Vertical Federated Learning in Medical AI: Concepts, Advances, and Challenges

1. Introduction

The widespread digitization of healthcare data, combined with the growing demand for intelligent clinical decision-making systems, has propelled the integration of artificial intelligence (AI) into medical domains. However, the effective training of AI models typically requires large-scale, diverse, and high-quality data, which are often fragmented across multiple institutions due to privacy concerns, regulatory constraints, and organizational silos. Traditional approaches that rely on centralizing patient data pose significant risks, including data breaches and violations of privacy laws such as HIPAA [1] and GDPR [2].

Federated Learning (FL) has emerged as a promising alternative, allowing collaborative models training without requiring direct data sharing [3,4,5,6,7,8]. Among its variants, VFL is particularly relevant in health care, where different organizations usually have complementary characteristics (for example, the Hospital holds diagnostic images, Hospital B has laboratory results and a insurance company has stories of claims) of the same patient cohort [9,10,11,12]. In VFL, entities collaborately train a global model exchanging intermediate representations or gradients, rather than raw data, maintaining rigorous privacy through encrypted protocols such as homomorphic encryption (HE) [13] and safe multi -party computing (SMC) [14]. Several recent revisions discussed federated learning or vertical federated learning in general. However, as shown in Table 1, most of these surveys are not focused on the medical AI or not comprehensively addresses major components such as justice, privacy preservation mechanisms, or real -world health applications. On the other hand, this article offers a focused and deepened examination of vertical federated learning specifically adapted to the needs and challenges of AI medical systems.

Unlike horizontal federated learning (HFL) [15], which distributes sample data between customers, VFL presents exclusive challenges: ensuring the entity’s safe alignment, preventing labeling, managing unbalanced resource spaces and optimizing communication efficiency. Recent research has introduced various technical innovations to face these challenges, such as divided learning architectures, exchanges of gradients that preserve privacy, and shot communication mechanisms. IMA VFL [9] applications are growing rapidly, including joint diagnostic systems, health recommendations enhanced by telecommunications and collaborative risk forecast models. Despite these advances, significant obstacles remain. Privacy attacks, such as reversal of gradient and backdoor insertion, are evolving, while the heterogeneous nature of health data and the regulatory scenario complicates the implementation. In addition, there is a lack of standardization in the implementations of VFL and the limited exploitation of its integration with foundation models, customization strategies and learning with knowledge of justice in health contexts.

This review makes several distinct contributions to the field of privacy-preserving collaborative learning in healthcare.

• First, we provide a focused and domain-specific synthesis of Vertical Federated Learning (VFL), highlighting its theoretical underpinnings, system architecture, and applicability to medical AI scenarios.
• Second, we comprehensively review recent advancements in communication efficiency, model effectiveness, pri-vacy-preserving techniques, and fairness enforcement, contextualized within the unique constraints of healthcare environments.
• Third, we explore VFLow, a unified optimization framework that captures the multidimensional trade-offs among privacy, utility, fairness, and scalability—offering actionable insights for system design and deployment.
• Fourth, we analyze real-world healthcare use cases and implementations, bridging theory and practice.
• Finally, we outline open research challenges and future directions to guide the development of robust, equitable, and regulatory-compliant VFL systems. To the best of our knowledge, this is the first survey to present such a com-prehensive, healthcare-centric perspective on VFL.

The remainder of this paper is organized as follows: Section 2 outlines the fundamental concepts, problem formulation, and training protocols of VFL. Section 3, Section 4 and Section 5 discuss major components influencing VFL performance, including communica-tion efficiency, model effectiveness, privacy preservation, and fairness. Section 6 introduces the VFLow optimization framework. Section 7 reviews real-world applications of VFL in medical AI. Section 8 highlights open challenges and future directions. Finally, Section 9 presents concluding remarks.

Table 1. Comparison of existing VFL-related survey papers with this work in the context of medical AI.

Year	Reference	VFL in Medical AI	Communication Efficiency	Privacy & Security	Model Effectiveness	Fairness & Data Valuation	Applications in Healthcare	Open Challenges	Future Directions
2023	Ashish et al. [16]	✗	✓	✗	✗	✗	✓	✓	✓
	Zhuang et al. [17]	✗	✓	✓	✗	✗	✗	✓	✓
	Tariq et al. [18]	✗	✓	✗	✗	✗	✗	✓	✓
	AK et al. [19]	✗	✓	✓	✗	✗	✗	✓	✓
2024	Li et al. [9]	✓	✓	✓	✗	✗	✓	✓	✓
	ML et al. [20]	✗	✗	✓	✗	✗	✗	✓	✓
	Shi et al. [10]	✓	✓	✓	✓	✗	✓	✓	✓
—	This paper	✓	✓	✓	✓	✓	✓	✓	✓

Table 1. Comparison of existing VFL-related survey papers with this work in the context of medical AI.

Year	Reference	VFL in Medical AI	Communication Efficiency	Privacy & Security	Model Effectiveness	Fairness & Data Valuation	Applications in Healthcare	Open Challenges	Future Directions
2023	Ashish et al. [16]	✗	✓	✗	✗	✗	✓	✓	✓
	Zhuang et al. [17]	✗	✓	✓	✗	✗	✗	✓	✓
	Tariq et al. [18]	✗	✓	✗	✗	✗	✗	✓	✓
	AK et al. [19]	✗	✓	✓	✗	✗	✗	✓	✓
2024	Li et al. [9]	✓	✓	✓	✗	✗	✓	✓	✓
	ML et al. [20]	✗	✗	✓	✗	✗	✗	✓	✓
	Shi et al. [10]	✓	✓	✓	✓	✗	✓	✓	✓
—	This paper	✓	✓	✓	✓	✓	✓	✓	✓

2. Training Protocol in VFL and Fundamentals

3.1. Subsection

FL enables multiple organizations to collaboratively train machine learning models without exposing their private datasets. Based on the way data is distributed among participating entities, FL is generally classified into three categories. Horizontal Federated Learning (HFL): Parties share similar feature spaces but possess different samples. Common in sce-narios like multiple hospitals in different regions with similar patient records but distinct patients. VFL: Parties share overlapping sample space (same individuals) but hold different features. This is particularly useful in medical AI when institutions like hospitals, diagnostic labs, and insurance companies hold different attributes for the same set of patients. Federated Transfer Learning (FTL): Parties have little overlap in both features and samples, requiring transfer learning techniques to bridge the distribution gap. A comparative overview of key privacy-preserving methods used in Vertical Federated Learning, including their objectives, strengths, and limitations, is presented in Table 2.

VFL enables two or more parties with overlapping user bases but different feature spaces to collaboratively train a machine learning model. This is particularly well-suited for cross-institutional healthcare collaboration, where entities such as hospitals, imaging centers, insurance companies, and telehealth platforms hold complementary patient information. In a typical VFL setup, one party (the active party) holds the labels for the shared users, while the others (passive parties) contribute auxiliary feature data. In VFL, each participating institution holds different features corresponding to the same user IDs. Let the dataset be partitioned vertically among K institutions (e.g., hospital, lab, insurer), where:

▪

$X_k\in {\mathbb{R}}^{n\times d_k}$is the feature matrix held by the $K^{th}$ institution for $n$ samples and $d\_k$ features [21,22].

▪

One institution (active party) holds the corresponding labels $X_k\in {\mathbb{R}}^{n\times 1}$.

▪

The goal is to collaboratively train a model $f\left(X_1,X_2,\dots ,X_k\right)$ → $Y$ without sharing raw $X_k$or $Y$.

The learning objective is to minimize joint loss:

$$\underset{ɵ}{\min }{\displaystyle \frac{1}{n}} {\displaystyle {\sum }_{i=1}^n}\mathrm{L}\left(f\left(X_{i,1 }, X_{2 },\dots ,X_{i,k }\right)y_{i }\right)$$

(1)

while preserving privacy via secure computation protocols.

The training process in VFL typically includes Entity Alignment a privacy-preserving protocol (e.g., RSA-based Private Set Intersection) is used to align common user IDs across parties without revealing the full ID sets [23,24,25,26]. Forward Propagation each party computes partial model outputs using its local features and sends them in encrypted or masked form to the active party [27,28]. Loss and Gradient Computation the active party computes the loss and sends back partial gradients for each party to update their local model parameters [29,30]. Backward Propagation and Update each party updates its model using the received gradient and continues to the next iteration [31,32]. Popular frameworks supporting VFL include FATE (by WeBank) [33,34,35], which implements SecureBoost [36,37,38], Federated Logistic Regression [39,40], and privacy-enhancing cryptographic modules [41,42]. The typical workflow of Vertical Federated Learning involves secure entity alignment, encrypted intermediate result exchange, and collaborative model optimization between active and passive parties, as outlined in Algorithm 1.

VFL presents a highly suitable paradigm for addressing critical challenges in the healthcare domain, where data is inherently fragmented across various institutions. In a typical medical ecosystem, different entities, such as hospitals, diagnostic laboratories, pharmaceutical companies and insurance providers, each has complementary patients of patient data. For example, hospitals can store electronic health records (EHRs) [43], radiology reports and clinical notes; Laboratories can manage genomics, pathology results or biochemical profiles; While insurance companies are charged, reimbursement and demographic information. Despite all these entities that refer to the same patient population, privacy regulations such as HIPPA, GDPR and local data protection laws prohibit centralized data aggregation due to property concerns, confidentiality and regulatory compliance. VFL bypasses these problems, allowing the training of joint models between organizations that share ordinary users, but do not share gross resource data, making it an ideal structure for the collaboration of preserving privacy in health [44,45,46,47].

General VFL training procedure: Algorithm Initialize model parameters: local models ${\theta }_k$ (for each party $k = 1$ to $K$) and global model $\psi ₖ$. For each training iteration $t = 1$ to $T$:    Sample a mini-batch of aligned data ${\left\{x_i\right\}}_{\left\{i=1\right\}}^B$ across all parties.    Each passive party $k$ computes local output $h_k= G_k\left(x_k; {\theta }_k\right)$ .    Passive parties send $h_k$ to the active party (typically Party $K$), optionally in encrypted form.    Active party computes its own output $h_K$ = $G_K$($x_K$; ${\theta }_K$) and aggregates all $h_k$.    Active party computes loss $L=mathcal\left\{L\right\}\left(F_{K\left(h_1,...,h_K\right)};y\right)$.    Update global model: $\mathsf{\psi }\mathrm{ₖ} \to \mathsf{\psi }\mathrm{ₖ} - \mathsf{\eta }₁{\nabla }_{\mathsf{\psi }\mathrm{ₖ}}L$ .    Compute gradients w.r.t. each $h_k$ and send them to the corresponding party.    Each party $k$ computes local gradient ${\nabla }_{{\theta }_K}L$ using the chain rule.    Update local models: ${\theta }_K\to {\theta }_K-{\mathsf{\eta }}_2{\nabla }_{{\theta }_K}L$. Repeat steps 3–11 until convergence or maximum iterations are reached. Return to final model parameters $\left\{\mathsf{\theta }\mathrm{ₖ}\right\}\mathrm{c}\mathrm{c}\mathrm{ₖ}₌₁\mathrm{ᴷ}$ and $\mathsf{\psi }\mathrm{ₖ}$.

VFL’s ability to take advantage of complementary data modalities enhances predictive performance in medical applications, where single institution data sets are usually incomplete or have no multimodal representation [48,49]. By integrating hospital image data with laboratory confirmed biomarkers through VFL, it is possible to build more accurate diagnostic models for cancer, sepsis or cardiovascular disease. In adjunct, VFL aligns well with real -world collaborative configurations, where partnerships between tertiary hospitals and rural clinics, or between national health systems and private insurers, are increasingly common [50]. In these cross collaborations, VFL can facilitate learning at the population level without compromising privacy at patient level. It also allows the development of robust AI tools for demographic variability and regional heterogeneity, which is particularly important to guarantee justice and generalization in medical AI. Therefore, VFL not only mitigates the risks associated with centralized data grouping, but also opens new ways for multi-institutional learning, clinical research and personalized medicine, making it an indispensable approach in the future of safe and collaborative medical intelligence [8,46,51,52,53].

3. Improving Communication Efficiency and Improving Effectiveness

3.1. Communication Optimization

One of the primary challenges in VFL, especially in healthcare environments, lies in the communication overhead incurred during collaborative model training [54,55]. Unlike centralized or horizontal FL setups, VFL requires frequent and iterative exchange of intermediate results (e.g., encrypted gradients, activations, and loss information) between the active party and passive parties. This interaction is intensified in deep learning-based VFL systems where gradients must be exchanged for each forward and backward pass. In bandwidth-constrained or latency-sensitive healthcare settings such as real-time clinical support systems or remote diagnostics this communication overhead can significantly impede scalability and system responsiveness. Therefore, optimizing communication efficiency is a critical research focus to make VFL practical in real-world medical deployments. The core strategies designed to improve communication efficiency in VFL are presented in Table 3, covering methods such as asynchronous coordination, multiple local updates, and representation compression.

To mitigate excessive communication, several methods propose allowing multiple local updates before synchronization. Techniques such as FedBCD [56]and Flex-VFL [57] permit passive parties to perform several local training iterations before sending updates to the active party. This reduces the number of communication rounds without significantly affecting convergence. Adaptive schemes like CELU-VFL [64] adjust the frequency of updates based on the stability of gradient directions, reducing redundant message exchanges. These methods are particularly beneficial in healthcare systems with constrained network infrastructure, such as rural hospitals or edge devices in telemedicine platforms. Another approach to improve efficiency is through asynchronous coordination, where each party transmits updates independently instead of waiting for all parties to complete a training round. Frameworks like AVFL [58], VAFL [65], and GP-AVFL [59]decouple communication and computation by allowing parties to send stale updates while implementing mechanisms to compensate for delayed or outdated gradients. This is especially relevant in heterogeneous healthcare environments where compute and bandwidth capabilities vary widely between institutions (e.g., a primary care clinic vs. a national research hospital). Asynchronous methods also improve fault tolerance by reducing idle times due to straggling parties.

One shot VFL techniques aim to eliminate the need for iterative communication, sharing latent representations extracted from local resources in a single round of communication [66,67]. Methods such as Fedonce [23] and AE-VFL [9] employ non-supervised auto-enclosure or techniques such as PCA to convert vectors of local characteristics to compact incorporations, which are then shared with the active part. This approach dramatically reduces communication costs and is suitable for health applications, where the quick implementation of the model is crucial, such as outbreak detection or emergency screening systems. However, careful evaluation of privacy leakage is required through latent representations, as they can still codify confidential information.

Gradient compression and quantization are widely used to further reduce the size of exchanged data. Strategies like DESC (Double-End Sparse Compression) [60], quantized feature maps, and gradient sparsification can decrease communication overhead by more than 70% without significant performance degradation. In medical imaging or EHR-based VFL models, where gradient vectors are high-dimensional, such compression is especially valuable. Recent advances also combine compression with homomorphic encryption, allowing encrypted and compacted gradients to be safely transmitted. Finally, sample selection techniques and communication awareness resources aim to reduce the volume of data involved in training. Selecting only the most informative features or representative samples, methods such as ColorsEt-VFL [62], SFS-VFL [63] and LEST-VFL [68] reduce communication by preserving the accuracy of the model. This is particularly useful in medical contexts, where certain biomarkers or subgroups of patients can disproportionately influence the model’s performance.

3.2. Model Effectiveness & Learning Strategies

Although increased communication efficiency is vital to scalable implementation, the effectiveness of the model in relation to accuracy, generalization and stability of the prediction remains a cornerstone for the medical AI. In vertically partitioned medical care environments, where different parts maintain incomplete but complementary characteristics of the patient, the strong performance of the model is not trivial. Questions such as the scarcity of labels, absent modalities, and non-IID data distributions [69,70] can significantly affect the convergence and generalization of the model. This section analyzes the main strategies developed to face these challenges and improve the effectiveness of the model in VFL -based medical systems.

In many real -world medical assistance collaborations, the active part that labels (for example, a hospital) may have only a limited number of samples noted with other institutions (e.g., laboratories or insurance). To leverage unmarked but aligned data, the researchers proposed semi-supervised VFL structures. Methods such as VFED-SSD [71,72] use marked and unmarked aligned samples to jointly train a global predictor and local estimators. Likewise, self-sued learning approaches (SSL)-as contrastive learning or masked resource forecasting can be adapted to pre-giving models on local views before adjusting with limited supervision [73,74,75]. These techniques are especially valuable in radiology or pathology, where the labeled data is expensive to obtain.

Knowledge Distillation (KD) has become an effective tool for improving performance in heterogeneous VFL settings [76,77]. Instead of sharing raw features or models, each party distills knowledge (e.g., logits or feature maps) to a shared model or to an active party, enabling collaborative learning without direct parameter sharing. In healthcare, this means that institutions can share abstract predictions (such as diagnosis scores or embedding activations) that contribute to a stronger central model, all while preserving patient confidentiality. Advanced strategies like FedMD [78,79], FedGKT [80,81,82], and bidirectional distillation [83,84] further enhance this by using shared public datasets or hard sample selection to guide learning.

To address cold-start issues and small-data limitations in VFL, transfer learning can be employed by initializing local models with pretrained weights derived from public or synthetic medical datasets. For instance, pretrained convolutional encoders from large-scale chest X-ray datasets can be used by hospitals, while insurers may fine-tune transformer-based models pretrained on administrative claims. FedFML [85] and VFL-Prompt integrate foundation models or domain-specific language models into the VFL pipeline, facilitating rapid convergence and improved generalization in cross-institutional settings [86,87].

Vertical FL naturally introduces feature heterogeneity different feature dimensions across clients and label heterogeneity, where labels may be noisy, incomplete, or inconsistent [59,88,89,90]. To cope with feature disparity, feature alignment networks, split learning, or coordinated embedding spaces are applied to bring distributed feature representations into a common latent space. For the heterogeneity of the label, techniques of refinement of federated labels and correction of the label triggered by consensus were proposed [88,91]. These techniques are criticism of scenarios, such as the collaborative prognosis of cancer, where different institutions can use variant annotation systems or classification schemes. AI medical systems usually require personalized predictions, especially dealing with populations of institution specific patients, treatment protocols or sensor devices. Custom VFL models, such as FedPer-VFL [65,92] or PFEDGRAPH [93,94], maintain a global dorsal spine, allowing each client to adapt local layers or thin adjustment forecast heads. This hybrid learning strategy balances global generalization with local specialization, ensuring that the model remains effective in several health customers.

4. Privacy Preservation and Security

The preservation of privacy is in the heart of VFL, particularly in health applications, where data sensitivity and regulatory requirements are fundamental. In VFL, collaboration occurs among various entities (eg hospitals, insurance providers, diagnostic laboratories) that share ordinary users but have different resources. Although gross data are never exchanged, iterative sharing of intermediate exits, such as gradients or activations, introduces new vulnerabilities. As VFL becomes increasingly adopted in medical AI, ensuring that strong guarantees of privacy and defense against opposing attacks is fundamental to the implementation of the real world. This section describes the models of primary threats in VFL and summarizes the main preservation and defense strategies of privacy and privacy. The primary privacy-preserving techniques used in Vertical Federated Learning—namely homomorphic encryption, secure multiparty computation, and differential privacy—along with their respective strengths and limitations, are compared in Table 4.

4.1. Threat Models in VFL

Despite its privacy preservation objectives, VFL is inherently vulnerable to various security threats due to the collaborative nature of its training process and the exchange of intermediate data. A threat category includes inference attacks, in which malicious participants–usually the active part call to rebuild private resources inputs or infer sensitive labels of gradients received or intermediate representations. Common forms of inference attacks include gradient reversal, resource reconstruction and label inference attacks, each capable of leaking confidential information from the patient. In addition, batch level attacks pose risks in mini-point training scenarios, where opponents can explore correlations between input samples and gradient updates to infer or manipulate batch labels. Poisoning attacks are another serious threat, where a subverted component contains evil updates or poisoned samples to degrade model performance or inject backdoors. These adversary behaviors endanger the trustworthiness of VFL systems, especially in privacy-sensitive applications, such as the medical AI, where data privacy and model integrity are most important [12,102,103]. Detection and countermeasures against these threat models are therefore critical to ensuring secure deployment of VFL in real-world health applications [51,104,105].

4.1. Cryptographic Techniques for Secure Computation

To ensure safe collaboration between various parts of VFL, cryptographic techniques [106,107,108,109] have become central to preserve data confidentiality during model training. One of the most prominent approaches is homomorphic encryption (HE), which allows mathematical operations to be performed directly on encrypted data without decryptography. This allows the parties to share encrypted intermediate representations or gradients, preventing the active party from reconstructing gross resources values. Widely used schemes such as paillier and CKKs support additive or approximate multiplicative operations, making them suitable for safe gradient and VFL loss computing. Another widely adopted strategy is Secure Multipartisan Computing (SMC) [97], where several participants calculate a joint function about their private entries without revealing these entries with each other. SMC based protocols are commonly employed for tasks such as private set intersection (PSI) [110,111] during the entity alignment and the safe aggregation of model updates. Reliable execution environments (Tees) [101,112]offer a hardware assisted approach to ensure computing, isolating sensitive operations within a reliable enclave. T-shirts like Intel SGX [113,114] have been leveraged on VFL systems to perform calculations in simple data safely, although they remain susceptible to side canal attacks and hardware vulnerabilities. Although these cryptographic tools significantly strengthen privacy in VFL systems, their deployment usually introduces computational overload challenges and scalability, especially in large -scale medical applications. As such, the design of light but robust protocols that preserves privacy remains a critical area of research ongoing.

4.3. Differential Privacy in VFL

Differential Privacy (PD) has emerged as a powerful structure to protect individual level information in federated learning, including VFL [31,115,116]. By introducing calibrated noise into intermediate calculations such as gradients, logits or model outputs-PD ensures that the inclusion or deletion of a single dataset has a limited impact on model behavior, thus minimizing the risk of leakage. In VFL, PD mechanisms can be applied locally, each part before transmitting local outputs (local PD [117]) or globally after active part (global PD [118]). However, the implementation of PD in VFL has unique challenges. Since only part usually keeps labels (the active part), it becomes a primary target for label inference attacks, and noise injection should be carefully balanced to preserve the utility of the model. In addition, VFL dependence on aligned samples and intermediate results sharing increases the complexity of projecting privacy budgets between the parties. To solve these problems, recent surveys exploit adaptable noise injection, privacy accounting, and safe DP protocols from various parts, adapted for vertically partitioned data. Although PD enhance formal privacy and complements cryptographic methods, such as homomorphic encryption and safe multiparty computing, this may adversely affect forecast convergence and performance, especially in sensitive medical tasks [119,120]. Therefore, work in progress seeks to develop privacy exchange structures to guide practical implementation in VFL systems focused on medical care.

4.4. Robustness Against Poisoning and Backdoor Attacks

VFL focuses on preservation of privacy, it remains vulnerable to backdoor poisoning and manipulation attacks, where malicious participants intentionally compromise the training process. In poisoning attacks [121,122], an opponent part has malicious data samples or manipulates gradient updates to degrade the overall performance of the model, reducing reliability or distorting the results in specific scenarios. In the context of medical AI, these attacks may result in diagnostic errors or biased treatment recommendations, representing significant clinical risks [123,124,125]. Backdoor attacks represent a more secret threat, where opponents incorporate hidden triggers during training that make the model incorrectly behave only in specific entrances, remaining not detected during normal use [126,127]. To defend against these adversary behaviors, various robust aggregation strategies have been proposed, such as median, trimmed or standard -based clipping, which reduce the influence of updates or more or less suspicious. In addition, anomaly detection techniques monitor the consistency of gradient updates to signal malicious behaviors. Other defenses include gradient to filter or disturb potentially harmful updates and opposite training, which hardens the model, simulating possible attack scenarios during learning. Although these methods increase robustness, they should be carefully designed to avoid impairing the utility of the model or violating privacy restrictions. As VFL gains strength in high -risk domains, such as health, ensuring robustness against directed and indiscriminate attacks is essential for building reliable and implantable systems.

4.5. Label Privacy and Entity Alignment

In VFL, a distinct feature is that the active part has the destination labels, while the passive parts contribute to resource information for the same set of users [128]. This centralized property of the label is an active part of a main target for label inference attacks, especially during the early training stages, when model parameters are subtitled and more vulnerable to leakage. Invadors may explore the relationship between shared intermediate outputs (eg gradients or activations) and labels to rebuild or infer patients sensitive to the patient, such as disease status or clinical risk scores. Ensuring the privacy of the label, therefore, requires carefully designed mechanisms, including label masking, smooth label coding and noise injection based on differential privacy during backwardness. Additionally, the process of record matching between institutions without revealing patients’ identities, known as entity alignment, is a necessity for VFL. Techniques such as Private Intersection (PSI), which are founded on cryptographic building blocks like RSA or elliptic curves, are commonly employed to match users in a way that ensures privacy [129]. However, these methods usually assume exact correspondence and can fight with data inconsistencies, typographic errors or heterogeneity in identifier formats among health service providers. Emerging solutions now explore diffuse correspondence protocols, safe hash -based correspondence, and privacy preservation registration connection, which allow safe and approximate alignment while reducing computational overload. Both the privacy of the label and the alignment of safe entities are fundamental to maintain the confidentiality and integrity of the VFL in real -world medical applications and require continuous attention to safe and scalable implantation [12].

4.6. Trade-Offs: Privacy vs. Utility

Obtaining strong guarantees of privacy in VFL usually has the cost of reduced performance of the model, highlighting a critical exchange between privacy and utility. Techniques such as homomorphic encryption, differential privacy and safe multipartisan computing provide essential protections against data leakage, but introduce additional computational overload, latency and, in the case of differential privacy, intentional noise that can undermine model accuracy. In sensitive domains, such as the medical authority, the quality of the forecast can directly influence clinical decision making-the balance of this trade-off becomes especially challenging. Excessive privacy restrictions may result in slow convergence, convergence or biased predictions, while insufficient privacy exposes institutions and patients to safety risks. Recent studies [130,131,132] have proposed adaptable privacy budget, privacy recognition optimization and selective encryption as ways to dynamically adjust the level of protection based on data sensitivity, stage stage or party function. In addition, structures that jointly evaluate privacy-use compensations using formal metrics (eg privacy loss, curve area (AUC) or forecasting error) are increasingly used to guide system design. Finally, the ability to manage this balance with flexibility is essential to making VFL safe and practical for implementing real -world medical care. Finally, the design of VFL systems that preserve privacy should balance safety guarantees with the effectiveness and efficiency of the model. This is particularly challenging in medical AI, where strict privacy laws coexist with the need for high diagnostic accuracy. Theoretical stations, such as Privacy-Utility Trade-off (PUE), the aid of the system design aid system, quantifying acceptable noise [133,134].

5. Data Valuation and Fairness in VFL

In VFL, collaborative training occurs between institutions that contribute to heterogeneous data–both in terms of quantity and utility. Although the preservation of data privacy is a main concern, another equally important aspect is justice–defining that all participants benefit proportionally to their contributions. This becomes especially important in medical AI, where institutions such as large hospitals, small clinics, research laboratories and insurance providers can vary widely in data volume, quality and resource wealth. Without adequate mechanisms for data assessment and contribution awareness training, some pieces may feel discouraged to participate, threatening the sustainability of federated learning ecosystems. This section discusses the main approaches to quantify contributions, ensuring justice and attenuating bias in VFL settings.

At the same time, justice in the behavior of the model is equally crucial, especially in sensitive domains, such as health care, where biased predictions can lead to unequal treatment results between demographic groups. Federated learning systems should therefore guarantee justice between parts-as a balanced performance between institutions and justice between groups-like demographic parity in forecasts. This can be achieved through justice aggregation, opposing training for bias mitigation and regularization techniques that penalize performance disparities. In addition, representational disparities among customers can spread to the global model if not managed carefully. Another layer of complexity arises from the fact that the institutional metadata necessary for the audit of justice (eg demographic composition) is often restricted due to concerns about privacy. Although there are promising methods, many still suffer from high computational overload or depend on assumptions that may not stay in practice. Consequently, the projection of scalable solutions, the preservation of privacy and interpretable for assessment and data justice remains an open challenge. Advancing, it is essential to integrate justice goals directly into the VFL protocols to promote reliable, sustainable and ethically solid collaboration in various stakeholders in health. As outlined in Table 5, current approaches to fairness and contribution scoring in VFL range from Shapley-based valuation to fairness-aware aggregation, each offering unique trade-offs between equity and model performance.

6. VFLow: Unified Optimization Framework for VFL

As VFL becomes increasingly complex and preserving privacy, communication efficiency, justice and model performance, there is a growing need for systematic and integrated optimization structures that can guide their implementation in real mutual applications, especially in the medical AI. One of these structures is VFlow, a unifying conceptual architecture proposed to harmonize multidimensional restrictions on VFL systems. VFlow aims to provide a holistic basis for the development, analysis and optimization of VFL protocols under simultaneous privacy, accuracy, efficiency and justice requirements.

6.1. Cryptographic Techniques for Secure Computation

Traditional VFL implementations usually optimize a single axis–such as minimizing the cost of communication or applying privacy guarantees without fully considering interaction with utility and equity. In medical care environments, this fragmented optimization is inadequate, such as stakeholder demand a strong privacy preservation due to patient-sensitive data. High model performance for accurate diagnosis and risk prediction. Communication efficiency in low-resource or edge settings. Equitable benefit distribution across collaborating institutions. VFLow was introduced to address these multi-objective, cross-domain challenges, making it a valuable conceptual and practical tool for federated medical AI.

6.2. Core Components of the VFLow Framework and Optimization Strategies

VFLow decomposes VFL optimization into five tightly coupled pillars:

• Communication Efficiency: Reducing the number and size of transmitted messages (e.g., gradients, logits) using techniques such as asynchronous updates, compression, and feature selection [143].
• Effectiveness (Model Utility): Ensuring the predictive power and generalizability of the trained model using semi-supervised learning, transfer learning, and robust optimization [144].
• Privacy and Security: Guaranteeing strong protection against inference, poisoning, and reconstruction attacks through cryptographic protocols, differential privacy, and secure entity alignment [145].
• Fairness and Data Valuation: Promoting equitable participation by integrating mechanisms for contribution scoring, bias mitigation, and reward allocation [146].
• Computational Efficiency and Scalability: Managing resource-constrained deployments by supporting heterogeneous devices and minimizing training time [147].

Each component may trade off with the others—for example, stronger encryption (privacy) may increase computation and communication cost, while gradient clipping (robustness) may affect utility. VFLow addresses this through multi-objective optimization strategies.

To optimize across the five pillars, VFLow employs pareto-ideal trade-off models, balancing objectives such as privacy loss, utility degradation and communication cost under restrictions. Adaptable learning schedules that adjust gradient noise levels, communication frequency and local update depth based on convergence signs or privacy budget consumption. Hybrid aggregation schemes that integrate customer specific weights from the contribution scores, restrictions of justice and similarity of the model. Modularization with task recognition, allowing different components (e.g., resource extractors, predictors) to be trained or optimized independently between the parties. These strategies are supported by metrics such as: Privacy-Utility Trade-off Score (PUTS) [148]; Communication Efficiency Ratio (CER) [149]; Fairness Disparity Index (FDI) [150]; Contribution Weighted Accuracy (CWA) [151].

In healthcare-specific deployments, VFLow enables prioritization of fair representation across hospitals with different data resources. Regulatory alignment, by tuning encryption levels and auditability parameters. Edge-compatibility, supporting remote clinics or mobile diagnostic devices. Custom personalization, enabling adaptation to local patient populations without compromising global model integrity. Frameworks such as FATE, FedML, and OpenFL can be extended or modularized using VFLow principles to achieve deployment-ready VFL systems for clinical use cases.

7. Applications for VFL in Medical AI

VFL has a transformative potential for medical care, allowing collaborative intelligence in silent institutions without compromising the patient’s privacy. Medical domain is inherently fragmented, with different entities, such as hospitals, diagnostic laboratories, insurance providers, pharmaceutical companies and wearable devices that have disjunctive but complementary data. VFL offers a scalable preservation and privacy structure to merge these data sources distributed for the creation of more accurate, equitable and robust AI systems. This section analyzes the main areas of application of IMA Medical VFL, supported by cases of real use of the world and implementations in progress. Representative VFL use cases in the medical field are described in Table 6, showing how multi-institutional collaboration allows privacy preservation models for diagnosis, treatment planning and medical care analysis.

7.1. Disease Prediction and Risk Stratification

Disease forecasting and patient risk stratification represent some of the most impactful applications of VFL in medical AI. In real clinical environments, different stakeholders in health often have complementary patient information. For example, hospitals may have access to Electronic Image and Health Records (EHRs) [152], laboratories can manage diagnostic biomarkers, and insurance providers can retain demographic and lifestyle data. By leveraging VFL, these institutions can train predictive models collaborated for chronic conditions–such as cardiovascular disease, diabetes and cancer, without exposing or sharing gross data. This privacy preservation collaboration enhances the generalization and performance of the model, particularly in limited or highly silent data settings. Several studies have shown that integrating vertically partitioned data significantly improves prediction accuracy compared to models trained on isolated datasets. For instance, risk stratification models for stroke or breast cancer have been shown to benefit from combining hospital-based clinical data with insurance claims and lifestyle indicators. As a result, VFL-based disease prediction systems are increasingly being explored for proactive population health management and personalized preventive care strategies.

Table 6. Representative applications of VFL in medical AI.

Application	Data Holders	Model Objective	Privacy Strategy	Example
Cancer prognosis	Hospital (imaging), lab (genomics)	Joint survival prediction	HE, SMC	FATE platform, SecureBoost [153]
Diabetic retinopathy	Eye clinic (retina scans), GP (glucose)	Retinopathy detection	Split learning	Cross-clinic VFL study [154]
Drug trial recruitment	Pharma (trial data), hospital (EMR)	Identify eligible patient cohorts	PSI, label masking	Federated trial matching systems [155]
COVID-19 severity prediction	Hospital (labs), agency (demographics)	Risk stratification model	DP + asynchronous updates	Multi-region pandemic VFL project [156]
Telehealth recommendation	App (wearables), clinic (medical history)	Personalized care suggestions	Secure gradient exchange	Federated mHealth engine [157]

Table 6. Representative applications of VFL in medical AI.

Application	Data Holders	Model Objective	Privacy Strategy	Example
Cancer prognosis	Hospital (imaging), lab (genomics)	Joint survival prediction	HE, SMC	FATE platform, SecureBoost [153]
Diabetic retinopathy	Eye clinic (retina scans), GP (glucose)	Retinopathy detection	Split learning	Cross-clinic VFL study [154]
Drug trial recruitment	Pharma (trial data), hospital (EMR)	Identify eligible patient cohorts	PSI, label masking	Federated trial matching systems [155]
COVID-19 severity prediction	Hospital (labs), agency (demographics)	Risk stratification model	DP + asynchronous updates	Multi-region pandemic VFL project [156]
Telehealth recommendation	App (wearables), clinic (medical history)	Personalized care suggestions	Secure gradient exchange	Federated mHealth engine [157]

7.2. Collaborative Diagnostics and Imaging Analysis

VFL enables hospitals and imaging centers to jointly train models for radiology and pathology analysis, especially when images (e.g., CT, MRI, X-rays) are hosted at one institution and the corresponding patient history or lab markers are stored elsewhere. Use cases include:

• Cross-hospital training of lung nodule classification models combining CT images and clinical records.
• Distributed tumor detection systems where diagnostic centers share histopathological features, and hospitals contribute clinical outcomes for supervised learning.
• Ophthalmology AI that leverages retinal imaging from eye clinics and glucose levels from primary care providers to predict diabetic retinopathy.

This cooperation improves clinical accuracy by ensuring compliance with HIPAA and GDPR.

7.3. Drug Discovery and Clinical Trial Optimization

VFL offers valuable opportunities to accelerate drug discovery and optimize the project of clinical trials, allowing collaboration between pharmaceutical companies, hospitals, research institutions and regulatory bodies–preserving data confidentiality. In drug development, access to data from various patients and various sources is critical to identifying therapeutic targets, understanding adverse effects and stratifying test populations. However, privacy regulations and competitive concerns often make it difficult to share data between stakeholders. VFL addresses this limitation, allowing institutions to train models collaboratively in vertically partitioned data sets–such as combining genomic data from research laboratories with clinical results from hospitals and demographic ideas from insurance providers–without revealing gross data. In clinical trials, VFL can support the recruitment of federated patients, where potential participants are examined in various institutions using joint models of eligibility without exposing health -sensitive records. It can also allow actual risk modeling and safety signal detection, continually learning from distributed longitudinal data sets. In addition, VFL facilitates pharmacogenomic research, integrating genetic markers with drug response data, maintaining strict privacy compliance. These features reduce development deadlines, increase patient safety and improve test generalization. As personalized medicine advances, VFL is ready to become a fundamental structure in the collaborative research of medicines and regulatory and conscious science of privacy.

Examples: 1) VFL-qualified recruiting systems aligned with inclusion criteria utilising dispersed data sets. 2) Models for detecting security signals that learn from unfavourable event reports while maintaining anonymity. 3) Pharmacogenomic models integrating genetic and prescription data from distinct institutions. This collaboration accelerates the drug development pipeline while protecting the patient’s privacy.

7.4. Personalized Treatment and Recommendation Systems

Personalized medicine, which aims to adapt health decisions to the individual characteristics of the patient, should benefit significantly with the integration of VFL. In practice, different entities have different but complementary data to customize care–hospitals maintain clinical stories, pharmacies track prescription standards, climate dispositions provide physiological signs, and insurers maintain demographic and behavioral data. VFL allows these stakeholders to collaborate to collaborate to train AI -oriented treatment recommendation systems without compromising data privacy or violating institutional policies. For example, a weather hospital and device provider can jointly develop a personalized diabetes management model that integrates continuous glucose monitoring with adherence to medicine levels and activity. Similarly, in oncology, VFL structures can support the selection of patient specific therapy, combining the tumor genomic research laboratory with clinical results stored in a hospital system. In addition to clinical contexts, VFL was used to develop digital health recommendation systems that offer lifestyle, nutrition or medicine advice, adding distributed behavioral and health data. These models improve the accuracy and contextual relevance of recommendations, remaining in accordance with privacy regulations. As medical care changes to patient -oriented preventive models, VFL offers a scalable and safe base to provide personalized interventions between organizational boundaries.

7.5. Healthcare Resource Allocation and Public Health

VFL also has a substantial promise in improving operations at the health system level, particularly resource allocation, public health surveillance and policy planning. These tasks usually require collaboration in various entities, such as hospitals, public health agencies, insurance providers and government institutions, each of which has partial but essential information on population health trends, health use or regional risk factors. VFL allows these stakeholders to collaborately build predictive models to predict the demand for hospital beds, disease outbreak forecast and vaccination prioritization to expose sensitive data at the individual level. For example, during the Covid-19 pandemic, VFL could facilitate joint learning in different provinces or hospitals to predict the regional ICU capacity needs, combining epidemiological data, comorbidity profiles and test trends. Similarly, public health agencies can partner with diagnostic and clinical laboratories to monitor initial signs spread through infectious diseases, preserving the privacy of the citizen. In chronic disease management, insurers and providers can jointly analyze risk stratification models to optimize preventive resource allocation. These applications demonstrate how VFL supports data-driven public health strategies in a privacy-preserving manner, ensuring ethical and regulatory compliance while enabling coordinated, real-time decision-making for population-wide benefit.

7.6. Real-World Implementations and Case Studies

Several platforms and projects have already adopted VFL in real-world medical settings:

• WeBank’s FATE framework has been deployed in joint cancer risk prediction projects between banks and hospitals in China [11].
• OpenFL by Intel supports cross-institutional radiology model training for pneumonia and COVID-19 detection [158].
• Mayo Clinic and NVIDIA CLARA collaboration leverages FL (and VFL extensions) for privacy-aware medical imaging analytics [159].
• Federated Tumor Segmentation (FeTS) Challenge explores federated frameworks across global institutions using brain tumor data [160].

These examples illustrate growing industry adoption and practical feasibility of VFL for sensitive, large-scale medical AI applications.

8. Open Challenges and Future Directions

Despite its growing adoption, VFL faces several unresolved challenges that limit its full potential in medical AI. Efficient and privacy-preserving entity alignment remains a key bottleneck, especially in real-world healthcare systems with inconsistent identifiers. Label privacy is another concern, as the active party becomes a central target for label inference attacks, compounded by the limited availability of labeled medical data. Scalability is challenged by dynamic participation, requiring VFL frameworks to support continual learning and adapt to changing client sets. Heterogeneity in local models and computing resources also hinders deployment, calling for flexible and modular architectures. Moreover, balancing privacy, model utility, and robustness under strict constraints remains a delicate trade-off. Fairness and transparency are essential to ensure equitable performance across diverse institutions and demographics yet remain underexplored. Lastly, the integration of VFL with large pre-trained foundation models and the lack of standardized benchmarks highlight the need for further innovation, rigorous evaluation, and cross-institutional collaboration to bring VFL into practical, trustworthy use in healthcare. Key open challenges and future research directions in vertical federated learning are summarized in Table 7, addressing issues such as entity alignment, fairness, personalization, and integration with foundation models.

9. Concluding Remarks

VFL presents a transformative opportunity for advancing collaborative intelligence in healthcare, offering a practical solution to the longstanding tension between data utility and privacy. By enabling institutions to jointly train models on vertically partitioned datasets without exposing sensitive patient information, VFL aligns with both ethical imperatives and regulatory mandates in medical environments. This survey has provided a comprehensive overview of VFL concepts, system architectures, and training mechanisms, with an emphasis on the unique demands of healthcare applications. We have analyzed recent developments in communication efficiency, privacy-preserving techniques, model robustness, fairness, and data valuation, culminating in the introduction of VFLow—a unified framework for understanding optimization trade-offs in real-world deployments. Furthermore, we have reviewed diverse healthcare applications ranging from disease prediction and personalized treatment to public health planning and clinical trial optimization, demonstrating the practical relevance of VFL in modern medical AI systems. Compared to existing reviews, this work offers a domain-specific synthesis that addresses the intersection of machine learning, healthcare collaboration, and secure computation. Despite significant progress, several challenges remain such as scalable entity alignment, label privacy, dynamic participation, and fairness auditing all of which must be addressed to unlock the full potential of VFL. Looking forward, we envision a future where VFL becomes a foundational pillar of privacy-aware medical AI, enabling global collaboration while preserving patient trust and institutional autonomy.