---
kind: concept
slug: vertical-federated-learning
title: Vertical federated learning
summary: >-
  Parties hold different features of the same users and train one model without pooling raw data. They exchange intermediate outputs and gradients after aligning users with private set intersection. Variants differ in the top model, whether the labelled party has features, and whether local models are trees. A federated RL survey uses "vertical" for another setting.
tags: [federated-learning, privacy, vertical-partitioning, survey]
papers: ["2211.12814", "2108.11887", "2007.13518", "2101.05428"]
related: [federated-learning, federated-reinforcement-learning, differential-privacy, federated-aggregation]
status: draft
updated_at: 2026-11-01
---

## Overview

In vertical federated learning (VFL) several parties hold different features of
the same set of users, and one of them, the active party, also holds the
labels. They want one joint model without exposing raw data or local model
parameters [arxiv:2211.12814 §2.1]. Each party keeps its feature block and its
local model. During training the parties exchange intermediate outputs and
gradients rather than raw features [arxiv:2211.12814 §2.2]. This differs from
horizontal FL, where parties share a feature space and differ in samples
[arxiv:2211.12814 tab. 1]. The survey also shows that these exchanged results
can leak information through label inference, feature inference and backdoor
attacks [arxiv:2211.12814 §5.3.1] [arxiv:2211.12814 §5.3.2] [arxiv:2211.12814 §5.4].

A general federated learning survey lists VFL as one of its FL types. Its
example is two organisations that hold different feature sets for the same
people [arxiv:2101.05428 §3]. That survey does not give a protocol for VFL, so
the training details on this page come from the VFL survey.

The word "vertical" also appears in federated reinforcement learning, where it
names a different setting: agents share one environment and each sees only part
of its state [arxiv:2108.11887 §4.3]. That is not a split of features among
parties, so the VFL rules on this page do not apply to it. It is covered under
Variants. The same FRL survey lists VFL as one of three federated learning
categories by data partition [arxiv:2108.11887 §2.3].

## Variants

### Split VFL (splitVFL)

The active party keeps a trainable global module that takes the concatenated
local outputs. Local models can be neural networks, linear or logistic
regression, SVMs, K-means or EM models [arxiv:2211.12814 §2.1]. Card:
[Vertical Federated Learning: Concepts, Advances and Challenges](/papers/2211.12814).

### Aggregation VFL (aggVFL)

The top step is a fixed function rather than a trained module. The card names a
sigmoid and an optimal split search for trees as examples [arxiv:2211.12814
§2.1] [arxiv:2211.12814 tab. 2]. Card: [Vertical Federated Learning: Concepts,
Advances and Challenges](/papers/2211.12814).

### Variants without active-party features (splitVFL_c, aggVFL_c)

The active party holds the labels but no features of its own, and the same two
top-step choices apply [arxiv:2211.12814 §2.1] [arxiv:2211.12814 tab. 2]. Card:
[Vertical Federated Learning: Concepts, Advances and Challenges](/papers/2211.12814).

### Federated transfer learning (FTL)

The general FL survey describes federated transfer learning as the extension of
VFL to sample instances that not every organisation holds [arxiv:2101.05428 §3].
The VFL survey's protocol works on N aligned samples, with IDs matched by
private set intersection [arxiv:2211.12814 §2.1] [arxiv:2211.12814 §2.2]. FTL
therefore relaxes that assumption. The general survey gives no protocol for it,
so none of the rows above can be carried over unchanged. Card: [Federated
Learning: Opportunities and Challenges](/papers/2101.05428).

### Tree-based VFL

Each party holds part of each tree, and the parts together form one tree. The
active party gathers the split information it receives and picks the best
split [arxiv:2211.12814 §2.2.1]. GBDT methods such as SecureBoost use additive
homomorphic encryption on gradients and histograms. Random-forest variants use
bagging, with encryption or a third party [arxiv:2211.12814 §2.2.1]. Card:
[Vertical Federated Learning: Concepts, Advances and Challenges](/papers/2211.12814).

### Communication-efficient methods

The survey groups five families: several local updates per round (FedBCD and
others), asynchronous coordination, one-shot communication, compression of
transmitted data, and selection of samples or features [arxiv:2211.12814
§3.1–§3.5]. Card: [Vertical Federated Learning: Concepts, Advances and
Challenges](/papers/2211.12814).

### Effectiveness methods for scarce labels

Self-supervised, semi-supervised, knowledge-distillation and transfer-learning
approaches help when labels are few or a party holds little data [arxiv:2211.12814
§4.1–§4.4]. Card: [Vertical Federated Learning: Concepts, Advances and
Challenges](/papers/2211.12814).

### Privacy defenses

Cryptographic defenses wrap the transmitted outputs and gradients, using
homomorphic encryption, secure multi-party computation or a trusted execution
environment [arxiv:2211.12814 §2.2] [arxiv:2211.12814 §5.3.3]. Non-cryptographic
defenses add noise, discretise gradients or sparsify them; the survey notes
these trade utility for privacy [arxiv:2211.12814 §5.3.4]. Card: [Vertical
Federated Learning: Concepts, Advances and Challenges](/papers/2211.12814).

### Library support (FedML)

FedML is an open research library. Its worker-oriented message API and topology
manager list vertical FL among the topologies it supports, next to split
learning, decentralized FL and hierarchical FL [arxiv:2007.13518 §3]. The paper
says the library ships a reference implementation of vertical FL
[arxiv:2007.13518 §4.1]. Its reported experiments cover FedAvg only
[arxiv:2007.13518 §5] [arxiv:2007.13518 tab. 5]. Card: [FedML: A Research
Library and Benchmark for Federated Machine Learning](/papers/2007.13518).

### Vertical federated reinforcement learning (VFRL)

This is not feature-partitioned VFL. All agents act in one shared environment,
but each observes only part of the state, so their observation spaces differ and
together cover the global state [arxiv:2108.11887 §4.3]. Decision-oriented
agents act and receive rewards; support-oriented agents only observe
[arxiv:2108.11887 §4.3]. The card's six-step procedure initialises the models,
collects state-action-reward-state tuples, sends encrypted intermediate products
to a federated model, aggregates them, sends encrypted parameters back, and
updates each local model [arxiv:2108.11887 §4.3 steps 1-6]. Card:
[Federated Reinforcement Learning: Techniques, Applications, and Open
Challenges](/papers/2108.11887).

## When to use which

The surveys report no experiments, so none of these rows is a measured ranking.
Treat them as a design checklist. The VFLow framework frames the choice as a
constrained trade-off between task loss, privacy, efficiency and bias, but gives
no values or measures for its bounds [arxiv:2211.12814 §7].

| Situation | Use | Why |
|---|---|---|
| Parties share users, hold different features, and one party holds labels | Split VFL with a trainable top module [arxiv:2211.12814 §2.1] | This is the base setting; the top module is learned at the active party [arxiv:2211.12814 alg. 1]. |
| The labelled party has no features of its own | splitVFL_c or aggVFL_c [arxiv:2211.12814 §2.1] | The framework covers this case explicitly [arxiv:2211.12814 tab. 2]. |
| The top step should stay fixed and simple | aggVFL [arxiv:2211.12814 §2.1] | Aggregation replaces the trainable module. |
| Local models are tree ensembles | Tree-based VFL [arxiv:2211.12814 §2.2.1] | Parties exchange split information and, for GBDT, encrypted gradients and histograms. |
| Not every party holds every sample | Federated transfer learning [arxiv:2101.05428 §3] | The general survey names this extension but gives no protocol, so the aligned-sample rows above do not settle it. |
| Communication rounds or bandwidth are limited | Communication-efficient families [arxiv:2211.12814 §3] | [arxiv:2211.12814 tab. 3] lists O(1/√T) rates for several entries; these are the cited works' own results, not checked by the survey. |
| Few labels at the active party | Effectiveness families [arxiv:2211.12814 §4] | Each family adds its own training objective [arxiv:2211.12814 §4.1–§4.4]. |
| Accept some loss of model utility for privacy | Noise, discretisation or sparsification [arxiv:2211.12814 §5.3.4] | The survey names this utility-for-privacy trade-off. |
| Strong confidentiality of exchanged values | Cryptographic defenses [arxiv:2211.12814 §5.3.3] | The card records no cost figures for them. |
| Agents with reinforcement learning share one environment, each seeing part of its state | VFRL in federated RL [arxiv:2108.11887 §4.3] | This is a different setting; the feature-partitioned rows above do not describe it. |
| Prototype a VFL topology in an existing research library | FedML's worker API and topology manager [arxiv:2007.13518 §3] | The paper names vertical FL as a supported topology [arxiv:2007.13518 §3]. Its reported benchmark runs use FedAvg only [arxiv:2007.13518 tab. 5]. |
| Compare VFL methods on reported accuracy | None of the cards provides one | The VFL survey has no experiments of its own (see Results), and the FedML runs use FedAvg only [arxiv:2007.13518 tab. 5]. |

## Implementation sketch

The sketch shows the split VFL loop [arxiv:2211.12814 alg. 1]. For aggVFL,
replace `top_model` with a fixed function and skip its update. Tree-based VFL
does not use this loop; it exchanges split information instead
[arxiv:2211.12814 §2.2.1]. The survey says encryption, secure multi-party
computation or a trusted execution environment can wrap the transmitted values
[arxiv:2211.12814 §2.2]; the sketch leaves them out.

```pseudocode
# One VFL mini-batch, split form  [arxiv:2211.12814 alg. 1]
# Inputs: eta_1 (active party's top module), eta_2 (local models)

def vfl_step(batch_ids, features, labels, local_models, top_model):
    # Each party k computes its local output H_k on the batch  [arxiv:2211.12814 alg. 1]
    outputs = [
        local_models[k](features[k][batch_ids])  # H_k, size not stated
        for k in range(num_parties)
    ]
    # Active party: loss on the joined outputs, then update top module
    loss = task_loss(top_model(outputs), labels[batch_ids])
    top_model.update(eta_1 * grad(loss, top_model.params))
    # Active party sends dloss/dH_k back to party k  [arxiv:2211.12814 alg. 1]
    output_grads = grad(loss, outputs)
    # Party k turns its output gradient into a parameter update  [arxiv:2211.12814 eq. 3]
    for k in range(num_parties):
        local_models[k].update(eta_2 * local_grad(output_grads[k]))
    return loss
```

Two points the paper leaves for the implementer. The algorithm sends the output
gradients without encryption, while the encrypted exchange is described only in
prose [arxiv:2211.12814 alg. 1] [arxiv:2211.12814 §2.2]. Its notation drifts
between indices i and k in §2.2 and between [arxiv:2211.12814 eq. 3] and
[arxiv:2211.12814 alg. 1]; read each party's output as one tensor per mini-batch
[arxiv:2211.12814 §2.2].

## Contradictions

None known. The VFL claims rest on one survey, so there is no second source on
the same setting to disagree with. The federated RL survey uses "vertical" for a
different setting, so its results do not bear on the VFL rows above and no
conflict is recorded. The general FL survey's one-line description of FTL is
not checked against any second source; the VFL survey does not cover FTL.

## Papers

- [Vertical Federated Learning: Concepts, Advances and Challenges](/papers/2211.12814): survey of VFL covering the training protocol, communication, privacy attacks and defenses, fairness, applications and open challenges, plus the VFLow design framework. No experiments and no official code.
- [Federated Learning: Opportunities and Challenges](/papers/2101.05428): general FL survey with a short taxonomy that names VFL and federated transfer learning, plus training bottlenecks, attacks and defences. The survey has no experiments and no official code.
- [Federated Reinforcement Learning: Techniques, Applications, and Open Challenges](/papers/2108.11887): survey of federated RL, with a "vertical" setting in which agents share one environment and each sees part of its state. This is not feature-partitioned VFL. The survey has no experiments of its own.
- [FedML: A Research Library and Benchmark for Federated Machine Learning](/papers/2007.13518): open library and benchmark for FL research, whose worker API can express vertical FL topologies. Its reported experiments use FedAvg only. Official code (Apache-2.0).