Barriers to the Practical Adoption of Federated Machine Learning in

Cross-company Collaborations

Tobias M

¨

uller

1,2

, Nadine G

¨

artner

1

, Nemrude Verzano

1

SAP SE, Dietmar-Hopp-Allee 16, 69190 Walldorf, Germany

nologies could enable cross-company collaboration, which yields the potential of overcoming the persistent

bottleneck of insufficient training data. Despite vast research efforts and potentially large benefits, these tech-

nologies are only applied rarely in practice and for specific use cases within a single company. Among other

things, this little and specific utilization can be attributed to a small amount of libraries for a rich variety of

privacy-enhancing methods, cumbersome design of end-to-end privacy-enhancing pipelines and unwieldy cus-

tomizability to needed requirements. Hence, we identify the need for an easy-to-use privacy-enhancing tool

to support and enable cross-company machine learning, suitable for varying scenarios and easily adjustable

to the desired corresponding privacy-utility desiderata. This position paper presents the starting point for our

future work aiming at the development of the described application.

1 PROBLEM STATEMENT

which are trained to identify patterns based on the col-

lected data and then act according to some predefined

rules. These systems allow companies to design better

products, optimize processes and enhance resilience

along the digital supply chain without the need of hu-

man intervention (Ivanov et al., 2019).

However, the complexity of AI models tends to in-

crease as problems get more complicated. The com-

mon ground of training complex AI systems is the re-

quirement for large and diverse datasets. The require-

kets provide a possible approach for enabling cross-

company collaboration (Ohrimenko et al., 2019).

Representatives from business, politics, and sci-

ence have recognized the added value and poten-

tial economic benefit of said data markets and there-

fore recently supported major multi-national projects

that provide a common digital infrastructure for data-

sharing. Initiatives like International Data Spaces As-

sociation (IDSA), GAIA-X or the automotive-related

Catena-X aim to enable cross-company collaboration

in a shared environment of trust. This work takes

tellectual property is a critical barrier in the users’

willingness to participate in collaborative information

sharing (Schomakers et al., 2020). In addition to pre-

venting privacy breaches, these systems also have to

ensure legal compliance e.g. with GDPR regulations.

It is usual practice to anonymize or pseudo-

anonymize sensitive data at the originating institu-

tion, before transmitting the data to a central location,

where it is stored, analyzed and used for model train-

ing (Sheller et al., 2020). However as seen in the infa-

using only anonymization has proven to be insuffi-

cient against re-identification attacks. Consequently,

a multitude of privacy-enhancing techniques (PETs)

recently emerged from this problem, each with a vary-

ing scope and for differing privacy concerns. For an

extensive overview of PETs in IoT data markets we

refer the reader to the work of (Garrido et al., 2021).

of the machine learning model from the model owner

and trains it locally. After local training, the result-

ing update gradients are shared with the model owner,

which then updates the centralized model through the

accumulated gradients (Kone

ˇ

cn

´

y et al., 2015; Hard

et al., 2018). By this, sensitive data never leaves

the users’ device. However, further privacy risks like

model stealing or reverse-engineering of training data

arise when applying federated learning (Gonc¸alves

little practical application. When applied, PETs are

only utilized for specific scenarios and with no gen-

eral, generic adaption. The factor, that PETs are un-

wieldy for non-experts is the reason for this observa-

tion (Renaud et al., 2014; Gerber et al., 2019). Most

methods lack a reusable library or the required com-

bination of anonymization and secure computation

(Garrido et al., 2021). Therefore, multiple approaches

have to be reasonably combined when data of multi-

institutional sources have to be processed. Designing

vacy over high utility. To make informed trade-off

decisions, users need to know the specifics about

the underlying architecture and implemented PETs.

Again, this might be cumbersome, especially for non-

experts.

Lastly, the composition of data sources, model

owners and stakeholders varies with each use case.

Each scenario also brings different data structures,

which results in the need for interchangeable machine

learning models depending on the use case.

This position paper presents the starting point for

our future work aiming to lower the hurdle for users

to practically deploy privacy-enhancing techniques to

enhance trust and accordingly support collaborative,

cross-company machine learning.

Thus we can summarize the challenges and the

goals of a possible application as follows:

ferent scenarios with varying model owners, data

sources and machine learning models.

After an initial technology, we seek to evaluate

and compare existing PETs and group them accord-

ing to performance indicators like the achievable

degree of privacy, addressed privacy concern, com-

putational overhead and adaptability. We also plan to

benchmark existing libraries in the process and derive

capabilities and limitations of existing technologies,

2 PRELIMINARIES

need to anticipate low levels of participation as well as

statistical and systems heterogeneity (Li et al., 2020).

to be determined. But we argue, that these obser-

vation also applies to industrial machine learning

practices which results in a need for generically

and easily usable privacy-enhancing framework for

collaborative data processing.

3 EXISTING APPROACHES

In this section, we will present an initial technology

overview for privacy-enhancing data processing, in-

cluding a first discussion about their respective ben-

efits, limitations and assessment of utility for our

or re-identification by protecting direct identifiers,

quasi-identifiers and sensitive attributes (Majeed and

Lee, 2020). Most anonymization techniques funda-

mentally rely on non-perturbative and perturbative

masking based on statistics, probability theory and

heuristics. Several approaches have been proposed in

the past (Salas and Domingo-Ferrer, 2018):

with ε as the likeliness of finding individuals and δ

as the possibility, by which outputs differ for different

datasets. Hence through differential privacy, an ad-

versary will essentially get the same inference about

any individual’s private information, which makes

cate the resulting update gradients of training deep

neural networks. This extension to traditional neu-

ral networks is one possibility to counteract reverse-

engineering of training data (Abadi et al., 2016).

Adding noise to data or to update gradients lowers the

degree of information and therefore the utility. How-

ever, the amount of noise can be easily customized,

which shifts the privacy-utility trade-off. Due to the

easy adaptability and broad applicability, we expect

DP to be a valuable technique for our project.

for k represents higher anonymity and consequently

a lower probability of correctly linking sensitive at-

tributes to an associated individual. However, finding

an optimal value for k with minimum information loss

is a NP-hard problem (Meyerson and Williams, 2004;

Liang and Samavi, 2020) and k-anonymity is not

secure against homogeneity attacks or background

knowledge attacks (Maheshwarkar et al., 2011).

Thus, multiple extensions have with further pri-

vacy requirements have been proposed. For instance,

l-diversity (Machanavajjhala et al., 2007) proposed to

have least l-different values in sensitive attributes or

t-closeness (Li et al., 2007) with the additional prop-

erty that the distance t between the distribution of sen-

sitive values within each class is less than or equal to

the overall dataset distribution of the attribute. Even

though, we also identified less prominent approaches

with less specific but semantically consistent value

which can be reverted back with the help of the origi-

These methods are mainly used to obfuscate the

input and output and therefore enhance privacy of the

input data and computational output. Of course, this

small list of privacy-preserving anonymization tech-

tude of cryptography-based methods have been pro-

posed not only to transfer data, but also for secure

data processing:

cryption (HE) is an encryption scheme, which al-

lows the computation of encrypted data, where the

output can be decrypted using the corresponding se-

cret key (Ogburn et al., 2013). Homomorphic en-

cryption schemes can be classified into fully homo-

morphic encryption (FHE), where both - addition

nearly identical results compared to training on non-

encrypted data. Evaluated on the CIFAR-10 dataset

(Krizhevsky, 2012), the model performed extremely

well with a high security level and classification ac-

curacy. The proposed model is still limited by com-

putational overhead and the runtime, which is about 4

hours to infer a single image (Lee et al., 2021). Con-

sequently, this technology is still impractical to use,

but might be promising after further research.

adversary can not obtain nontrivial information about

protocol, which enables multiple parties to perform

and evaluate computations without revealing any of

crets to each of the N computing parties according

to a selected secret sharing method.

sults and shares the results with the other comput-

ing parties.

all computing parties and computes a global re-

sult, which is then sent back to all participants.

Whereby additive secret sharing (Vaidya and

entail multiple rounds of interactive communica-

tion, which leads to a sensitivity to network latency.

Since machine learning frameworks can be integrated

(Knott et al., 2021) and because these SMPC proto-

cols target the problem of keeping the input private

and of ensuring correctness, SMPC might be a valu-

able technique for our project.

1990). ZKPs can be distinguished into interactive

ZKPs where a sequential message exchange is re-

Moreover, we want to present trusted execution envi-

ronments (TEE), which is a combination of hardware

and software components and allow users to define

secure areas of memory (enclaves) that enhance con-

fidentiality, as well as the data and computation in-

tegrity. These processing environments are isolated

and thus impede other programs outside the enclave

to act on the data (Sabt et al., 2015). These environ-

ments should be secure against sophisticated attacks

vide false certifications (Colman et al., 2019).

However, there is no standardization and most

open-source proposals lack maturity. Hardware and a

trusted third party might be needed, which introduces

a single point of failure (Shepherd et al., 2016; Busch

et al., 2020) and reduces the usefulness for our in-

tentions. Proprietary solutions like the Intel Software

Guard Extension (SGX) (Anati et al., 2013), where

Intel is the trusted third party and therefore single

point of failure have been mostly used due to the lack

of maturity of open-source protocols (Garrido et al.,

2021). As a fallback, TEEs could help enable secure

centralized machine learning, in case it turns out that

4 RELATED WORK

From recommender systems for videos (Duan et al.,

2020), payments in smart finance (Liu et al., 2020) to

predicting the energy demand of electric vehicle net-

works (Saputra et al., 2019), federated learning has

Most work on multi-institutional machine learn-

ing has been made in medical research (Sheller et al.,

2020; Sarma et al., 2021; Guo et al., 2021). Notably,

Kaissis et al. (2021) recently presented PriMIA, an

end-to-end privacy-preserving deep learning frame-

work for medical imaging on multi-institutional data.

Combining federated learning, secure multi-party

computation and differential privacy, the authors have

been able to prevent model inversion attacks with

comparable accuracy and reasonably longer (1.5-2.91

cases with certain privacy concerns. Hence, we iden-

tify a lack of a generally usable privacy-preserving

framework for collaborative processing of industrial

data.

5 CONCLUSION

We observe a reluctance of participating in collabo-

rative, cross-company machine learning due to high

privacy concerns. Since wary users value data pri-

vacy and data security over monetary benefits and

contractual agreements, we argue that the barriers to

small amount of available libraries and the momen-

tarily inevitable need for expert knowledge to adjust

these technologies to the desired needs given by each

use case.

Hence, this position paper represents the starting

point for our future work aiming towards a frame-

work, which enables non-experts to easily apply de-

responding methods. Naturally, this list is far from

complete and the approaches have yet to be thor-

oughly evaluated. The results of this evaluation will

provide the necessary basis for the application archi-

tecture and integration concept into distributed data

infrastructures.

ACKNOWLEDGEMENTS

The authors would like SAP SE and the Catena-X Au-

tomotive Network for supporting this work.

Anati, I., Gueron, S., Johnson, S. P., and Scarlata, V. R.

Collaboration and Internet Computing (CIC), pages

landscape of privacy-enhancing technologies in the

Goldreich, O. (1987). Towards a theory of software protec-

personalization paradox: Taxonomy and survey.

the art. In 2017 IEEE Conference of Russian Young

Li, N., Li, T., and Venkatasubramanian, S. (2007).

Liu, Y., Ai, Z., Sun, S., Zhang, S., Liu, Z., and Yu, H.

(2020). FedCoin: A Peer-to-Peer Payment System for

Lu, Y., Huang, X., Dai, Y., Maharjan, S., and Zhang,

Y. (2020). Blockchain and federated learning for

privacy-preserved data sharing in industrial iot. IEEE

Machanavajjhala, A., Kifer, D., Gehrke, J., and Venkita-

subramaniam, M. (2007). L-diversity: Privacy be-

yond k-anonymity. ACM Trans. Knowl. Discov. Data,

Maheshwarkar, N., Pathak, K., and Chourey, V. (2011). Pri-

vacy issues for k-anonymity model.

Majeed, A. and Lee, S. (2020). Anonymization techniques

for privacy preserving data publishing: A comprehen-

(2018). Supply chain collaboration and firm’s perfor-

Saputra, Y. M., Hoang, D. T., Nguyen, D. N., Dutkiewicz,

Sarma, K. V., Harmon, S., Sanford, T., Roth, H. R., Xu, Z.,

ticenter deep learning without data sharing. Jour-

nal of the American Medical Informatics Association,

28(6):1259–1264.

Schomakers, E.-M., Lidynia, C., and Ziefle, M. (2020). All

of me? users’ preferences for privacy-preserving data

markets and the importance of anonymity. Electronic

Sheller, M., Edwards, B., Reina, G., Martin, J., Pati, S.,

Kotrotsou, A., Milchenko, M., Xu, W., Marcus, D.,

in medicine: facilitating multi-institutional collabora-

Shepherd, C., Arfaoui, G., Gurulian, I., Lee, R. P., Markan-

177.

Baumbach, J. (2020). Privacy-preserving artificial in-

telligence techniques in biomedicine.

means clustering over vertically partitioned data. In

Proceedings of the Ninth ACM SIGKDD International

Conference on Knowledge Discovery and Data Min-

ing, KDD ’03, page 206–215, New York, NY, USA.

Association for Computing Machinery.

Woldaregay, A., Henriksen, A., Issom, D.-Z., Pfuhl, G.,

Sato, K., Richard, A., Lovis, C., Arsand, E., Rochat,

J., and Hartvigsen, G. (2020). User expectations and

Zhang, J., Fang, Z., Zhang, Y., and Song, D. (2020). Zero

knowledge proofs for decision tree predictions and ac-

curacy. In Proceedings of the 2020 ACM SIGSAC

Conference on Computer and Communications Secu-

Association for Computing Machinery.

Zhou, J., Zhang, S., Lu, Q., Dai, W., Chen, M., Liu, X., Pirt-

tikangas, S., Shi, Y., Zhang, W., and Herrera-Viedma,

plications for accelerating industrial internet of things.