Label Owner

The label owner defines and executes the vertical training protocol, the precise sequence of steps for a federated round. This involves:

• Coordinating the entity alignment phase with feature owners.
• Initiating each training iteration by signaling feature owners to begin their local forward propagation.
• Receiving and processing encrypted intermediate outputs from feature owners.
• Calculating the final loss and initiating the vertical backpropagation of gradients. This role requires managing the state and synchronization of all participating parties to ensure correct, sequential computation.

In the common split neural network architecture, the label owner hosts the top portion of the model, typically from the cut layer to the final output layer. Its core computational duties are:

• Completing the forward pass using received intermediate outputs to compute predictions and the final loss function.
• Calculating the initial gradients for backpropagation.
• Updating the parameters of its portion of the model. This segment often contains the most sensitive layers, as its inputs are aggregated features that could be reverse-engineered to reveal private data, necessitating robust privacy safeguards.

As the aggregator of sensitive intermediate data, the label owner is responsible for implementing privacy-preserving mechanisms to prevent data leakage. Key techniques include:

• Employing homomorphic encryption to perform computations on encrypted intermediate outputs from feature owners.
• Utilizing secure multi-party computation (MPC) protocols for vertical gradient computation.
• Applying differential privacy by adding calibrated noise to its gradient updates before sharing them with feature owners.
• Coordinating vertical secure aggregation protocols to combine updates without exposing individual contributions. This creates a trusted but privacy-conscious central point for the federation.

Before training can begin, the label owner must collaborate with feature owners to identify the overlapping set of entities (e.g., common user IDs) across all vertically partitioned datasets. This involves:

• Coordinating the use of cryptographic Private Set Intersection (PSI) protocols to find the intersection of entity IDs without revealing non-overlapping entries.
• Establishing and maintaining the aligned sample order for the duration of training.
• Potentially handling secure entity resolution for more complex matching scenarios beyond simple IDs. Successful alignment is foundational; errors here corrupt the entire model, as features and labels would be mispaired.

The label owner uniquely defines the machine learning task because it holds the ground truth. Its responsibilities include:

• Specifying the loss function (e.g., cross-entropy, mean squared error) that all parties optimize towards.
• Selecting and calculating model evaluation metrics (e.g., accuracy, AUC-ROC, F1-score) on a private validation set.
• Monitoring for signs of non-IID data effects or potential data poisoning attacks from malicious participants.
• Assessing model fairness and bias, which can be challenging when the full feature set is not centrally visible.

After training, the label owner operates the vertical inference protocol to make predictions on new data. This requires:

• Receiving and processing encrypted or protected intermediate outputs from feature owners for the new data samples.
• Executing its portion of the trained model to generate the final prediction.
• Returning the prediction result to the authorized requester (which may be one of the feature owners or an external client). This process must maintain the same privacy standards as training, ensuring feature data is not exposed during prediction.

A bank, as the Label Owner, holds the target variable (e.g., loan default status). It orchestrates training with Feature Owners like a telecommunications company (call patterns, payment history) and a utility provider (bill payment consistency).

• The bank uses Private Set Intersection (PSI) to align common customers without revealing non-intersecting lists.
• It trains a split neural network, receiving encrypted intermediate outputs from feature owners to compute loss and initiate vertical backpropagation.
• This creates a more robust risk model without any party sharing raw customer data.

A central research hospital, as the Label Owner, holds confirmed patient diagnoses. It collaborates with Feature Owners such as local clinics (patient vitals, basic history) and genomic testing labs (genetic marker data).

• The label owner manages the vertical training protocol, ensuring compliance with regulations like HIPAA or GDPR.
• Homomorphic encryption or secure multi-party computation (MPC) is used to protect the intermediate data flows.
• The resulting model can predict disease risk more accurately by leveraging diverse, distributed feature sets while keeping sensitive health information localized.

An e-commerce platform, as the Label Owner, holds the target (e.g., total customer spend). It federates training with a social media company (engagement metrics, ad clicks) and a payment processor (transaction frequency, basket size).

• The platform's role involves heavy entity alignment to match user IDs across datasets pseudonymously.
• It handles the aggregation of gradients via vertical secure aggregation protocols to update the shared model component it hosts.
• This enables hyper-personalized marketing strategies without directly pooling competitive consumer data.

A credit card network, as the Label Owner, holds labels for fraudulent transactions. It collaborates with partner banks (account features) and online merchants (purchase behavior features).

• The label owner is responsible for the vertical inference protocol, allowing real-time fraud scoring during a transaction without exposing any single party's full data view.
• It must implement robust federated learning attack mitigation to prevent adversarial feature owners from poisoning the model.
• This creates a powerful, unified fraud detection system that outpaces what any single entity could build alone.

Beyond holding labels, the Label Owner is typically the system orchestrator. Its core technical duties include:

• Protocol Execution: Managing the sequence of vertical forward propagation and vertical gradient computation.
• Aggregation: Serving as the aggregation server for updates from feature owners, often using Vertical Federated Averaging (VFA).
• Privacy Enforcement: Implementing and auditing privacy-preserving vertical FL techniques like differential privacy on aggregated updates.
• Model Management: Hosting the final, global model and coordinating its deployment for secure vertical inference.

Label Owners leverage specialized Vertical FL frameworks to manage complexity. These platforms abstract the cryptographic and communication overhead.

• FATE (Federated AI Technology Enabler): An open-source project providing a complete VFL pipeline with built-in PSI, homomorphic encryption, and split neural network support.
• PySyft with PyGrid: Libraries for secure, private deep learning that enable the definition of a cut layer and automate encrypted gradient exchange.
• Google's Private Join and Compute: A tool specifically for the entity alignment and secure aggregation phases critical to the label owner's setup tasks.

These tools handle the heavy lifting of vertical communication overhead and vertical computation overhead, allowing the label owner to focus on business logic.

A Feature Owner is a participant in a Vertical Federated Learning (VFL) system that possesses a distinct subset of the input features (columns) for the aligned set of entities but does not hold the target labels. They are the counterpart to the Label Owner.

• Role: Computes the initial layers of a split neural network on their local features.
• Interaction: Securely sends intermediate outputs to the Label Owner for the forward pass and receives gradients during backpropagation.
• Example: A bank (Feature Owner) holds customer credit history, while an e-commerce platform (Label Owner) holds purchase labels; they collaborate to build a fraud detection model.

A Vertical Data Partition is the foundational data structure for VFL, where different features (columns) describing the same entities (rows) are held by different organizations.

• Structure: The complete feature space is sliced vertically across parties.
• Contrast with Horizontal FL: In Horizontal FL, different parties hold different rows (samples) with the same features.
• Alignment Requirement: Requires entity alignment to match which rows correspond to the same customer or device across databases before training can begin.

Entity Alignment is the privacy-sensitive process of identifying the overlapping set of entities (e.g., user IDs) across the vertically partitioned datasets held by different parties. It is a critical prerequisite for VFL.

• Purpose: Ensures the Label Owner and Feature Owners are training the model on the same set of users or devices.
• Methods: Often performed using cryptographic protocols like Private Set Intersection (PSI) or Secure Entity Resolution.
• Output: A cryptographically secure, aligned list of entity identifiers without revealing non-overlapping records.

A Split Neural Network is the standard model architecture used in VFL, where the neural network is divided into multiple segments hosted by different parties.

• Cut Layer: The specific layer where the model is split. Feature Owners compute the forward pass up to the cut layer.
• Label Owner's Role: Hosts the remaining layers from the cut layer to the output, using the received intermediate outputs to complete the forward pass, compute the loss, and initiate vertical backpropagation.
• Security: Intermediate outputs must be protected, often via encryption, to prevent reconstruction of raw feature data.

A Vertical Training Protocol is the defined sequence of communication and computation steps that coordinating parties follow to execute a complete training round in VFL.

• Orchestration: Typically dictated by the Label Owner, which acts as the training coordinator.
• Steps per Round: 1) Feature Owners compute intermediate outputs. 2) Outputs are sent to Label Owner. 3) Label Owner completes forward pass, computes loss & gradients. 4) Gradients are sent back to Feature Owners. 5) All parties update their respective model segments.
• Security Integration: The protocol incorporates steps for vertical secure aggregation or homomorphic encryption to protect data in transit.

Vertical Federated Averaging (VFA) is a class of collaborative learning algorithms adapted for the vertical data partition setting, where model updates from Feature Owners are aggregated.

• Mechanism: Unlike Horizontal Federated Averaging (FedAvg) which averages entire models, VFA algorithms coordinate the averaging or updating of specific model segments (e.g., gradients for layers before the cut layer).
• Challenge: Must account for the statistical heterogeneity introduced by different feature distributions across owners.
• Goal: To converge on a global model that leverages all vertically partitioned features without centralizing the data.