Abstract:Split learning, a distributed learning framework, has garnered significant attention from academic and industrial communities. In contrast to federated learning, split learning offers a more flexible architecture for participants with limited computing resources. However, the security of split learning has been questioned due to the separation of data and model control rights from usage rights. Currently, most research work focuses on inference attacks in split learning. In this paper, we first reveal the vulnerability of split learning to backdoor attacks and present two backdoor attack frameworks from both the server and client perspectives. Regarding the client-side attacker, we insert backdoor samples into the training data by utilizing the client's direct control over local data, and propose two methods for labeling backdoor samples that can be adapted to various application scenarios. Due to the server's lack of control over the client in split learning, it is infeasible for server-side attackers to inject backdoor samples into training data. Our strategy involves leveraging the server's control over the training process to shape the optimization direction of the client model, thereby enabling it to encode backdoor samples. Moreover, we introduce an auxiliary model into the attack framework to enhance the effectiveness of the backdoor attack. The auxiliary model can increase the distinction between backdoor samples and clean samples in the feature space to improve the sensitivity of the client model to backdoor samples. Extensive evaluations demonstrate the high attack accuracy of both proposed attack frameworks without causing any compromise to the performance of the main task. Our research uncovers the potential security risks and rings the alarm for the application of split learning.

SplitAUM: Auxiliary Model-Based Label Inference Attack Against Split Learning

VILLAIN: Backdoor Attacks Against Vertical Split Learning

SIA: A sustainable inference attack framework in split learning

Passive Inference Attacks on Split Learning via Adversarial Regularization

A Stealthy Backdoor Attack for Without-Label-Sharing Split Learning.

AdvUSL: Targeted Adversarial Attack Against U-shaped Split Learning

Dullahan: Stealthy Backdoor Attack against Without-Label-Sharing Split Learning

On the Robustness of Split Learning Against Adversarial Attacks

Similarity-Based Label Inference Attack Against Training and Inference of Split Learning

Functionality and Data Stealing by Pseudo-Client Attack and Target Defenses in Split Learning

Defending Label Inference Attacks in Split Learning under Regression Setting.

How to backdoor split learning

Secure Split Learning Against Property Inference, Data Reconstruction, and Feature Space Hijacking Attacks

Training on Fake Labels: Mitigating Label Leakage in Split Learning via Secure Dimension Transformation

PSLF: Defending Against Label Leakage in Split Learning

Masking-enabled Data Protection Approach for Accurate Split Learning

Evaluating Privacy Leakage in Split Learning

A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning

Make Split, not Hijack: Preventing Feature-Space Hijacking Attacks in Split Learning