Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The authors expose the vulnerability of split Federated Learning and show how model extraction attacks can be launched by malicious clients querying the gradient information from server-side.

They proposed five different variants of model extraction attacks (ME) on split federated learning. The attacks use different gradient schemes, including data crafting, data generating, gradient matching and soft label crafting. They also made different assumptions for the data such as no data, only auxiliary data (out-of-distribution data) and training data (in-distribution data). They interestingly find that in a 5-layer-in-server SFL, an ME attack can derive a surrogate model with over 90% accuracy, and less than 2% accuracy degradation.

For the experiment they tried both fine-tuning the SFL models and training from scratch for different gradient consistency.
They showed that the ME attacks can succeed even without any data when fine-tuning. They also concluded that the ME attacks would succeed better with the increase of layers on the server side. 
strengths_and_weaknesses: Strengths:
- It’s an original work and perhaps the first one on the possible attacks on SFL systems.
- Quality of the work is good, and the writing it’s quite clear. 

Weaknesses:
- Some related work is missing. The authors mention that Split Learning is firstly introduced in reference "[Gupta and Raskar, 2018]" while the idea goes further back and there are already several papers on the field. For example (non exhaustive list):
* Kang, Yiping, et al. "Neurosurgeon: Collaborative intelligence between the cloud and mobile edge." ACM SIGARCH Computer Architecture News 45.1 (2017): 615-629.
* Yousefpour, Ashkan, et al. "Guardians of the deep fog: Failure-resilient DNN inference from edge to cloud." Proceedings of the First International Workshop on Challenges in Artificial Intelligence and Machine Learning for Internet of Things. 2019.
* Liu, Peng, Bozhao Qi, and Suman Banerjee. "Edgeeye: An edge service framework for real-time intelligent video analytics." Proceedings of the 1st international workshop on edge systems, analytics and networking. 2018.
* Surat Teerapittayanon, Bradley McDanel, and HT Kung. 2017. Distributed deep neural networks over the cloud, the edge and end devices. In Distributed Comput- ing Systems (ICDCS), 2017 IEEE 37th International Conference on. IEEE, 328–339.
questions: What do authors think about their possible way of defending such attacks through regularization? How good is that? 

Have the authors also looked the LEAF datasets for the experiments? LEAF seems to be the standard dataset for FL papers, with natural client partitions and other FL constraints.
limitations: The defense mechanism is quite basic and it would be nice to see some strong defense mechanisms with more analyses and numerical experiments
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The authors perform five different model extraction attacks in settings of split federated learning (SFL). Such attacks exploit gradient information from the server-side to conduct model extraction attacks. Besides, this paper proposed an approach to obtain the necessary shadow data for constructing attackers.
strengths_and_weaknesses: ** strengths 
  1. Give a comprehensive investigation of model extraction attacks in split federated learning settings, and provide rich experimental results. 
** weaknesses
  1. Different attack approaches are explained in an abstract way. It is hard to understand the attack assumption, how to craft data, how the attacker works, etc.
questions:   1. Craft-ME method, both the surrogate model and input x_r are randomly initialized, and the surrogate model generates x_r since the server-side model won't provide loss respect with x_r. Even though we can generate plausibly (x_r, c) labels via such a random surrogate model, how can these collected (x_r, c) instances be applied to train the surrogate model well?
  2. Gradient matching model extraction (GM-ME): since the prediction query is disallowed, V is unknown in this setting. how to compute \nabla_{x_i} L(V(C(x_i)), y_i) (see line 196, eq. 1)? Normally, Victim part will only compute gradient with respect to C's party weights. 
  3. Training-based model extraction (Train-ME): how much training data are used to train such a surrogate model, compared with the data size in SFL settings. 
limitations:   1. Gradient matching model extraction (GM-ME) relies on the gradient of x_i, which is infeasible in reality. 
  2. Training-based model extraction (Train-ME)'s idea is done by previous work, using model transferability. see [1]

[1] Fu, Chong, et al. "Label inference attacks against vertical federated learning." 31st USENIX Security Symposium (USENIX Security 22), Boston, MA. 2022.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: Federated learning is a distributed learning paradigm that allows multiple clients and a server to collaboratively learn a machine learning model without data sharing. However, federated learning still suffers from model privacy concerns, since the server and the clients all have access to the full global model. Split federated learning is proposed as a solution to both communication reduction and privacy enhancement. In split federated learning, the machine learning model is split into two parts, one held by the server and the other one held by the clients. Since the clients have access to only part of the model, split federated learning was considered to be robust to client-side model extraction attacks. However, in this work, the authors find that this is a false sense of security. Specifically, a malicious client can perform model extraction attacks to learn a surrogate model that have similar accuracy/predictions compared to the target server-side model. 
strengths_and_weaknesses: ### Strengths
- Five different model extraction attacks are proposed in this work. The authors consider attack different settings for the attack, e.g., whether the attacker (malicious client) has local training data. 
- The authors conduct extensive experiments to show the effectiveness of their model extraction attacks. It is impressive that the attacks do work in many cases and it is interesting to see the impact of different parameters, e.g., the number of queries, the number of layers in the server-side model, and model architectures.
- The paper is generally well-written and easy to follow. 

### Weakness
- When evaluating the model extraction attacks with training data available, it is intuitive to compare the attacks with a simple baseline that uses the training data to train a model locally on the malicious client. I would expect the authors to perform a simple comparison with such baseline. This is essential because if the attacker can locally train a better model, then there is no motivation for the attacker to perform the model extraction attacks. 
- There is no analysis on the complexity of the proposed attacks. It is interesting to see some analysis on the attack cost, e.g., $O()$ notations with respect to the number of parameters in the server-side model. 
- There are some defenses in federated learning that leverages statistical analysis of the local gradients (known as Byzantine-robust FL methods). I am curious whether these methods are sufficient to defend against the proposed attacks. 
- In Section 5.3, it is claimed that "This indicates Resnet architecture is more resistant to ME attack". It would be interesting to see some explanation on why this is the case. 
- The potential societal impact may need to be stated more explicitly.
- Writing issues. On line 3 of Algorithm 1, I would say it is better to average model parameters (i.e., $W$) instead of models (i.e., $C$). In Figure 4, the captions of subfigures mismatch.
questions: - What is the accuracy of the model obtained via the aforementioned baseline, i.e., locally trained by the attacker with the available training data? Do the proposed attacks outperform it?
- What is the complexity of the proposed attacks?
- Can existing statistics-based Byzantine-robust FL methods defend against the attacks?
- Is there any possible reason why ResNet shows better robustness to ME attack?
limitations: The negative societal impact may need to be stated more explicitly, e.g., via adding a paragraph in the discussion.
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: This paper investigates model extraction attacks on split federated learning. The paper assumes that the attacker cannot be able to access the model predictions from the server. Hence, the paper leverages the gradients to extract the server-side model. Five model extraction attack methods are proposed for different data assumptions.
strengths_and_weaknesses: Strengths:
1. The paper investigates five model extraction attacks against SFL.

2. The evaluation considers several interesting scenarios, such as non-iid data distributions, adversarial attacks, and attacks without knowing model architectures.

Weaknesses:
1. The paper claims that the client-side attacker cannot use the existing model extraction attacks in the split federated learning because the client cannot get the predictions from the server. However, in the inference phase, the clients can get the predictions. The proposed attacks can be further compared with the existing model extraction attacks through predictions in the inference phase.

2. The novelty of this paper is limited. Most proposed attacks leverage the existing model extraction attacks. Train-ME is the most effective attack. However, Train-ME is a very straightforward attack, which does not even need the gradient query. This may indicate that the model extraction attacks in SFL is not a trivial problem.

3. The no data assumption is confusing. If the attacker is a client, the attacker should at least have access to the client’s data. 

4. It would great if the proposed attacks could be compared with some baselines. For example, since the attacker is one of the clients, what is the attack performance when the attacker uses the client’s data to train a model?

5. The experiment only considers 10 clients. However, in the real-world settings, the number of clients should be much large. What’s the performance of the proposed attacks when a large number of clients participate in the SFL?

6. The proposed attacks do not perform well on complex datasets (e.g., ImageNet, CIFAR100) and complex models (e.g., ResNet). 

7. The scope of the paper is pretty narrow. The proposed attacks can be only applied to split federated learning.
questions: Please clarify the no prediction assumption (weakness 1) and the no data assumption (Weakness 3).
limitations: The authors addressed the limitations and potential negative societal impact.
review_title: null

Meta-review: metareview: The paper studies the vulnerability of split federated learning with model extraction attacks. The paper provides five attacks and evaluates them experimentally. The authors also provided additional experimental results during the author rebuttal.  While the topic and techniques are interesting, reviewers raise concerns about the novelty, and lack of experiments on standard FL datasets (e.g., LEAF) or large number of clients. While authors addressed some of these concerns during rebuttals, the paper can benefit from (a) explaining the novelty of the contributions (b) clarifying the assumptions made in the paper (c) explaining if the paper considers cross-device or cross-silo federated learning (b) adding more experiments on standard FL datasets and tasks.
confidence: Less certain
Decision: Reject