Accurate Split Learning on Noisy Signals

Authors: Hang Xu, Aritra Dutta, Xin Li, Panos Kalnis
Primary area: optimization
Keywords: split learning, denoising techniques

Abstract:
Noise injection is applied in Split Learning to address privacy concerns about data leakage. Previous works protect Split Learning by adding noise to the intermediate results during the forward pass. Unfortunately, noisy signals significantly degrade the accuracy of Split Learning training. This paper focuses on improving the training accuracy of Split Learning over noisy signals while protecting training data from reconstruction attacks. We propose two denoising techniques, namely scaling and random masking. Our theoretical results show that both of our denoising techniques accurately estimate the intermediate variables during the forward pass of Split Learning. Moreover, our experiments with deep neural networks demonstrate that the proposed denoising approaches allow Split Learning to tolerate high noise levels while achieving almost the same accuracy as the noise-free baseline. Interestingly, we show that after applying our denoising techniques, the resultant network is more resilient against a state-of-the-art attack compared to the simple noise injection approach.

Decision: reject
Reviewer scores: 6, 6, 3

Reviews and discussion:
<thread>
creation date:
1729363406380

thread_type:
official_review

<thread_object>
creator: reviewer_4b5y

<content>
summary:
This paper discusses the use of scaling and random masking as a denoising method for noise-injected networks in the context of split learning. The authors present both theoretical and empirical evidence showing that applying these denoising techniques during the training phase improves testing accuracy. Additionally, the study demonstrates that the proposed denoising methods enhance the network’s resilience against feature space hijacking attacks.

strengths:
The authors aim to demonstrate that the proposed denoising methods (scaling and random masking) improve test accuracy through both theoretical analysis and empirical evaluation.

weaknesses:
I believe the focus of the paper is misaligned with the target. First, I think the motivation was made clear: to protect models against reconstruction attacks, noise is often added to intermediate representations (IRs), which leads to a drop in accuracy. This creates a privacy-accuracy or robustness-accuracy trade-off. The primary goal of the paper should be to demonstrate that the proposed methods (scaling and random masking) improve this trade-off, but unfortunately discussions about this trade-off is completely missing.

The authors dedicate substantial space to showing that the denoising methods preserve accuracy when noise is injected. However, this seems unnecessary. It is intuitive that denoising in noise-injected networks would help maintain accuracy—a rather trivial observation. Variance scales as the square of the variable scaling, so scaling down naturally reduces variance. Similarly, adding random masking during training makes the network more robust to noise. This is intuitive and easy to understand. 

What the authors really want to show is that the proposed methods also helps in improve network privacy (or at least no degrade on it) so that a better trade-off become possible. This is critical but unfortunately, the authors spend so less effort on it.  I expected to see quantitative measurements against multiple types of attacks, but only the feature space hijacking attack is covered, while other attacks mentioned in the introduction are ignored. Additionally, quantitative results are lacking. 

As such, I feel authors fail to demonstrate a better accuracy-privacy trade-off, leading to their contribution unjustified.

Additionally, they are also minor issues in both theoretical and empirical study. In my understanding, the denoising methods are applied during the training, so with and without this it will lead to different weights. I don't think it is reflected in theoretical analysis. In the empirical analysis part, I don't think it is the best choice to show graphs of accuracy by training epoch as it takes a lot of space. Instead, I would expect to see much richer results from using different parameter settings.

questions:
1. Is there any conclusion on the choice of parameters (i.e. \lambda, p). Authors mostly use \lambda=0.1 or 0.2, p = 0.1 or 0.2. How did author choose on this setting? Does the theoretical analysis provide guidance on how we should choose \lambda and p?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730299554860

thread_type:
official_review

<thread_object>
creator: reviewer_k5df

<content>
summary:
This paper presents innovative denoising techniques for Split Learning to enhance training accuracy while preserving data privacy against reconstruction attacks. The authors propose scaling and random masking methods, demonstrating their efficacy through theoretical and experimental results.

strengths:
1) The paper addresses a critical issue in Split Learning regarding data privacy and accuracy, which is highly relevant in today’s data-driven environment.
2) It introduces two novel denoising techniques—scaling and random masking—that show significant promise in improving training performance under noisy conditions.
3) The theoretical analysis is well-supported by experimental results, enhancing the validity of the proposed methods.
The clarity of the writing and organization of the content facilitate understanding, making complex ideas accessible to a broader audience.

weaknesses:
1) The experimental validation may lack diversity in the datasets used, potentially limiting generalizability.
2) Comparisons with existing methods could be more robust to highlight the advantages of the proposed techniques.
3) The paper could benefit from clearer explanations of the denoising algorithms for readers unfamiliar with the underlying concepts.

questions:
1) The literature review could be expanded to include more recent studies, providing a broader context for the proposed techniques.
2) Additional details on the experimental setup would enhance reproducibility and transparency, allowing other researchers to validate the findings.
3) The paper could benefit from more comprehensive discussions on the limitations of the proposed methods and potential future work.
4) A more detailed analysis of the impact of varying noise levels on training accuracy could provide deeper insights into the practical applications of the proposed techniques.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730531049388

thread_type:
official_review

<thread_object>
creator: reviewer_amqu

<content>
summary:
This paper introduces two denoising techniques—scaling and random masking—for Differential Privacy (DP) within the Split Learning framework. These methods aim to preserve security guarantees while maintaining model accuracy. The authors focus on theoretical contributions supported by extensive simulation and empirical studies, demonstrating that the proposed techniques enhance the accuracy of split neural network classification under DP. Additionally, the paper shows that the resulting deep neural networks are resilient to state-of-the-art hijacking attacks.

strengths:
1. The paper provides a theoretical proof explaining how the proposed denoising methods reduce MSE under certain conditions, effectively denoising while preserving privacy guarantees. The paper covers both a simple identity layer and a more complex linear layer with non-linear activation, with implications for both classification and broader applications.
2. It discusses how the two denoising methods approximate DP-SGD and contribute to privacy.
3. Simulations are conducted for both linear and non-linear cases. Results indicate that the denoising methods exhibit different characteristics at varying noise scales, validating the theoretical claims and offering guidance on the application of each method.
4. The authors conduct practical experiments across five datasets and various ML tasks, including image classification, recommendation, and language modeling. The results show significant improvements, with accuracy close to the clean model performance.
5. The paper examines how hyperparameter settings (e.g., learning rate, weight decay, and optimizer choice) impact denoising performance in practical CIFAR-10/100 image classification tasks.
6. Empirical studies indicate that the proposed method, combined with noise injection, effectively mitigates FSHA.
7. Code is available for review and extensive discussion & extra experiments are available in appendix

weaknesses:
1. The theorem and its proof are limited to L-1 layers, which restricts the scope.
2. While simulation largely supports the theoretical findings, discrepancies are observed between simulation and practical results. For example, scaling outperforms masking in simulation, though this does not hold consistently in practice.
3. Performance degradation occurs when the cut layer is set below L-1.
4. The paper does not explore hybrid applications of the two denoising methods.
5. The empirical study tests only a limited set of noise-injection parameters (e.g., noise scale = 0.7). Exploring denoising limitations would be informative.
6. The empirical study also uses a limited range of cut-layer settings.
7. The paper evaluates only a limited range of attack types.
8. The techniques are demonstrated only in a two-party split learning setup, despite their potential applicability to Split Federated Learning, which has broader real-world use.

questions:
1. The denoising mechanism requires the addition of a tanh function. Could this cause performance degradation? Is it always applicable to general ML tasks?
2. There are no empirical results for cut layers below L-2. Exploring these results could help elucidate the proposed methods' limitations.
3. Could the authors provide more insight into why scaling does not mitigate FSHA effectively?
4. Could the authors discuss the limited performance improvement of the denoising mechanism on Laplacian noise?
</content>
</thread_object>

</thread>
<thread>
creation date:
1732559475812

thread_type:
official_comment

<thread_object>
creator: authors

<content>
comment:
Dear Reviewers,

We posted our detailed rebuttals addressing all your questions and comments. Indeed, we can incorporate many of them in the final version and they would strengthen the paper. We feel many issues raised by the reviewers stem from misunderstandings, and we did our best to clarify them. 

We hope the reviewers will read our rebuttals and engage in meaningful interaction with us. We will be happy to clarify any further doubts.

Thank you again for your time.

Looking forward,

The Authors
</content>
</thread_object>

</thread>
<thread>
creation date:
1733279188139

thread_type:
official_comment

<thread_object>
creator: authors

<content>
comment:
Dear Reviewers,

We posted our detailed rebuttals addressing your questions on the **25th of November 2024 around 1:31 PM EST.** The reviewers mentioned many positive points regarding the main contributions of our paper.  They also raised some interesting questions and concerns that, we believe, stem from misunderstandings --- they are addressable and we did our best to respond to them in detail. Regardless, we plan to incorporate many of those comments in the revised version to increase the manuscript's clarity. We highlight two salient features of our work in the following. 

**Main motivation and focus.** Split learning is an emerging learning technique between different parties in a client-server framework to learn a deep neural network (DNN) model collaboratively, without explicitly sharing raw input data [Gupta and Raskar, '18; Vepakomma et al., '18]. Noise addition (or noise injection) is *normal practice* to ensure privacy when sharing information with others in split learning; see [Titcombe et al., 2021; Abuadbba et al., 2020]. Indeed, noise injection degrades the accuracy. Therefore, we identify the problem as to how to alleviate the issue of reduced accuracy by noise addition while keeping the security intact, specifically for split learning. Improving the privacy accounting for split learning is not the primary focus of this work, instead, we want to show how denoising can improve noisy SplitNN accuracy. For completeness, we discussed the DP guarantee of our ``denoising" mechanisms. 

**Improving the privacy guarantee in noisy Split Learning remains an important open problem.** We note that, after being introduced in the ML community in 2020 by Abuadbba et al., our work is the first attempt to theoretically discuss the differential privacy guarantee in a noisy SplitNN setup. Therefore, we followed the regular DP framework to show the readers that noisy SplitNN training with postprocessing maintains the DP guarantee.  Improving the privacy accounting for split learning is not the primary focus of this work, instead, we want to show how denoising (in our case scaling and masking) can improve noisy SplitNN accuracy. Traditional denoising methods exist for Gaussian noise injection, but none of them is directly applicable in the SplitNN setting. In other words, the differential privacy denoising works cannot be directly applied and compared with noisy SplitNN denoising due to a much-complicated setup in the latter case.  

We hope the reviewers have read our rebuttals and will engage with us in meaningful interaction. We will be happy to clarify any other doubts.

Thank you again for your time.

Looking forward,

Authors
</content>
</thread_object>

</thread>


Metareview:
metareview:
This paper aims to enhance training accuracy while preserving data privacy against reconstruction attacks. The authors propose to use scaling and random masking as a denoising method for noise-injected networks in the context of split learning. Experiments are performed to evaluate the effectiveness of the proposed method against feature space hijacking attacks. The reviewers raised concerns about the obvious discrepancy between simulation and practical results, the limited experimental and evaluation setup, and the misalignment between the paper’s focus and its target. These concerns were not sufficiently addressed. Based on the above considerations, I think the current manuscript does not match the ICLR’s requirement and I do not recommend to accept this manuscript.