Split Neural Network

The cut layer is the specific, predetermined layer where the neural network is partitioned between parties. This architectural decision defines the trust and privacy boundary.

• Local Computation: The portion of the model from the input layer up to the cut layer resides on the feature owner's device.
• Shared Interface: The output of this local portion, called the intermediate output or smashed data, is the only information transmitted.
• Strategic Choice: The depth of the cut layer is a critical trade-off. A shallow cut (early layer) sends less processed, more raw data, offering stronger privacy but potentially less useful representations. A deep cut sends highly abstract features, which are more useful for the downstream task but may leak more information about the raw input.

The intermediate output is the tensor produced by the forward pass of the client-side sub-model up to the cut layer. It acts as the privacy-risk interface between parties.

• Data Minimization: This tensor is a transformed, lower-dimensional representation of the raw input features, adhering to the principle of sharing only what is necessary for the task.
• Attack Surface: While more private than raw data, intermediate outputs can still be vulnerable to model inversion or membership inference attacks if not protected, necessitating techniques like homomorphic encryption or differential privacy.
• Bandwidth Determinant: The size and dimensionality of this tensor directly impact the vertical communication overhead of the system.

Vertical forward propagation is the distributed execution of the model's forward pass across the split architecture.

• Sequential Computation: The feature owner computes the forward pass on its local features using its sub-model, producing the intermediate output.
• Secure Transmission: This output is encrypted or otherwise protected and sent to the label owner (or the next party in the chain).
• Completion by Label Owner: The label owner receives the intermediate output, feeds it into its server-side sub-model (which continues from the cut layer to the output layer), and computes the final prediction and loss using its local labels.

Vertical backpropagation is the coordinated, reverse-pass calculation of gradients necessary for training the split model.

1. Gradient Flow Initiation: The label owner calculates the initial loss gradient with respect to its sub-model's output and propagates it backwards through its layers.
2. Gradient at the Cut: The gradient at the input to the label owner's sub-model (which is the output of the feature owner's sub-model) is computed.
3. Secure Gradient Passing: This gradient is securely sent back to the feature owner.
4. Local Update: The feature owner uses this received gradient to perform backpropagation through its own local sub-model, updating its private parameters. No raw data or labels are exchanged during this process.

Core cryptographic protocols are required to secure the exchange of intermediate outputs and gradients, forming the trust layer of the architecture.

• Homomorphic Encryption (HE): Allows computations (forward/backward passes) to be performed directly on encrypted intermediate outputs. The label owner processes ciphertext, and the feature owner decrypts the resulting encrypted gradient. This provides strong privacy but adds significant vertical computation overhead.
• Secure Multi-Party Computation (MPC): Protocols that allow the label and feature owners to jointly compute the forward pass and gradients without either party seeing the other's private inputs (raw features or raw labels).
• Vertical Secure Aggregation: In scenarios with multiple feature owners, this protocol allows the label owner to aggregate updates (e.g., gradients from each feature owner's sub-model) without being able to decipher any single contributor's update.

A vertical training protocol defines the strict sequence of operations that coordinates the distributed training loop. This is often managed by a central, non-trusting orchestrator (which may be the label owner).

A Standard Protocol Round:

1. Entity Alignment: Parties use Private Set Intersection (PSI) to confidentially identify their common samples.
2. Forward Pass: Feature owners compute and protect (e.g., encrypt) their intermediate outputs, sending them to the label owner.
3. Loss Calculation & Gradient Initiation: The label owner completes the forward pass, computes loss, and begins backpropagation.
4. Backward Pass: The label owner sends the encrypted gradients at the cut layer back to the respective feature owners.
5. Local Optimization: Each party updates its own model segment using its local optimizer (e.g., SGD).

This protocol ensures deterministic execution and privacy-by-design throughout the lifecycle.

A bank (label owner) holds transaction labels (fraudulent/legitimate), while a telecommunications company (feature owner) holds behavioral data like call patterns and location. A split neural network is deployed where:

• The telco runs the initial layers on its features, producing an intermediate embedding.
• This embedding is sent to the bank, which completes the forward pass using its layers and the labels.
• Gradients are propagated back through the cut layer without either party seeing the other's raw data. This creates a more robust fraud model than either party could build alone, leveraging cross-domain signals while complying with data protection regulations like GDPR.

A hospital (label owner) holds patient diagnoses and outcomes. A medical imaging center (feature owner A) holds X-rays, while a genomics lab (feature owner B) holds genetic sequences. A multi-party split network is used:

• Each feature owner has a dedicated client-side model (e.g., a CNN for images, an MLP for genomic data).
• Their respective intermediate outputs are sent to the hospital's server-side model, which fuses them for a final prediction.
• Training uses secure aggregation to combine updates. This architecture enables the development of a comprehensive diagnostic AI that leverages multimodal data without centralizing sensitive Protected Health Information (PHI), directly addressing HIPAA compliance.

An e-commerce platform (label owner) holds user purchase history (labels). A social media platform (feature owner A) holds user engagement data, and an ad network (feature owner B) holds browsing history. A vertically split model personalizes recommendations:

• Feature owners compute user embeddings from their proprietary data.
• The e-commerce platform aggregates these embeddings via its layers to predict purchase probability.
• The cut layer is strategically placed to minimize the exposure of the raw feature semantics in the exchanged embeddings. This allows for hyper-personalization by leveraging rich, cross-platform user behavior while maintaining the siloed nature of the data, preserving user privacy and business competitiveness.

A utility company (label owner) holds historical energy consumption labels. A weather service (feature owner A) holds meteorological data, and a city's IoT network (feature owner B) holds real-time traffic and event data. A split model forecasts load:

• The split occurs after each party's feature extraction modules.
• Homomorphic encryption may be applied to the intermediate outputs from feature owners before they are sent to the utility for secure aggregation and final prediction.
• This enables highly accurate, short-term load forecasting that responds to external factors, optimizing grid stability and renewable energy integration without any party disclosing its core operational data streams.

The architecture of a split neural network is defined by key engineering decisions:

• Cut Layer Selection: The choice of where to split the model is a trade-off between privacy, communication cost, and computational balance. An early cut preserves more privacy but sends larger, rawer data. A later cut sends more abstract features but requires more computation on the feature owner's side.
• Cryptographic Backends: Common implementations integrate with:
  • Secure Multi-Party Computation (MPC) for gradient computation.
  • Homomorphic Encryption (HE) for operating on encrypted intermediates.
  • Private Set Intersection (PSI) for the initial entity alignment step.
• Frameworks: Systems like FATE, PyVertical, and TensorFlow Federated provide abstractions for defining the split, managing the vertical training protocol, and handling secure communication.

Deploying split neural networks introduces distinct systems challenges:

• Communication Overhead: Exchanging intermediate outputs and gradients every round can be costly. Mitigations include:
  • Gradient compression techniques.
  • Using stale synchronous parallel updates.
• Synchronization Complexity: All parties must be available for each training step. Strategies involve:
  • Designing fault-tolerant vertical training protocols.
  • Using asynchronous updates (with caution for model convergence).
• Privacy-Utility Trade-off: The intermediate output itself can leak information. Defenses include:
  • Adding differential privacy noise to the exchanged vectors.
  • Using adversarial training to learn representations that are informative for the task but non-invertible for raw data reconstruction.

A decentralized machine learning paradigm where different parties (clients) hold different features about the same set of entities (e.g., customers). They collaborate to train a model without directly sharing their raw feature data. This is the overarching framework that utilizes split neural networks.

• Core Distinction: Contrasts with Horizontal Federated Learning (HFL), where parties have the same features but different samples.
• Typical Use Case: A bank (holding credit history) collaborates with an e-commerce platform (holding purchase history) to build a joint fraud detection model for their shared customers.

The specific layer in a neural network where the model is divided between parties in a Vertical Federated Learning system. This is the architectural decision point that defines the split.

• Function: Determines which computations are performed locally by the feature owner and which outputs (called intermediate outputs or embeddings) are shared with the label owner.
• Design Trade-off: A shallow cut (early layer) minimizes the feature owner's computation but may expose more raw data information. A deep cut (later layer) increases local computation but enhances privacy.

The prerequisite process of identifying and matching the same real-world entities across the vertically partitioned datasets held by different parties. Without alignment, parties cannot know which features correspond to the same user or sample.

• Challenge: Must be performed privately to avoid revealing each party's full user list.
• Common Solution: Uses cryptographic protocols like Private Set Intersection (PSI) to find the common set of user IDs without exposing non-overlapping entries.

A cryptographic protocol that allows two or more parties to compute the intersection of their private datasets (e.g., sets of user IDs) without revealing any information about items not in the intersection.

• Critical Role in VFL: Enables secure entity alignment, the foundational step before split network training can begin.
• Example: A hospital and an insurance company use PSI to securely identify their shared patients, revealing only the IDs that match, not their full patient rosters.

In a split neural network for VFL, this is the result of the forward pass up to the cut layer. It is computed locally by a feature owner and must be securely transmitted to the label owner (or the next party) to continue the forward propagation.

• Data Type: Typically a feature embedding or activation tensor.
• Privacy Risk: This vector can contain information about the raw input data, necessitating protection via methods like homomorphic encryption or additive secret sharing during transmission.

Cryptographic protocols used in VFL to combine model updates (e.g., gradients or intermediate outputs) from multiple feature owners without revealing any individual party's contribution.

• Purpose: Prevents the label owner from inferring a feature owner's private data from their update.
• Mechanism: Often employs Secure Multi-Party Computation (MPC) or homomorphic encryption to allow the server to compute the sum of encrypted updates, decrypting only the final aggregated result.