Secure Federated Transfer Learning, Explained

By the RunLocalModel editorial team · October 14, 2026 · ~40 minute read

This page reads the author version: arXiv:1812.03337v2 (24 June 2020). The published paper is in IEEE Intelligent Systems (2020), DOI 10.1109/MIS.2020.2988525. The author version says changes were made before publication. Formula numbers, tables, and algorithms below follow the author version.

The hole this paper is filling

Machine learning eats labels. The paper opens with two familiar scales: AlphaGo's training data included about 160,000 games and 30 million moves, and ImageNet has more than 14 million images. Many businesses do not have that. Expert labels are expensive. The remaining features sit in different organizations. Under the EU GDPR, handing user records to another company is something you need consent for, item by item.

In 2016, McMahan and coauthors made federated learning a training procedure you could actually run: each party updates the model locally, the data stays put, and what leaves is the update. That framework needs everyone to have the same columns. Another line of work handles the cut the other way. Gascón and coauthors, for example, run secure linear regression on a table split by features. Both lines have a precondition. Either the columns match, or a large set of the same samples overlaps. Rows outside that overlap never enter the model.

FTL is aimed at what is left. The source domain has many labels. The target domain has few labels and different columns. Only a short stretch of samples is shared. Transfer learning carries knowledge across that bridge. Encrypted computation keeps the products on the bridge from exposing the raw rows. The authors are from WeBank, Shanghai Jiao Tong University, and the Hong Kong University of Science and Technology. In the 2019 survey Federated Machine Learning: Concept and Applications, Qiang Yang, Yang Liu, Tianjian Chen, and coauthors split federated learning into horizontal, vertical, and federated transfer. This paper is the training and prediction protocol for the third.

Three ways to cut the data

The protocol below serves the last row. The first two rows already have their own standard methods. Forcing FTL onto them makes a simple problem expensive.

Section 1 of the paper puts it this way: the first two kinds of federation leave the data off the bridge unused. If the set of common entities is small, the federation is less attractive, and most of the non-overlapping samples never shape the model. FTL uses transfer learning on those non-overlapping rows. Source labels that have no twin still shape what "positive" means. Target features that have no twin are what you eventually score. The few overlapping rows only pin the two spaces together.

What each organization actually holds

The paper calls the two sides A and B. The secret-sharing section switches to Alice and Bob. Same roles.

A is the source domain. Each row is a feature vector x^A and a label y^A, with labels in {+1, −1}, and there are N_A rows. B is the target domain. Each row is only a feature vector x^B, and there are N_B rows. In the experiments the column counts differ: on NUS-WIDE, A has 1,000 text-tag features and B has 634 low-level image features. The paper's notation writes both sides with one dimension. That is shorthand. The protocol does not require the raw columns to have the same length. What has to match is the embedding they are mapped into.

Two small aligned sets sit in the middle, and they do different jobs.

• Co-occurrence samples D_AB, N_AB pairs. The same person, or the same image, has features on both sides. These pairs are used to align embeddings. A pair does not have to carry a label.
• A small set of target labels D_c, N_c rows. These samples from B have answers, and the answers live with A. The supervised loss is added only on these N_c rows.

The paper does not invent a new way to match sample IDs without publishing the lists. They use the RSA Intersection module in FATE. That private set intersection is preprocessing. The contribution of this paper starts after the IDs line up.

Putting every label on A's side is an assumption the authors say loses no generality. If the labels sit with B, the derivation can be rewritten symmetrically. In a business this is a familiar split: A holds the outcome (defaulted or not, diagnosed or not), B holds a different set of process features, and the two sides can recognize only a few of the same people.

The security model is in section 3. The adversary is semi-honest and corrupts at most one of the two parties. Semi-honest means the party sends the messages the protocol requires, and also keeps the intermediate values and tries to infer the other party's data. The paper's security definition comes down to one sentence: once A's input and A's output are fixed, infinitely many inputs from B still lead to that same output. What A sees does not pin down B's raw table. The authors say this definition is looser than complete zero-knowledge, so that "how much is revealed" can be controlled.

The model does three things

First, both sides map features into one d-dimensional space. A's network Net^A turns x^A into an embedding u^A. B's network Net^B turns x^B into u^B. The two sides agree on d in advance. The paper says any symmetric feature transform can sit here. Neural networks are the choice that lets training run from the raw input all the way to the loss. The networks in the experiments are shallow: an autoencoder with one layer of 64 units, or two layers of width 128 and 64.

Second, score a point. The paper assumes the classes are linearly separable in this shared space, and then uses a translator with a fixed shape. Take all of A's embeddings, weight them by their labels, and average:

Φ^A = (1 / N_A) Σ_i y^A_i u^A_i

Positive samples pull the average one way. Negative samples pull it the other way. Φ^A is the direction those two centers define. Project one of B's embeddings onto that direction and you get a score:

φ(u^B) = Φ^A · u^B

The direction uses all of A's labeled samples, including rows that B does not have a twin for. That is how non-overlapping source data enters the model. Those rows do not align with anyone. They vote on which side of the space is the positive class.

Third, align. The two embeddings of a shared sample should land in comparable positions. Otherwise A's direction has no meaning in B's coordinates. The training objective is three terms:

L = L₁ + γ L₂ + (λ / 2) (L₃^A + L₃^B)

• L₁ is on the N_c labeled target samples. The loss is logistic: log(1 + exp(−y φ)). It asks the translator to be right on the only answers that exist.
• L₂ is on the N_AB shared samples. Typical choices are a negative inner product, or the squared distance between the two embeddings. For encryption, the paper needs the loss to split: a term that depends only on A, a term that depends only on B, and a coefficient κ times an inner product. Squared distance has exactly that shape. The lengths stay local. The cross term −2 u^A·u^B is what the two parties have to compute together.
• L₃ is weight decay on both sides' parameters.

γ decides how hard to pull the spaces into alignment. λ decides how hard to punish large weights. The experiment that checks the Taylor approximation sets γ to 0.05 and λ to 0.005, so alignment is an auxiliary term. The accuracy experiments choose both numbers by cross-validation.

During back-propagation, the part that involves the other party is the cross term on the embeddings. Once ∂L/∂u is computed at that interface, passing the gradient back to each layer's weights is each network's own chain rule. The inside of a convolution or a fully connected layer does not have to be encrypted. "Minimal modifications to the existing model structure," from the abstract, means this. The volume of ciphertext is set by N_c, N_AB, and d. A deeper network costs more local compute. What gets sent still depends mainly on the interface.

Why the logistic loss becomes a parabola

Additive homomorphic encryption can do two things: add ciphertexts, and multiply a ciphertext by a plaintext. It does not do exponentials, logarithms, or comparisons. The logistic loss contains an exp.

The paper takes a second-order Taylor expansion where the score is 0. With C(y) = −y and D(y) = y²:

ℓ(y, φ) ≈ ℓ(y, 0) + (1/2) C(y) φ + (1/8) D(y) φ²

∂ℓ/∂φ ≈ (1/2) C(y) + (1/4) D(y) φ

Written out, that is log 2 − (y/2) φ + (y²/8) φ². When the label is ±1, y² is always 1, so the quadratic term only punishes the absolute size of the score. The linear term is what carries the direction.

The difference from real logistic loss can be computed exactly. Real logistic loss goes to 0 when the sign is right and the model is confident, the gradient vanishes, and the score can be pushed very large. The derivative of the approximate loss is zero at φ = 2y. Hold the embedding fixed and look at one sample: the approximation pulls the score toward "correct sign, magnitude about 2," and the quadratic term pushes back if you go further. The two losses therefore stop at different minima. Figures 2(a) and 2(b) show that pattern. The loss falls at a similar rate, the final height differs, and the weighted F1 stays close. Going from one layer to two leaves this relationship in place. That run used 500 training samples and 1,396 overlapping pairs.

The paper compares this accuracy drop with work in the SecureML line, where the network itself is replaced by a low-degree polynomial so it can be encrypted, and argues that their drop is smaller. Table 1 supports a specific range: on these shallow networks and this metric, the Taylor version and true logistic loss have almost the same F1. The approximation itself caps confidence at a finite magnitude. If a task really needs a large logit, the parabola changes the training objective first.

The homomorphic version: encrypt only a few blocks at the interface

Section 5 writes [[·]]_A for a ciphertext under A's public key, and [[·]]_B for B's. Each round starts with both parties running their own networks locally and obtaining u^A and u^B. The raw features do not leave. What leaves are the interface quantities below, already aggregated.

A encrypts three blocks under A's own public key and sends them to B, so B can compute the gradient of Net^B:

1. (1/8) D(y) (Φ^A)^T Φ^A. One d×d matrix for each labeled target sample.
2. (1/2) C(y) Φ^A. A d-dimensional vector.
3. γκ u^A. The embeddings on the shared samples, used for the alignment term.

B encrypts four blocks under B's own public key and sends them to A, so A can compute the gradient of Net^A and the loss: the squared length of the embedding, the embedding itself, κ u^B, and B's weight-decay term as a single piece.

The party who receives the ciphertext multiplies it by their own plaintext and adds ciphertexts together, and ends up with a gradient that is still locked. They cannot open it. The key is on the other side. They then add a random mask of their own choosing, still under encryption, and send the masked ciphertext back to the key owner. The key owner decrypts, sees the gradient plus the random number, and sends that plaintext back. The owner of the mask subtracts the random number, obtains their real gradient, and updates their own weights. The next round uses a fresh mask. The loss is aggregated along the same path. When A sees convergence, A can tell B to stop.

So in one training round, each party ends holding the gradient of its own network. What the other party sees at decryption time is a masked number. The paper argues that this, plus "more unknowns than equations, so the solution is not unique" (citing Du, Han, and Chen, SDM 2004), means that A still cannot pin down B's input even while watching A's own gradient every round.

Who sees what at prediction time

Prediction in Algorithm 1 is shorter, and the information flow is worth reading line by line.

1. B runs B's network to get u^B, encrypts it, and sends it to A.
2. A multiplies that ciphertext by Φ^A, adds A's mask, and sends it back to B.
3. B decrypts, obtains "score plus mask," and sends that back to A.
4. A subtracts the mask, obtains the score φ, computes the label, and gives the label to B.

At the end, B has the label and A has φ for every row. φ is the inner product of Φ^A and u^B, the projection of the embedding onto one direction. A single projection does not recover the whole embedding, and it does not recover the raw features x^B. Something equally concrete: B cannot score offline. Φ^A lives with A. If A is offline, the translator is missing a half. The parameters are stored separately. Inference is done together.

Theorem 1 says: if the underlying additive homomorphic encryption scheme is secure, training and prediction are secure under the definition in section 3. The paper also writes down a malicious case. If A forges an input and leaves only one nonzero coordinate, A may learn the value of u^B at that coordinate. A still does not obtain x^B, and does not obtain B's weights. The prediction computed this way is wrong. The protocol does not put this case inside the security definition.

The secret-sharing version: multiply online, prepare the triples first

Section 6 splits every private number v into two shares. A holds one, B holds the other, and they add up to v. A share by itself is random. Addition, and multiplication by a public constant, need no communication. The operation the two parties have to negotiate is matrix multiplication.

Beaver triples are how they do it. The product to compute is P = MN. Ahead of time the two parties share random matrices D, E, and F, with F = DE. Online, they exchange shares of M−D and N−E, and so both learn two differences, δ and γ. D and E are one-time random masks, so δ and γ look random too. Then:

P = (D + δ)(E + γ) = F + Dγ + δE + δγ

δ and γ are public. D, E, and F are held as shares. Each term can be turned into a new share locally. One party subtracts the public product δγ. Add the two parties' shares and you have P. The online phase is light. The cost is offline: the triples have to be built first, and a triple is consumed when it is used. Use the same triple to mask two different multiplications and the two differences can be combined. The mask stops working.

Building a triple is itself a multiplication, so you cannot build triples out of triples. That would loop. In the offline phase the paper invites a third party, Carlos. A and B split the matrices again. Of the four cross products, one block is missing information on both sides. Carlos computes that block, splits the result into shares, and sends the shares back. Carlos sees shares. Theorem 2 says Algorithms 3 through 6 are information-theoretically secure against at most one passive adversary: anyone receives only one share of an additive secret sharing. Drop any share and the hidden value cannot be recovered.

That theorem holds when Carlos does not collude with A or with B. If Carlos colludes, Carlos's block plus the colluding party's own share can reconstruct the other party's matrix. The trust list for the secret-sharing version is therefore three parties. Carlos does not see the raw business tables, but Carlos has to be present offline, and Carlos cannot cooperate with either side. The paper also has Carlos prepare shares of zero matrices in various shapes, for aligning dimensions.

Training (Algorithm 5) splits the loss and the gradients into three piles: terms that belong only to A, terms that belong only to B, and cross terms that have to be multiplied. The cross terms go through the secure multiplication. Afterward both parties publish their shares of the loss, and each reconstructs the full L, which is how they decide whether to stop. Shares of a gradient are gathered by the owner of that parameter: B updates θ^B, A updates θ^A. Neither party sees the other's gradient. Both parties see the loss curve.

In the listing of Algorithm 5, "Bob updates θ^B" appears twice in the same iteration, with Alice's update in between. The surrounding text means each party updates its own weights with its own gradient. Implement the listing literally and B takes the same step twice. That reads as a repeated line in the algorithm box.

Prediction (Algorithm 6) uses the same secure multiplication for the product of Φ^A and u^B. A reconstructs the score, computes the label, and gives the label to B. A sees the score and B sees the label. That is the same information flow as the homomorphic version.

This section still uses the Taylor expansion. The reason the paper gives is a fair comparison with the homomorphic version. Addition and multiplication under secret sharing are exact. The approximation comes from the loss, not from the sharing. When the conclusion says secret sharing has "no accuracy loss," this is what that sentence refers to. The gap versus true logistic loss is still the parabola. Read it next to the TLL column of Table 1.

The authors also use an optimization from SecureML: each matrix can be masked by the same random matrix again and again. They say security is unaffected and efficiency improves a lot. The triples themselves are still consumed. The conclusion states the drawback directly. The online phase is fast because many triples have to be generated and stored offline.

The accuracy experiments: read the three abbreviations separately

Accuracy is measured on NUS-WIDE. The dataset is a Flickr collection assembled at the National University of Singapore, with 81 ground-truth labels, plus text tags and low-level visual features. A holds the 1,000 most frequent text tags, and the class labels. B holds 634 low-level features, including color histograms and color correlograms. This is one public image collection cut into a text view and an image view. The IDs already match. It simulates "the same object, different features."

The task is one-versus-rest binary classification on three of the most common labels: water, person, and sky. In each experiment the number of overlapping samples is half the number of samples in that category. N_c is 100 or 200. Each setting uses three random partitions. λ and γ are chosen by cross-validation.

The letters in the table are three algorithms. They are not three datasets.

• SST: secret sharing, with the Taylor loss.
• TLT: homomorphic encryption, with the Taylor loss.
• TLL: non-private transfer learning, with the true logistic loss. This is the column the abstract means by "non-privacy-preserving transfer learning."

The self-learning baselines do not see A's data: logistic regression (LR), a support vector machine (SVM), and a stacked autoencoder of the same structure as the transfer model, followed by a logistic layer (SAE). The table is weighted F1, mean ± standard deviation over three partitions. The numbers are from Table 1 of the paper.

Did encryption ruin the model? Look at the first three columns. On every row, SST, TLT, and TLL sit together. The gaps are about 0.01. The widest cell is sky with 100 labels: TLL is 0.713, TLT is 0.700, a difference of 0.013, still inside TLT's standard deviation of ±0.022. On person with 200 labels, SST and TLL are both 0.735. On this table, "the encrypted versions match non-private transfer learning, and the Taylor expansion barely moves F1" holds.

Did transfer help? Look at the gap to the last three columns. All six rows are above LR, SVM, and SAE. Against SVM the gap can be about 0.08: person, 100 labels, SST 0.703 versus SVM 0.619. Against LR it is smaller, about 0.01 to 0.035. On water with 100 labels, TLT's standard deviation is ±0.062, and that interval overlaps LR. Raising the label count from 100 to 200 raises F1 on all six rows.

Figure 2(c) varies only the number of overlapping pairs. The horizontal axis runs from about 500 pairs to about 4,000. Weighted F1 for transfer learning rises, and it stays above logistic regression. A longer bridge gives alignment more anchors. The figure is direct evidence that overlap helps, and direct evidence that overlap cannot be removed.

Two gaps remain in the table. First, the paper does not report precision, recall, or AUC for the positive class. Weighted F1 weights classes by how many samples they have, and the large "rest" class takes a lot of that weight. A score of 0.70 does not by itself mean "water" or "person" was recognized well. Second, the paper does not report what happens if the law allows the two tables to be joined on ID and a normal model is trained on all the columns. TLL measures encrypted versus non-private training on the same transfer objective. The price of privacy relative to simply merging the data is not answered by this experiment.

The paper describes the comparison with LR, SVM, and SAE as significantly better than self-learning. The direction is consistent across the six rows. The size depends on the baseline. Against non-private transfer learning, the scores are nearly level. Against a linear model that sees only about a hundred labels, the gain is small and the direction is stable, and on one row the uncertainty interval overlaps LR.

The timing experiments: secret sharing is one to two orders of magnitude faster

Timing is measured on the credit-card default data (Kaggle's Default of Credit Card Clients). After one-hot encoding there are 33 features and 30,000 rows. The authors assign each sample to A only, to B only, or to both, which creates a small overlap, and they also cut the feature space, so they can watch time as the number of columns grows. All labels sit with A. This experiment is about scaling. The F1 table above does not come from it.

Communication has a formula. The cost of a message from B to A is n (d² + d) c_t. n is the number of samples sent, d is the embedding dimension, and c_t is the size of one message. The other direction has the same order. The d² term comes from a d×d matrix at the interface, such as (Φ^A)^T Φ^A. FTL's premise is that n stays at "very little overlap," and under that premise the formula is on the protocol's side. Once d reaches the hundreds, the same formula becomes the bottleneck first.

A back-of-the-envelope use of the paper's formula, at a scale the paper did not run, shows the order of magnitude. Take n = 10,000 and d = 128. Then d² + d = 16,512, and one direction is 165.12 million elements. A Paillier ciphertext under a 2048-bit modulus is a number modulo n², about 512 bytes. One direction is about 85 GB per round, before the gradient comes back. The overlap has to stay in the range of the paper's experiments, tens to a few thousand, before this interface is light.

In the implementation, encryption, gradient calculation, and decryption run in parallel. The paper says 20 partitions are about 100 times faster than the sequential scheme. A 100-fold gain from 20-way parallelism is steeper than "the work split evenly into 20 pieces." It looks like a sequential implementation in which a batch of modular exponentiations, which could have run together, was queued. That factor compares two implementations. Do not multiply it into the absolute times below.

Table 2 is training time after parallelism, in seconds. The sample counts are small. They probe the slope. The paper does not say how many iterations these seconds cover, so treat them as the training times the paper reports, not as a per-step cost.

Homomorphic encryption rises with d, with the feature count, and with the overlap, and on these points the rise is roughly linear. From d = 15 to d = 40, time goes from 29 seconds to 101 seconds. Secret sharing goes from 2.41 seconds to 3.04 seconds. The cell with 140 overlapping samples and 146 seconds of homomorphic encryption corresponds to the smaller values of d in Figure 2(f) (the legend shows d = 5, 10, and 15). Do not multiply that cell by the d = 40 row.

The paper notes that if the other factors are held fixed, communication is O(d²), while secret sharing on the plots looks closer to linear, and very flat. Their explanation is that the computation is cheap enough that the quadratic term does not yet dominate the clock. As the feature count or the overlap keeps growing, the rate of increase in time is still slowing down. The engineering judgment in the conclusion can be taken as written. The homomorphic protocol is simple and computationally expensive. Secret sharing is one to two orders of magnitude faster at these sizes, the multiplications are exact, and the price is the offline triples.

Eight things worth keeping after you finish

1. The map still works. The translator was a choice of its time.

Same columns, different people: horizontal federation. Mostly the same people, complementary columns: vertical federation. A little overlap, different columns, labels concentrated on one side: this paper's problem. Later work that calls itself federated transfer learning often keeps this map. The loss is not always still Φ^A · u^B. Tie the map to this linear translator and you undersell the map and oversell the translator.

2. Overlap was shortened. It was not removed.

With no D_AB, the two embeddings have no shared anchor, and A's direction has no meaning in B's coordinates. With no N_c, the translator has no answer on the target side to correct against. Figure 2(c), where F1 rises with overlap, is that dependence. The paper criticizes older federation for leaving non-overlapping data unused, and then still needs a short overlap as a bridge. The progress is real. The length of the bridge becomes a condition that can be small and still has to be greater than zero. A cold start with zero overlap is outside this protocol.

3. "Almost no change to the network" is about the interface, and about this head.

Local back-propagation is a clean design. Once the interface gradient is computed, updates to the deep weights stay local, so the body of the network barely has to be rewritten for encryption. What is fixed is the head: a label-weighted source prototype, then an inner product with the target embedding. That makes the cross term an inner product and a Gram matrix, which is what homomorphic encryption and Beaver multiplication can accept. This is a transfer objective chosen for the shape of the protocol. It shows that this objective can be trained by two parties under the paper's security definition. It does not show that an arbitrary deep transfer model can reuse the same ciphertexts.

4. Quote the security result together with the definition, the number of rounds, and prediction.

The adversary is semi-honest, and at most one party. The definition is that the output does not uniquely determine the other party's input. Security of the homomorphic version is computational, and it rests on the encryption scheme. Security of the secret-sharing version, in Theorem 2, is information-theoretic, and it rests on the shares. Training runs for many rounds. Each round uses a fresh mask, and the protocol does that. A still accumulates A's own gradient every round, and the secret-sharing version also shows both parties the full loss. "More unknowns than equations" for a single round does not cover that whole transcript.

The hole for a malicious party is one the paper writes down: forge an input with a single nonzero entry, and you may learn one coordinate of the embedding. At prediction time A receives a score for every row. The score is an inner product. If that score is a default tendency or a diagnostic tendency, the source party is in the loop for every inference, and sees the result. For some businesses that is the point of the collaboration. For others it is a new privacy problem. The protocol keeps raw features and the other party's weights local. It does not keep the prediction visible only to the target party.

5. Read the secret-sharing seconds together with Carlos.

The two or three seconds of training time in Table 2 are the online phase, after the triples already exist. The third party who builds the triples must not collude. Storage grows with the number of iterations, the matrix shapes, and the number of samples. The conclusion lists this as the main drawback, and that judgment matches the structure of the protocol. Remark 1 allows the mask matrix to be reused. That changes how masks are generated. It does not turn one triple into something that can serve two different multiplications.

6. The Taylor expansion is why the protocol can run, and it is the boundary of the accuracy sentence.

Without the parabola, additive homomorphic encryption cannot touch the logistic loss. With it, the approximate loss on a single sample has zero gradient at a correct score of magnitude about 2, so overconfidence is held down, and the minimum differs from true logistic loss. On autoencoders of at most two layers, on weighted F1, and on these three common NUS-WIDE labels, the ranking after that cap barely moved. Change the metric, change the task, or push the scores larger, and it has to be measured again. "Almost lossless" is the conclusion of Table 1. The scope of the table is the scope of that phrase.

7. The external validity of the experiments stops at simulated splits and shallow networks.

The two sides of NUS-WIDE are two feature views of one image collection. The credit-card experiment cuts one table of 30,000 rows in half. Both are reasonable checks of the mechanism. Neither is yet a federation that two organizations would form naturally under the GDPR: mismatched IDs, noisy labels, and missing features are not in the experiment. The networks stop at two layers. The timing experiment uses at most 140 overlapping samples and an embedding dimension of at most 40. The formula n(d² + d) says what happens if you go up. Table 2 does not make that trip for you.

8. The protocol that is written down is two-party.

The abstract says the framework can be adapted to various secure multi-party tasks. The algorithms, both theorems, and every experiment in the body are A and B. A third party appears only while secret sharing builds triples offline, and that party does not hold a third business table. Keys, masks, and triples for more than two parties have to be redone. That is an extension. The paper does not do it.

What is still worth keeping

What is worth keeping is the split of labor. The large network stays inside each organization. Only products on a low-dimensional interface enter encryption or secret sharing. Once the gradient is back on the embedding, the rest of back-propagation is local. Finding the shared IDs uses private set intersection. The paper already hands that job to FATE's RSA Intersection and keeps it separate from the training protocol. The later mainstream for horizontal federation is secure aggregation, plus differential privacy when it is needed. Encrypting the gradients of vertical logistic regression became the engineering default in the FATE line. Those systems cover the first two rows of the map. This paper writes one trainable objective for the third row all the way through.

Beaver triples have not aged out. They are still a basic part of protocols in the SPDZ family. What has aged out is treating "a second-order Taylor expansion, plus Paillier, an embedding of a few dozen dimensions, and a two-layer network" as the default answer. If the embedding is the few hundred to a thousand dimensions that are common now, the paper's own communication formula objects first. Keep the overlap very small, and the formula is on the implementer's side.

Three sentences are enough:

• Shared samples are a bridge. The bridge can be short. It cannot be missing. Source labels with no overlap shape the direction. Target samples with no overlap are what you score.
• What gets encrypted is the product of the two embeddings. The body of the network stays local. The prediction head is written as a linear translator.
• Against non-private transfer learning, encryption in this paper does not wreck weighted F1. Against training after the two tables are merged, the paper reports no gap. The security guarantee stops at two semi-honest parties. The online speed of secret sharing also depends on an offline third party who does not collude.

How LLMs Are Trained on this site is about a dataset that sits in one place, and about how a model first reads and is then taught. The starting point here is different. The tables belong to two organizations from the beginning, the columns differ, the labels sit on one side, and what leaves is a ciphertext or a share at the interface.