Abstract
Split learning is a new training paradigm that divides a neural network into two parts and performs operations on the client and server, respectively. However, it does not directly transmit the client’s original data to the server, and the intermediate features transmitted by the client allow an attacker to guess the original data via model inversion attacks. In this study, we conducted a quantitative evaluation to compare the performances of three existing defense technologies to prevent such threats to data privacy. For systematic experiments, we used two datasets and three target classification models and measured how well previous defenses maintained model accuracy and resisted model inversion attacks. Our results showed that Laplacian noise-based defense has little practical effect, NoPeekNN has a large performance variation, and differential privacy is somewhat helpful in defense; however, the larger the client-side model, the lower the task performance. Finally, further research is needed to overcome the limitations of previous defenses.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Abadi, M., Chu, A., Goodfellow, I., McMahan, H.B., Mironov, I., Talwar, K., Zhang, L.: Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308–318 (2016)
Chang, L., et al.: 6g-enabled edge AI for metaverse: challenges, methods, and future research directions. J. Commun. Inf. Netw. 7(2), 107–121 (2022)
Deng, L.: The MNIST database of handwritten digit images for machine learning research. IEEE Signal Process. Mag. 29(6), 141–142 (2012)
Georghiades, A.S., Belhumeur, P.N., Kriegman, D.J.: From few to many: illumination cone models for face recognition under variable lighting and pose. IEEE Trans. Pattern Anal. Mach. Intell. 23(6), 643–660 (2001)
He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770–778 (2016)
He, Z., Zhang, T., Lee, R.B.: Model inversion attacks against collaborative inference. In: Proceedings of the 35th Annual Computer Security Applications Conference, pp. 148–162 (2019)
Kingma, D.P., Ba, J.: Adam: a method for stochastic optimization. arXiv preprint arXiv:1412.6980 (2014)
Mireshghallah, F., Taram, M., Ramrakhyani, P., Jalali, A., Tullsen, D., Esmaeilzadeh, H.: Shredder: learning noise distributions to protect inference privacy. In: Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 3–18 (2020)
Pasquini, D., Ateniese, G., Bernaschi, M.: Unleashing the tiger: inference attacks on split learning. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 2113–2129 (2021)
Pham, N.D., Abuadbba, A., Gao, Y., Phan, T.K., Chilamkurti, N.: Binarizing split learning for data privacy enhancement and computation reduction. IEEE Trans. Inf. Forensics Secur. 18, 3088–3100 (2023)
Ryu, J., et al.: Can differential privacy practically protect collaborative deep learning inference for IoT? Wireless Netw. 1–21 (2022)
Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)
Titcombe, T., Hall, A.J., Papadopoulos, P., Romanini, D.: Practical defences against model inversion attacks for split neural networks. arXiv preprint arXiv:2104.05743 (2021)
Vepakomma, P., Singh, A., Gupta, O., Raskar, R.: NoPeek: information leakage reduction to share activations in distributed deep learning. In: 2020 International Conference on Data Mining Workshops (ICDMW), pp. 933–942. IEEE (2020)
Wang, Z., Bovik, A.C., Sheikh, H.R., Simoncelli, E.P.: Image quality assessment: from error visibility to structural similarity. IEEE Trans. Image Process. 13(4), 600–612 (2004)
Acknowledgements
This work was supported by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government(MSIT) (No. 2021-0-00511, Robust AI and Distributed Attack Detection for Edge AI Security).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Na, H., Oh, Y., Lee, W., Choi, D. (2024). Systematic Evaluation of Robustness Against Model Inversion Attacks on Split Learning. In: Kim, H., Youn, J. (eds) Information Security Applications. WISA 2023. Lecture Notes in Computer Science, vol 14402. Springer, Singapore. https://doi.org/10.1007/978-981-99-8024-6_9
Download citation
DOI: https://doi.org/10.1007/978-981-99-8024-6_9
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-99-8023-9
Online ISBN: 978-981-99-8024-6
eBook Packages: Computer ScienceComputer Science (R0)