Vertical Federated Learning (VFL)

The foundational data structure of VFL is a vertical data partition, where different features (columns) for the same entities (rows) are held by distinct parties. Before training can begin, entity alignment must be performed to identify the overlapping set of entities across these private datasets. This is typically achieved using privacy-preserving protocols like Private Set Intersection (PSI) or secure entity resolution, which compute the intersection of entity IDs (e.g., customer IDs) without revealing non-overlapping records.

The model itself is architecturally divided into segments distributed across the participating parties. This is known as a split neural network. The division point is defined by the cut layer.

• Feature Owners (Passive Parties): Hold subsets of the input features. They host the bottom models, which process local features up to the cut layer, producing an intermediate output or embedding.
• Label Owner (Active Party): Holds the target labels. It hosts the top model, which receives the aggregated intermediate outputs from feature owners to compute the final prediction and loss. This split allows the complete model function to be computed without any single party seeing all the raw input data.

To prevent data leakage via intermediate outputs or gradients, VFL employs cryptographic privacy-enhancing technologies (PETs).

• Homomorphic Encryption (HE): Allows the label owner to perform computations on encrypted intermediate outputs from feature owners.
• Secure Multi-Party Computation (MPC): Enables multiple parties to jointly compute a function (like gradient calculation) over their private inputs.
• Differential Privacy (DP): Can be applied by adding calibrated noise to shared information (e.g., gradients) to provide rigorous, mathematical privacy guarantees against inference attacks.
• Vertical Secure Aggregation: Protocols to combine model updates from multiple parties without revealing any individual contribution.

This defines the step-by-step sequence for a single training iteration (round) in VFL, coordinating forward and backward passes across the split network.

1. Vertical Forward Propagation: Each feature owner computes its local bottom model on its features and sends the resulting intermediate output (often encrypted) to the label owner.
2. Loss Computation: The label owner aggregates these inputs, completes the forward pass through its top model, and calculates the loss.
3. Vertical Backpropagation: The label owner computes gradients for its top model and the gradients for the intermediate outputs.
4. Gradient Distribution & Update: These intermediate gradients are sent back to the respective feature owners, who then compute gradients for and update their local bottom models. This process repeats until convergence.

A logical component, often managed by the label owner or a neutral third party, that coordinates the entire VFL process. Its responsibilities include:

• Managing the lifecycle of the vertical training protocol.
• Orchestrating the entity alignment phase.
• Handling party authentication and managing cryptographic keys.
• Scheduling training rounds and managing fault tolerance (e.g., if a feature owner drops out).
• Logging metrics for convergence and system performance. This layer is often implemented within a Vertical FL framework.

Once trained, the vertically split model must be used for prediction via a vertical inference protocol. This mirrors the forward pass of training:

• A feature owner receives a new data sample for its features.
• It computes the intermediate output using its local bottom model.
• This output is securely sent to the label owner (or another designated party).
• The label owner completes the forward pass through the top model to generate the final prediction. This process ensures that raw feature data never leaves its owner, even during model deployment, maintaining the same privacy standards as training.

Banks, credit card issuers, and fintech companies hold complementary financial data about shared customers. VFL enables the creation of a superior fraud detection model by combining:

• Bank A's transaction history and account balances.
• Bank B's credit application data and loan history.
• E-commerce Platform's purchase patterns and device IDs.

No single party shares raw transaction data, yet the collaboratively trained model can identify sophisticated, cross-institutional fraud patterns that would be invisible to any single entity. This directly addresses regulations like GDPR and CCPA that restrict cross-organization data pooling.

Hospitals, insurers, and genomics labs hold vertically partitioned patient data. VFL allows for training diagnostic or treatment efficacy models without centralizing Protected Health Information (PHI).

• Hospital 1 holds medical imaging (MRI/CT scans).
• Hospital 2 holds electronic health records (EHRs) and lab results.
• Research Institute holds genomic sequencing data.

By aligning on patient IDs via Private Set Intersection (PSI), a split neural network can learn from this combined multimodal feature set to predict disease progression or drug response, accelerating biomedical research while maintaining HIPAA/GDPR compliance.

Brands, advertising platforms, and retailers seek a unified view of customer lifetime value without directly sharing sensitive purchase histories or browsing behavior. VFL aligns on user identifiers to build a joint model.

• Retailer holds detailed purchase history and loyalty data.
• Social Media Platform holds user interests, engagement metrics, and demographic inferences.
• Payment Processor holds cross-merchant spend categories and frequency.

The resulting model enables highly accurate hyper-personalization and churn prediction, optimizing marketing spend. The label owner (e.g., the retailer predicting churn) benefits from enriched features without any party exposing its raw user database.

Different municipal departments and utility companies operate separate sensor networks monitoring the same urban environment. VFL enables predictive maintenance and optimization models.

• Transport Authority holds traffic camera feeds and loop sensor data.
• Energy Utility holds smart meter readings and grid load data.
• Environmental Agency holds air quality and noise pollution sensor data.

By training a model to predict traffic congestion or energy demand spikes, the city improves operational efficiency. The vertical training protocol ensures raw video or granular consumption data never leaves the owning department's secure edge servers, mitigating cybersecurity risks.

Multiple entities in a supply chain hold different feature sets about shared components or products. VFL facilitates quality control and demand forecasting.

• Supplier A holds material composition and sourcing data.
• Supplier B holds component stress-test results.
• OEM Manufacturer holds assembly line sensor data and final quality control labels.

A joint model can predict product failures by learning from the entire vertical feature stack. The label owner (the OEM) initiates training, and secure aggregation protocols protect each supplier's proprietary manufacturing data, preserving competitive advantage while improving overall product reliability.

Mobile network operators (MNOs) and content providers have partitioned data on the same subscribers. VFL enables advanced network security and service quality models.

• MNO holds network signaling data, location pings, and device types.
• Streaming Service holds app usage patterns, video quality metrics, and session times.
• Security Vendor holds threat intelligence feeds on malicious IPs.

Collaborative training can create a model for detecting botnets or predicting subscriber churn due to poor service. Homomorphic encryption for VFL or vertical MPC secures the exchange of intermediate embeddings, ensuring subscriber privacy is never compromised.

A vertical data partition is a dataset split where different features (columns) of the same samples (rows) are held by different parties. This is the foundational data structure for VFL.

• Example: A bank holds customer credit history (features), while an e-commerce platform holds the same customers' purchase history (different features). The rows (customer IDs) are the same, but the columns are split.

Entity alignment is the privacy-preserving process of identifying and matching the same real-world entities (e.g., customers, devices) across the vertically partitioned datasets held by different parties. It is a critical prerequisite for VFL training.

• Common Method: Uses cryptographic protocols like Private Set Intersection (PSI) to find overlapping user IDs without revealing non-intersecting records.

A split neural network is the model architecture used in VFL where the neural network is divided into multiple parts. Each part resides on a different party that holds a specific subset of the features.

• Cut Layer: The specific layer where the model is divided. The feature owner computes the forward pass up to this layer, producing an intermediate output that is sent securely to the label owner to complete the forward propagation and compute the loss.

Private Set Intersection (PSI) is a cryptographic protocol that allows two or more parties to compute the intersection of their private datasets (e.g., sets of user IDs) without revealing any information about items not in the intersection.

• Role in VFL: PSI is the standard method for performing secure entity alignment before model training begins, ensuring only overlapping samples are used.

In the VFL context, secure aggregation refers to cryptographic protocols used to combine model updates (e.g., gradients from feature owners) without revealing any individual party's contribution.

• Purpose: Prevents the label owner or other participants from inferring raw feature data from the shared updates, a key defense against privacy leakage.

Homomorphic Encryption (HE) is an encryption scheme that allows computations to be performed directly on ciphertext. The decrypted result matches the result of operations performed on the plaintext.

• Application in VFL: Used to encrypt intermediate outputs or gradients, allowing the label owner to perform necessary computations (like loss calculation) without ever decrypting the sensitive data from feature owners.