Oops!... They Stole it Again: Attacks on Split Learning

Split Learning (SL) is a collaborative learning approach that improves privacy by keeping data on the client-side while sharing only the intermediate output with a server. However, the distributed nature of SL introduces new security challenges, necessitating a comprehensive exploration of potential attacks. This paper systematically reviews various attacks on SL, classifying them based on factors such as the attacker's role, the type of privacy risks, when data leaks occur, and where vulnerabilities exist. We also analyze existing defense methods, including cryptographic methods, data modification approaches, distributed techniques, and hybrid solutions. Our findings reveal security gaps, highlighting the effectiveness and limitations of existing defenses. By identifying open challenges and future directions, this work provides valuable information to improve SL privacy issues and guide further research.

Key Contributions

Systematic taxonomy of attacks on Split Learning classified by attacker role, privacy risk type, data leak timing, and vulnerability location
Comprehensive analysis of existing defenses including cryptographic methods, data modification approaches, distributed techniques, and hybrid solutions
Identification of security gaps, open challenges, and future research directions in Split Learning privacy

🛡️ Threat Analysis

Model Inversion Attack

A dominant attack class in Split Learning is reconstructing private training data from shared intermediate outputs (smashed data/activations), which is a direct model inversion / gradient leakage threat — the survey explicitly covers these data reconstruction attacks and defenses against them.

Membership Inference Attack

Membership inference attacks on Split Learning — determining whether a specific data point was in the training set from shared intermediate representations — are a well-established threat class covered in this survey.

Model Poisoning

As a collaborative learning protocol, Split Learning is susceptible to backdoor/trojan injection attacks; the survey covers these training-time threats alongside poisoning-based attacks in the SL threat landscape.