UnSplit: Data-Oblivious model inversion, model stealing, and label inference attacks against split learning

Date
2022-11-07
Advisor
Supervisor
Co-Advisor
Co-Supervisor
Instructor
Source Title
Print ISSN
Electronic ISSN
Publisher
Association for Computing Machinery
Volume
Issue
Pages
115 - 124
Language
English
Type
Conference Paper
Journal Title
Journal ISSN
Volume Title
Series
Abstract

Training deep neural networks often forces users to work in a distributed or outsourced setting, accompanied with privacy concerns. Split learning aims to address this concern by distributing the model among a client and a server. The scheme supposedly provides privacy, since the server cannot see the clients' models and inputs. We show that this is not true via two novel attacks. (1) We show that an honest-but-curious split learning server, equipped only with the knowledge of the client neural network architecture, can recover the input samples and obtain a functionally similar model to the client model, without being detected. (2) We show that if the client keeps hidden only the output layer of the model to ''protect'' the private labels, the honest-but-curious server can infer the labels with perfect accuracy. We test our attacks using various benchmark datasets and against proposed privacy-enhancing extensions to split learning. Our results show that plaintext split learning can pose serious risks, ranging from data (input) privacy to intellectual property (model parameters), and provide no more than a false sense of security. © 2022 Owner/Author.

Course
Other identifiers
Book Title
Keywords
Data privacy, Label leakage, Machine learning, Model inversion, Model stealing, Split learning
Citation
Published Version (Please cite this version)