while recording every revealed split, then run the paper's attribute-inference attacker on the union of the final tree structure and the noise matrices; if any splitting vector is recovered noticeably better than the $(\varepsilon_{\mathrm{PP}},\delta_{\mathrm{PP}})$ bound permits, the per-message guarantee does not compose to the full protocol.

Watch

Extended reading notes

Core claim

The discovery is that XGBoost's split evaluation, which is the dot product of a binary splitting vector $m_i$ with the private gradient and Hessian vectors $g$ and $h$, can be masked with Gaussian noise that is mostly invisible to that product. For each candidate split $i$, the passive party draws noise vectors $b_{ij}=u_{ij}+v_{ij}+r_{ij}$: active noise $u_{ij}$ is supported on the active set and sums to zero, inactive noise $v_{ij}$ is supported on the inactive set, and both satisfy $m_i^\top u_{ij}=m_i^\top v_{ij}=0$; only the disturbing noise $r_{ij}$ moves the score. The active party weights these vectors by coefficients of total energy $C$ and adds them to $g$ and $h$ to form $\langle g\rangle_i$ and $\langle h\rangle_i$. Theorem 1 bounds the deviation of the noised split score from the true score by a concentration bound that vanishes with the disturbing-noise scale, Theorem 2 gives $(\varepsilon_{\mathrm{AP}},\delta_{\mathrm{AP}})$-local differential privacy for the noised messages using the total noise energy, and Theorem 3 gives $(\varepsilon_{\mathrm{PP}},\delta_{\mathrm{PP}})$-differential privacy for the noise matrices, with leakage controlled mainly by the ratio $\sigma_1^2/\sigma_2^2$ and the dataset size. The paper presents this as the first bilateral privacy analysis for vertical federated XGBoost and reports experiments on six datasets supporting the utility and efficiency claims.

Load-bearing premise

The bilateral guarantee covers only the transmitted noise matrices and noised gradient and Hessian vectors, not the split choices that the passive party reveals at every node, so the end-to-end privacy of the completed tree is not established by Theorems 2 and 3.

Editorial extensions

If this is right

  • For the same privacy budget, MaskedXGBoost reports higher and more stable test AUC than FedXGBoost-LDP and XGBoost-LDP across Credit 1, Adult, Higgs, Bank, Credit 2, and Nomao, approaching the non-private baseline as the budget grows.
  • Average training time per tree is 4.82 times (Adult) to 6.72 times (Nomao) faster than the HE-XGBoost baseline, because noising and matrix operations replace ciphertext operations.
  • The passive party's privacy leakage for fixed $\varepsilon_{\mathrm{PP}}$ increases with the noise ratio $\sigma_1^2/\sigma_2^2$, giving the protocol an explicit knob that trades PP privacy against utility.
  • The same noising recipe adapts to GBDT by applying it to gradients alone, since GBDT's split score uses only first derivatives.
  • Communication overhead sits between plain DP methods and HE methods (about 1.2 MB versus 16 KB and 2.1 MB in the paper's illustrative configuration), which is the price of bilateral privacy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The null-space construction is a transferable recipe: any learning algorithm whose per-candidate statistic is a linear projection of sensitive data could place most of its DP noise in the kernel of that projection, and MaskedXGBoost is one concrete instance of that pattern.
  • The theorems are per-message guarantees, not an end-to-end guarantee: the passive party reveals each chosen split operation (feature and threshold) to the active party at every node, and that output is not included in Theorems 2 and 3, so the full training transcript may leak more than the stated budgets account for.
  • One testable simplification is to reuse a single batch of null-space noise vectors across all candidate splits instead of generating one noise matrix per split, which would cut communication if the privacy accounting can still be performed.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes MaskedXGBoost, a vertical federated learning protocol for training XGBoost models with differential privacy for both the active party (AP, holding labels) and the passive party (PP, holding features). The core idea is to inject structured Gaussian noise: PP constructs noise vectors whose active and inactive components lie in the null space of each splitting vector, so they cancel out in the split-score computation, leaving only a smaller disturbing noise to affect utility. AP then applies these noise vectors to its gradients and Hessians before sending them to PP, which computes the split scores and reveals the best split. The paper provides a utility bound (Theorem 1) showing that the score disturbance vanishes as the disturbing-noise scale goes to zero, and gives differential privacy guarantees for AP (Theorem 2) and PP (Theorem 3). Experiments on six datasets show higher utility than DP baselines and lower training time than homomorphic encryption. The central claim is that MaskedXGBoost achieves bilateral differential privacy with better utility and efficiency than existing approaches.

Significance. The null-space noise construction is an elegant and original mechanism-design idea: it decouples privacy noise from the utility-critical projection, which is a genuinely useful contribution to DP mechanism design for tree-based models. If the bilateral DP claim were fully established, the paper would be the first to provide end-to-end DP for both parties in vertical federated XGBoost without heavy cryptography, with a strong utility/efficiency trade-off. The experimental validation is solid (six datasets, multiple baselines) and the theoretical proofs are detailed. However, the privacy analysis has a load-bearing gap: the protocol reveals the selected split operation (and split score) at every node, and this release is not covered by Theorems 2 and 3 nor by any composition argument. The utility analysis (Theorem 1) is sound as a standalone bound, and the empirical results support the utility claims. The paper would be a strong addition to the literature after the privacy accounting is completed.

major comments (3)
  1. [§4.4 (Algorithm 3, line 15) and §5.3] The protocol requires PP to reveal the selected splitting score and operation (s*) to AP at every node (Algorithm 3, lines 11–16). Theorem 3 bounds the privacy of PP only for the transmitted noise matrices B_i, and Theorem 2 bounds only the noised gradient/Hessian vectors sent by AP. The revealed s* is a function of PP's private splitting vector m_i, AP's private gradients/Hessians, and the noise B_i; since AP knows g, h, and the coefficients c_ik, d_ik, it can compute all the noised aggregates and thus s* becomes a deterministic function of m_i that is not covered by the DP guarantee for B_i. No sequential/parallel composition argument in the paper includes this split-selection mechanism, so the claimed (ε_PP, δ_PP)-DP guarantee does not extend to the full protocol output (the tree structure). This is a load-bearing gap for the bilateral DP claim.
  2. [§4.3 (Algorithm 2, line 2) and §5.2 (Theorem 2)] Algorithm 2 states only that the coefficients c_i1..c_iW and d_i1..d_iW satisfy Σ_k c_ik^2 = C and Σ_k d_ik^2 = C, without specifying their distribution. Theorem 2 and its proof in Appendix C rely on the total noise vector Σ_k c_ik b_ik being Gaussian with covariance matrix (12)–(13). If the coefficients are randomized (e.g., drawn uniformly from the sphere), the noise is a scale mixture of Gaussians and the Gaussian covariance argument in Appendix C no longer holds. The authors need to fix the coefficients (e.g., deterministic values) and re-derive the condition, or provide a DP proof for the actual distribution.
  3. [§5.2–§5.3 and §6.2] Even setting aside the split release, the paper does not give a full composition argument for the repeated releases across nodes, trees, and candidates. Theorem 2 is stated for 'each time' AP sends ⟨g⟩_i and ⟨h⟩_i, and Theorem 3 for each noise matrix B_i, but the protocol releases l pairs of vectors per node and repeats this for every node and training round. The experiment section mentions using the advanced composition bound, but the composition count, the adaptivity, and the correlation between the releases of ⟨g⟩_i and ⟨h⟩_i (which share the same B_i) are not analyzed. Without this accounting, the claimed end-to-end (ε_AP, δ_AP)-LDP and (ε_PP, δ_PP)-DP are not demonstrated.
minor comments (5)
  1. [Algorithm 2, line 5] The computation 'H ← Σ_{i=1}^n g_i' should be 'H ← Σ_{i=1}^n h_i', as H is defined as the sum of Hessians.
  2. [Section 1, first paragraph] The phrase 'high performance and interoperability' appears to be a typo for 'high performance and interpretability'.
  3. [Table 3] The table header appears to have the row and column labels interchanged: the first column contains the method names and the remaining columns are datasets; please correct the header.
  4. [Appendix G] The claim that 'if either party violates the protocol, it will only affect its own privacy and will not improve its ability to launch a privacy attack against the other party' is asserted without proof; consider providing an argument or softening the claim.
  5. [Figure 9 caption] The figure legends are small and difficult to read; please enlarge the fonts or use a more legible layout.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the utility and privacy theorems follow from the protocol construction and standard DP analyses, with no fitted parameter relabeled as a prediction.

full rationale

The paper's derivation chain is self-contained with respect to its stated claims. Theorem 1 is built on the algebraic identity Eq. (10), m_i^T <g>_i = m_i^T g + sum_k c_ik r_ik, which follows from the explicit construction of active and inactive noise in the null space of m_i and leaves only the disturbing noise in the split score; the concentration bound then measures the residual Gaussian disturbance, so the utility result is a consequence of the construction rather than an assumption of it. Theorem 2 is a standard Gaussian-mechanism LDP proof for the noised gradient/Hessian vectors, with the sensitivity bound derived from the bounded binary cross-entropy gradients and Hessians. Theorem 3 is a standard adjacent-input DP proof for the noise matrix distribution, comparing two splitting vectors and applying composition over W columns. None of the cited prior work is load-bearing for these proofs: [30] contributes only the splitting-vector formulation, and the self-citations by the authors are background references or unrelated prior work. The concern that Algorithm 3's revealed split score and operation is not covered by Theorems 2-3 is a scoping gap in the end-to-end privacy claim, but it is not a circularity: no theorem is equivalent to its inputs, and no parameter fitted to data is presented as a prediction.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The protocol introduces four parameters (sigma1, sigma2, C, W) without a closed-form selection rule or reported values, and the proof of Theorem 2 assumes a Gaussian noise distribution that Algorithm 2 does not explicitly generate. Several standard DP composition results and the honest-but-curious threat model are adopted from prior work.

free parameters (4)
  • sigma1
    Scale for active and inactive noise; chosen to satisfy the privacy budgets, but no numerical values or selection formula are given.
  • sigma2
    Scale for disturbing noise; controls the utility-privacy tradeoff, but the paper does not report the values used in experiments.
  • C
    Squared norm constraint on the noise weights in Algorithm 2; set to meet the active party's privacy budget, but the concrete setting is not described.
  • W
    Number of noise vectors per splitting candidate; affects the passive party's privacy (epsilon_PP > W ln 2), but the experimental values are not given.
assumptions (5)
  • domain assumption Gradients and Hessians are bounded, |g_i|, |h_i| < mu/2, with mu = 2e/(e+1) for binary cross-entropy or via clipping for other losses.
    Used in Theorem 2 to bound sensitivity; introduced in Section 5.2 before Theorem 2.
  • ad hoc to paper The noise weights c and d in Algorithm 2 are chosen so that the added noise is Gaussian with covariance C times Sigma; the paper does not specify their distribution.
    Theorem 2's proof models the perturbation as Gaussian (Appendix C), but Algorithm 2 only constrains the squared norm of the weights.
  • domain assumption Honest-but-curious adversary model where both parties follow the protocol.
    Stated in Section 3.1 Threat Model.
  • standard math Standard sequential and parallel composition theorems for differential privacy hold.
    Used in Lemma 1, Lemma 2, and the advanced composition bound for privacy accounting.
  • domain assumption The revealed splitting operation (feature and threshold) is not considered private; the DP analysis only covers noise matrices and noised gradients.
    The protocol reveals split scores and operations to the active party (Algorithm 3), which is outside the DP analysis in Theorem 2 and Theorem 3.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Bilateral Differentially Private Vertical Federated Boosted Decision Trees." pith.science (2026). https://pith.science/paper/V7LIPQ7S

@misc{pith2026250421739,
  author       = {Pith},
  title        = {Pith review of: Bilateral Differentially Private Vertical Federated Boosted Decision Trees},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V7LIPQ7S}},
  note         = {Machine review of arXiv:2504.21739}
}
read the original abstract

Federated learning is a distributed machine learning paradigm that enables collaborative training across multiple parties while ensuring data privacy. Gradient Boosting Decision Trees (GBDT), such as XGBoost, have gained popularity due to their high performance and strong interpretability. Therefore, there has been a growing interest in adapting XGBoost for use in federated settings via cryptographic techniques. However, it should be noted that these approaches may not always provide rigorous theoretical privacy guarantees, and they often come with a high computational cost in terms of time and space requirements. In this paper, we propose a variant of vertical federated XGBoost with bilateral differential privacy guarantee: MaskedXGBoost. We build well-calibrated noise to perturb the intermediate information to protect privacy. The noise is structured with part of its ingredients in the null space of the arithmetical operation for splitting score evaluation in XGBoost, helping us achieve consistently better utility than other perturbation methods and relatively lower overhead than encryption-based techniques. We provide theoretical utility analysis and empirically verify privacy preservation. Compared with other algorithms, our algorithm's superiority in both utility and efficiency has been validated on multiple datasets.

Figures

Figures reproduced from arXiv: 2504.21739 by the authors.

Figure 1
Figure 1. An example of XGBoost and splitting vector. The [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Federated XGBoost problem setting. Definition 2 (Local Differential Privacy [16]). A random￾ized mechanism M satisfies (𝜀, 𝛿)-local differential privacy ( (𝜀, 𝛿)- LDP), where 𝜀 ≥ 0 and 0 ≤ 𝛿 ≤ 1, if for any two of input 𝑑, 𝑑′ , and any measurable set O of M’s outputs, Pr(M (𝑑) ∈ O) ≤ exp(𝜀)Pr(M (𝑑 ′ ) ∈ O) + 𝛿. 2.4 Notations Frequently used notations are summarised in [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. MaskedXGBoost overview. MaskedXGBoost is composed of four steps: initialization, noise calibration, information noising, and joint optimal splitting candidate searching. AP and PP first determine the necessary algorithm parameters in the initialization step. In the noise calibration step, PP builds well-calibrated noise according to the categorical matrix which ensures the consistently better property of MaskedXGBoo… view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Utility of different methods for different privacy budgets. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Training process of the four XGBoost algorithms with different privacy budgets on Credit 1 dataset [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Illustration of the neural network-based attacker. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: Empirical privacy evaluation for AP with varying [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]
Figure 9
Figure 9. Figure 9: Ablation study on Credit 1: the effect of [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Simulation results for Theorem 3: Greater [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]
Figure 11
Figure 11. Figure 11: Training process of the four XGBoost algorithms with different privacy budgets on Adult, Higgs, Bank, Credit 2, and [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 12
Figure 12. Figure 12: Utility of different methods for different privacy budgets on Credit 2 and Nomao. [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]
Figure 13
Figure 13. Figure 13: Empirical privacy evaluation for AP with varying privacy budget [PITH_FULL_IMAGE:figures/full_fig_p020_13.png]
Figure 14
Figure 14. Figure 14: Empirical privacy evaluation for PP with varying privacy budget [PITH_FULL_IMAGE:figures/full_fig_p020_14.png]
Figure 15
Figure 15. Figure 15: Ablation study on Adult, Higgs, Bank, Credit 2, and Bank datasets: the effect of [PITH_FULL_IMAGE:figures/full_fig_p021_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 40 canonical work pages

  1. [1]

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 308–318

    2016

  2. [2]

    Yoshinori Aono, Takuya Hayashi, Lihua Wang, Shiho Moriai, et al. 2017. Privacy- preserving deep learning via additively homomorphic encryption. IEEE Transac- tions on Information Forensics and Security 13, 5 (2017), 1333–1345

    2017

  3. [3]

    Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017. Prac- tical secure aggregation for privacy-preserving machine learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 1175–1191

    work page 2017

  4. [4]

    Tianqi Chen and Carlos Guestrin. 2016. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd Acm Sigkdd International Conference on Knowledge Discovery and Data Mining . 785–794

    work page 2016

  5. [5]

    Weijing Chen, Guoqiang Ma, Tao Fan, Yan Kang, Qian Xu, and Qiang Yang. 2021. Secureboost+: A high performance gradient boosting tree framework for large scale vertical federated learning. arXiv preprint arXiv:2110.10927 (2021)

    arXiv 2021

  6. [6]

    Kewei Cheng, Tao Fan, Yilun Jin, Yang Liu, Tianjian Chen, Dimitrios Papadopou- los, and Qiang Yang. 2021. Secureboost: A lossless federated learning framework. IEEE Intelligent Systems 36, 6 (2021), 87–98

    2021

  7. [7]

    Philip J Davis. 1979. Circulant Matrices Wiley. Vol. 120. Wiley New York

    work page 1979

  8. [8]

    Kevin Deforth, Marc Desgroseilliers, Nicolas Gama, Mariya Georgieva, Dimitar Jetchev, and Marius Vuille. 2022. XORBoost: Tree boosting in the multiparty computation setting. Proceedings on Privacy Enhancing Technologies (2022)

    work page 2022

Show all 57 references
  1. [9]

    Linkang Du, Zhikun Zhang, Shaojie Bai, Changchang Liu, Shouling Ji, Peng Cheng, and Jiming Chen. 2021. AHEAD: Adaptive Hierarchical Decomposition for Range Query under Local Differential Privacy. In ACM CCS

    2021

  2. [10]

    Yuntao Du, Yujia Hu, Zhikun Zhang, Ziquan Fang, Lu Chen, Baihua Zheng, and Yunjun Gao. 2023. LDPTrace: Locally Differentially Private Trajectory Synthesis. In VLDB

    2023

  3. [11]

    Dheeru Dua and Casey Graff. 2017. UCI Machine Learning Repository. http: //archive.ics.uci.edu/ml

    2017

  4. [12]

    Lutz Duembgen. 2010. Bounding standard gaussian tail probabilities. arXiv preprint arXiv:1012.2063 (2010)

    2010 arXiv

  5. [13]

    Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni Naor. 2006. Our data, ourselves: Privacy via distributed noise generation. In Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 486–503

    2006

  6. [14]

    Cynthia Dwork, Aaron Roth, et al. 2014. The algorithmic foundations of differ- ential privacy. Foundations and Trends® in Theoretical Computer Science 9, 3–4 (2014), 211–407

    2014

  7. [15]

    Cynthia Dwork, Guy N Rothblum, and Salil Vadhan. 2010. Boosting and differ- ential privacy. In 2010 IEEE 51st Annual Symposium on Foundations of Computer Science. IEEE, 51–60

    2010

  8. [16]

    Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. 2014. Rappor: Random- ized aggregatable privacy-preserving ordinal response. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security . 1054–1067

    2014

  9. [17]

    Wenjing Fang, Chaochao Chen, Jin Tan, Chaofan Yu, Yufei Lu, Li Wang, Lei Wang, Jun Zhou, and Alex X Liu. 2020. A hybrid-domain framework for secure gradient tree boosting. In The 29th ACM International Conference on Information and Knowledge Management (CIKM’20), Galway, Irela...

    2020

  10. [18]

    Zhi Feng, Haoyi Xiong, Chuanyuan Song, Sijia Yang, Baoxin Zhao, Licheng Wang, Zeyu Chen, Shengwen Yang, Liping Liu, and Jun Huan. 2019. Securegbm: Secure multi-party gradient boosting. In 2019 IEEE international conference on big data (big data). IEEE, 1312–1321

    2019

  11. [19]

    Jerome H Friedman. 2001. Greedy function approximation: a gradient boosting machine. Annals of statistics (2001), 1189–1232

    2001

  12. [20]

    Fangcheng Fu, Jiawei Jiang, Yingxia Shao, and Bin Cui. 2019. An experimental evaluation of large scale GBDT systems. arXiv preprint arXiv:1907.01882 (2019)

    2019 arXiv

  13. [21]

    Nayanaba Pravinsinh Gohil and Arvind D Meniya. 2021. Click ad fraud detec- tion using XGBoost gradient boosting algorithm. In International Conference on Computing Science, Communication and Security . Springer, 67–81

    2021

  14. [22]

    Robert M Gray et al. 2006. Toeplitz and circulant matrices: A review. Foundations and Trends® in Communications and Information Theory 2, 3 (2006), 155–239

    2006

  15. [23]

    2012.Matrix analysis

    Roger A Horn and Charles R Johnson. 2012.Matrix analysis. Cambridge university press

    2012

  16. [24]

    Lingying Huang, Junfeng Wu, Dawei Shi, Subhrakanti Dey, and Ling Shi. 2024. Differential privacy in distributed optimization with gradient tracking. IEEE Trans. Automat. Control (2024)

    2024

  17. [25]

    Chao Jin, Jun Wang, Sin G Teo, Le Zhang, CS Chan, Qibin Hou, and Khin Mi Mi Aung. 2022. Towards End-to-End Secure and Efficient Federated Learning for XGBoost. (2022)

    2022

  18. [26]

    Kaggle.2012. [n. d.]. Give Me Some Credit Competition Dataset. https://www. kaggle.com/competitions/GiveMeSomeCredit/data?select=cs-test.csv

    2012

  19. [27]

    Alan F Karr, Xiaodong Lin, Ashish P Sanil, and Jerome P Reiter. 2009. Privacy- preserving analysis of vertically partitioned data using secure matrix products. Journal of Official Statistics 25, 1 (2009), 125

    2009

  20. [28]

    Guolin Ke, Qi Meng, Thomas Finley, Taifeng Wang, Wei Chen, Weidong Ma, Qiwei Ye, and Tie-Yan Liu. 2017. Lightgbm: A highly efficient gradient boosting decision tree. Advances in Neural Information Processing Systems 30 (2017)

    2017

  21. [29]

    Vladimir Kolesnikov, Naor Matania, Benny Pinkas, Mike Rosulek, and Ni Trieu

  22. [30]

    Nhan Khanh Le, Yang Liu, Quang Minh Nguyen, Qingchen Liu, Fangzhou Liu, Quanwei Cai, and Sandra Hirche. 2021. FedXGBoost: Privacy-Preserving XGBoost for Federated Learning. arXiv preprint arXiv:2106.10662 (2021)

    2021 arXiv

  23. [31]

    Jerome Le Ny and George J Pappas. 2013. Differentially private filtering. IEEE Trans. Automat. Control 59, 2 (2013), 341–354

    2013

  24. [32]

    Oscar Li, Jiankai Sun, Xin Yang, Weihao Gao, Hongyi Zhang, Junyuan Xie, Vir- ginia Smith, and Chong Wang. 2021. Label Leakage and Protection in Two-party Split Learning. In International Conference on Learning Representations

    2021

  25. [33]

    Qinbin Li, Zhaomin Wu, Yanzheng Cai, Yuxuan Han, Ching Man Yung, Tianyuan Fu, and Bingsheng He. 2023. FedTree: A Federated Learning System For Trees. In Proceedings of Machine Learning and Systems

    2023

  26. [34]

    Qinbin Li, Zhaomin Wu, Zeyi Wen, and Bingsheng He. 2020. Privacy-preserving gradient boosting decision trees. In Proceedings of the AAAI Conference on Artifi- cial Intelligence, Vol. 34. 784–791

    2020

  27. [35]

    Xiaoliang Ling, Weiwei Deng, Chen Gu, Hucheng Zhou, Cui Li, and Feng Sun

  28. [36]

    Wen-jie Lu, Zhicong Huang, Qizhi Zhang, Yuchen Wang, and Cheng Hong. 2023. Squirrel: A Scalable Secure{Two-Party} Computation Framework for Training Gradient Boosting Decision Tree. In 32nd USENIX Security Symposium (USENIX Security 23). 6435–6451

    2023

  29. [37]

    In Proceedings of the 26th international conference on world wide web companion

    Model ensemble for click prediction in bing search ads. In Proceedings of the 26th international conference on world wide web companion . 689–698

  30. [38]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-Efficient Learning of Deep Networks from Decentralized Data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (Proceedings of ...

    2017

  31. [39]

    Samuel Maddock, Graham Cormode, Tianhao Wang, Carsten Maple, and Somesh Jha. 2022. Federated Boosted Decision Trees with Differential Privacy. In Pro- ceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2249–2263

    2022

  32. [40]

    Thorsten Peinemann, Moritz Kirschte, Joshua Stock, Carlos Cotrini, and Esfandiar Mohammadi. 2023. S-BDT: Distributed Differentially Private Boosted Decision Trees. arXiv e-prints (2023), arXiv–2309

    2023

  33. [41]

    H Brendan McMahan, Eider Moore, Daniel Ramage, and Blaise Agüera y Arcas

  34. [42]

    Garry J Tee. 2007. Eigenvectors of block circulant and alternating circulant matrices. New Zealand Journal of Mathematics 36, 8 (2007), 195–211

    2007

  35. [43]

    Zhenya Tian, Jialiang Xiao, Haonan Feng, and Yutian Wei. 2020. Credit risk assessment based on gradient boosting decision tree. Procedia Computer Science 174 (2020), 150–160

    2020

  36. [44]

    Reza Shokri and Vitaly Shmatikov. 2015. Privacy-preserving deep learning. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. 1310–1321

    2015

  37. [45]

    Haiming Wang, Zhikun Zhang, Tianhao Wang, Shibo He, Michael Backes, Jim- ing Chen, and Yang Zhang. 2023. PrivTrace: Differentially Private Trajectory Synthesis by Adaptive Markov Model. In USENIX Security

    2023

  38. [46]

    Rui Wang, Oğuzhan Ersoy, Hangyu Zhu, Yaochu Jin, and Kaitai Liang. 2022. Feverless: Fast and secure vertical federated learning based on xgboost for de- centralized labels. IEEE Transactions on Big Data (2022)

    2022

  39. [47]

    Zhihua Tian, Rui Zhang, Xiaoyang Hou, Lingjuan Lyu, Tianyi Zhang, Jian Liu, and Kui Ren. 2023. FederBoost:Private Federated Learning for GBDT. IEEE Transactions on Dependable and Secure Computing (2023)

    2023

  40. [48]

    Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. 2019. Federated machine learning: Concept and applications. ACM Transactions on Intelligent Systems and Technology (TIST) 10, 2 (2019), 1–19. 13 Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Zhang et al

    2019

  41. [49]

    I-Cheng Yeh and Che-hui Lien. 2009. The comparisons of data mining techniques for the predictive accuracy of probability of default of credit card clients. Expert systems with applications 36, 2 (2009), 2473–2480

    2009

  42. [50]

    Tianhao Wang, Joann Qiongna Chen, Zhikun Zhang, Dong Su, Yueqiang Cheng, Zhou Li, Ninghui Li, and Somesh Jha. 2021. Continuous Release of Data Streams under both Centralized and Local Differential Privacy. In ACM CCS

    2021

  43. [51]

    Bokang Zhang, Yanglin Zhang, Zhikun Zhang, Jinglan Yang, Lingying Huang, and Junfeng Wu. 2024. S2NeRF: Privacy-preserving Training Framework for NeRF. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. 258–272

    2024

  44. [52]

    Zhikun Zhang, Tianhao Wang, Ninghui Li, Shibo He, and Jiming Chen. 2018. CALM: Consistent Adaptive Local Marginal for Marginal Release under Local Differential Privacy. In ACM CCS

    2018

  45. [53]

    Quan Yuan, Zhikun Zhang, Linkang Du, Min Chen, Peng Cheng, and Mingyang Sun. 2023. PrivGraph: Differentially Private Graph Data Publication by Exploiting Community Information. In USENIX Security

    2023

  46. [56]

    Zhikun Zhang, Tianhao Wang, Ninghui Li, Jean Honorio, Michael Backes, Shibo He, Jiming Chen, and Yang Zhang. 2021. PrivSyn: Differentially Private Data Synthesis. In USENIX Security. A DETAILS OF XGBOOST Regression Tree. A regression tree, which belongs to the family of decisi...

    2021

  47. [57]

    −𝐶𝜎 2 1 0 ··· 0 −𝐶𝜎 2 1 −𝐶𝜎 2 1 ... ... ... 0 0 ... ... ... ... ... ... ... 0 0 ... −𝐶𝜎 2 1 −𝐶𝜎 2 1 0 ··· 0 −𝐶𝜎 2 1 𝐶(2𝜎2 1+𝜎2 2)  and the submatrix of all the other entries is given as Σ1 =𝐶(2𝜎2 1+𝜎2 2)𝐼. (20) Notice that Σ1 ∈ R𝑛𝐼,𝑖×𝑛𝐼,𝑖, Σ2 ∈ R𝑛𝐴,𝑖×𝑛𝐴,𝑖 , wh...

    2018

  48. [2016]

    arXiv preprint arXiv:1602.05629 2 (2016)

    Federated learning of deep networks using model averaging. arXiv preprint arXiv:1602.05629 2 (2016)

    2016 arXiv

  49. [2017]

    In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security

    Practical multi-party private set intersection from symmetric-key tech- niques. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 1257–1272

    2017

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.