Original: ExPLoit: Extracting Private Labels in Split Learning
Revised: ExPLoit: Extracting Private Labels in Split Learning

Original: Abstract —Split learning is a popular technique used to perform vertical federated learning, where the goal is to jointly train a model on the private input and label data held by two parties.
Revised: Abstract —Split learning is a popular technique used to perform vertical federated learning, where the goal is to jointly train a model on the private input and label data held by two parties.

Original: To preserve privacy of the input and label data, this technique uses a split model trained end-to-end, by exchanging the intermediate representations (IR) of the inputs and gradients of the IR between the two parties.
Revised: To preserve privacy of the input and label data, this technique uses a split model trained end-to-end, by exchanging the intermediate representations (IR) of the inputs and gradients of the IR between the two parties.

Original: We propose ExPLoit – a label-leakage attack that allows an adversarial input-owner to extract the private labels of the label-owner during split-learning.
Revised: We propose ExPLoit – a label-leakage attack that allows an adversarial input-owner to extract the private labels of the label-owner during split-learning.

Original: ExPLoit frames the attack as a supervised learning problem by using a novel loss function that combines gradient-matching and several regularization terms developed using key properties of the dataset and models.
Revised: ExPLoit frames the attack as a supervised learning problem by using a novel loss function that combines gradient-matching and several regularization terms developed using key properties of the dataset and models.

Original: Our evaluations on a binary conversion prediction task and several multi-class image classification tasks show that ExPLoit can uncover the private labels with near- perfect accuracy of up to 99 .
Revised: Our evaluations on a binary conversion prediction task and several multi-class image classification tasks show that ExPLoit can uncover the private labels with near- perfect accuracy of up to 99 .

Original: 53% , demonstrating that split learning provides negligible privacy benefits to the label owner.
Revised: 53% , demonstrating that split learning provides negligible privacy benefits to the label owner.

Original: Furthermore, we evaluate the use of gradient noise to defend against ExPLoit. While this technique is effective for simpler datasets, it significantly degrades utility for datasets with higher input dimensionality.
Revised: Furthermore, we evaluate the use of gradient noise as a defense and show that the protection against our attack comes at the cost of a significant loss in model utility.

Original: Our findings underscore the need for better privacy-preserving training techniques for vertically split data.
Revised: Our findings underscore the need for better privacy-preserving training techniques for vertically split data.

Original: I. I NTRODUCTION
Revised: I. I NTRODUCTION

Original: The plethora of apps and services that we use for our everyday needs, such as online shopping, social media, communication, healthcare, finance, etc., have created distributed silos of user data.
Revised: The plethora of apps and services that we use for our everyday needs, such as online shopping, social media, communication, healthcare, finance, etc., have created distributed silos of user data.

Original: While aggregating this distributed data would improve the performance of machine learning models, doing so is not always feasible due to privacy constraints.
Revised: While aggregating this distributed data would improve the performance of machine learning models, doing so is not always feasible due to privacy constraints.

Original: For instance, in healthcare, laws like HIPAA require hospitals to keep medical records private.
Revised: For instance, in healthcare, laws like HIPAA require hospitals to keep medical records private.

Original: For finance and internet companies, user agreements and privacy laws might prevent them from sharing data.
Revised: For finance and internet companies, user agreements and privacy laws might prevent them from sharing data.

Original: These challenges have led to the development of several techniques for federated learning , which allow models to be trained on distributed private data, without the data owner having to share their data explicitly.
Revised: These challenges have led to the development of several techniques for federated learning , which allow models to be trained on distributed private data, without the data owner having to share their data explicitly.

Original: Split learning [11], [25] is one such technique that allows federated learning to be performed when the inputs and the corresponding labels are held by two different parties.
Revised: Split learning [11], [25] is one such technique that allows federated learning to be performed when the inputs and the corresponding labels are held by two different parties.

Original: Split learning uses a composition of two models f : X → Z and g : Z → Y that is split between the input and label owners as shown in Fig.
Revised: Split learning uses a composition of two models f : X → Z and g : Z → Y that is split between the input and label owners as shown in Fig.

Original: The composition network g ◦ f is trained end-to-end by requiring the input owner to transmit the embedding z i (intermediate representation) to the label owner in the forward pass and the label owner returning the gradient ∇ z L i to the input owner during the backward pass.
Revised: The composition network g ◦ f is trained end-to-end by requiring the input owner to transmit the embedding z i (intermediate representation) to the label owner in the forward pass and the label owner returning the gradient ∇ z L i to the input owner during the backward pass.

Original: This allows the parameters of the split model to be trained on the distributed data while keeping the sensitive data with their respective owners.
Revised: This allows the parameters of the split model to be trained on the distributed data while keeping the sensitive data with their respective owners.

Original: Unfortunately, split learning does not have formal privacy guarantees, and it is not clear if it allows the input and label owners to hide their private data from each other.
Revised: Unfortunately, split learning does not have formal privacy guarantees, and it is not clear if it allows the input and label owners to hide their private data from each other.

Original: We set out to answer this question by considering an adversarial input owner who wants to break label privacy by extracting the private labels in two-party split learning.
Revised: We set out to answer this question by considering an adversarial input owner who wants to break label privacy by extracting the private labels in two-party split learning.

Original: To this end, we propose ExPLoit – a label-leakage attack that frames the problem of learning the private labels as a supervised learning task, by leveraging the gradient information ( ∇ z L i ) obtained during split learning.
Revised: To this end, we propose ExPLoit – a label-leakage attack that frames the problem of learning the private labels as a supervised learning task, by leveraging the gradient information ( ∇ z L i ) obtained during split learning.

Original: ExPLoit “replays” split learning by replacing the label owner’s model g and labels { y i } with a randomly initialized surrogate model g ′ (with parameters θ g ′ ) and surrogate labels { y ′ i } respectively.
Revised: ExPLoit “replays” split learning by replacing the label owner’s model g and labels { y i } with a randomly initialized surrogate model g ′ (with parameters θ g ′ ) and surrogate labels { y ′ i } respectively.

Original: We aim to learn the private labels by training these surrogate parameters using the following key objectives:
Revised: We aim to learn the private labels by training these surrogate parameters using the following key objectives:

Original: 1) Gradient Matching Objective: The gradient computed using the surrogate model and labels during replay split learning should match the gradients received from the label owner during the original split learning process.
Revised: 1) Gradient Matching Objective: The gradient computed using the surrogate model and labels during replay split learning should match the gradients received from the label owner during the original split learning process.

Original: 2) Label Prior Objective: The distribution of surrogate labels must match the expected label prior distribution.
Revised: 2) Label Prior Objective: The distribution of surrogate labels must match the expected label prior distribution.

Original: For instance, if the classification problem in consideration has a uniform label prior, the surrogate labels must also have a uniform distribution.
Revised: For instance, if the classification problem in consideration has a uniform label prior, the surrogate labels must also have a uniform distribution.

Original: 3) Label Entropy Objective: Since we consider datasets with hard labels, each individual surrogate label y ′
Revised: 3) Label Entropy Objective: Since we consider datasets with hard labels, each individual surrogate label y ′

Original: i must have low entropy.
Revised: i must have low entropy.

Original: 4) Accuracy Objective: The predictions made by the surrogate model must be close to the surrogate labels, achieving high accuracy.
Revised: 4) Accuracy Objective: The predictions made by the surrogate model must be close to the surrogate labels, achieving high accuracy.

Original: Combining the above objectives yields a loss function that can be used to train the surrogate parameters and labels.
Revised: Combining the above objectives yields a loss function that can be used to train the surrogate parameters and labels.

Original: By minimizing this loss function over all the embedding, gradient pairs { z i , ∇ z L i } received during split learning, the surrogate labels { y ′ i } can be trained to match the private labels of the label owner { y i } , allowing an adversarial input owner to carry out a label leakage attack with high accuracy.
Revised: By minimizing this loss function over all the embedding, gradient pairs { z i , ∇ z L i } received during split learning, the surrogate labels { y ′ i } can be trained to match the private labels of the label owner { y i } , allowing an adversarial input owner to carry out a label leakage attack with high accuracy.

Original: Our paper makes the following key contributions:
Revised: Our paper makes the following key contributions:

Original: Contribution 1: We propose ExPLoit – a label-leakage attack for two-party split learning.
Revised: Contribution 1: We propose ExPLoit – a label-leakage attack for two-party split learning.

Original: Our proposal replaces the label owner’s private labels and model with trainable surrogate parameters and frames the attack as a supervised learning problem.
Revised: Our proposal replaces the label owner’s private labels and model with trainable surrogate parameters and frames the attack as a supervised learning problem.

Original: We combine gradient-matching and regularization terms obtained by leveraging several key properties of the model and dataset to develop a novel loss function.
Revised: We combine gradient-matching and regularization terms obtained by leveraging several key properties of the model and dataset to develop a novel loss function.

Original: By training the surrogate parameters to minimize this loss function, our attack uncovers the private labels of the label owner corresponding to each input.
Revised: By training the surrogate parameters to minimize this loss function, our attack uncovers the private labels of the label owner corresponding to each input.

Original: 𝑓 𝑔 𝑥 !
Revised: 𝑓 𝑔 𝑥 !

Original: Input Owner
Revised: Input Owner

Original: Label Owner
Revised: Label Owner

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original: y
Revised: y

Original: [Figure]
Revised: [Figure]

Original: Contribution 2: We carry out extensive evaluations on the Criteo conversion prediction [23] task, and several image classification datasets, including FashionMNIST, CIFAR-10,
Revised: Contribution 2: We carry out extensive evaluations on the Criteo conversion prediction [23] task, and several image classification datasets, including FashionMNIST, CIFAR-10,

Original: CIFAR-100 and Tiny-ImageNet to show that ExPLoit can leak private labels with near-perfect accuracy (up to 99 .
Revised: CIFAR-100 and Tiny-ImageNet to show that ExPLoit can leak private labels with near-perfect accuracy (up to 99 .

Original: 53% ) for most datasets.
Revised: 53% ) for most datasets.

Original: Our attack is effective across multiple model architectures and also outperforms several recently proposed label-leakage attacks for split learning.
Revised: Our attack is effective across multiple model architectures and also outperforms several recently proposed label-leakage attacks for split learning.

Original: Contribution 3: We evaluate perturbing the gradient with noise as a defense against our attack.
Revised: Contribution 3: We evaluate perturbing the gradient with noise as a defense against our attack.

Original: Our results show that gradient noise allows the label owner to trade off model accuracy (lower utility) for improved privacy against ExPLoit (better label privacy).
Revised: Our results show that gradient noise allows the label owner to trade off model accuracy (lower utility) for improved privacy against ExPLoit (better label privacy).

Original: While this technique works well for simpler datasets like FashionMNIST, it leads to  significant degradation in accuracy for  datasets like CIFAR-10, CIFAR-100 and TinyImagenet, making it unsuitable for more complex datasets.
Revised: However, our results show that a large amount of noise is necessary to offer protection against our attack. This results in a significant degradation of accuracy for several datasets like CIFAR-10, CIFAR-100 and TinyImagenet.

Original: Our findings in this work demonstrate that split learning does not protect the privacy of labels, emphasizing the need for better techniques for VFL.
Revised: Our findings in this work demonstrate that split learning does not protect the privacy of labels, emphasizing the need for better techniques for VFL.

Original: II. R ELATED W ORK
Revised: II. R ELATED W ORK

Original: We discuss prior work on label leakage attacks and describe their limitations.
Revised: We discuss prior work on label leakage attacks and describe their limitations.

Original: For an overview of techniques besides split learning that can be used to learn on vertically partitioned data, we refer the reader to Section X.
Revised: For an overview of techniques besides split learning that can be used to learn on vertically partitioned data, we refer the reader to Section X.

Original: [Figure]
Revised: [Figure]

Original: A. Norm-Based Attack for Conversion Prediction
Revised: A. Norm-Based Attack for Conversion Prediction

Original: Recently, Li et al.
Revised: Recently, Li et al.

Original: proposed Norm-Based Attack [16] – a label leakage attack on two-party split learning, specifically for the conversion prediction problem.
Revised: proposed Norm-Based Attack [16] – a label leakage attack on two-party split learning, specifically for the conversion prediction problem.

Original: We first provide background on the conversion prediction problem and then describe the Norm-Based attack.
Revised: We first provide background on the conversion prediction problem and then describe the Norm-Based attack.

Original: Conversion Prediction:
Revised: Conversion Prediction:

Original: Given the attributes of a user and an ad, conversion prediction estimates the likelihood of a user purchasing the product.
Revised: Given the attributes of a user and an ad, conversion prediction estimates the likelihood of a user purchasing the product.

Original: Conversion prediction is an essential component of ad-ranking algorithms, as ads with a high likelihood of conversion are more relevant to the user and need to be ranked higher.
Revised: Conversion prediction is an essential component of ad-ranking algorithms, as ads with a high likelihood of conversion are more relevant to the user and need to be ranked higher.

Original: The data required to train the model are split between the advertising and product websites, as depicted in Fig.
Revised: The data required to train the model are split between the advertising and product websites, as depicted in Fig.

Original: The user attributes, which serve as the inputs, are stored with the advertising company, while the purchase data, which serve as the labels, are held with the product company.
Revised: The user attributes, which serve as the inputs, are stored with the advertising company, while the purchase data, which serve as the labels, are held with the product company.

Original: The companies are interested in training a model to predict the conversion likelihood while keeping their datasets private.
Revised: The companies are interested in training a model to predict the conversion likelihood while keeping their datasets private.

Original: Norm-based Attack: Norm-based attack [16] leverages the observation that only a small fraction of ad clicks result in a purchase.
Revised: Norm-based Attack: Norm-based attack [16] leverages the observation that only a small fraction of ad clicks result in a purchase.

Original: Consequently, there is a high class imbalance in the training dataset of the conversion prediction task.
Revised: Consequently, there is a high class imbalance in the training dataset of the conversion prediction task.

Original: This imbalance results in the magnitude of the gradients being higher when the infrequent class is encountered.
Revised: This imbalance results in the magnitude of the gradients being higher when the infrequent class is encountered.

Original: Thus, by considering the norm of the loss gradient ( ∥∇ z L i ∥ 2 ), an adversarial input owner can infer the private labels.
Revised: Thus, by considering the norm of the loss gradient ( ∥∇ z L i ∥ 2 ), an adversarial input owner can infer the private labels.

Original: Note that a key limitation of this attack is that it only works on binary classification problems with high class imbalances.
Revised: Note that a key limitation of this attack is that it only works on binary classification problems with high class imbalances.

Original: In contrast, our proposed ExPLoit attack does not require a class imbalance and works for multi-class classification problems.
Revised: In contrast, our proposed ExPLoit attack does not require a class imbalance and works for multi-class classification problems.

Original: B. UnSplit: Gradient Matching Attack
Revised: B. UnSplit: Gradient Matching Attack

Original: Similar to our attack, a recent concurrent work UnSplit [8] also proposes to learn the private labels in split learning using a gradient-matching objective [31] by minimizing the mean squared error (MSE) between the surrogate and true gradients using the following objective: 
Revised: Similar to our attack, a recent concurrent work UnSplit [8] also proposes to learn the private labels in split learning using a gradient-matching objective [31] by minimizing the mean squared error (MSE) between the surrogate and true gradients using the following objective: min θ

Original: [Equation]
Revised: [Equation]

Original: ( ∇ z L ′ i , ∇ z L i ) .
Revised: , ∇ z L i ) .

Original: Here, θ ′ g are the parameters of the surrogate model and { y ′ i } are the surrogate labels.
Revised: Here, θ ′ g are the parameters of the surrogate model and { y ′ i } are the surrogate labels.

Original: Results from this work show that
Revised: Results from this work show that

Original: UnSplit only works well when the label-owner’s model g is one-layer deep.
Revised: UnSplit only works well when the label-owner’s model g is one-layer deep.

Original: In contrast, ExPLoit provides high accuracy of up to 99 .
Revised: In contrast, ExPLoit provides high accuracy of up to 99 .

Original: 53% , even when the label owner uses multi-layer networks (up to 8 layers deep in our experiments).
Revised: 53% , even when the label owner uses multi-layer networks (up to 8 layers deep in our experiments).

Original: This is because ExPLoit uses additional regularization terms in the loss that help avoid poor local minima during training.
Revised: This is because ExPLoit uses additional regularization terms in the loss that help avoid poor local minima during training.

Original: C. Model Completion Attack
Revised: C. Model Completion Attack

Original: Model Completion Attack [9] uses unlabeled embeddings
Revised: Model Completion Attack [9] uses unlabeled embeddings

Original: D = { z i } and a small number of labeled embeddings
Revised: D = { z i } and a small number of labeled embeddings

Original: D l = { z li , y li } to train a surrogate model g ′ :
Revised: D l = { z li , y li } to train a surrogate model g ′ :

Original: Z → Y using semi-supervised learning.
Revised: Z → Y using semi-supervised learning.

Original: Since g ′ functionally approximates the label-owner’s model g , it can be used to predict the labels for the input embeddings y
Revised: Since g ′ functionally approximates the label-owner’s model g , it can be used to predict the labels for the input embeddings y

Original: i =
Revised: i =

Original: g ′ ( z i ) , allowing the input owner to guess the private labels.
Revised: g ′ ( z i ) , allowing the input owner to guess the private labels.

Original: This proposal suffers from two key drawbacks.
Revised: This proposal suffers from two key drawbacks.

Original: First, it requires the adversary to have access to labeled examples, which may not always be available.
Revised: First, it requires the adversary to have access to labeled examples, which may not always be available.

Original: For instance, in case of conversion prediction, labels for the input data cannot be gathered even using human annotators, as it is not readily apparent from the data.
Revised: For instance, in case of conversion prediction, labels for the input data cannot be gathered even using human annotators, as it is not readily apparent from the data.

Original: Second, the efficacy of this attack is limited by the accuracy of the model that can be trained by the adversary.
Revised: Second, the efficacy of this attack is limited by the accuracy of the model that can be trained by the adversary.

Original: Thus, the attack accuracy is highly dependent on the number of labeled examples available to the attacker and the difficulty of the prediction problem at hand.
Revised: Thus, the attack accuracy is highly dependent on the number of labeled examples available to the attacker and the difficulty of the prediction problem at hand.

Original: For example, this attack provides a label leakage accuracy of 75 .
Revised: For example, this attack provides a label leakage accuracy of 75 .

Original: 06% for FashionMNIST, where a high-accuracy g ′ can be trained with just a few labeled examples.
Revised: 06% for FashionMNIST, where a high-accuracy g ′ can be trained with just a few labeled examples.

Original: However, the accuracy is much lower ( 15 . 3% ) for CIFAR-100, where the surrogate model is harder to train.
Revised: However, the accuracy is much lower ( 15 . 3% ) for CIFAR-100, where the surrogate model is harder to train.

Original: In contrast, ExPLoit does not require any labeled examples and can achieve a high accuracy of 94 .
Revised: In contrast, ExPLoit does not require any labeled examples and can achieve a high accuracy of 94 .

Original: 38% even for complex datasets like CIFAR100 (after 10 training epochs of the split-model).
Revised: 38% even for complex datasets like CIFAR100 (after 10 training epochs of the split-model).

Original: III. P RELIMINARIES
Revised: III. P RELIMINARIES

Original: In this section, we provide background on the two-party split learning framework and formally state the objectives of the label leakage attack and defense.
Revised: In this section, we provide background on the two-party split learning framework and formally state the objectives of the label leakage attack and defense.

Original: A. Two-Party Split Learning
Revised: A. Two-Party Split Learning

Original: Two-party split learning is used for VFL, where the data is vertically partitioned between the input and label owner.
Revised: Two-party split learning is used for VFL, where the data is vertically partitioned between the input and label owner.

Original: The input owner owns the inputs D inp
Revised: The input owner owns the inputs D inp

Original: = { x i } and the label owner owns the labels D label =
Revised: = { x i } and the label owner owns the labels D label =

Original: { y i } , corresponding to each input.
Revised: { y i } , corresponding to each input.

Original: The goal of split learning is to train a composition model g ◦ f that is distributed between the two parties.
Revised: The goal of split learning is to train a composition model g ◦ f that is distributed between the two parties.

Original: Training with supervised learning requires mapping the entries in the input set to the corresponding entries in the label set.
Revised: Training with supervised learning requires mapping the entries in the input set to the corresponding entries in the label set.

Original: If this mapping is not known, private set intersection algorithms [5] can be used to link the corresponding entries in the two datasets.
Revised: If this mapping is not known, private set intersection algorithms [5] can be used to link the corresponding entries in the two datasets.

Original: A single training iteration involves a forward and a backward pass (as shown in Fig. 1), which proceeds as follows:
Revised: A single training iteration involves a forward and a backward pass (as shown in Fig. 1), which proceeds as follows:

Original: • Forward pass: The input owner samples a batch of inputs { x } batch ∼ D inp and performs forward propagation through f : X → Z and produces the corresponding embeddings { z } batch .
Revised: • Forward pass: The input owner samples a batch of inputs { x } batch ∼ D inp and performs forward propagation through f : X → Z and produces the corresponding embeddings { z } batch .

Original: These embeddings, along with the corresponding inputIDs are sent to the label owner.
Revised: These embeddings, along with the corresponding inputIDs are sent to the label owner.

Original: The label owner feeds the embeddings to
Revised: The label owner feeds the embeddings to

Original: g
Revised: g

Original:  Z → Y to produce the predictions { p } batch , which along with the labels { y } batch are used to compute the model’s loss L = E [ H ( y, p )] .
Revised: : Z → Y to produce the predictions { p } batch , which along with the labels { y } batch are used to compute the model’s loss L = E [ H ( y, p )] .

Original: • Backward pass: The label owner initiates backpropagation and returns the loss gradient {∇ z L } batch to the input owner.
Revised: • Backward pass: The label owner initiates backpropagation and returns the loss gradient {∇ z L } batch to the input owner.

Original: Both the label and input owner compute the gradient of the loss with respect to the model parameters and update model parameters using gradient descent as shown below:
Revised: Both the label and input owner compute the gradient of the loss with respect to the model parameters and update model parameters using gradient descent as shown below:

Original: [Equation]
Revised: [Equation]

Original: Privacy Objectives: There are two key privacy objectives that split learning aims to achieve:
Revised: Privacy Objectives: There are two key privacy objectives that split learning aims to achieve:

Original: 1) Input privacy: The label owner should not be able to infer the input owner’s private inputs { x i } . 2)
Revised: 1) Input privacy: The label owner should not be able to infer the input owner’s private inputs { x i } . 2)

Original: Label privacy: The input owners should not be able to infer the label owner’s private labels { y i } .
Revised: Label privacy: The input owners should not be able to infer the label owner’s private labels { y i } .

Original: B. Label Leakage Attack Objective
Revised: B. Label Leakage Attack Objective

Original: In this work, we propose a label leakage attack, where an adversarial input owner tries to learn the label owner’s private labels D label =
Revised: In this work, we propose a label leakage attack, where an adversarial input owner tries to learn the label owner’s private labels D label =

Original: { y i } .
Revised: { y i } .

Original: We consider an honest-but-curious adversary, where the input owner tries to infer the private labels while honestly following the split learning protocol.
Revised: We consider an honest-but-curious adversary, where the input owner tries to infer the private labels while honestly following the split learning protocol.

Original: During the training process of split learning, for each input x i , the adversarial input owner transmits the embeddings z i and receives the gradient ∇ z L i from the label owner.
Revised: During the training process of split learning, for each input x i , the adversarial input owner transmits the embeddings z i and receives the gradient ∇ z L i from the label owner.

Original: The adversary uses an algorithm A to estimate the private labels y
Revised: The adversary uses an algorithm A to estimate the private labels y

Original: i for each input using these { z i , ∇ z L i } pairs obtained during split learning as shown below:
Revised: i for each input using these { z i , ∇ z L i } pairs obtained during split learning as shown below:

Original: [Equation]
Revised: [Equation]

Original: The attack objective is to maximize the accuracy of estimated labels as follows:
Revised: The attack objective is to maximize the accuracy of estimated labels as follows:

Original: [Equation]
Revised: [Equation]

Original: Since the private labels { y i } are unavailable to the input owner, evaluating Eqn.
Revised: Since the private labels { y i } are unavailable to the input owner, evaluating Eqn.

Original: 3 is not possible.
Revised: 3 is not possible.

Original: Instead, our proposed attack uses a surrogate objective that can be optimized to uncover the private labels with high accuracy.
Revised: Instead, our proposed attack uses a surrogate objective that can be optimized to uncover the private labels with high accuracy.

Original: Attack Constraints:
Revised: Attack Constraints:

Original: We assume that the parameters and architecture of the label-owner’s model g is unknown to the attacker.
Revised: We assume that the parameters and architecture of the label-owner’s model g is unknown to the attacker.

Revised: While hiding the label-owner’s model architecture does not provide any theoretical security benefits, our assumption is intended to simulate a hard setting for the attacker.

Original: The number of output classes and the class prior distribution are assumed to be known 1 . C. Label Leakage Defense Objective
Revised: The number of output classes and the class prior distribution are assumed to be known 1 . 𝑔′ 𝑝 !"

Original: Defending against label leakage attack requires balancing the following utility and privacy objectives:

Original: Utility Objective: Train the composition model g ◦ f to have high classification accuracy on an unseen validation set associated with the classification task (Eqn. 4).

Original: [Equation]

Original: 𝑔′ 𝑝 !" ∇ # 𝐿 !" 𝐿 !"
Revised: ∇ # 𝐿 !" 𝐿 !"

Original: = 𝐻(𝑦 !" , 𝑝 !" )
Revised: = 𝐻(𝑦 !" , 𝑝 !" )

Original: 𝑓 𝑔 =?
Revised: 𝑓 𝑔 =?

Original: 𝑥 !
Revised: 𝑥 !

Original: Input Owner
Revised: Input Owner

Original: Label Owner 𝑧 !
Revised: Label Owner 𝑧 !

Original: 𝑝 !
Revised: 𝑝 !

Original: =?
Revised: =?

Original: ∇ # 𝐿 !
Revised: ∇ # 𝐿 !

Original: 𝐿 !
Revised: 𝐿 !

Original: =
Revised: =

Original: 𝐻(𝑦 !
Revised: 𝐻(𝑦 !

Original: =?
Revised: =?

Original: ,𝑝 !
Revised: ,𝑝 !

Original: =?)
Revised: =?)

Original: {𝑧 ! , ∇ # 𝐿 ! } 𝑧 !
Revised: {𝑧 ! , ∇ # 𝐿 ! } 𝑧 !

Original: (b) ExPLoit
Revised: (b) ExPLoit

Original: (a)
Revised: (a)

Original: Label owner’s parameters are unknown to the Input Owner
Revised: Label owner’s parameters are unknown to the Input Owner

Original: Collect embedding, gradient data
Revised: Collect embedding, gradient data

Original: Replay split learning with surrogate parameters
Revised: Replay split learning with surrogate parameters

Original: Compute ExPLoit loss 𝐿 $%& (Eqn.12) using ∇ # 𝐿 !"
Revised: Compute ExPLoit loss 𝐿 $%& (Eqn.12) using ∇ # 𝐿 !"

Original: Update surrogate parameters ( 𝜃 ’" and 𝑦′ ) with gradient descent𝑦 = ?
Revised: Update surrogate parameters ( 𝜃 ’" and 𝑦′ ) with gradient descent𝑦 = ?

Original: Privacy Objective: Minimize the  accuracy of the estimated labels { y ′ i } that can be recovered from the gradient information used in split learning (Eqn. 5).
Revised: Defending against label leakage attack requires balancing the following utility and privacy objectives: Utility Objective: Train the composition model g ◦ f to have high classification accuracy on an unseen validation set associated with the classification task (Eqn. 4).

Original: [Equation]
Revised: [Equation]

Original: [Figure] [Figure]
Revised: Privacy Objective: Minimize the accuracy of the estimated labels { y ′ i } that can be recovered from the gradient information used in split learning (Eqn. 5).

Original: [Figure]
Revised: [Equation]

Original: We propose ExPLoit – a label leakage attack that can be used by a malicious input-owner to learn the private labels in split learning.
Revised: We propose ExPLoit – a label leakage attack that can be used by a malicious input-owner to learn the private labels in split learning.

Original: Our key insight is that the label leakage attack can be framed as a supervised learning problem by replacing the unknown parameters of the label owner with learnable surrogate parameters.
Revised: Our key insight is that the label leakage attack can be framed as a supervised learning problem by replacing the unknown parameters of the label owner with learnable surrogate parameters.

Original: This allows the adversarial input owner to “replay” the split learning process with surrogate parameters.
Revised: This allows the adversarial input owner to “replay” the split learning process with surrogate parameters.

Original: We train these surrogate parameters by using a novel loss function that uses gradient-matching and several regularization terms that leverage key properties of the model and training data.
Revised: We train these surrogate parameters by using a novel loss function that uses gradient-matching and several regularization terms that leverage key properties of the model and training data.

Original: By optimizing the surrogate parameters to minimize this loss function, we can recover the label owner’s private labels with high accuracy.
Revised: By optimizing the surrogate parameters to minimize this loss function, we can recover the label owner’s private labels with high accuracy.

Original: The rest of this section describes our proposed attack in greater detail.
Revised: The rest of this section describes our proposed attack in greater detail.

Original: A. Surrogate Parameter Substitution
Revised: A. Surrogate Parameter Substitution

Original: From the input owner’s point of view, the split learning process has two sets of unknown parameters associated with the label-owner: the label owner’s model g and the private labels { y i } (see Fig. 3a).
Revised: From the input owner’s point of view, the split learning process has two sets of unknown parameters associated with the label-owner: the label owner’s model g and the private labels { y i } (see Fig. 3a).

Original: Our goal is to uncover these unknown values by treating them as learnable parameters.
Revised: Our goal is to uncover these unknown values by treating them as learnable parameters.

Original: To do so, we start by substituting these unknowns with randomly initialized surrogate parameters, as shown in Fig.
Revised: To do so, we start by substituting these unknowns with randomly initialized surrogate parameters, as shown in Fig.

Original: 3b.
Revised: 3b.

Original: We replace g with a surrogate model g ′ (with parameters θ g ′ ), and { y i } with a set of surrogate labels { y ′ i } .
Revised: We replace g with a surrogate model g ′ (with parameters θ g ′ ), and { y i } with a set of surrogate labels { y ′ i } .

Original: We want y ′ i to be a point on an n −dimensional probability simplex for an n-class classification problem.
Revised: We want y ′ i to be a point on an n −dimensional probability simplex for an n-class classification problem.

Original: To enforce this property, we set y ′
Revised: To enforce this property, we set y ′

Original: i =
Revised: i =

Original: Softmax (ˆ y i ) , where ˆ y i ∈ R n .
Revised: Softmax (ˆ y i ) , where ˆ y i ∈ R n .

Original: With the surrogate parameters in place, the goal of our attack is to learn the surrogate labels { y ′ i } (or equivalently to learn { ˆ y i } ).
Revised: With the surrogate parameters in place, the goal of our attack is to learn the surrogate labels { y ′ i } (or equivalently to learn { ˆ y i } ).

Original: B. Replay Split Learning
Revised: B. Replay Split Learning

Original: To train the surrogate parameters, we first “replay” the split learning process using the surrogate parameters (Fig. 3b).
Revised: To train the surrogate parameters, we first “replay” the split learning process using the surrogate parameters (Fig. 3b).

Original: First, in the forward pass, the embedding z i (collected during split learning) is fed into g ′ to get the prediction p
Revised: First, in the forward pass, the embedding z i (collected during split learning) is fed into g ′ to get the prediction p

Original: i , which along with the surrogate labels y ′
Revised: i , which along with the surrogate labels y ′

Original: i can be used to compute the loss
Revised: i can be used to compute the loss

Original: L ′ i
Revised: L ′ i

Original: =
Revised: =

Original: H ( y ′ i , p ′ i ) .
Revised: H ( y ′ i , p ′ i ) .

Original: Next, we perform backpropagation through g ′ and compute the gradient of the loss with respect to the embedding ∇ z L
Revised: Next, we perform backpropagation through g ′ and compute the gradient of the loss with respect to the embedding ∇ z L

Original: ′ i .
Revised: ′ i .

Original: We use this gradient data as part of our loss function to learn the private labels, as described below.
Revised: We use this gradient data as part of our loss function to learn the private labels, as described below.

Original: C. ExPLoit Loss
Revised: C. ExPLoit Loss

Original: To train the surrogate parameters θ g ′ and ˆ y , we formulate a loss function using four key objectives:
Revised: To train the surrogate parameters θ g ′ and ˆ y , we formulate a loss function using four key objectives:

Original: Gradient Objective : The loss gradient ∇ z L ′ i , obtained during replay split learning  must match the original gradients ∇ z L i  obtained 
Revised: Gradient Objective : The loss gradient ∇ z L ′ i , obtained during replay split learning , must match the original gradients ∇ z L i , obtained during the original split learning process.

Original: during

Original: the

Original: original split learning process.

Original: This can be

Original: achieved

Original:  by minimizing the l  distance between ∇ 
Revised: This can be achieved by minimizing the l 2 distance between ∇ z L ′ i and ∇ z L i as shown below:

Original: z

Original: L ′ i

Original: and

Original: ∇

Original: z L i as shown below:

Original: [Equation]
Revised: [Equation]

Original: Label Prior Objective : The distribution of surrogate labels must match the label prior P y of the dataset.
Revised: Label Prior Objective : The distribution of surrogate labels must match the label prior P y of the dataset.

Original: The probability distribution of the surrogate labels can be computed by taking the expectation of the surrogate labels 2 P y ′ =
Revised: The probability distribution of the surrogate labels can be computed by taking the expectation of the surrogate labels 2 P y ′ =

Original: E ( y ′ i ) .
Revised: E ( y ′ i ) .

Original: We perform the following optimization to match the distributions of the original and surrogate labels:
Revised: We perform the following optimization to match the distributions of the original and surrogate labels:

Original: [Equation]
Revised: [Equation]

Original: Label Entropy Objective : Each individual surrogate label y ′
Revised: Label Entropy Objective : Each individual surrogate label y ′

Original: i must have low entropy as the datasets we consider have zero entropy one-hot labels.
Revised: i must have low entropy as the datasets we consider have zero entropy one-hot labels

Original: Accuracy Objective : The surrogate model must have high prediction accuracy with respect to the surrogate labels.
Revised: Accuracy Objective : The surrogate model must have high prediction accuracy with respect to the surrogate labels.

Original: In other words, the predictions of the surrogate model p ′
Revised: In other words, the predictions of the surrogate model p ′

Original: i must be close to the surrogate labels y
Revised: i must be close to the surrogate labels y

Original: i.
Revised: i

Original: To achieve the label entropy and accuracy objectives, we can minimize the normalized cross-entropy loss between p ′ i and y
Revised: To achieve the label entropy and accuracy objectives, we can minimize the normalized cross-entropy loss between p ′ i and y

Original: ′ i as follows:
Revised: ′ i as follows:

Original: [Equation]
Revised: [Equation]

Original: Note that the cross-entropy term H ( y ′ i , p ′ i ) in Eqn.
Revised: Note that the cross-entropy term H ( y ′ i , p ′ i ) in Eqn.

Original: 8 can be expressed as a sum of the label entropy and KL divergence between the surrogate label and prediction: H ( y ′ i , p ′ i ) =
Revised: 8 can be expressed as a sum of the label entropy and KL divergence between the surrogate label and prediction: H ( y ′ i , p ′ i ) =

Original: H ( y ′ i )
Revised: H ( y ′ i )

Original: + D KL ( y ′ i
Revised: + D KL ( y ′ i

Original: ∥
Revised: ∥

Original: p ′ i ) .
Revised: p ′ i ) .

Original: Thus, by minimizing cross-entropy, we can minimize the entropy of surrogate labels (label entropy objective) and match the model’s predictions with the surrogate labels (accuracy objective).
Revised: Thus, by minimizing cross-entropy, we can minimize the entropy of surrogate labels (label entropy objective) and match the model’s predictions with the surrogate labels (accuracy objective).

Original: We normalize cross-entropy with the entropy of the label prior H
Revised: We normalize cross-entropy with the entropy of the label prior H

Original: ( P y ) to ensure that the metric is insensitive to the number of label classes and the label priors [13].
Revised: ( P y ) to ensure that the metric is insensitive to the number of label classes and the label priors [13].

Original: We combine all the learning objectives described above to derive the final loss function as shown below:
Revised: We combine all the learning objectives described above to derive the final loss function as shown below:

Original: [Equation]
Revised: [Equation]

Original: Here, λ ce and λ p dictate the relative importance of the crossentropy and label prior terms compared to the gradient loss term (first term in Eqn. 9).
Revised: Here, λ ce and λ p dictate the relative importance of the crossentropy and label prior terms compared to the gradient loss term (first term in Eqn. 9).

Original: By optimizing the surrogate model and label parameters using this loss function, we can recover the private labels of the label owner with high accuracy.
Revised: By optimizing the surrogate model and label parameters using this loss function, we can recover the private labels of the label owner with high accuracy.

Original: We consider the gradient loss term to be the primary optimization objective of our loss function.
Revised: We consider the gradient loss term to be the primary optimization objective of our loss function.

Original: The cross-entropy and label prior terms act as regularizers and help us achieve a better label leakage accuracy (see Section VII for an ablation study).
Revised: The cross-entropy and label prior terms act as regularizers and help us achieve a better label leakage accuracy (see Section VII for an ablation study).

Original: D. Putting It All Together
Revised: D. Putting It All Together

Original: The individual components described thus far can be combined to carry out our label leakage attack.
Revised: The individual components described thus far can be combined to carry out our label leakage attack.

Original: Our attack starts with the input owner performing split learning process with the label owner, as shown in Fig. 3a.
Revised: Our attack starts with the input owner performing split learning process with the label owner, as shown in Fig. 3a.

Original: During this process, the input owner collects the embedding z
Revised: During this process, the input owner collects the embedding z

Original: i and the corresponding loss gradient ∇ z L i for each input.
Revised: i and the corresponding loss gradient ∇ z L i for each input.

Original: Using this data, the input owner can use the ExPLoit attack to leak the private labels.
Revised: Using this data, the input owner can use the ExPLoit attack to leak the private labels.

Original: Our attack is described in Algorithm 1.
Revised: Our attack is described in Algorithm 1.

Original: In the outer loop, we pick values for λ p , λ ce and the learning rates η g ′ ,
Revised: In the outer loop, we pick values for λ p , λ ce and the learning rates η g ′ ,

Original: η ˆ y using a Bayesian hyperparameter optimization algorithm.
Revised: η ˆ y using a Bayesian hyperparameter optimization algorithm.

Original: The surrogate parameters { ˆ y i } i and θ g ′ are randomly initialized, and each inner loop of the attack proceeds as follows:
Revised: The surrogate parameters { ˆ y i } i and θ g ′ are randomly initialized, and each inner loop of the attack proceeds as follows:

Original: 1) Replay split learning with surrogate parameters with the following steps: a. Sample a batch of embeddings, gradients and surrogate labels: { z, ∇ z L, ˆ y } batch .
Revised: 1) Replay split learning with surrogate parameters with the following steps: a. Sample a batch of embeddings, gradients and surrogate labels: { z, ∇ z L, ˆ y } batch .

Original: b. Perform forward pass and compute loss { L′ } using predictions{ p′ } and surrogate labels{ y ′ } .
Revised: b. Perform forward pass and compute loss { L } using predictions p } and surrogate labels

Original: c. Perform backpropagation to compute the loss gradients{∇ z L ′ } .
Revised: c. Perform backpropagation to compute the loss gradients

Original:  Compute the  ExP 
Revised: 2) Compute the ExPLoit loss: L ExP 3) Update surrogate ˆ

Original:  minimize
Revised: to minimize

Original: We repeat the above steps until the values of the surrogate parameters converge. 
Revised: We repeat the above steps until the values of the surrogate parameters converge. Algorithm

Original:  { z i } , {∇ z L i } , P y , N iter
Revised: Input: { z i } , {∇ z L i } , P y , N iter

Original: Output: { y ∗ i }
Revised: Output: { y ∗ i }

Original: D train =
Revised: D train =

Original: { z i , ∇ z L i , y ′ i } for i ← 0 to N iter do λ p , λ ce , η g ′ , η ˆ y ← BayesOpt ()
Revised: { z i , ∇ z L i , y ′ i } for i ← 0 to N iter do λ p , λ ce , η g ′ , η ˆ y ← BayesOpt ()

Original: Initialize { ˆ y i } , g ′ ( · ; θ g ′ ) repeatfor { z, ∇ z L, ˆ y } batch in D train do { y ′ i } =
Revised: Initialize { ˆ y i } , g ′ ( · ; θ g ′ ) repeat for { z, ∇ z L, ˆ y } batch in D train do { y ′ i } =

Original: { Softmax (ˆ y i ) }
Revised: { Softmax (ˆ y i ) }

Original: P y ′
Revised: P y ′

Original: =
Revised: =

Original: E ( y ′ i ) 
Revised: E ( y ′ i ) //

Original:  do p ′
Revised: Replay Split Learning for { z, ∇ z L, ˆ y } i in { z, ∇ z L, ˆ y } batch do p ′

Original: i =
Revised: i =

Original: g ′ ( z i ; θ g ′ )
Revised: g ′ ( z i ; θ g ′ )

Original: L ′ i
Revised: L ′ i

Original: = D KL ( y ′ i
Revised: = D KL ( y ′ i

Original: ∥
Revised: ∥

Original: p ′ i )
Revised: p ′ i )

Original: Compute ∇ z L ′
Revised: Compute ∇ z L ′

Original: i end // 2.
Revised: i end // 2.

Original: Compute ExPLoit loss (Eqn. 12)
Revised: Compute ExPLoit loss (Eqn. 12)

Original: [Equation]
Revised: [Equation]

Original: Update surrogate model, label parameters
Revised: Update surrogate model, label parameters

Original: [Equation]
Revised: [Equation]

Original: ExP end until Convergence ;
Revised: end until Convergence ;

Original: NewBest =
Revised: NewBest =

Original: UpdateBayesOpt ( E [ ∥∇ z L ′ i − ∇ z L i ∥ 2 ]) if NewBest then { y ∗ i } ← { Softmax (ˆ y i ) } end end
Revised: UpdateBayesOpt [Equation] if NewBest then { y ∗ i } ← { Softmax (ˆ y i ) } end end

Original: Hyperparameter Optimization : We learn a set of surrogate labels { y ′ i } in each outer loop for different selections of the hyperparameters.
Revised: Hyperparameter Optimization : We learn a set of surrogate labels { y ′ i } in each outer loop for different selections of the hyperparameters.

Original: Unfortunately, evaluating the accuracy of the surrogate labels produced in each iteration is not possible since the input owner is unaware of any of the true labels.
Revised: Unfortunately, evaluating the accuracy of the surrogate labels produced in each iteration is not possible since the input owner is unaware of any of the true labels.

Original: Consequently, we cannot use accuracy to guide the hyperparameter search.
Revised: Consequently, we cannot use accuracy to guide the hyperparameter search.

Original: Instead, we evaluate the gradient loss term E [ ∥∇ z L ′ i − ∇ z L i ∥ 2 ] after completing each outer iteration and use this as our objective function to be minimized  by tuning the hyperparameters.
Revised: Instead, we evaluate the gradient loss term E [ ∥∇ z L ′ i − ∇ z L i ∥ 2 ] after completing each outer iteration and use this as our objective function to be minimized [Table] by tuning the hyperparameters.

Original: We report the accuracy of the surrogate labels obtained for the best set of hyperparameters that minimizes this objective.[Table]
Revised: We report the accuracy of the surrogate labels obtained for the best set of hyperparameters that minimizes this objective.

Original: V. E XPERIMENTS
Revised: V. E XPERIMENTS

Original: We evaluate ExPLoit with multiple datasets and model architectures to show that it can leak private labels with high accuracy, across different settings.
Revised: We evaluate ExPLoit with multiple datasets and model architectures to show that it can leak private labels with high accuracy, across different settings.

Original: We describe our experimental setup followed by the results in this section.
Revised: We describe our experimental setup followed by the results in this section.

Original: A. Experimental Setup
Revised: A. Experimental Setup

Original: The datasets and the corresponding split-models ( f ◦ g ) used in our evaluations are shown in Table I.
Revised: The datasets and the corresponding split-models ( f ◦ g ) used in our evaluations are shown in Table I.

Original: Datasets: FashionMNIST, CIFAR-10, CIFAR-100, and
Revised: Datasets: FashionMNIST, CIFAR-10, CIFAR-100, and

Original: Tiny-ImageNet are computer vision datasets used to perform multi-class image classification.
Revised: Tiny-ImageNet are computer vision datasets used to perform multi-class image classification.

Original: The Criteo dataset consists of conversion logs for online ad-clicks, with each entry consisting of 3 continuous, and 17 categorical features, along with a binary label indicating if the ad-click resulted in a purchase (conversion).
Revised: The Criteo dataset consists of conversion logs for online ad-clicks, with each entry consisting of 3 continuous, and 17 categorical features, along with a binary label indicating if the ad-click resulted in a purchase (conversion).

Original: Note that the Criteo dataset has a large class imbalance ( 90% of the labels are 0’s, and the rest are 1’s).
Revised: Note that the Criteo dataset has a large class imbalance ( 90% of the labels are 0’s, and the rest are 1’s).

Original: Models: We use a 4-layer convolutional neural network for
Revised: Models: We use a 4-layer convolutional neural network for

Original: FashionMNIST and a 21-layer ResNet model for CIFAR-10,
Revised: FashionMNIST and a 21-layer ResNet model for CIFAR-10,

Original: CIFAR-100 and Tiny-ImageNet.
Revised: CIFAR-100 and Tiny-ImageNet.

Original: The model for the conversion prediction task (Criteo) consists of a learnable embedding layer (to handle categorical features) followed by four fully connected (FC) layers.
Revised: The model for the conversion prediction task (Criteo) consists of a learnable embedding layer (to handle categorical features) followed by four fully connected (FC) layers.

Original: All the models are split into two submodels f (input-owner’s model) and g (label-owner’s model), which are jointly trained using split learning.
Revised: All the models are split into two submodels f (input-owner’s model) and g (label-owner’s model), which are jointly trained using split learning.

Original: The layer at which the model is split is referred to as the cut-layer .
Revised: The layer at which the model is split is referred to as the cut-layer .

Original: To test the sensitivity of our attack to the cut-layer, we perform experiments with two different configurations: Config-1 and
Revised: To test the sensitivity of our attack to the cut-layer, we perform experiments with two different configurations: Config-1 and

Original: Config-2, which splits the model at different points as shown in
Revised: Config-2, which splits the model at different points as shown in

Original: Table I.
Revised: Table I.

Original: The label-owner’s model g only consists of FC layers in Config-1.
Revised: The label-owner’s model g only consists of FC layers in Config-1.

Original: In contrast, the g model in Config-2 is larger and consists of both convolutional (Conv) and FC layers.
Revised: In contrast, the g model in Config-2 is larger and consists of both convolutional (Conv) and FC layers.

Original: The vision models are trained for 10 epochs and the CVR model for 5 epochs using the Adam optimizer with a learning rate of 0.001.
Revised: The vision models are trained for 10 epochs and the CVR model for 5 epochs using the Adam optimizer with a learning rate of 0.001.

Original: We evaluate the efficacy of label leakage attacks at different points during the split-model training by carrying out the attack after each training epoch.
Revised: We evaluate the efficacy of label leakage attacks at different points during the split-model training by carrying out the attack after each training epoch.

Original: Attack parameters: We assume that the architecture of the label owner’s model g is not known to the input owner.
Revised: Attack parameters: We assume that the architecture of the label owner’s model g is not known to the input owner.

Original: Thus, we use a 3-layer fully connected DNN (FC[128-64-10] for image classification and FC[32-32-10] for Criteo) as the surrogate model g ′ .
Revised: Thus, we use a 3-layer fully connected DNN (FC[128-64-10] for image classification and FC[32-32-10] for Criteo) as the surrogate model g ′ .

Original: We set N iter = 500 , and the learning rate range to [10 − 5 , 10 − 4 ] for η g ′ and [10 − 2 , 10 − 1 ] for η ˆ y .
Revised: We set N iter = 500 , and the learning rate range to [10 − 5 , 10 − 4 ] for η g ′ and [10 − 2 , 10 − 1 ] for η ˆ y .

Original: The range for λ ce and λ p is set to [0 . 1 , 3] .
Revised: The range for λ ce and λ p is set to [0 . 1 , 3] .

Original: We carry out the
Revised: We carry out the

Original: ExPLoit attack for each training epoch of split learning.
Revised: ExPLoit attack for each training epoch of split learning.

Original: Evaluation Metric:
Revised: Evaluation Metric:

Original: By learning the surrogate labels associated with each input, ExPLoit groups the inputs that belong to the same class together.
Revised: By learning the surrogate labels associated with each input, ExPLoit groups the inputs that belong to the same class together.

Original: However, the true class labels corresponding to each input group remains to be determined.
Revised: However, the true class labels corresponding to each input group remains to be determined.

Original: For an unbalanced dataset, the label prior information can be used to infer the label by considering the size of each input group.
Revised: For an unbalanced dataset, the label prior information can be used to infer the label by considering the size of each input group.

Original: For a balanced dataset, the adversary can use inputs with known labels (one for each output class) to determine the label associated with each input group.
Revised: For a balanced dataset, the adversary can use inputs with known labels (one for each output class) to determine the label associated with each input group.

Original: We report the clustering accuracy [28] obtained with the best hyperparameters (corresponding to the lowest gradient loss) in our results below.
Revised: We report the clustering accuracy [28] obtained with the best hyperparameters (corresponding to the lowest gradient loss) in our results below.

Original: B. Results
Revised: B. Results

Original: We plot label leakage accuracy for ExPLoit and other label leakage attacks and compare it with the test accuracy/normalized cross entropy 3 of the split-model, across various datasets and model configurations in Fig. 4.
Revised: We plot label leakage accuracy for ExPLoit and other label leakage attacks and compare it with the test accuracy/normalized cross entropy 3 of the split-model, across various datasets and model configurations in Fig. 4.

Original: ExPLoit achieves near-perfect label leakage accuracy for most datasets ( 99 .
Revised: ExPLoit achieves near-perfect label leakage accuracy for most datasets ( 99 .

Original: 53% for CIFAR-10) and significantly outperforms all prior works.
Revised: 53% for CIFAR-10) and significantly outperforms all prior works.

Original: We provide explanations for the attack sensitivity to various parameters like dataset, split-model training epoch, cut layer, and a detailed comparison with recent prior works below.
Revised: We provide explanations for the attack sensitivity to various parameters like dataset, split-model training epoch, cut layer, and a detailed comparison with recent prior works below.

Original: We use the accuracy numbers from Config-1 (Fig. 4a),
Revised: We use the accuracy numbers from Config-1 (Fig. 4a),

Original: Epoch-10 to discuss the results, unless specified otherwise.
Revised: Epoch-10 to discuss the results, unless specified otherwise.

Original: Sensitivity to Split-model Training Epoch: Our results show that the efficacy of ExPLoit improves when attacking the later epochs of the split-model training.
Revised: Sensitivity to Split-model Training Epoch: Our results show that the efficacy of ExPLoit improves when attacking the later epochs of the split-model training.

Original: For instance, the label leakage accuracy of ExPLoit for CIFAR-100 is just 30 .
Revised: For instance, the label leakage accuracy of ExPLoit for CIFAR-100 is just 30 .

Original: 65% for
Revised: 65% for

Original: Epoch-1 and improves to 94 .
Revised: Epoch-1 and improves to 94 .

Original: 4% for Epoch-10.
Revised: 4% for Epoch-10.

Original: The reason for this trend is because our attack approximates the label owner’s model g using a fixed surrogate model g ′ .
Revised: The reason for this trend is because our attack approximates the label owner’s model g using a fixed surrogate model g ′ .

Original: However, in reality, g is not fixed, and changes as training progresses.
Revised: However, in reality, g is not fixed, and changes as training progresses.

Original: The rate of this change is smaller for the latter epochs.
Revised: The rate of this change is smaller for the latter epochs.

Original: Consequently, our ability to approximate g with a fixed surrogate model improves for the later epochs, which improves our attack’s efficacy.
Revised: Consequently, our ability to approximate g with a fixed surrogate model improves for the later epochs, which improves our attack’s efficacy.

Original: While ExPLoit already achieves near perfect accuracy for most datasets with just 10 epochs of split-model training,we expect this accuracy to improve further as the split-model is trained for a greater number of epochs. Sensitivity to Datasets: ExPLoit is more effective for datasets with lower input dimensionality and fewer classes.
Revised: While ExPLoit already achieves near perfect accuracy for most datasets with just 10 epochs of split-model training,

Original: [Figure]
Revised: [Figure]

Original: Labe l
Revised: Labe l

Original: Lea k
Revised: Lea k

Original: A cc .
Revised: A cc .

Original: ( % ) ( a )
Revised: ( % ) ( a )

Original: C on f i g -
Revised: C on f i g -

Original: [Figure]
Revised: [Figure]

Original: FashionMNIST
Revised: FashionMNIST

Original: [Figure]
Revised: [Figure]

Original: Tiny
Revised: Tiny

Original: [Figure]
Revised: [Figure]

Original: ImageNet
Revised: ImageNet

Original: [Figure]
Revised: [Figure]

Original: Criteo
Revised: Criteo

Original: [Figure]
Revised: [Figure]

Original: Labe l
Revised: Labe l

Original: Lea k
Revised: Lea k

Original: A cc .
Revised: A cc .

Original: ( % ) ( b )
Revised: ( % ) ( b )

Original: C on f i g -
Revised: C on f i g -

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Revised: we expect this accuracy to improve further as the split-model is trained for a greater number of epochs.

Revised: Sensitivity to Datasets: ExPLoit is more effective for datasets with lower input dimensionality and fewer classes.

Original: For instance, ExPLoit has a label leakage accuracy of 99 .
Revised: For instance, ExPLoit has a label leakage accuracy of 99 .

Original: 5% for FashionMNIST, whereas the accuracy drops to 94 .
Revised: 5% for FashionMNIST, whereas the accuracy drops to 94 .

Original: 38% for
Revised: 38% for

Original: CIFAR-100 and 80 .
Revised: CIFAR-100 and 80 .

Original: 61% for Tiny-ImageNet.
Revised: 61% for Tiny-ImageNet.

Original: This is because our attack has a higher number of surrogate parameters for
Revised: This is because our attack has a higher number of surrogate parameters for

Original: CIFAR-100 and Tiny-ImageNet compared to FashionMNIST (due to larger input size and number of output classes), which increases the difficulty of the learning problem in our attack.
Revised: CIFAR-100 and Tiny-ImageNet compared to FashionMNIST (due to larger input size and number of output classes), which increases the difficulty of the learning problem in our attack.

Original: Sensitivity to Cut layer and Model Architecture: We evaluate our attack on two split network configurations:
Revised: Sensitivity to Cut layer and Model Architecture: We evaluate our attack on two split network configurations:

Original: Config-1 and Config-2, which represent two different choices of the cut layer.
Revised: Config-1 and Config-2, which represent two different choices of the cut layer.

Original: ExPLoit achieves a higher label-leakage accuracy for Config-1 compared to Config-2.
Revised: ExPLoit achieves a higher label-leakage accuracy for Config-1 compared to Config-2.

Original: For instance, in the case of CIFAR-100, our attack produces a label leakage accuracy of 94 .
Revised: For instance, in the case of CIFAR-100, our attack produces a label leakage accuracy of 94 .

Original: 38% for Config-1 and 65 .
Revised: 38% for Config-1 and 65 .

Original: 74% for Config2.
Revised: 74% for Config2.

Original: The reason for this discrepancy is two-fold.
Revised: The reason for this discrepancy is two-fold.

Original: First, g is larger for Config-2, compared to Config-1, which makes it harder to approximate with a surrogate model g ′ for Config-2.
Revised: First, g is larger for Config-2, compared to Config-1, which makes it harder to approximate with a surrogate model g ′ for Config-2.

Original: Second, our g ′ model is architecturally similar to the g model in Config-1 as both these models use fully connected layers, while the g models in Conv-2 uses FC and Conv layers.
Revised: Second, our g ′ model is architecturally similar to the g model in Config-1 as both these models use fully connected layers, while the g models in Conv-2 uses FC and Conv layers.

Original: Thus, the efficacy of our attack reduces when g is larger and has a dissimilar model architecture compared to g ′ .
Revised: Thus, the efficacy of our attack reduces when g is larger and has a dissimilar model architecture compared to g ′ .

Original: Comparisons with Baseline and Prior Work: We compare the performance of ExPLoit against an unsupervised learning baseline (K-Means Clustering) and three recent attacks: UnSplit, Model Completion and Norm based attack.
Revised: Comparisons with Baseline and Prior Work: We compare the performance of ExPLoit against an unsupervised learning baseline (K-Means Clustering) and three recent attacks: UnSplit, Model Completion and Norm based attack.

Original: The experimental setup for these prior works is described in Section IX.
Revised: The experimental setup for these prior works is described in Section IX.

Original: K-Means Attack: Through the split-learning process, the label-owner is able to generate embeddings
Revised: K-Means Attack: Through the split-learning process, the label-owner is able to generate embeddings

Original: z i = f
Revised: z i = f

Original: ( x i ) , for each input x i .
Revised: ( x i ) , for each input x i .

Original: One way to estimate the private labels is by using unsupervised learning to group these embeddings.
Revised: One way to estimate the private labels is by using unsupervised learning to group these embeddings.

Original: We perform K-Means clustering using the embeddings { z i } and report the resulting label leakage accuracy in Fig. 4.
Revised: We perform K-Means clustering using the embeddings { z i } and report the resulting label leakage accuracy in Fig. 4.

Original: The efficacy of the attack improves with the quality of embeddings.
Revised: The efficacy of the attack improves with the quality of embeddings.

Original: Consequently, the attack performs well for simpler datasets like FashionMNIST, where it is easier to learn good embeddings with relatively few training epochs.
Revised: Consequently, the attack performs well for simpler datasets like FashionMNIST, where it is easier to learn good embeddings with relatively few training epochs.

Original: The attack accuracy accuracy also improves for later epochs as the model f learns better embeddings as training progresses.
Revised: The attack accuracy accuracy also improves for later epochs as the model f learns better embeddings as training progresses.

Original: UnSplit Attack [8]: The UnSplit attack uses the gradient matching loss to learn the private labels.
Revised: UnSplit Attack [8]: The UnSplit attack uses the gradient matching loss to learn the private labels.

Original: The authors of [8] showed that this technique is effective only when g is a single layer network and does not work for multi-layer networks.
Revised: The authors of [8] showed that this technique is effective only when g is a single layer network and does not work for multi-layer networks.

Original: Consistent with their results, our experiments with the UnSplit attack also showed very low efficacy ( 10 . 99% attack accuracy for CIFAR-10, which is comparable to a random guess).
Revised: Consistent with their results, our experiments with the UnSplit attack also showed very low efficacy ( 10 . 99% attack accuracy for CIFAR-10, which is comparable to a random guess).

Original: Model Completion Attack [9]: This attack proposes to train a surrogate model g ′ using semi-supervised learning to predict the private labels corresponding to the inputs.
Revised: Model Completion Attack [9]: This attack proposes to train a surrogate model g ′ using semi-supervised learning to predict the private labels corresponding to the inputs.

Original: Similar to the KMeans attack, the efficacy of this attack depends on the quality of emebddings produced by f .
Revised: Similar to the KMeans attack, the efficacy of this attack depends on the quality of emebddings produced by f .

Original: Consequently, this attack works well for simpler datasets, providing an accuracy of 75 .
Revised: Consequently, this attack works well for simpler datasets, providing an accuracy of 75 .

Original: 06% for FashionMNIST, while the accuracy degrades for more complex datasets like CIFAR-10 ( 61 . 3% accuracy), CIFAR100 ( 15 . 3% accuracy) and Tiny-ImageNet ( 6 . 875% accuracy).
Revised: 06% for FashionMNIST, while the accuracy degrades for more complex datasets like CIFAR-10 ( 61 . 3% accuracy), CIFAR100 ( 15 . 3% accuracy) and Tiny-ImageNet ( 6 . 875% accuracy).

Original: Norm-based attack [16] : The norm-based attack uses gradient norm to predict the labels in imbalanced binary classification problems.
Revised: Norm-based attack [16] : The norm-based attack uses gradient norm to predict the labels in imbalanced binary classification problems.

Original: Evaluations on the Criteo dataset showsthat this attack can achieve high accuracy (comparable with ExPLoit).
Revised: Evaluations on the Criteo dataset shows

Original: The leakage accuracy also improves for the later epochs of the split-model training as the difference in gradient norms becomes more pronounced.

Original: [Figure]
Revised: [Figure]

Original: A
Revised: A

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: FashionMNIST
Revised: FashionMNIST

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Revised: that this attack can achieve high accuracy (comparable with

Revised: ExPLoit).

Revised: The leakage accuracy also improves for the later epochs of the split-model training as the difference in gradient norms becomes more pronounced.

Original: ExPLoit significantly outperforms all prior works, providing a near-perfect label leakage accuracy for most datasets.
Revised: ExPLoit significantly outperforms all prior works, providing a near-perfect label leakage accuracy for most datasets.

Original: E.g.
Revised: E.g.

Original: ExPLoit achieves a label-leakage accuracy of 99 .
Revised: ExPLoit achieves a label-leakage accuracy of 99 .

Original: 53% for
Revised: 53% for

Original: CIFAR-10, which is 32 .
Revised: CIFAR-10, which is 32 .

Original: 38% higher than the next best attack.
Revised: 38% higher than the next best attack.

Original: This difference is even more pronounced when the attack is carried out at an earlier training epoch ( 67 . 2% higher accuracy compared to next best attack at Epoch-1 for CIFAR-10).
Revised: This difference is even more pronounced when the attack is carried out at an earlier training epoch ( 67 . 2% higher accuracy compared to next best attack at Epoch-1 for CIFAR-10).

Original: This is because, unlike prior works, the efficacy of ExPLoit does not depend on the quality of embeddings produced by f .
Revised: This is because, unlike prior works, the efficacy of ExPLoit does not depend on the quality of embeddings produced by f .

Original: The efficacy of our attack demonstrates that split learning offers negligible privacy benefits for the label owner.
Revised: The efficacy of our attack demonstrates that split learning offers negligible privacy benefits for the label owner.

Original: VI. G RADIENT N OISE D EFENSE
Revised: VI. G RADIENT N OISE D EFENSE

Original: ExPLoit uses the gradient information obtained from the label owner during split learning to leak the private labels.
Revised: ExPLoit uses the gradient information obtained from the label owner during split learning to leak the private labels.

Original: One way to defend against ExPLoit is by perturbing the loss gradients ∇ z L i with noise as shown in Eqn.∇ [Equation] where η
Revised: One way to defend against ExPLoit is by perturbing the loss gradients ∇ z L i with noise as shown in Eqn.

Original: [Equation]
Revised: [Equation]

Original: The label owner can transmit these noisy gradients ∇ z
Revised: The label owner can transmit these noisy gradients ∇ z

Original: ˆ L i to the input owner to perform split learning.
Revised: ˆ L i to the input owner to perform split learning.

Original: Adding noise prevents the input owner from having reliable access to the true gradients.
Revised: Adding noise prevents the input owner from having reliable access to the true gradients.

Original: This reduces the efficacy of ExPLoit, providing better privacy to the label owner.
Revised: This reduces the efficacy of ExPLoit, providing better privacy to the label owner.

Original: On the other hand, noisy gradients are detrimental to training the split model and results in lower accuracy, thus impacting utility.
Revised: On the other hand, noisy gradients are detrimental to training the split model and results in lower accuracy, thus impacting utility.

Original: To evaluate the utility-privacy trade-off offered by this defense, we perform split learning with different amounts of gradient noise by sweeping σ in Eqn. 10.
Revised: To evaluate the utility-privacy trade-off offered by this defense, we perform split learning with different amounts of gradient noise by sweeping σ in Eqn. 10.

Original: For each value of σ , we train the splitmodel till convergence and report the test and label leakage accuracy with ExPLoit.
Revised: For each value of σ , we train the splitmodel till convergence and report the test and label leakage accuracy with ExPLoit.

Original: Since the gradients obtained during split learning are noisy, optimizing the hyperparameters of our attack using the gradient loss objective is not optimal.
Revised: Since the gradients obtained during split learning are noisy, optimizing the hyperparameters of our attack using the gradient loss objective is not optimal.

Original: Instead we tune the hyperparameters using L ExP ( λ ce = 1 , λ p = 1) as the optimization objective.
Revised: Instead we tune the hyperparameters using L ExP ( λ ce = 1 , λ p = 1) as the optimization objective.

Original: The utility-privacy trade-off with gradient noise defense for ExPLoit is shown in Fig.
Revised: The utility-privacy trade-off with gradient noise defense for ExPLoit is shown in Fig.

Original: Against the ExPLoit attack, this defense provides a better utility-privacy trade-off for lower dimensional datasets like Criteo and FashionMNIST.
Revised: Against the ExPLoit attack, this defense provides a better utility-privacy trade-off for lower dimensional datasets like Criteo and FashionMNIST.

Original: For instance, gradient noise degrades the label leakage accuracy for FashionMNIST by 51 .
Revised: For instance, gradient noise degrades the label leakage accuracy for FashionMNIST by 51 .

Original: 8% with only a 2 .
Revised: 8% with only a 2 .

Original: 26% reduction of test accuracy.
Revised: 26% reduction of test accuracy.

Original: In contrast, for CIFAR-10, a 79% reduction in label leakage accuracy incurs a 38% reduction in test accuracy.
Revised: In contrast, for CIFAR-10, a 79% reduction in label leakage accuracy incurs a 38% reduction in test accuracy.

Original: This discrepancy is because adding gradient noise hampers the quality of the input owner’s model f .
Revised: We hypothesize that this discrepancy could be attributable to the degradation in the quality of the input owner’s model f .

Original: Simpler datasets are more resilient to this degradation, whereas more complex datasets like CIFAR-10, CIFAR-100 and Tiny-ImageNet are impacted more if f is not trained properly.Thus, while gradient noise might be suitable for simpler datasets, it may not be practical for more complex datasets.
Revised: Lower-dimensional datasets could be more resilient to this degradation, whereas higher-dimensional datasets like CIFAR10, CIFAR-100 and Tiny-ImageNet may be impacted more if f is not trained properly.

Original: Additionally, we evaluate the gradient noise defense against other attacks.
Revised: Additionally, we evaluate the gradient noise defense against other attacks.

Original: While the gradients are not directly used by the K-Means and model completion attacks, gradient noise reduces the quality of embeddings learnt by f , which degrades the efficacy of these attacks.
Revised: While the gradients are not directly used by the K-Means and model completion attacks, gradient noise reduces the quality of embeddings learnt by f , which degrades the efficacy of these attacks.

Original: We find that these attacks are more resilient to gradient noise for simpler datasets (FashionMNIST) compared to ExPLoit as the quality of the embeddings does not degrade significantly.
Revised: We find that these attacks are more resilient to gradient noise for FashionMNIST, as the quality of the embeddings does not degrade significantly.

Original: However, ExpLoit performs better than these two attacks formore complex datasets like CIFAR-100 and Tiny-ImageNet.
Revised: However, ExpLoit performs better than these two attacks for datasets like CIFAR-100 and Tiny-ImageNet.

Original: The UnSplit attack continues to provide no benefit under gradient noise.
Revised: The UnSplit attack continues to provide no benefit under gradient noise.

Original: VII. A BLATION S TUDY
Revised: VII. A BLATION S TUDY

Original: ExPLoit replaces the unknown labels and model parameters of the label owner with surrogate parameters and uses the gradient information obtained during split learning to train these surrogate parameters.
Revised: ExPLoit replaces the unknown labels and model parameters of the label owner with surrogate parameters and uses the gradient information obtained during split learning to train these surrogate parameters.

Original: In addition to matching the surrogate gradients obtained during “replay” split learning with the original gradients, our loss function consists of two regularization terms as shown in Eqn. 11.
Revised: In addition to matching the surrogate gradients obtained during “replay” split learning with the original gradients, our loss function consists of two regularization terms as shown in Eqn. 11.

Original: [Equation]
Revised: [Equation]

Original: The cross-entropy regularization
Revised: The cross-entropy regularization

Original: [Equation]
Revised: [Equation]

Original: term [Equation] achieves the dual objective of minimizing the entropy of the individual surrogate labels and improving the accuracy of the surrogate model ( g ′ ).
Revised: achieves the dual objective of minimizing the entropy of the individual surrogate labels and improving the accuracy of the surrogate model ( g ′ ).

Original: The label prior regularization (LPR) term D KL ( P y ∥
Revised: The label prior regularization (LPR) term D KL ( P y ∥

Original: P y ′ ) tries to match the distribution of the surrogate labels with the label prior.
Revised: P y ′ ) tries to match the distribution of the surrogate labels with the label prior.

Original: We conduct an ablation study to understand the importance of the two regularization terms by carrying out ExPLoit

Original: [Table]
Revised: [Table]

Original:  without using LPR, without using CER, and without using both LPR and CER.
Revised: We conduct an ablation study to understand the importance of the two regularization terms by carrying out ExPLoit without using LPR, without using CER, and without using both LPR and CER.

Original: The resuls of this study are shown in
Revised: The resuls of this study are shown in

Original: Table II.
Revised: Table II.

Original: As expected, we find that there is a degradation in accuracy when regularization terms are not used.
Revised: As expected, we find that there is a degradation in accuracy when regularization terms are not used.

Original: CER seems to be more important compared to LPR as the degradation is higher when CER is not used.
Revised: CER seems to be more important compared to LPR as the degradation is higher when CER is not used.

Original: For CIFAR-10 and Criteo, the regularization terms seem to matter less as the accuracy is high even when we disable both regularization terms.
Revised: For CIFAR-10 and Criteo, the regularization terms seem to matter less as the accuracy is high even when we disable both regularization terms.

Original: VIII. L IMITATIONS
Revised: VIII. L IMITATIONS

Original: Our proposed ExPLoit Attack uses the gradient information obtained during split learning to leak the private labels.
Revised: Our proposed ExPLoit Attack uses the gradient information obtained during split learning to leak the private labels.

Original: We assume that the input owner has knowledge of the number of classes and the distribution of the labels over these classes (prior information) to develop our loss function (Eqn. 9).
Revised: We assume that the input owner has knowledge of the number of classes and the distribution of the labels over these classes (prior information) to develop our loss function (Eqn. 9).

Original: If the attacker is completely unaware of the downstream classification task, this information could be hard to estimate, making our attack less effective (see Section VII).
Revised: If the attacker is completely unaware of the downstream classification task, this information could be hard to estimate, making our attack less effective (see Section VII).

Original: However, we argue that it is rare for the input owner (attacker) to be completely unaware of the downstream classification task.
Revised: However, we argue that it is rare for the input owner (attacker) to be completely unaware of the downstream classification task.

Original: Even if the label prior is unknown, knowledge of the task in itself might be sufficient to make an educated guess about the label prior.
Revised: Even if the label prior is unknown, knowledge of the task in itself might be sufficient to make an educated guess about the label prior.

Original: For instance, in conversion prediction, the average conversion rate for online advertising is publicly available [4].
Revised: For instance, in conversion prediction, the average conversion rate for online advertising is publicly available [4].

Original: For disease prediction, the prevalence rate of a disease is often known and can be used as the label prior.
Revised: For disease prediction, the prevalence rate of a disease is often known and can be used as the label prior.

Original: Developing attacks that do not require label prior information is an interesting avenue of exploration for future work.
Revised: Developing attacks that do not require label prior information is an interesting avenue of exploration for future work.

Original: IX. E XPERIMENTAL S ETUP FOR P RIOR W ORKS
Revised: IX. E XPERIMENTAL S ETUP FOR P RIOR W ORKS

Original: We describe the experimental setup and evaluation methodology for the prior works used in our experiments.
Revised: We describe the experimental setup and evaluation methodology for the prior works used in our experiments.

Original: The Unsplit and Model Completion attacks both require a surrogate model.
Revised: The Unsplit and Model Completion attacks both require a surrogate model.

Original: To have a fair comparison, we use the same surrogate model as ExPLoit (see Table I) for both of these attacks.
Revised: To have a fair comparison, we use the same surrogate model as ExPLoit (see Table I) for both of these attacks.

Original: UnSplit Attack: The UnSplit attack [8] aims to learn the surrogate labels { y ′ } and model parameters θ g ′ by minimizing the mean square error loss between the original and the surrogate gradients using the following objective: min θ ′ g , { y ′ i } MSE ( ∇ z L ′
Revised: UnSplit Attack: The UnSplit attack [8] aims to learn the surrogate labels { y ′ } and model parameters θ g ′ by minimizing the mean square error loss between the original and the surrogate gradients using the following objective: min θ ′ g , { y ′ i } MSE ( ∇ z L ′

Original: i , ∇ z L i ) .
Revised: i , ∇ z L i ) .

Original: We use an Adam optimizer with a learning rate of 0.001 and train for 50 epochs.
Revised: We use an Adam optimizer with a learning rate of 0.001 and train for 50 epochs.

Original: Model Completion Attack: Model completion attack [9] trains the surrogate model using semi-supervised learning by using a small number of labeled embeddings D l = { z li , y li } and unlabeled embeddings D
Revised: Model Completion Attack: Model completion attack [9] trains the surrogate model using semi-supervised learning by using a small number of labeled embeddings D l = { z li , y li } and unlabeled embeddings D

Original: = { z i } .
Revised: = { z i } .

Original: We assume that the attacker has 4 labeled examples per class for the vision datasets and 50 examples per class for the Critio dataset.
Revised: We assume that the attacker has 4 labeled examples per class for the vision datasets and 50 examples per class for the Critio dataset.

Original: We use the parameters from the original paper [9] to perform semisupervised learning.
Revised: We use the parameters from the original paper [9] to perform semisupervised learning.

Original: We set temperature T=0.8 for sharpening the predictions, λ u = 50 as the weight for the loss on the unlabeled dataset and α = 0 .
Revised: We set temperature T=0.8 for sharpening the predictions, λ u = 50 as the weight for the loss on the unlabeled dataset and α = 0 .

Original: 5 for MixUp.
Revised: 5 for MixUp.

Original: We train all the models for 100 epochs and report the accuracy by using the predictions of this trained model.
Revised: We train all the models for 100 epochs and report the accuracy by using the predictions of this trained model.

Original: Norm-Based Attack: The norm-based attack uses the difference in the magnitude of gradient norms in imbalanced binary datasets to predict the private labels.
Revised: Norm-Based Attack: The norm-based attack uses the difference in the magnitude of gradient norms in imbalanced binary datasets to predict the private labels.

Original: This difference can be seen clearly from Fig.
Revised: This difference can be seen clearly from Fig.

Original: 6, which shows the distribution of gradient norms ∥∇ z L ∥ 2 obtained during split learning for different epochs of the conversion prediction model trained on the Criteo dataset.
Revised: 6, which shows the distribution of gradient norms ∥∇ z L ∥ 2 obtained during split learning for different epochs of the conversion prediction model trained on the Criteo dataset.

Original: The norm-based attack exploits this difference in the gradient norms and uses it to infer the private labels in split learning.
Revised: The norm-based attack exploits this difference in the gradient norms and uses it to infer the private labels in split learning.

Original: This attack uses a threshold T to classify the examples into positive and negative classes as shown below.
Revised: This attack uses a threshold T to classify the examples into positive and negative classes as shown below.

Original: [Equation]
Revised: [Equation]

Original: We sweep the value of T and pick a value that yields the best accuracy to report the Norm-based attack results in
Revised: We sweep the value of T and pick a value that yields the best accuracy to report the Norm-based attack results in

Original: Section V-B. Note that in a real attack setting, the adversary does not have the ability to check the accuracy for different values of T .
Revised: Section V-B. Note that in a real attack setting, the adversary does not have the ability to check the accuracy for different values of T .

Original: However, we pick an ideal value of T in our experiments to understand the best possible accuracy that can be obtained with the Norm-based attack. X. O THER R ELATED W ORK
Revised: However, we pick an ideal value of T in our experiments to understand the best possible accuracy that can be obtained with the Norm-based attack. [Equation]

Original: We describe prior works in vertical federated learning that are not directly related to our proposed attack in this section.
Revised: We describe prior works in vertical federated learning that are not directly related to our proposed attack in this section.

Original: A. Privacy-Preserving Training Techniques for Vertical Federated Learning
Revised: A. Privacy-Preserving Training Techniques for Vertical Federated Learning

Original: In addition to split learning, several methods have been proposed to train a model on vertically partitioned private data.
Revised: In addition to split learning, several methods have been proposed to train a model on vertically partitioned private data.

Original: These methods can broadly be classified into three categories:
Revised: These methods can broadly be classified into three categories:

Original: Differential Privacy (DP) 2.
Revised: Differential Privacy (DP) 2.

Original: Multi-Party Compute (MPC) and 
Revised: Multi-Party Compute (MPC) and 3.

Original: Trusted Execution Environment ( TEE).
Revised: Trusted Execution Environment (TEE).

Original: We discuss solutions in each category and describe their limitations.
Revised: We discuss solutions in each category and describe their limitations

Original: Label Differential Privacy: Differential privacy [7] is a principled system for training on a private database thatrestricts the influence of any single entry of the database on the outcome by adding noise to a query’s response. A recent
Revised: Label Differential Privacy: Differential privacy [7] is a principled system for training on a private database that

Original: [Figure]
Revised: [Figure]

Original:  t
Revised: a c t

Original: i
Revised: i

Original: [Figure]
Revised: [Figure]

Original: n [Figure] f
Revised: n o f

Original: [Figure]

Original:  a t a
Revised: D a t a

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Revised: restricts the influence of any single entry of the database on the outcome by adding noise to a query’s response.

Original:  work [10] proposed Label Differential Privacy (LDP) to train a model on vertically partitioned data with sensitive labels.
Revised: A recent work [10] proposed Label Differential Privacy (LDP) to train a model on vertically partitioned data with sensitive labels.

Original: LDP relies on a randomized response algorithm to provide a noisy version of the labels to the input owner by defining a probability distribution over the class labels as follows:
Revised: LDP relies on a randomized response algorithm to provide a noisy version of the labels to the input owner by defining a probability distribution over the class labels as follows:

Original: [Equation]
Revised: [Equation]

Original: The label owner uses the noisy labels sampled from this distribution and the input data to train a model.
Revised: The label owner uses the noisy labels sampled from this distribution and the input data to train a model.

Original: To prevent the model from overfitting on the incorrect labels, the authors propose using the Mixup technique [30] to train the model, which provides resilience to label noise.
Revised: To prevent the model from overfitting on the incorrect labels, the authors propose using the Mixup technique [30] to train the model, which provides resilience to label noise.

Original: One drawback of this technique is that it allows the input owner to have complete ownership of the model.
Revised: One drawback of this technique is that it allows the input owner to have complete ownership of the model.

Original: In contrast, split learning enables the input and label owners to jointly own the model, which might be desirable if the label owner wants to exercise control over the usage of the model.
Revised: In contrast, split learning enables the input and label owners to jointly own the model, which might be desirable if the label owner wants to exercise control over the usage of the model.

Original: Multi-Party Compute (MPC): Several works [18], [20], [27] have proposed using cryptographic techniques to enable private computations over distributed data held by multiple parties.
Revised: Multi-Party Compute (MPC): Several works [18], [20], [27] have proposed using cryptographic techniques to enable private computations over distributed data held by multiple parties.

Original: These works use a combination of cryptographic primitives such as oblivious transfer [2], [14], [22], garbled circuits [29], secret sharing [6] and homomorphic encryption [21] to train the model.
Revised: These works use a combination of cryptographic primitives such as oblivious transfer [2], [14], [22], garbled circuits [29], secret sharing [6] and homomorphic encryption [21] to train the model.

Original: Unfortunately, these methods have significant computational overheads and require multiple rounds of communication between the parties involved.
Revised: Unfortunately, these methods have significant computational overheads and require multiple rounds of communication between the parties involved.

Original: Consequently, even training a simple 2-layer network incurs a 30 × overhead [18] compared to training without privacy, making it impractical for training larger networks.
Revised: Consequently, even training a simple 2-layer network incurs a 30 × overhead [18] compared to training without privacy, making it impractical for training larger networks.

Original: Trusted Execution Environment (TEE): Trusted Execution Environments use hardware enclaves to enable remote computations with confidentiality and integrity.
Revised: Trusted Execution Environment (TEE): Trusted Execution Environments use hardware enclaves to enable remote computations with confidentiality and integrity.

Original: A centrally hosted TEE can be used to train a model on distributed data.
Revised: A centrally hosted TEE can be used to train a model on distributed data.

Original: The data owners can communicate data securely over an encrypted channel to the trusted enclave.
Revised: The data owners can communicate data securely over an encrypted channel to the trusted enclave.

Original: Training is performed while ensuring data confidentiality, and the resulting model is transmitted securely to the data owners.
Revised: Training is performed while ensuring data confidentiality, and the resulting model is transmitted securely to the data owners.

Original: Unfortunately,
Revised: Unfortunately,

Original: TEEs have slow memory due to the overheads associated with encryption and integrity checks [12], [19].
Revised: TEEs have slow memory due to the overheads associated with encryption and integrity checks [12], [19].

Original: Moreover, commercially available TEEs such as Intel SGX [17] and
Revised: Moreover, commercially available TEEs such as Intel SGX [17] and

Original: Arm Trustzone [26] are CPU-based and offer less parallelism compared to GPUs.
Revised: Arm Trustzone [26] are CPU-based and offer less parallelism compared to GPUs.

Original: The combination of these two factors results in orders of magnitude [3] increase in training times of models.
Revised: The combination of these two factors results in orders of magnitude [3] increase in training times of models.

Original: Additionally, this solution requires specialized hardware, which adds to the cost of implementation.
Revised: Additionally, this solution requires specialized hardware, which adds to the cost of implementation.

Original: B. Input Privacy Attacks and Defenses in Split Learning
Revised: B. Input Privacy Attacks and Defenses in Split Learning

Original: Recent works have proposed attacks to break input privacy in split learning.
Revised: Recent works have proposed attacks to break input privacy in split learning.

Original: The goal of these attacks (a.k.a model inversion attack) is for an adversarial label owner to recover the private inputs { x i } of the input owner using the embedding information { z i } obtained during split learning.
Revised: The goal of these attacks (a.k.a model inversion attack) is for an adversarial label owner to recover the private inputs { x i } of the input owner using the embedding information { z i } obtained during split learning.

Original: A recent work [1] showed that, for simple 1-d time-series signals, the embedding data obtained in split learning might not preserve privacy as it has a high distance correlation with the original input data.
Revised: A recent work [1] showed that, for simple 1-d time-series signals, the embedding data obtained in split learning might not preserve privacy as it has a high distance correlation with the original input data.

Original: Model inversion attacks have also been demonstrated on split learning with more complex datasets in the image domain [24].
Revised: Model inversion attacks have also been demonstrated on split learning with more complex datasets in the image domain [24].

Original: To carry out the attack, the adversary uses examples from the input data distribution { x ′ i } to query the input owner’s model and generate embeddings z ′ i
Revised: To carry out the attack, the adversary uses examples from the input data distribution { x ′ i } to query the input owner’s model and generate embeddings z ′ i

Original: =
Revised: =

Original: f
Revised: f

Original: ( x ′ i ) .
Revised: ( x ′ i ) .

Original: The input and embedding data can be used to train an inversion model f inv that maps the embedding to the input: Z → X .
Revised: The input and embedding data can be used to train an inversion model f inv that maps the embedding to the input: Z → X .

Original: This inversion model can be used to reconstruct the input data using the embeddings during the attack.
Revised: This inversion model can be used to reconstruct the input data using the embeddings during the attack.

Original: Note that such attacks require access to the examples from the input data distribution and black-box query access to the input owner’s model.
Revised: Note that such attacks require access to the examples from the input data distribution and black-box query access to the input owner’s model.

Original: In contrast, our label leakage attack does not require black-box access to the label owner’s model or access to the ground truth label data.
Revised: In contrast, our label leakage attack does not require black-box access to the label owner’s model or access to the ground truth label data.

Original: [1] also proposes using additive noise to perturb the embedding to defend against such attacks.
Revised: [1] also proposes using additive noise to perturb the embedding to defend against such attacks.

Original: This is similar in spirit to our work, which uses gradient noise to deter label leakage attacks.
Revised: This is similar in spirit to our work, which uses gradient noise to deter label leakage attacks.

Original: XI. C ONCLUSION
Revised: XI. C ONCLUSION

Original: Split learning has been proposed as a method to train a model on vertically split data while keeping the data private.
Revised: Split learning has been proposed as a method to train a model on vertically split data while keeping the data private.

Original: We investigate the privacy properties of two-party split learning by proposing ExPLoit – a label-leakage attack that allows an adversarial input owner to learn the label owner’s private labels during split learning.
Revised: We investigate the privacy properties of two-party split learning by proposing ExPLoit – a label-leakage attack that allows an adversarial input owner to learn the label owner’s private labels during split learning.

Original: Our key insight is that the attack can be framed as a learning problem by substituting the unknown parameters of the label owner with learnable surrogate parameters.
Revised: Our key insight is that the attack can be framed as a learning problem by substituting the unknown parameters of the label owner with learnable surrogate parameters.

Original: We use the gradient data collected during split learning and a novel loss function to train these surrogate parameters.
Revised: We use the gradient data collected during split learning and a novel loss function to train these surrogate parameters.

Original: Our evaluations on several image-classification tasks and a converstion prediction task show that ExPLoit can leak private labels with near-perfect accuracy of up to 99 .
Revised: Our evaluations on several image-classification tasks and a converstion prediction task show that ExPLoit can leak private labels with near-perfect accuracy of up to 99 .

Original: 53% , proving that split learning provides a negligible amount of label privacy.
Revised: 53% , proving that split learning provides a negligible amount of label privacy.

Original: ExPLoit also outperforms recent prior works, offering up to 67 .
Revised: ExPLoit also outperforms recent prior works, offering up to 67 .

Original: 2% improvement in label leakage accuracy.
Revised: 2% improvement in label leakage accuracy.

Original: We also evaluate gradient noise as a defense to improve label privacy.
Revised: We also evaluate gradient noise as a defense to improve label privacy.

Original: While this provides a reasonable defense for simpler datasets, we find that the utility-privacy tradeoff of this technique is unfavorable for more complex datasets.
Revised: While this provides a reasonable defense for simpler datasets, we find that the utility-privacy tradeoff of this technique is unfavorable for more complex datasets.

Original: Our findings in this work underscore the need for better techniques to perform vertical federated learning. I. R EVIEWER # A. Summary
Revised: Our findings in this work underscore the need for better techniques to perform vertical federated learning

Original: This paper proposes a label-leakage attack that allows an adversarial input-owner to extract the private labels of the label-owner during split-learning.

Original: This paper leverages the gradient information obtained during split learning to frame the problem of learning the private labels as a supervised learning task.

Original: The proposed ExPLoit learns the private labels by training the surrogate parameters using a loss function yielded from Gradient Matching Objective, Label Prior Objective, Label Entropy Objective and Accuracy Objective.

Original: This paper demonstrates that an adversarial input owner can learn the private labels using gradient information obtained during split learning, which compromises the label owner’s privacy.

Original: B. Strengths

Original: I think that the proposed idea of leveraging the gradient information obtained during split learning to extract the private labels of the label-owner is novel and effective.

Original: From the perspective of experimental results, the proposed attack is effective across multiple model architectures and also outperforms several recently proposed label-leakage attacks for split learning.

Original: This paper shows that split learning does not protect the privacy of labels, emphasizing the need for better techniques for VFL.

Original: The topic is interesting and important for developing the privacy protection, and the proposed method sounds good.

Original: C. Weakness

Original: This paper states that the proposed attack is more effective for datasets with lower input dimensionality and fewer classes for the reason of easier surrogate parameters learned.

Original: Then, what key factors may be important to protect the privacy in during split-learning?

Original: What more limitations in detail is needed to set the data sharing to perform vertical federated learning?

Original: D. Our Response

Original: Our paper demonstrates that split-learning (in it’s basic form) does not provide label privacy.

Original: We study adding noise to the gradients as a potential defense against label leakage attack in split learning.

Original: II.

Original: R EVIEWER

Original: A. Summary

Original: This paper proposes a label-leakage attack called ExPLoit that allows an adversarial input-owner to extract the private labels of the label-owner during split-learning.

Original: ExPLoit frames the attack as a supervised learning problem by using a novel loss function that combines gradient-matching and several regularization terms developed using key properties of the dataset and models.

Original: In the analyses, ExPLoit can uncover the private labels with near-perfect accuracy of up to 99 .

Original: 96% for

Original: Cifar-10.

Original: This result highlights a critical security problem for vertical federated learning.

Original: B. Strengths

Original: The paper is well written in general, and the methods are well explained.

Original: The addressed problem and the proposed method are interesting.

Original: The proposed ExPLoit method also outperforms the baseline on Cifar datasets with good margin.

Original: C. Weakness

Original: A major problem with the paper is the inconsistency in the experimental analyses.

Original: Although the proposed ExPLoit outperforms baseline on Cifar datasets, its improvement is not clear for the other datasets.

Original: Therefore, the experimental analyses should be extended using additional datasets such as

Original: ImageNet, CelebA etc., with additional detailed ablation study, and other tasks such as Image Segmentation.

Original: Thus, the paper is not ready for publication with the current results.

Original: D. Our Response

Original: Insufficient Experiments: We have included evaluations on the TinyImagenet dataset as a response to the above review.

Original: Our method shows significant improvements over prior works across all the datasets used in our experiments.

Original: III. R EVIEWER # A. Summary

Original: • Split learning is an approach for distributed model learning without raw data sharing, where the full model is split into smaller model portions that are trained separately.

Original: SL generally offers strong privacy guarantees because no party has full access to all model information.

Original: In a simple form of split learning, there could be two parties: one that has access to the inputs and produces intermediate embeddings and another that predicts data labels from the embeddings.

Original: In this example, the first party — the input owner — never accesses the labels whereas the second party — the label owner — never accesses the raw inputs.

Original: During backward passes, the label owner provides the loss gradient that relates to the exchanged embeddings.

Original: • This paper proposes EXPLOIT, an approach that enables an input owner to guess input labels without using the model part of the label owner.

Original: The key idea of EXPLOIT is to train a surrogate model and replay split learning on this model, while minimizing the loss gradient difference between the target model’s loss gradients and that of the surrogate model, until convergence.

Original: • Evaluation suggests that EXPLOIT manages to retrieve the (private) labels for over 94% of the data across MNIST, CIFAR-10, CIFAR-100 and Criteo datasets.

Original: B. Strengths

Original: • Distributed model learning and the related security issue is a current and practically relevant problem.

Original: • In addition to the attack, the paper investigates how to defend against EXPLOIT through gradient noising and evaluate the effectiveness of this defence.

Original: • Results drastically improves over existing competing approach under the paper working assumptions.

Original: • Well written and easy to understand.

Original: C. Weakness

Original: • EXPLOIT considers a simple form of SL with only two parties involve.

Original: Will the approach work as well on more distributed cases?

Original: • There is a contradiction between the paper objective (private label extraction) and how the approach is executed/what it produces.

Original: Indeed, EXPLOIT does not produce the label but can only group inputs that belong to the same class.

Original: I am, therefore, not sure of EXPLOIT’s practical utility.

Original: • Why updating the surrogate weight and the surrogate labels independently instead of jointly (e.g. determine the surrogate labels via the predictions of the model, or vice-versa)?

Original: Is there any proof that doing so guarantees convergence?

Original: • A major factor to EXPLOIT effectiveness is the architecture similarity of the surrogate compared to the target model.

Original: Did you keep the same model architecture from each target model g to its surrogate g’?

Original: What would the impact of using a different architecture for g’ (assuming the architecture of g is unknown)?

Original: • Would the approach still work for classification tasks where the class clusters are less dense and more intertwined (in the input space and/or the embedding space).

Original: • Could you give more details on how you compute the clustering accuracy?

Original: Also, is this the same as what is called ”label leakage accuracy” in Figure 4?

Original: • Why does label leakage accuracy differ so much from test accuracy?

Original: • The paper has little to do with computer vision beyond the use of image datasets in the evaluation.

Original: Is there any real-world computer vision use case for split learning?

Original: D. Our Response

Original: • Multi-party split learning: We limit the scope of this paper to two-party split learning.

Original: Extending our proposal to multi-party split learning is part of future work.

Original: • Inferring Class labels We explain how the class labels for input groups can be inferred using label prior information or a very small number of labeled examples in Section 5 (under Evaluation Metric)

Original: • Architectural Similarity of surrogate model: We include experiments showing that our attack is effective even when the surrogate model architecture is dissimilar to the label-owner’s model (Config-2 in Table 1).

Original: • Dependence on embedding: Our attack uses gradient information to group inputs into the same class and is independent of the embedding produced at the split layer.