# Passive Inference Attacks on Split Learning via Adversarial Regularization

Xiaochen Zhu  National University of Singapore<EMAIL_ADDRESS>,  Xinjian Luo
National University of Singapore<EMAIL_ADDRESS>,  Yuncheng Wu
National University of Singapore<EMAIL_ADDRESS>,  Yangfan Jiang
National University of Singapore<EMAIL_ADDRESS>,  Xiaokui Xiao
National University of Singapore<EMAIL_ADDRESS>and  Beng Chin Ooi
National University of Singapore<EMAIL_ADDRESS>
###### Abstract.

Split Learning (SL) has emerged as a practical and efficient alternative to
traditional federated learning. While previous attempts to attack SL have
often relied on overly strong assumptions or targeted easily exploitable
models, we seek to develop more practical attacks. We introduce SDAR, a novel
attack framework against SL with an honest-but-curious server. SDAR leverages
auxiliary data and adversarial regularization to learn a decodable simulator
of the client’s private model, which can effectively infer the client’s
private features under the vanilla SL, and both features and labels under the
U-shaped SL. We perform extensive experiments in both configurations to
validate the effectiveness of our proposed attacks. Notably, in challenging
but practical scenarios where existing passive attacks struggle to reconstruct
the client’s private data effectively, SDAR consistently achieves attack
performance comparable to active attacks. On CIFAR-10, at the deep split level
of 7, SDAR achieves private feature reconstruction with less than 0.025 mean
squared error in both the vanilla and the U-shaped SL, and attains a label
inference accuracy of over 98% in the U-shaped setting, while existing attacks
fail to produce non-trivial results.

††copyright: cc

##  1\. Introduction

To bridge the isolated data repositories across different data owners,
federated learning (FL) (McMahan et al., 2017; Kairouz et al., 2021; Wu et
al., 2020; Yang et al., 2021; Liu et al., 2021) has been proposed as a
solution to privacy-preserving collaborative learning. However, participants
engaged in FL often suffer from low communication efficiency and heavy
computational overhead imposed by the iterative process of local model
training and the frequent exchange of model parameters, especially when the
local models to be trained are deep neural networks (NNs). Naturally, as a
simple adaption with enhanced communication and computation efficiency of FL,
split learning (SL) (Poirot et al., 2019; Gupta and Raskar, 2018; Vepakomma et
al., 2018; Oh et al., 2022; Thapa et al., 2021; Yin et al., 2021; Singh et
al., 2019) has drawn increasing attention in various applications, such as
healthcare (Ha et al., 2022; Vepakomma et al., 2018) and open source packages
(OpenMinded, 2021; Hall, 2020). The general idea of SL is to _split_ an NN
model into smaller partial models, with simpler models being allocated to
clients, and more intricate ones hosted on a computationally capable server.
During training, clients send the intermediate representations produced by
their partial models to the server, which subsequently performs a forward pass
utilizing its own partial model and back-propagates the gradients back to the
clients to perform model updates. In this way, SL enables privacy-preserving
collaborative learning by sharing only the intermediate representations
without revealing the original private data from the clients. Compared to FL,
SL adopts a more computationally efficient approach, yielding improved
communication efficiency and scalability without compromising model utility
(Yin et al., 2021; Singh et al., 2019; Gao et al., 2020). Nonetheless, privacy
concerns still exist within the SL framework. Given that clients share model
intermediate representations with the server, one may naturally wonder _if it
is possible for the server to infer private data of clients from the shared
intermediate representations_.

##### Related work111Please refer to Appendix D for detailed discussions on
related work.

To address this question, several inference attacks (Pasquini et al., 2021;
Erdoğan et al., 2022; Gao and Zhang, 2023; Yin et al., 2023; Qiu et al., 2023;
He et al., 2019) have been devised to investigate the privacy risks of SL.
However, _these attacks typically consider impractical threat models and
target non-standard settings favorable for the adversary._ For example,
Pasquini et al. (2021) assume a malicious server that _actively_ tampers the
back-propagated gradients, which deviates from the original training protocol
of SL and can be easily detected as an agreement violation (Fu et al., 2023;
Erdogan et al., 2022). In addition, Erdoğan et al. (2022) and Gao and Zhang
(2023) propose passive inference attacks, in which the server honestly follows
the SL training protocol but attempts to infer clients’ private data by
analyzing the shared intermediate outputs. Although these two attacks are more
stealthy, they also target non-standard and easily exploitable models, as did
in (Pasquini et al., 2021). Specifically, the targeted models on the clients’
side are typically non-standard models that are overly wide for their input
dimensions, which results in higher dimensional intermediate representations
encoding more information about the private input, thus making the attacks
more effective. Additionally, existing attacks are often evaluated on split
configurations where the clients’ models are shallow, which are commonly
believed to be more vulnerable to attacks (Vepakomma et al., 2020; Pasquini et
al., 2021; Gao and Zhang, 2023). Correspondingly, these attacks can be
defended by considering models with adequate width and allocating more layers
to the clients’ partial models. Existing attacks (Pasquini et al., 2021;
Erdoğan et al., 2022; Gao and Zhang, 2023) also often omit the use of batch
normalization layers (Ioffe and Szegedy, 2015) in the target models for
achieving favorable attack results, rendering these attacks less effective on
widely adopted model structures comprising batch normalization. Therefore, it
is still underexplored whether passive inference attacks can achieve
reasonable effectiveness in practical SL scenarios involving less exploitable
model structures.

In this paper, we address this gap by developing passive feature and label
inference attacks on practical SL settings where existing attacks (Pasquini et
al., 2021; Erdoğan et al., 2022; Gao and Zhang, 2023) fail to work, i.e., we
target standard models with adequate width and batch normalization at deeper
split levels. By considering passive attacks, we can ensure the stealthiness
of our attacks, making them hardly susceptible to detection by active defense
mechanisms (Fu et al., 2023; Erdogan et al., 2022). By considering the
practical SL settings, we can reveal the privacy vulnerabilities that may
exist in real-world applications but have not been explored. Nonetheless,
before devising the proposed attacks, several challenges must be addressed.

##### Challenges

First, the main challenge in server-side attacks on SL is the absence of
access (including the black-box access) to the client’s partial model, which
means that the server cannot feed specific input to the client’s model and
observe the corresponding output, rendering the traditional approach of model
inversion (Fredrikson et al., 2015; Zhao et al., 2021; Fredrikson et al.,
2014) inapplicable in SL. Second, in a passive setting where the server cannot
manipulate the client’s model, the only information available to the server is
the shared intermediate representations. As the complexity of the client’s
partial model increases, e.g., with deeper split levels, the information
encoded in these intermediate representations diminishes, making it more
challenging to decode the private data solely from the received
representations. Third, during SL training, the client’s model undergoes
continuous updates in each iteration. This dynamic nature results in entirely
different representations over iterations, further complicating inference
attacks for the server, compared to attacks on finalized models (He et al.,
2019; Yin et al., 2023).

Aside from the typical SL setting, we also consider a more intricate SL
configuration, known as U-shaped SL, where the last few layers of the model
are also kept privately by the clients, and the server’s responsibility is
limited to training the intermediate layers of a neural network. This
introduces two new challenges. First, the absence of access to training
examples’ labels poses the need for the server to simultaneously recover
private features and labels to achieve a reasonable attack. Second,
established practices and theoretical insights of transfer learning indicate
that the last few layers of a network are crucial to learn domain-specific
representations (Yosinski et al., 2014), and the lack of these layers makes it
harder for the server to recover private training samples than in vanilla SL.

##### Contributions

To address these challenges, we propose a novel class of passive attacks on
SL, namely, Simulator Decoding with Adversarial Regularization (SDAR). The
basic idea behind SDAR involves the server initially training a simulator that
emulates the client’s private model and subsequently training a decoder
tailored to the trained simulator, with the help of auxiliary data disjoint
from the private target data (Pasquini et al., 2021; Gao and Zhang, 2023). The
rationale of SDAR is that a well-trained decoder should be capable of decoding
the intermediate representations generated by the client’s private model.
However, due to the intrinsic differences in distribution between the client’s
private data and the server’s auxiliary data, the simulator trained by the
server tends to overfit the auxiliary data. Consequently, the simulator cannot
faithfully replicate the behaviors of the client’s model, resulting in the
decoder being proficient at decoding the auxiliary data but incapable of
decoding the client’s private data.

To solve this issue, we draw inspiration from generative adversarial networks
(GANs) (Goodfellow et al., 2020, 2014) and innovatively propose to regularize
the simulator and decoder through an adversarial loss, encouraging them to
learn more generalized representations that are transferable to the client’s
private data. For vanilla SL where the server has access to the labels of
training records, SDAR utilizes the label information in the style of
conditional GAN (Mirza and Osindero, 2014). In the more challenging U-shaped
SL setting, where the client privately retains the last few layers of the
model along with the record labels, SDAR trains an additional simulator to
mimic the behavior of these last few layers. To mitigate overfitting of this
supplementary simulator, we introduce label random flipping, which encourages
this simulator to learn the general representations rather than mere
memorization of the server’s data. Furthermore, we utilize the inference
outcomes of this simulator on private samples to achieve label inference
attacks in the context of the U-shaped setting.

We conduct extensive experiments on various real-world datasets in both SL
configurations to demonstrate the effectiveness of the proposed attacks. The
results show that under challenging yet practical settings where existing
attacks fail to effectively reconstruct clients’ private data, SDAR achieves
consistent and distinctive attack performance. In addition, we evaluate
potential countermeasures and show the robustness of our attacks against such
defenses.

##  2\. Preliminaries

(a) Vanilla SL

(b) U-shaped SL

Figure 1. Vanilla and U-shaped configurations of SL.

##### Split learning

We consider training an NN model $H$ on dataset
$D=\\{(x_{t},y_{t}):t=1,\ldots,N\\}$. $H$ consists of $n$ layers $H=L_{n}\circ
L_{n-1}\ldots\circ L_{1}$. The key idea of SL (Poirot et al., 2019; Gupta and
Raskar, 2018; Vepakomma et al., 2018) is to split the execution of $H$ by a
split layer (namely, $L_{s}$) and assign the first half
$f=L_{s}\circ\ldots\circ L_{1}$ to the client and the second half
$g=L_{n}\circ\ldots\circ L_{s+1}$ to the server. Then, $H=g\circ f$. In the
vanilla SL setting, the server also holds the labels of training examples. For
a batch of examples $X$, define the representations returned by layer $L_{i}$
as $Z_{i}$. Then, on the forward pass, the client sends intermediate
representations $Z_{s}=f(X)$ (also known as smashed data) to the server such
that the latter can complete the forward pass via $Z_{n}=g(Z_{s})$. Since the
server has access to the record labels $Y$, it can evaluate the loss
$\ell(Z_{n},Y)$ where $\ell(\cdot,Y)$ is the loss function given ground truth
labels $Y$. In backpropogation, for parameters $\theta_{i}$ of $L_{i}$, chain
rule gives

(1) $\nabla\theta_{i}=\frac{\partial\ell(Z_{n},Y)}{\partial
Z_{n}}\cdot\frac{\partial
L_{n}(Z_{n-1})}{\partial\theta_{n}}\cdots\frac{\partial
L_{i}(Z_{i-1})}{\partial\theta_{i}}=\nabla\theta_{i+1}\frac{\partial
L_{i}(Z_{i-1})}{\partial\theta_{i}}.$

By (1), one only needs the gradients of the next layer and the representations
returned by the previous layer to differentiate layer $L_{i}$. Thus, the
server can update parameters $\theta_{g}$ of its model $g$ after receiving
$Z_{s}$ from the client, while the client can update $f$ after receiving
$\nabla\theta_{s+1}$ from the server (see Fig. 1(a) for an example).

##### U-shaped SL

If the client’s record labels are considered private and not shared with the
server, SL can be configured as a U-shaped structure (Gupta and Raskar, 2018),
as illustrated in Fig. 1(b). Under U-shaped SL, the NN model is partitioned
into three parts, i.e., $H=h\circ g\circ f$, where $f=L_{s}\circ\ldots\circ
L_{1}$, $g=L_{t}\circ\ldots\circ L_{s+1}$, and $h=L_{n}\circ\ldots\circ
L_{t+1}$. The client owns $f$ and $h$ while the server only hosts $g$. During
the training on samples $X$, the client sends $Z_{s}$ to the server, which
computes $Z_{t}$ and sends it back to the client. The client then computes the
final prediction $Z_{n}=h(Z_{t})$. In the backpropogation phase, the client
first updates its model $h$ and sends $\nabla\theta_{t+1}$ to the server.
Then, the server updates $g$ and sends $\nabla\theta_{s+1}$ to the client for
updating the partial model $f$ on the client side.

##### SL with multiple clients

Due to its simplicity, the SL framework can be easily scaled to support
multiple clients on either horizontally-partitioned data (Vepakomma et al.,
2018) or vertically-partitioned data (Ceballos et al., 2020). Note that in the
multi-client SL scenarios, each client still needs to communicate with the
server via the above-described protocol, i.e., sharing intermediate
representations with the server.

##  3\. Problem Statement

##### System model

For ease of presentation, we introduce the proposed attacks in the SL setting
where a client and a server collaboratively train a deep model $H$ in either
the vanilla or the U-shaped configuration. Our attacks can be seamlessly
extended to the multi-client SL scenario for inferring the private data from
different clients without further modifications, given that the shared
information between clients and the server in the multi-client scenario is the
same as that in the single-client scenario. Note that image datasets are
typically used to train deep models under various SL settings (Gupta and
Raskar, 2018).

##### Threat model

We investigate the privacy risks of SL under the honest-but-curious threat
model (Luo et al., 2021), i.e., the server honestly adheres to the SL protocol
and does not tamper with the training process but tries to passively infer the
client’s private information from the received messages. In addition, we
assume that the server has background knowledge of an auxiliary public dataset
$D^{\prime}=\\{(x^{\prime}_{t},y^{\prime}_{t}):t=1,\ldots,m\\}$ such that
$D\cap D^{\prime}=\emptyset$, where $D$ denotes the client’s private dataset
and shares a similar distribution with $D^{\prime}$. This is a common and
reasonable assumption in related studies (Pasquini et al., 2021; Gao and
Zhang, 2023) because the task types and data domain should be negotiated
between the client and the server before initiating an SL training.
Consequently, the server can collect a public dataset from the same data
domain for attack implementation (Pasquini et al., 2021; Gao and Zhang, 2023).
Note that we assume no access to any example in the client’s private dataset
$D$ for the server, which is more stringent than (Gao and Zhang, 2023) where
$D^{\prime}$ can be a subset of $D$. In addition, the server and the client
should agree on the model architecture of $H$ and the split configuration
beforehand for information exchange and model convergence (Erdoğan et al.,
2022). During model training, the server has neither black-box nor white-box
access to the client’s models, and can only receive intermediate
representations from the client based on the SL protocol.

In _vanilla SL_ , the client hosts model $f$ while the server hosts model $g$
and has access to the record labels. For a batch of training records $(X,Y)$,
the server aims to reconstruct the private features $X$ given the received
intermediate representations $Z_{s}$, i.e.,
$\hat{X}=\mathcal{A}(Y,Z_{s},\theta_{g},D^{\prime})$, where $\hat{X}$ is the
inferred features, $\theta_{g}$ represents the parameters of $g$, and
$\mathcal{A}$ denotes the attack algorithm. In _U-shaped SL_ , the client
hosts partial models $f$ and $h$ while the server hosts model $g$. For a batch
of training records $(X,Y)$, the server aims to reconstruct both the private
features $X$ and the labels $Y$ given the received $Z_{s}$ and the gradient
vector $\nabla\theta_{t+1}$, i.e.,
$\hat{X},\hat{Y}=\mathcal{A}(Z_{s},\theta_{g},\nabla\theta_{t+1},D^{\prime})$.

##  4\. Passive attacks against SL

In this section, we introduce SDAR, a novel framework for an honest-but-
curious server to infer the client’s private data in SL. The core idea of SDAR
is using adversarial regularization to train a simulator model that learns
similar representations as the client’s intermediate representations in a way
that the simulator’s outputs and the client model’s outputs are
indistinguishable from each other by an adversarial discriminator. After that,
a corresponding decoder is trained on $D^{\prime}$ for decoding the
intermediate representations output by the simulator. By regularizing this
decoder via an additional adversarial discriminator, this decoder can be
generalized to effectively decode the client’s intermediate representations
despite $D\cap D^{\prime}=\emptyset$. SDAR is capable of inferring private
features in the vanilla SL and both the private features and labels in the
U-shaped SL, even under challenging scenarios where the client’s model is deep
and narrow with batch normalization.

(a) Private $X$ (upper) vs $\hat{X}$ (lower) reconstructed by the naïve SDA

(b) Training loss of $g\circ f$ vs $g\circ\tilde{f}$

(c) Decoding MSE on $Z^{\prime}_{s}$ vs $Z_{s}$

Figure 2. Failure of naïve SDA on CIFAR-10 with ResNet-20 at split level 7.
Solid lines are mean values over 5 runs, and values between min/max boundaries
are shaded.333If not specified otherwise, all figures follow the same
convention.

###  4.1. Feature inference attacks in vanilla SL

We start with a simple attack prototype, denoted as naïve simulator decoding
attack (naïve SDA). As the server has access to an auxiliary dataset
$D^{\prime}$ and the knowledge of the architecture of the client’s $f$, it can
first initialize a simulator $\tilde{f}$ on its own with the same architecture
as $f$ (but with random initialization) and then train the model
$g\circ\tilde{f}$ on $D^{\prime}$. Specifically, for each batch of training
examples $(X,Y)$, after the parameters of $f,g$ are updated via the training
loss $\ell(g(f(X)),Y)$, the server samples another batch of examples
$(X^{\prime},Y^{\prime})$ from $D^{\prime}$ and trains $\tilde{f}$ to minimize
loss $\ell(g(\tilde{f}(X^{\prime})),Y^{\prime})$ with the model $g$ frozen.
The reason to fix $g$ in this step is mainly twofold. First, as an honest-but-
curious party, the server should ensure that the parameters of $g$ are only
updated based on $D$ as specified in the SL protocol. Second, fixing $g$ while
training $\tilde{f}$ forces $\tilde{f}$ to learn representations that are
compatible with $g$. As $g$ is trained collaboratively with the client’s model
$f$ on $D$, it is expected to memorize information of $D$ (Shokri et al.,
2017) which may be implicitly leaked to $\tilde{f}$ while training
$g\circ\tilde{f}$. In this way, the encoder $\tilde{f}$ trained by the server
is expected to mimic the behaviors of $f$. In the meantime, the server trains
a decoder $\tilde{f}^{-1}$ with the transposed architecture of $\tilde{f}$ to
decode $Z_{s}^{\prime}=\tilde{f}(X^{\prime})$, i.e., the decoder parameters
$\theta_{\tilde{f}^{-1}}$ are updated via the loss
$\ell_{\text{MSE}}(X^{\prime},\tilde{f}^{-1}(Z_{s}^{\prime}))$. One may expect
the decoder $\tilde{f}^{-1}$ can not only decode the output of the simulator
$\tilde{f}$ but also effectively decode the output $Z_{s}$ of $f$, i.e.,
$\tilde{f}^{-1}(Z_{s})\approx X$ for private features $X$.

Unfortunately, the naïve SDA fails to achieve this objective as illustrated in
Fig. 2(a). The main reason behind the failure of naïve SDA is that although
the training loss of $g\circ\tilde{f}$ on $X^{\prime}$ converges to a similar
minimum as that of $g\circ f$ on $X$ (see Fig. 2(b)), $\tilde{f}$ fails to
learn the same representations as $f$. This generalization gap is rooted in
the distributional discrepancy between the disjoint datasets $D$ and
$D^{\prime}$, and the fact that $\tilde{f}$ is trained solely on $D^{\prime}$
makes it prone to overfitting to $D^{\prime}$. As a result, even if the
decoder $\tilde{f}^{-1}$ can precisely decode the simulator $\tilde{f}$ with
very low reconstruction error, its reconstruction error on $Z_{s}$, the output
of the client’s private model $f$ on unseen features $X$, does not converge
(see Fig. 2(c)).

In response, we propose to enhance naïve SDA with adversarial regularization,
to encourage the simulator and the decoder to learn more general
representations transferable to the private data $X$.

##### Adversarial regularization for $\tilde{f}$

To regularize the simulator $\tilde{f}$ such that it behaves more similarly to
the client’s private model $f$, we introduce a server-side discriminator
$d_{1}$ that is trained to distinguish $Z_{s}^{\prime}=\tilde{f}(X^{\prime})$
(the fake data) against $Z_{s}=f(X)$ (the real data). In each iteration,
$d_{1}$ is updated to minimize the loss

(2)
$\mathcal{L}_{d_{1}}=\ell_{\text{BCE}}(d_{1}(Z_{s}^{\prime}),0)+\ell_{\text{BCE}}(d_{1}(Z_{s}),1)$

to correctly classify $Z_{s}^{\prime}$ against $Z_{s}$, where $\ell_{BCE}$ is
the binary cross-entropy loss. In the meantime, the simulator is updated in an
adversarial way that maximizes the likelihood of being misclassified by the
discriminator, i.e., to minimize the loss
$\ell_{\text{BCE}}(d_{1}(\tilde{f}(X^{\prime})),1)$. We introduce this
adversarial loss as a regularization term with penalty parameter
$\lambda_{1}$, i.e., the simulator $\tilde{f}$ is updated to minimize the loss

(3)
$\mathcal{L}_{\tilde{f}}=\ell(g(\tilde{f}(X^{\prime})),Y^{\prime})+\lambda_{1}\cdot\ell_{\text{BCE}}(d_{1}(\tilde{f}(X^{\prime})),1).$

Thus, with the training loss on $D^{\prime}$ as the main objective and the
adversarial loss as the regularization term, the simulator is expected to
output representations indistinguishable from the output of $f$, thus better
simulating $f$’s behaviors on the private data $X$.

##### Adversarial regularization for $\tilde{f}^{-1}$

As shown in Fig. 2(c) and 2(a), the decoder $\tilde{f}^{-1}$ can accurately
decode the output of $\tilde{f}$ since $\tilde{f}^{-1}$ is trained in a
supervised manner on $Z^{\prime}_{s}$. However, this reconstruction capability
can not be generalized to decode $Z_{s}$. Specifically, we observe from Fig
2(a) that the reconstructed samples $\hat{X}$ exhibit obfuscated visual
features and can be easily distinguished from real images by a well-trained
discriminator. Motivated by this observation, we introduce another
discriminator $d_{2}$ to distinguish $\tilde{f}^{-1}(Z_{s})$ (the fake data)
against $X^{\prime}$ (the real data) owned by the server. Similar to Eq. (2),
$d_{2}$ is trained by minimizing

(4)
$\mathcal{L}_{d_{2}}=\ell_{\text{BCE}}(d_{2}(\tilde{f}^{-1}(Z_{s})),0)+\ell_{\text{BCE}}(d_{2}(X^{\prime}),1).$

Meanwhile, the decoder $\tilde{f}^{-1}$ needs to be trained in an adversarial
manner to maximize the likelihood of being misclassified by the discriminator.
Similar to Eq. (3), we introduce a regularization term with penalty parameter
$\lambda_{2}$, and the decoder is trained to minimize

(5)
$\mathcal{L}_{\tilde{f}^{-1}}=\ell_{\text{MSE}}(X^{\prime},\tilde{f}^{-1}(Z_{s}^{\prime}))+\lambda_{2}\cdot\ell_{\text{BCE}}(d_{2}(\tilde{f}^{-1}(Z_{s})),1).$

In this way, the decoder is trained to reconstruct private images from $Z_{s}$
with plausible visual features as real images.

##### Use of labels

In the vanilla SL, the server holds labels of all private training images,
indicating that the server has access to the labels of both the private data
$X$ and the auxiliary data $X^{\prime}$. This enables the server to adopt the
decoder $\tilde{f}^{-1}$ and the discriminators $d_{1},d_{2}$ in a conditional
manner similar to the conditional GANs (Mirza and Osindero, 2014). Take the
decoder $\tilde{f}^{-1}$ as an example. Instead of only taking the
intermediate representations $Z_{s},Z_{s}^{\prime}$ as the input, a
conditional $\tilde{f}^{-1}$ can additionally take the corresponding labels
$Y,Y^{\prime}$ as the input. These labels can be first transformed into a
high-dimensional embedding and then concatenated with the intermediate
representations. A similar modification can be applied to the discriminators.
This adaptation enables the decoder to more effectively decode the
intermediate representations, while also enhancing the discriminators’
capability to distinguish between real and synthetic examples.

With the integration of the aforementioned enhancements, we denote the refined
simulator decoding attack as Simulator Decoding with Adversarial
Regularization (SDAR). We describe the complete attack algorithm (Algorithm 1)
in Appendix A.

###  4.2. Feature & label inference attacks in U-shaped SL

In the U-shaped SL, the model $H$ is split into three parts $H=h\circ g\circ
f$ such that only the intermediate partial model $g$ is kept by the server,
and the other two are trained by the client. An intuitive approach to adapt
SDAR to the U-shaped SL is that the server trains an additional simulator
$\tilde{h}$ to mimic the behaviors of $h$, which can be updated by minimizing
the training loss of $\tilde{h}\circ g\circ\tilde{f}$ on $D^{\prime}$ when
freezing $g$. If the simulator $\tilde{h}$ is well-trained on $D^{\prime}$
such that it is able to generalize well to classify unseen private examples in
$D$, the server can effectively reconstruct private labels
$\hat{Y}=\tilde{h}(g(Z_{s}))$ in addition to private features. However, the
last few layers (i.e., $h$) of the model has a strong expressive capacity of
the private information suggested by the practice and theory of transfer
learning (Yosinski et al., 2014). Consequently, $\tilde{h}$ can easily overfit
to $D^{\prime}$ such that the training loss on $D^{\prime}$ converges to a
local minimum yet $\tilde{h}$ and $\tilde{f}$ fail to learn the similar
behaviors of $h$ and $f$. In this case, the decoder $\tilde{f}^{-1}$ will not
be able to reconstruct the private input $X$ from $Z_{s}$ effectively when
trained along with the overfitted $\tilde{f}$. Thus, it is crucial to ensure
that the simulator $\tilde{h}$ learns the general and transferable data
representations, instead of overfitting to $D^{\prime}$.

To this end, we introduce random label flipping in the training of
$\tilde{h}\circ g\circ\tilde{f}$. Specifically, for each batch of examples
$(X^{\prime},Y^{\prime})$ sampled from $D^{\prime}$, we first randomly modify
a small fraction of $Y^{\prime}$ to new random labels for generating a new
label set $\tilde{Y}^{\prime}$. After that, we train $\tilde{h}\circ
g\circ\tilde{f}$ based on the new training batch
$(X^{\prime},\tilde{Y}^{\prime})$. The rationale is that the randomly flipped
labels can help regularize the training of $\tilde{h}$, enabling $\tilde{h}$
to produce more general data representations that are compatible with the
output of $g$ and meanwhile transferable to the private data $D$. Other
components of SDAR except for the use of labels in Sec. 4.1 are directly
applicable to the U-shaped SL setting, including the adversarial
regularization on $\tilde{f}$ and $\tilde{f}^{-1}$. We describe the complete
attack algorithm (Algorithm 2) in Appendix A.

###  4.3. Technical novelty

First, SDAR identifies an underexplored vulnerability of SL, i.e., the risks
of information leakage from the parameters of the server’s model $g$. Since
$g$ is trained together with $f$ on the private examples $(X,Y)$, it
unintentionally memorizes information about the private data (Shokri et al.,
2017), and a carefully designed simulator trained with $g$ and
$(X^{\prime},Y^{\prime})$ can accurately simulate the behaviors of $f$. On the
contrary, most existing attacks (Pasquini et al., 2021; Erdoğan et al., 2022)
focus on only exploiting the privacy risks of the client’s intermediate
representations $Z_{s}$, which is often insufficient to reconstruct private
data under practical settings.

Second, SDAR utilizes a novel adversarial regularization method to
considerably improve the generalization performance of the simulator and
decoder on the client’s private data, which can achieve consistent and robust
attack performance on less vulnerable models where existing attacks (Pasquini
et al., 2021; Erdoğan et al., 2022; Gao and Zhang, 2023) cannot work. To the
best of our knowledge, this is also the first time that adversarial
regularization is utilized in the design of inference attacks on SL.

Note that one parallel study, PCAT (Gao and Zhang, 2023), adopts a similar
attack framework as our naïve SDA discussed in Sec. 4.1, with some minor
improvements. However, as demonstrated in Fig. 2 and our comparative
experiments in Sec. 5, PCAT fails to reconstruct reasonable images in
challenging but practical settings.

##  5\. Experiments

Table 1. Model statistics on different split levels in vanilla SL. Level |  #layers of $f$ |  #param. of $f$ |  #layers of $g$ |  #param. of $g$
---|---|---|---|---
3 | 7 | 14,704 | 13 | 259,338
4 | 9 | 29,424 | 11 | 244,618
5 | 11 | 48,112 | 9 | 225,930
6 | 13 | 66,800 | 7 | 207,242
7 | 15 | 124,912 | 5 | 149,130

###  5.1. Experimental settings

##### Datasets

We experiment with 4 popular benchmarking datasets: MNIST (LeCun et al.,
2010), Fashion-MNIST (Xiao et al., 2017), CIFAR-10 (Krizhevsky et al., 2009),
and CIFAR-100 (Krizhevsky et al., 2009). Due to limited space, we only report
results on CIFAR-10 and CIFAR-100 in the main text, and full results are
deferred to Appendix B.2. All images are resized to $32\times 32\times 3$ and
normalized to $[0,1]$ beforehand to match the input configuration of ResNet-20
(He et al., 2016). We partition each dataset into two disjoint subsets
$D,D^{\prime}$ where $D$ belongs to the client, and $D^{\prime}$ belongs to
the server. We start with $|D|=|D^{\prime}|$ where the server acquires
auxiliary data of the same size as the client’s private dataset. Then, we
experiment with $|D^{\prime}|\ll|D|$ to discuss the effectiveness of our
attacks with much less data.

##### Models

We use ResNet-20 (He et al., 2016) as the base model architecture for $H$,
which is a standard model specifically designed to classify the CIFAR-10
dataset. We chose residual networks because they are widely adopted in various
real-world applications, and are recognized to be hard to invert (Behrmann et
al., 2019). $H$ consists of 20 layers (19 convolutional layers and one
additional fully-connected output layer), with 9 residual blocks. We
experiment with different split levels denoted by $s\in\\{3,4,5,6,7\\}$ on the
ResNet-20 model, which is characterized by the number of residual blocks in
the client’s model $f$. The deepest client’s model has 7 residual blocks as
adding any more blocks will render the client to host more parameters than the
server, invalidating SL’s purpose of enabling a powerful server to relieve the
client from heavy computation. In the vanilla SL, all the remaining layers are
assigned to the server as shown in Table 1. In the U-shaped SL, the last few
layers, including the average pooling and the fully connected output layer,
are also assigned to the client, while the server only hosts the layers in
between. By considering the standard ResNet-20 model with 16/32/64 filters,
batch normalization and deep split levels up to 7, we target more challenging
and practical settings where the client’s private model is less exploitable to
existing attacks. Our experiments demonstrate that the wider and shallower
models without batch normalization considered by existing attacks (Pasquini et
al., 2021; Erdoğan et al., 2022; Gao and Zhang, 2023) are more vulnerable to
our attacks.

For the simulator $\tilde{f}$ (and $\tilde{h}$ if in U-shaped SL) of SDAR, the
server uses the same model architecture as that of the client’s $f$ (and $h$
if in U-shaped SL). The server uses the decoder $\tilde{f}^{-1}$ with a
structure transposed to $\tilde{f}$ ending with a sigmoid function to produce
$32\times 32\times 3$ tensors within $[0,1]$. The discriminators $d_{1}$ that
distinguishes $Z_{s}^{\prime}$ from $Z_{s}$, and $d_{2}$ that distinguishes
$\hat{X}$ from $X^{\prime}$, are deep convolutional networks. Architecture
details of the attack models are described in Appendix B.1.3.

##### Baselines

We compare SDAR with existing attacks, including UnSplit (Erdoğan et al.,
2022), PCAT (Gao and Zhang, 2023) and FSHA (Pasquini et al., 2021). UnSplit
(Erdoğan et al., 2022) is a passive attack which reconstructs private features
by minimizing $\ell_{\text{MSE}}(\tilde{f}(\hat{X}),Z_{s})$ via alternating
optimization on $\tilde{f}$ and $\hat{X}$. PCAT (Gao and Zhang, 2023) is also
a passive attack that adopts a similar attack framework as our naïve SDA
discussed in Sec. 4.1. FSHA (Pasquini et al., 2021), on the other hand, is an
active attack framework, where the server actively hijacks the gradients
transmitted to the client such that the client’s model $f$ is induced to
behave similarly to the server’s own encoder. To ensure the fairness of
comparison, we use the same model architectures and auxiliary datasets in
different attacks. Implementation details of the baselines are described in
Appendix B.1.4.

###  5.2. Experiments on vanilla SL attacks

##### Attack effectiveness

We report the results of SDAR and other passive feature inference attacks on
CIFAR-10 at split levels 3–7 in Table 2 and give concrete examples of private
data reconstruction in Fig. 3. Table 2 demonstrates that the proposed attack,
SDAR, surpasses existing passive attacks (Gao and Zhang, 2023; Erdoğan et al.,
2022) in terms of reconstruction errors at all split levels by a significant
margin. We note that SDAR achieves nearly perfect reconstruction at shallower
split cuts, and is still able to achieve exceptional reconstruction quality
even at deep split levels up to 7 (see Fig. 3). PCAT (Gao and Zhang, 2023) is
able to recover private features at shallower split levels ($\leq 4$) but of
much lower quality than SDAR. In particular, the reconstruction quality of
PCAT in the most trivial case (split level 3) is even worse than the attack
results of SDAR at the deepest split level 7. Moreover, the effectiveness of
PCAT degenerates dramatically at deeper split levels, resulting in even larger
performance gaps compared to SDAR. This is demonstrated in Fig. 3 where PCAT
struggles to produce reasonable reconstruction at split levels 6–7. We note
that the images reconstructed by UnSplit (Erdoğan et al., 2022) are
indistinguishable at all split levels and are thus omitted in this paper. The
performance of UnSplit is expected as $\tilde{f}(\hat{X})\approx f(X)$ does
not necessarily lead to $\hat{X}\approx X$.

Table 2. Mean values with standard deviations of the reconstruction MSE over 5 trials on CIFAR-10 in the vanilla SL. Level | SDAR |  PCAT (Gao and Zhang, 2023) |  UnSplit (Erdoğan et al., 2022)
---|---|---|---
3 | 0.0072 (0.0013) | 0.0231 (0.0066) | 0.0688 (0.0027)
4 | 0.0104 (0.0009) | 0.0237 (0.0021) | 0.0662 (0.0004)
5 | 0.0120 (0.0003) | 0.0337 (0.0048) | 0.0670 (0.0000)
6 | 0.0134 (0.0007) | 0.0382 (0.0062) | 0.0674 (0.0005)
7 | 0.0216 (0.0014) | 0.0568 (0.0062) | 0.0660 (0.0000)
|  |
---|---|---
3 |  |
4 |  |
5 |  |
6 |  |
7 |  |
|  (a) SDAR |  (b) PCAT (Gao and Zhang, 2023)
Figure 3. Examples of feature inference attack results on CIFAR-10 in vanilla
SL. The first row shows the original private images while the following rows
show the reconstructed images by SDAR and PCAT at various split levels 3–7.
Reconstructions of the best quality among 5 trials are shown.

(a) Feature reconstruction MSE

(b) Training loss of $g\circ f$

Figure 4. Attack MSE and training losses on the original task of SDAR vs FSHA
on CIFAR-100 at split level 7 in vanilla SL.

##### Comparison to active attacks

We also compare SDAR with the SOTA active feature inference attack, FSHA
(Pasquini et al., 2021), and report the attack MSE curve over training
iterations at split level 7 on CIFAR-100 in Fig 4(a). Note that as an active
attack where the server actively hijacks the client’s gradients to manipulate
the training of $f$, FSHA is expected to exhibit substantially better attack
performance than passive attacks. Yet, we observe that our attack, despite
being passive, still can achieve comparable attack performance as FSHA. This
indicates the strong capability of our proposed attack, which is unprecedented
in existing passive attacks. A particular advantage of SDAR is the
preservation of the original training task as the server does not tamper with
the SL training protocol. This is demonstrated in Fig. 4(b) where SDAR’s
training loss of $g\circ f$ on $X$ converges much faster than FHSA.
Consequently, SDAR poses a greater risk to real-world applications compared to
FSHA, as the original training task is preserved and the server can perform
the attack of robust quality without being detected by the client (Erdogan et
al., 2022; Fu et al., 2023).

Table 3. Effects of different sizes of the auxiliary data $D^{\prime}$ on SDAR performed on CIFAR-10 at split level 7 in vanilla SL. $|D^{\prime}|/|D|$ | 1.0 | 0.5 | 0.2 | 0.1 | 0.05
---|---|---|---|---|---
Attack MSE | 0.0216 | 0.0224 | 0.0237 | 0.0235 | 0.0274
(0.0014) | (0.0017) | (0.0017) | (0.0015) | (0.0016)
Original |
---|---
$\frac{|D^{\prime}|}{|D|}=1.0$ |
$\frac{|D^{\prime}|}{|D|}=0.05$ |
Figure 5. Examples of feature inference results of SDAR performed with
auxiliary datasets of different sizes.

(a) Effects of batch normalization

(b) Effects of model width

Figure 6. Effects of model structure on SDAR at split level 7 in vanilla SL.
Left is on CIFAR-10 and right is on CIFAR-100.

##### Effects of $|D^{\prime}|$

We discuss the effects of different sizes of the auxiliary dataset
$D^{\prime}$ on the performance of SDAR in Table 3. We only observe a limited
effect of the shrinkage of the auxiliary dataset on the performance of SDAR,
as the attack MSE only slightly increases when $D^{\prime}$ shrinks. Fig. 5
also demonstrates precise reconstructions even with auxiliary data of size 5%
of the client’s dataset. Intuitively, with smaller $D^{\prime}$, one would
expect the simulator/decoder trained on $D^{\prime}$ to be more prone to
overfitting and thus learn less useful information about client’s private
data. However, the core idea of SDAR is to reduce such overfitting by
adversarial regularization. The positive results presented in Table 3 and Fig.
5 demonstrate the effectiveness of adversarial regularization and show that
SDAR can still work effectively even with a limited size of additional data.

##### Effects of model structure

We discuss the effects of batch normalization and model width (number of
filters) on the attack performance of SDAR in Fig. 6. To discuss the effects
of batch normalization, we remove batch normalization layers in ResNet-20 and
report SDAR results in Fig. 6(a). Noticeably, it is easier to attack models
without batch normalization as SDAR consistently achieves lower reconstruction
MSE after removing batch normalization. This is because batch normalization
(Ioffe and Szegedy, 2015) re-centers and re-scales each layer’s input, making
the output less sensitive to the input. As for model width, since ResNet-20
uses convolutional layers of 16/32/64 filters, we experiment with wider and
narrower models by doubling and halving filters in each layer in Fig. 6(b). It
can be seen that attack performance increases with model width. This is
because wider models output $Z_{s}$ of significantly larger dimensions, thus
encoding more information about the private training data. It is worth noting
that existing attacks (Pasquini et al., 2021; Erdoğan et al., 2022; Gao and
Zhang, 2023) are often evaluated on overly wide models without batch
normalization, which, suggested by Fig. 6, are much easier to attack. For
example, PCAT (Gao and Zhang, 2023) is evaluated on a CNN model with up to 512
filters for CIFAR-10, while omitting batch normalization and ReLU (Nair and
Hinton, 2010). Our experiments with the standard ResNet-20 model demonstrate
that SDAR is able to attack much less vulnerable models with significantly
better performance.

##### Ablation studies

We conduct ablation studies in Table 4 to evaluate the effectiveness of each
component in SDAR. We observe that all components are crucial, as removing any
of them results in worse attack performance. In particular, attack performance
degenerates the most when the server does not use adversarial regularization
(case 4), showing its effectiveness to reduce overfitting and improve the
generalization of the simulator/decoder. Between the two adversarial
regularizers for $\tilde{f}$ and $\tilde{f}^{-1}$, SDAR is more sensitive to
the former (case 2 vs 3). Because the successful generalization of the decoder
heavily relies on the quality of the simulator. At last, we notice a marginal
performance gain by utilizing labels of the private examples in the style of
CGANs (Mirza and Osindero, 2014) (case 1 vs 5), when the discriminators and
decoders are fed with additional information.

Table 4. Ablation studies on CIFAR-10 at level 7 in vanilla SL. |  $d_{1}$ (for $\tilde{f}$) |  $d_{2}$ (for $\tilde{f}^{-1}$) | conditional | attack MSE
---|---|---|---|---
1 | ✓ | ✓ | ✓ | 0.0216 (0.0014)
2 | ✗ | ✓ | ✓ | 0.0575 (0.0036)
3 | ✓ | ✗ | ✓ | 0.0234 (0.0015)
4 | ✗ | ✗ | ✓ | 0.0607 (0.0093)
5 | ✓ | ✓ | ✗ | 0.0222 (0.0012)

###  5.3. Experiments on U-shaped SL attacks

##### Attack effectiveness

As SDAR can infer both features and labels of the client’s training examples,
we report the feature reconstruction MSE and the label inference accuracy in
Table 5, and present examples of private feature reconstructions in Fig. 7.
Note that we no longer present results of UnSplit (Erdoğan et al., 2022) due
to its inability to produce distinguishable results even in the vanilla SL
setting. Similar to feature inference attacks in vanilla SL, SDAR can
reconstruct private features of high quality across various split levels, and
there is no significant performance drop compared to vanilla SL. The reason is
that although the server no longer has access to the last part of the model,
i.e., $h$, it manages to train a simulator $\tilde{h}$ that learns the same
representations, as supported by the high label inference accuracy which
consistently reaches around 98% on CIFAR-10 across all split levels. As the
server trains $\tilde{h}\circ g\circ\tilde{f}$ solely on $D^{\prime}$ (while
$g$ is trained on $D$), its high test accuracy on unseen examples in $D$
demonstrates that information about $D$ is indeed leaked to the server via the
trained parameters of $g$. In contrast, PCAT (Gao and Zhang, 2023) achieves
visibly worse feature reconstruction performance than in vanilla SL, since
PCAT is unable to train an effective simulator to $h$, as supported by its
poor label inference accuracy. It can be seen that with deeper split levels
and fewer parameters in the server’s $g$, less information about $D$ is leaked
via $g$, and hence the label inference accuracy of PCAT dramatically
degenerates to the level of random guessing when the split level increases to
7.

Table 5. Mean values with standard deviations of feature reconstruction MSE and label inference accuracy over 5 trials on CIFAR-10 at split levels 3–7 in U-shaped SL. lv. | Feature MSE | Label ACC (%)
---|---|---
SDAR |  PCAT (Gao and Zhang, 2023) | SDAR |  PCAT (Gao and Zhang, 2023)
3 | 0.0060 (0.0011) | 0.0452 (0.0297) | 97.80 (0.63) | 69.12 (35.15)
4 | 0.0085 (0.0013) | 0.0387 (0.0262) | 98.61 (0.26) | 88.66 (18.88)
5 | 0.0120 (0.0017) | 0.0665 (0.0262) | 98.49 (0.25) | 58.11 (34.33)
6 | 0.0138 (0.0013) | 0.0791 (0.0122) | 98.15 (0.51) | 21.34 (25.29)
7 | 0.0247 (0.0009) | 0.0947 (0.0184) | 98.71 (0.77) | 15.45 (09.99)
|  |
---|---|---
3 |  |
4 |  |
5 |  |
6 |  |
7 |  |
|  (a) SDAR |  (b) PCAT (Gao and Zhang, 2023)

Figure 7. Examples of feature inference attack results on CIFAR-10 in U-shaped
SL. See Fig. 3 for detailed descriptions.

Figure 8. Effects of random label flipping on SDAR on CIFAR-10 at split level
7 in U-shaped SL.

##### Effects of random label flipping

Many of the properties of SDAR in vanilla SL discussed in Sec. 5.2 directly
apply to the U-shaped SL, and we focus on the effects of random label flipping
on the training of $\tilde{h}$. Fig. 8 shows that after removing random label
flipping, the label inference accuracy of SDAR drops significantly, and in the
worst case, the label inference accuracy quickly vanishes to near-zero, even
worse than random guessing. Thus, without label flipping, server’s model
$\tilde{h}$ will quickly overfit to its own dataset $D^{\prime}$ without
simulating the behavior of $h$ on $D$. As a result, the simulator $\tilde{f}$
trained together with $\tilde{h}$ will not learn the same representations as
$f$ and hence the decoder can no longer generalize to decode the client’s $f$,
leading to poor feature inference performance as well. With random label
flipping, the server’s model $\tilde{h}$ is forced to learn the general
representations over time instead of overfitting to $D^{\prime}$.

Figure 9. Attack MSE of SDAR on CIFAR-10 with ResNet-20 at deeper split levels of 7–9 in the vanilla SL configuration. Table 6. Attack MSE of SDAR and training accuracies of SL on CIFAR-100 at split level 7 in vanilla SL with dropout. Dropout rate | 0.0 | 0.2 | 0.4 | 0.6 | 0.8
---|---|---|---|---|---
Attack MSE | 0.0217 | 0.0222 | 0.0227 | 0.0245 | 0.0263
(0.0011) | (0.0014) | (0.0011) | (0.0020) | (0.0020)
Train ACC (%) | 96.24 | 91.33 | 86.08 | 74.13 | 40.33
(0.65) | (0.29) | (0.38) | (0.82) | (0.73)
Table 7. Attack MSE of SDAR on CIFAR-10 at split level 7 in vanilla SL at different $\ell_{1}/\ell_{2}$ regularization factors. Regularization factor | 0.0 | 0.001 | 0.01 | 0.1
---|---|---|---|---
Attack MSE on SL with $\ell_{1}$ regularization | 0.0216 | 0.0219 | 0.0222 | 0.0230
(0.0014) | (0.0009) | (0.0016) | (0.0028)
Attack MSE on SL with $\ell_{2}$ regularization | 0.0216 | 0.0223 | 0.0228 | 0.0223
(0.0014) | (0.0017) | (0.0020) | (0.0012)

##  6\. Potential Countermeasures

##### Change of model architectures

We have demonstrated the effectiveness of SDAR on ResNet-20 (in Table 2 and
Table 5) and its narrower variants (in Fig. 6(b)) at the deep split level of
seven and show that narrower models with batch normalization at deeper split
levels are relatively more robust to our attacks. A natural defense against
SDAR is to assign more layers to the clients’ model. Therefore, we conduct
experiments at split levels up to 9 to observe the SDAR performance. The
results are presented Fig. 9. Note that at split level 9, the client hosts all
convolutional layers, and the server has merely 650 parameters. This is an
extreme case that is not practical in real-world deployments, as this
invalidates SL’s purpose of relieving the client’s computational burden with a
capable server. From Fig. 9, we see that even at level 9, SDAR’s attack MSE
continues to decrease over time without saturation. Therefore, we conclude
that SDAR is robust against different split levels, and changing the model
architecture is not a viable defense against our attacks.

##### Regularization

Overfitting is a key concern in inference attacks on ML models (Shokri et al.,
2017; Nasr et al., 2019), as ML models may overfit to and unintentionally
memorize private training data. Dropout (Srivastava et al., 2014; Luo et al.,
2021) and $\ell_{1}/\ell_{2}$ regularization (Ng, 2004) are straightforward
yet effective techniques to prevent overfitting. Therefore, we consider these
two regularizers as a potential defense and evaluate SDAR against them. As
shown in Table 6, the increase in dropout rate slightly degrades the attack
performance of SDAR, but the attack MSE remains at a low level, indicating the
attack effectiveness against dropout. Table 6 also shows that large dropout
rates can lead to significant degradation in the training accuracy of SL.
Similarly, we observe from Table 7 that variations of the $\ell_{1}/\ell_{2}$
regularization factors have limited influence on the attack performance. The
reason that our attacks are robust against regularization defense is due to
the fact that the same regularization is also applied in the training of the
simulator, so the $\tilde{f}$ can simulate the regularized behavior of the
client’s $f$. Therefore, dropout and $\ell_{1}/\ell_{2}$ regularization is not
a viable defense.

##### Decorrelation

A recent method for enhancing the privacy of SL is to decorrelate the
intermediate representations $Z_{s}$ with the input private features $X$
(Vepakomma et al., 2020, 2021). This is done by replacing $g\circ f$’s loss
function $\ell(g(f(X)),Y)$ with

$(1-\alpha)\ell(g(f(X)),Y)+\alpha\cdot\text{dCol}(f(X),X),$

where $\alpha$ is the decorrelation parameter and $\text{dCol}(\cdot,\cdot)$
is the distance correlation (Székely et al., 2007). To evaluate the
effectiveness of SDAR against this decorrelation defense, we first introduce a
decorrelation term in Eq. (3) to decorrelate $\tilde{f}(X^{\prime})$ with
$X^{\prime}$ in SDAR, such that the simulator can learn the decorrelation
behaviors of client’s $f$. Then, we perform SDAR on SL with decorrelation with
$\alpha\in\\{0.2,0.4,0.6,0.8\\}$. As shown in Table 8 and Fig. 10, although
decorrelation manages to degrade the attack quality when $\alpha$ increases,
SDAR still produces visibly precise reconstructions even at $\alpha=0.8$.
Also, Table 8 shows that the decorrelation defense with larger $\alpha$
results in a notable loss in training accuracy of the original task, rendering
this defense relatively impractical in real-world applications.

Table 8. Attack MSE of SDAR on CIFAR-100 in vanilla SL at split level 7 with decorrelation defense with various $\alpha$ values. $\alpha$ | 0.0 | 0.2 | 0.4 | 0.6 | 0.8
---|---|---|---|---|---
Attack MSE | 0.0217 | 0.0315 | 0.0383 | 0.0444 | 0.0475
(0.0011) | (0.0014) | (0.0009) | (0.0012) | (0.0012)
Train ACC (%) | 96.41 | 96.09 | 94.53 | 93.28 | 70.16
(1.36) | (1.10) | (1.10) | (1.89) | (6.54)
Original |
---|---
$\alpha=0.0$ |
$\alpha=0.8$ |
Figure 10. Examples of feature inference attack results on CIFAR-100 at split
level 7 with decorrelation with $\alpha\in\\{0,0.8\\}$.

##### Others

Appendix C discusses additional potential defenses to our attacks and their
inapplicability in SL in their current forms, including homomorphic encryption
(Takabi et al., 2016; Wood et al., 2020), secure multi-party computation (Wu
et al., 2020; Yao, 1982; Bonawitz et al., 2017; Keller, 2020), and
differential privacy (Dwork et al., 2014; Xiao et al., 2010; Abadi et al.,
2016).

##  7\. Conclusion

In this paper, we investigate the privacy risks of split learning under the
notion of an honest-but-curious server. We identify that existing server-side
passive attacks often target impractical and vulnerable settings to gain extra
advantage for the adversary. We present new passive attacks on split learning,
namely, SDAR, by utilizing GAN-inspired adversarial regularization to learn a
decodable simulator of client’s private model that produces representations
indistinguishable from the client’s. Empirically, we show that SDAR is
effective in inferring private features of the client in vanilla SL, and both
private features and labels in the U-shaped SL, under challenging settings
where existing passive attacks fail to produce non-trivial results. At last,
we propose and evaluate potential defenses against our attacks and highlight
the need for improving SL to further protect the client’s private data.

Split learning is a promising protocol to enable distributed training and
inference of neural networks on devices with limited computational resources.
There are many open challenges and potential directions regarding its
security. For example, one may rigorously study the privacy guarantee of SL
and theoretically measure the information leakage of the protocol. Also, it
will be an interesting direction to design privacy-preserving mechanisms to
mitigate our proposed attacks and improve the privacy of SL.

## References

  * (1)
  * Abadi et al. (2015) Martín Abadi, Ashish Agarwal, Paul Barham, Eugene Brevdo, Zhifeng Chen, Craig Citro, Greg S. Corrado, Andy Davis, Jeffrey Dean, Matthieu Devin, Sanjay Ghemawat, Ian Goodfellow, Andrew Harp, Geoffrey Irving, Michael Isard, Yangqing Jia, Rafal Jozefowicz, Lukasz Kaiser, Manjunath Kudlur, Josh Levenberg, Dandelion Mané, Rajat Monga, Sherry Moore, Derek Murray, Chris Olah, Mike Schuster, Jonathon Shlens, Benoit Steiner, Ilya Sutskever, Kunal Talwar, Paul Tucker, Vincent Vanhoucke, Vijay Vasudevan, Fernanda Viégas, Oriol Vinyals, Pete Warden, Martin Wattenberg, Martin Wicke, Yuan Yu, and Xiaoqiang Zheng. 2015\.  TensorFlow: Large-Scale Machine Learning on Heterogeneous Systems.  https://www.tensorflow.org/ Software available from tensorflow.org.
  * Abadi et al. (2016) Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. 2016.  Deep learning with differential privacy. In _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_ _(CCS ’16)_. 308–318.
  * Behrmann et al. (2019) Jens Behrmann, Will Grathwohl, Ricky TQ Chen, David Duvenaud, and Jörn-Henrik Jacobsen. 2019\.  Invertible residual networks. In _International conference on machine learning (ICML)_. PMLR, 573–582.
  * Bonawitz et al. (2017) Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017.  Practical secure aggregation for privacy-preserving machine learning. In _Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security_ _(CCS ’17)_. 1175–1191.
  * Ceballos et al. (2020) Iker Ceballos, Vivek Sharma, Eduardo Mugica, Abhishek Singh, Alberto Roman, Praneeth Vepakomma, and Ramesh Raskar. 2020.  SplitNN-driven Vertical Partitioning.  _CoRR_ abs/2008.04137 (2020).
  * Dwork et al. (2014) Cynthia Dwork, Aaron Roth, et al. 2014\.  The algorithmic foundations of differential privacy.  _Foundations and Trends® in Theoretical Computer Science_ 9, 3–4 (2014), 211–407.
  * Erdogan et al. (2022) Ege Erdogan, Alptekin Küpçü, and A Ercument Cicek. 2022\.  Splitguard: Detecting and mitigating training-hijacking attacks in split learning. In _Proceedings of the 21st Workshop on Privacy in the Electronic Society_. 125–137.
  * Erdoğan et al. (2022) Ege Erdoğan, Alptekin Küpçü, and A Ercüment Çiçek. 2022\.  Unsplit: Data-oblivious model inversion, model stealing, and label inference attacks against split learning. In _Proceedings of the 21st Workshop on Privacy in the Electronic Society_. 115–124.
  * Fredrikson et al. (2015) Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. 2015\.  Model inversion attacks that exploit confidence information and basic countermeasures. In _Proceedings of the 22nd ACM SIGSAC conference on computer and communications security_ _(CCS ’15)_. 1322–1333.
  * Fredrikson et al. (2014) Matthew Fredrikson, Eric Lantz, Somesh Jha, Simon Lin, David Page, and Thomas Ristenpart. 2014\.  Privacy in pharmacogenetics: An End-to-End case study of personalized warfarin dosing. In _23rd USENIX security symposium (USENIX Security 14)_. 17–32.
  * Fu et al. (2023) Jiayun Fu, Xiaojing Ma, Bin B. Zhu, Pingyi Hu, Ruixin Zhao, Yaru Jia, Peng Xu, Hai Jin, and Dongmei Zhang. 2023.  Focusing on Pinocchio’s Nose: A Gradients Scrutinizer to Thwart Split-Learning Hijacking Attacks Using Intrinsic Attributes. In _30th Annual Network and Distributed System Security Symposium, NDSS 2023_.
  * Gao and Zhang (2023) Xinben Gao and Lan Zhang. 2023.  PCAT: Functionality and Data Stealing from Split Learning by Pseudo-Client Attack. In _32nd USENIX Security Symposium (USENIX Security 23)_. 5271–5288.
  * Gao et al. (2020) Yansong Gao, Minki Kim, Sharif Abuadbba, Yeonjae Kim, Chandra Thapa, Kyuyeon Kim, Seyit A Camtep, Hyoungshick Kim, and Surya Nepal. 2020.  End-to-End Evaluation of Federated Learning and Split Learning for Internet of Things. In _2020 International Symposium on Reliable Distributed Systems (SRDS)_. IEEE, 91–100.
  * Goodfellow et al. (2014) Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014\.  Generative adversarial nets.  _Advances in neural information processing systems_ 27 (2014).
  * Goodfellow et al. (2020) Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2020\.  Generative adversarial networks.  _Commun. ACM_ 63, 11 (2020), 139–144.
  * Gulrajani et al. (2017) Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. 2017\.  Improved training of wasserstein gans.  _Advances in neural information processing systems_ 30 (2017).
  * Gupta and Raskar (2018) Otkrist Gupta and Ramesh Raskar. 2018.  Distributed learning of deep neural network over multiple agents.  _Journal of Network and Computer Applications_ 116 (2018), 1–8.
  * Ha et al. (2022) Yoo Jeong Ha, Gusang Lee, Minjae Yoo, Soyi Jung, Seehwan Yoo, and Joongheon Kim. 2022\.  Feasibility study of multi-site split learning for privacy-preserving medical systems under data imbalance constraints in COVID-19, X-ray, and cholesterol dataset.  _Scientific Reports_ 12, 1 (2022), 1–11.
  * Hall (2020) Adam J Hall. 2020\.  _Implementing split neural networks on PySyft_.  https://blog.openmined.org/split-neural-networks-on-pysyft/
  * He et al. (2016) Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016\.  Deep residual learning for image recognition. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 770–778.
  * He et al. (2019) Zecheng He, Tianwei Zhang, and Ruby B Lee. 2019.  Model inversion attacks against collaborative inference. In _Proceedings of the 35th Annual Computer Security Applications Conference_. 148–162.
  * Hinton and Salakhutdinov (2006) Geoffrey E Hinton and Ruslan R Salakhutdinov. 2006.  Reducing the dimensionality of data with neural networks.  _science_ 313, 5786 (2006), 504–507.
  * Ioffe and Szegedy (2015) Sergey Ioffe and Christian Szegedy. 2015.  Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift. In _Proceedings of the 32nd International Conference on Machine Learning (ICML)_ _(Proceedings of Machine Learning Research, Vol. 37)_. 448–456.
  * Kairouz et al. (2021) Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. 2021\.  Advances and open problems in federated learning.  _Foundations and Trends® in Machine Learning_ 14, 1–2 (2021), 1–210.
  * Keller (2020) Marcel Keller. 2020\.  MP-SPDZ: A Versatile Framework for Multi-Party Computation. In _Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security_ _(CCS ’20)_.
  * Kingma and Ba (2015) Diederik P. Kingma and Jimmy Ba. 2015.  Adam: A Method for Stochastic Optimization. In _3rd International Conference on Learning Representations, ICLR 2015_ , Yoshua Bengio and Yann LeCun (Eds.).
  * Krizhevsky et al. (2009) Alex Krizhevsky, Geoffrey Hinton, et al. 2009\.  Learning multiple layers of features from tiny images.  (2009).
  * LeCun et al. (2010) Yann LeCun, Corinna Cortes, and CJ Burges. 2010.  MNIST handwritten digit database.  _ATT Labs [Online]. Available: http://yann.lecun.com/exdb/mnist_ 2 (2010).
  * Li et al. (2022) Oscar Li, Jiankai Sun, Xin Yang, Weihao Gao, Hongyi Zhang, Junyuan Xie, Virginia Smith, and Chong Wang. 2022\.  Label Leakage and Protection in Two-party Split Learning. In _The Tenth International Conference on Learning Representations, ICLR_.
  * Liu et al. (2021) Bingyan Liu, Yao Guo, and Xiangqun Chen. 2021.  PFA: Privacy-preserving federated adaptation for effective model personalization. In _Proceedings of the Web Conference 2021_ _(WWW ’21)_. 923–934.
  * Liu and Lyu (2023) Junlin Liu and Xinchen Lyu. 2023.  Clustering label inference attack against practical split learning.  _CoRR_ abs/2203.05222 (2023).
  * Luo et al. (2021) Xinjian Luo, Yuncheng Wu, Xiaokui Xiao, and Beng Chin Ooi. 2021\.  Feature inference attack on model predictions in vertical federated learning. In _2021 IEEE 37th International Conference on Data Engineering (ICDE)_. IEEE, 181–192.
  * McMahan et al. (2017) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017\.  Communication-efficient learning of deep networks from decentralized data. In _Artificial intelligence and statistics_. PMLR, 1273–1282.
  * Mirza and Osindero (2014) Mehdi Mirza and Simon Osindero. 2014.  Conditional Generative Adversarial Nets.  _CoRR_ abs/1411.1784 (2014).
  * Nair and Hinton (2010) Vinod Nair and Geoffrey E Hinton. 2010.  Rectified linear units improve restricted boltzmann machines. In _Proceedings of the 27th international conference on machine learning (ICML-10)_. 807–814.
  * Nasr et al. (2019) Milad Nasr, Reza Shokri, and Amir Houmansadr. 2019.  Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In _2019 IEEE symposium on security and privacy (SP)_. IEEE, 739–753.
  * Ng (2004) Andrew Y Ng. 2004\.  Feature selection, L1 vs. L2 regularization, and rotational invariance. In _Proceedings of the Twenty-first International Conference on Machine Learning_. 78\.
  * Odena et al. (2016) Augustus Odena, Vincent Dumoulin, and Chris Olah. 2016\.  Deconvolution and checkerboard artifacts.  _Distill_ 1, 10 (2016), e3.
  * Oh et al. (2022) Seungeun Oh, Jihong Park, Praneeth Vepakomma, Sihun Baek, Ramesh Raskar, Mehdi Bennis, and Seong-Lyun Kim. 2022.  LocFedMix-SL: Localize, Federate, and Mix for Improved Scalability, Convergence, and Latency in Split Learning. In _Proceedings of the ACM Web Conference 2022_ _(WWW ’22)_. 3347–3357.
  * OpenMinded (2021) OpenMinded. 2021\.  PySyft.  https://github.com/OpenMined/PySyft
  * Pasquini et al. (2021) Dario Pasquini, Giuseppe Ateniese, and Massimo Bernaschi. 2021\.  Unleashing the tiger: Inference attacks on split learning. In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_ _(CCS ’21)_. 2113–2129.
  * Poirot et al. (2019) Maarten G Poirot, Praneeth Vepakomma, Ken Chang, Jayashree Kalpathy-Cramer, Rajiv Gupta, and Ramesh Raskar. 2019.  Split learning for collaborative deep learning in healthcare.  _CoRR_ abs/1912.12115 (2019).
  * Qiu et al. (2023) Xinchi Qiu, Ilias Leontiadis, Luca Melis, Alex Sablayrolles, and Pierre Stock. 2023\.  EXACT: Extensive Attack for Split Learning.  _CoRR_ abs/2305.12997 (2023).
  * Shokri et al. (2017) Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. 2017.  Membership inference attacks against machine learning models. In _2017 IEEE symposium on security and privacy (SP)_. IEEE, 3–18.
  * Singh et al. (2019) Abhishek Singh, Praneeth Vepakomma, Otkrist Gupta, and Ramesh Raskar. 2019.  Detailed comparison of communication efficiency of split learning and federated learning.  _CoRR_ abs/1909.09145 (2019).
  * Srivastava et al. (2014) Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. 2014.  Dropout: a simple way to prevent neural networks from overfitting.  _The journal of machine learning research_ 15, 1 (2014), 1929–1958.
  * Székely et al. (2007) Gábor J Székely, Maria L Rizzo, and Nail K Bakirov. 2007\.  Measuring and testing dependence by correlation of distances.  _The Annals of Statistics_ 35, 6 (2007), 2769\.
  * Takabi et al. (2016) Hassan Takabi, Ehsan Hesamifard, and Mehdi Ghasemi. 2016\.  Privacy preserving multi-party machine learning with homomorphic encryption. In _29th Annual Conference on Neural Information Processing Systems (NIPS)_.
  * Thapa et al. (2021) Chandra Thapa, Mahawaga Arachchige Pathum Chamikara, and Seyit A Camtepe. 2021\.  Advancements of federated learning towards privacy preservation: from federated learning to split learning.  _Federated Learning Systems: Towards Next-Generation AI_ (2021), 79–109.
  * Vepakomma et al. (2018) Praneeth Vepakomma, Otkrist Gupta, Tristan Swedish, and Ramesh Raskar. 2018.  Split learning for health: Distributed deep learning without sharing raw patient data.  _CoRR_ abs/1812.00564 (2018).
  * Vepakomma et al. (2020) Praneeth Vepakomma, Abhishek Singh, Otkrist Gupta, and Ramesh Raskar. 2020.  NoPeek: Information leakage reduction to share activations in distributed deep learning. In _2020 International Conference on Data Mining Workshops (ICDMW)_. IEEE, 933–942.
  * Vepakomma et al. (2021) Praneeth Vepakomma, Abhishek Singh, Emily Zhang, Otkrist Gupta, and Ramesh Raskar. 2021\.  NoPeek-Infer: Preventing face reconstruction attacks in distributed inference after on-premise training. In _2021 16th IEEE International Conference on Automatic Face and Gesture Recognition (FG 2021)_. IEEE, 1–8.
  * Wood et al. (2020) Alexander Wood, Kayvan Najarian, and Delaram Kahrobaei. 2020\.  Homomorphic encryption for machine learning in medicine and bioinformatics.  _ACM Computing Surveys (CSUR)_ 53, 4 (2020), 1–35.
  * Wu et al. (2020) Yuncheng Wu, Shaofeng Cai, Xiaokui Xiao, Gang Chen, and Beng Chin Ooi. 2020.  Privacy preserving vertical federated learning for tree-based models.  _Proceedings of the VLDB Endowment_ 13, 12 (Jul 2020), 2090–2103.
  * Xiao et al. (2017) Han Xiao, Kashif Rasul, and Roland Vollgraf. 2017.  Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms.  _CoRR_ abs/1708.07747 (2017).
  * Xiao et al. (2010) Xiaokui Xiao, Guozhang Wang, and Johannes Gehrke. 2010\.  Differential privacy via wavelet transforms.  _IEEE Transactions on knowledge and data engineering_ 23, 8 (2010), 1200–1214.
  * Yang et al. (2021) Chengxu Yang, Qipeng Wang, Mengwei Xu, Zhenpeng Chen, Kaigui Bian, Yunxin Liu, and Xuanzhe Liu. 2021.  Characterizing impacts of heterogeneity in federated learning upon large-scale smartphone data. In _Proceedings of the Web Conference 2021_ _(WWW ’21)_. 935–946.
  * Yao (1982) Andrew C. Yao. 1982\.  Protocols for secure computations. In _23rd Annual Symposium on Foundations of Computer Science (FOCS 1982)_. 160–164.
  * Yin et al. (2021) Xuefei Yin, Yanming Zhu, and Jiankun Hu. 2021.  A comprehensive survey of privacy-preserving federated learning: A taxonomy, review, and future directions.  _ACM Computing Surveys (CSUR)_ 54, 6 (2021), 1–36.
  * Yin et al. (2023) Yupeng Yin, Xianglong Zhang, Huanle Zhang, Feng Li, Yue Yu, Xiuzhen Cheng, and Pengfei Hu. 2023.  Ginver: Generative Model Inversion Attacks Against Collaborative Inference. In _Proceedings of the ACM Web Conference 2023_ _(WWW ’23)_. 2122–2131.
  * Yosinski et al. (2014) Jason Yosinski, Jeff Clune, Yoshua Bengio, and Hod Lipson. 2014\.  How transferable are features in deep neural networks?  _Advances in neural information processing systems_ 27 (2014).
  * Zhao et al. (2021) Xuejun Zhao, Wencan Zhang, Xiaokui Xiao, and Brian Lim. 2021\.  Exploiting explanations for model inversion attacks. In _2021 IEEE/CVF International Conference on Computer Vision (ICCV)_. 682–692.

##  Appendix A Pseudocode

We provide the pseudocode for SDAR proposed in Section 4 in Algorithm 1 for
the vanilla SL setting and Algorithm 2 for the U-shaped SL setting.

Algorithm 1 SDAR against vanilla split learning

1:$\ell(\cdot,\cdot)$ is the loss function of the original SL task; $s$ is the
split level; $\eta$ is the learning rate of the original SL task;
$\eta_{\tilde{f}},\eta_{\tilde{f}^{-1}},\eta_{d_{1}},\eta_{d_{2}}$ are
learning rates for the server’s models $\tilde{f},\tilde{f}^{-1},d_{1},d_{2}$
respectively.

2:procedure Client:

3: Initializes model $f$ with parameters $\theta_{f}$

4: for $i\in\\{1,2,\ldots\\}$ do

5: Samples a batch of examples $(X,Y)\in D$

6: $Z_{s}\leftarrow f(X)$

7: Sends $(Z_{s},Y)$ to the server $\triangleright$ Timestamp $t_{i1}$

8: Receives $\nabla\theta_{s+1}$ from the server $\triangleright$ Timestamp
$t_{i2}$

9: Calculates $\nabla\theta_{f}$ using $\nabla\theta_{s+1}$

10: $\theta_{f}\leftarrow\theta_{f}-\eta\nabla\theta_{f}$$\triangleright$
Original SL task

11: end for

12:end procedure

13:

14:procedure Server:

15: Initializes model $g$ with parameters $\theta_{g}$

16: Initializes models $\tilde{f},\tilde{f}^{-1},d_{1},d_{2}$ with parameters
$\theta_{\tilde{f}},\theta_{\tilde{f}^{-1}},\theta_{d_{1}},\theta_{d_{2}}$

17: for $i\in\\{1,2,\ldots\\}$ do

18: Receives $(Z_{s},Y)$ from the client $\triangleright$ Timestamp $t_{i1}$

19: $\mathcal{L}=\ell(g(Z_{s}),Y)$

20: $\nabla\theta_{g}\leftarrow\partial\mathcal{L}/\partial\theta_{g}$

21: Sends $\nabla\theta_{s+1}$ to the client $\triangleright$ Timestamp
$t_{i2}$

22: $\theta_{g}\leftarrow\theta_{g}-\eta\nabla\theta_{g}$$\triangleright$
Original SL task

23:

24: Samples a batch of examples $(X^{\prime},Y^{\prime})\in D^{\prime}$

25:
$\mathcal{L}_{\tilde{f}}\leftarrow\ell(g(\tilde{f}(X^{\prime})),Y^{\prime})+\lambda_{1}\cdot\ell_{\text{BCE}}(d_{1}(\tilde{f}(X^{\prime})),1)$

26:
$\mathcal{L}_{d_{1}}\leftarrow\ell_{\text{BCE}}(d_{1}(\tilde{f}(X^{\prime})),0)+\ell_{\text{BCE}}(d_{1}(Z_{s}),1)$

27:
$\mathcal{L}_{\tilde{f}^{-1}}\leftarrow\ell_{\text{MSE}}(X^{\prime},\tilde{f}^{-1}(\tilde{f}(X^{\prime})))+\lambda_{2}\cdot\ell_{\text{BCE}}(d_{2}(\tilde{f}^{-1}(Z_{s})),1)$

28:
$\mathcal{L}_{d_{2}}\leftarrow\ell_{\text{BCE}}(d_{2}(\tilde{f}^{-1}(Z_{s})),0)+\ell_{\text{BCE}}(d_{2}(X^{\prime}),1)$

29:

30:
$\nabla\theta_{\tilde{f}}\leftarrow\partial\mathcal{L}_{\tilde{f}}/\partial\theta_{\tilde{f}}$

31:
$\nabla\theta_{d_{1}}\leftarrow\partial\mathcal{L}_{d_{1}}/\partial\theta_{d_{1}}$

32:
$\nabla\theta_{\tilde{f}^{-1}}\leftarrow\partial\mathcal{L}_{\tilde{f}^{-1}}/\partial\theta_{\tilde{f}^{-1}}$

33:
$\nabla\theta_{d_{2}}\leftarrow\partial\mathcal{L}_{d_{2}}/\partial\theta_{d_{2}}$

34:

35:
$\theta_{\tilde{f}}\leftarrow\theta_{\tilde{f}}-\eta_{\tilde{f}}\nabla\theta_{\tilde{f}}$

36: $\theta_{d_{1}}\leftarrow\theta_{d_{1}}-\eta_{d_{1}}\nabla\theta_{d_{1}}$

37:
$\theta_{\tilde{f}^{-1}}\leftarrow\theta_{\tilde{f}^{-1}}-\eta_{\tilde{f}^{-1}}\nabla\theta_{\tilde{f}^{-1}}$

38: $\theta_{d_{2}}\leftarrow\theta_{d_{2}}-\eta_{d_{2}}\nabla\theta_{d_{2}}$

39:

40: $\hat{X}\leftarrow\tilde{f}^{-1}(X_{s})$$\triangleright$ Reconstructed
private features

41: end for

42:end procedure

Algorithm 2 Simulator decoding attack with adversarial regularization (SDAR)
against U-shaped split learning

1:$\ell(\cdot,\cdot)$ is the loss function of the original SL task; $s,t$ are
the split levels; $\eta$ is the learning rate of the original SL task;
$\eta_{\tilde{h}},\eta_{\tilde{f}},\eta_{\tilde{f}^{-1}},\eta_{d_{1}},\eta_{d_{2}}$
are learning rates for the server’s models
$\tilde{h},\tilde{f},\tilde{f}^{-1},d_{1},d_{2}$ respectively. $p$ is the
label flipping probability. $\mathcal{Y}$ is the set of all possible labels.

2:procedure Client:

3: Initializes models $f,h$ with parameters $\theta_{f},\theta_{h}$

4: for $i\in\\{1,2,\ldots\\}$ do

5: Samples a batch of examples $(X,Y)\in D$

6: $Z_{s}\leftarrow f(X)$

7: Sends $Z_{s}$ to the server $\triangleright$ Timestamp $t_{i1}$

8: Receives $Z_{t}$ from the server $\triangleright$ Timestamp $t_{i2}$

9: $\mathcal{L}\leftarrow\ell(h(Z_{t}),Y)$

10: $\nabla\theta_{h}\leftarrow\partial\mathcal{L}/\partial\theta_{h}$

11: $\theta_{h}\leftarrow\theta_{h}-\eta\nabla\theta_{h}$ $\triangleright$
Original SL task

12: Sends $\nabla\theta_{t+1}$ to the server $\triangleright$ Timestamp
$t_{i3}$

13: Receives $\nabla\theta_{s+1}$ from the server $\triangleright$ Timestamp
$t_{i4}$

14: Calculates $\nabla\theta_{f}$ using $\nabla\theta_{s+1}$

15: $\theta_{f}\leftarrow\theta_{f}-\eta\nabla\theta_{f}$$\triangleright$
Original SL task

16: end for

17:end procedure

18:

19:procedure Server:

20: Initializes model $g$ with parameters $\theta_{g}$

21: Initializes models $\tilde{h}$, $\tilde{f}$, $\tilde{f}^{-1}$, $d_{1}$,
$d_{2}$ with parameters $\theta_{\tilde{h}}$, $\theta_{\tilde{f}}$,
$\theta_{\tilde{f}^{-1}}$, $\theta_{d_{1}}$, $\theta_{d_{2}}$

22: for $i\in\\{1,2,\ldots\\}$ do

23: Receives $(Z_{s},Y)$ from the client $\triangleright$ Timestamp $t_{i1}$

24: $Z_{t}=g(Z_{s})$

25: Sends $Z_{t}$ to the client $\triangleright$ Timestamp $t_{i2}$

26: Receives $\nabla\theta_{t+1}$ from the client $\triangleright$ Timestamp
$t_{i3}$

27: Calculates $\nabla\theta_{g}$ using $\nabla\theta_{t+1}$

28: $\theta_{g}\leftarrow\theta_{g}-\eta\nabla\theta_{g}$ $\triangleright$
Original SL task

29: Sends $\nabla\theta_{s+1}$ to the client $\triangleright$ Timestamp
$t_{i4}$

30:

31: Samples a batch of examples $(X^{\prime},Y^{\prime})\in D^{\prime}$

32: $\tilde{Y}_{i}^{\prime}\leftarrow\begin{cases}Y_{i}^{\prime}&\text{w.p.
}1-p\\\ \text{Uniform}(\mathcal{Y})&\text{w.p. }p\end{cases}$$\triangleright$
Label random flipping

33:
$\mathcal{L}_{\tilde{h}}\leftarrow\ell(\tilde{h}(g(\tilde{f}(X^{\prime}))),\tilde{Y}^{\prime})$

34:
$\mathcal{L}_{\tilde{f}}\leftarrow\ell(\tilde{h}(g(\tilde{f}(X^{\prime}))),\tilde{Y}^{\prime})+\lambda_{1}\cdot\ell_{\text{BCE}}(d_{1}(\tilde{f}(X^{\prime})),1)$

35:
$\mathcal{L}_{d_{1}}\leftarrow\ell_{\text{BCE}}(d_{1}(\tilde{f}(X^{\prime})),0)+\ell_{\text{BCE}}(d_{1}(Z_{s}),1)$

36:
$\mathcal{L}_{\tilde{f}^{-1}}\leftarrow\ell_{\text{MSE}}(X^{\prime},\tilde{f}^{-1}(\tilde{f}(X^{\prime})))+\lambda_{2}\cdot\ell_{\text{BCE}}(d_{2}(\tilde{f}^{-1}(Z_{s})),1)$

37:
$\mathcal{L}_{d_{2}}\leftarrow\ell_{\text{BCE}}(d_{2}(\tilde{f}^{-1}(Z_{s})),0)+\ell_{\text{BCE}}(d_{2}(X^{\prime}),1)$

38:

39:
$\nabla\theta_{\tilde{h}}\leftarrow\partial\mathcal{L}_{\tilde{h}}/\partial\theta_{\tilde{h}}$

40:
$\nabla\theta_{\tilde{f}}\leftarrow\partial\mathcal{L}_{\tilde{f}}/\partial\theta_{\tilde{f}}$

41:
$\nabla\theta_{d_{1}}\leftarrow\partial\mathcal{L}_{d_{1}}/\partial\theta_{d_{1}}$

42:
$\nabla\theta_{\tilde{f}^{-1}}\leftarrow\partial\mathcal{L}_{\tilde{f}^{-1}}/\partial\theta_{\tilde{f}^{-1}}$

43:
$\nabla\theta_{d_{2}}\leftarrow\partial\mathcal{L}_{d_{2}}/\partial\theta_{d_{2}}$

44:

45:
$\theta_{\tilde{h}}\leftarrow\theta_{\tilde{h}}-\eta_{\tilde{h}}\nabla\theta_{\tilde{h}}$

46:
$\theta_{\tilde{f}}\leftarrow\theta_{\tilde{f}}-\eta_{\tilde{f}}\nabla\theta_{\tilde{f}}$

47: $\theta_{d_{1}}\leftarrow\theta_{d_{1}}-\eta_{d_{1}}\nabla\theta_{d_{1}}$

48:
$\theta_{\tilde{f}^{-1}}\leftarrow\theta_{\tilde{f}^{-1}}-\eta_{\tilde{f}^{-1}}\nabla\theta_{\tilde{f}^{-1}}$

49: $\theta_{d_{2}}\leftarrow\theta_{d_{2}}-\eta_{d_{2}}\nabla\theta_{d_{2}}$

50:

51: $\hat{X}\leftarrow\tilde{f}^{-1}(X_{s})$$\triangleright$ Reconstructed
private features

52: $\hat{Y}\leftarrow\tilde{h}(g(X_{s}))$$\triangleright$ Inferred private
labels

53: end for

54:end procedure

##  Appendix B Additional discussions on experiments

###  B.1. Implementation details

####  B.1.1. Experiment setup

The experiments are conducted on machines running Ubuntu 20.04 LTS, equipped
with two Intel® Xeon® Gold 6326 CPUs, 256GB of RAM and an NVIDIA® A100 80GB
GPU. We implement our attack and other baselines in Python and TensorFlow
(Abadi et al., 2015). Our code base is available at
https://anonymous.4open.science/r/SDAR_SplitNN/ for reproducibility.

####  B.1.2. Split learning setup

We target the same SL setup across all experiments, where the complete model
$H$ is ResNet-20 and we experiment with various split configurations of the
model. For all experiments, we use Adam optimizer (Kingma and Ba, 2015) to
optimize $H$ (that is, $g\circ f$ in vanilla SL and $h\circ g\circ f$ in
U-shaped SL) with default initial learning rate $\eta=0.001$. We use 128
examples per batch as per the original ResNet paper suggests (He et al.,
2016). We train the model $H$ with split learning protocol for 10000
iterations (i.e., batches) on MNIST and Fashion-MNIST, and 20000 iterations on
CIFAR-10 and CIFAR-100. For all attacks, on all datasets, at all considered
split levels and under both vanilla and U-shaped settings, we run five trials
for statistical significance.

####  B.1.3. Implementation details of SDAR

##### Models

Due to our threat model where the server knows the model architecture of
$H=g\circ f$, the server uses the same model architecture for its simulator
$\tilde{f}$ as the client’s model $f$, but with random initialization.
Server’s decoder $\tilde{f}^{-1}$ is a deep convolutional network, where each
residual block of $\tilde{f}$ corresponds to a deconvolution block
(deconvolutional layer, followed by batch normalization and ReLU) in reverse
order. Note that we replace deconvolutional layers with strides 2 with a
combination of an upsampling layer and a convolutional layer, to reduce the
checkerboard effects (Odena et al., 2016). For MNIST dataset, we use a
shallower network architecture, which skips the non-upsampling deconvolutional
blocks. For the discriminator $d_{1}$ which distinguishes intermediate
representations, we use a deep convolutional network with up to 256 filters,
where each convolutional layer is followed by LeakyReLU and batch
normalization except the last layer. The discriminator $d_{2}$ that
distinguishes real and fake $32\times 32\times 3$ images follows a rather
standard architecture, consists of convolutional layers, batch normalization
and LeakyReLU. In the vanilla setting where labels are used as part of the
input to the decoder and discriminators, we first transform the labels into
embeddings of 50 units, and then further transform the embeddings by a
learnable fully connected layer, before concatenating with the input to the
decoder and discriminators. Details of the model architectures can be found in
src/models/attacker_models.py of our code base.

##### Hyperparameters

All models are optimized with the Adam optimizer. As a simulator to $f$, we
choose the learning rate of $\tilde{f}$ the same as $f$, and we always keep
the learning rate of the decoder half of that of the simulator, i.e.,
$2\eta_{\tilde{f}^{-1}}=\eta_{\tilde{f}}=\eta$ for all cases. We choose
smaller learning rates for the discriminators $d_{1},d_{2}$ as this is the
standard practice in GAN training. We choose the adversarial regularization
factors $\lambda_{1},\lambda_{2}$ such that
$\lambda_{1}\eta_{\tilde{f}}=\eta_{d_{1}}$ and
$\lambda_{2}\eta_{\tilde{f}}=\eta_{d_{2}}$, to ensure that the step size to
minimize generator loss (as a regularization term) is on par with that of the
discriminator loss. We use the same configuration for all experiments in
vanilla SL across all datasets, while different configurations are chosen for
different datasets in U-shaped SL. In particular, the hyperparameters used in
the experiments are shown in the following table.

Setting | Dataset | $\lambda_{1}$ | $\lambda_{2}$ | $\eta_{h}$ | $p$
---|---|---|---|---|---
Vanilla | All datasets | 0.02 | 0.00002 | NA | NA
U Shaped | MNIST | 0.04 | 0.00001 | 0.001 | 0.1
U Shaped | Fashion-MNIST | 0.04 | 0.0001 | 0.001 | 0.4
U Shaped | CIFAR-100 | 0.04 | 0.00001 | 0.001 | 0.2
U Shaped | CIFAR-10 | 0.04 | 0.00001 | 0.001 | 0.2

####  B.1.4. Implementation details of baseline methods

##### PCAT

We implement PCAT (Gao and Zhang, 2023) with the exact same model
architectures for simulator and decoder as SDAR for a fair comparison. We also
give the server in PCAT the same auxiliary dataset as SDAR. Compared to naïve
SDA, PCAT uses two unique techniques to improve its performance. First, in
vanilla SL where the server knows the labels of the private examples, PCAT
aligns these labels by sampling auxiliary examples with the same labels as the
received private examples. Second, in both vanilla and U-shaped SL, PCAT
introduces a delay in attacking, where the server does not train its simulator
and decoder until a certain number of iterations have been executed, to avoid
the noisy early-stage training process disturbing the attacks. We implement
both techniques, and choose a delay period of 100 iterations, as used in the
original paper (Gao and Zhang, 2023).

##### UnSplit

UnSplit (Erdoğan et al., 2022) infers the private features $X$ by minimizing
$\ell_{\text{MSE}}(\tilde{f}(\hat{X}),Z_{s})$ via alternating optimization of
$\tilde{f}$ and $\hat{X}$, where $\tilde{f}$ is a surrogate model of the same
architecture as $f$ but randomly initialized, and $\hat{X}$ is initialized as
tensors filled with 0.5. We follow the implementation of the original paper
(Erdoğan et al., 2022) and use the same configuration for the alternating
optimization algorithm. We use Adam optimizer with learning rate of 0.001 for
both $\tilde{f}$ and $\hat{X}$. The alternating optimization process consists
of 1000 rounds, each having 100 $\tilde{f}$ optimization steps and 100
$\hat{X}$ optimization steps. Following (Erdoğan et al., 2022), total
variation is used to regularize the optimization of $\hat{X}$. In each
training iteration of SL, UnSplit is able to infer the private training
examples $X$ by running the iterative alternating optimization procedure.
However, due to the extremely high computational cost of the iterative
optimization process, we are unable to run the optimization algorithm for
every training iteration, but only attack the last batch of training examples
and present the results in the paper.

##### FSHA

We implement FSHA (Pasquini et al., 2021) with the same model architectures
for the encoder, decoder and discriminator as SDAR for a fair comparison. In
FSHA, the client’s model $f$ is hijacked by the server to be updated to
simulate the behaviors of the server’s own encoder $\tilde{f}$. Following the
original paper, we use learning rate 0.00001 for the training of $f$ as a
generator and use learning rate 0.0005 for the discriminators, using
Wasserstein GAN loss with gradient penalty coefficient of 500 (Gulrajani et
al., 2017). The encoder and decoder are trained in an autoencoder fashion
(Hinton and Salakhutdinov, 2006) with learning rate 0.00001.

###  B.2. Additional experimental results

In Sec. 5, we only present experimental results on a single dataset due to
limited space. We hereby provide the full results of our experiments on all
four datasets as well as some additional experiments and discussions. We list
all extended tables and figures and their corresponding versions in the main
text in the following table. In addition, we also report the attack MSE (and
label inference accuracy for U-shaped SL) of SDAR over training iterations
across all split configurations on all datasets in Fig. 11 and 15 for vanilla
and U-shaped SL respectively.

Figure/table in main text | Extended figure/table
---|---
Table 2 |  Table 9
Fig. 3a |  Fig. 12
Fig. 4 |  Fig. 13
Table 3 |  Table 10
Fig. 6(b) |  Fig. 14
Table 5 |  Table 11 and 12
Fig. 7a |  Table 16

##  Appendix C Additional potential defenses

##### Homomorphic encryption

One of the most straightforward ideas to mitigate privacy issues in SL is to
encrypt the intermediate representations $Z_{s}$ and send only the ciphertext
to the server such that the server cannot use it to infer private features.
This usually requires homomorphic encryption (HE) (Takabi et al., 2016; Wood
et al., 2020) where the server can only perform computation on the ciphertext
without decrypting it and return the ciphertext of the result to the client.
In the context of SL, this means that the server must execute forward pass,
loss evaluation, and backward propagation all in ciphertext, and at last sends
the gradients $\nabla\theta_{s+1}$ in ciphertext back to the client. However,
current HE schemes usually only support homomorphic arithmetic operations such
as addition and multiplication, and it is computationally prohibitive to
execute the forward pass and backward propagation in ciphertext, which
typically involves non-linear operations and necessitates the use of
approximation techniques (Takabi et al., 2016). Therefore, homomorphic
encryption can hardly be applicable to SL, especially for deep neural network
models.

##### Secure multi-party computation

Another widely-used cryptographic technique to protect privacy is secure
multi-party computation (MPC) (Wu et al., 2020; Yao, 1982; Bonawitz et al.,
2017; Keller, 2020), where multiple parties jointly compute a function on
their private inputs without revealing their inputs to each other. To the best
of our knowledge, there has been no prior work improving the privacy of SL
using MPC. Even if it is possible to apply MPC such that the client and the
server can train their models without revealing private data of the client or
model parameters of both parties, such protocol will introduce significant
computational overhead and communication cost, completely defeating the
purpose and promises of split learning.

##### Differential privacy

Currently, the state-of-the-art technique to quantify and reduce information
disclosure about individuals is differential privacy (DP) (Xiao et al., 2010;
Abadi et al., 2016; Dwork et al., 2014), which mathematically bounds the
influence of private data on the released information. In the context of SL,
this would mean that the intermediate representations $Z_{s}$ are
differentially private with regard to the client’s private features $X$. If we
are to achieve DP in split learning, random noise will be injected by the
client, such that even if the client arbitrarily modifies the input data $X$,
the intermediate representations $Z_{s}$ will remain almost unchanged. That
is, client’s model $f$ will output similar representations for any input data,
which practically renders the model trivial. Therefore, DP is not applicable
to our problem.

##  Appendix D Additional related work

##### Split learning

Split learning (SL) (Poirot et al., 2019; Gupta and Raskar, 2018; Vepakomma et
al., 2018) is a privacy preserving protocol for distributed training and
inference of deep neural networks, and has gain increasing attention due to
its simplicity, efficiency and scalability (Kairouz et al., 2021; Thapa et
al., 2021; Yin et al., 2021; Singh et al., 2019). Since its proposal, many
works have extended SL to various configurations, including U-shaped SL that
protects the client’s labels (Gupta and Raskar, 2018), SL with multiple
clients with horizontal (Vepakomma et al., 2018) or vertical (Ceballos et al.,
2020) partition. We refer the audience to Sec. 2 and available surveys
(Kairouz et al., 2021; Thapa et al., 2021; Yin et al., 2021; Singh et al.,
2019) for more details on split learning.

##### Inference attacks against split learning

The security of SL has been a focus of the research community since the
proposal of SL. Various privacy attacks have been proposed to infer clients’
labels or features under different threat models. Pasquini et al. (2021)
propose FSHA, an active feature inference attack where the server hijacks the
gradients sent back to the client to control the updates of client’s private
model. Erdoğan et al. (2022) design passive feature and label inference
attacks via alternating optimization of a surrogate model and inferred private
inputs. Qiu et al. (2023) also consider passive feature and label inference
attacks, but with the extremely strong assumption that the server knows the
model parameters of the victim clients, thus can utilize the excessive
information on client’s model parameters and gradients. Concurrently with our
work, Gao and Zhang (2023) propose a passive feature and label inference
attack against SL, namely PCAT, which adopts a similar framework as our naïve
SDA discussed in the beginning of Sec. 4.1, with minor improvements such as
label alignment and delayed training. On a separate line of research, several
works (Li et al., 2022; Liu and Lyu, 2023) focus solely on label inference
attacks. This is not the focus of our work as we aim to develop effective
attacks that can infer both the clients’ labels and features. At last, several
attacks (He et al., 2019; Yin et al., 2023) have been proposed against split
inference, often known as collaborative inference. However, split inference is
more vulnerable as the intermediate representations are products of a fixed
client’s model, while in training-time SL attacks, the server has to invert
the output of a constantly updated client’s model. Therefore, attacks against
split inference are not our focus in this work.

##### Privacy-preserving improvements of split learning

In response to the privacy vulnerabilities of SL, various privacy-preserving
improvements have been proposed. U-shaped SL (Gupta and Raskar, 2018) enhances
privacy by preventing label exposure to the server, although our work
demonstrates that SDAR can still infer private labels with high accuracy.
Targeting active hijacking attacks such as FSHA (Pasquini et al., 2021),
Erdogan et al. (2022); Fu et al. (2023) detect and defend against the active
manipulation of back-propagated gradients. Vepakomma et al. (2020, 2021)
propose to improve the privacy of SL by minimizing the correlation between the
private inputs and the shared representations via injecting a correlation
regularization term to the loss function of the original SL task, which we
investigate in Sec. 6.

Table 9. Mean and standard deviation of feature inference attack MSE on all datasets at split levels 3–7 in vanilla SL. Dataset | Method | Split Level
---|---|---
3 | 4 | 5 | 6 | 7
MNIST | SDAR | 0.0024 (0.0004) | 0.0028 (0.0003) | 0.0036 (0.0006) | 0.0041 (0.0005) | 0.0086 (0.0010)
PCAT | 0.0255 (0.0050) | 0.0236 (0.0048) | 0.0350 (0.0107) | 0.0389 (0.0131) | 0.0575 (0.0046)
UnSplit | 0.1876 (0.0109) | 0.2076 (0.0059) | 0.2140 (0.0028) | 0.2166 (0.0022) | 0.2168 (0.0020)
Fashion-MNIST | SDAR | 0.0033 (0.0008) | 0.0062 (0.0008) | 0.0102 (0.0011) | 0.0113 (0.0016) | 0.0178 (0.0012)
PCAT | 0.0286 (0.0067) | 0.0245 (0.0028) | 0.0308 (0.0045) | 0.0524 (0.0059) | 0.0756 (0.0046)
UnSplit | 0.1302 (0.0092) | 0.1394 (0.0080) | 0.1496 (0.0024) | 0.1514 (0.0010) | 0.1502 (0.0007)
CIFAR-10 | SDAR | 0.0072 (0.0013) | 0.0104 (0.0009) | 0.0120 (0.0003) | 0.0134 (0.0007) | 0.0216 (0.0014)
PCAT | 0.0231 (0.0066) | 0.0237 (0.0021) | 0.0337 (0.0048) | 0.0382 (0.0062) | 0.0568 (0.0062)
UnSplit | 0.0688 (0.0027) | 0.0662 (0.0004) | 0.0670 (0.0000) | 0.0674 (0.0005) | 0.0660 (0.0000)
CIFAR-100 | SDAR | 0.0070 (0.0011) | 0.0101 (0.0007) | 0.0128 (0.0012) | 0.0136 (0.0011) | 0.0217 (0.0011)
PCAT | 0.0188 (0.0029) | 0.0185 (0.0032) | 0.0244 (0.0028) | 0.0300 (0.0014) | 0.0430 (0.0014)
UnSplit | 0.0846 (0.0070) | 0.0726 (0.0008) | 0.0728 (0.0004) | 0.0730 (0.0000) | 0.0718 (0.0004)

(a) MNIST

(b) Fashion-MNIST

(c) CIFAR-10

(d) CIFAR-100

Figure 11. Feature inference attack MSE of SDAR over training iterations at split levels 3–7 on vanilla SL |  |  |  |
---|---|---|---|---
3 |  |  |  |
4 |  |  |  |
5 |  |  |  |
6 |  |  |  |
7 |  |  |  |
|  (a) MNIST |  (b) Fashion-MNIST |  (c) CIFAR-10 |  (d) CIFAR-100
Figure 12. Examples of feature inference attack results of SDAR all datasets
at split levels 3–7 in vanilla SL.

(a) MNIST

(b) Fashion-MNIST

(c) CIFAR-10

(d) CIFAR-100

Figure 13. Attack MSE (upper) and original task training loss (lower) of SDAR vs FSHA on all datasets at level 7 in vanilla SL. Table 10. Effects of the size of the auxiliary dataset $D^{\prime}$ on SDAR attack MSE on all datasets at split level 7 on vanilla SL. Dataset | $|D^{\prime}|/|D|$
---|---
1.0 | 0.5 | 0.2 | 0.1 | 0.05
MNIST | 0.0086 (0.0010) | 0.0076 (0.0004) | 0.0085 (0.0007) | 0.0101 (0.0010) | 0.0111 (0.0012)
MNIST-Fashion | 0.0178 (0.0012) | 0.0182 (0.0006) | 0.0179 (0.0015) | 0.0208 (0.0006) | 0.0215 (0.0006)
CIFAR-10 | 0.0216 (0.0014) | 0.0224 (0.0017) | 0.0237 (0.0016) | 0.0235 (0.0015) | 0.0274 (0.0008)
CIFAR-100 | 0.0217 (0.0011) | 0.0217 (0.0014) | 0.0232 (0.0007) | 0.0257 (0.0016) | 0.0287 (0.0020)

(a) MNIST

(b) Fashion-MNIST

(c) CIFAR-10

(d) CIFAR-100

Figure 14. Attack MSE of SDAR on all datasets at split level 7 in vanilla SL with different model widths Table 11. Mean and standard deviation of feature inference attack MSE on all datasets at split levels 3–7 in U-shaped SL. Dataset | Method | Split Level
---|---|---
3 | 4 | 5 | 6 | 7
MNIST | SDAR | 0.0040 (0.0017) | 0.0024 (0.0005) | 0.0029 (0.0001) | 0.0046 (0.0008) | 0.0086 (0.0018)
PCAT | 0.0499 (0.0325) | 0.0580 (0.0281) | 0.0911 (0.0075) | 0.0943 (0.0134) | 0.0895 (0.0087)
Fashion-MNIST | SDAR | 0.0033 (0.0013) | 0.0059 (0.0012) | 0.0093 (0.0016) | 0.0115 (0.0014) | 0.0211 (0.0011)
PCAT | 0.0821 (0.0577) | 0.0946 (0.0175) | 0.1290 (0.0094) | 0.1036 (0.0159) | 0.1308 (0.0102)
CIFAR-10 | SDAR | 0.0060 (0.0011) | 0.0085 (0.0013) | 0.0120 (0.0017) | 0.0138 (0.0013) | 0.0247 (0.0009)
PCAT | 0.0452 (0.0297) | 0.0387 (0.0262) | 0.0665 (0.0262) | 0.0791 (0.0122) | 0.0947 (0.0184)
CIFAR-100 | SDAR | 0.0062 (0.0003) | 0.0084 (0.0015) | 0.0115 (0.0010) | 0.0132 (0.0006) | 0.0227 (0.0007)
PCAT | 0.0180 (0.0057) | 0.0547 (0.0418) | 0.0708 (0.0200) | 0.0998 (0.0091) | 0.0938 (0.0062)
Table 12. Mean and standard deviation of label inference accuracy on all datasets at split levels 3–7 in U-shaped SL. Dataset | Method | Split Level
---|---|---
3 | 4 | 5 | 6 | 7
MNIST | SDAR | 99.88 (0.10) | 99.87 (00.14) | 99.93 (00.04) | 99.64 (00.26) | 99.90 (00.07)
PCAT | 80.43 (38.87) | 42.37 (46.77) | 06.72 (11.20) | 23.22 (28.45) | 17.87 (09.98)
Fashion-MNIST | SDAR | 98.45 (00.15) | 98.66 (00.15) | 98.17 (00.49) | 98.91 (00.40) | 98.49 (00.37)
PCAT | 54.80 (37.55) | 22.48 (26.25) | 13.88 (03.88) | 19.91 (14.88) | 10.40 (07.33)
CIFAR-10 | SDAR | 97.80 (00.63) | 98.61 (00.26) | 98.49 (00.25) | 98.15 (00.51) | 98.71 (00.77)
PCAT | 69.12 (35.15) | 88.66 (18.88) | 58.11 (34.33) | 21.34 (25.29) | 15.45 (09.99)
CIFAR-100 | SDAR | 74.93 (01.22) | 75.16 (01.46) | 74.84 (01.63) | 73.72 (02.36) | 73.83 (01.20)
PCAT | 75.03 (02.24) | 45.33 (33.78) | 16.91 (18.71) | 03.44 (02.51) | 02.32 (01.75)

(a) MNIST

(b) Fashion-MNIST

(c) CIFAR-10

(d) CIFAR-100

Figure 15. Feature inference attack MSE (upper) and label inference accuracy (lower) of SDAR over training iterations at split levels 3–7 on U-shaped SL |  |  |  |
---|---|---|---|---
3 |  |  |  |
4 |  |  |  |
5 |  |  |  |
6 |  |  |  |
7 |  |  |  |
|  (a) MNIST |  (b) Fashion-MNIST |  (c) CIFAR-10 |  (d) CIFAR-100
Figure 16. Examples of feature inference attack results of SDAR all datasets
at split levels 3–7 in U-shaped SL.