Guard-GBDT: Secure Vertical GBDT Framework

• Guard-GBDT is a secure vertical federated learning system where two parties jointly train GBDT models without revealing raw features, labels, or gradients.
• The framework eliminates expensive MPC operations like division and sigmoid evaluation by using lookup-table approximations driven by function secret sharing.
• It achieves significant speedups and reduced communication compared to SiGBDT and HEP-XGB, while maintaining simulation-based security with minimal accuracy loss.

Searching arXiv for the primary Guard-GBDT paper and closely related vertical secure GBDT work. Search query: Guard-GBDT vertical GBDT MPC SiGBDT HEP-XGB Guard-GBDT is a two-party secure training framework for gradient boosting decision trees (GBDT) over vertically partitioned data. It is designed for the setting in which two parties hold disjoint feature subsets for the same samples, one party holds the labels, and both parties wish to train a single GBDT model without revealing raw features, labels, gradients, thresholds, or sample assignments. Its defining technical move is to eliminate the principal MPC bottlenecks in vertical GBDT training—division and sigmoid evaluation—by replacing them with lookup-table approximations driven by function secret sharing, while separately reducing bandwidth through a compression-aware gradient aggregation protocol. In the reported implementation, these choices yield up to $2.71\times$ speedup over SiGBDT and up to $12.21\times$ over HEP-XGB on LAN, up to $2.7\times$ and $8.2\times$ on WAN, with accuracy comparable to plaintext XGBoost and SiGBDT within approximately $\pm1\%$ to $\pm2\%$ (Song et al., 28 Jul 2025).

1. Problem setting and baseline GBDT formulation

Guard-GBDT operates in vertical federated learning. Two parties, denoted $P_0$ and $P_1$, hold column-wise partitions of a dataset with the same $N$ samples. $P_1$ owns the labels $12.21\times$0, while both parties contribute features to a jointly trained GBDT. For a selected split, the corresponding feature index and threshold are revealed only to the party that owns that feature; the other party learns nothing about the split contents. Gradient statistics, split decisions, and leaf weights are computed privately (Song et al., 28 Jul 2025).

The learning objective follows standard histogram-based GBDT for binary classification with logistic loss. Let $12.21\times$1 be the current ensemble score and $12.21\times$2 the probability, where

$12.21\times$3

For sample $12.21\times$4 with label $12.21\times$5, the gradient and Hessian are

$12.21\times$6

In MPC, Guard-GBDT uses fixed-point encoding over the ring $12.21\times$7, with $12.21\times$8, typically $12.21\times$9 and fractional precision $2.7\times$0 (Song et al., 28 Jul 2025).

At a tree node with sample set $2.7\times$1, and for a candidate split producing $2.7\times$2 and $2.7\times$3, the aggregated statistics are

$2.7\times$4

$2.7\times$5

The standard XGBoost split gain is

$2.7\times$6

and the leaf weight is

$2.7\times$7

These formulas identify the core difficulty: split evaluation requires three divisions, leaf estimation requires another division, and logistic training requires secure sigmoid computation (Song et al., 28 Jul 2025).

2. Threat model, leakage profile, and cryptographic architecture

Guard-GBDT assumes a static, semi-honest PPT adversary corrupting one party. The protocol uses a preprocessing model with a secure third party (STP) that generates input-independent randomness offline. There is no collusion between $2.7\times$8 and $2.7\times$9, and the STP learns no inputs or outputs (Song et al., 28 Jul 2025).

Its security target is simulation-based security for the individual sub-protocols and for the composed training workflow. Leakage is explicitly limited to the tree structure, including which party owns the split at each node and the public tree topology. Feature values, labels, gradients, thresholds, and per-sample assignments remain secret. When a split is chosen, only the owner learns the corresponding feature and threshold and performs the local comparison needed to update membership for the child nodes (Song et al., 28 Jul 2025).

The online cryptographic stack is intentionally narrow. Linear arithmetic is performed with 2-out-of-2 additive secret sharing (ASS), with Beaver triples for secure multiplication. Non-linear comparisons use function secret sharing (FSS), specifically DCF-based less-than evaluation. No homomorphic encryption, fully homomorphic encryption, or garbled circuits are used online. The paper situates its protocol libraries in relation to ABY for ASS and to Orca/FSS-style mixed-mode fixed-point secure computation (Song et al., 28 Jul 2025).

This privacy model is narrower than full identifier anonymity. Guard-GBDT addresses privacy of features, labels, gradients, thresholds, and sample assignments in a vertically aligned two-party setting. By contrast, later anonymous two-party GBDT work studies the stronger problem of hiding identifiers, intersection membership, intersection cardinality, and alignment in split data, using dual circuit-PSI, OPPRF, and RLWE-based aggregation (Chenyu et al., 26 May 2026). This distinction matters because “privacy-preserving vertical GBDT” does not by itself imply ID-hiding.

3. Division- and sigmoid-free approximations

The central algorithmic contribution of Guard-GBDT is the removal of MPC-unfriendly division and sigmoid evaluation through segment-wise lookup tables. For sigmoid approximation, the input domain is quantized into $8.2\times$0 segments over $8.2\times$1, exploiting saturation outside that range. With

$8.2\times$2

the table stores

$8.2\times$3

A piecewise-constant approximation $8.2\times$4 is then selected via private less-than tests. If $8.2\times$5, the reconstruction formula is

$8.2\times$6

The online phase requires one communication round and $8.2\times$7 bits, with no exponentiation or division inside MPC. Offline memory is approximately $8.2\times$8 bits. With $8.2\times$9 and $\pm1\%$0, the implemented LUT is $\pm1\%$1 bytes per table (Song et al., 28 Jul 2025).

Leaf weights are approximated by a related LUT construction on $\pm1\%$2, but division is avoided by rewriting the comparison. Instead of testing $\pm1\%$3, Guard-GBDT evaluates

$\pm1\%$4

with DCF-based less-than. If $\pm1\%$5 and $\pm1\%$6, then

$\pm1\%$7

where $\pm1\%$8. This yields an approximate Newton step without secure division (Song et al., 28 Jul 2025).

Guard-GBDT also replaces the standard split gain with a division-free surrogate that preserves candidate ordering. Let $\pm1\%$9 and define

$\pm2\%$0

Then the surrogate gain is

$\pm2\%$1

The stated rationale is monotonicity: for

$\pm2\%$2

the sign of $\pm2\%$3 is determined by $\pm2\%$4, so the function is strictly monotone in $\pm2\%$5 on each side of $\pm2\%$6. Because the parent term $\pm2\%$7 is constant for a fixed node, ranking by the original gain is equivalent to ranking by a monotone transformation of the numerator terms, and $\pm2\%$8 preserves order among candidates. The paper reports a proof of this claim in its appendix (Song et al., 28 Jul 2025).

A common misconception is that privacy-preserving GBDT requires exact secure implementations of every non-linearity in the plaintext algorithm. Guard-GBDT directly contradicts that premise: it introduces controlled approximation error in sigmoid and leaf weights, while keeping the ordering of split candidates intact through the surrogate gain. The reported empirical deviation from plaintext XGBoost is only $\pm2\%$9 to $P_0$0 across the evaluated datasets (Song et al., 28 Jul 2025).

4. Compression-aware aggregation and end-to-end protocol flow

A second bottleneck in prior vertical secure GBDT systems is data inflation during gradient aggregation. Guard-GBDT exploits the fact that $P_0$1, so only the sign and fractional part carry information. Rather than masking every gradient with a full $P_0$2-bit share, its aggregation protocol $P_0$3 masks into a compact ring with $P_0$4. Preprocessing generates masks $P_0$5, $P_0$6, together with auxiliary values $P_0$7, $P_0$8, and $P_0$9, all secret-shared to the parties (Song et al., 28 Jul 2025).

Online, each party exchanges only a masked indicator bit and a compact masked gradient:

$P_1$0

After reconstructing $P_1$1 and $P_1$2, the parties upcast to the $P_1$3-bit ring and compute $P_1$4 exactly, using the preprocessed masks and local arithmetic. The key bandwidth effect is explicit: compared with full $P_1$5-bit masking, the exchange saves $P_1$6 bits per gradient element. Accuracy is unchanged because the upcast preserves exact arithmetic over $P_1$7, and the paper states that security is unchanged as well (Song et al., 28 Jul 2025).

The full protocol has a clear offline–online decomposition. Offline, the STP generates Beaver triples, DCF keys for the sigmoid LUT, leaf-weight LUT, and Argmax, compact masks for $P_1$8, and the LUT tables themselves. Online, training proceeds tree by tree. First, the current ensemble score is computed by secret-shared inference over the already built trees, using the path vector method. Then $P_1$9 is computed from the sigmoid LUT, followed by

$N$0

For each feature $N$1 and bin threshold $N$2, the owner locally tests against $N$3, produces a secret-shared test indicator, derives left and right membership vectors, aggregates $N$4 with $N$5, evaluates the division-free gain, and participates in a secure Argmax over all $N$6 candidates. The split owner is then identified by opening a comparison bit on the feature index; only the owner opens the winning feature and threshold and updates the sample space for the children. At leaves, the protocol aggregates $N$7 and computes the approximated leaf weight through the LUT (Song et al., 28 Jul 2025).

The round complexity per node drops to $N$8, in contrast to the $N$9 or $P_1$0 expressions reported for the previous systems to which Guard-GBDT is compared (Song et al., 28 Jul 2025).

5. Empirical performance and comparison with prior frameworks

The implementation is a PyTorch prototype with $P_1$1, $P_1$2, FSS security parameter $P_1$3, and lookup segment count $P_1$4, which the paper reports as empirically best. Evaluation uses five real-world datasets—Breast Cancer $P_1$5, Credit $P_1$6, Phishing $P_1$7, Skin $P_1$8, and Covertype $P_1$9—under simulated LAN with RTT $12.21\times$00 ms and $12.21\times$01 Gbps, and simulated WAN with RTT $12.21\times$02 ms and $12.21\times$03 Mbps (Song et al., 28 Jul 2025).

Framework	Cryptographic mechanism	Stated bottleneck
HEP-XGB	Paillier PHE + ASS	2048-bit ciphertext inflation; Goldschmidt division; rough sigmoid approximation
SiGBDT	ASS + FSS	Taylor/exp and division; $12.21\times$04-bit masking of gradients and Hessians
Guard-GBDT	ASS + FSS	LUT-based sigmoid and leaf weights; division-free gain; compact masking with $12.21\times$05

Accuracy is reported across tree depths $12.21\times$06 and tree counts $12.21\times$07. Guard-GBDT matches SiGBDT and plaintext XGBoost within $12.21\times$08 to $12.21\times$09 and is consistently better than HEP-XGB. Representative examples given in the paper are Breast Cancer at $12.21\times$10, where Guard-GBDT achieves $12.21\times$11 versus SiGBDT $12.21\times$12 and HEP-XGB $12.21\times$13, and Phishing at $12.21\times$14, where it achieves $12.21\times$15 versus $12.21\times$16 and $12.21\times$17. On Skin and Covertype, the reported accuracy is $12.21\times$18 across settings and is insensitive to segmentation $12.21\times$19, whereas smaller datasets stabilize for $12.21\times$20 to $12.21\times$21 (Song et al., 28 Jul 2025).

The microbenchmarks isolate the algorithmic changes. For input size $12.21\times$22, the division-free gain is reported as $12.21\times$23 to $12.21\times$24 faster than SiGBDT and HEP-XGB in LAN, and $12.21\times$25 to $12.21\times$26 in WAN. Gradient aggregation yields $12.21\times$27 and $12.21\times$28 speedups over SiGBDT and HEP-XGB in LAN, and $12.21\times$29 and $12.21\times$30 in WAN (Song et al., 28 Jul 2025).

In end-to-end training for one tree, Guard-GBDT is up to $12.21\times$31 faster than SiGBDT and up to $12.21\times$32 faster than HEP-XGB on LAN; on WAN, the reported maxima are $12.21\times$33 and $12.21\times$34. The communication reduction is also explicit: on Breast Cancer, Guard-GBDT uses $12.21\times$35 MB, which is $12.21\times$36 less than SiGBDT and $12.21\times$37 less than HEP-XGB; on Covertype, the savings are $12.21\times$38 and $12.21\times$39, respectively. For training $12.21\times$40 trees, the LAN speedups reach $12.21\times$41 versus SiGBDT and $12.21\times$42 versus HEP-XGB on Breast Cancer, while WAN results include $12.21\times$43 and $12.21\times$44 on the same dataset. The paper also reports $12.21\times$45 GB communication for Breast Cancer in the $12.21\times$46-tree setting, which is $12.21\times$47 less than SiGBDT and $12.21\times$48 less than HEP-XGB (Song et al., 28 Jul 2025).

Synthetic scalability results show similar trends. For one tree with $12.21\times$49k, $12.21\times$50, $12.21\times$51, $12.21\times$52, Guard-GBDT is $12.21\times$53 and $12.21\times$54 faster than SiGBDT and HEP-XGB; for $12.21\times$55k, the factors become $12.21\times$56 and $12.21\times$57; for $12.21\times$58, they are $12.21\times$59 and $12.21\times$60. Communication reductions at the baseline configuration are reported as $12.21\times$61 versus SiGBDT and $12.21\times$62 versus HEP-XGB, with larger reductions at larger scales (Song et al., 28 Jul 2025).

6. Security guarantees, limitations, and relation to adjacent work

The paper gives formal security statements for the LUT-based sigmoid protocol, the LUT-based leaf-weight protocol, and $12.21\times$63, under the assumption that ASS arithmetic and FSS DCF are secure. By sequential composition, the full training protocol inherits simulation-based security in the semi-honest model. The compression step does not weaken the masking guarantee: the stated adversarial success probability for guessing masked values remains $12.21\times$64, the same as standard masking of the informative sign and fractional bits (Song et al., 28 Jul 2025).

The framework also has explicit limits. It is a two-party system in its primary form. Its experimental focus is binary classification with logistic loss. The paper states that regression with MSE is simpler in MPC because $12.21\times$65 and no sigmoid or division is needed, while multi-class learning would require multi-sigmoid or softmax approximations and is left for future work. DCF key size grows linearly with the number of segments, so the segment count cannot be increased without cost; the reported experiments indicate that $12.21\times$66 suffices in practice. The use of an STP is restricted to input-independent randomness generation, and the paper notes that this role can be instantiated by generic 2PC or multi-party OT to avoid trust if needed (Song et al., 28 Jul 2025).

Several neighboring lines of work illuminate what Guard-GBDT does and does not solve. Anonymous two-party GBDT addresses hidden identifiers and hidden alignment rather than the aligned vertical setting assumed here (Chenyu et al., 26 May 2026). FairGBM studies fairness-constrained GBDT training via a proxy-Lagrangian dual ascent framework, targeting criteria such as demographic parity, equality of opportunity, predictive equality, and equalized odds rather than cryptographic privacy (Cruz et al., 2022). Separate work on backdoor attacks against GBDT and DNN models in insurance shows that tabular GBDT systems can remain vulnerable to training-time poisoning even when predictive performance is preserved, especially in some regression settings (Kühlem et al., 2024). A plausible implication is that efficient secure vertical training, identifier anonymity, fairness constraints, and robustness against poisoning are complementary rather than interchangeable design goals.

Within that broader landscape, Guard-GBDT is most precisely understood as an efficiency-oriented privacy-preserving vertical GBDT framework. Its contribution is not merely to accelerate prior MPC constructions, but to change the algebra of secure training so that the dominant non-linear operations are replaced by FSS-driven lookup selections and the dominant communication pattern is replaced by compact exact masking.