Abstract:Split learning (SL) is a popular framework to protect a client's training data by splitting up a model among the client and the server. Previous efforts have shown that a semi-honest server can conduct a model inversion attack to recover the client's inputs and model parameters to some extent, as well as to infer the labels. However, those attacks require the knowledge of the client network structure and the performance deteriorates dramatically as the client network gets deeper (>= 2 layers). In this work, we explore the attack on SL in a more general and challenging situation where the client model is unknown to the server and gets more complex and deeper. Different from the conventional model inversion, we investigate the inherent privacy leakage through the server model in SL and reveal that clients' functionality and private data can be easily stolen by the server model, and a series of intermediate server models during SL can even cause more leakage. Based on the insights, we propose a new attack on SL: Pseudo-Client ATtack (PCAT). To the best of our knowledge, this is the first attack for a semi-honest server to steal clients' functionality, reconstruct private inputs and infer private labels without any knowledge about the clients' model. The only requirement for the server is a tiny dataset (about 0.1% - 5% of the private training set) for the same learning task. What's more, the attack is transparent to clients, so a server can obtain clients' privacy without taking any risk of being detected by the client. We implement PCAT on various benchmark datasets and models. Extensive experiments testify that our attack significantly outperforms the state-of-the-art attack in various conditions, including more complex models and learning tasks, even in non-i.i.d. conditions. Moreover, our functionality stealing attack is resilient to the existing defensive mechanism.

Split Learning without Local Weight Sharing to Enhance Client-side Data Privacy

Enhancing Accuracy-Privacy Trade-off in Differentially Private Split Learning

GELU-Net: A Globally Encrypted, Locally Unencrypted Deep Neural Network for Privacy-Preserved Learning.

Split Ways: Privacy-Preserving Training of Encrypted Data Using Split Learning

Binarizing Split Learning for Data Privacy Enhancement and Computation Reduction

Evaluating Privacy Leakage in Split Learning

Make Split, not Hijack: Preventing Feature-Space Hijacking Attacks in Split Learning

Functionality and Data Stealing by Pseudo-Client Attack and Target Defenses in Split Learning

Love or Hate? Share or Split? Privacy-Preserving Training Using Split Learning and Homomorphic Encryption

Splitfed learning without client-side synchronization: Analyzing client-side split network portion size to overall performance

PFSL: Personalized & Fair Split Learning with Data & Label Privacy for thin clients

Privacy-Preserving Split Learning Via Pareto Optimal Search.

Advancements of federated learning towards privacy preservation: from federated learning to split learning

Privacy-Preserving Split Learning with Vision Transformers using Patch-Wise Random and Noisy CutMix

PPCL: Privacy-preserving collaborative learning for mitigating indirect information leakage

PCAT: Functionality and Data Stealing from Split Learning by Pseudo-Client Attack

SplitAUM: Auxiliary Model-Based Label Inference Attack Against Split Learning

HierSFL: Local Differential Privacy-aided Split Federated Learning in Mobile Edge Computing

Dullahan: Stealthy Backdoor Attack against Without-Label-Sharing Split Learning

A Stealthy Backdoor Attack for Without-Label-Sharing Split Learning.

Split-U-Net: Preventing Data Leakage in Split Learning for Collaborative Multi-Modal Brain Tumor Segmentation