Abstract:Split learning (SL) is a popular framework to protect a client's training data by splitting up a model among the client and the server. Previous efforts have shown that a semi-honest server can conduct a model inversion attack to recover the client's inputs and model parameters to some extent, as well as to infer the labels. However, those attacks require the knowledge of the client network structure and the performance deteriorates dramatically as the client network gets deeper (>= 2 layers). In this work, we explore the attack on SL in a more general and challenging situation where the client model is unknown to the server and gets more complex and deeper. Different from the conventional model inversion, we investigate the inherent privacy leakage through the server model in SL and reveal that clients' functionality and private data can be easily stolen by the server model, and a series of intermediate server models during SL can even cause more leakage. Based on the insights, we propose a new attack on SL: Pseudo-Client ATtack (PCAT). To the best of our knowledge, this is the first attack for a semi-honest server to steal clients' functionality, reconstruct private inputs and infer private labels without any knowledge about the clients' model. The only requirement for the server is a tiny dataset (about 0.1% - 5% of the private training set) for the same learning task. What's more, the attack is transparent to clients, so a server can obtain clients' privacy without taking any risk of being detected by the client. We implement PCAT on various benchmark datasets and models. Extensive experiments testify that our attack significantly outperforms the state-of-the-art attack in various conditions, including more complex models and learning tasks, even in non-i.i.d. conditions. Moreover, our functionality stealing attack is resilient to the existing defensive mechanism.

Functionality and Data Stealing by Pseudo-Client Attack and Target Defenses in Split Learning

PCAT: Functionality and Data Stealing from Split Learning by Pseudo-Client Attack

VILLAIN: Backdoor Attacks Against Vertical Split Learning

Dullahan: Stealthy Backdoor Attack against Without-Label-Sharing Split Learning

A Stealthy Backdoor Attack for Without-Label-Sharing Split Learning.

A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning

Make Split, not Hijack: Preventing Feature-Space Hijacking Attacks in Split Learning

Split Learning without Local Weight Sharing to Enhance Client-side Data Privacy

How to backdoor split learning

Passive Inference Attacks on Split Learning via Adversarial Regularization

Secure Split Learning Against Property Inference, Data Reconstruction, and Feature Space Hijacking Attacks

Adversarial for Good – Defending Training Data Privacy with Adversarial Attack Wisdom

SplitGuard: Detecting and Mitigating Training-Hijacking Attacks in Split Learning

Enhancing Accuracy-Privacy Trade-off in Differentially Private Split Learning

Split Ways: Privacy-Preserving Training of Encrypted Data Using Split Learning

Evaluating Privacy Leakage in Split Learning

Protecting Split Learning by Potential Energy Loss

Love or Hate? Share or Split? Privacy-Preserving Training Using Split Learning and Homomorphic Encryption

SplitOut: Out-of-the-Box Training-Hijacking Detection in Split Learning via Outlier Detection

Privacy-Preserving Split Learning with Vision Transformers using Patch-Wise Random and Noisy CutMix

Analyzing User-Level Privacy Attack Against Federated Learning