Abstract:Split learning (SL) is a popular framework to protect a client's training data by splitting up a model among the client and the server. Previous efforts have shown that a semi-honest server can conduct a model inversion attack to recover the client's inputs and model parameters to some extent, as well as to infer the labels. However, those attacks require the knowledge of the client network structure and the performance deteriorates dramatically as the client network gets deeper (>= 2 layers). In this work, we explore the attack on SL in a more general and challenging situation where the client model is unknown to the server and gets more complex and deeper. Different from the conventional model inversion, we investigate the inherent privacy leakage through the server model in SL and reveal that clients' functionality and private data can be easily stolen by the server model, and a series of intermediate server models during SL can even cause more leakage. Based on the insights, we propose a new attack on SL: Pseudo-Client ATtack (PCAT). To the best of our knowledge, this is the first attack for a semi-honest server to steal clients' functionality, reconstruct private inputs and infer private labels without any knowledge about the clients' model. The only requirement for the server is a tiny dataset (about 0.1% - 5% of the private training set) for the same learning task. What's more, the attack is transparent to clients, so a server can obtain clients' privacy without taking any risk of being detected by the client. We implement PCAT on various benchmark datasets and models. Extensive experiments testify that our attack significantly outperforms the state-of-the-art attack in various conditions, including more complex models and learning tasks, even in non-i.i.d. conditions. Moreover, our functionality stealing attack is resilient to the existing defensive mechanism.

PCAT: Functionality and Data Stealing from Split Learning by Pseudo-Client Attack

Functionality and Data Stealing by Pseudo-Client Attack and Target Defenses in Split Learning

Private Data Inference Attacks against Cloud: Model, Technologies, and Research Directions

A Stealthy Backdoor Attack for Without-Label-Sharing Split Learning.

Dullahan: Stealthy Backdoor Attack against Without-Label-Sharing Split Learning

VILLAIN: Backdoor Attacks Against Vertical Split Learning

Adversarial for Good – Defending Training Data Privacy with Adversarial Attack Wisdom

Towards Efficient Data Free Blackbox Adversarial Attack

Split Learning without Local Weight Sharing to Enhance Client-side Data Privacy

SIA: A sustainable inference attack framework in split learning

On the Robustness of Split Learning Against Adversarial Attacks

How to backdoor split learning

A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning

Passive Inference Attacks on Split Learning via Adversarial Regularization

Make Split, not Hijack: Preventing Feature-Space Hijacking Attacks in Split Learning

Enhancing Accuracy-Privacy Trade-off in Differentially Private Split Learning

AdvUSL: Targeted Adversarial Attack Against U-shaped Split Learning

Secure Split Learning Against Property Inference, Data Reconstruction, and Feature Space Hijacking Attacks

Masking-enabled Data Protection Approach for Accurate Split Learning

Model Extraction Attacks on Split Federated Learning