# Make Split, not Hijack: Preventing Feature-Space Hijacking Attacks in Split
Learning

Tanveer Khan  0000-0001-7296-2178 Tampere UniversityTampereFinland
<EMAIL_ADDRESS>,  Mindaugas Budzys  0000-0002-1913-7985 Tampere
UniversityTampereFinland<EMAIL_ADDRESS>and  Antonis Michalas
0000-0002-0189-3520 Tampere UniversityTampereFinland RISE Research Institutes
of SwedenGothenburgSweden<EMAIL_ADDRESS>
###### Abstract.

The popularity of Machine Learning (ML) makes the privacy of sensitive data
more imperative than ever. Collaborative learning techniques like Split
Learning (SL) aim to protect client data while enhancing ML processes. Though
promising, SL has been proved to be vulnerable to a plethora of attacks, thus
raising concerns about its effectiveness on data privacy. In this work, we
introduce a hybrid approach combining SL and Function Secret Sharing (FSS) to
ensure client data privacy. The client adds a random mask to the activation
map before sending it to the servers. The servers cannot access the original
function but instead work with shares generated using FSS. Consequently,
during both forward and backward propagation, the servers cannot reconstruct
the client’s raw data from the activation map. Furthermore, through visual
invertibility, we demonstrate that the server is incapable of reconstructing
the raw image data from the activation map when using FSS. It enhances privacy
by reducing privacy leakage compared to other SL-based approaches where the
server can access client input information. Our approach also ensures security
against feature space hijacking attack, protecting sensitive information from
potential manipulation. Our protocols yield promising results, reducing
communication overhead by over $2\times$ and training time by over $7\times$
compared to the same model with FSS, without any SL. Also, we show that our
approach achieves $>96\%$ accuracy and remains equivalent to the plaintext
models.

Function Secret Sharing, Machine Learning, Privacy, Split Learning

##  1\. Introduction

In recent years, Machine Learning (ML) has developed into a highly valuable
field used in everyday situations. Various ML applications, like large
language models (OpenAI, 2021), have become more accessible than ever before.
However, ML requires a suitable amount of processing power to train. As such,
various companies have started offering Machine-Learning-as-a-Service (MLaaS)
to allow clients to use maintained servers to outsource resource-intensive ML
tasks. Despite its benefits, MLaaS raises privacy concerns, as it requires
sharing client data to a company during model training (Shokri et al., 2017;
Hu et al., 2022). To address this privacy issue, researchers have begun
developing Privacy-Preserving Machine Learning (PPML) techniques to protect
client data (Khan et al., 2021; Khan and Michalas, 2023; Khan et al., 2024).
These techniques encompass cryptographic approaches like Homomorphic
Encryption (HE) (Gentry, 2009) and Multi-Party Computation (MPC) (Yao, 1986)
as well as collaborative learning approaches such as Federated Learning (FL)
(McMahan et al., 2016; Konečnỳ et al., 2016) and Split Learning (SL) (Abuadbba
et al., 2020). These techniques have been used in a number of works and
successfully reduce the privacy leakage of ML (Abuadbba et al., 2020; Sav et
al., 2021; Hesamifard et al., 2016; Nguyen et al., 2023; Khan et al., 2023c,
a, b).

FL and SL are two methods which allow to train a model collectively from
various distributed data sources without sharing raw data. FL, introduced by
Google AI Blog, allow each user to run a copy of the entire model on its data.
The server receives updated weights from each user and aggregates them.
However, in FL, the users’ model weights are shared with the server, which can
leak sensitive information (Hitaj et al., 2017). The SL approach proposed by
Gupta and Raskar (Gupta and Raskar, 2018) offers a number of significant
advantages over FL. With SL, multiple parties can train an ML model together
while keeping their respective parts private. Similar to FL, SL does not share
raw data but it has the benefit of not disclosing the model’s architecture and
weights and clients can train an ML model without sharing their data with a
server, which has the remaining part of the model. Hence, in this work, our
focus is on the SL technique, where low-cost operations are performed on the
client-side while, computationally expensive operations are outsourced to a
powerful server, expediting the models training process. However, SL without
any additional privacy-preserving measures is prone to privacy leakage through
Feature Space Hijacking Attack (FSHA) (Pasquini et al., 2021) or data analysis
techniques, such as Visual Invertibility (VI) (Abuadbba et al., 2020).

Through VI a malicious server is able to infer information of the underlying
input data by analysing the visual similarity between the original image and
the produced activation map after a number of convolutional layers. Looking
into improving the security and efficiency of individual approaches,
researchers have lately started exploring solutions that combine several
privacy-preserving techniques (Khan et al., 2023b; Truex et al., 2019; Sav et
al., 2021). As such, researchers proposed to use differential privacy (DP)
(Abuadbba et al., 2020) with SL, but noted, that it greatly reduces the
utility of the trained model. Others have proposed encrypting the intermediate
results using HE before sending them to the server (Khan et al., 2023b). This
allows the server to compute the final layers of the ML model and get the
correct outputs without leaking additional information to the server. Despite
the increased security, the authors report, that the computational overhead
even for a single linear layer using HE increases the training time
drastically, when compared to the unencrypted models. Regarding the FSHA,
existing work in literature does not address this attack in SL. FSHA allows a
malicious server to hijack the model and steer it towards a specific target
feature space. Once the model maps into the target feature space, the
malicious server can recover the private training instances by reversing the
known feature space. In short, FSHA allows a malicious server to take control
of the model and extract private information from training data.

In this work, to secure SL against FSHA and visual analysis, we use Function
Secret Sharing (FSS) (Boyle et al., 2015) – an MPC technique which allows two
parties to perform computations on a public input using a private, secret
shared function. We show that FSS can be used to eliminate the privacy leakage
of SL while at the same time keeping data safe from FSHA. In addition, it
greatly reduces the computational complexity, when compared to existing
techniques (Khan et al., 2023b; Nguyen et al., 2023; Ryffel et al., 2020).
Furthermore, we show that combining FSS with SL results in lower
communications overhead than combining HE with SL.

Contributions: The main contributions of this work, can be summarized as
follows:

  1. bx1.

We designed an efficient PPML protocol using SL and FSS. Our contribution lies
in being the first to incorporate FSS into SL, aiming at enhancing the privacy
of SL.

  2. bx2.

We have conducted experiments on the MNIST dataset to demonstrate privacy
leakage in SL after the first and second convolution layers. We have used FSS
to mitigate this issue, offering a more efficient alternative to the
computationally expensive HE method mentioned in prior work by Nguyen et al.
(Nguyen et al., 2023). Our approach enables running multiple layers on the
server-side, unlike (Nguyen et al., 2023), which considered only one layer on
the server-side.

  3. bx3.

We designed an FSS based vanilla SL (refer to as private vanilla SL model)
protocol and compared it with AriaNN (Ryffel et al., 2020) (private local).
Our findings demonstrated that our approach is more efficient in terms of
communication cost and complexity while maintaining the same level of accuracy
and privacy.

  4. bx4.

To date, VI has not been considered an attack in research; rather, it has been
seen as a privacy leakage metric in SL. In our work, we use VI as an attack,
specifically a VI Inference Attack (VIIA) in SL.

  5. bx5.

We demonstrated the security of our approach against FSHA. Also, our VI
analysis demonstrates that the server cannot reconstruct raw image data from
the activation maps.

###  1.1. Organization

The rest of the paper is organized as follows, in section 2, we provide the
necessary background information on Convolution Neural Network (CNN), SL, and
FSS. In section 3, we define the notation used throughout the paper, discuss
FSS in a higher detail, and describe its core primitives. In section 4, we
present important published works in the area of SL and FSS. The architectures
of the two local models: one without a split and another with a split are
presented in section 5, where we elaborate on the private local model and
introduce the key actors in our protocols. A detailed description of our
private vanilla SL protocol is described in section 6, followed by the
considered threat model & security analysis in section 7, while section 8
provides a detailed explanation of the experimental setup and provides
extensive experimental results for our proposed approach. Finally, we conclude
the paper in section 9.

##  2\. Preliminaries

In this section, we cover the underlying ML and cryptographic techniques we
utilize in our design.

###  2.1. Convolutional neural network

CNN is a special type of neural network which have shown great results in
various ML classification and recognition tasks for two dimensional (2D)
images data (Lecun et al., 1998). For our task, we employ a 2D CNN which
consists of the following layers:

  * •

2D Convolution (Conv2D): It is used in CNN to perform convolution operation on
the input data, that is, this layer applies a set of kernels, to a sliding
window of input data, which extracts local features from the data (see Figure
1) (Lecun et al., 1998).

  * •

ReLU: It is a non-linear activation function that is commonly used in CNN to
compute a simple function:

$f(x)=\max(0,x)$.

  * •

Max-pooling: It is used in CNN to create a downsampled activation map ($ATm$)
with a lower resolution than the input. This operation helps to reduce the
computational cost of the network and prevent overfitting by compressing
information in the $ATm$.

  * •

Fully Connected (FC): In FC layers, each neuron in the layer is connected to
every other neuron in the previous layer. This means that the output of each
neuron in the layer is computed as a weighted sum of the outputs of all the
neurons in the previous layer.

2D Conv layerA pixel in an image2D Kernel FeatureDetector

Figure 1. 1D convolution layer vs 2D convolution layer

###  2.2. Split learning

It is a collaborative learning technique (Gupta and Raskar, 2018) in which an
ML model is split into two parts, the client part ($f_{C}$), comprises the
first few layers of model ($1,\cdots,l$) – $l$ being the last layer on the
client-side and the server part ($f_{P}$), encompassing the remaining layers
of model ($l+1,\cdots,L$) – $L$ being the last layer on the server-side. The
client and server collaborate to train the split model without having access
to each other’s parts. The client who owns the data uses forward propagation
to train their part of the model and sends the $ATm$ from the split layer
(final layer of the client-side) to the server. The server continues the
forward propagation on the $ATm$ using their part of the model. After
completing the forward propagation and computing the loss, the server performs
the backward propagation, only returning to the client the gradients to
complete the backward propagation. This process is repeated until the model
converges and learns a suitable set of parameters.

The aim of SL is to protect client privacy by allowing clients to train part
of the model, and share $ATm$ (instead of their raw data) with a server
running the remaining part of the model. It is also utilized to reduce the
client’s computational overhead by merely running a few layers rather than the
entire model.

###  2.3. Function secret sharing

FSS provides a way for additively secret-sharing a function $f$ from a given
function family $F$. More concretely, a two-party FSS scheme splits a function
$f:{(0,1)}^{n}\rightarrow\textit{G}$, for some abelian group $G$, into
functions described by keys such that $f=\mathsf{f_{0}}+\mathsf{f}_{1}$ and
every strict subset of the keys hides $f$. An FSS scheme for some class $F$
has two algorithms ($\mathsf{KeyGen,EvalAll}$) (Boyle et al., 2015):

  * •

$\mathsf{KeyGen(1}^{\lambda},f)\rightarrow(\mathsf{f_{0},f_{1}})$: The
$\mathsf{KeyGen}$ algorithm that takes the security parameter $1^{\lambda}$
and some secret function $f$ to be shared and outputs two different function
shares $(\mathsf{f_{0},f_{1}})$ (also called function keys).

  * •

$\mathsf{EvalAll}(j,\mathsf{f}_{j},x_{pub})\rightarrow\mathsf{f}_{j}(x_{pub})$:
The $\mathsf{EvalAll}$ algorithm takes three parameters, the input bit
$j\in\\{0,1\\}$, the key $\mathsf{f}_{j}$, and the public data $x_{pub}$ and
outputs the shares $\mathsf{f}_{j}(x_{pub})$.

An FSS scheme should satisfy the following two properties:

  * •

Secrecy: A single key $(\mathsf{f}_{j})$ hides the original function $f$.

  * •

Correctness: Adding the local shares get the same output as the original
function $(\mathsf{f_{0}}(x_{pub})+\mathsf{f_{1}}(x_{pub})=f(x_{pub}))$.

As can be seen in Figure 2, function $f$ is first split into two shares
$\mathsf{f_{0}}$ and $\mathsf{f_{1}}$ and then each party locally evaluates
the function on the input $x_{pub}$. In FSS, adding the locally evaluated
functions $(\mathsf{f_{0}}(x_{pub})+\mathsf{f_{1}}(x_{pub}))$, gives the
additive reconstruction of the original function applied on the input
$f(x_{pub})$.

$f$$\mathsf{f_{0}}$$\mathsf{f_{1}}$$\mathsf{f_{1}}(x_{pub})$$\mathsf{f_{0}}(x_{pub})$$f(x_{pub})$$\forall
x_{pub}$$+$$\mathbf{KeyGen}$$\mathbf{EvalAll}$ Figure 2. Function secret
sharing

##  3\. Function Secret Sharing Primitives

Before going into the details of the FSS primitives, first we define all the
notation used in the paper. After that, we go into the details of the FSS
primitives taking into consideration ReLU as an example.

#### Notation

Table 1 summarizes the core notation of this paper. In addition to that,
$f_{\theta_{c}}$ denotes the client part of the model, while
$f_{\theta_{P_{0}}}$ and $f_{\theta_{P_{1}}}$, represent the split part of the
remaining model associated with Server 1 ($P_{0}$) and Server 2 ($P_{1}$).

Table 1. Parameters and description in the algorithms

# | ML Parameters | Description | FSS Parameters | Description
---|---|---|---|---
1 |  $\mathbf{D}$, $m$ | Dataset, Number of data samples | $s_{j}$ | Random Seed
2 | $x,y$ | Input data samples, Ground-truth labels | $\alpha$ | Random mask
3 | $\eta$ | Learning rate |  $P_{0}$, $P_{1}$ | Server 1 and 2
4 | $p$ | Momentum | $\mathsf{f_{0},f_{1}}$ | Function shares (function keys)
5 | $n$ | Batch size | $f_{\theta_{P}}$ | Server-side model
6 | $N$ | Number of batches to be trained | $f_{\theta_{C}}$ | Client-side model
7 | $E$ | Number of training epochs | $\tilde{f}$ | Encoder
8 | $f^{i}$ | Linear or non-linear operation of layer $i$ | $\tilde{f}^{-1}$ | Decoder
9 | $ATm^{i}$ | Output activation map of $g^{i}$ | $\mathsf{f^{ReLU}_{j}}$ | ReLU FSS key for server $j$
10 | $x_{pub}$ | Public input | $\mathsf{f^{FC}_{j}}$ | FC part for server $j$

As mentioned earlier, the ReLU function returns 0 for negative inputs and
keeps positive value as is. To create shares of the ReLU function, we have
employed two FSS tests that fit our needs: (1) the equality test and (2) the
comparison test (Boyle et al., 2015, 2016, 2019, 2021). Before going into the
details of these tests, let’s briefly cover the concepts of the Pseudo-random
Number Generator (PRNG) and Correction Word (CW).

Pseudo-random number generator. A PRNG is an algorithm that takes a short,
random seed and produces a longer sequence of pseudo-random bits. In FSS, it
is used to generate the keys for the FSS protocol. Each party starts with a
random seed, and uses the PRNG to generate a sequence of keys. These keys are
then used to generate CW for the FSS protocol.

Correction word. It is a special value used in FSS to correct the private
shares being compared between two parties. The CW shifts a pseudo-random
string so that it matches another random string on one side and remains
independent on the other side. Each node in the binary decision tree generates
its own CW, which is computed by applying a PRNG to the private shares being
compared at that node. The resulting value is then used to correct the shares
by computing an XOR operation on them with the CW. This ensures that the
shares are equal if the input bits are the same, and different if the input
bits are different. The CW is passed down to the child nodes of the current
node in the binary decision tree, where it is used to correct the shares at
those nodes as well. This process continues until the final output of the
binary decision tree is computed.

Equality test. A test that involves comparing $x_{pub}$ to a private value
$\alpha$ and the goal is to determine whether $x_{pub}$ is equal to $\alpha$
or not. The random mask $\alpha$ and the private input $ATm$ are combined
using modular arithmetic and published to obtain a public value $x_{pub}$. The
equality test is performed using a binary decision tree of depth $n$, where
$n$ is the number of bits in the input $x_{pub}$. The tree evaluates the input
using $\mathsf{f_{0},f_{1}}$, which are generated using FSS. The path from the
root to $\alpha$ is called the special path. The two servers ($P_{0},P_{1}$)
start from the root and update their state depending on the bit $x_{pub}[i]$
using a CW from $\mathsf{f_{0},f_{1}}$. If $x_{pub}[i]==\alpha[i]$, they stay
on the special path and output 1, otherwise, they output 0. The main idea is
that the servers on the special path have specific states $(s_{0},t_{0})$ and
$(s_{1},t_{1})$, where $s_{0}$ and $s_{1}$ are independent and identically
distributed and $t_{0}\oplus t_{1}=1$ (see the dotted lines in Figure 3). When
the servers are out of the special path, the CW ensures that ${s_{0}=s_{1}}$
but remain random and indistinguishable, and ${t_{0}=t_{1}}$, guaranteeing
${t_{0}\oplus t_{1}=0}$. To reconstruct the result, each server outputs its
value $t_{j}$, and the final result is obtained by ${t_{0}\oplus t_{1}}$.

$\displaystyle x_{2}$$\displaystyle x_{1}$$\displaystyle x_{2}$$\displaystyle
x_{3}$$\displaystyle x_{3}$$\displaystyle x_{3}$$\displaystyle
x_{3}$0x010=1$\displaystyle\alpha=010$1111111000000x111=0x110=0x101=0x100=0x011=0x001=0x000=0

Figure 3. Function secret sharing for equality test

Comparison test. The comparison test involves a binary decision tree with a
depth of $n$. In this test, the path from the root down to the greater value
is called the special path. Each server starts at the root of the binary
decision tree and updates their state based on the bits using CW from
$\mathsf{f_{0}}$ and $\mathsf{f_{1}}$. The goal is to evaluate all the paths
simultaneously. When a server deviates from the special path, they either fall
on the left side for $x_{pub}<\alpha$ or on the right side for
$x_{pub}>\alpha$ (see Figure 4). Hence, at each node, an additional step is
taken where a leaf label is output depending on the bit value $x_{pub}[i]$.
The label is 1 only if $x_{pub}[i]<\alpha[i]$ and all previous bits are same.
Only one label, either the final label (which corresponds to $x_{pub}=\alpha$)
or the leaf label can be equal to 1, because only one path is taken.
Therefore, the servers return the sum of all the labels to obtain the final
output.

$\displaystyle x_{2}$$\displaystyle x_{1}$$\displaystyle x_{2}$$\displaystyle
x_{3}$$\displaystyle x_{3}$$\displaystyle x_{3}$$\displaystyle
x_{3}$0x010=1001x001=1x000=1$\displaystyle\alpha=010$1111110000x111=0x110=0x101=0x100=0x011=0

Figure 4. Function secret sharing for comparison test

##  4\. Related Work

SL provides significant advantages in terms of reducing the computational cost
of training deep neural networks. However, a potential vulnerability arises
during end-to-end training, where the exchange of gradients at the cut layer
could inadvertently encode private features or labels, posing a risk to data
privacy. Abuadbba et al. (Abuadbba et al., 2020) proposed using SL when
training and classifying 1-dimensional data on CNN models. In their work, they
use two CNN models, one with two Conv2D layers and another with three Conv2D
layers to see the applicability of SL on time-series data, when compared to a
centralized system. They identified that SL achieves comparable accuracy to
centralized models, but noted that SL by itself has multiple privacy leakages,
which hamper the confidentiality of the input data. Moreover, researchers have
found that SL is susceptible to different types of attacks, such FSHA
(Pasquini et al., 2021).

The leakages highlight the importance of addressing data privacy concerns when
implementing SL techniques. As such, researchers have attempted combining
different cryptographic techniques with SL to address these attacks. For
example, Abuadbba et al. (Abuadbba et al., 2020) tried two privacy mitigation
techniques – adding more hidden layers on the client-side and using DP.
However, both of these techniques indicate a trade-off between reducing
privacy leakage and experiencing a decline in model accuracy, particularly
when DP is used. Thapa et al. (Thapa et al., 2022) proposed to combine SL with
FL to reduce the computational complexity of SL. To address the remaining
privacy leakage, the authors made use of DP-enhanced client model training and
PixelDP (Lecuyer et al., 2019), however faced the same drawback of greatly
reduced model utility. Some other works like (Khan et al., 2023b, c, a) make
use of HE to encrypt the intermediate $ATm$ of SL before outsourcing them to
the server. This way, the model retains equivalent accuracy when compared to
plaintext SL, and addresses the privacy leakages known in SL. However, a key
limitation of this method is identified during backward propagation. By
analyzing the gradients sent from the client, the server gains valuable
information about the client’s input data, leading to potential privacy leaks.
To tackle this, an improved protocol is proposed by Nguyen et al. (Nguyen et
al., 2023), aiming to minimize privacy leakage. The authors (Nguyen et al.,
2023) claim that their proposed approach not only helps maintain privacy but
also accelerates the training time and reduces the communication overhead
compared to (Khan et al., 2023a)). Despite these advancements, the training
time and communication cost in (Nguyen et al., 2023) continue to pose
challenges, even for a simple model featuring two convolutional layers on the
client-side (processing plaintext data) and only one fully connected layer on
the server-side (processing encrypted data). Specifically, it takes a
substantial amount of time and communication cost, which poses a challenge for
practical implementation.

There is a plethora of works, which employ FSS in PPML, such as AriaNN (Ryffel
et al., 2020) which is the first work that makes use of FSS for secure neural
network training and inference against a semi-honest adversary. Pika (Wagh,
2022) introduces a 3PC PPML solution against either a semi-honest or a
malicious adversary. Another recent FSS work is LLAMA (Gupta et al., 2022),
which implements a low-latency library for computing non-linear mathematical
functions, useful to PPML, such as sigmoid, tanh, reciprocal square root,
using FSS primitives. Orca (Jawalkar et al., 2023) directly uses the library
proposed in LLAMA (Gupta et al., 2022) performs secure training on neural
network architectures. SIGMA (Gupta et al., 2023) demonstrates how FSS can be
used for secure inference of generative pre-trained transformers, which
contain GeLU, Softmax, and layer normalizations, and shows that the secure
inference can be accelerated through GPUs. Agarwal et al. (Agarwal et al.,
2022) designs a secure logistic regression training construction with FSS.
FssNN (Yang et al., 2023) proposes a two-party FSS framework for secure NN
training and makes improvements to various aspects in prior arts.

In all of the covered FSS works, the researchers employ FSS on the entire
model which in turn increases computational complexity and communication
overhead. However, to the best of our knowledge, the idea of combining SL with
FSS has not been explored in the literature. To this end, our approach
provides new insights into how the use of these techniques can improve the
privacy guarantees of ML applications, solve the privacy leakage caused by SL
and reduce both the communication and computation costs of FSS.

##  5\. Architecture

This section provides an overview of the ML model used for classification. We
begin with the description of the initial non-split or local model followed by
a brief explanation of a related FSS model from a previous work (Ryffel et
al., 2020). Then, we explain how we convert the local model into a split
model. Finally, we introduce our private vanilla SL protocl. Additionally, we
introduce the key entities involved in the training process of the split
model, namely the client and the server, elaborating on their respective roles
and assigned parameters during the training phase.

###  5.1. Local model without split

Figure 5 illustrates our local model, which consists of two Conv2D layers, two
max-pooling layers, two FC layers and four ReLU layers. These layers operate
without any split between client and server, with one party performing
computations on the entire model. The training process of this model can be
described as follows.

Let $\mathbf{|D|}=\\{(x_{i},y_{i})|i=1,2,\ldots,m\\}$ be a training dataset
consisting of $m$ data samples. Each data sample $x$ has a corresponding
encoded label vector $y$ that represents its ground-truth class. Then,
$f_{\theta}$ is a function representing the local model with $\theta$ being a
set of adjustable parameters. $\theta$ is first initialized to small random
values denoted as $\Phi$. The goal is to find the optimal parameters $\theta$
to map $x$ to a predicted output vector $\hat{y}$, where $\hat{y}$ is as close
as possible to $y$. $\hat{y}$ is a vector of probabilities (called
posteriors), and we use the highest probability to determine the class to
which $x$ belongs. To find the closest value of $\hat{y}$ with respect to $y$,
we try to minimize a loss function $J=\mathcal{L}(\hat{y},y)$. Training the
local model is an iterative process to find the best $\theta$ to minimize $J$.
This process involves two steps: forward and backward propagation. The forward
propagation computes each layer in the network (Figure 5) on input $x$,
reaching the output layer to predict $\hat{y}$. Backward propagation starts
from the output layer and goes back to the input layer to calculate the
gradients of the loss function $J$ w.r.t the network’s weights $\theta$. These
weights are then updated according to the calculated gradients. We train the
local model with numerous samples of $x$ and corresponding $y$, through many
iterations of forward and backward propagation. We do not train the network on
each single data example, but use a number of them at a time (using batch size
$n$). The total number of training batches is $N=\frac{\mathbf{|D|}}{n}$ ,
where $\mathbf{|D|}$ is the size of the dataset. Once the model goes through
all the training batches, it has completed one training $E$ and this process
continues for a total of $E$ epochs. We implement and reproduce the results
for this model. The best test accuracy that we obtained for this model is
99.29%.

ConvolutionalConvolutionalMax-poolingMax-poolingReLUReLUTraining
DataReLUReLUFully ConnectedFully Connected

Figure 5. Local model without split learning

###  5.2. Local model with vanilla split

In this protocol, we split the local model shown in Figure 5 between the
client and the server in such a way that the starting layers, Conv2D, max-
pooling and the first two ReLU layers are executed on client-side while two FC
layers and the last two ReLU layers are executed on the server-side. As can be
seen in Figure 6, the training input data is residing on the client-side while
the final prediction of the model is on the server-side.

ConvolutionalConvolutionalMax-poolingMax-poolingReLUReLUClientTraining
DataReLUReLUServer$ATm$Fully ConnectedFully Connected

Figure 6. Local model with vanilla split learning

###  5.3. Private local model

In (Ryffel et al., 2020), the authors proposed AriaNN, an efficient protocol
for achieving private equality and comparison through FSS. The model used in
this study, as depicted in Figure 5, consists of two Conv2D layers, two Max-
pooling, four ReLUs and two FC layers. Among these layers, ReLU is supported
as a direct application of the equality and comparison protocol, while the
Conv2D layers are computed using beaver triples. More details, about the
computations of these layers can be found in (Ryffel et al., 2020). We
reproduced the results for this variant of the protocol, achieving the best
test accuracy of 97.29%.

###  5.4. Private vanilla SL

In our private vanilla SL protocol, the client handles the initial layers of
the model, while the server takes care of the rest (see Figure 7). The client,
owning the data, executes their part of the model without splitting. On the
server-side, as depicted in Figure 7, consists of four layers: two ReLUs and
two FC layers. For efficient online communication, we train the FC layers
using beaver triples and the ReLU function using FSS. Our FSS implementation
for ReLU layers ensures privacy using a comparison protocol.

With FSS on the server-side, we now have two servers, each working on its
private shared function and evaluating it on the public input $x_{pub}$. This
protocol allows client-server collaboration in ML model training without
exposing client’s input data. Additionally, with some of the layers on the
server-side, computational complexity is reduced, making the model more
efficient. More details on the private vanilla SL will be discussed in
subsection 6.1.

$\mathsf{EvalAll}$$\mathsf{f^{FC}_{0}}$Server 1Server
2$\mathsf{f^{FC}_{0}}$$\mathsf{f^{ReLU}_{0}}$$\mathsf{f^{FC}_{1}}$$\mathsf{f^{FC}_{1}}$$\mathsf{f^{ReLU}_{1}}$$\mathbf{\hat{y}}_{0}$$\mathbf{\hat{y}}_{1}$$x_{pub}$$+$$\mathbf{\hat{y}}$ConvolutionalConvolutionalMax-
poolingMax-poolingReLUReLUClientTraining
Data$\mathsf{f^{ReLU}_{1}}$$\mathsf{f^{ReLU}_{0}}$

Figure 7. Private vanilla split learning

###  5.5. Actors in the model

Now, we define the main actors participating in the protocol and detail their
abilities:

  * •

Client: The client provides the training data and is capable of computing the
initial layer of the model in plaintext. The client uses their private data to
compute the initial layers of the model and shares the intermediate $ATm$ and
the remaining layers with the servers. In our approach, the client has to
share the labels with the server.

  * •

Servers: Our protocol requires two servers to perform computations on the
secret shares. Based on the received $x_{pub}$, each server make computations
on the underlying ML model. Both servers can compute the final outputs and
compare it to the truth labels received from the client. We assume that there
is no collusion between the two servers and the servers are hosted
independently to avoid reconstructing the original data from the shares. This
assumption is realistic and consistent with other 2PC works in the area
(Mohassel and Zhang, 2017; Ryffel et al., 2020; Agrawal et al., 2019).

##  6\. FSS based SL Protocol

This section provides a more detailed explanation of the algorithms for
training the private vanilla SL model.

###  6.1. Private vanilla SL training protocol

We have used algorithm 1 and algorithm 2 to train the private vanilla SL model
reported in subsection 5.4. This model consists of the initialization, forward
and backward propagation. The initialization phase only takes place once at
the beginning of the procedure, whereas the other phases continue until the
model iterates through all epochs. The initialization phase consists of socket
and random weight initialization $\Phi$. The client first establishes a socket
connection and synchronize the hyperparameters $\eta,n,N,E$. $ATm^{(i)}$ and
the gradient are initially set to zero $\emptyset$. These parameters must be
synchronized on both sides to be trained in the same way. There are two phases
in training the whole protocol, forward and backward propagation phase. During
the forward propagation, the client forward propagates the input $x$ through
$f_{\theta_{C}}$ to generate an activation map $ATm$. The private input which
is $ATm$ is first masked using random mask $\alpha$ to construct the public
input $x_{pub}=ATm+\alpha$ before sending it to the server. Once $x_{pub}$ is
constructed, the next step is to send $x_{pub}$ to the server. As can be seen
in Figure 8, we have two servers labelled as $P_{0}$ and $P_{1}$. Each server
receives the public input $x_{pub}$ and initiates forward propagation by
executing their respective portion of the model. On the server-side, we employ
FSS, allowing us to compute the function keys. Specifically, these keys are
generated for the ReLU layers. We employ the FSS $\mathsf{KeyGen}$ algorithm,
to create these keys for each server. Additionally, to compute the FC layers
on the server-side, we used the beaver triples. As in private vanilla SL, the
final output layer is executed on the server-side, hence both servers execute
their respective share of the layer to produce the final output $\hat{y_{j}}$.
Both the servers calculate the loss using the equation
$J\leftarrow\mathcal{L}(\hat{y}_{j},y_{j})$. During the loss calculation, the
intermediate results and the final loss remain in the form of additive shares.
Specifically, $y_{j}$ is the additive shares of the target value while
$\hat{y}_{j}$ are the predicted output computed by each server. As the loss
computation is performed by each servers, now, in order to get the final
predicted output, the two servers must collaborate to add their secret shares.
In this setting, the servers must know the actual target values as well as the
predicted output of the model.

${\textstyle\langle x_{(pub)}\rangle}$$P_{0}$$P_{1}$${\textstyle\langle
x_{(pub)}\rangle}$${\displaystyle\langle w\rangle_{0}}$${\displaystyle\langle
w\rangle_{1}}$${\displaystyle\langle
y\rangle_{0}}$${\textstyle\langle\hat{y}\rangle_{0}}$${\displaystyle\langle
y\rangle_{1}}$${\displaystyle\langle\hat{y}\rangle_{1}}$$J_{0}$${\textstyle
J_{1}}$${\textstyle w{{}_{0}^{n+1}}\ \leftarrow(w_{0}^{n}\ -\
\eta\nabla_{w}\mathcal{L})}$$w{{}_{1}^{n+1}}\ \leftarrow(w_{1}^{n}\ -\
\eta\nabla_{w}\mathcal{L})$${\textstyle\nabla_{w}\mathcal{L}\ =\
\left[\frac{\partial\mathcal{L}}{\partial w}\right]}$$J\
\leftarrow\mathcal{L}(\langle\hat{y}\rangle\ -\ \langle y\rangle)$$z\ =\
w*x+b$${\displaystyle ATm\ =\ ReLU(z)}$Linear LayerReLU LayerForward
Prop.1Compute Cost22PCBackward Prop.3Compute Cost2 Figure 8. Utilizing
function secret sharing between two servers

After completing the forward propagation,each server starts the backward
propagation by first computing $\frac{\partial
J_{j}}{\partial\hat{\mathbf{y_{j}}}}$ and continue the backward propagation
algorithm until layer $l+1$ and update the weights and biases of the layers
using the given equations.

(1) $\displaystyle\boldsymbol{w}=\boldsymbol{w}-\eta\frac{\partial
J}{\partial\boldsymbol{w}},\quad$

(2) $\displaystyle\boldsymbol{b}=\boldsymbol{b}-\eta\frac{\partial
J}{\partial\boldsymbol{b}}$

During backward propagation, each server also calculates:

(3) $\frac{\partial J_{j}}{\partial ATm^{(l)}}=\frac{\partial J}{\partial
ATm^{(l+1)}}\frac{\partial ATm^{(l+1)}}{\partial ATm^{(l)}},$

and sends $\frac{\partial J}{\partial ATm^{(l)}}$ to the client. After
receiving $\frac{\partial J}{\partial ATm^{(l)}}$, the client calculates the
gradients of $J$ w.r.t the weights and biases of its part of layers using the
chain-rule, which can generally be described as:

(4) $\displaystyle\frac{\partial J_{j}}{\partial\boldsymbol{w}^{(i-1)}}$
$\displaystyle=\frac{\partial
J_{j}}{\partial\boldsymbol{w}^{(i)}}\frac{\partial\boldsymbol{w}^{(i)}}{\partial\boldsymbol{w}^{(i-1)}}$
(5) $\displaystyle\frac{\partial J_{j}}{\partial\boldsymbol{b}^{(i-1)}}$
$\displaystyle=\frac{\partial
J_{j}}{\partial\boldsymbol{b}^{(i)}}\frac{\partial\boldsymbol{b}^{(i)}}{\partial\boldsymbol{b}^{(i-1)}}$

Finally, after calculating the gradients $\frac{\partial
J}{\partial\boldsymbol{w}^{(i)}},\ \frac{\partial
J}{\partial\boldsymbol{b}^{(i)}}$, the client updates $\boldsymbol{w}^{(i)}$
and $\boldsymbol{b}^{(i)}$. The forward and backward propagation continue
until the model converges to learn a suitable set of parameters.

1Initialization:

2 $soc\leftarrow$ socket initialized with port and address;

3 $soc.\mathsf{connect}$

4 $\eta,n,N,E\leftarrow soc.\mathsf{synchronize}$

5 $\\{\boldsymbol{w}^{(i)},\boldsymbol{b}^{(i)}\\}_{\forall i\in\\{0..l\\}}\
\leftarrow$ initialize using $\Phi$

6 $\\{ATm^{(i)}\\}_{\forall i\in\\{0..l\\}}\leftarrow\emptyset\ $

7 $\left\\{\frac{\partial J}{\partial ATm^{(i)}}\right\\}_{\forall
i\in\\{0..l\\}}\leftarrow\emptyset\ $

8 for  _$\displaystyle e\ \in\ E$_ do

9 for  _$\displaystyle\text{each}\ \text{batch}\ (x,\ y)\ \text{generated\
from}\ D\ $_ do

10 $\displaystyle\mathbf{\underline{Forward\ Propagation}:}$

11 for  _$i\leftarrow 1$ to $l$_ do

12 $\displaystyle ATm^{(i)}\ \leftarrow\ f_{\theta_{C}}\left(x^{(i)}\right)$

13 end for

14 $\displaystyle x_{pub}^{i}\ \leftarrow\ ATm^{(i)}+\alpha$

15 $\displaystyle soc.\mathsf{send}\ (x_{pub}^{i})$

16 $\displaystyle\mathbf{\underline{Backward\ Propagation}:}$

17 $\displaystyle soc.\mathsf{receive}\ \left(\frac{\partial J}{\partial
ATm_{j}^{(l+1)}}\right)$

18 $\displaystyle\text{Compute}\left\\{\frac{\partial J}{\partial
ATm^{l}}\right\\}$

19 for  _$i\leftarrow l$ to $1$_ do

20 $\text{Compute}\ \left\\{\frac{\partial J}{\partial\boldsymbol{w}^{(i)}},\
\frac{\partial J}{\partial\boldsymbol{b}^{(i)}}\right\\}$

21 $\displaystyle\ \text{Update}\ \boldsymbol{w}^{(i)},\ \boldsymbol{b}^{(i)}$

22 end for

23

24 end for

25

26 end for

Algorithm 1 Client-Side Vanilla SL

1Initialization:

2 $soc\leftarrow$ socket initialized with port and address;

3 $soc.\mathsf{connect}$

4 $\eta,n,N,E\leftarrow soc.\mathsf{synchronize}$

5 for  _$\displaystyle e\ \in\ E$_ do

6 for  _$\displaystyle i\leftarrow l+1\ \mathbf{to}\ N\ $_ do

7 $\displaystyle\mathbf{\underline{Forward\ Propagation}:}$

8 $\displaystyle soc.\mathsf{receive}\ (x_{pub}^{i})\ \ $

9 for  _$\displaystyle j=0,1$_ do

10 $\displaystyle\hat{y_{j}}\ \leftarrow\ f_{\theta_{Pj}}\left(x_{pub}\right)$

11 $\displaystyle J_{j}\leftarrow\mathcal{L}(\hat{y_{j}},y_{j})$

12 end for

13 $\displaystyle\mathbf{\underline{Backward\ Propagation}:}$

14 $\displaystyle\text{Compute}\left\\{\frac{\partial
J_{j}}{\partial\hat{y_{j}}}\right\\}$

15 for  _$i\leftarrow L$ to $l+1$_ do

16 $\text{Compute}\ \left\\{\frac{\partial
J_{j}}{\partial\boldsymbol{w}_{j}^{(i)}},\ \frac{\partial
J_{j}}{\partial\boldsymbol{b}_{j}^{(i)}}\right\\}$

17 $\displaystyle\ \text{Update}\ \boldsymbol{w}_{j}^{(i)},\
\boldsymbol{b}_{j}^{(i)}$

18 end for

19 $\displaystyle soc.\mathsf{send}\ \left(\frac{\partial J_{j}}{\partial
ATm_{j}^{(l+1)}}\right)$

20

21 end for

22

23 end for

Algorithm 2 Server-Side Vanilla SL

##  7\. Threat Model & Security Analysis

In this section we first define the threat model we consider. Then, we proceed
by proving the security of our protocol.

###  7.1. Threat model

In SL, collaborative learning of local models introduces potential risk due to
interactions among the participants (Li et al., 2022). In this study, we
examine a scenario involving a semi-honest adversary, denoted as
$\mathcal{ADV}$, capable of corrupting one of the two servers engaged in our
protocol. In this context, the corrupted parties adhere to the protocol’s
specifications, all the while attempting to gather as much information as
possible about the inputs and function shares of other participants. Within
our specific framework, secure protocols are employed to facilitate
collaborative CNN model training by three parties: a client and two servers.
The client, who also serves as the data owner (note that considering a
malicious client in this context is pointless), initiates the process by
executing the initial layers of the model. This action produces an
intermediary result, denoted as $ATm$, which is subsequently kept confidential
through secret sharing between two independent servers. Following this, these
two servers proceed to jointly train the remaining segments of the model using
the client’s data, achieved by employing the FSS protocol. Apart from that,
the behavior of $\mathcal{ADV}$ can be summarized as follows:

  * •

$\mathcal{ADV}$ does not possess information about the client participating in
the distributed training, except the necessary details required to execute the
SL protocol.

  * •

$\mathcal{ADV}$ is familiar with a shadow dataset, which captures the same
domain as the clients’ training sets.

  * •

$\mathcal{ADV}$ has no knowledge of the architecture and weights of the whole
model.

  * •

$\mathcal{ADV}$ is unaware of the specific task on which the distributed model
is trained.

Finally, we extend the above threat model by defining two attacks available to
$\mathcal{ADV}$ who wishes to launch an FSHA or perform data analysis through
VI.

###### Attack 1 (Feature-Space Hijacking Attack).

Let $\mathcal{ADV}$ be an adversary that has compromised at most one of the
servers ($P_{0}$ or $P_{1}$). $\mathcal{ADV}$ successfully performs an FSHA if
she manages to substitute the original learning task chosen by the client with
a new function intentionally designed to mold the feature space of $f$.

###### Attack 2 (Visual Invertibility Inference Attack).

Let $\mathcal{ADV}$ be an adversary, that has compromised at most one of the
servers ($P_{0}$ or $P_{1}$). $\mathcal{ADV}$ successfully performs a Visual
Invertibility Inference Attack (VIIA) if she manages to infer sensitive
information of the original input data using the acquired convolutions from
the client. $\mathcal{ADV}$ attempts to identify the original images
characteristics and truth labels using intermediate data received during the
SL process.

###  7.2. Feature-space hijacking attack

Here, we describe the main concept behind an FSHA. In such an attack, the
client owns its private data and is responsible for training the
$f_{\theta_{C}}$. Instead of running its part of the SL protocol, the server
runs the code provided by the $\mathcal{ADV}$. To carry out the attack
$\mathcal{ADV}$ relies on three networks: The first two $\tilde{f}$ and
$\tilde{f}^{-1}$ are used to build an autoencoder which is trained with a
shadow dataset. Specifically, $\tilde{f}$ maps the data space to a feature
space whereas $\tilde{f}^{-1}$ act as a decoder that maps back the feature
space into the original data space. The third one is Discriminator (D), the
network that substitutes $f_{\theta_{P_{j}}}$, $j\in\\{0,1\\}$, and is trained
to distinguish between the output of $f_{\theta_{C}}$ and the output of
network $\tilde{f}$. It is used to caste the gradients for $f_{\theta_{C}}$
during training and bring it in an insecure state. D indirectly guides
$f_{\theta_{C}}$ to learn a mapping between the private data and the feature
space defined from $\tilde{f}$. More specifically, D is used to train
$f_{\theta_{C}}$ to produce an output that is as close as possible to the one
of $\tilde{f}$. Ultimately, this is the network that substitutes server
network in the protocol, and that defines the gradient which is sent to the
client during the distributed training process. After certain number of
iterations, the feature space learned by $f_{\theta_{C}}$ overlaps with one
defined from $\tilde{f}$. Once this happens, $\tilde{f}^{-1}$ is used to map
back this smashed data sent by the client to do the training and recover the
approximation of the original private data.

###  7.3. Visual invertibility inference attack

Figure 9. Visual invertibility inference attack: First row shows the original
images (image size: $28\times 28$) from the MNIST dataset. Second row shows
the $ATm$ after the first Conv2D layer before the first max-pooling operation
(image size: $24\times 24$). Third row displays the $ATm$ after the second
Conv2D layer before the second max-pooling operation (image size: $8\times
8$).

VI serves as a privacy assessment metric designed to measure the correlations
between the split layer $ATm$ and original raw data samples. The underlying
concept of VIIA involves the client initially training its part of the model
to create the $ATm$. Afterwards, the client sends the $ATm$ to the server.
Upon reception, if the server is malicious, it could exploit the received
$ATm$ to extract private information by inferring the client’s raw data and
the corresponding truth label. In essence, VIIA assesses the risk for
unintended data exposure during the model’s collaborative learning process. In
our SL setup, the client computes $f_{\theta_{C}}$ before outsourcing the
remaining operations to a server. The client must share $ATm$ to the server
for computing $f_{\theta_{P}}$. However, $ATm$ have patterns that are very
similar to the raw image data and cause a privacy leakage. This similarity is
visible in Figure 9, where the first row shows the raw image data and the
second and third rows show intermediate outputs after the first and second
Conv2D layers respectively. Even though the similarities are reduced after the
second Conv2D layer, the $\mathcal{ADV}$ could extract some information and
features of the private data, compromising the client’s data privacy.

###  7.4. Security analysis

With our threat model established, we can now move forward to demonstrate the
security of our protocol.

###### Proposition 0 (FSHA Soundness).

Let $\mathcal{ADV}$ be a semi-honest adversary that corrupts at most one of
the two servers ($P_{0}$ or $P_{1}$) involved in the protocol. Then
$\mathcal{ADV}$ cannot launch a successful Feature-Space Hijacking attack.

###### Proof.

Let $\mathcal{ADV}$ be a semi-honest adversary that has compromised $P_{0}$ or
$P_{1}$. In addition to that, assume $\mathsf{f}_{j}$, $j\in[0,1]$ be the key
distribution of an arbitrary function $f$. Then, if $\mathcal{ADV}$ can only
distinguish the key distribution $\mathsf{f}_{j}$ from another
$\mathsf{f}^{^{\prime}}_{j}$ (for some other function $f^{\prime}$), with
negligible probability then our protocol is secure against the Feature-Space
Hijacking attack.

To show that $\mathcal{ADV}$ can only distinguish between these values with
negligible probability, we will use a proof by contradiction. Let’s assume the
opposite, that $\mathcal{ADV}$ can distinguish from which function ($f$ or
$f^{\prime}$) the key came from. This means that $\mathcal{ADV}$ has a non-
negligible advantage to correctly determine whether the key came from $f$ or
$f^{\prime}$.

To test this assumption, let’s consider a security game, where $\mathcal{ADV}$
has access to both $f$ and $f^{\prime}$ and receives $\mathsf{f}_{j}$ from a
challenger $\mathcal{CHAL}$:

Following this game, the $\mathcal{ADV}$ would have a method to correctly
guess which function the key $\mathsf{f}_{j}$ represents, through the bit
$b^{\prime}$, so that $b^{\prime}==b$. However, the key $\mathsf{f}_{j}$ is
generated in such a way, that it does not reveal any information about the
original function $f$ subsection 2.3. As such, the $\mathcal{ADV}$ has a 50%
chance of successfully guessing the original function, just like flipping a
fair coin with a negligible advantage. This reaches a contradiction because
the $\mathcal{ADV}$ cannot accurately guess the original function with a non-
negligible advantage from the obtained function key $\mathsf{f}_{j}$.

Now, in order to show the soundness of our protocol against FSHA, we will
focus on a scenario where the $\mathcal{ADV}$ takes control of one of the
servers and leaves the other server and client untouched. The $\mathcal{ADV}$
tries to manipulate the feature space or the model’s output and to accomplish
this the $\mathcal{ADV}$ would need to understand the underlying feature space
of $f_{\theta_{P}}$. However, through the use of FSS, $f_{\theta_{P}}$ is
split between two servers which makes understanding the model and feature
space improbable. Each server holds a share of the function but not the entire
function itself. This makes it more challenging for an $\mathcal{ADV}$ to
compromise the entire model by taking control of one server. Additionally,
guessing the function share of the non-compromised server from the share of
the compromised server is not possible (1). Hence, we prove that our proposed
private vanilla SL protocol is secure against FSHA.

$\mathcal{ADV}$ sends: $f$ and $f^{\prime}$ to $\mathcal{CHAL}$
$\mathcal{ADV}$ guesses: $b^{\prime}$, where $b^{\prime}==b$

$\mathcal{CHAL}$ computes: $b\leftarrow\mathsf{Rand(\cdot)}$, where
$b\in\\{0,1\\};$ If $b==0$,
$\mathsf{f}_{j}\leftarrow\mathsf{KeyGen}(1^{\lambda},f);$ Else,
$\mathsf{f}_{j}\leftarrow\mathsf{KeyGen}(1^{\lambda},f^{\prime});$
$\mathcal{CHAL}$ sends $\mathsf{f}_{j}$ to $\mathcal{ADV}$

∎

###### Proposition 0 (VIIA Soundness).

Let $\mathcal{ADV}$ be a semi-honest adversary that corrupts at most one of
the two servers ($P_{0}$ or $P_{1}$) involved in the protocol. Then
$\mathcal{ADV}$ cannot successfully infer the raw input data through VIIA.

###### Proof.

Let $\mathcal{ADV}$ be a semi-honest adversary that has compromised one of the
two servers $P_{j}$, $j\in[0,1]$. In addition, assume a noisy intermediate map
$x_{pub}=ATm+\alpha$, where $ATm$ is the original intermediate activation map
and $\alpha$ is a set amount of noise. Then, if $\mathcal{ADV}$ cannot acquire
$ATm$ from $x_{pub}$, then our protocol is secure against raw data inference
through Visual Invertibility Inference Attack.

The use of FSS addresses the privacy leakage caused by VIIA as the $ATm$ is
masked with a specific amount of noise ($x_{pub}=ATm+\alpha$) for both servers
$P_{j}$. Following this a single corrupted server $P_{j}$ would not be able to
discern any additional information from the obtained $x_{pub}$ without
guessing the function share held by the other, non-corrupted server as proven
in Proposition 1. Additionally, if the $\mathcal{ADV}$ is unable to obtain
$\alpha$, then it is improbable that $ATm$ could be reconstructed through
$x_{pub}$, when an adequate amount of noise is added. To this extent, we also
showcase a visualization of the masked $ATm$ from both servers in 10(a) and
10(b) to show that $x_{pub}$ becomes unrecognisable to the original
convolutions $ATm$.

(a) (b) Figure 10. Visual invertibility inference attack with FSS applied:
First row shows the original $ATm$ after the first Conv2D (before the max-
pooling operations) from the MNIST dataset. Second row shows what $P_{0}$
receives when the FSS protocol is applied. Third row what $P_{1}$ receives
when the FSS protocol is applied. (a) Image Size: $24\times 24$; (b) Image
Size: $8\times 8$

∎

##  8\. Performance Analysis

This section covers our experimental setup and the results of our private
vanilla SL protocol.

###  8.1. Dataset

MNIST. To test the applicability of our approach we used the MNIST dataset
(LeCun et al., [n. d.]). It consists of a total of 70,000 images of which
60,000 are in the training set and the remaining 10,000 are in the test set.
All of the images are 28x28 pixels and display a black and white handwritten
number ranging from 0 to 9.

###  8.2. Experimental setup

We test and compare our SL protocol with AriaNN (Ryffel et al., 2020). For the
experiments, we used a machine running Ubuntu 20.04 LTS, processor 12th
generation Intel Core i7-12700, 32 GB RAM mesa Intel graphics (ADL-S GT1). We
implemented our code using Python 3.7 and it is made available on
GitHub111https://github.com/UnoriginalOrigi/SplitFSS. FSS implemented using
the PySyft
framework222https://github.com/OpenMined/PySyft/tree/ryffel/0.2.x-fix-training
and a modified version of AriaNN333https://github.com/LaRiffle/ariann. To get
a more consistent and reproducible result, we ran our experiments a total of
10 times for each experiment, totaling 60 executions of the code with
different settings. However, in our study, we are reporting the top three
results for each model (refer to Table 2). In the experiments we measured the
communication costs, training times, and accuracy of the model after each
epoch and report the total costs after full training. The communication costs
are calculated by measuring the byte length of serialized objects sent through
packets. Time measurements are taken by making use of the in-built time module
from Python. The loss is calculated using mean squared error.

In terms of hyperparameters, we train all networks with $E=10$ epochs,
$\eta=0.002$ learning rate, $p=0.9$ momentum, a batch size of $n=128$, and the
total training data samples $m=59904$ (as the incomplete final batch is
dropped). These parameters were chosen as they showed best results during
preliminary testing and are equivalent to the parameters set for the AriaNN
implementation (Ryffel et al., 2020). This lets us accurately compare our
results with AriaNN without the parameters making a large impact on the
comparison.

###  8.3. Evaluation

This section provides an overview of the outcomes derived from our
experiments. It is organized into three distinct parts, with each part
dedicated to a specific architectural framework as defined in section 5.
First, the local models with and without SL are covered. These models run in
plaintext without making use of FSS to create a baseline to compare further
results and also measure the effects of FSS on the performance of the models.
Second, the reproduced results of AriaNN (Ryffel et al., 2020), which we use
to compare to our proposed models, are provided. Finally, the results of the
private vanilla SL model and its comparison with the results of AriaNN are
presented.

Plaintext models. As previously mentioned, it’s important to note that
training the models on plaintext data does not account for FSS. These models
consist of both a local model and a standard SL model. We have successfully
implemented and replicated the results for these models. After training our
local model for approximately 10 epochs, we achieved the highest test accuracy
at 99.36%, with the second and third highest test accuracies at 99.33% and
99.28%, respectively.

Furthermore, our experiments indicate that training the vanilla SL model on
plaintext data yield similar accuracy results when compared to training the
local model. As illustrated in Table 2, the top three results for the vanilla
SL model are 99.29%, 99.28%, and 99.21%. These accuracy values closely align,
suggesting that the SL model can be effectively applied to CNN models on the
MNIST dataset without experiencing a significant degradation in classification
accuracy.

We also consider the training time and communication cost of the vanilla SL
model and compare it to the local model. The total training time for 10 epochs
is nearly identical, ranging between 1 and 2 minutes. Interestingly, even
though the vanilla model involve communication between the client and server
to exchange $ATm$ and gradients, their training times remain similar to that
of the local model. This similarity arises because the local model’s training
time encompasses the duration during which the client transmits images to the
server. Consequently, both models have nearly the same training times.

Regarding the communication cost, we are considering costs on both the client-
side and server-side, as well as the total costs during training and testing.
In Table 2 we show the variation between the client-side and server-side
communication costs between the local and SL model. We observe that the SL
approach has slightly higher server-side communication costs, than the local
model, but client-side communications are about $3\times$ larger on the local
model. This difference arises from the size of the data being shared as in the
local model, the client must send $28\times 28$ images, while in the SL model,
the client send the intermediate $ATm$, which is only $8\times 8$. Even though
the vanilla SL model provides similar accuracy and has the same training and
communication cost when compared to the locally computed model, it is
essential to note that the vanilla SL model introduce a privacy leakage, which
we mitigate using FSS.

FSS without SL. For our benchmarking we used AriaNN (Ryffel et al., 2020) – a
promising solution for doing PPML on sensitive data. The authors have shown
that AriaNN provides competitive performance compared to existing work, and
have demonstrated its practicality by running private training on MNIST using
models like LeNet. Given the promising outcomes achieved by AriaNN in
comparison to other works, we adopted it as the base paper for our study.

In our experimentation, we replicated the results for AriaNN, which we refer
to as the private local model. To thoroughly assess and compare the impact of
FSS on performance, we initialized two models: one before applying FSS
(referred to as the “public local model”) and one after applying FSS, both
with the same set of initial weights. Our analysis, clearly indicates that the
accuracy obtained before and after applying FSS remains nearly identical. In
simpler terms, the implementation of FSS exhibits no noticeable effect on the
performance of the models. As can be seen in Table 2, the private local model
achieves an impressive test accuracy of approximately 97.29%, closely followed
by accuracies of 97.04% and 97.61%. This showcases that the private local
model attains a commendable level of accuracy, lacking only by a modest 2% to
3% when compared to the public local models.

However, when we examine the training time for private local model over 10
epochs, a significant contrast emerges. Private local model necessitates
approximately 1288 minutes, which is roughly 900$\times$ more time-consuming
than the training of the public local models. Additionally, the training
communication cost incurred by private local model is 2$\times$ higher, and
the testing communication cost is 4$\times$ greater compared to the public
local models. The communication costs reported in Table 2 do not take into
account the preprocessing communication costs for transmitting the FSS keys
and securely computing each function. The preprocessing costs for the private
local model is 10.572851 MB per batch.

In conclusion, private local model demonstrates its potential as a promising
solution for maintaining data privacy while achieving commendable accuracy in
ML. Nonetheless, it is important to remember that using private local model
comes with significant drawbacks in terms of the time it takes to train models
and the extra communication needed. This should be carefully weighed when
deciding if it is the right choice when selecting a privacy-preserving
framework for specific use cases.

Table 2. Performance comparison: training and testing results for various privacy-preserving models PETs | Training Statistics | Testing Statistics
---|---|---
FSS | SL |  | Client
---
Communication
(MB)
| Server
---
Communication
(MB)
| Training
---
Time (minutes)
| Training
---
Communication
(MB)
| Testing
---
Communication
(MB)
| Testing
---
Accuracy (%)
Public | Local | 1931.855552 | 1.656024 | 1.4402 | 1933.511576 | 313.394140 | 99.36
1931.853762 | 1.656288 | 1.4307 | 1933.510050 | 313.394040 | 99.33
1931.854346 | 1.658358 | 1.4265 | 1933.512704 | 313.394140 | 99.28
Vanilla | 641.172596 | 25.745798 | 1.4183 | 666.702220 | 102.522446 | 99.29
641.170668 | 25.745258 | 1.4324 | 666.699764 | 102.522176 | 99.28
641.173568 | 25.746834 | 1.426 | 666.704240 | 102.522820 | 99.21
Private | Local | 3863.333306 | 3.571760 | 1288.6959 | 3866.905066 | 1253.010860 | 97.04
3860.620376 | 3.574165 | 1271.6553 | 3864.194541 | 1253.010740 | 97.29
3861.326498 | 3.576877 | 1190.5958 | 3864.903375 | 1253.010820 | 96.71
Vanilla | 1332.080326 | 3.573196 | 191.6493 | 1335.653522 | 204.857314 | 97.26
1332.082984 | 3.572936 | 220.4564 | 1335.655920 | 204.857348 | 97.14
1332.086146 | 3.574748 | 161.4921 | 1335.660894 | 204.857618 | 96.89

Private vanilla SL. The private vanilla SL model addresses privacy concerns in
public models while maintaining nearly the same accuracy, experiencing only a
2% reduction compared to both public local and public vanilla models (see
Table 2). This is because, as previously discussed, both SL and FSS can be
implemented without a notable reduction in model accuracy. It also achieves
comparable accuracy to the private local model in around 192 minutes, a
significant advantage. The shorter training time is due to executing all
client-side layers in plain, unlike the private local model, which employs
various techniques such as beaver triples (for convolution layers) and FSS
(for ReLU). Additionally, the total communication cost of private vanilla SL
is 2.9$\times$ lower than that of the private local model. Notably, the
server-side communication cost for private vanilla SL is remarkably low
(similar to the public vanilla SL model), compared to the private local model.
It is important to note that private vanilla SL additionally requires 0.119634
MB of preprocessing communications per batch, which is a 88.3$\times$
reduction when compared to private local FSS (10.572851 MB per batch). This is
because we execute client-side layers on plaintext, whereas private local
model involves more interaction between parties, increasing communication
costs. In summary, private vanilla SL model outperforms the private local
model in terms of training time and communication cost while maintaining
similar accuracy. Moreover, it offers better privacy than either public
models, though with a slight accuracy trade-off. It is important to mention
that our private vanilla SL model has higher training time and communication
costs compared to the public models.

Open Science and Reproducible Research: To support open science and
reproducible research, and provide researchers with opportunity to use, test,
and extend our work, source code used for the evaluations is publicly
available444https://github.com/UnoriginalOrigi/SplitFSS.

##  9\. Conclusion

Although split learning was once viewed as a promising collaborative learning
method for safeguarding the privacy of client data, recent studies have
highlighted concerns about its effectiveness in preventing potential privacy
leaks from client data. In response to these concerns, we have introduced a
hybrid approach that combines split learning with another privacy-preserving
technique known as function secret sharing. Our research demonstrates how the
utilization of function secret sharing can effectively mitigate privacy
breaches in split learning while still maintaining efficiency.

Our findings indicate that our proposed approach, which combines function
secret sharing with vanilla split learning, outperforms existing protocols
(such as private local models) in terms of communication efficiency and
complexity. Notably, it achieves the same level of accuracy while offering
improved privacy protections.

###### Acknowledgements.

This work was funded by the HARPOCRATES EU research project (No. 101069535)
and the Technology Innovation Institute (TII), UAE, for the project
ARROWSMITH.

## References

  * (1)
  * Abuadbba et al. (2020) Sharif Abuadbba, Kyuyeon Kim, Minki Kim, Chandra Thapa, Seyit A Camtepe, Yansong Gao, Hyoungshick Kim, and Surya Nepal. 2020.  Can we use split learning on 1d cnn models for privacy preserving training?. In _Proceedings of the 15th ACM Asia Conference on Computer and Communications Security_. 305–318.
  * Agarwal et al. (2022) Amit Agarwal, Stanislav Peceny, Mariana Raykova, Phillipp Schoppmann, and Karn Seth. 2022.  Communication Efficient Secure Logistic Regression.  _Cryptology ePrint Archive_ (2022).
  * Agrawal et al. (2019) Nitin Agrawal, Ali Shahin Shamsabadi, Matt J Kusner, and Adrià Gascón. 2019.  QUOTIENT: two-party secure neural network training and prediction. In _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_. 1231–1247.
  * Boyle et al. (2021) Elette Boyle, Nishanth Chandran, Niv Gilboa, Divya Gupta, Yuval Ishai, Nishant Kumar, and Mayank Rathee. 2021.  Function secret sharing for mixed-mode and fixed-point secure computation. In _Advances in Cryptology–EUROCRYPT 2021: 40th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, October 17–21, 2021, Proceedings, Part II_. Springer, 871–900.
  * Boyle et al. (2015) Elette Boyle, Niv Gilboa, and Yuval Ishai. 2015.  Function secret sharing. In _Annual international conference on the theory and applications of cryptographic techniques_. Springer, 337–367.
  * Boyle et al. (2016) Elette Boyle, Niv Gilboa, and Yuval Ishai. 2016.  Function secret sharing: Improvements and extensions. In _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_. 1292–1303.
  * Boyle et al. (2019) Elette Boyle, Niv Gilboa, and Yuval Ishai. 2019.  Secure computation with preprocessing via function secret sharing. In _Theory of Cryptography: 17th International Conference, TCC 2019, Nuremberg, Germany, December 1–5, 2019, Proceedings, Part I 17_. Springer, 341–371.
  * Gentry (2009) Craig Gentry. 2009.  _A fully homomorphic encryption scheme_.  Stanford university.
  * Gupta et al. (2023) Kanav Gupta, Neha Jawalkar, Ananta Mukherjee, Nishanth Chandran, Divya Gupta, Ashish Panwar, and Rahul Sharma. 2023.  Sigma: Secure gpt inference with function secret sharing.  _Cryptology ePrint Archive_ (2023).
  * Gupta et al. (2022) Kanav Gupta, Deepak Kumaraswamy, Nishanth Chandran, and Divya Gupta. 2022.  LLAMA: A Low Latency Math Library for Secure Inference.  _Proceedings on Privacy Enhancing Technologies_ 4 (2022), 274–294.
  * Gupta and Raskar (2018) Otkrist Gupta and Ramesh Raskar. 2018.  Distributed learning of deep neural network over multiple agents.  _Journal of Network and Computer Applications_ 116 (2018), 1–8.
  * Hesamifard et al. (2016) Ehsan Hesamifard, Hassan Takabi, and Mehdi Ghasemi. 2016.  Cryptodl: towards deep learning over encrypted data. In _Annual Computer Security Applications Conference (ACSAC 2016), Los Angeles, California, USA_ , Vol. 11.
  * Hitaj et al. (2017) Briland Hitaj, Giuseppe Ateniese, and Fernando Perez-Cruz. 2017.  Deep models under the GAN: information leakage from collaborative deep learning. In _Proceedings of the 2017 ACM SIGSAC conference on computer and communications security_. 603–618.
  * Hu et al. (2022) Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S Yu, and Xuyun Zhang. 2022.  Membership inference attacks on machine learning: A survey.  _ACM Computing Surveys (CSUR)_ 54, 11s (2022), 1–37.
  * Jawalkar et al. (2023) Neha Jawalkar, Kanav Gupta, Arkaprava Basu, Nishanth Chandran, Divya Gupta, and Rahul Sharma. 2023.  Orca: FSS-based Secure Training and Inference with GPUs. In _2024 IEEE Symposium on Security and Privacy (SP)_. IEEE Computer Society, 63–63.
  * Khan et al. (2021) Tanveer Khan, Alexandros Bakas, and Antonis Michalas. 2021.  Blind faith: Privacy-preserving machine learning using function approximation. In _2021 IEEE Symposium on Computers and Communications (ISCC)_. IEEE, 1–7.
  * Khan et al. (2024) Tanveer Khan, Mindaugas Budzys, Khoa Nguyen, and Antonis Michalas. 2024.  Wildest Dreams: Reproducible Research in Privacy-preserving Neural Network Training.  _Proceedings on Privacy Enhancing Technologies_ 2024, 3.
  * Khan and Michalas (2023) Tanveer Khan and Antonis Michalas. 2023.  Learning in the Dark: Privacy-Preserving Machine Learning using Function Approximation.  (2023).
  * Khan et al. (2023a) Tanveer Khan, Khoa Nguyen, and Antonis Michalas. 2023a.  A More Secure Split: Enhancing the Security of Privacy-Preserving Split Learning. In _Nordic Conference on Secure IT Systems_. Springer, 307–329.
  * Khan et al. (2023b) Tanveer Khan, Khoa Nguyen, and Antonis Michalas. 2023b.  Split Ways: Privacy-Preserving Training of Encrypted Data Using Split Learning. In _2023 Workshops of the EDBT/ICDT Joint Conference, EDBT/ICDT-WS 2023, 28 March 2023_. CEUR-WS.
  * Khan et al. (2023c) Tanveer Khan, Khoa Nguyen, Antonis Michalas, and Alexandros Bakas. 2023c.  Love or Hate? Share or Split? Privacy-Preserving Training Using Split Learning and Homomorphic Encryption. In _2023 20th Annual International Conference on Privacy, Security and Trust (PST)_. IEEE Computer Society, 1–7.
  * Konečnỳ et al. (2016) Jakub Konečnỳ, H Brendan McMahan, Daniel Ramage, and Peter Richtárik. 2016.  Federated optimization: Distributed machine learning for on-device intelligence.  _arXiv preprint arXiv:1610.02527_ (2016).
  * Lecun et al. (1998) Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. 1998.  Gradient-based learning applied to document recognition.  _Proc. IEEE_ 86, 11 (1998), 2278–2324.  https://doi.org/10.1109/5.726791
  * LeCun et al. ([n. d.]) Yann LeCun, Corinna Cortes, and Christopher J.C. Burges. [n. d.].  The mnist database.  http://yann.lecun.com/exdb/mnist/
  * Lecuyer et al. (2019) Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. 2019.  Certified robustness to adversarial examples with differential privacy. In _2019 IEEE symposium on security and privacy (SP)_. IEEE, 656–672.
  * Li et al. (2022) Jingtao Li, Adnan Siraj Rakin, Xing Chen, Zhezhi He, Deliang Fan, and Chaitali Chakrabarti. 2022.  Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning. In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_. 10194–10202.
  * McMahan et al. (2016) H Brendan McMahan, Eider Moore, Daniel Ramage, and Blaise Agüera y Arcas. 2016.  Federated learning of deep networks using model averaging.  _arXiv preprint arXiv:1602.05629_ 2 (2016), 2.
  * Mohassel and Zhang (2017) Payman Mohassel and Yupeng Zhang. 2017.  Secureml: A system for scalable privacy-preserving machine learning. In _2017 IEEE symposium on security and privacy (SP)_. IEEE, 19–38.
  * Nguyen et al. (2023) K Nguyen, T Khan, and A Michalas. 2023.  Split Without a Leak: Reducing Privacy Leakage in Split Learning. In _19th EAI International Conference on Security and Privacy in Communication Networks (SecureComm’23)_. Springer.
  * OpenAI (2021) OpenAI. 2021.  ChatGPT.  Computer software.  https://openai.com
  * Pasquini et al. (2021) Dario Pasquini, Giuseppe Ateniese, and Massimo Bernaschi. 2021.  Unleashing the tiger: Inference attacks on split learning. In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_. 2113–2129.
  * Ryffel et al. (2020) Théo Ryffel, Pierre Tholoniat, David Pointcheval, and Francis Bach. 2020.  Ariann: Low-interaction privacy-preserving deep learning via function secret sharing.  _Proceedings on Privacy Enhancing Technologies_ 2022, 1 (2020), 291–316.
  * Sav et al. (2021) Sinem Sav, Apostolos Pyrgelis, Juan Ramon Troncoso-Pastoriza, David Froelicher, Jean-Philippe Bossuat, Joao Sa Sousa, and Jean-Pierre Hubaux. 2021.  POSEIDON: Privacy-Preserving Federated Neural Network Learning. In _28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021_. INTERNET SOC.
  * Shokri et al. (2017) Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017.  Membership inference attacks against machine learning models. In _2017 IEEE symposium on security and privacy (SP)_. IEEE, 3–18.
  * Thapa et al. (2022) Chandra Thapa, Pathum Chamikara Mahawaga Arachchige, Seyit Camtepe, and Lichao Sun. 2022.  Splitfed: When federated learning meets split learning. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 36. 8485–8493.
  * Truex et al. (2019) Stacey Truex, Nathalie Baracaldo, Ali Anwar, Thomas Steinke, Heiko Ludwig, Rui Zhang, and Yi Zhou. 2019.  A hybrid approach to privacy-preserving federated learning. In _Proceedings of the 12th ACM workshop on artificial intelligence and security_. 1–11.
  * Wagh (2022) Sameer Wagh. 2022.  Pika: Secure Computation using Function Secret Sharing over Rings.  _Proceedings on Privacy Enhancing Technologies_ 4 (2022), 351–377.
  * Yang et al. (2023) Peng Yang, Zoe L Jiang, Shiqi Gao, Jiehang Zhuang, Hongxiao Wang, Junbin Fang, Siuming Yiu, and Yulin Wu. 2023.  FssNN: Communication-Efficient Secure Neural Network Training via Function Secret Sharing.  _Cryptology ePrint Archive_ (2023).
  * Yao (1986) Andrew Chi-Chih Yao. 1986.  How to generate and exchange secrets. In _27th Annual Symposium on Foundations of Computer Science (sfcs 1986)_. IEEE.