Privacy-Preserving Vertical FL

Secure Multi-Party Computation (MPC) is a cryptographic framework that allows multiple parties to jointly compute a function over their private inputs while revealing only the final output. In VFL, MPC protocols enable collaborative gradient calculation and model updates without exposing raw features or intermediate results.

• Core Mechanism: Data is secret-shared or garbled, allowing computations to be performed on these disguised values.
• VFL Application: Used for secure entity alignment via Private Set Intersection (PSI) and for privacy-preserving forward/backward propagation in split neural networks.
• Guarantee: Provides information-theoretic or computational security, meaning privacy is guaranteed even against computationally unbounded or bounded adversaries, respectively.

Homomorphic Encryption (HE) is an encryption scheme that allows specific algebraic operations (e.g., addition, multiplication) to be performed directly on ciphertext. The decrypted result matches the result of the operations as if they had been performed on the plaintext.

• Core Mechanism: A feature owner encrypts its intermediate outputs (e.g., activations from the cut layer) before sending them to the label owner. The label owner can perform further model computations on these ciphertexts.
• VFL Application: Enables the label owner to compute loss and gradients without ever decrypting the feature owners' data. Partial or fully homomorphic schemes are used depending on the required operations.
• Trade-off: Provides strong cryptographic security but introduces significant computation and communication overhead due to ciphertext size and complexity of homomorphic operations.

Differential Privacy (DP) is a rigorous, mathematical framework that guarantees the output of a computation (e.g., a model update) does not reveal whether any single individual's data was included in the input dataset.

• Core Mechanism: Carefully calibrated random noise (e.g., Gaussian, Laplacian) is added to the shared information, such as gradients or intermediate outputs. The noise scale is determined by a privacy budget (epsilon, δ).
• VFL Application: Applied to the outputs shared by feature owners (e.g., embeddings) or to the aggregated updates to prevent reconstruction attacks and membership inference.
• Guarantee: Provides a statistical privacy guarantee that holds even if the adversary has arbitrary auxiliary information. It directly trades off privacy (epsilon) with model utility.

These are specialized cryptographic primitives for controlled information disclosure in distributed computations.

• Functional Encryption: Allows a party to decrypt a ciphertext to reveal only the result of a specific function on the underlying plaintext, and nothing else. In VFL, it could allow a label owner to learn only the aggregated gradient for a batch, not individual contributions.
• Secret Sharing: Splits a data secret into multiple shares distributed among parties. The original secret can only be reconstructed if a sufficient number of shares are combined. Threshold secret sharing is used in secure aggregation protocols to combine model updates without a central aggregator seeing any individual update in plaintext.
• Use Case: Forms the backbone of many vertical secure aggregation protocols, preventing the label owner or any single party from learning a feature owner's precise update.

A Trusted Execution Environment (TEE) is a secure, isolated area within a main processor (e.g., Intel SGX, AMD SEV) that guarantees the confidentiality and integrity of code and data executing inside it, even from the host operating system.

• Core Mechanism: Sensitive VFL computations (e.g., aggregation, activation computation) are performed within the TEE's encrypted memory enclave. Data is only decrypted inside this hardware-protected environment.
• VFL Application: Can be used by a central coordinator or by individual parties to handle plaintext intermediate results securely, simplifying protocol design compared to pure cryptography.
• Trade-off: Offers high performance relative to cryptographic techniques but relies on specific hardware and requires trust in the hardware vendor's implementation and attestation mechanisms.

In practice, VFL systems often combine multiple techniques in a hybrid approach to balance privacy, utility, and efficiency.

• MPC + DP: MPC provides secure computation, while DP adds a layer of statistical protection against potential protocol vulnerabilities or information leakage from the final model.
• HE + TEEs: Homomorphic encryption secures data in transit and during remote computation, while TEEs can be used for efficient decryption and final aggregation in a trusted zone.
• Design Principle: The choice of hybrid technique depends on the threat model (semi-honest vs. malicious adversaries), performance requirements, and the type of potential leakage (feature, label, or membership inference) being mitigated. For example, DP is particularly effective against reconstruction attacks on the label owner's data.

Multiple financial institutions (e.g., a bank and a credit card company) collaborate to build a more accurate credit risk model. Each holds different features—transaction history, loan repayment data, credit line usage—for the same customers. Using Private Set Intersection (PSI) for entity alignment and homomorphic encryption for secure gradient computation, they train a model that predicts default risk without any bank exposing its proprietary customer data.

A hospital, a genomics lab, and an insurance provider collaborate to improve disease prediction. The hospital holds medical images and lab results, the lab holds genomic sequences, and the insurer holds longitudinal treatment and outcome data. Privacy-preserving VFL allows training a multimodal diagnostic model. Techniques like differential privacy are applied to gradients to prevent leakage of rare genetic markers or specific patient outcomes, ensuring compliance with HIPAA and GDPR.

An e-commerce platform, a social media company, and a payment processor aim to build a unified customer preference model. Each possesses a vertical slice of user behavior: purchase history, social engagement, and spending patterns. Through secure entity resolution and a split neural network, they generate personalized product recommendations. The cut layer outputs are encrypted, ensuring the social media company cannot infer specific purchases, and the payment processor cannot learn browsing habits.

A digital wallet app, a cryptocurrency exchange, and a traditional bank collaborate to detect sophisticated, cross-platform fraud schemes. Each entity observes different signals—login device history, crypto transaction graphs, and wire transfer patterns. A vertical training protocol using Secure Multi-Party Computation (MPC) enables the joint training of an anomaly detection model. This identifies complex fraud patterns invisible to any single party, while cryptographic guarantees prevent leakage of legitimate user transaction graphs.

Different municipal departments or utility companies hold sensor data from vertically partitioned sources—traffic cameras (transport department), air quality sensors (environment agency), and smart meter readings (energy utility)—all relating to the same city zones and time periods. Privacy-preserving VFL enables training models for urban planning, congestion prediction, or energy demand forecasting. The intermediate outputs from each party's model segment are aggregated without revealing raw sensor feeds, which may contain sensitive locational data.

A manufacturer, a logistics provider, and a retailer collaborate to optimize inventory and delivery routes. They hold different features for the same products or shipments: production quality data, real-time GPS logistics data, and point-of-sale demand data. Using a vertical inference protocol, they can run predictive models for delivery delays or stock-outs. Vertical secure aggregation ensures the manufacturer cannot deduce the retailer's profit margins, and the logistics provider cannot access proprietary production specifications.

A cryptographic scheme that allows computations to be performed directly on encrypted data. In VFL, it enables the label owner to compute gradients and losses on encrypted intermediate outputs from feature owners, ensuring raw features are never decrypted during training.

• Key Property: The result of computations on ciphertext, when decrypted, matches the result of operations on the plaintext.
• VFL Application: Often used to secure the forward and backward passes between parties, particularly for calculations involving the cut layer outputs and gradients.

A cryptographic protocol that enables a group of distributed parties to jointly compute a function over their private inputs while revealing only the final output. In VFL, MPC protocols coordinate the training of the split neural network.

• Core Principle: No single party learns anything about another's private data beyond what can be inferred from the final model.
• VFL Role: Manages the secure exchange and computation of intermediate results and gradients across feature and label owners, forming the backbone of many vertical training protocols.

A rigorous mathematical framework that guarantees the output of a computation (e.g., a model update) does not reveal whether any specific individual's data was included in the input. In VFL, DP is applied to shared information like gradients or intermediate outputs.

• Mechanism: Achieved by adding carefully calibrated statistical noise (e.g., Gaussian, Laplacian) to the values being shared.
• VFL Application: Provides a quantifiable, worst-case privacy guarantee against inference attacks, often used in conjunction with cryptographic methods like secure aggregation.

A foundational cryptographic protocol for the entity alignment phase of VFL. It allows two or more parties holding private sets of entity identifiers (e.g., user IDs) to compute the intersection of their sets without revealing any identifiers not in the common set.

• Critical Prerequisite: Enables parties to discover their overlapping samples to form the training cohort without leaking their full customer lists.
• Efficiency: Modern PSI protocols (e.g., based on Oblivious Transfer) are highly optimized for large datasets, making practical VFL initialization possible.

A protocol for combining multiple private values (e.g., model updates from clients) into an aggregate sum without revealing any individual value. In horizontal FL, it's used for gradient aggregation; in VFL, it can secure the combination of updates from multiple feature owners.

• Key Technique: Often employs masking with secret sharing, where clients add a secret mask to their update that cancels out when all masked updates are summed.
• VFL Benefit: Prevents the label owner or any feature owner from learning the specific contribution of another participant, protecting feature data patterns.

A secure, isolated area within a main processor (CPU) that guarantees code and data loaded inside are protected with respect to confidentiality and integrity. In VFL, TEEs can act as a neutral, hardware-based arbiter.

• VFL Application: The split model's cut layer logic or aggregation functions can be executed inside a TEE. Feature owners send encrypted intermediate outputs to the TEE, which decrypts, computes, and re-encrypts results, shielding data from the host system (including the label owner).
• Trade-off: Reduces complex cryptographic overhead but relies on specific hardware (e.g., Intel SGX, AMD SEV).