# Practical Anonymous Two-Party Gradient Boosting Decision Tree

arXiv: https://arxiv.org/abs/2605.26903 · HTML: https://mlsanity.com/paper/2605.26903/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 68 references that are in the map.
- First posted on arXiv 26 May 2026.

## Builds on (most cited first, 13 of 13)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Distributed learning of deep neural network over multiple agents](https://mlsanity.com/paper/1810.06060/) (2018)
- [SecureBoost: A Lossless Federated Learning Framework](https://mlsanity.com/paper/1901.08755/) (2019)
- [Privacy Preserving Vertical Federated Learning for Tree-based Models](https://mlsanity.com/paper/2008.06170/) (2020)
- [CrypTFlow2: Practical 2-Party Secure Inference](https://mlsanity.com/paper/2010.06457/) (2020)
- [Large-Scale Secure XGB for Vertical Federated Learning](https://mlsanity.com/paper/2005.08479/) (2020)
- [Vertical Federated Learning without Revealing Intersection Membership](https://mlsanity.com/paper/2106.05508/) (2021)
- [TitAnt: Online Real-time Transaction Fraud Detection in Ant Financial](https://mlsanity.com/paper/1906.07407/) (2019)
- [Federated Transformer: Multi-Party Vertical Federated Learning on Practical Fuzzily Linked Data](https://mlsanity.com/paper/2410.17986/) (2024)
- [Eliminating Label Leakage in Tree-Based Vertical Federated Learning](https://mlsanity.com/paper/2307.10318/) (2023)
- [SoK: Privacy-Preserving Collaborative Tree-based Model Learning](https://mlsanity.com/paper/2103.08987/) (2021)
- [Efficient decision tree training with new data structure for secure multi-party computation](https://mlsanity.com/paper/2112.12906/) (2021)
- [Ents: An Efficient Three-party Training Framework for Decision Trees by Communication Optimization](https://mlsanity.com/paper/2406.07948/) (2024)

## Abstract (arXiv)

Structured data is well handled by gradient-boosted decision trees (GBDT), which are usually trained on vertically partitioned features across mutually distrustful parties. High speed and interpretability make GBDTs popular in finance and healthcare, where neural networks may fall short. Enabling secure computation for GBDTs poses unique challenges, requiring secure record alignment for comparison. Relying on private set intersection (PSI) is a de facto approach. Mistaking PSI for a safety measure actually exposes which record identifiers (IDs) are shared between the datasets. Although circuit-PSI could help, it is costly for generic uses. New ideas are needed to efficiently train in a "dark forest". Aiming to hide the IDs, we initiate the study of anonymous GBDT training on split data held by two parties. Dual circuit-PSI in our design lets the parties alternate as receiver to run pick-then-sum over local features. Via oblivious programmable pseudorandom functions, we propagate circuit-PSI outputs as shared state across runs. Avoiding universal alignment, we resolve the neglected dilemma that ID hiding incurs a cost that scales with domain size. Next, we halve the cost of ciphertext packing used to convert single-instruction multiple-data homomorphic encryption from (ring) learning with errors in prior secure GBDT (Usenix Security' 23) and related secure machine-learning computations. Comparative experiments show our protocol remains competitive with leaky approaches in efficiency. Enabling ID-hiding aggregation, our techniques can extend to other vertically partitioned analytics.