Unleashing the Tiger: Inference Attacks on Split Learning

Abstract

We investigate the security of split learning-a novel collaborative machine learning framework that enables peak performance by requiring minimal resources consumption. In the paper, we make explicit the vulnerabilities of the protocol and demonstrate its inherent insecurity by introducing general attack strategies targeting the reconstruction of clients' private training sets. More prominently, we demonstrate that a malicious server can actively hijack the learning process of the distributed model and bring it into an insecure state that enables inference attacks on clients' data. We implement different adaptations of the attack and test them on various datasets as well as within realistic threat scenarios. To make our results reproducible, we made our code available. 1 * Work in progress.1 https://github.com/pasquini-dario/SplitNN_FSHA

SplitGuard: Detecting and Mitigating Training-Hijacking Attacks in Split Learning

“…In this paper, we presented SplitGuard, a method for SplitNN clients to detect if they are being targeted by a training-hijacking attack [11] or not. We described the theoretical foundations underlying SplitGuard, experimentally evaluated its effectiveness, and discussed at depth many issues related to its use.…”

“…when success in the original task implies failure in the new task). We demonstrate using three commonly used benchmark datasets (MNIST [12], Fashion-MNIST [13], and CIFAR10 [14]) that SplitGuard effectively detects and mitigates the only training-hijacking attack proposed so far [11]. We further argue that it is generalizable to any such training-hijacking attack.…”

“…The Feature-Space Hijacking Attack (FSHA), by Pasquini et al [11], is the only proposed training-hijacking attack against SplitNN clients so far. It is important to gain an understanding of how a training-hijacking attack might work before discussing SplitGuard in detail.…”

“…In SplitNN, the server has control over the parameter updates being propagated back to each client model. This creates a new attack vector, that has already been exploited in an attack proposed by Pasquini et al [11], for a malicious server trying to infer the clients' private data. By contrast, this attack vector does not exist in federated learning, since the clients can trivially check if their model is aligned with their goals by calculating its accuracy.…”

UnSplit: Data-Oblivious Model Inversion, Model Stealing, and Label Inference Attacks Against Split Learning

“…In the first in-depth security analysis of SplitNN, Pasquini et al [18] showed that it is possible for an honest-but-curious server to obtain the clients' private training data during the training phase. Their attack relies on the server's ability to manipulate the client during the training process by propagating back loss values that are unrelated to the original task, but aid the server in its pursuit.…”