Secure Split Learning against Property Inference and Data Reconstruction Attacks
Authors: Yunlong Mao
Zexi Xin
Zhenyu Li.
Jue Hong
Yang Qingyou
Sheng Zhong
Venue: NeurIPS 2022 Submitted (2022)
Keywords: split learning
security
inference attack
data privacy

Abstract: Split learning of deep neural networks (SplitNN) has provided a promising solution to learning jointly for the mutual interest of the guest and the host, which may come from different backgrounds, holding features partitioned vertically. However, SplitNN creates a new attack surface for the adversarial participant, holding back its practical use in the real world. By investigating the adversarial effects of two highly threatening attacks, i.e., property inference and data reconstruction, adapted from security studies of federated learning, we identify the underlying vulnerability of SplitNN. To prevent potential threats and ensure learning guarantees of SplitNN, we design a privacy-preserving tunnel for information exchange between the guest and the host. The intuition behind our design is to perturb the propagation of knowledge in each direction with a controllable unified solution. To this end, we propose a new activation function named $\text{R}^3$eLU, transferring private smashed data and partial loss into randomized responses in forward and backward propagations, respectively. Moreover, we give the first attempt to achieve a fine-grained privacy budget allocation scheme for SplitNN. The analysis of privacy loss proves that our privacy-preserving SplitNN solution requires a tight privacy budget, while the experimental result shows that our solution outperforms existing solutions in attack defense and model usability.

Secure Split Learning against Property Inference and Data Reconstruction Attacks
Anonymous Author(s)
Affiliation
Address
email
Abstract
Split learning of deep neural networks (SplitNIN) has provided a promising solu- tion learning jointly for the mutual interest of guest and host, which may come from different backgrounds, holding features partitioned vertically. How- ever, SplitNN creates a new attack surface for the adversarial participant, holding back its practical use in the real world. By investigating the adversarial effects of two highly threatening attacks, i.e., property inference and data reconstruction, adapted from security studies federated learning, we identify the underlying vulnerability of SplitNN. To prevent potential threats and ensure learning guaran- of SplitNN, we design privacy-preserving tunnel for information exchange between the guest and the host. The intuition behind our design is perturb the propagation of knowledge in each direction with a controllable unified solution. To this end, we propose a new activation function named R R*eLU, transferring pri- vate smashed data and partial loss into randomized responses in forward and back- ward propagations, respectively. Moreover, we give the first attempt to achieve a fine-grained privacy budget allocation scheme for SplitNN, The analysis pri- vacy loss proves that our crivacy-preserviie SplitNN solution provides a tight privacy budget, while the experimental result shows that our solution outperforms existing solutions in attack defense and model usability.
7
13
14
15
16
Introduction
19
Collaborative learning enables participants from different backgrounds to learn jointly for mutual 21 interests. well-known collaborative learning paradigm federated learning (FL) (25). focusing on the coordination of distributed participants. Meanwhile, another paradigm, split neural network learning (SplitNN for short) [19.
20
4J. is designed for vertically partitioned features. The emer- gence of SplitNN provides promising solution to building cooperative models such as two-towers recommendation systems (37 39 By combining different features, SplitNN is supposed to be more expressive for tasks like user profiling and recommendation.
24
25
26
27 However, collaborative learning paradigms are faced with severe security issues. Roughly speak-
28 ing, there are three kinds of known threats, inference attack (9 [30], reconstruction attack [17, 31], and poisoning attack (33. 18.. The inference attack discloses properties membership information
30 of data samples, while the reconstruction attack seeks to recover participants' private data samples.
31 Unlike these two kinds of threats, the poisoning attack [33] [8] aims to put harmful data into collab-
32 orative learning for malicious purposes rather than stealing private information. As a result, some
33 defensive solutions have been proposed for federated learning. According to their techniques, these
34 solutions can be classified into three categories: differential privacy solutions [36 (2], homomorphic
35 eneryption solutions 38 21]] and secure multiparty computation solutions [12 27
Submitted to 36th Conference Neural Information Processing Systems (NeurIPS 2022). Do not distribute.

---

36
Unfortumately, defense solutions for SplitNN are barely discussed, but threatening attacks are con- tinuously emerging. We note that the workflow of SplitNN has a unique asymmetric design, which 38 is quite different from FL. Therefore, most solutions for secure FL are not suitable for SplitNN,
37
39 Secure multiparty computation solutions and homomorphic encryption solutions can achieve ideal
40 data confidentiality in SplitNN. But the overhead introduced is still far away from practical uses. Thus, for the first attempt at a secure SplitNN solution, will concentrate on privacy leakage is- sues caused by property inference and data reconstruction attacks in this paper because they share similar adversarial goals. Instead, poisoning attacks need to be studied separately [7. 24].
43
44 We note an inherent contradiction [6] between privacy preservation and model utility in SpliONN. To investigate the privacy leakage risk of SplitNN, we evaluate the adversarial effect of property inference and data reconstruction attacks against recommendation and image classification models built using SplitNN. The results in semi-honest and malicious settings show that both attacks have sufficiently high success rates when disclosing the privacy of the guest or the host. To secure SplitNN against these attacks [17 30, 29], we give the first trivacy-rreserving SplitNN solution, stemming privacy leakage from either direction with dynamic privacy budget allocation.
45
48
49
50
51
Contribution. Through thorough investigation of the privacy leakage issue in SplitNN, we con- firm that the best option of defensive solution for SplitNN is to construct a privacy-preserving tunnel between the split surfaces of the host and guest sides. To this end, we propose a novel activation function named R R',LUU, responding to forward and backward propagations in a randomized manner. Furthermore, we propose a fine-grained privacy budget allocation scheme for SplitNN to achieve more efficient perturbations, dynamically allocating the privacy budget in spatial dimension (feature level) and temporal dimension (epoch level). The analysis of privacy loss shows that our solution provides a differential privacy guarantee regarding activations. The evaluation results regarding rec- ommendation and classification models show that our solution can outperform the existing solutions in privacy preservation and model usability.
52
54
55
56
57
58
59
61
2
Problem Statement
82
2.1
Split Learning
63
Given training dataset X and model parameters 0, a learning task is find approximately optimal 0 by minimizing a pre-defined loss function L. We assume that the optimizer used is manc-
65 stochastic gradient descent (SGD) algorithm, which updates O with batch input of X iteratively.
{zd|z; E X, E 67 [1, NJ) should be ErEw L( x)) in the I-th training iteration. The gradients of A for model updating should be estimated by N EnEE VeL(O, x) approximately. Hence, parameters can be updated 69 as r++ 0 1/2 ExEn VeL(e, x)). This mini-batch SGD based optimizing procedure should be repeated until the model usability meets the requirement or the maximal count of iterations reaches.
66 Assuming the batch size is N, then the total loss of 0 for a batch input
66
70
71 Generally, there are two roles in two-party SplitNN. We denote by the guest who holds features
72 only and the host who holds both features and labels. According to related studies [34, 14]. there
73 exist several split configurations of neural networks. We will focus on the SplitNN designed for
74 vertically partitioned features with labels held by the host only [4. []]- We denote by 05, 0 the
75 partial models of the guest and the host after split and 8 the rest part of the original model. Then
76 the forwarding result Forward( 20 09) of the guest should be evaluated locally and passed to the host. The host should merge Forward( hh @h) with Forward(x (0) using a predefined strategy 78 such as concatenating and averaging. Then the host finishes the rest of the forward propagation
79 [ [MMerg((oorvard] 09), Forward(2"' 0h))), @*) and initiates backward propagation, sending
80 the partial loss regarding x and 0 back to the guest.
81 We take SplitNN based recommendation system as an example and give a benchmark in Table Different merging strategies and two public datasets, MovieLens [15) and BookCrossing [40), have been evaluated. In case of misaligned features, zero padding will be used to retain the shape of fea-
2

---

84 ture vectors. We notice that concatenating and element-wiss averaging with padding have relatively stable and desirable performance, which will be used as the default setting in the rest of this work.
Table 1: Top-10 hit ratio of SplitNN based recommendation using different merging strategies.
clement- -ise
concatenate
no split
sum
average
padding
56.62%
56.26%
56.35%
56.89%
57.19%
MovieLens
57.21%
non-padding
55.38%
54.75%
54.95%
55.72%
55.08%
padding
61.70%
60.84%
60.21%
61.16%
60,98
Book Crossing
61.92%
non- non-padding
58.80%
59.34%
59.44%
59.10%
59.02%
85
2.2
Threat Model
87 In SplitNN, interactions between the guest and the host pose threats to each other. Thus, we will
86 investigate private data leakage threats from either direction. We first assume that the host and
89 the guest are honest but curious about the private data of each other. Moreover, we will consider 90 a more powerful threat model [29]. where the guest or the host could be malicious, hijacking the feature space during split learning. In both cases, we take into account property inference and data reconstruction attacks, which are highly threatening attacks identified in collaborative learning.
Property inference attack. Since either role of SplitNN has access to the output of the other's local 94 model, the adversary can mount a property inference attack 19. 22), inferring properties of private data through observing query input and the corresponding output. By constructing shadow models elaborately, the adversary can steal substantial information from the target. this way, the adversary acquires the capability of inferring some properties (such as gender and age) of the data samples used for training. Denoted by F, T and LF the inference model, target model, and the loss function used for F, the adversarial goal of property inference attack is
93
95
96
87
99
APIa = arg min
Σ CF (F((((())))) E (0.1). 225
(1)
100
Data reconstruction attack. By taking advantage of generative adversarial networks (GANs) [13], a data reconstruction attack [17 29] becomes possible in collaborative learning. To mount the attack, the adversary augments the training data per iteration by inserting fake samples x generated by generator G. The target model will serve as discriminator D. The adversary affects the target
101
102
103
model by deceiving the target with fake training samples. For correcting the adversary, the target participant is supposed to put more private information into the learning. In this game-style training, the adversary can obtain a generator to reconstruct data samples similar to target private data. The adversarial goal of the data reconstruction attack can be given as
105
106
107
ADRA
min max G
log
logg(1 D(G())))
Feature space hijacking. The property inference and data reconstruction attacks adapted from FL 109 can be mounted by a semi-honest participant, who follows the split learning protocol normally. How-
110 ever, a recent attack study dedicated to SplitNN has revealed that a malicious host can achieve more impressive adversarial effects on property inference or data reconstruction by explicitly distorting
111
112 the objective split learning. Thus, we also consider the defensive effect of our solution against property inference and data reconstruction attacks using this feature space hijacking approach.
113
Privacy- Split Learning
114
115
Our goal design an unified defense solution to preserving privacy from both the host and guest's perspectives. Ideally, the guest wants to collaborate with the host under the condition that the host
116
could disclose private information and vice versa. According to recent studies [ 23,, 16), artifi- cial perturbations of data samples parameters could prevent privacy leakage effectively. However,
3

---

119
different from conventional model publishing scenarios, the host and guest in SplitNN will keep exchanging intermediate results during training. These continuous queries significantly increase the risk of privacy leakage for both sides. Moreover, the attack surface of splitNN is in the middle of neural network propagations, which makes things tricky. Thus, our primary idea to tackle this prob- preseriing tunnel for interactions. Recent studies such as 10] have proved that activation functions are more adaptive for perturbed operands than other neu- ral network components. Moreover, activation functions have various forms (2). which are flexible for configuration. As a result, we propose new variant of ReLU as privacy-preserving interface.
120
121
122
123
lem is to construct a bidirectional
124
125
128
127
3.1
RºeLU: Beddomized-Respomeee ReLU
128
Inspired by randomized response approach 35 we propose a new activation function named Rd eLU. The original randomized response method is good statistical analysis of item sets. But the result of an activation function is commonly continuous variable. Hence, they cannot be easily combined together. It should also be noted that it is risky to perturb activation functions directly because non-activated results may be flipped unexpectedly. Recall that the original formula of ReLU is fx) = max(0 (0, z), x E R. Our randomized-respome variant will yield a proper substitute for replacing the real activation with a probability of p. If we yield as the substitute, then we can randomly inactivate a part of ReLU results. But nothing has been changed for x I Because
129
130
132
133
134
135
136
(a) 0 when S O. Hence, the variant is not completely privacy preserved since [(x) also reveals useful information to the adversary. For the completeness of the variant, we generate noisy activations x' + Laplace(O, σ) for S 0. Now, we can give the definition of R cLU as
138
ReeLU()) = { max (0, x + x'); with probability p: 0,
(3)
with probability (1 pp) p)-
We remark that the way R handles non-activated results is dangerous, although learning ac- curacy is often traded off for privaey. But we will mitigate the side effect through privacy budget allocation. Then the risk of applying ReeLU will not be problem.
139
140
142
3.2
Forward Propagation with R'eLU
Now we show how to apply ReeLU in the forward pass of SplitNN regarding the guest's privacy. Generally, when the 1-th training iteration begins, the guest randomly samples a mini-batch æ from
143
144
private training dataset X(s) Assuming that an embedding procedure Embedding() RM
145
X' is publicly available, raw data samples in the mini-batch can be encoded into feature vectors = {1i, 12,,... uM }. i E N1, and M is the dimension of feature representing space. From the functional perspective, we assume that L(v", ua 0) is equivalent to L (Forward( (=", 0²), Forward( 09). 0²), where Forward() R.N + R. is a function to yield the feedforward result of hidden units for a given neural network, and N, indicates the output shape.
147 V = (1), .......,N,,,
148
149
150
We now make the minimal modification of the forward propagation of SplitNN while leaving the rest part unchanged. Denoted by Forward-R'e RLU() the feedforward result of neural network by replacing the activation functions of the guest's output layer with R.eLU. Then the feedforward result transmitted to the host should be a = Forward-RR RU 03). Next, the host executes pre- defined aggregation procedure taking as input a and a². Finally, the loss function will be evaluated by ([FForrardRR'eLUj 0²), Forward(o" )²), g*). Algorithm || in the appendix integrates the above forward propagation using R8eLU into SplitNN.
152
153
154
155
196
157
156
3.3
Prreacy-ressrving Backward Propagation
159
According to recent studies of privacy leakage in backward propagation 22 31 g) model updating
160
information may cause severe leakage of private training data. Since the partial loss will be propa- gated to the guest in SplitNN, it is crucial to protect the host's privacy from being disclosed. Fortu- nately, our RoLLU is adaptable to noisy partial losses and we design RD LUU--iffff in a randomized-
162

---

163
response manner for the derivative of R*eLU as
Rd ReLLU-Diff(8', a², 00) 89 x ReLU-Diff( a², v9) + x', with probability (1 p);
0, with probability p.
184
Noting that the derivative value of ReLU for any imput either one or zero, randomly flipping the derivative value may still disclose 8. when value ones are not flipped. Therefore, we integrate Laplace mechanism into the R ReeLU- Please also note that the constructions of R'eLU-Diff and eLU are in similar way. This is helpful to obtain uniform analysis results of two parties, which will be shown in the privacy analysis part.
165
186
Rd
188
We sketch the backward propagation using Rd RLULU-fiff in Algorithm 2 in the appendix. Briefly, when the t-th backward propagation begins, the host calculates the partial loss 8t V [(l, a, 0 for 0 regarding the total loss I obtained in forward propagation, where á is the averaged activation result. Then Backward() R.. RN procedure calculates the gradients of model parameters, where N, is the shape of parameters. To update the guest model, the host sends partial loss 8 for 174 0 to the guest. To preserve the host's 's privacy within 8", we disturb the partial loss 8 propagating
169
170
172
175 to the guest and keep the partial loss on the host side unchanged.
176
3.4
Dynamic Privacy Budget Allocation
177
has been proved that the importance of a parameter can be quantified by the error introduced when is removed from the model [28]] Thus, we define the importance 1, of given SplitNN parameter
178
8 0 as the squared difference of prediction errors caused by removing B,.
1 (C(x, 0) [(x, 0 (0,)))²
(4)
180 Due to the consideration of efficiency, is suggested in (28] to estimating the importance by a first-order Taylor expansion approximately. Then the importance of 0y is estimated as
181
i, (9) 0,)²,
(5)
where gy is the gradient of the parameter 0, regarding a specific sample when O is well-trained. Given parameter importance, the importance of features can be derived further. Specifically, the importance of a neuron (or a feature) Uj. j E Na). where N,, is the total number of neurons in the model, can be calculated as a joint importance of relevant parameters by summing up the importance of all relevant parameters. Hence, U, = Eo,ed, Tk. where 0, denotes the set of all parameters directly connected to the j-th neuron.
183
184
185
186
187
However, the above importance estimation method is designed for well-trained model and cannot be directly applied to intermediate models during training. To tackle this problem, we give a dynamic estimation method by deriving the original method into a cumulative form. The importance of a
189
190
191
feature will accumulated as the training epoch increases. Specifically, the importance the j-th
192
feature in the q-th training epoch
U7 Eeco, In U x (q x [T/md] + (1 mod ni) - 1)
(6)
9 x [T/n + (t mod n.)
193
where n, indicates the iteration number within a training epoch, T is the maximum training iteration number, and the current training iteration globally. Generally, we assume that T/n, ng: my E N, which also means that q E [1, nyy]- We give the importance estimation results of different neurons in Figure in the appendix, showing the correctness of our dynamic importance estimation method and the existence of unbalanced feature importance.
194
195
197
196
Given the parameter importance estimated dynamically, we are capable of allocating privacy budgets regarding different features. The intuition is to give larger budgets more important features while
199
200
smaller budgets less important ones. Before the g-th training epoch begins, estimate the feature importance vector U {UA, Ug..... U., J. Based on U, the corresponding privacy budget
to be allocated should be e, x US. E [u). And the total privacy budget for all features is
5

---

203 OF =
E Sz. On the other hand, we can also dynamically allocate privacy budgets for different iterations to optimize the total privacy budget further. Given the total privacy budget ér for all iterations, we assign the privacy budget e; = zे to the i-th iteration. Since Di=1 2
204
205
s er.
206
according to the sequential composition theory of differential privacy, we can still ensure that the whole training process achieves er-differential privacy.
207
3.5
Privacy Analysis
209
We will give the privacy analysis for the host and the guest respectively. In forward propagation, we recall that vº, 09, and aº are input features, model parameters, and activation results of the guest. According to the definition of R a should be randomly flipped with probability p. For
210
211
212
brevity, we denote by f() the evaluation of neural network before activation. Then the probability of observing any activation a, for given input v should be
213
f(0)
1 1-P exp(
-(() b
P(a. = 00p) = p (1 p)
exp(
dd = p+
25
b
2
000
1-p
1ag-
f(U)a)
P(a. > 0(6)
exp(
2h
b
214
Then we can give the following conclusion regarding the guest model. The proof is in the appendix.
Corollary 1. When forward propagation of the guest model is activated by ReeLU in split learning. the activation result is c-DP, given Laplace noise scale dg-
215
217
For a fine-gratn graingd privacy budget allocation, we introduce dynamic budget allocation in our solution. We now give the analysis of feature- -ppecifi privacy budget. Given the estimated feature importance vector
218
{U,, UU..U ....... U%, }. we allocate privacy budget e; eU each feature. Thus, if the be bounded by their privacy budgets, then the total privacy budget will be bounded. Denoted by b, and e; the noise parameter and bound of the i-th feature. Then we can
219
220
divergence of features
222
account the divergence of features
[a: f(m)el
P(a: > 0/0)
exp(
a; f(v's/
aa -ass-(
2c by
2b
< exp(
exp(
P(a: 0/v/)
1-P 2h
exp(
a. [()))
P(a: = 0/v)
+ L exp(
f(W)s
+ (e
20s S expl
by
P(a: = 0/w²)
p + eapp
[(0))
pt Pepppp
bi
6,
223
Basing on this result, we can conclude the following corollary. Corollary 2. In forward propagation with Ree.U,, the privacy budget of the i-th feature can be
224
bounded by if we choose b; to satisfy exp( 201) S exp(e::) Vp E [0,
225
The last analysis result of the guest is privacy budget allocation during the whole training stage. Since we have allocated ΣiE[I,N.] c; for all features, we directly conclude that each training
B is the sampling ratio of step is De-DP by following the privacy amplification theory, where N7 batch regarding the whole training dataset. Now we can give the total privacy budget of the whole
228
229
230
training stage using the strong composition theorem.
Corollary 3. The total privacy budget of the whole training process using ReeLU is (c 8
where o = 76 27 (2 7eT((""s11)
232
So far, we have given the privacy analysis from the guest perspective. Since we construct RäeLU and R eLU-Diff using the same way and same technique, these procedures have the same analysis result if choose the noise scale of host a og. In this way, we can conclude the following result for the host.
233
236
237
Corollary 4. In backward propagation with R ReeLU-Diff- the privacy budget of the host can be bounded by en if we choose σ% 0g. The total privacy budget of the host in the whole training
238
239
process is (e/, 8% -DP, where é/, = yeh 12T + Te -1) 1).

---

4
Evaluation
240
241
SplitNN solution from two aspects model usability and privacy loss. To be comprehensive, we will compare our solution with the baseline (without any protection) and the most relevant defense solutions, i.e., a primitive Laplace mechanism [S] and DPSGD (i]. the most well-known privacy-preserving deep learning solution, in the same setting. We will use the same fixed total privacy budget and the same split way (shown in the appendix) for all solutions. We adapt solutions into recommendation models using two real- world datasets, MovieLens (15). BookCrossing [40], and an image classification model using MNIST [20] dataset. The MovieLens 1-M dataset contains million ratings of 4,000 movies collected from 6,000 users and users' de- mographic information such as gender and age. The BookCrossing dataset includes 278,858 users' demographic information and 1, 1,149,780 ratings of ,77, books. The MNIST database has 70,000 handwriting image examples. We will use 32 batch size, a 0.01 learning rate and an Adam opti- mizer as default. Since different datasets and defense solutions may require various epochs for split learning, calculate the metrics when the learning converges, the privacy budget is drained. All experimental results are averaged across multiple runs.
We evaluate our
242
243
244
247
248
249
250
251
252
Table 2: Model usability results while preserving the privacy of the guest.
MovicLens
BookCrossing DPSGD
MNIST
Laplace
DPSGD
Ours
Laplace
Ours
Laplace
DPSGD
Ours
0.1
30.84%
32.29%
34.03%
57.02%
55.89%
58.18%
17.43%
30.21%
32.41
0.5
41.25%
43.69%
43.87% %
57.67%
56.14%
58.54%
27.33%
58.43%
60,38 %
1.0
48. 16%
49.09%
50.56%
58.02%
56.56%
58.42%
31.05%
75.58%
76.60 %
2.0
49.32%
50.38%
50.49%
58.74%
56.91%
59.24%
38.92%
92.90%
%
4.0
49.26%
50.86%
50.73%
59.01% %
57.16%
59.26%
95.37%
95.87% %
94.12%
Table 3: Model usability results while preserving the privacy of the host.
MovieLens
BookCrossing
MNIST
Laplace
DPSGD
Ours
Laplace
DPSGG
Ours
Laplace
DPSGD
Ours
0.1
31.47%
30.68%
33.98%
57.37%
57.46%
58.26%
27.64%
33.45%
32.36%
0.5
41.75%
42.31%
42.67%
58.62%
58.24%
58.59
55.38%
65.28%
67.83%
1.0
47.43%
48.29%
50.39%
59.49%
58.44%
59.77%
71.95%
89.74%
18.14%
2.0
49.86%
50.43%
51.47%
59.34%
59.97%
60.27%
89.15%
92.66%
92.52%
4.0
49.57%
50.09%
51.62%
59.55%
60.75%
60.66%
94.61%
95.37%
95.01%
254
255
4.1
Model Usability
256
Since artificial perturbation may affect the learning procedure, we will evaluate how SplitNN is affected by
257
solutions. Moreover, two asymmetric parties of SplitNN may have different privacy concerns and affect learning differently. Thus, we will evaluate model usability concerning privacy from the perspective of the guest or the host, We use an averaged test accuracy
258
259
across all test samples for the evaluation. Precisely, the test accuracy of a recommendation model is calculated using a top-10 10 hit ratio, while the test accuracy of an image classifier is the prediction accuracy. In Table 2 and Table 3 we show the model usability results regarding various privacy budget values of two parties. We note that model accuracy baselines of Movielens, BookCrossing, and MNIST are 56.62%, 61.70% and 98.00%, respectively.
262
263
264
For the MovieLens model, solution achieves the best model usability in most cases, especially with less privacy budget. DPSGD has a better result when cause a significant privacy leakage in this case. For the BookCrossing model, the model usability of our solution is relatively high in cases of protecting the guest and the host. Similarly, DPSGD has better result when c = 4 for the host, sacrificing the privacy guarantee. Things are a bit different for
for the guest. But DPSGD will
268
269
270
the MNIST model. DPSGD gets some better results when protecting the host. The reason that split learning for an image classification model segments image samples roughly, making our dynamic budget allocation approach malfunction. Meanwhile, DPSGD is not designed for protecting partial
271
272
loss in SplitNN, leading to optimistic estimation of the threat against the host. Apart from these exceptional cases, our solution outperforms other solutions on model usability.
274
7

---

275
4.2
Defense Against Inference and Reconstruction Attacks
276
We will evaluate the performance of privacy preservation by comparing attack results against SplitNN with and without the defense. We will mount property inference and data reconstruction attacks against the guest and the host, respectively. Prediction accuracy of the adversary's s inference
277
278
279
model will be used measure the performance of the property inference attack. As for the data re- construction attack, the adversary tries to generate data samples similar possible to the target's private data. In this case, we can use mean squared error (MSE) between a generated sample and a target data sample to measure the adversarial effect.
Table 4: Results of defending the guest against property inference attack.
MovieLens DPSGD
rossing
MNIST
Laplace
Ours
Laplace
DPSGD
Ours
Laplace
DPSGD
Ours
0.1
66.99%
71.71%
60.99%
54.76%
73.29%
55.78%
43.27%
53.95%
44.33%
0.5
66. 66.16%
74.23%
64.16%
54.97%
74.52%
56.33%
46.92%
54.23%
45.59 %
1.0
67.19%
78.65%
18%
55.03%
74.96%
58.65%
47.58%
54.26%
47.51 %
2.0
68.65%
73.06%
68.56%
54.85%
74.26%
58.14%
48.06 %
54.65%
52.87%
4.0
69.14%
76.18%
71.91%
54.92%
74.33%
60.76%
48.47 %
54.57%
55.73%
Table 5: Results of defending the host against property inference attack.
MovieLens
BookCrossing
MNIST
Laplace
DPSGD
Ours
Laplace
DPSGD
Ours
Laplace
DPSGD
Ours
0.1
33.46%
78.59%
51.86%
54.55%
74.35%
59.42%
60.34%
80.29%
%
0.5
53.46%
75.64%
51.89%
54.62%
74.36%
59.42%
59.82%
81.92%
49.71 %
1.0
53.46%
73.54%
52.75%
54.95%
74.39%
59.52%
59. .4%
82.80%
50.48% %
2.0
53.47%
75.05%
59.77%
54.40%
74.39%
58.13%
60.38%
88.88%
50.57
4.0
53.48% %
79.28%
56.52%
54.95%
74.39&
62.04%
60.62%
89.73%
50.47 %
282
283
Defense against property inference attack. We give evaluation results of the defensive effect of the guest and the host Table 4 and Table[5] respectively, inferring the property of users in MovieLens and BookCrossing and image patch in MNIST. The attack accuracy against baselines of Movie- Lens, BookCrossing, and MNIST models can achieve above 80%, 79%, and 94% by an adversarial host, 80%, 78%, and 57% by an adversarial guest, respectively. However, our SplitNN solution can effectively mitigate the adversarial effect during training and decrease the attack accuracy sig- nificantly. It should be noted that the primitive Laplace mechanism frustrates the inference attack badly because the artificial noise added by the mechanism is indiscriminate, leading to conspicuous damages to the model usability. Even so, our solution has significant advantages on Moviel ens and MNIST datasets. In contrast, the primitive Laplace mechanism cannot cover image classification cases, while DPSGD cannot defeat the attack.
284
288
289
290
291
292
Table 6: Results of defending the guest against data reconstruction attack.
MovieLenss
BookCrossing
MNIST
Laplace
DPSGD
Ours
Laplace
DPSGD
Ours
Laplace
DPSGD
Ours
0.1
0.2459
0.2455
0.3223
0.3216
0.2907
0.3329
1.8849
1,8885
2.0181
0.5
0,2453
0.2451
0.3222
0.3202
0.2902
0.3329
1.8024
1.8137
1.9875
1.0
0.2453
0.2451
0.3222
0.3202
0.2902
0.3221
1.7857
1.7509
1.9533
2.0
0.2452
0,2451
0.3222
0.3202
0.2902
0.3221
1.7336
1.7469
1.9391
4.0
0.2452
0.2451
0.3222
0.3202
0.2902
0.3221
1.7014
1.7440
1.9206
Defense against data reconstruction attack. We show the defense results against an adversarial host respectively. We note that the MSE is measured after the attack model has been trained sufficiently in all cases. The MSEs measured for the attack against baselines of MovieLens, BookCrossing, and MNIST models are 0.2412, 0.2629, and 0.9612
and adversarial guest in Table 6 and Table 7
297
298
by an adversarial host, 0.2369, 0.2402, and 1.6998 by an adversarial guest, respectively. Please note that these attack results against the baselines are frustrating because the reconstruction attack is hard
289
300
to succeed in the semi-hones setting. Meanwhile, data samples in two recommendation datasets are similar and embedded with the same feature vectors. This leads to similar reconstruction results and
301
similar MSEs. But we still conclude from the results that solution has dominant performance
in the defense against reconstruction attacks mounted by either side.
8

---

Table 7: Results of defending the host against data reconstruction attack.
MovieLens
BookCrossing
MNIST
Laplace
DPSGD
Ours
Laplace
DPSGD
Ours
Laplace
DPSGD
Ours
0.1
0.4032
0.2417
0.5486
0.4237
0.2758
0.5066
I.2887
1.0875
1.8257
0.5
0.4024
0.2419
0.5357
0.4222
0.2756
0,5149
1.2778
1.0685
1.7758
1.0
0.4008
0.2422
0.5285
0.4217
0.2743
0.5235
1.2602
1.0422
1.7528
2.0
0.3982
0.2421
0.5083
0.4214
0.2697
0,5150
1.2613
1.0333
1.7334
4.0
0.3960
0.2422
0.4819
0.4194
0.2683
0.5046
1.2549
0,9996
1.7262
304
Defense against feature space hijacking attacks (FSHA). Please note that property inference and data reconstruction attacks implemented in (29) hijack the learning objective, offering the adversary an advantage over the previous attacks we straightforwardly adapted from FL. In this setting, the malicious attacker trains generator using the split neural network as a discriminator during the trick to train the generator. Since the generating part critical to FSHA, we will focus on the defense against the reconstruction. If the generating part fails, the inference attack will be impossible. Here we give the defense results of the MNIST model because FSHA [29] is mainly evaluated using this dataset. We also evaluate our solution for other datasets against FSHA, and the results are given in the appendix. In Figure [ and Figure 2 give the reconstruction results of FHSA mounted by adversarial host and guest against target samples used in (29). The second row of two figures shows the results of FSHA against baselines. The following rows show that our solution can effectively preserve private data for both the guest and the host, even the privacy budget is relaxed to 4. More practical privacy budget values for defending
307
308
split learning process and uses a gradient-scalin
309
310
311
314
315
316
317
against FSHA are presented in the appendix.
JOH
9
2
3
3
6
7
0
4
9
2
3
4
6
7
Figure I:
Reconstruction results of FSHA against the guest's data the first row. The following
rows are attack results against the original SplitNN and our solution (e = 0.1, 1.0, 4.0), respectively.
2
7
2
2
3
3
3 3 3
2
2
2
2
3
3 3 3 3
Figure 2: Reconstruction results of FSHA against the host's 's data in the first row. The following rows are attack results against the original SplitNN and our solution (e 0.1, 1.0, 4.0), respectively.
Conclusion and Limitation
318
Our privacy-prese prreeerigg SplitNN solution, built upon a new activation function RdeLU and its deriva- tive ReeLU-Diff in randomized-responss manner, significantly reduces privacy leakage risk for both the guest and the host. We show that our solution can provide tight privacy budget for split learning through the privacy analysis. The model usability and privacy loss can be further balanced
321
322
323
by our dynamic privacy budget allocation. The experimental evaluation using different datasets shows that our solution outperforms the existing privacy-prese privacy-prseervng SplitNN solutions in model us-
324
325
ability and privacy protection. We note that our solution deals with property inference and data reconstruction attacks in a feature level, but clustering-basee label inference attack [8] is out of our reach, which is an interesting topic be studied in future work.

---

References
328
329
[1] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Tal- war, and Li Zhang. Deep learning with differential privacy. In ACM SIGSAC conference on computer and communications security, pages 308-318, 2016.
330
331
(2] Andrea Apicella, Francesco Donnarumma, Francesco Isgrò, and Roberto Prevete. A survey on modern trainable activation functions. Neural Networks, 2021.
333
334
[3] Eugene Bagdasaryan, Omid Poursaeed, and Vitaly Shmatikov. Differential privacy has dis- parate impact on model accuracy. Advances in Neural Information Processing Systems, 32: 15479-15488, 2019.
337
[4] Iker Ceballos, Vivek Sharma, Eduardo Mugica, Abhishek Singh, Alberto Roman, Praneeth Vepakomma, and Ramesh Raskar. Splitnn-driven vertical partitioning. arXiv preprint 2rXIv:2008.04137,220 20200
338
340
[5] Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foun- dations and Trends@ Theoretical Computer Science, pages 21 211-407, 2014.
341
342
[6] Ege Erdogan, Alptekin Kupcu, and A Ercument Cicek. Unsplit: Data-oblivious model in- version, model stealing, and label inference attacks against split learning. arXiv preprint arXiv:2108. 09033, 2021.
343
344
345
[7] Minghong Fang, Neil Zhenqiang Gong, and Jia Liu. Influence function based data poisoning attacks to top-n recommender systems. In Proceedings of The Web Conference, pages 3019- 3025. 2020.
346
347
[8]
Chong Fu, Xuhong Zhang, Shouling Ji, Jinyin Chen, Jingzheng Wu, Shanqing Guo, Jun Zhou, Alex X Liu, and Ting Wang. Label inference attacks against vertical federated learning. In USENIX Security Symposium, 2022.
349
350
[9] Karan Ganju, Qi Wang, Wei Yang, Carl A Gunter, and Nikita Borisov. Property inference attacks on fully connected neural networks using permutation invariant representations. In ACM SIGSAC conference on computer and communications security, pages 619-633, 2018.
352
353
354
[10]
Hongyang Gao, Lei Cai, and Shuiwang Ji. Adaptive convolutional relus. In AAAI Conference on Artificial Intelligence, volume 34, pages 3914-3921,200
356
Yansong Gao, Minki Kim, Sharif Abuadbba, Yeonjae Kim, Chandra Thapa, Kyuyeon Kim, Seyit A Camtep. Hyoungshick Kim, and Surya Nepal. End-to-end evaluation of federated learning and split learning for internet of things. In International Symposium Reliable Distributed Systems, pages 91-100, 2020.
357
360
[12] Ran -aaaddB-achrchh, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks encrypted data with high throughput and accuracy. In International conference on machine learning pages 201-210, 2016.
[13] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in neural information processing systems, pages 2672-2680, 2014.
363
364
385
366
[14] Otkrist Gupta and Ramesh Raskar. Distributed learning of deep neural network over multiple agents. Journal of Network and Computer Applications, 116:1-8, 2018.
367
368
[15] Attribution F Maxwell Harper and Joseph A Konstan. The movielens datasets: History and context. ACM Transactions on Interactive Intelligent Systems, 5(4), 2015.
389
[16] Xinlei He and Yang Zhang. Quantifying and mitigating privacy risks of contrastive learning. In ACM Conference Computer and Communications (acurity,22111
10

---

372
[17] Briland Hitaj. Giuseppe Ateniese, and Fernando Perez-Cruz, Deep models under the gan: in- formation leakage from collaborative deep learning. InACM SIGSAC Conference on Computer and Communications Security, pages 603-618, 2017.
373
374
375
[18] Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi ing attacks to deep learning based recommender systems. In Annual Network and Distributed System Security Symposium, 2021.
Li, Bin Liu, and Mingwei Xu, Data poison-
Xu.
376
377
378
[19] Juyong Kim, Yookoon Park, Gunhee Kim, and Sung Ju Hwang. Splitnet: Learning seman- tically split deep networks for parameter reduction and model parallelization. In International Conference Machine Learning, pages 1866-1874, 2017.
[20] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):227)
382
1998.
383
[21] Yang Liu, Zhuo Ma, Yilong Yang, Ximeng Liu, Jianfeng Ma, and Kui Ren. Revfrf: Enabling cross-domain random forest training with revocable federated learning. IEFE Transactions on Dependable and Secure Computing, 2021.
384
385
386
[22] Xinjian Luo, Yuncheng Wu, Xiaokui Xiao, and Beng Chin Ooi. Feature inference attack on model predictions in vertical federated learning. IEEE International Conference on Data Engineering, pages 181-192, 2021.
387
388
389
[23] Yunlong Mao, Wenbo Hong, Boyu Zhu, Zhifei Zhu, Yuan Zhang, and Sheng Zhong, Secure deep neural network models publishing against membership inference attacks via training task parallelism. IEEE Transactions Parallel and Distributed Systems, 2021.
380
[24] Yunlong Mao, Xinyu Yuan, Xinyang Zhao, and Sheng Zhong. Romoa: Robust model ag- gregation for the resistance of federated learning to model poisoning attacks. In European Symposium on Research in Computer Security, pages 476-496, 2021.
393
394
395
[25] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera Ar- cas. Communication-efffcientt learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273-1282,
396
397
398
[26] Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In IEEE Symposium on Security and Privacy, pages 691 691-706. IEEE, 2019.
399
400
[27]
Payman Mohassel and Yupeng Zhang. Secureml: A system for scalable privacy-preserving machine learning. In IEEE sympositmm security and privacy, pages 19-38 2017.
[28]
Pavlo Molchanov, Arun Mallya, Stephen Tyree, luri Frosio, and Jan Kautz. Importance esti- mation for neural network pruning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1127,,
404
405
406
[29]
Dario Pasquini, Giuseppe Ateniese, and Massimo Bernaschi. Unleashing the tiger: Inference attacks on split learning. ACM SIGSAC Conference on Computer and Communications Secu- rity, 2021.
407
408
409
[30] Ahmed Salem, Yang Zhang, Mathias Humbert, Mario Fritz, and Michael Backes. MI-leaks: Model and data independent membership inference attacks and defenses on machine learning models. In Annual Network and Distributed Systems Security Symposium, 2019.
410
411
412
[31] Ahmed Salem, Apratim Bhattacharya, Michael Backes, Mario Fritz, and Yang Zhang. Updates- leak: Data set inference and reconstruction attacks in online learning. In USENIX Security Symposium, pages 1291-1308, 2020.
414

---

415
[32]
Lichao Sun, Jianwei Qian, and Xun Chen. LDP-FL: practical private aggregation in feder- ated learning with local differential privacy. In International Joint Conference on Artificial Intelligence, pages 1571-1578, 2021.
416
417
418
[33] Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. Data poisoning attacks against federated learning systems. In European Symposium on Research in Computer Security, pages 480-501, 2020.
419
420
[34]
Praneeth Vepakomma, Otkrist Gupta, Tristan Swedish, and Ramesh Raskar. Split learn- ing for health: Distributed deep learning without sharing raw patient data. arXiv preprint PeXiv::812.0001 2018.
422
423
[35] Stanley L Warner. Randomized response: A survey technique for eliminating evasive answer bias. Journal of the American Statistical Association, 60(309):63-66 1965.
425
428
[36] Kang Wei, Jun Li, Ming Ding, Chuan Ma, Howard H Yang, Farhad Farokhi, Shi Jin, Tony QS Quek, and H Vincent Poor. Federated learning with differential privacy: Algorithms and per- formance analysis. IEEE Transactions Information Forensics and Security, 15:3454-3469, 2020.
429
430
[37] Ji Yang, Xinyang Yi, Derek Zhiyuan Cheng, Lichan Hong, Yang Li, Simon Xiaoming Wang, Taibai Xu, and Ed H Chi. Mixed negative sampling for learning two-tower neural networks in recommendations. In Proceedings of the Web Conference, pages 441 1444447,44 2020.
432
433
[38] Chengliang Zhang, Suyi Li, Junzhe Xia, Wei Wang, Feng Yan, and Yang Liu. Batchcrypt: Effi- cient homomorphic encryption for cross-silo federated learning. In USENIX Annual Technical Conference, 2020.
436
[39] Yin Zhang, Derek Zhiyuan Cheng, Tiansheng Yao, Xinyang Yi, Lichan Hong, and Ed Chi. model of two tales: Dual transfer learning framework for improved long-tail item recom- mendation. In Proceedings of the Web Conference, pages 2,20-2231,200
439
[40] Cai-Nicolas Ziegler, Sean McNee, Joseph Konstan, and Georg Lausen. Improving recom- mendation lists through topic diversification. In International Conference on World Wide Web, pages 22 22- 2005.
440
Checklist
442
443
The checklist follows the references. Please read the checklist guidelines carefully for information on how to answer these questions. For each question, change the default [TODO] [Yes]. [No]. or [N/A].
444
You are strongly encouraged to include justification to your answer, either by referencing the appropriate section of your paper or providing brief inline deseription. For example:
447
Did you include the license to the code and datasets? [Yes] See Section ??.
Did you include the license to the code and datasets? [No] The code and the data are proprictary.
449
450
Did you include the license to the code and datasets? [N/A]
451
Please do not modify the questions and only use the provided macros for your answers. Note that the
452
Checklist section does not count towards the page limit. In your paper, please delete this instructions
453
block and only keep the Checklist section heading above along with the questions/answers below.
454
For all authors...
455
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
456
(b) Did you describe the limitations of your work? [Yes]
12

---

458
(c) Did you discuss any potential negative societal impacts of your work? [N/A]
459
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
480
461
2. If you are including theoretical results...
462
(a) Did you state the full set of assumptions all theoretical results? [Yes]
(b) Did you include complete proof' of all theoretical results? [Yes]
464
3. If you ran experiments..
465
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or URI.)? [Yes]
467
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes]
488
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [Yes]
470
471
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes]
472
473
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
474
(a) If your work uses existing assets, did you cite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes]
476
(c) Did you include any new assets either in the supplemental material or as a URL? [No]
477
(d) Did you discuss whether and how consent was obtained from people whose data you'l re using/curating? [N/A]
479
480
(e) Did you discuss whether the data you are using/curating contains personally identifi- able information or offensive content? [N/A]
482
5. If you used crowdsoureing or conducted research with human subjects...
483
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
484
485
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A]
486
487
(c) Did you include the estimated hourly wage paid participants and the total amount spent participant compensation? [N/A]
13

---

A
Appendix
490
A.1
Split Leaning with R*eLU
We give the forward propagation procedure of SplitNN using our R'eLU Algorithm 1 and the backward propagation procedure of SplitNN using our R'eLU-Diff in Algorithm Ø The two algo- rithms supplementary materials for Section 3.2 and 3.3.
482
Algorithm 1: forward propagation with RºeLU
Input:
batch size N, data batch x9, xx,, encoded label y, training indicator I, noise scale Output: loss or prediction.
0h NO,, 1). 0 - NO,, 0r & 10,
// initiaal
Guest:
for i + to to do
D. + Embedding(a,):
end
4 +- [v] : v2 UN
a + Forward- eL 4 09)
// send a to the host
Host:
7 for i f to N do of + Embedding(
end
{0î vhy .... uN a Forward( hh )h)
// wait for a from the guest
t Average(a aa a²))
6 Forward dl a, 0%)
14 if I = Irain then
15
loss < L(o y)
// training
else
pred + Sof 2oftmaz(o"")
// predicting
18 end
Algorithm 2: backward propagation with ReeLU-Diff
Input:
batch size N, feature vectors 29, oh, forward results a a² a, total loss 1, encoded label y, learning rate 178, n 1yat clipping bound C, noise scale a. updated parameters 0.+1. 0h 0. 0.
Output:
Host:
8 + C(,, a, 0
g + Backward($ 8h a 0
5 L6r a 0%), 5a + V av L(6", a² 0.)
g Backward 8h w 0%)
g EIEL gh l
1 EiELL, g/
0 + 0 g
hh - 0. 1 g
// host updates
7 8a - 8 max(1, 18'111)
5- t R² BLU- ALU-Diff(O' a v9)
// send 5 to the guest
Guest:
9 - + Backward 80 09,0%) 0!)
10 g: t N E 1. D.
0
i+1 0% g6
// guest updates
14

---

494
A.2
Privacy Analysis
485
Here we give the proof of our Corollary in detail for the privacy analysis in Section 3.5.
496 Proof. Without loss of generality, we assume an activation result {a= a2 = 0, .... ag
ao+1 O,...,a.. aN, 0}. Then the difference of activations for two neighboring feature vectors v' can be bounded by
P(ale) P(ak"")
p+ L exp(
No
L expl exp(- )
i=1 p - exp(
20 exp(
10++
pexp(
L exp( [e'' [[(h)])
p eepp( [(("')=l)
+ -
2
N.
a: - [(v))()))))) (1'')s=== - le - MWلما
II 100+1
exp(
p pexp [o'h) d expl [il
[(('): [(V)a
exp
pexp |
b
pexpl [f exp( fiwhl بa exp( -
pexp( | exp( | +
1
1=1
II exp( [((()) ) (i-s-oo f(o)x))
N, II exp( #0011
[f('')-
1=1 p pexp Rel'l -1oo)d
1-p 2
We assume [f(e),) S Cg and b <
then the RHS
14p
II exp( [f((') - i=0+1
2
pexp
N
ff('), - f(o)al)
exp(
exp(
1=0+1
1+2
Af
expl
exp(
=
b
exp(c)
Thus, we have Ns( S2
In( ()
له =
500
501
A.3
Evaluation of Dynamic Parameter Importance Estimation
502
Additionally, we evaluate the effectiveness of our feature importance estimation method and give the result here. We compare the estimating results between parameter importance estimated in the model's finally stable state and parameter importance estimated in our dynamic manner. The result is shown in Figure 3 We can conclude from the result that our dynamic parameter importance estimation approach can achieve desirable effectiveness.
503
504
506
507
We aim to estimate the importance of parameters precisely during privacy-preserving split learning. But it is difficult to get the same result with the estimation in a non-perturbed case. By carefully
508
509
constructing the dynamic estimation method, we can obtain dynamic estimation results of noisy pa-
rameters quite close to a baseline estimation result in the stable state without any privacy protection. In Figure 4 we show the result of our dynamic importance estimation approach. We can find that
15

---

stable estimation
035
dynamic estimation
0.030
importance
0.020
0.015
0.010
0.005
Am
0.000
32
64
112
128
neuron
Figure Comparison of parameter importance estimation results.
512 artificial noise introduced by our preserving SplitNN solution will affect the estimation of 513 parameter importance. But the growth tendency keep same as the baseline. This is good enough for since use the proportionality factor of each parameter to calculate the budget allocation, which will not be influenced by the magnitude.
-7
Baseline
Baseline Noise
Noise
-8
88
-9
-10
-9-
-11
0
10
20
20
30
epach
epoch
Figure 4: Importance of noisy parameters estimated dynamically in logarithm.
516 A.4
Supplementary Results for Evaluation
The neural networks used for the MovieLens, BookCrossing, and MNIST datasets after split shown in Tab g Table g and Table [TC These networks are commonly used in related studies. We
split them according to the interpretation of SplitNN in (4. 11. 22)
519
Guest Layer
Output Shape
Param #
Linear(160,, R28)
(None,
20608
Host Layer
Output Shape (None, 128)
Param # 20608
Linear( (100, RReLU
Merge Guest
Linear( 128, RReL
(None, 128)
16512
Linear( (8. (8.66))
(None,64) 64)
8256
(N0ne,3952)
256880
Table 8: The MovieLens model.
520 To further investigate how our solution affects the learning process of SplitNN, we report learning
521 results of Movielens recommendation model protecting the privacy of the guest and the host
522 in Figure and 6 respectively. In each plot, we show trends of training loss, training accuracy, and testing accuracy the training epoch increases. We can conclude from these figures that our solution achieve satisfying model usability with small privacy budget for either side of SplitNN.
16

---

Guest Layer (inear([60,128))RRel)
Output Shape (None,128)
Param # 20608
Host Layer
Output Shape
Param # 20608
(None, 128)
Merge Guest
Linear( (anear(118,2555) +ReLL
(None,256)
33024
Linear( 256, 125,118)++eLUU
(None, 128)
32896
Linear( (1 17344
(None, 10)
2242536
Table 9: The BookCrossing model.
Guest Layer
Output Shape (None,128) (None, 128) (None,64)
Param #
Linear(28* (inear(281141122)) 128)
50304
BatchNonm++eo
Linear(1288) 128,64)
8256
Host Layer 14,
Output Shape
Param #
(None, 128)
50304
BatchNNorm+ReLUU
(None, 128)
Linear( 64)
(None,64)
8256
BatchNorm-RRLLU
(None,64)
Merge Guest
Linear(64,644
(None,64)
4160
BatchNorm+RRl.UU
(None,64)
(None,10)
650
Table 10: The MNIST model.
525
We notice that FSHA is sensitive to our privacy-preserving SplitNN solution. In Figure ① and Fig- we find that neither an adversarial host nor an adversarial guest can reconstruct meaningful samples, even if the target's privacy budget is e 4. Therefore, we are curious about practical choice of the privacy budget when dealing with FSHA. To this end, give more defense results of our solution against FSHA using various privacy budget values in Table [ We can conclude from the MSE results that two recommendation models prefer relatively low privacy budget, such
526
527
530
531
as 1.0. However, is interesting to see that FSHA attack against an image classification model
532
using SplitNN can frustrated by our solution using relatively high privacy budget, which also means high model usability.
Table 11: Defense results against FSHA mounted by an adversarial host.
MovieLens
BookCrossing
MNIST
baseline
Ours
baseline
Ours
baseline
Ours
1200 Epochs
5000 Epochs
1200 Epochs
5000 Epochs
9000) Epochs
9000 Epochs
0.1
455.5676
500.1487
1.98257
0.25
73.7824
83.7606
1.9788
0.5
21.1706
30.2905
1.9703
0.75
9,5312
8.5984
1.9534
1.0
0.2652 x10
4.4903
0.2365 x00
6.1267
0.0206
1.9442
2.0
1.1559
1.7047
1.9283
4.0
0.2719
0,2478
1.9209
6.0
0.1091
0.1638
1.9135
8.0
0.0975
0.0846
1.9116
533
17

---

Wedi el 4po-20.
8
bidlig
24
23
Opacs
Ldech
1200
Figure 5: SplitNN learning curve with the guest's privacy protected by solution.
Jelli SIVEE 606-6.1
Ar30 Silssiraeeeeeo 1.5
SKWWY 1pt-10.
8
35
X6
team
1300
Figure 6: SplitNN learning curve with the host's privacy protected by solution.
18


Reviews:
[{"review_id": "borggl_rbC", "reviewer": "Reviewer_Nq3T", "summary": "The paper investigates adversarial effects of property inference and data reconstruction attacks in the setting of split learning for features partitioned vertically. To defend against such attacks, the paper proposes a privacy-preserving technique that involves adding noise in the ReLU activation during the forward and backward propagation steps in the split learning protocol. In addition, it proposes a dynamic allocation of the privacy budget through estimating the importance of features.  \n", "questions": "Q1. Why is the influence estimation of single features considered and not the combination of features? I.e., could it be that the single feature change might not have an influence on the output but that a combination of features is particularly vulnerable? In this case, why did you consider single feature influence estimation?\n\nQ2. Why is DPSGD much worse at defending against property inference attacks than the Laplace or your proposed solution (e.g., in Table 4 and Table 5 there are almost 20% differences in prediction accuracy for BookCrossing and more than 30% for MNIST)?\n\nQ3. Does it make sense to evaluate the data reconstruction attack using MSE? At least for MNIST, should we be looking at measures of visual similarity, e.g., Frechet distance?\n\nQ4. What is the baseline mechanism used for Laplace? Does it refer to applying the perturbation without the fine-grained analysis? It is not mentioned in the evaluation.\n\nQ5. Why does the property inference attack by the adversarial host have a much higher 94% accuracy on MNIST compared to the 57% accuracy by the adversarial guest?\n\nQ6. What do you mean by “that these attack results against the baselines are frustrating because the reconstruction attack is hard..” or “ … primitive Laplace mechanism frustrates the inference attack…” (perhaps deteriorates/inhibits the attack accuracy?)?", "limitations": "None", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The paper tackles a new topic in split learning. Overall, I found the paper clear and significant, though there were some unnatural phrasings here and there and some typos. The paper offers an original approach to privacy-preserving split learning but the evaluation could be more insightful and explain a bit more certain phenomena (see Questions). \n\n**Strengths**\n\nS1. The proposed technique is privacy-preserving, based on the formal guarantee of differential privacy.\n\nS2. Interesting technique to apply the perturbation at the activation level and propose $R^3eLU$.\n\nS3. The paper argues in the evaluation section from the perspective of better defenses against adversarial attacks, which both improve with the Laplace mechanism.\n\n**Weaknesses**\n\nW1. The evaluation results are not that impressive in terms of the model utility (the utility is up to 2% better compared to DPSGD), though they are better with the fine-grained analysis (Ours in Table 2 and 3). It seems that for these datasets even DPSGD comes pretty close to the baseline training (no privacy) of SplitNN. \n\nW2. Not clear what the overhead (in performance) is for the dynamic budget allocation (if any) over baseline (no privacy).\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "BVxRedNdDA", "reviewer": "Reviewer_QQtJ", "summary": "This paper presents a way to improve privacy in split learning by constructing a privacy-tunnel between the host and the guest. This is done by using a new activation function called R3eLU, which responds to forward and backward passes in a randomized manner. The noise added to the activation through this activation function provides differential privacy on the activations and its gradients . The proposal is evaluated on recommendation and classification models to show that it improves the utility-privacy tradeoff of split-NNs.", "questions": "1. Privacy Amplification: The analysis presented in the paper assumes that the random sampling in SplitNN provides a privacy amplification of B/N. My understanding is that privacy amplification by subsampling requires the input-ids to be unknown to the host. However, the guest needs to share the input-id of the samples in the batch with the host to coordinate the training. Can you comment on this?", "limitations": "The paper discusses the limitations of the proposed defense.", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strength\n\n1. The idea of using a randomized activation function to add noise during forward and backward propagation to provide DP is interesting.\n2. The idea seems to provide better protection against property inference and reconstruction attacks compared to other forms of noise addition (DPSGD and Laplace)\n\n\n \n## Weakness\n\n1. The writing in the evaluation section is unclear and is missing key details about the experimental setup.\n2. Property inference: It’s unclear what this means in the context of the paper. Is the adversary trying to infer additional attributes from the data? If so, what are these additional attributes for the datasets used in the results?\n3. How is DPSGD being applied to split learning?  Is the noise being applied to the embedding or the gradients shared during backpropagation or both?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "6dnHJUil9T", "reviewer": "Reviewer_Yh7T", "summary": "The authors present a differential privacy mech for training with split learning. Their method is based on a randomized response like mech applied to privatizing relu activations. ", "questions": "\n-Typically the privacy budgeting is about composition laws, or dealing with sampling with (repitition) replacement across batches for the same.\n- Why is your proposed budgeting based on perceived feature importance instead?\n", "limitations": "Please answer the concerns under questions and Weaknesses. That will help clarify whether those fall under limitations or not.", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n-Earliest of DP mechs for split learning\n- \n\nWeakness:\n\n-Typically the privacy budgeting is about composition laws, or dealing with sampling with (repitition) replacement across batches for the same.\n- Why is your proposed budgeting based on perceived feature importance instead?\n\n- For DP-SGD, typically the model weights as a query are a function of all of training data. As opposed to that in terms of making activations private, the query is 1 sample at a time. Each activation is a function of 1 sample. This brings it under a local dp like regime.\n- This needs to be stated along with reasoning of why the proposed method is comparable with DP-SGD in terms of privacy models or paradigms.\n\nMinor/typo: Change Split Leaning to Split Learning in A.1 \n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Reject