PaperlayerView exact revision on arXiv

Source-linked AI summary

UnSplit: Data-Oblivious Model Inversion, Model Stealing, and Label Inference Attacks Against Split Learning

Ege Erdogan, Alptekin Kupcu, A. Ercument Cicek

arXiv:2108.09033v2cs.CRcs.LG

TL;DR

Split learning is intended to support distributed DNN training while limiting exposure of client data and models, but its privacy can be compromised by an honest-but-curious server. UnSplit combines input inversion and model stealing using limited client-side knowledge, and shows that label inference is also possible when the client computes only the final layer. The attacks expose risks to input privacy and model confidentiality, while deeper client splits increase security without guaranteeing it.

  • Problem

    Split learning distributes DNN computation to address privacy concerns, but the server's access to client-produced intermediate data leaves the privacy of inputs and models in question.

    Source: §1 · p. 1

  • Method

    UnSplit has a server use the client architecture and smashed data to optimize a similar model and input, and separately infer labels when the client computes only the output layer.

    Source: §1 · p. 1, §3.2 · p. 4, §4.2 · p. 7

  • Results

    UnSplit recovers inputs and a functionally similar client model, improves recovered-input quality by combining inversion with model stealing, and infers labels perfectly when the client split is one layer deep.

    Source: §1 · p. 2, §4.2 · p. 7, §5 · p. 9

  • Takeaways & Limitations

    Deeper client splits increase security at a computing-cost trade-off, but vanilla SplitNN still requires additional mechanisms such as homomorphic encryption for provable security guarantees.

    Source: §5 · p. 9

    Deeper splits do not guarantee security; the authors say additional mechanisms such as homomorphic encryption are required for provable security guarantees.

    Source: §5 · p. 9

Abstract

from arXiv · show

Training deep neural networks often forces users to work in a distributed or outsourced setting, accompanied with privacy concerns. Split learning aims to address this concern by distributing the model among a client and a server. The scheme supposedly provides privacy, since the server cannot see the clients' models and inputs. We show that this is not true via two novel attacks. (1) We show that an honest-but-curious split learning server, equipped only with the knowledge of the client neural network architecture, can recover the input samples and obtain a functionally similar model to the client model, without being detected. (2) We show that if the client keeps hidden only the output layer of the model to "protect" the private labels, the honest-but-curious server can infer the labels with perfect accuracy. We test our attacks using various benchmark datasets and against proposed privacy-enhancing extensions to split learning. Our results show that plaintext split learning can pose serious risks, ranging from data (input) privacy to intellectual property (model parameters), and provide no more than a false sense of security.

1 INTRODUCTION

Split learning supports collaborative DNN training while limiting direct data sharing, but its privacy can be undermined by an honest-but-curious server. UnSplit combines input recovery and model stealing, and also demonstrates perfect-accuracy label inference under a one-layer client split.

1 INTRODUCTION

  • SplitNN divides computation between clients and a central server, allowing data holders to train collaboratively without sharing their private data; this is especially important in regulated fields such as healthcare.The framework is described as more efficient than similar approaches [23].Source: §1 · p. 1
  • With client-model architecture knowledge alone, a SplitNN server can recover inputs and obtain a functionally similar client model; with a one-layer client split, it can infer labels perfectly.The server follows the protocol and performs attacks in the background, making them undetectable to the client.Source: §1 · p. 1
  • The attacks use an honest-but-curious server that follows SplitNN while attacking in the background, so the client cannot detect them from protocol behavior.Source: §1 · p. 1
  • UnSplit combines model stealing with model inversion, and the authors report that this combination improves recovered-input quality while threatening input privacy and model confidentiality.The attacker needs only the client architecture and smashed data, not client queries or a related public dataset.Source: §1 · pp. 1–2

2 BACKGROUND AND RELATED WORK

SplitNN distributes a neural network across clients and a server, with several configurations for handling labels and loss computation. Prior work seeks to reduce leakage or invert models, but existing SplitNN attacks carry additional assumptions or do not steal the client model.

2 BACKGROUND AND RELATED WORK

  • SplitNN divides a DNN among clients and a central server; its configurations differ in where examples, labels, and loss computation reside.In the basic setup, the client sends its intermediate output and target label to the server; other arrangements keep labels or examples on different parties.Source: §2 · p. 2

2.1 Reducing Information Leakage in SplitNN

  • The leakage-reduction approach in [21] adds a logarithmic distance-correlation loss between inputs and smashed data, with weights controlling its impact.Source: §2.1 · p. 2

2.2 Model Inversion Attacks

  • Model inversion seeks to recover a model's inputs from its output [13] [28], while SplitNN constrains attacks because clients control model inputs and the server generally cannot query them.Table 1 summarizes adversary capabilities across inversion attacks.Source: §2.2 · pp. 2–3, Table 1 · p. 3

2.2.1 Attacks Against Split Learning.

  • Pasquini et al. recover client data by steering the client toward arbitrary goals, but their attack cannot steal the client model.Source: §2.2.1 · p. 3
  • FSHA uses a similar-distribution public dataset to train an autoencoder for inversion, whereas UnSplit does not assume such a dataset and also targets model stealing.Without a suitable dataset, FSHA cannot train its autoencoder.Source: §2.2.1 · p. 3
  • Other collaborative-inference attacks [7] consider white-box, black-box, and query-free settings, but black-box and query-free effectiveness depends heavily on knowledge of the original task.Federated-learning attacks [28] instead recover inputs by matching gradients, showing that shared gradients can leak information even when computation stays client-side.Source: §2.2.1 · p. 3, §2.2.2 · p. 3

3 METHOD

UnSplit models attacks by a SplitNN server with limited client-side knowledge, then uses optimization to reconstruct inputs and clone client parameters or infer labels from gradients. Although described for one client, the attacks extend to n-client setups.

3.1 Threat Models

  • The inversion attacker knows the client model architecture but not its parameters, cannot query it or access specific data, and otherwise follows SplitNN protocol.The client cannot distinguish an attacking server from one following the protocol; the paper describes the setting as realistic for a researcher serving healthcare providers.Source: §3.1 · p. 3

3.2 Model Inversion & Stealing

  • The inversion attack alternates gradient updates to estimated inputs and client-model parameters, minimizing MSE and adding total variation to smooth reconstructed images.Coordinate descent holds one target set fixed while updating the other; the attacker can tune update steps, rounds, and search-space partitioning.Source: §3.2 · p. 4

3.3 Label Inference

  • For label inference, the server compares gradients from a same-architecture clone across possible labels with the client's received gradients, then uses the closest label to train the clone.The setup assumes the server knows the training input and receives client-layer gradients from one example during backpropagation.Source: §3.3 · p. 4

3.4 Number of Clients Does Not Matter

  • The attacks generalize to n clients because the server trains with one client at a time and clients update a shared parameter set as if data were aggregated at one client.The paper presents the method using a single-client setup for simplicity.Source: §3.4 · pp. 4–5

4 EXPERIMENTAL RESULTS

Across MNIST, Fashion-MNIST, and CIFAR10, the attacks recover inputs and produce clones that perform close to the original models on unseen data. Results also show input and model leakage under DCOR, and label inference when only the output layer remains client-side.

4.1 Experimental Setup

  • Experiments used MNIST, Fashion-MNIST, and CIFAR10, tested the first six split layers, and limited DCOR tests to MNIST and Fashion-MNIST because larger models incurred significant training overhead.Results were averaged over five randomly selected sets of ten images each.Source: §4.1 · p. 5

4.2 Results

  • Reconstruction errors were 0.084, 0.149, and 0.083 for MNIST, Fashion-MNIST, and CIFAR10; clone test accuracy reached 95.63%, 83.90%, and 55.73% on those datasets.Source: §4.2 · pp. 5–6
  • Trained client models yielded lower reconstruction errors than untrained models, but untrained models still leaked considerable information.For trained versus untrained clients, errors were 0.084 versus 0.097 on MNIST, 0.149 versus 0.189 on Fashion-MNIST, and 0.083 versus 0.089 on CIFAR10.Source: §4.2 · pp. 5, 7
  • When the client computes only the last layer locally, the server infers labels with perfect accuracy and can then train a clone that performs as well as the client model.Source: §4.2 · p. 7
  • UnSplit recovered inputs more accurately than the query-free attack, while the white-box attack achieved higher PSNR with unlimited client-model access.Source: §4.2 · p. 7
  • With a very limited query budget, the black-box attack could match UnSplit's PSNR, but sending client-selected queries violates the protocol and falls outside the honest-but-curious threat model.Examples were 12 queries for MNIST at split depth 1 and 71 for CIFAR10 at depth 4.Source: §4.2 · pp. 7–8

4.3 Results Against the DCOR Defense

  • Under DCOR, input MSE remained approximately 0.8 for MNIST and 0.18 for Fashion-MNIST, while clone performance matched the client; the defense reduced input quality but its effect could be substantially reduced by attacker capabilities.Source: Table 4 · p. 8, §4.3 · pp. 8–9, Figure 9 · p. 9

4.2 Results

  • UnSplit performed comparably to FSHA until about 1,000 FSHA setup iterations, but FSHA requires data similar to the training set and becomes infeasible without it.Source: §4.2 · p. 8

5 CONCLUSION

A server knowing only the client architecture can recover inputs and a functionally similar model; with a final client split of depth one, it can infer labels perfectly. Deeper splits reduce inversion and stealing effectiveness but do not guarantee security, so additional mechanisms are needed for provable guarantees.

5 CONCLUSION

  • With client architecture alone, a server can recover inputs and obtain a model that performs similarly; at final-split depth one, it can infer labels perfectly.The server is described as honest-but-curious.Source: §5 · p. 9
  • Later preprints [8] [14] use stronger threats: [8] assumes adversary-owned inputs; [14] assumes label lists and one labeled sample per class, versus gradient-only access here.Source: §5 · p. 9
  • Deeper split layers reduce model inversion and stealing effectiveness, creating a trade-off in which data holders can spend more computing power to increase security.This is presented as a possible response when the data are sensitive.Source: §5 · p. 9
  • More client-side computation does not guarantee security; additional mechanisms such as homomorphic encryption are required for provable guarantees.Source: §5 · p. 9

Related papers

Loading 2108.09033v2…