Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: The paper investigates adversarial effects of property inference and data reconstruction attacks in the setting of split learning for features partitioned vertically. To defend against such attacks, the paper proposes a privacy-preserving technique that involves adding noise in the ReLU activation during the forward and backward propagation steps in the split learning protocol. In addition, it proposes a dynamic allocation of the privacy budget through estimating the importance of features.  

strengths_and_weaknesses: The paper tackles a new topic in split learning. Overall, I found the paper clear and significant, though there were some unnatural phrasings here and there and some typos. The paper offers an original approach to privacy-preserving split learning but the evaluation could be more insightful and explain a bit more certain phenomena (see Questions). 

**Strengths**

S1. The proposed technique is privacy-preserving, based on the formal guarantee of differential privacy.

S2. Interesting technique to apply the perturbation at the activation level and propose $R^3eLU$.

S3. The paper argues in the evaluation section from the perspective of better defenses against adversarial attacks, which both improve with the Laplace mechanism.

**Weaknesses**

W1. The evaluation results are not that impressive in terms of the model utility (the utility is up to 2% better compared to DPSGD), though they are better with the fine-grained analysis (Ours in Table 2 and 3). It seems that for these datasets even DPSGD comes pretty close to the baseline training (no privacy) of SplitNN. 

W2. Not clear what the overhead (in performance) is for the dynamic budget allocation (if any) over baseline (no privacy).


questions: Q1. Why is the influence estimation of single features considered and not the combination of features? I.e., could it be that the single feature change might not have an influence on the output but that a combination of features is particularly vulnerable? In this case, why did you consider single feature influence estimation?

Q2. Why is DPSGD much worse at defending against property inference attacks than the Laplace or your proposed solution (e.g., in Table 4 and Table 5 there are almost 20% differences in prediction accuracy for BookCrossing and more than 30% for MNIST)?

Q3. Does it make sense to evaluate the data reconstruction attack using MSE? At least for MNIST, should we be looking at measures of visual similarity, e.g., Frechet distance?

Q4. What is the baseline mechanism used for Laplace? Does it refer to applying the perturbation without the fine-grained analysis? It is not mentioned in the evaluation.

Q5. Why does the property inference attack by the adversarial host have a much higher 94% accuracy on MNIST compared to the 57% accuracy by the adversarial guest?

Q6. What do you mean by “that these attack results against the baselines are frustrating because the reconstruction attack is hard..” or “ … primitive Laplace mechanism frustrates the inference attack…” (perhaps deteriorates/inhibits the attack accuracy?)?
limitations: None
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The authors present a differential privacy mech for training with split learning. Their method is based on a randomized response like mech applied to privatizing relu activations. 
strengths_and_weaknesses: Strengths:

-Earliest of DP mechs for split learning
- 

Weakness:

-Typically the privacy budgeting is about composition laws, or dealing with sampling with (repitition) replacement across batches for the same.
- Why is your proposed budgeting based on perceived feature importance instead?

- For DP-SGD, typically the model weights as a query are a function of all of training data. As opposed to that in terms of making activations private, the query is 1 sample at a time. Each activation is a function of 1 sample. This brings it under a local dp like regime.
- This needs to be stated along with reasoning of why the proposed method is comparable with DP-SGD in terms of privacy models or paradigms.

Minor/typo: Change Split Leaning to Split Learning in A.1 


questions: 
-Typically the privacy budgeting is about composition laws, or dealing with sampling with (repitition) replacement across batches for the same.
- Why is your proposed budgeting based on perceived feature importance instead?

limitations: Please answer the concerns under questions and Weaknesses. That will help clarify whether those fall under limitations or not.
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: This paper presents a way to improve privacy in split learning by constructing a privacy-tunnel between the host and the guest. This is done by using a new activation function called R3eLU, which responds to forward and backward passes in a randomized manner. The noise added to the activation through this activation function provides differential privacy on the activations and its gradients . The proposal is evaluated on recommendation and classification models to show that it improves the utility-privacy tradeoff of split-NNs.
strengths_and_weaknesses: ## Strength

1. The idea of using a randomized activation function to add noise during forward and backward propagation to provide DP is interesting.
2. The idea seems to provide better protection against property inference and reconstruction attacks compared to other forms of noise addition (DPSGD and Laplace)


 
## Weakness

1. The writing in the evaluation section is unclear and is missing key details about the experimental setup.
2. Property inference: It’s unclear what this means in the context of the paper. Is the adversary trying to infer additional attributes from the data? If so, what are these additional attributes for the datasets used in the results?
3. How is DPSGD being applied to split learning?  Is the noise being applied to the embedding or the gradients shared during backpropagation or both?
questions: 1. Privacy Amplification: The analysis presented in the paper assumes that the random sampling in SplitNN provides a privacy amplification of B/N. My understanding is that privacy amplification by subsampling requires the input-ids to be unknown to the host. However, the guest needs to share the input-id of the samples in the batch with the host to coordinate the training. Can you comment on this?
limitations: The paper discusses the limitations of the proposed defense.
review_title: null

Meta-review: metareview: Though reviewers increased their scores, they maintained some skepticism regarding several issues in the paper. The authors are strongly encouraged to consider addressing these in a later submission.

- Privacy amplification by subsampling seems to require that specific inputs used in a batch (after subsampling) should not be known to the host. This condition does not seem to be readily satisfied in split-learning as the input-ids need to be communicated to the host during training.
- Gains remain modest compared to simple baselines.
- Steps within the pipeline remain heuristics, and are not formally justified.
confidence: Certain
Decision: Reject