Vertical Multi-Party Computation (MPC)

The foundational principle of Vertical MPC is the vertical partition of the feature space. Each participating party (e.g., a bank and a retailer) holds a distinct, non-overlapping set of features (columns) for a shared set of entities (rows). MPC protocols allow computation across these partitions while the raw data remains encrypted and localized. For example, a bank's credit history and a retailer's purchase history for the same customers can be used to train a fraud detection model without either party seeing the other's dataset.

Before training can begin, parties must identify their common entities (e.g., user IDs) without revealing their full lists. This is achieved using Private Set Intersection (PSI), a core MPC protocol. PSI allows two or more parties to compute the intersection of their private ID sets, learning only which IDs they have in common and nothing about the non-intersecting IDs. This secure entity resolution is a critical, privacy-preserving prerequisite for aligning samples in Vertical MPC.

The machine learning model is architecturally divided into segments, typically using a split neural network. Each party holds a portion of the model corresponding to its local features.

• Feature Owners: Compute the forward pass on their local features up to a designated cut layer, producing an intermediate output.
• Label Owner: Receives these encrypted intermediate outputs, completes the forward pass, computes the loss, and initiates backpropagation. This architecture ensures no single party has the complete model or data view.

Training occurs through a coordinated vertical training protocol.

• Vertical Forward Propagation: Feature owners compute on local data and send encrypted intermediate results to the label owner.
• Vertical Backpropagation: The label owner computes gradients and sends back encrypted gradient messages relevant to each feature owner's model segment. Techniques like homomorphic encryption or secret sharing are used so computations can be performed on ciphertext, preventing leakage of raw features or intermediate values.

Vertical MPC provides stronger, cryptographically enforced privacy compared to heuristic methods. Its guarantees are based on mathematical proofs under defined adversarial models (semi-honest or malicious). These protocols are designed to prevent:

• Data Reconstruction: An adversary cannot invert intermediate outputs to recover raw input features.
• Membership Inference: It is infeasible to determine if a specific entity's data was part of the training set.
• Gradient Leakage: Individual model updates do not reveal information about the local dataset.

The primary trade-off for strong cryptographic privacy is significant overhead.

• Vertical Communication Overhead: Each training round requires multiple rounds of encrypted communication for forward/backward passes, increasing latency.
• Vertical Computation Overhead: Cryptographic operations (encryption, decryption, secure multi-party arithmetic) are computationally intensive, often orders of magnitude slower than plaintext operations. This makes Vertical MPC suitable for high-value, sensitive data scenarios where privacy is paramount and resources are available.

Multiple financial institutions, such as a bank and a credit card company, collaborate to build a more accurate credit risk model. Each holds different features (e.g., mortgage history vs. transaction data) for overlapping customers. Using Vertical MPC, they compute a joint model. The label owner (e.g., the bank with default records) learns only the final prediction, while feature owners learn nothing about each other's data or the specific model parameters, complying with financial regulations like GDPR and CCPA.

A hospital holds patient imaging data, a lab holds genomic sequences, and a pharmacy holds medication history—all for the same patient cohort. Vertical MPC allows these entities to train a diagnostic model for a disease like cancer without creating a centralized, vulnerable dataset.

• Entity alignment via Private Set Intersection (PSI) matches patient records securely.
• A split neural network trains across the parties, with intermediate outputs protected by cryptographic protocols.
• This enables precision medicine initiatives while preserving Protected Health Information (PHI) under HIPAA and other frameworks.

An e-commerce platform, a payment processor, and a digital wallet provider can jointly detect sophisticated fraud patterns. The e-commerce platform has browsing history, the processor has transaction metadata, and the wallet has login behavior. Vertical MPC facilitates training an anomaly detection model where the label owner (e.g., the processor with confirmed fraud tags) orchestrates the process. Secure aggregation of gradients ensures no single party can infer another's feature set, preventing collusion and protecting consumer privacy across the transaction chain.

A retailer, a social media platform, and a logistics company aim to predict customer lifetime value or churn. The retailer has purchase history, the platform has engagement data, and the logistics firm has delivery patterns. Vertical MPC enables the creation of a unified customer profile model without sharing raw data, which would violate user trust and privacy policies.

The vertical inference protocol allows for real-time, privacy-preserving predictions for ad targeting. This mitigates the risk of data leakage and protects competitive intelligence while improving campaign ROI.

A manufacturer, a shipping company, and a retailer collaborate to optimize inventory and predict delays. Each possesses vertically partitioned features: production schedules, GPS logistics data, and point-of-sale data. Using Vertical MPC, they train a predictive model for demand forecasting or bottleneck identification.

• The vertical training protocol coordinates gradient exchanges between the parties' local model segments.
• Homomorphic encryption may be used to compute on encrypted intermediate results.
• This creates a resilient, intelligent supply chain without exposing proprietary operational data.

Different municipal departments or utility companies hold sensor data for traffic flow, energy consumption, and public safety incidents across the same geographic grid. Vertical MPC allows for the training of models to optimize traffic light timing, predict grid load, or allocate emergency services.

Feature owners (e.g., transit and energy departments) contribute their data features securely. The label owner (e.g., city planning with target outcomes) learns the model's predictions to inform policy. This use case demonstrates how Vertical MPC enables public-private partnerships and cross-agency collaboration while maintaining strict data governance for citizen data.

Vertical Federated Learning (VFL) is the overarching decentralized machine learning paradigm where different parties hold different features about the same set of entities (e.g., a bank holds credit history, a retailer holds purchase history for the same customers). They collaborate to train a model—like a joint fraud detector—without directly sharing their raw, vertically partitioned data. VFL defines the problem that Vertical MPC aims to solve cryptographically.

Private Set Intersection (PSI) is a foundational cryptographic protocol for VFL. Before training can begin, parties must identify their common users without revealing non-matching entries. PSI allows two or more parties to compute the intersection of their private datasets (e.g., lists of customer IDs) while learning only which IDs are shared, and nothing about the other party's non-shared IDs. This is the critical first step for entity alignment in a vertical setting.

A split neural network is the standard model architecture for VFL. The neural network is literally divided (or "split") at a specific cut layer. For example:

• Feature Owners hold the bottom layers, processing their local features.
• The Label Owner holds the top layers, culminating in the output. During training, feature owners compute intermediate outputs up to the cut layer and send them securely (often via MPC or HE) to the label owner, who completes the forward pass, calculates the loss, and initiates vertical backpropagation.

Homomorphic Encryption (HE) is an alternative or complementary cryptographic primitive to MPC for VFL. HE allows computations to be performed directly on encrypted data. In VFL, a feature owner can encrypt its intermediate outputs using HE. The label owner can then perform model computations on this ciphertext to produce an encrypted result (e.g., loss or gradient), which only the feature owner can decrypt. This enables training without any party seeing another's plaintext data, though it typically incurs higher computation overhead than MPC.

Vertical secure aggregation is the cryptographic protocol for combining model updates from multiple feature owners without revealing any single owner's contribution. While often associated with horizontal FL, in VFL it secures the aggregation of gradients or intermediate results. For instance, using secret sharing, each feature owner splits its gradient update into random shares distributed among other parties. The aggregated sum can be reconstructed without any party learning the individual values, providing strong privacy during the vertical gradient computation phase.

A vertical training protocol is the concrete, step-by-step specification that coordinates all parties in a VFL system. It defines the exact sequence of communication and computation for a training round, integrating MPC, PSI, and cryptographic aggregation. A typical protocol outlines:

1. Entity Alignment via PSI.
2. Vertical Forward Propagation with encrypted intermediate outputs.
3. Loss calculation by the label owner.
4. Vertical Backpropagation with secure gradient transmission.
5. Vertical Federated Averaging (VFA) with secure aggregation of updates. This protocol ensures deterministic, privacy-preserving execution.