Privacy-Preserving Split Learning with Vision Transformers using Patch-Wise Random and Noisy CutMix
Authors: Seungeun Oh
Sihun Baek
Jihong Park
Hyelin Nam
Praneeth Vepakomma
Ramesh Raskar
Mehdi Bennis
Seong-Lyun Kim
Venue: Accepted by TMLR ()

Abstract: In computer vision, the vision transformer (ViT) has increasingly superseded the convolutional neural network (CNN) for improved accuracy and robustness. However, ViT's large model sizes and high sample complexity make it difficult to train on resource-constrained edge devices. Split learning (SL) emerges as a viable solution, leveraging server-side resources to train ViTs while utilizing private data from distributed devices. However, SL requires additional information exchange for weight updates between the device and the server, which can be exposed to various attacks on private training data. To mitigate the risk of data breaches in classification tasks, inspired from the CutMix regularization, we propose a novel privacy-preserving SL framework that injects Gaussian noise into smashed data and mixes randomly chosen patches of smashed data across clients, coined DP-CutMixSL. Our analysis demonstrates that DP-CutMixSL is a differentially private (DP) mechanism that strengthens privacy protection against membership inference attacks during forward propagation. Through simulations, we show that DP-CutMixSL improves privacy protection against membership inference attacks, reconstruction attacks, and label inference attacks, while also improving accuracy compared to DP-SL and DP-MixSL.

Published in Transactions on Machine Learning Research (08/2024)
Privacy-Preserving Split Learning with Vision Transformers using Patch-Wise Random and Noisy CutMix
Seungeun Oh
seoh
Yonsei University
Sihun Back Duke University
sihun.backkttee edu
Jihong Park Singapore University of Technology and Design
jihong park@sutd.cdu....m
Hyelin Nam
hlnam @ramo Aham@rumo.yonsch oc.kr
Yonsei University
Praneeth Vepakomma
sapakom@@itz edu
MBZUAI and Massachusetts Institute of Technology
Ramesh Raskar
ruskor@media. mit edu
Massachusetts Institute Technologg
Mehdi Bennis University of Oulu
mehdi. Bonfd
Seong-Lyun Kim Yonsei University
slkim slkim@@yonse..cck
Reviewed on OpenReview: https: // openreview. net/ forum? id- 4bo6XAnutd
Abstract
In computer vision, the vision transformer (ViT) has increasingly superseded the convolutional neural network (CNN) for improved accuracy and robustness. However, ViT's large model sizes and high sample complexity make it difficult to train on resouroe-constrained edge devices. Split learning (SL) emerges as viable solution, leveraging server-side resources to train ViTs while utilizing private data from distributed devices. However, SL requires additional information exchange for weight updates between the device and the server, which can be exposed to various attacks on private training data. To mitigate the risk of data breaches in classification lasks, inspired from the CutMix regularization ion, we propose a novel privacy-prseerve SL framework that injects Gaussian noise into smashed data and mixes randomly chosen patches of smashed data across clients, coinod OP-CutMinSL. differentially private (DP) mechanism
Our analysis demonstrates that MixSL that strengthens privacy protection against membership inference attacks during forward propagation. Through simulations, show that DP-CutMixSS improves privacy protection against membership inference attacks, reconstruction attacks, and label inference attacks, while also improving accuracy compared to DP-SL and DP-MixST.
*Corresponding author

---

Published in Transactions on Machine Learning Research (08/2024)
client
server
eagle
noisy random
eagle
CutMix
dog
clienta
mixer
dog
Figure 1: Schematic illustration of DP- with 2 clients.
1 Introduction
Transformer architecture has originally been developed in the domain of natural language processing (NLP) Vaswani et al. (017), and its application has recently been extended to various domains including speech recognition (Karita ct al. 2019) and computer vision (CV) (Dosovitskiy et al. 2020b). In particular, the vision transformer (ViT) has recently been the new standard archilecture in CV, succeeded to the convolutional neural network (CNN) architecture. VIT operations are summarized in two steps: 1) the first step to dividing image data into multiple image patches, and 2) the second step learning the relationship between the patches under the encoder of the transformer. The latter step, dubbed the self-attentin ief-aattention mechanism, helps achieve high performance
large datasets, but causes performance degradation on small datasets. Hence, securing large-scale datasets in VIT is essential yet challenging, especially in distributed learning scenarios where huge data is dispersed to multiple clients with limited computing capability (Khan et al. 2021 Han et al. 2022) Federated learning (FL) is a promising solution in terms of enjoying these scattered data and computing resources [Li et al. 2020 Kairouz et al. 2021). h. In FL, each client trains a local model to be uploaded to the server with their own dataset, while the server yields the global model by taking the weighted average of the local models, leading data diversity gain without direct data exchange. However, FL, which requires training the entire model the client, is not suitable for ViT, which has heavy computational burden and requires large memory due to its large model size.
To address this, split learning (SL) can be an alternative solution (Gupta and Raskar 2018 Vepakomma et al. 2018). In this approach, an arbitrary single layer of the entire ViT model is defined as a cut- cut-layer. The entire ViT model is then divided into a lower model segment and an upper model segment based on this cut-layer, with each segment stored on the client and server, respectively. During training in this model-split. architecture, the client uploads the output from the cut-layer, referred as smashed data, during forward propagation and downloads the corresponding gradient during back propagation. However, this exchange of information between the client and server can lead to privacy leakage. Unfortunately, the privacy leakage of ViT, to be shown in Figure 2al is expected to be more severe than that of CNN, due to the absence of a pooling layer in VIT.
To this end, we propose a novel distributed learning framework for VIT, coined DP- CP-tutM that is differentially private (DP) under the Parallel SI. architecture. As depicted in Figure 1 each client of DP- CutMixSL uploads a portion of the smashed data according to the CutMix regularization (Yun et al., 2019 with additive Gaussian noise. Then, novel entity, the mizer, combines these CutMixed noisy smashed data to generate the MisSu's smashed data and propagates it to the server. By doing so, MiXCL gains in terms of robustness against various privacy attacks compared to uploading the smashed data itself. Specifically, we prove the effectiveness of DP-CutMixSL, in protecting privacy against membership inference attack (Shokri et al.] 2017 Rahman et al., 2018) and model inversion attack or reconstruction attack (He ct al. 2019) in forward propagation, both theoretically and experimentally. In addition, we experimentally show the privacy guarantee for label inference attack (Li et al., 2021 Yang al.) (002)) in back propagation and demonstrate that high accuracy is also achieved thanks to the regularization effect of CutMix.
2

---

Published in Transactions on Machine Learning Research (08/2024)
Contributions.
The key contributions of this article are summarized follows
Inspired by CutMix, we propose new ST.-based architecture named MixCL aiming to improve privacy guarantee of VIT. In this process, we introduce an entity called mixer on a network consisting of client-server, and outline its specific operations.
We theoretically derive the privacy guaranlee of DP-CutMixSL against membership inference attacks through DP analysis and experimentally demonstrate it. Through experiments, we verify that DP-CutMixST is robust against reconstruction attack and label inference attack.
In addition, we show that MP-CutMixSL outperforms basclines such as Parallel SL in terms of accuracy via numerical evaluation.
2 Related Works
Vision Transformers. The transformer architecture first used in the NLP field (Vaswani et al. 2017);
,
where its core operation is rooted on self-attention mechanism as well encoder structure with multi-layer perceptron (MLP) and residual connection. In NLP, such hansformer-baset architecture is extended from Bidirectional Encoder Representations from Transformers (BERT) (Devlin et al. 2018), Generative Pre- trained Transformer (GPT) (Radford et al. 2018) to GPT-2 Radford et al. (2019) GPT-3 (Brown et al.) 2020). This paradigm shift from CNN to transformer has reached out to the CV field. VIT, proposed in Dosovitskiy et al. (2020a), is the first of its kind to apply the transformer architecture to the CV field. ViT transforms an input image into a scries of image patches, just as a transformer embeds words text, and learns relationships between image patches, thereby a large-scale dataset is indispensible. This ViT operation enables to extract global spatial information, leading to its robustness against information loss such as patch drop and image shuffling compared to CNN (Naseer et al. 2021
If most of the VIT works are based on the centralized method CCarion et. al. 2020 Zheng et al. 2021
Chen et al., 2021). several studies have conducted research on distributed implementation of transformer or VIT (Hong et al. 2021 Park et al.) 2021b Qu et al. 2021). Hong et al. 2021 has designed FL- based transformer structure targeting text to specch task, while Qu et al. (2021) has explored the performance of
FI. in ViT when data are heterogeneous. To diagnose COVID-19, Park et al. (202bb) proposed ST--base architecture in VIT, benefiting from its robustness task-agnostic training.
Federated & Split. Learning. The key element of the distributed learning framework is to utilize raw data and computing resources spread across the sheer amount of Internet-of-Thin Thiinng (loT) devices clients. As the first kind of this, FL enables to acquire data diversity gain through exchanging model parameters (Li let al. 2020 Kairouz et al. 2021 FL's model parameter aggregation does not induce data privacy leakage, and what is more, it ensures scalability in terms of increasing accuracy with the number of participating clients (Konečný et al.
2015 Park et al. 2021a). Nevertheless, FL has a trouble in running a large-size model, constrained by its limited client-side computation and communication resources, highlighting the need for alternative solutions (Konečný et al., 2016 Singh et al., 2019). To this end, SL has appeared as enabler for large model operation by splitting the entire model into two partitions (Gupta and Raskar 2018 Vepakomima et al. 2018 Gao et al. 2020). The initial implementation of SL, which is based on sequential method, used to result in large latency especially with many clients, giving rise to the research on Parallel SL free from this problem. SFL, a combination of FL and SL, is the first form of Parallel SL, allowing simultancous access by multiple clients (Thapa el al.] 2020a by Gao al.) 2021). One step further, Pal et al. (2021). Oh et al. (2022b), and Oh et al. (2023) try address the low accuracy, communication efficiency, and scalability of SFL.
Privacy Attacks & Differential Privacy. As machine learning develops rapidly, several types of privacy attacks have emerged whose goal is to extract information about training data, labels the model
This work is extended version of both our previous workshop papers Back al. 2022 Oh 2022a with the addition of extensive experiments involving label inference attacks and an analysis the subsampled mechanism.
3

---

Published in Transactions on Machine Learning Research (08/2024)
itself. In particular, regarding the privacy attack on distributed learning, Nasr et al. (0018) shows the membership inference attack of an adversary with some auxiliary information on the training data. He et al.] (2019) investigates the reconstruction attack occurring on the inference phase of vanilla SL under white-box and black-box settings, while Oh et al.] (2022b) measures it emprically on the Parallel SL structure. In addition, for label inference attacks in vanilla SI, Li et al. (2021) handles norm-based and direction-based attacks under black-box setting, and Yang et al. (2022) deals with white-box attacks and GradPerturb as a solution for them.
Accordingly, many studies have been conducted to protect information from various privacy attacks. One line of works first introduced the application of DP analysis technique to deep learning models (Dwork) 2008 Abadi et al.] 2016). PixeIDP, designed for SFL, is proposed as DP-based defence to adversarial examples,
providing certified robustness to AI/ML models, while Wu et al. (002) applies the concept of DP to FL. Furthermore, Lowy and Razaviyayn (2021) defined record-level DP for practical use in cross-silo FL and invorstigated privacy protection between silos and the server. Mcanwhile, Reńyi DP (RDP) is presented to facilitate the composition between heterogeneous mechanisms while providing light bounds with fewer computations (Mironov
2017
Such diffcrential privacy (DP) or Rényi differential privacy (RDP) bounds can be tightened via subsam-
pling (Balle et al. 2018 and shuffling (Erlingsson et al. 2019) In particular, Yao et al. (2022) and Xu et al. (2024) provide experimental and theoretical studies on privacy-preserving split learning via patch shufiling on transformer structures. However, both studies are limited to single-client scenarios and do not address multi-client parallel computation or accuracy improvement in data-limited environments. Another method for privacy amplification is Mixup (Zhang et al.! 2017 Verma et al. 2019), , which leverages its inherent. distortion property (Koda et al. 202 Borgnia et al. 2021 Lee et al. 2019 In this context, our research exploits techniques for multi-user ViT by utilizing DP and CutMix, which inherently involve the concept of subsampling and present potential challenges when combined with shuffling.
3 Motivation: Privacy-Preserving Parallel SL in ViT
Consider a network with a set of clients C = {1, 2, ,n) nn and a single server. Here, let be the subscript for the client. The dataset of the i-th client is consisting of multiple tuples of input data x; and its one-hot encoded ground-truth label ye. We denote the i-th entire network as w, = [We,,, wa]"", where We,ss War and (.)T represent the i-th lower model segment, the upper model segment, and the transpose function, respectively.
Under the above setting, this section first revisits the Parallel SL operation on VIT. For the sake of convenience, we assume that the cut-layer is located between the embedding layer and the transformer in the ViT structure. This allows each i-th client to transform x; into s; consisting of multiple patches via Was. Then for all i, the i-th client sends 8;, which is referred to as smashed data, to the server, followed by FP through w, at the server, resulting in loss Li. During the BP phase of Parallel SL, the server updates w, based on aggregated losses Eiec L, and sends cut-layer gradients to clients, who then update their respective We,i-
By doing so, Parallel SL. enables the client to efficiently offload the upper segment of the VIT to the server, which can be computationally expensive to run in its entirety, while still benefiting from exploring distributed data. However, Parallel SL with ViT has the following fundamental characteristics compared to it with CNN, as organized in Figure 2 which ultimately requires a solution considering these differences.
1) Absence of Pooting Layer: While CNNs typically include a pooling layer, ViTss often omit pooling layers, except in variants like the pooling- based ViT (PiT) (Heo et al. 2021b). Conversely, dropout layers in ViTs can impact the smashed data, whereas in CNNs, dropout layers usually affect the dense layers, leaving the carlier fcature maps unchanged. When considering both pooling and dropout layers, the size of the smashed data changes significantly. For instance, using a 28 x 28 image, a 2 x 2 pooling layer with a stride of 2 reduces the data size to 25% of the original, whereas a dropout layer with a rate of 0.1 retains 90% of the data size without changing the spatial dimensions. This comparison highlights the difference in distortion levels between CNNs and ViTs, implying significant privacy leakage in ViTs. On the bright side, this makes regularization on hidden representations more fruitful, just like regularization on input data.
4

---

Published in Transactions on Machine Learning Research (08/2024)
Trput now image
Smakhed data of Cut layer CNN
Smushed dats, Cut layer Vision Imnsoomer
(a) Effect of pooling layer.
Rocepinn tok loe:
Nae
Nei Lager
of Trassenne
ofCN
seguenes
(b) Size of receptive field.
(c) Pixel-wise and patch-wise process.
Figure 2: Comparison of CNN and ViT operation from various perspectives.
2) Large Receptive Field Size: A CNN with convolutional layer is specialized in catching local spatial information of an image, in other words, its recoptive field size is small. Conversely, the receptive field of ViT is large enough to learn global spatial information, with the help of its self-attention mechanism. Because of this, ViT is more suitable for producing generalized models compared to CNN, but large-scale datasets are required unleash the full potential of ViT due its low inductive bias (Baxter 2000 Data regularization address this largo-scale dataset requirement (Stciner et al. 2021
3) Patch-WWis Processing: Due to the large receptive field of ViTs, as described in 2), they exhibit robustness against significant noise applied to parts of the image, such as patch drops or image shuffling (Naseer et al.) 2021). Leveraging this inherent property, several studies (Yao et al. 2022 Xu et al. 2024 have attempted to design privacy-preservee
frameworks for ViTs using patch-wise permutation and shullling. Consequently, we intuitively infer that patch-wise operations may be more efficient for ViTs than pixel-wise operations in terms of both accuracy and privacy.
As highlighted in 1), smashed data in Parallel SL with ViT is vulnerable to privacy leakage. However, ViT's resilience to substantial noise in parts of the image, as observed in 2), paves the way for privacy-enhancing methods. In this context, CutMix regularization (Yun et al. 2019) emerges as a viable strategy where the client shares only a portion their image while the accuracy can be guaranteed. The only thing to address is modifying CutMix to work patch-wise, as suggested 3), which is covered in the next section. This patch- wise adaptation of CutMix, therefore, presents an integrated solution that aligns with the considerations from 1) to 3), exploiting ViT's structural traits while maintaining data privacy.
4 Proposed: Split Learning With Random CutMix for ViT
In this scction, we first propose Patch- Patch-Wise Random and Noisy CutMir (Random CutMix), aiming to improve VIT's privacy guarantee while still ensuring its accuracy. The key idea of Random Cutmix is that each client uploads a patch-wise fraction of the smashed data with additive Gaussian noise on top of the FP process in Parallel SL. Before getting into the details, we assume a network of client-mixor-serverr wherein the server is
with privacy attack on data and labels and the mixer trusted third party. The mixer be implemented through homomorphic encryption (Rivest. et al. 1978 Pereteanu et al. 2022
5

---

Published in Transactions on Machine Learning Research (08/2024)
2 Mixer
2 Clients
( Mixer
O
[4,2,) Bur(na))
Sead Mixer
Send Server
Server
Mixing
Mixer
Clients
Patch- Wise
Send Clleats
and Noiry UniMbii
Cleat
Clirs
Cliest
Cliak
Clical
Clisst
(a) Baseline 1: PSL.
(b) Beseline 2: SFL.
(c) Proposed: DP-CutMiASL.
Figure Structural comparison of (c) UP-CutMixSL with (a) Parallel SL (PSL) and (b) split foderated
learning (SFL. (Thapa al.] 2020b). (1) In DP-CulMixST, the mixer first calculates the i-th miaing ralio X following the symmetric dirichlet distribution (Bishop et al. 2007) with mask distribution aM- Depending
Ai the mixer creates the i-th mask M,, randomizing [ N out of a total of N patches. (2) The i-th client
after the client-side FP punches the smashed data based on M, and add Gaussian noise, which is then sent to the mixer. (3) The mixer consolidates the patch-wise randomly selected and noise-augmented smashed data received from clients, producing the smashed data of DP-CutMixSL with all patches intact. This is then transmitted the server for the remaining SL operations including server-side forward propagation process.
that enables enerypted computation on the server side or analog communication as in Koda al. 20221 Specifically, with homomorphic encryption, computation can be processed while preserving privacy. The client transmits homomorphically encrypted smashed data the server, which then processes the data and produces encrypted output mixer.
Consider a network with client number of 2. First, the mixer generates patch-wise mask M, with the given mask distribution am and sends it to the i-th client (i E {1,2)). After finishing the forward propagation process on the i-th lower model segment of SL with ViT, each client punches the smashed data s; based on the mask and adds random noise with Gaussian distribution it. The label of this determined by the ratio X of the number of patches in the smashed data punched by M, to the total number N of patches. Accordingly, the i-th client sends the following (;) pair to the server:
s; M, (s; n,.)),
y; =; (y: ny.a).
(1)
where ns and ny. are matrices for the random noise added to the smashed data and label, whose elements follow zero-mean Gaussian distribution with variances o² and oy respectively, and O an pixel-wise multipli- cation operator. Then, mixer aggregates (s, V.) generate the output of Random CutMix ($ 5] + $2, (1.2) = y1 V2) and sends it to server, yielding a loss T.(122 via server-side FP.
In the back propagation phase, when the mixer receives cut-layer gradient V [41.23 from the server, the mixer divides the gradient by client as shown in the following formula and sends it to each client:
V Van L(12) M1 Venne M, Varno L(2
(2)
V (Mi O [1121) Va (M₂ 3 L122))
gradient for client 1
gradient client
For a given gradient, each client and server updates the weights Wa,i, of the lower model segment and the upper model segment, completing a single round of differential private SL with Random CutMir (DP-CwMMaSLL.)
As shown in Equation 1 DP-CutMixSL's forward propagation, each client's smashod data randomly disclosed on a patch-by-pated basis with noise added to ensure the privacy guarantee for smashed data, and its back propagation similarly ensures the privacy guarantee for labels through the process shown in

---

Published in Transactions on Machine Learning Research (08/2024)
Equation 3 Furthermore, when defining the number of clients performing Random CutMix, so-called miring group size k I the aforementioned DP-Cut.MiSTI. can be considered as case where n = k 2, and observations on the performance of DP-CutMixSL for general k can be found in Appendix A Moreover, the detailed operation of Random CutMix and DP-CutMixSL is organized in Figure B and the pscudocode in Appendix C respectively.
5 Differential Privacy Analysis on Smashed Data
In this section, we theoretically analyze the differential privacy (DP) bound DP-CutMixSL and validate its effectiveness for privacy guarantoes. Unlike existing DP works that focus on the privacy guarantces of samples and labels, we conduct DP analysis from the perspective of smashed data, which is highly correlated with the sample particularly in ViT, and its labels. This is in the same context as analyzing the privacy leakage of model parameters gradient in FL. Note that in DP-CutMixSL, the component designed to safeguard against privacy breaches by leveraging trusted intermediary known as the mixer, and the component that introduces Gaussian noise, both adhere to the Central and Gaussian Differential Privacy configurations, respectively. the definition of Central DP (CDP) (Dwork et al. 2006) is organized as follows:
Definition 1 ((e,))-CDP). For & 2 0 and ô > 0, we say that a randomized mechanism M: : D + R is (ED if it satisfies the following inequality for any adjacent D,D' E D and U C R:
Pr(M(D) ( E U] +
(4)
At this point, a small indicates a high privacy level implying that one cannot distinguish whether D or D' used to produce an outcome of mochanism. Although CDP is widely used when analyzing Gaussian mechanisms, we also the Reáyi DP (RDP) (Mironov 2017), defined below, given the tractable interpretation of its composition rule:
Definition ((a,e)- R)-RD)). A randomized mechanism M: D + is said to have e-RDP of order a, or RDP for short, if for any adjacent D, D' E DD it holds that:
Dc(M(D))M()))
(5)
In addition, Mironov (2017) proves that every RDP mechanism is also (c, 6)-CDP, Especially in Mironov 2017)) when the mechanism is (a, RRDD,, then is (e + log(1/6) 8)DC for
1.
We consider scenario where each i-th client has one smashed data-label pair. Then, given the VIT's patch size of P, the full datasct the client side consists of clients' pairs of smashed data s; E P2 = R, and the corresponding label y; E IR- = D2 y is one-hot vector of size L, where N and C denote the nunber (Sn.))))) For ease of analysis, we assume that D. and y; E [0, Px,, respectively. Based on the above premise, we first perform the RDP analysis on a single epoch.
of patches and chamnels, respectively (D = ((11,)1)
and y; are normalized so that s; E [0, A
Table 1: Comparison of mechanism output and RDP bounds for DP-CutMixST, DP-MixSL and DP-ST.
Smashed Data
Label
Output
RDP Bounds
Output
RDP Bounds
DP-CutMixSL DP-MixSL
E (M, ① 0s: + ng.))
Amax (a) Amaz 2 (a))(a)
(A: . Yt + ny.s)
Amaz 2 (a,
i-1 (A; ss + no,s)
siml (Ai . yi + ny.s)
Amaz 2 (a) (1p(a)
DP-SL
8, nz,i
(a)
Yi + ny,
As comparison group for DP-CutMixSL, we use DP-SL, which applics the Gaussian mechanism to the existing SL, and MixSS, which utilizes Mixup instead of CutMix in DP-SutMixSL. Table [ shows the smashed data and labels of Mi-CL compared to those of DP-MixSL or DP-ST. We also refer to the
7

---

Published in Transactions on Machine Learning Research (08/2024)
differentially private mechanisms DP-SL, DP-MixSL, and OP-CutMixSL as M1, M2, and Ms, respectively, Then, we can compare the RDP bound of DP-CutMixSL. to those of DP-ST, and DP-MixSI. as follows:
Theorem 1. For a given order a 2 2, the RDP privecy budgets e ei(a), e2(a), and e3(a) ) of DP-SL, DP-MisSL and DP-CuMMiaSL salisfy the following inequalily if and only if ils equalilies hold when Amar 1/n:
<2(a) S (a(aa) S sc(),,
(6)
where
<i(a) +1 + eiy(a),
(7)
c2(0) = Amar ((1, + (I)(a)),
(8)
c3(0) Amar (1 Amaz (l
in which (a) = a.3D. E1, (.) 20 20
aDy and Amar maxjec X;- 20
Proof. Combining Proposilions through in Aypendia completes the proof.
Theorem ! provides the following 4 observations about DP-CutMixSL.
Privacy-Accuracy Trade-Offs (I: = n). There are two privacy-aceuraey trade-offs identified Theorem D First, DP-CutMiXLL provides a lower RDP guarantee than DP-MixSL but achieves higher accuracy, as be demonstrated in Section 6. The Mixup technique of DP-MixSL results in a superposition of images, where each pixel corresponds to multiple overlapping images. As the number of superimposed images, or equivalently the number of clients, increases, it becomes more challenging to identify each individual image by observing single pixel. In contrast, the CutMix technique of DP-CutMixSt aggregates non-overlapping masked images. Due to the masking, this aggregation certainly leaks less privacy compared to the unmasked noisy images in DP-ST. Nevertheless, each pixel in this masked image aggregation corresponds to a specific image, making casier to identify and thus achieving higher accuracy while leaking more privacy than the superimposed images in DP-MixSL. Another trade-off associated with Amaz E [1/n, 1]. When Amez reaches I/n (i.e., (C) increases or am goes to oo), the privacy guarantee is maximized and the equality constraint for Theorem incqualities is satisfied, but the accuracy decrcases as shown in Figure [0b and Figure 10c of Appendix leading to the privacy-accuracy trade-off.
Leveraging the compositional benefits the RDP framework, the outcome of Theorem 1, initially derived from an analysis of single epoch, can be straightforwardly generalized scenarios involving multiple epochs. This extension is possible by simply applying the RDP sequential rule,
RDP-CDP Conversion.
but results in RDP bounds that worsen linearly with the nunber of epoch (Mironov) 2017 Feldman al.) 2018). Some recent work (Ye and Shokri 2022
Altschuler and Talwar 2022) allempls to derive lighter RDP bounds with multi epochs, but this is beyond our scope and we refer this as future work.
We can also measure the CDP guarantee of MP- by applying the aforementioned RDP-to-CDP conversion to Theorem 0 which based on the RDP guarantee. Additionally, the effect of the mixing group size can be reflected by using the CDP bound formula of the subsampled mechanism in Wang al. (2019). whereas Thcorem I implicitly assumes that the mixing group size is equal to Thereby, for k n, can derive the CDP guarantee of DP-CuLMixSL with subsampling (M' subsample) operation consists of 1) subsampling mechanism that randomly selects i out of a total of n datapoints (reflecting the mixing group size), and 2) operation of M as depicted in Figure
below, whose key
Corollary 1. For all integer a 2 2 and 0 < < 1, the DP privacy budgets (6), E,(,), and E/(() of M subsample, M subsample and M subsample satisfy the following inequality:
()) S (0( < (6),
(10)
8

---

Published in Transactions on Machine Learning Research (08/2024)
Mixing Policy
Subsampling
Milring Raih
025:075:a5
Client
Peendonadem Saasy Suqurars
X2 x1
(2)
Client
[Ag
1
2 + 7 2
Gaussian Noise
Client
Figure 4: An illustration of DP-CutMixSL with subsampling when n = 4 and t:
where
k
(6) = log (1 ++++
(e (ct(a))ec()) - 1)),
(11)
n
k
(6) = log (1 +
(e (aa))ta) - 1)),
(12)
n
k:
(6) log (1 (c 1)),
(13)
n
in which kg tciulo)) and kg E.(d]
(ix(a) E.10]
minimize 55(() and ( under the assumption that
A; 1/k Vi, respectively, and (o) 1//(1/8)
Sketch of Proof. Recall Theorem 1 and apply it to the DP bound formula of the subsampled mechanism of Wang et al. 2010) (if M (c,5)-DP, then the subsampled mechanism M subsample (log(1 + 7(e - 1)),78) DP where y denotes sampling ratio). This gields Equation 10
Assuming maxiec 1/k, for Es(a) =o(0)<11, E){(6) log (1
& (ccala)+e 1)) is approzimated
by log (1+ & (cs((a) + Since the log function is monotone increasing function and fixed, k (ea(a)) Eo()) should be minimized for the minimumm ()) Regarding k (eg(ai) eo(d)), since it is convex function for k > O, we can find k2 which becomes 0 when differentiated. k2 can also be calculated in similar manner. This completes the proof.
Revisiting Privacy-Accuracy Trade-Off (k < nt. First, privacy-accuracy trade-off between DP- MixSL and DP-CutMixSL occurs in Corollary D as in Theorem where = k. The existence of an optimal mixing group size is rooted in subsampling. In the existing Mixup or Random CutMix, the privacy guarantee improves when the number of samples increases, but counterintuitivel, with subsampling, the randomness of which client among all clients a specific sample belongs to decreases, resulting in a tradc-off.
Limitations on DP Analysis. There are major limitations on our DP analysis. Firstly, existing DP analysis, it fundamentally measures how sensitively the output changes compared the input, and this time, the output is in- in-practice bounded (for example, classification). However, since SL inherently lacks in quantifying the change of smashed data versus input, we indirectly analyze the privacy guarantee of smashed data versus output. To complement this, we experimentally measure the attack success rate for membership inference at tacks and assess robustness against. reconstruction attacks in Section D to ensure privacy guarantees between input and smashed data.
Secondly, DP analysis cannot differentiate between Random CutMix and Vanilla CutMix because it focuses the quantity rather than the randomesss pattern of the mechanism. Through the robust of the

---

Published in Transactions on Machine Learning Research (08/2024)
reconstruction attack in Section mentioned above, we bypass the privacy guarantee between CutMix, which is theoretically indistinguishable.
6 Numerical Evaluation
While Section 5 theoretically demonstrates the privacy guarantee of DP-CutMixSL, this section experimentally analyzes its privacy guarantce and accuracy compared to Parallel SL, SFL (Thapa et al.) 2020b), and etc. For the experiment, we use the CIFAR-10 dataset (Krizhevsky 2009) with a batch size of 128, and Table 1 additionally uses the Fashion-MINE weight docay (AdamW) (Loshchilov and Hutter 2017) is used with learning rate of 0.001, and a total of 10 clients each have 5,000 images. Except for Table we use the ViT-tiny model [Touvron al.) 2020), , and the entire model is split. that the client and server each have embedding layer and transformer. Regarding the injection of noise into the one-hot encoded label, we use a clamp function to bound the values between 0 and 1 after the noise is added. Additionally, in Figure 5 for the case of n = 10 and h > 2, the mixer clusters a set of n clients into subsets of size & at each epoch (constructing each subset from the remaining clients) before determining the mixing ratio and masks within each subset. Furthermore, for the purpose of training the model, we employ an environment consisting of 64 patches, each measuring x 2, and conduct training over span of 600 epochs. Other parameters for DP measurement are in Table 2
dataset (Xiao et al. 2017). y. As an optimizer, Adam with decoupled
Table Parameters for DP measurement.
Parameter
Annotation
Value
Number of clients
10
Dimension of smashed data
D.
10
Dimension of label
Dy
L
2
Pixel-wise upper bound of smashed data Mixing ratio
A
0.15
A Vi
1/k (uniform)
RDP parameter
a
2
DP paramcter
8
0.0002
To measure the robustness DP-CutMixSL against privacy allacks, we first consider the following three types of privacy attacks: membership inference attack, reconstruction attack, and label inference attack. Among them, membership inference attack and reconstruction attack are privacy attacks that occur in the forward propagation process of Op-CStMixXTI and label inference attack in its back propagation process, respectively. Specifically, honest but curious server in membership inference attack attempts to determine whether particular client's data is used for training, via the uploaded DP-CutMix's s smashed data and label generated by the mixer in Equation [ Similarly, in a reconstruction attack, the server aims to restore the input data of the client through the auxiliary network with the uploaded smashed data of DP-CutMixSI.
Furthermore, in the label inference attack, a conest-but-curion client tries to infer the label of input data used by another client through the cut-layer gradient. For example, assuming that the cut-layer gradient Väria) [4122 in Equation is sent to clients 1 and 2, the 2-th client can try to infer the label of the 1-th client by performing a classification with the 1-th client's gradient V (Mi O L4122)) ) as input, which is included in the entire cut- layer gradient.
Privacy Against Membership Inference Attacks. Here we assume the worst case that the server knows the smashed data of all client. Given this premise, the DP analysis in Section 3 enables theoretical evaluation of privacy protection against membership inference attacks, thus leading to the measurement of the CDP bound.
Figure 5a shows the accuracy of each method as a function of the CDP guarantee (s). For the same E, DP-CutMixSI. achioves higher accuracy than both DP-SL and DP-MiX,L, except when E = 1. Appendix B presents the noise variance required for each method to guarantee privacy for each e in Figure 5aa Here, the noise variance increases in the order of DP-ST, MP-CutMixSL, and DP-Mix implying that the accuracy
10

---

Published in Transactions on Machine Learning Research (08/2024)
DI-CutNeSSL Di-MaSi DP.)
DESCUSMESSL DI-WieL
DP CIMMI. DP-MXSL DP-LL
DF-Cut
A0T144 quccos rode (44)
DF-MISL
80
AC0001100
DP-LL
25
20-
Stanng group size
Maxing group 128
group
(a) Acc w.r.t E.
(b) Attack success rate w.r.t ls.
(c) Acc w.r.l &.
(d) w.r.t K.
Figure 5: Accuracy, attack success rate, and & under the CIFAR-10 dataset: (a) accuracy of Mix,,,, DP-MixSL, and DP-SL according E; (b) attack success rate of membership inference attacks against DP-CutMixST, DP-MixST, and DP-SL according to k; (c) accuracy of DP-CutMixST, DP-ST, and DP-MixST. according to k; (d) e of DP-CutMixSL, DP-SL, and DP-MixSL according to k.
drop at = 1 in Figure 5a is attributed to the injection of large-scale noise. In fact, Figure Ia in Appendix D demonstrates that DP-CutMixSL outperforms DP-SL and DP-MixSL in terms of accuracy for all given noise variances. Additionally, Figure 11b illustrates the superiority of DP-CutMixST. as a privacy amplifier with an improved & compared to DP-SL.
Figure 5b] Figure bc| and Figure 5d compare the impact of mixing group size on attack success rate, accuracy, and ε for membership inference attacks, respectively. In particular, Figure 5b is measured using a neural network-based attacker model with three fully connected layers pretrained on the CIFAR-10 dataset. Both Figure 5b and Figure 5d show that DP-CulMixSL, provides improved privacy guarantees against membership inference attacks compared to DP-SL. Factors that improve the DP guarantee of DP-CutMixSL include 1) noise injected by Gaussian mochanism and 2) DP guarantec amplification through Random CutMix, and such gap in privacy guarantee between DP-SL and DP-Cut MixSSL indicates that the latter more critical to privacy. Comparing DP-CutMixSI, and DP-MixST, Figure 5b demonstrates the superiority of DP-CutMixST, while Figure 5d shows the opposite. This highlights the aforementioned limitations of DP analysis and the experimental superiority of MiXLL
In Figure 5c DP-CutMixST. achieves higher accuracy compared to both DP-MixSL and DP-SL, regardless of the mixing group size. In Figure 5c and Figure 5d both accuracy and & of DP-CutMixSL and DP-MixSL decrease as the mixing group size increases, while those of DP-SL tend to be reversed. This is because in the trade-off privacy guarantee between subsampling and CutMix or Mixup, the privacy guarantee gain of CutMix or Mixup as i incrcasod is greater than the loss of privacy guarantee due to subsampling, resulting in 'Hiding in the crowd" effect (Jeong et al., 2020). It can also be explained by how large the optimal mixing group size is (convex function with respect to kt), and large ky well as Ag for given parameters validate it (k3 = 28.55, kg 27.07). On the other hand, DP-SL lacks CutMix or Mixup, so a small k leads to a strong privacy guarantee due to subsampling. Moving forward, to more effectively utilize CutMix's privacy protection capabilities without introducing noise, we assess performance in noiseless environments. Consequently, we are updating our naming conventions: DP-CutMixSL will now be referred to as CutMixSL, and DP-MixSL will be known as PSL with Mixup, among others.
Privacy Against Reconstruction Attacks For the reconstruction attack, an auxiliary network is utilizod, which takes the smashed data as input and produces restored data through two convolutional layers followed by interpolation. The auxiliary network is trained using the CIFAR-10 dataset by minimizing the mean-squared-error (MSE) loss between the restored data and the original input data. Regarding the hyperparameters, we adjust the datasct size for training the auxiliary network, mask distribution, and mixing group size.
Table 3 shows the reconstruction loss of SL-based methods according to various hyperparameters. When comparing SL-based techniques, the reconstruction loss of the proposed CutMixSL the largest, in other words, CutMixSL outperforms in terms of privacy guarantee for reconstruction attack in most cases, followed by PST w. Mixup. In particular, when comparing CutMixST, (Random CutMix) and PSL. w. vanilla CutMix,
11

---

Published in Transactions on Machine Learning Research (08/2024)
Randomly Punched Smashed Data
Inpet Data
Random CunMix
Vanilla CuMMix
Random CutMix
Vanilla CutMix
Mixup
Mixup
(a) Input and smashed data
(b) Smushed data at the server
(c) Restored data at an attacker
at a client
Figure 6: Example images of raw, smashed, and restored data for Random CutMix, Vanilla CutMix, and Mixup.
Table Reconstruction loss (MSE) SL-based techniques according to mixing group size, train dataset size, and mask distribution.
Training Dataset (10%)
Training Dataset (100%)
Mask Distribution (aa)
6
2
Mixing group size (k)
2
PSL
0.403
0.425
0.326
1.425
0.116
0.308
0.138
0.398
PSL w. Mixup
0.665
0.383
0.379
1.923
0.172
0.396
0.215
0.292
PSL w. Vanilla CutMix
0.382
0.426
0.429
1.316
0.180
0.403
0.219
0.417
CutMixSL (proposed)
0.425
0.466
0.441
1.561
0.187
0.312
0.221
0.435
the robustness of CutMixSL is superior for most hyperparamoter scttings. This is due to the difference in randomness between Vanilla and Random CutMix, which is previously indistinguishabll by DP analysis. Since adjacent box-shaped pixels are replaced, Vanilla CutMix has a relatively high correlation between pixels, while the correlation between pixels in a Random CutMix that is randomly replaced patch-wise is bounded in patch units, straightforwardly leading to a strong privacy guarantee.
With respect to the overall tendency for hyperparameters, the larger the training dataset size, the smaller the mask distribution, and the smaller the mixing group size, the more advantageous the auxiliary network is to learn the restored data, leading to small reconstruction loss. Finally, Figure 0 presents examples from the C dataset, showcasing the original data, the smashed data, and the corresponding restored data generated by the auxiliary network. This comparison highlights the superiority of the Random CutMix technique.
Privacy Against Label Inference Attacks. For label inference attacks, there are white-box attacks in Yang et al. (2022), black-box attacks in Li et al. (2021), and other minor variations. We consider a white-box attack among them, since black-box attacks include the bold assumption that clients know the upper model segment weight of the server. Unlike Li et al. (2021), which is based on Vanilla SL, we consider
12

---

Published in Transactions on Machine Learning Research (08/2024)
A
Oxr
dx
Gg -6
dy
Tie 6
dx
6g
dy -
M
O ConGaR
(a) SFL.
(b) CutMixSL.
(a) SFL.
(b) CutMixSL.
Figure 7: Norm distribution of gradients accord- Figure 8: Cosine similarity distribution of gradi- ing to mask distribution.
ents according to mask distribution.
Norm Leak,
Cosine Leak, Epech
Colbet
CL06.5L
0.8
644
3.4
32
0.0
2.
0.2
0.5
(a) ROC curve norm leak.
(b) ROC curve of cosine leak.
(c) AUC of norm and cosine leak.
Figure 9: Privacy guarantee measurement for label inference attack of CutMixSL and SFL.
the following worst case of CutMixSL to enable powerful whitc-box attacks in parallelized form of SL: 1) the first assumption of weight averaging in SFL to share the weight of the lower model segment among clients, 2) the second assumption that the gradient in the cut-layer is averaged as in Pal et al (2021) before broadcasting to clients, 3) the third assumption that label inference leakage occurs between clients within the same mixing group size for CutMixSL with k = 2. Also, we refer to Mut as its best case when not with the above assumptions. Then, a honest-but-curious client aims to infer its label by measuring the norm (norm leak) or cosine similarity (cosine leak) of the averaged cut-layer gradient as well as the gradient propagate to the lower model segment.
For measurement, we compute the area under the ROC curve (AUC) over the distribution of the norm or cosine similarity. The ROC curve means the curve of the true positive rate (TPR) and false positive rate (FPR) as the decision boundary moves from -c to Do in a binary classification scenario, and its base area, AUC, close to 1, it means that the classífication of the two distributions becomes clear under accurate data labeling. Thus, in our scenario, an AUC close to 0.5 implics a high privacy guarantoe against label inference attacks. As an experimental setting, we utilize the LeNet-5 model (LeCun al., 2015), where the cut-layer is located after the second convolutional layer, and allocate 1,000 samples each corresponding to the two labels 0 and 4 of MNIST dataset to two clients. As a comparator, we use SFL with cut-layer gradient averaging.
Figure 7 anddd S visualize the distribution of norm and cosine similarity according to the mask distribution of MixSL and SFL, respectively. where the orange and blue regions each represent that the labels are positive and negative. We can visually confirm that, as the mask distribution increases, CutMixSL does not change significantly, whereas in SFL, the variance of the distribution increases, making it easier to distinguish. Based on these, the ROC curves for norm leak and cosine leak are shown in Figure and 9b
13

---

Published in Transactions on Machine Learning Research (08/2024)
Table 4: Top-1 accuracy of methods for various datasets and models.
Models w/ CIFAR-10
Models w/ Fashiou-MNISS
Method
ViT-Tiny PiT-Tiny
VGG-16
ViT-Tiny PiT-Tiny
VGG-16
Standalone
48.84
47.77
54.97
77.65
78.21
80.12
PSL
57.21
52.28
62.62
85.68
82.35
84.39
SFL
67.88
55.63
63.98
89.17
84.27
87.34
PSL w. Mixup
69.23
64.89
68.20
88.21
87.62
88.53
PSL w. Random Cutout
53.86
50.28
56.65
88.46
86.48
88.17
PSL Vanilla CutMix
71.78
58.21
33.50
87.86
86.31
89.01
CutMixSL (proposed)
73.77
71.26
67.53
89.75
89.25
89.45
Further, Figure D measures AUC per epoch of SFL and CutMixSL (its worst case as well as its best case) for norm and cosine leaks. The first. thing to note is the strong privacy guarantee for norm and cosine leak of CutMixSL for both cases, maintaining an AUC close to 0.5 for all epochs, thanks to parallelization and Random CutMix's masking effect on gradient of Equation g The baseline SFL reaches AUCs up 0.75 and 0.68 for norm and cosine leak, respectively, roughly alleviated by parallelization alone. In addition, regarding the impact of norm and cosine leak according to epoch, the variance of norm leak AUC is larger at the beginning of learning, but becomes weaker epoch progresses, and instead, the variance of cosine leak AUC becomes large, showing the potential complementary threats of the two privacy attacks.
Accuracy under IID Dataset. In Table 4 we additionally measure the accuracy for PiT-tiny Heo et al. 2021a) and VGG-16 Simonyan and Zisserman (2014) except for ViT-tiny. Here, VGG-16 is for CNN in addition to ViT, and PiT is model between VIT and CNN and is transformer architecture equipped with a pooling layer. For an extensive comparison of results, we consider PSL with Random Cutout, which is equivalent to the single client case of Random CutMix.
Table f shows the top-1 accuracy on the CIFAR-10 and Fashion-MNIST datasets of various ST--base techniques, including CutMixSL. First, the accuracy of CutMixSL is the highest in all cases except for the case where VGG-16 and CIFAR-10 are used. With VGG-16 and CIFAR-10, PSL w. Mixup achieves the highest accuracy. This is because, as mentioned earlier, CNN focuses on locality when learning spatial information, while ViT focuses on globality. Also, it is consistent with Nascer et al. (2021). indicating that VIT has robustness of accuracy against patch drop or image shuflling compared to CNN. For that reason, CNN and VIT are better suited for superposition type regularization (i.e., Mixup) and masking type regularization (i.e., Cutout, CutMix), respectively Harris et al. (2020). Compared to PSL w. Vanilla CutMix, CutMixSL demonstrates superior accuracy, validating our intuition about the efficacy of the patch-wir wise designed regularizer in VIT. From the perspective of dropout, (Srivastava al. (2014), it be also seen that the increased randomness in CutMixSL results in higher accuracy. Furthermore, in Appendix F Random CutMix achieves the highest accuracy even when applied at the input layer. Straightforwardly Random CutMix applied to the input layer, however, is more vulnerable to data privacy leakage than that applied to the cut-layer, resulting in an accurayy-prioacy trade-off.
7 Conclusion
In this study, we designed DP-CutMixSi with the goal of developing privacy preserving distributed ML algorithm for VIT. Thanks to the randomness and masking effect of Random CutMix, theoretically and experimentally demonstrated that the proposed DP-CutMixSL. has robustness against three types of privacy attacks, while not compromising accuracy. While this work focuses on an SL-based algorithm that enables privacy-preserving and accurate parallel computation in multi-user ViTs, it also shows promise in relation to existing techniques for and aricacy-ccuurayy trade-offs of patch-wise shuffling (Yao et al. [2022] Xu et al.) (2024) and its application DP-CutMixSI. in Tables 7 and of Appendix G which are worthy of further exploration in future research.
SL. in single-user ViTs. Notably, we briefly examined the scalability
14

---

Published in Transactions on Machine Learning Research (08/2024)
Although DP guarantee for smashed data theoretically derived in FP, but our study lacks it in BP. Combined with GradPerturb in Yang et al. (2022). exploring the DP guarantee at BP could be an interesting topic for future work. Furthermore, while controlling the mixing group size only in this work, it is possible to increase the number of FP flows by combinatorily setting the mixing group several times during single FP as in Oh et al. (2022b), locusing on its augmentation properties. This can be a solution to the low inductive bias of VIT, which is deferred to future research.
Broader Impact Statement
In this paper, we introduce novel parallel training method for transformer structures designed to enhance privacy guarantees while improving accuracy for multi-client environments, leveraging memory-effcient structures based on split learning. We believe our work can siguificantly contribute to privacy-preserving training schemes for constriind devices, offering robust protection against membership inference attacks, model inversion attacks, and label inference attacks. However, real-world implementation can be challenging, particularly regarding the implementation of mixer. Although homomorphic encryption and AirComp can be adopted without additional deployment costs, factors such encryption especially for large deep learning models and time synchronization must be carefully considered for each. Therefore, we recommend rigorous approach to implementing our framework in real-world scenarios, taking into account deployment costs, latency requirements, and other relevant factors.
peeryptio/dderyptiion /decryption speed
Acknowledgments
This work was supported in part by the Korean Ministry of Science and ICT (MSIT) under the National Research Foundation of Korea (NRF) grant (No. 2023-11-1836) and the Information Technology Research Center (TTRC) support program (TTT-22024-RS-223300002) supervised by IITP.
References
Martin Abadi, Andy Chu, Tan Goodfellow, H Brendan McMahan, Tlya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308-318, 2016.
Jason Altschuler and Kunal Talwar, Privacy noisy stochastic gradient descent: More iterations without more privacy loss. Adeances in Newral Information Processing Systems, 35:3788 3800, 2022.
Sihun Back, Jihong Park, Praneeth Vepakomma, Ramesh Raskar, Mehdi Bemnis, and Seong-Lyun Kim. Visual transformer meets cutmix for improved accuracy, communication efficiency, and data privacy in split learning. arXi preprint ar 0X0::2207.00234, 2022.
Borja Balle, Gilles Barthe, and Marco Gaboardi. Privacy amplification by subsampling: Tight analyses via couplings and divergences. Advonces in Neural Information Processing Systems, 31, 2018.
Jonathan Baxter. A model of inductive bias learning. Journal of artificial intelligence research, 12:149-198, 2000.
Yvonne M Bishop, Stephen E Fienberg, and Paul W Holland. Discrete multivariate analysis: theory and practice. Springer Science Business Media, 2007.
Eitan Borgnia, Jonas Geiping, Valeriia Cherepanova, Liam Fowl, Arjun Cupta, Amin Ghiasi, Furong Huang, Micah Goldblum, and Tom Goldstein. Dp-instahide: Provably defusing poisoning and backdoor attacks with differentially private data augmentations. arXiu preprint or Xrx:221033. 02079, 2021.
Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33:1877-1901, 2020.
Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolus Usunier, Alexander Kirillov, and Sergey Zagoruyko. Eud-to-end object detection with transformers. In European conference on computer vision, pages 129-299. Springer, 2020.
15

---

Published in Transactions on Machine Learning Research (08/2024)
Chun-Fu Richard Chen, Quanfu Fan, and Rameswar Panda. Crossvit: Cross-allention multi-scale vision transformer for image classification. In Proceedings of the IEEE/CVF international conference on compuler vision, pages 357-366, 2021.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXi::8100004805, 2018.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. CoRR, hts/2010.11922) 2020a. URL https://arxiv wwwpiiiwwrgg/aae wtggab////aaa aa/////bb./00....//////// 11929
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, al. An image is worth 16x16 words: Transformers for image recognition at scale. arXis preprint 0tt:20000.119999 2020b.
Cynthia Dwork. Differential privacy: A survey of results. In International conference on theory and applications of models of computation, pages 1-19. Springer, 2008
Cyuthia Dwork, Krishnaram Kenthapadi, Frank McSherry, llya Mironov, and Moni Naor. Our data, ourselves: Privacy via distributed noise generation. In Annual international conference on the theory and applccttions of cryptographic techniques, pages 486 503. Springer, 2006.
Úlfar Erlingsson, Vitaly Feldman, Tya Mironov, Ananth Raghunathan, Kunal Talwar, and Abhradeep Thakurta. Amplification by shuffling: From local central differential privacy via anonymity. In Proceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithmms, pages 2468-2479. SIAM, 2019.
Vitaly Feldman, Dyy Mironov, Kunal Talwar, and Abhradeep Thakurta. Privacy amplification by iteration. In 2018 IEEE 59th Annual Symposium on Foundations of Computer Science (FOCS), pages 521-532 IEEE, 2018
Yansong Gao, Minki Kim, Sharif Abuadbba, Yeonjae Kim, Chandra Thapa, Kyuyeon Kim, Seyit A Camtepe, Hyoungshick Kim, and Surya Nepal. End-to-end evaluation of federated learning and split learning for internet of things. Xiv preprinl Xiv:20003. 13376, 2020.
Yansong Gao, Minki Kim, Chandra Thapa, Sharif Abuadbba, Zhi Zhang, Seyit Camtepe, Hyoungshick Kim, and Surya Nepal. Evaluation and optimization of distributed machine learning techniques for internet of things. IEEE Transactions on Computers, 2021.
Manuel Gil, Fady Alajaji, and Tamas Linder. Rényi divergence measures for commonly used univariate continuou distributions. Information Sciences, 249:124 131, 2013.
Otkrist Gupta and Ramesh Raskar. Distributed learning of deep neural network over multiple agents. Journal of Network and Computer Applications, 116:1-8, 2018.
Kai Han, Yunhe Wang, Hanting Chen, Xinghao Chen, Jianyuan Guo, Zhenlua Liu, Yehui Tang, An Xiao, Chunjiug Xu, Yixing Xu, et al. A survey on vision transformer. JEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
Ethan Harris, Antonia Marcu, Matthew Painter, Mahesan Niranjan, Adam Prügel-Bennett, and Jonathon S. Hare. Underslanding and enhancing mixed sample data angmentation. CoRR,, 2ttp//002.122111 2020. URL https:
//arziv.org ats///0ss2002222 12047
Zecheng He, Tianwei Zhang, and Ruby B Lee. Model inversion attacks against collaborative inference. In Proceedings of the 35th Annual Computer Security Applications Conference, pages 148-162, 2019.
Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spatial dimensions vision transformers. CoRR, abs/ abbs/2103.16300 2021a. URL
Byeongho Heo, Sangdoo Yun, Dongyoon Han, Sanghyuk Chun, Junsuk Choe, and Seong Joon Oh. Rethinking spatial dimeusions of vision transformers. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 11936-11945, 2021b.
Zhenhou Hong, Jianzong Wang, Xiaoyang Qu, Jie Liu, Chendong Zhao, and Jing Xiao. Federated learning with dynamic transformer for text speech. arXio preprint ar Xxix:2107.08795 2021.
16

---

Published in Transactions on Machine Learning Research (08/2024)
Eunjeong Jeoug, Seungeun Ohi, Jilong Park, Hyesung Kim, Mehdi Bennis, and Seong-Lyur Kim. Hiding in the crowd: Federated data augmentation for on-device learning. IEEE Intelligent Systems, 36(5):80-88) 87, 2020.
Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, al. Advances and open problems in federated learning. Foundations and Trends@ in Machine Learning, 14(1-2):1-210, 2021.
Shigeki Karita, Nanxin Chen, Tomoki Hayashi, Takaaki Hori, Hirofumi Inaguma, Ziyan Jiang, Masao Someki, Nelson Enrique Yalta Soplin, Ryuichi Yamamoto, Xiaofei Wang, al. A comparative study on transformer vs rmn speech applications. In 2019 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU), pages 449-456. IEEE, 2019.
Salman Khan, Muzammal Naseer, Munawar Hayat, Syed Waqas Zamir, Fahad Shahbaz Khan, and Mubarak Shah. Transformers in vision: A survey. ACM Computing Surveys (CSUR), 2021.
Yusuke Koda, Jihong Park, Mehdi Bennis, Praneeth Vepakommua, and Ramesh Raskar. Airmixml: Over-the-air data edge machine learning. arXiv preprint arXim:2105000399 2021.
mixup for inherently
Jakub Konečný; Brendan McMahan, and Daniel Ramage. Federated optimization: Distributed optimization beyond the datacenter. arXiv preprint orXiv: 1xXi::1511.00 1511.03577, 2015.
Jakub Konečný, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.00400 2016.
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
Yann LeCun et al. Lenet-5, convolutional neural networks. URL: http:///yonn. lecun. com/exdb/lenet, 20(3):14, 2015.
Kangwook Lee, Hoon Kim, Kyungmin Lee, Changho Suh, and Kannan Ramchandran. Synthesizing differentially private datasets using random mixing. In 2019 IEEE International Symposium on Information Theory (ISIT), pages 542-546. IEEE, 2019.
Oscar Li, Jiankai Sun, Xin Yang, Weihao Gao, Hongyi Zhang, Junyuan Xie, Virginia Smith, and Chong Wang. Label leakage and protection in two-party split learning. arXiv preprint S0..::21020000000 2021.
Tian Li, Anit Kumnrr Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions. IEEE Signal Processing Magazine, 37(3)500-60, 60, 2020.
Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv preprint arXiv: 2017.
Andrew Lowy and Meisam Razaviyayn. Private federated learning without a trusted server: Optimal algorithms for convex losses. orXiv preprint arXi:2216..m 09779, 2021.
Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th computer security foundations symposium (CSF), pages 263-275. IEEE, 2017.
Muhammad Muzammal Naseer, Kanchana Ranasinghe, Salman H Khan, Munawar Hayat, Fahad Shahbaz Khan, and Ming- Hsuan Yang. Intriguing properties of vision transformers. Advances Neurol Information Processing Systems, 34, 2021.
Milad Nasr, Reza Shokri, and Amir Houmansadr. Machine learning with membership privacy using adversarial regularization. In Proceedings of the 2018 ACM SIGSAG conference on computer and commmunications security, pages 634 646, 2018
Seungeun Oh, Jihong Park, Sihum Back, Hyelin Nam, Praneeth Vepakomma, Ramesh Raskar, Mehdi Bennis, and Seong- Lyun Kim. Differentially private cutmix for split learning with vision transformer. First Workshop on Interpolation Regularizers and Beyond at NewrIPS 2022, 2022a. URL http:::://oparrrree..ee//ttooo aet//forum/Idrggicdlittg
Seungeun Oh, Jihong Park, Pranceth Vepakomma, Silun Back, Ramesh Raskar, Mehdi Bennis, and Seong-Lyun Kim. Locfedmix-sl: Localize, federate, and mix for improved scalability, convergence, and latency in split learning. In Proceedings of the ACM Web Conference 2022, pages 3347-3357, 2022b.
Seungeun Oh, Hyelin Nam, Jihong Park, Praneeth Vepakomuma, Ramesh Raskar, Mehdi Bennis, and Seong-Lyun Kim. Mix2all: Two-way mixup for scalable, accurate, and communication efiffiin split federated learning. JEEE Transactions on Big Data 2023.
17

---

Published in Transactions on Machine Learning Research (08/2024)
Shraman Pal, Mansi Uuiyal, Jihong Park, Praneeth Vepakomma, Ramesh Raskur, Mehdi Bennis, Moongu Jeon, and Jinho Choi. Server-side local gradient averaging and learning rale acceleration for scalable split learning. arXio preprint Xit:22112 05929, 2021.
Jihong Park, Sumudu Samarakoon, Anis Elgabli, Joongheon Kim, Mehdi Bennis, Seong-Lyun Kim, and Mérouane and distributed learning over wireless networks: Principles and applications.
Debbah. Communication-efian Proceedings of the IEEE, 109(5):796-81) 2021a.
Sangjoon Park, Gwanghyun Kim, Jeongsol Kim, Boah Kim, and Jong Chul Ye. Federated split aank-sgnsttcc vision transformer for covid-19 cxr diagnosis. Advances in Neural Information Processing Systems, 34, 2021b.
George-Liviu Pereteanu, Amir Alansary, and Jonathan Passerat-PPalmaaee Split he: Fast secure inference combining split learning and homomorphic encryption. arXiv preprint arXix:2202. 199511 2022.
Liangqiong Qu, Yuyin Zhou, Paul Pu Liang, Yingda Xia, Feifei Wang, Li Fei-Fei, Elsan Adeli, and Daniel Rubin. Rethinking architecture design for tackling data heterogeneity in lederated learning, arXiv prepriul arXic:206.00000 060477, 2021.
Alec Radford, Karthik Narasimhan, Tim Salimans, Ily Sutskever, et al. Improving language understanding by generative pre-training, 2018.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Tlya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Md Atiqur Rahman, Tanzila Rahman, Robert Laganière, Noman Mohammed, and Yang Wang. Membership inference attack against differentially private deep learning model. Trons. Data Priv., 11(1):61-79, 2018
Ronald L Rivest, Len Adleman, Michael L Dertouzos, et al. On data banks and privacy homomorphisms. Foundations of secure computation, 4(11):169-18) 180, 1978.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov, Membership inference attacks against machine learning models. In 2017 IEEE symposium on securily and privecy (SP), pages 3 18. IEEE, 2017.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXip preprint arXiv:1409 1t0::4409.5000 1556, 2014.
Abhishek Singh, Praneeth Vepakomma, Otkrist Gupta, and Ramesh Raskar. Detailed comparison of communication efficiency of split. learning and federated learning. or Xio preprint 19X9g:1909.091 19155,999999.............. 2019.
Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research, 15(1):1929-1958, 2014.
Andreas Steiner, Alexander Kolesnikov, Xiaohna Zhai, Ross Wightman, Jakob Uszkoreit, and Lucas Beyer. How to train your vit? data, augmentation, and regularization in vision transformers. CoRR, abs/2106.10270, 2021. URL
10270
Chandra Thapa, Mahawaga Arachchige Pathum Chamikara, and Seyit Camtepe. Splitfed: When federated learning meets split. learning. CoRR, 220000000000,,, 2020a. URL httpppp//aarrvvv..rr/a/////....0
Chandra Thapa, Mahawaga Arachchige Pathum Chamikara, Seyit Camtepe, and Lichao Sun. Splitfed: When federated learning meets split learning. arXiv preprint orXiv:2004. 12088, 2020b.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. CoRR, abs/2012.11287 2020. URL https:
//arxiv.org//bs/2011 12877
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
Pranecth Vepakomma, Otkrist Gupta, Tristan Swedish, and Ramesh Raskar. Split learning for health: Distributed deep learning without sharing raw patient data, arXiv preprint Xie 00564, 2018
Vikas Verma, Alex Lamb, Christopher Beckham, Amir Najafi, Ioannis Mitliagkas, David Lopez-Paz, and Yoshua Bengio. Manifold mixup: Better representations by interpolating hidden states, In International Conference on Machine Learning, pages 6438 6447. PMLR, 2019.
18

---

Published in Transactions on Machine Learning Research (08/2024)
Yu-Xiang Wang, Borja Balle, and Shiva Prasad Kasiviswanalhan. Subsampled réuyi differential privacy and analytical moments accountant. In The 22nd International Conference on Artificial Intelligence and Statistics, pages 1226 1235. PMLR, 2019.
Xiang Wu, Yongting Zhang, Minyu Shi, Pei Li, Ruirui Li, and Neal N Xiong. An adaptive federated learning scheme with differential privacy preserving. Puture Generation Computer Systems, 127:362-372, 2022.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Pashion-mnist: novel image dataset for benchmarking machine learning algorithms. arviv preprint aiv: 708.07747, 2017.
Hengyuan Xu, Liyao Xiang, Hangyu Ye, Dixi Yao, Pengzhi Chu, and Baochun Li. Permutation equivariance of transformers and its applications. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 5987 5996, 2024.
Xin Yang, Jiankai Sun, Yuanshun Yao, Junyuan Xie, and Chong Wang. Differentially private label protection in split learning. Xrxiv preprint Xiviv:2203 02073, 2022.
Dixi Yao, Liyao Xiang, Hengyuan Xu, Hangyu Ye, and Yingqi Chen. Privacy-preserving split learning via patch shuffling over transformers. In 2022 IEEE International Conference on Data Mining (TCDM), pages 638-647. IEEE, 2022.
Jiayuan Ye and Reza Shokri. Differentially private learning needs hidden state (or much faster convergence). Advonces in Newral Information Processing Systems, 35:703 715, 2022.
Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In Proceedings of the IEEE/CVF Intervational Conference on Compuler Vision, pages 6023 6032, 2019.
Hongyi Zhang, Moustapha Cisse, Yann Dauphin, and David Lapez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint ar Xix::1771000044 2017.
Sixiao Zheng, Jiachen Lu, Hengshuang Zhao, Xiatian Zhu, Zekun Luo, Yabiao Wang, Yanwei Fu, Jianfeng Feng, Tao Xiang, Philip HS Torr, et al. Rethinking semantic segmentation from a pequence-to-sequene perspective with transformers. In Proceedings of the IEEE/CVP conference compuder vision and pattern recognition, pages 6881-6890, 2021.
19

---

Published in Transactions on Machine Learning Research (08/2024)
Appendices
A Observations on Random CutMix
75
Unifom Driog=6)
Driow-2)
Random DutMix
50-
Vanilla CutMix
Mixup
2
3
4
2
6 (uniform)
Number of clients
mixing group size, k
Qu
(a) Impact of mixing methods.
(b) Impact of mixing group size.
(c) Impact of mask distributions (aM)).
Figure 10: Top-1 accuracy of multi-client scenario: (a) accuracy of Random CutMix, Vanilla CutMix, and Mixup w.r.t the number of clients; (b) accuracy of Random CutMix w.r.t the mixing group size; (c) accuracy of Random CutMix w.r.t the mask distribution aa--
In this subsection, the design elements of Random CutMix explored, along with its optimal hyperparameter settings, especially with respect to its accuracy.
Random CutMix vs. Vanilla CutMix and Mixup. While the proposed Random CutMix is a patch-wise partial regularization scheme rooted in masking, a Mixup (Zhang et al. 2017 Verma et al. 2019 that superpositions the full image can be considered as an alternative. Another alternative Vanilla CutMix, masking type regularization equal to Random CutMix. Figure 10a shows the comparison of accuracy between these regularization schemes according to the number of clients n. The top-1 accuracy is high in the order of Random CutMix, Vanilla CutMix, and Mixup regardless of the number of clients, showing superiority of Random CutMix in VIT. Also, in all three regularization schemes, accuracy increases as the number of clients increases, that is, scalability guaranteed up
clients.
Impacts of Mixing Group Size and Mask Distributions. In Figure 10b the accuracy of the Random CutMix as the mixing group size varies is shown for mask distribution av. Note here that the infinite divergence of оы implies that the mixing ratio follows a uniform distribution. Without cases where is 4 with am of 2 or 6, the decline is greatest when k
top-1 accuracy tends be inversely proportional to the mixing group size, especially changes from 2 to 3. Interpreting this from the perspective of each client, as the mixing group size k increases, large noise that may lead to performance degradation applied in the remaining areas except. for & of the entire image, under the ussumption of a uniform mixing ratio. For similar reasons regarding distortion level, Figure 10c includes tendency for accuracy to decrease as am increases.
B Noise Variance Settings in Figure 5a
Noise variance (o x
E
1.5
2
2.5
3
3.5
4
4.5
5
DP-SL DP-CuLMiXSL.
246/255
164/255
123/255
98.5/255
80/255
70.5/255
61/255
55/255
49/255
66/255
47/255
36/255
29/255
25/255
21 21/255
19/255
17/255
15/255
MP-MiX
60/255
43/255
33/255
27/255
23/255
20/255
17/255
15/255
14/255
Table 5: Noise variances for DP-SL, MPxMiX and DP-CutMixSL for various values of s.
20

---

Published in Transactions on Machine Learning Research (08/2024)
C
DP-CutMixSL's Pseudocode
Algorithm Operation of DP-CutMixSL with = 2.
Input: mask distribution O.M
Exxectte in mixer*
function 1. PSEUDORANDOM SEQUENCE GENERATION
Sample } ~ Dir(arm)
Generate binary masks (M,, M2) according to {21,22}
Return M, i-th client for all [1,2]
function 2. RANDOM CUTMIX
Generate (8(122 (1.22) through ((12)) 81 + 82, ((1,2) = 92
Return ($11.2) (1.2)) to server
function 3. CUT-LAYER GRADIENT SPLITTING
Split Vaqu,2) [1.2) into Va M1 @ L(,,)) and Van.a) @ L(1,2) through Equation
Return V Van M, O.O L(12) to i-th client
while not converged do
PSEUDORANDOM SEQUENCE GENERATION
*Execute in client /*/
Generate S; by passing x; through We,
Generate (R,, V:) in Equation based on M, and Gaussian mechanism
Send (s, y,) to mixer
RANDOM CUrMIx
1 /* Execute in server*
Generate loss L(12)) through server-side FP via w,
Send V (L T.(1,2) to mixer & Update
CUT-LAYER GRADIENT SPLITTING
/*Execute in client i*/ Update We,
end while
D Performance of DP-CutMixSL on Noise Variance
70.
DP-CutMixSL
60
DP-MixSL
70
DP for (a.2)
50
1cc@l(%)
65
30
10
0/255
8/255
16/255
32/255
0/255
8/255
16/255
32/255
Noise Variance of az
Noise Variance a² =o
(a) Acc w.r.t noise variance.
(b) w.r.f noise variance.
Figure 11: Accuracy and E of DP-CutMisSI, DP-MixSL, and DP-SL w.r.t noise variance.
21

---

Published in Transactions on Machine Learning Research (08/2024)
E Proof of Theorem 1
DP-SL Analysis. We first demonstrate the RDP guarantee DP-SL as follows:
Proposition 1. For all integer 2 2, Mi is (a, -Ra)))DDP where
oA
aDz
(1 =
(14)
20
20
Proof. Starting from the Definition G and the Rényi divergence formula with malti-voriate Gaussian distributions Gil et al. 2013), the RDP bound of M1, denoted by Eı(a), can be expressed
Mg 1'' I1?
(1(0) sup D Pa(Mi(D)lM(())) D,D'
= sup D.D
a
Byy
(15)
20
20
since VMp".a'T and y; N(p - oyJD,), where pig and py indicate the average smashed data and that of label, belonging to dataset D. It is noteworthy that ei(a) is represented as the sum of RDP bound for smashed
data (o)) and RDP bound for label (1,)(a)) the sequential composition rule, aiming to induce smashed data-label pairwise RDP bound.
Here, by using assumptions about the pizel-wrise upper bound of the smashed data and labels (st E 10, A). and Yi [0,1] 1] 1 we have:
2 Ds.
1 my D' 11 s 12. D, Dw.
(16)
Combining Equation 15 and Equation
16 concludes the proof.
DP-MixSL Analysis. We also present the privacy guarantee of DP-MixST, belows: Proposition For all integer a 2 2, Ma is (a, RRDP))RDDP, where
aD aD
e2(a) = (max 2c)
(17)
20 20
Proof. Consider the output of DP-MinSL, where smashed data and labels mized up, and their pizel-wise upper boand and dimension. Then, for two adjacent datasets D and D' (i.e., only -th elements are different, 1 1 S n), have:
- - po 1 & D).
- & X.D
(18)
Here, Equation 18 is manimized when Ae is the marimum value of >; for all Expressing this is as follows:
A) & (max X; A) X² S (max >.)²
(19)
sEC
iEc
Recolling the Rényi divergence formula and combining it with Equation 19 completes the proof.
DP-CutMIxSL Analysis. Lastly, the following privacy guarantee of DP-CutMixSL is induced:
Proposition For all integer a 2 2, Ma is (5, (a(D))-RDP, where
aA²D.
(max Xi) aDr IEC
es(a) = (max Xx) sEC
(20)
20
20
Proof. If we consider mean of & for two adjacent datasets and D', where only the i' -th element different, N₂ P²C pizels among the total D. pizels are differend and the rest are identical. At this time, considering the upper bound of the pisel-level, the following inequality established::
1|p2 - D' s (N ( = >
(21)
When Ap maXiec Ao, that to say, No max,ec No, Equation 21 is mazimized as follows:
1| - " 0 11? < (max A,)
(22)
VEC
= [mmax N. C2) IEC
(23)
Recall the Rénzi divergence formula, and substātule Equation data. Since My is identical to Ma in lerms of labels, the proof is completed by applying this to the RDP sequential composition rule together with Ma 's label prinacy guarantee.
23 oblain privacy guarantee for DP-CulMis smashed
22

---

Published in Transactions on Machine Learning Research (08/2024)
F
Accuracy comparison of regularizations applied to the input layer
Table 6: Top-1 accuracy of SL-based methods for various dalasets and models.
Models w/ CIFAR-10
Models w/ Fashion-MNIST
Method
ViT-Tiny
PiT-Tiny
VGG-16
ViT-Tiny
PiT-Tiny
VGG-16
PSL w. Mixup
74.36
37.21
66.08
89.86
87.62
89.70
PSL w. Random Cutout
22.03
45.19
66.32
88.65
88.51
89.62
PSL Vanilla CutMix
73.02
33.54
47.69
88.72
88.37
90.02
CutMixSL (proposed)
75.06
53.93
67.43
89.91
89.53
90.32
G Impact of Shuffling
Method
ViT-Tiny
PiT-Tiny
VGG-16
PSL
57.05
52.28
62.62
PSL w. Shuffling
54.47
45.67
49.82
PSL w. Mixup
71.02
65.92
74.43
PSL w. Random Cutout
65.03
60.87
67.06
PSL w. Random CutMix
75.55
73.19
72.23
PSL w. Random CutMix & Shuffling
72.78
57.59
33.50
Table 7: Impact of patch-wise shuffling model accuracy.
Method
Train Dataset (10%)
Train D1tosct(100%)
PSL
0.0091
0.0056
PSL w. Shuffling
0.0672
0.0595
PSL w. Mixup
0.0402
0.0351
PSL w. Random Cutout
0.0920
0,0829
PSL w.
Random CutMix
0.0458
0.0434
PSL w. Random CutMix & Shuffling
0.1233
0.1250
Table Impact of patch-wise shuflling on reconstruction MSE loss.
23


Reviews:
[{"review_id": "4uowc97rUC", "reviewer": "Reviewer_wz2M", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Thanks for submitting the paper to TMLR and it is a pleasure to see the contribution towards the field of privacy-preserving split learning.\n\nStrengths:\n1. The paper studied an important area in privacy-preserving machine learning The method is effective in preserving privacy in split learning with the usage of ViT. The method can effectively defend against three different types of attacks: membership inference attack, reconstruction attack and label inference attack.\n2. The authors provided a theoretical privacy guarantee through differential privacy. Both bounds with centralized differential privacy and Renyi-differential privacy are provided\n3. The paper is easy to read and flows. Motivation and comparison with conventional models such as CNNs are provided.\n\nWeakness:\n1. The paper lacks reference and comparison to important references, which makes it hard to evaluate whether the main argument is well-supported. For example, [1] also proposed a privacy-preserving split learning method based on patch-wise operations, designed for ViTs. [2] studied the privacy-preserving split learning over more broad applications including ViTs for image classification and transformers for text tasks. \n2. Though this paper is easy to read and flows, there still exist some organizational issues. For example, why the degradation of ViT over small datasets is related to the high-level idea of this paper. I'm confused as to why authors need to paraphrase such topics. The authors may also need to pay attention to the usage of prepositions in the paper.\n\n[1] Yao, Dixi, Liyao Xiang, Hengyuan Xu, Hangyu Ye, and Yingqi Chen. \"Privacy-preserving split learning via patch shuffling over transformers.\" In 2022 IEEE International Conference on Data Mining (ICDM), pp. 638-647. IEEE, 2022.   \n[2] Xu, Hengyuan, Liyao Xiang, Hangyu Ye, Dixi Yao, Pengzhi Chu, and Baochun Li. \"Permutation Equivariance of Transformers and Its Applications.\" In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 5987-5996. 2024.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors studied an important research question:  how we can do privacy-preserving split learning with vision transformers. In response to this research question, a privacy-preserving method based on patch-wise random and noisy CutMix is proposed. The proposed method is evaluated and compared with traditional split learning methods and a theoretical bound based on differential privacy is provided. The proposed method can improve accuracy and robustness to imbalanced data distributions over clients.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "I would be happy to see this paper published but I think the following changes may need to be gone through before it is qualified for acceptance.\n\n- The abstract includes too much detail about split learning which can be removed to the background and related work. The abstract is supposed to include more general ideas.\n- The authors may not need to typically mention FL. The argument of why FL is not suitable is not well-supported. For example, model averaging is not the major reason that FL is not supported in the study of research questions. The authors are encouraged to think about the real difference between FL and SL. For example, vision image transformers are usually of bigger memory usage where we cannot accommodate full model training on the edge.\n- It is correct that a ViT usually does not have pooling layers. But a ViT usually has drop out layers which have the similar functionality of skipping activations. Some discussion about drop outs is needed here with the comparison to CNNs.\n- It feels that the proposed CutMix method can also be applied to none-patch wise cases. Could the authors provide more rationale about why we need to define such operations on the patch-wise level?\n- The resolution of images in CIFAR10 and FashionMNIST is very low, less than 32x32. It is very hard to thoroughly evaluate the success of reconstruction attacks. The authors may need to evaluate over datasets containing images of higher resolution, e.g. CelebA High resolution.\n- Only privacy budgets are used as a metric to evaluate the ability to preserve privacy. The authors may need to show the attack success rate in the membership inference attack and the reconstruction performance in the reconstruction attack. Some visualization results are better to understand the effectiveness of privacy preserving methods. For example, moving Figure 10 into the main part.\n- What dataset is used to train auxiliary networks in reconstruction attacks?\n- The authors need to include important references and have a comparison with existing solutions over privacy-preserving split learning using ViTs.\n\nThere are also some minor changes which can be gone through as well:\n\n- The texts in Figure 5 are too small. Readers have to zoom in on every figure.\n- The acronym FP for forward propagation is not a common usage.", "broader_impact_concerns": "It is recommended to have some discussion about broader impact concerns as they are not seen in the current manuscript.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "oBAfv0S00l", "reviewer": "Reviewer_Zgri", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "STRENGTHS:\n\n- Practically important problem: an effective, privacy-preserving method for training VIT could be useful in many CV applications \n- Section 3 is relatively clear \n- Formal DP guarantees are provided for their method. \n- Experiments are used to support the efficacy of their method.\n\nWEAKNESSES: \n\n- Presentation and writing is the main weakness: the writing is unclear in places. One general concern is that too many technical details and too much jargon is used early in the paper before defining these terms and outlining the approach at a high level. Other presentation issues: \n\n-- Abstract: too much technical details; second sentence is confusing and run-on; \"by analysis, we prove...\" sentence is confusing and has strange terminology; \"DP-CutMixSL improves accuracy...\" compared to what? \n\n-- Use \\citet and \\citep appropriately \n\n-- terms like \"cut-layer representation\" and \"smashed data\" are used before they are defined \n\n-- Figure 1 is too busy: it is not clear what CutMixSL is doing from the figure. Perhaps taking out the attacks would help. \n\n-- Table 1 and Sections 5 & 6 are strange: usually we fix the privacy parameter $\\epsilon$ and then write what noise variance $\\sigma^2$ is needed to ensure $\\epsilon$-(R)DP. An interpretable, clean way to compare two DP mechanisms is to plot accuracy vs. $\\epsilon$. However, the paper does things unconventionally and thus it is difficult to interpret the results. \n\n- Related Work: you could discuss related works on differentially private federated learning, such as the papers about \"Private federated learning without a trusted server...\" by Lowy & Razaviyayn (ICLR 2023 and AISTATS 2023).", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a method for privacy-preserving split learning (SL) for training vision transformers (VIT) in computer vision tasks. Their method, coined DP-CutMixSL, adds gaussian noise to clients' smashed data and mixes randomly subsampled patches of clients' smashed data, before sending the noisy data to the server. A differential privacy (DP) guarantee is proven for DP-CutMixSL. Experiments show that DP-CutMixSL offers accuracy and robustness benefits over baselines.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please see above.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "FmzUYpV1d7", "reviewer": "Reviewer_eXdQ", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### **strengths**\nThe paper works on an important problem; proposes an interesting approach.\n\n### **weaknesses**\nThere should be more detailed explanations of the technical aspects of the proposed framework, such as the implementation of the mixer and the process of injecting noise into the smashed data. Also, the limitations of the proposed framework are not discussed. It would be helpful to address potential challenges or drawbacks of the DP-CutMixSL approach.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper addresses an important problem in computer vision and proposes a novel framework, DP-CutMixSL, to mitigate data privacy risks in split learning with vision transformers. The paper provides a clear story and the proposed framework is well motivated. However, I find methodology section a bit lacking. Additionally, the paper should discuss the limitations and potential drawbacks of the proposed approach. Therefore, further improvements are needed before the paper can be considered for publication in a peer-reviewed journal.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "Addressing the weaknesses mentioned above", "broader_impact_concerns": "No", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The results are not super interesting and the problem setting is a little contrived. However, I recommend acceptance because of the correctness of the claims, and the fact that the claims are interesting to a section of the community
Decision: Accept (poster)