Vertical Inference Protocol

The core computational sequence where each feature owner executes their local model segment on their private features. They produce an encrypted intermediate output (or embedding) which is passed to the label owner or a computation server. The label owner then completes the forward pass using the aggregated intermediate results to produce the final prediction. This process ensures no single party reconstructs the complete input feature vector.

A cryptographic mechanism that combines the intermediate outputs from multiple feature owners without revealing any individual contribution. Common techniques include:

• Homomorphic Encryption (HE): Allows computations on ciphertext.
• Secure Multi-Party Computation (MPC): Distributes the computation so no party sees another's raw input.
• Trusted Execution Environments (TEEs): Provide a hardware-isolated secure enclave for computation. This layer is the primary defense against data reconstruction attacks during inference.

The protocol must handle non-linear activation functions (e.g., ReLU, Sigmoid) securely after the secure aggregation step. This is a significant challenge because most cryptographic schemes work natively only on linear operations. Solutions include:

• Polynomial approximations of activation functions compatible with HE.
• Garbled circuits within MPC protocols to evaluate the function.
• Two-server protocols where non-linearities are computed in a decomposed, privacy-preserving manner.

The central service (often run by the label owner or a neutral third party) that manages the inference workflow. Its responsibilities include:

• Request Routing: Directing prediction requests to the correct feature owners.
• Sequence Enforcement: Ensuring the forward pass steps occur in the correct, synchronized order.
• Result Composition: Collecting and securely aggregating outputs before applying the final model layers.
• Audit Logging: Recording protocol execution for compliance and debugging, without logging sensitive data.

Mechanisms applied to the final prediction output to prevent model inversion or membership inference attacks. Even the prediction score can leak information about the training data. Guards include:

• Output Perturbation: Adding calibrated noise to the prediction (Differential Privacy).
• Prediction Discretization: Returning only a class label or a bounded score range instead of a precise probability.
• Access Control: Enforcing policies on who can query the model and at what frequency.

The network and messaging infrastructure that connects participants. Key requirements:

• Low-Latency Links: To meet real-time inference SLAs (e.g., <100ms for fraud detection).
• Authenticated Channels: All parties must cryptographically verify each other's identity.
• State Management: The protocol must handle scenarios where a feature owner is temporarily offline, often using queuing mechanisms or fault-tolerant aggregation algorithms to proceed with available parties.

A bank (label owner) holds loan repayment histories. A fintech (feature owner) holds alternative transaction data for the same customers. Using a pre-trained vertical model, the fintech can securely provide transaction-derived features for a loan application, enabling the bank to generate a more accurate risk score without either party seeing the other's proprietary data.

• Key Mechanism: The fintech computes the intermediate output from its local model segment and sends it to the bank.
• Privacy Guarantee: Raw transaction data never leaves the fintech's secure environment.

A hospital's diagnostic AI model is trained using its patient labels and features from a medical research institute (e.g., genomic markers). During inference, for a new patient, the institute provides the genomic features via the secure protocol. The hospital combines this with its clinical data to produce a diagnosis, preserving patient confidentiality across both entities.

• Compliance: Aligns with regulations like HIPAA and GDPR by avoiding centralization of sensitive health data.
• Use Case: Enables rare disease diagnosis by leveraging specialized, distributed data sources.

An e-commerce platform (label owner, with purchase history) wants to predict user purchase intent. A social media platform (feature owner, with engagement data) can participate in inference. The social platform computes an embedding from user activity and sends it to the e-commerce platform's model, generating a personalized ad score without sharing browsing history or identifying individual users.

• Data Minimization: Only non-identifiable model intermediates are exchanged.
• Industry Application: Facilitates cooperative marketing while respecting user privacy norms and regulations.

Multiple banks form a consortium to improve fraud detection. Each bank holds different features (e.g., domestic transactions, international wire patterns) for shared corporate clients. A central fraud model is trained vertically. For a new transaction, each bank provides its local inference output. These are aggregated to produce a consortium-wide fraud probability, protecting each bank's proprietary transaction patterns.

• Security Benefit: Prevents a single bank from reverse-engineering another's fraud detection rules or customer behavior.
• Operational Model: Enables collective defense without a centralized, vulnerable data lake.

A utility company (label owner) needs to forecast electricity demand. A smart meter manufacturer (feature owner #1) holds real-time consumption patterns, and a weather data provider (feature owner #2) holds hyper-local forecasts. During inference, both feature owners compute their respective model outputs. The utility securely aggregates these to predict grid load, optimizing generation without accessing granular household or proprietary weather data.

• System Efficiency: Enables precise, real-time forecasting critical for balancing renewable energy sources.
• Data Sovereignty: Meter and weather data remain under the control of their respective owners.

An OEM (label owner) holds failure data for industrial machines. A component supplier (feature owner) holds detailed sensor telemetry from its parts. Using a vertically trained model, the supplier can provide a real-time health signature derived from its sensors. The OEM combines this with its own operational data to predict failures, enabling proactive maintenance without either party exposing core intellectual property (sensor algorithms or failure root causes).

• Supply Chain Collaboration: Creates a closed-loop quality system across organizational boundaries.
• Value Preservation: Protects the supplier's sensor analytics and the OEM's maintenance know-how.

A split neural network is the model architecture used in Vertical Federated Learning where the network is partitioned across different data owners. The model is divided at a cut layer, with each party holding and computing a specific segment of the model based on their local features. During inference, the feature owner computes the forward pass up to the cut layer, producing an intermediate output that is securely passed to the label owner to complete the prediction.

Secure Multi-Party Computation (MPC) is a cryptographic subfield that enables multiple parties to jointly compute a function over their private inputs without revealing those inputs to each other. In the context of a vertical inference protocol, MPC protocols are used to perform the final prediction calculation. This allows the label owner to combine encrypted intermediate outputs from feature owners to compute the final model output, ensuring no single party learns another's raw feature data during the inference process.

Homomorphic Encryption (HE) is a form of encryption that allows computations to be performed directly on ciphertext, generating an encrypted result that, when decrypted, matches the result of operations performed on the plaintext. In vertical inference, a feature owner can encrypt their intermediate output using the label owner's public key. The label owner can then perform the remaining model computations on this ciphertext, producing an encrypted prediction. Only the authorized result recipient (e.g., the feature owner) holds the private key to decrypt the final output.

Private Set Intersection (PSI) is a foundational cryptographic protocol used before training or inference can begin in Vertical Federated Learning. It allows two or more parties to discover the common set of entities (e.g., user IDs) in their vertically partitioned databases without revealing any information about entities not in the intersection. This entity alignment step is critical for ensuring all parties are computing on the same batch of samples during a coordinated inference request, forming the aligned sample set for the protocol.

The label owner is the coordinating party in a Vertical Federated Learning system that holds the target values (labels) for the aligned entities. In the inference protocol, the label owner typically:

• Possesses the portion of the split model from the cut layer to the output.
• Orchestrates the inference request, coordinating with feature owners.
• Receives and securely aggregates intermediate outputs.
• Computes or facilitates the computation of the final prediction, often using cryptographic protocols like MPC or HE to preserve privacy.

The vertical training protocol is the defined sequence of steps used to collaboratively train the split model. It is the direct precursor to the inference protocol. Understanding training is essential for inference because:

• The cut layer and model architecture are established during training.
• The training protocol defines the trust and cryptographic assumptions between parties.
• The inference protocol uses the same data flow and communication patterns but in a single, forward-pass-only execution to generate predictions with the already-trained model.