Vertical Forward Propagation

The core model architecture enabling VFL. The neural network is partitioned at a designated cut layer. The bottom model segments reside with feature owners, who compute on their local features. The top model segment resides with the label owner, who receives intermediate outputs to complete the forward pass and compute the loss. This split enforces data separation by design.

The specific layer where the neural network is divided between parties. Its placement is a critical system design choice with major trade-offs:

• Privacy vs. Utility: A later cut layer (deeper in the network) allows more complex feature extraction locally but risks exposing more revealing data patterns.
• Communication vs. Computation: An earlier cut layer reduces local computation for feature owners but increases the dimensionality of the intermediate outputs that must be transmitted.

The encrypted or protected tensors passed from a feature owner to the label owner. These are the activations at the cut layer, representing a transformed, abstract representation of the local raw features. They are the only data exchanged during the forward pass, forming the privacy boundary. Their size directly impacts vertical communication overhead.

The encrypted pipeline for transmitting intermediate outputs and gradients. It prevents eavesdropping on the data in transit. Common technologies include:

• Transport Layer Security (TLS) for channel encryption.
• Homomorphic Encryption (HE) for computing on encrypted data, allowing the label owner to process encrypted intermediates.
• Secure Multi-Party Computation (MPC) protocols for joint computation without revealing private inputs.

The step-by-step sequence governing the forward pass. A standard protocol for a single feature owner and label owner is:

1. Entity Alignment: Parties privately identify common samples (e.g., using PSI).
2. Local Forward Pass: Feature owner computes forward pass on its local model segment up to the cut layer.
3. Secure Transmission: Feature owner sends the encrypted intermediate output to the label owner.
4. Completion of Forward Pass: Label owner decrypts (if using HE) or processes the input, completes its top model segment, and computes the prediction and loss.

Additional safeguards applied to intermediate outputs to prevent data reconstruction or inference attacks. These are often used in conjunction with secure channels:

• Differential Privacy (DP): Adding calibrated statistical noise to the intermediate outputs before they are shared.
• Gradient Perturbation: Applying noise during the subsequent backpropagation step.
• Functional Encryption: Allowing the label owner to compute only the specific loss function on the received data, nothing else.

The foundational model architecture for VFL. The neural network is vertically split at a designated cut layer. Each participating party (e.g., a feature owner) holds and computes only its segment of the model on its local features.

• Local Bottom Model: The portion of the network from the input layer up to the cut layer, residing with a feature owner.
• Top Model: The portion from the cut layer to the output layer, typically held by the label owner.

The specific layer where a split neural network is divided between parties. It is a critical hyperparameter that determines:

• Privacy-Computation Trade-off: A later cut layer means more computation is done locally by feature owners, enhancing privacy but increasing their computational load.
• Communication Cost: Defines the size and dimensionality of the intermediate output that must be transmitted.
• Model Performance: Impacts gradient flow and can affect final model accuracy.

The tensor result of the forward pass up to the cut layer. This is the core data object exchanged during Vertical Forward Propagation.

• Computation: Generated locally by a feature owner using its private features and its segment of the model.
• Transmission: Securely sent to the next party (usually the label owner) to continue the forward pass.
• Security Critical: This output contains a latent representation of the raw input data and is a primary target for privacy protection via encryption or perturbation.

The defined sequence of steps governing a complete training round in VFL. Vertical Forward Propagation is the first major phase of this protocol.

A standard protocol involves:

1. Entity Alignment & PSI: Securely identify common samples.
2. Forward Propagation: Feature owners compute and send encrypted intermediate outputs.
3. Label Owner Computation: Completes the forward pass, computes loss.
4. Backward Propagation: Gradients are calculated and passed back securely.
5. Secure Update: Each party updates its local model segment.

A primary cryptographic method for securing Vertical Forward Propagation. It allows computations to be performed directly on encrypted data.

• Mechanism: A feature owner encrypts its intermediate output before sending it to the label owner.
• Computation on Ciphertext: The label owner can perform the forward pass of its top model on this encrypted input.
• Output: The result (e.g., loss, logits) remains encrypted, enabling secure vertical backpropagation. This prevents the label owner from learning the feature owner's private data from the intermediate values.

A broader class of cryptographic protocols used to implement privacy-preserving VFL. MPC enables multiple parties to jointly compute a function (like a model's forward pass) over their private inputs without revealing those inputs to each other.

• Contrast with HE: Often more communication-intensive but can support arbitrary computations without the limitations of specific homomorphic encryption schemes.
• Common Frameworks: Protocols like SPDZ or ABY are adapted for VFL to securely compute activation functions and aggregate gradients across the split neural network.