Vertical Data Partition

A vertical partition splits a dataset by features (columns), not by samples. Different parties hold different attributes for the same set of entities (rows). For example, a bank holds a customer's credit history (features F1-F3), while a retailer holds the same customer's purchase history (features F4-F6). The complete feature vector for any entity is distributed across multiple silos.

For VFL to be possible, the parties must share a common set of entity identifiers (e.g., user IDs, device IDs). The core challenge is performing entity alignment—finding these overlapping samples—without exposing the full list of IDs each party holds. This is typically solved using cryptographic protocols like Private Set Intersection (PSI). Only data for the aligned intersection is used for training.

Roles in a vertical partition are inherently asymmetric:

• Label Owner: Typically one party holds the target variable (e.g., loan default flag, purchase prediction). This party often acts as the computation coordinator.
• Feature Owners: One or more other parties hold subsets of the input features but lack the labels. They collaborate to provide predictive features for the aligned samples. This asymmetry dictates the training protocol and flow of information.

Unlike horizontal FL, where data heterogeneity is a challenge, vertical partitions are inherently statistically heterogeneous by design. Each party's feature subset comes from a different domain, distribution, and semantic meaning (e.g., financial vs. behavioral features). The learning objective is to fuse these complementary feature spaces to build a more powerful model than any single party could create alone.

The vertical data structure directly informs the model architecture. The standard approach is a split neural network, where the model is divided at a cut layer. Feature owners compute the forward pass on their local features up to the cut layer, producing encrypted intermediate outputs. These are sent to the label owner, which completes the forward pass, calculates the loss, and coordinates backpropagation. The model's architecture mirrors the data partition.

Because each party holds a different view of the same entities, even sharing intermediate results (like embeddings or gradients) can risk leaking raw feature information through inference attacks. This necessitates strong privacy-preserving techniques as a core characteristic, including:

• Secure Multi-Party Computation (MPC) for joint calculations.
• Homomorphic Encryption (HE) for computing on ciphertext.
• Differential Privacy (DP) to add statistical noise to shared values.

A bank holds core financial transaction history and credit labels (loan default), while an e-commerce platform possesses detailed purchase behavior and product affinity data. A vertical partition allows them to train a more robust default prediction model without the bank seeing purchase data or the e-commerce platform accessing sensitive financial records.

• Key Driver: Regulatory compliance (e.g., GDPR, financial privacy laws) prevents raw data sharing.
• Technical Approach: The bank acts as the label owner, and both parties use Private Set Intersection (PSI) to align common customers before training a split neural network.

A hospital holds labeled medical imagery (e.g., MRI scans with diagnoses) and genomic data, while a pharmaceutical research firm possesses detailed molecular compound libraries and assay results. A vertical partition enables the joint development of a diagnostic model linking drug efficacy to patient biomarkers.

• Key Driver: Patient privacy laws (HIPAA, GDPR) and intellectual property protection for proprietary compounds.
• Technical Approach: Homomorphic encryption or secure multi-party computation (MPC) is used to compute on encrypted intermediate outputs, ensuring neither raw patient data nor molecular structures are exposed.

A retailer holds in-store and online purchase history (labels: customer lifetime value), while a social media platform has rich user engagement, demographic, and interest graph data. They collaborate to build a hyper-personalized recommendation or churn prediction model.

• Key Driver: Competitive data is a core asset; neither party wants to enrich a competitor's central database.
• Technical Approach: A vertical training protocol coordinates the exchange of embeddings or gradients from the social platform's model portion to update the retailer's overall model, preserving user anonymity.

A municipal traffic department holds traffic camera feeds (labels: congestion incidents), while a telecom operator possesses anonymized cell phone location pings showing population density and movement. A vertical partition allows for real-time traffic flow prediction and incident detection.

• Key Driver: Data sovereignty and contractual agreements prevent the sharing of raw telecom user location data with government entities.
• Technical Approach: Federated feature selection identifies the most predictive location-derived features, which are then used as input to a vertically split model hosted partly on the telecom's secure edge servers.

A payment processor holds transaction amounts, times, and merchant codes (labels: fraudulent transactions), while a network of issuing banks possesses individual cardholder spending patterns and account histories. A vertical partition enables a consortium to build a superior fraud model that sees a holistic view of behavior without any single entity pooling all data.

• Key Driver: Competitive secrecy between banks and the need to minimize data breach risk by avoiding a central repository of sensitive financial data.
• Technical Approach: Vertical secure aggregation cryptographically combines gradient updates from each bank, and differential privacy noise is added to provide formal privacy guarantees against inference attacks.

An automotive OEM holds assembly line sensor data and final quality control labels (defect/no defect). A parts supplier holds detailed sensor data from its own manufacturing process for the supplied component. A vertical partition allows them to jointly model the propagation of sub-component defects into final assembly failures.

• Key Driver: Protection of proprietary manufacturing processes and sensor configurations, which are trade secrets.
• Technical Approach: The supplier and OEM align components by serial number using secure entity resolution. They then employ a vertical inference protocol to run predictions without exposing the supplier's real-time process data to the OEM.

The foundational process of identifying and matching the same real-world entities (e.g., customer IDs, device serial numbers) across the vertically partitioned datasets held by different parties. This must be done without revealing the full datasets.

• Purpose: Creates the aligned sample space required for model training.
• Methods: Often employs cryptographic protocols like Private Set Intersection (PSI).
• Challenge: A prerequisite for VFL; misalignment leads to training on incorrect data pairs.

The model architecture used in VFL where the neural network is divided into multiple segments, each residing on a different party that holds a specific subset of the features.

• Structure: The label owner typically holds the deeper layers near the output, while feature owners hold the initial layers.
• Cut Layer: The specific layer where the model is split. The output of this layer (the intermediate output) is shared to continue computation.
• Example: Feature Owner A computes layers 1-3 on its features, sends the intermediate result to the Label Owner, who computes layers 4-5 to produce the final prediction.

A cryptographic protocol for combining model updates (e.g., gradients or intermediate outputs) from multiple parties without revealing any individual party's contribution. This protects the privacy of each participant's data.

• Core Idea: Uses techniques like secret sharing or homomorphic encryption so that only the aggregated sum is revealed to the coordinator.
• Benefit: Prevents the label owner or other parties from inferring a feature owner's raw data from their update.
• Vertical Context: Applied to gradients from feature owners' model segments or to encrypted intermediate outputs.

A cryptographic protocol that allows two or more parties, each holding a private set of items (e.g., user IDs), to compute the intersection of their sets without revealing any information about items not in the intersection.

• Primary Use in VFL: The standard method for performing entity alignment in a privacy-preserving manner.
• Output: All parties learn only which IDs they have in common, and nothing else.
• Variants: Includes PSI-CA (Cardinality) where parties learn only the size of the intersection.

An encryption scheme that allows specific types of computations to be performed directly on ciphertext, generating an encrypted result which, when decrypted, matches the result of the operations as if they had been performed on the plaintext.

• Use in VFL: Enables the label owner to perform computations on encrypted intermediate outputs from feature owners.
• Benefit: The label owner never sees the raw intermediate values, enhancing privacy.
• Trade-off: Introduces significant computation overhead due to the complexity of encrypted arithmetic.

The defined sequence of communication and computation steps that coordinating parties follow to execute a complete training round in a VFL system.

• Typical Steps: 1) Entity Alignment via PSI. 2) Vertical Forward Propagation: Feature owners compute to the cut layer and send outputs. 3) Loss & Gradient Calculation by the label owner. 4) Vertical Backpropagation: Gradients are sent back to feature owners. 5) Local Model Update by each party.
• Governance: Specifies roles, data formats, encryption methods, and aggregation rules.
• Framework Implementation: Codified in VFL frameworks like FATE or TensorFlow Federated.