Aqsa Shabbir | Searcharxiv

arXiv2025

A Taxonomy of Attacks and Defenses in Split Learning

Split Learning (SL) has emerged as a promising paradigm for distributed deep learning, allowing resource-constrained clients to offload portions of their model computation to servers while maintaining collaborative learning. However, recent research has demonstrated that SL remains vulnerable to a range of privacy and security threats, including information leakage, model inversion, and adversarial attacks. While various defense mechanisms have been proposed, a systematic understanding of the attack landscape and corresponding countermeasures is still lacking. In this study, we present a comprehensive taxonomy of attacks and defenses in SL, categorizing them along three key dimensions: employed strategies, constraints, and effectiveness. Furthermore, we identify key open challenges and research gaps in SL based on our systematization, highlighting potential future directions.

cs.CR↗

arXiv2024

CURE: Privacy-Preserving Split Learning Done Right

Training deep neural networks often needs large datasets stored and processed in the cloud, and in sensitive fields like healthcare, these workflows must follow strict privacy rules. Split Learning (SL), a framework that divides model layers between client(s) and server(s), is widely adopted for distributed model training. While SL reduces privacy risks by limiting server access to the full parameter set, previous research has identified that intermediate outputs exchanged between server and client can compromise the client's data privacy. Homomorphic encryption (HE)-based solutions exist, but they often impose prohibitive computational burdens. To address these challenges, we propose CURE, a novel system based on HE for the single-client setting that encrypts only the server side of the model and optionally the data. CURE enables secure SL while substantially improving communication and parallelization. We propose packing schemes for efficient execution of deep learning algorithms and generalize them to MLPs and convolutional models, enabling the evaluation of large architectures using our implementations, such as ResNet blocks. We demonstrate that CURE can achieve similar accuracy to plaintext SL, while being up to 210x more efficient in terms of the runtime compared to the state-of-the-art privacy-preserving alternatives. Finally, we propose a novel estimator that enables efficient use of HE in SL settings by recommending an optimal server-client split.

cs.CR↗