{"id":"d94b4f22-0e78-433b-a202-c6ff52c14732","arxiv_id":"2501.06650","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"SafeSplit detects poisoned client updates in U-shaped split learning by comparing DCT frequency distances and rotational distances of backbone states, then rolling back to the latest benign checkpoint; experiments show backdoor accuracy below 5% across five image datasets.","lead":"SafeSplit is a server-side defense for split learning that spots malicious client updates by comparing the backbone's frequency content and a new rotational distance between model states, then rolls back to the latest trusted checkpoint. It is presented as the first defense against client-side backdoor attacks in U-shaped split learning, and its evaluation shows backdoor accuracy near zero across several image datasets.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Backbone-only detection can be bypassed by a head-embedded backdoor, leaving SafeSplit's universal mitigation claim unproven.","rationale":"The reader's weakest_assumption identifies exactly this gap, and I agree. Among the issues listed in the reader's rationale, the lack of error bars and code and the unspecified DCT cutoff affect reproducibility and calibration but do not directly threaten the core detection claim. The head/tail hiding attack is different: it is within the paper's own adversary model and would make SafeSplit blind regardless of metric choices. The paper's argument against this class is the §VII assertion that backbone changes are essential for backdoor injection, yet the only supporting experiment (tail-only attack) intentionally prevents backbone updates for poisoned batches and thus tests a different mechanism. A head-embedded backdoor, where the head emits a target-class smashed-data vector for triggered inputs, is not disproved by that experiment and is trivially implementable given full control of the head. Because the paper claims universal mitigation ('SafeSplit was always able to mitigate the backdoor attack and reduced in all experiments the BA to less than 5%'), a single untested in-scope attack that plausibly evades both metrics is sufficient to make the claim unproven. The proposed concrete test directly runs that attack in the paper's own setup and would settle the matter. Since the reader already reached a conditional verdict, no change to that verdict is needed; the contribution here is to make the condition concrete and testable.","tokens_in":25891,"tokens_out":8613,"duration_ms":80765,"concrete_test":"Reproduce the CIFAR-10 ResNet-18 setup of §VI (N=10, IID rate 0.8, 2 malicious clients, pixel trigger). For each malicious client, train a head branch that, on triggered inputs, outputs a target-class smashed-data vector (e.g., the smashed data of a target-class sample) while updating only H and T; leave the backbone parameters unchanged during poisoned batches or update B only on clean batches. Forward the resulting malicious H/T through the normal client-to-client protocol and run SafeSplit unchanged. Measure the final model's BA. If BA remains above the 5% threshold, SafeSplit is evaded by an in-threat-model head-only backdoor; if BA is at or below 5%, the concern is settled in SafeSplit's favor. Also compare the backbone's DCT and rotational scores under this attack with a fully benign training to confirm the scores are indistinguishable.","verdict_should_be":"UNCHANGED","load_bearing_attack":"SafeSplit's central detection rationale (§IV) is that a backdoor necessarily produces anomalous changes in the server-side backbone. However, the threat model (§III-B) gives the adversary complete control of the client-held head and tail. The paper asserts in §VII that 'changing the backbone is essential for injecting the backdoor,' but this is not demonstrated; the only related test, the tail-only attack in §VI-E, blocks server gradients for poisoned batches and therefore does not rule out a head-embedded attack that leaves the backbone benign. Concretely, a malicious client can replace or train the head so that triggered inputs produce smashed data resembling a target-class sample; the unchanged benign backbone then maps this to features that the tail classifies as the target. SafeSplit inspects only backbone states, so such an attack would produce benign-looking DCT and rotational scores, and the rollback would keep the malicious head. No experiment in §VI covers this in-scope adversary, so the headline claim that SafeSplit 'was always able to mitigate the backdoor' is not supported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SafeSplit, a server-side defense against client-side backdoor attacks in U-shaped split learning. The server keeps a sliding window of the last N backbone states; after each client's training it computes two anomaly scores for every state in the window: a static score based on the Euclidean distance between low-frequency 2D-DCT representations of backbone updates, and a dynamic score based on a newly introduced rotational distance metric derived from angular displacement, angular velocity, and rotational frequency. The defense defines a benign majority as the intersection of the N/2+1 smallest-score sets under the two metrics, rolls back to the most recent backbone state in that intersection, and instructs the next client to use the corresponding head and tail. The evaluation covers five datasets, several architectures, varying client counts, IID rates, poisoned-model rates, poisoned-data rates, and several adaptive attacks, including loss-constraint variants and a tail-only attack; the authors report backdoor accuracy below 5% in all experiments while largely preserving main-task accuracy.","tokens_in":26088,"tokens_out":4714,"duration_ms":47363,"significance":"If the security claim holds, SafeSplit is a meaningful first step toward backdoor defenses in U-shaped split learning. Its strengths are that it is deployable solely on the server, addresses the sequential-training challenge with a rollback mechanism, and is evaluated extensively across datasets, architectures, client counts, data distributions, and adaptive adversaries. The frequency/rotation dual analysis is a plausible heuristic, and the runtime measurements in Appendix G indicate scalability. However, the defense is an empirically evaluated heuristic rather than a derived guarantee; the central claims of universality and of backbone-essentiality for backdoor injection are not supported by the experiments as reported. The lack of code release, unspecified DCT cutoff, and absence of repeated-run statistics further limit the strength of the empirical claims.","major_comments":[{"comment":"The claim in §VII that “changing the backbone is essential for injecting the backdoor” is not demonstrated and is in tension with the threat model of §III-B, which gives the adversary full control over the head, tail, smashed data, gradients, and loss. The tail-only attack evaluated in §VI-E is not a test of a head-embedded backdoor: in that experiment the malicious client still uses the server for forward propagation on poisoned batches and only skips backpropagation, so the backbone and head are trained only on clean data and the backbone is genuinely benign. An in-scope adversary could instead train or replace the head so that triggered inputs produce smashed data that the benign backbone maps to the target class, while leaving the backbone parameters untouched. SafeSplit inspects only backbone states, so such an attack would yield benign-looking DCT and rotational scores, and the rollback would preserve the malicious head. No experiment in §VI covers this adversary, so the headline claim that SafeSplit “was always able to mitigate the backdoor” is not supported for the stated threat model. I ask for a concrete experiment with a head-embedded attack or, alternatively, an explicit narrowing of the adversarial scope.","section":"§V-C, Eq. (2), Alg. 1 line 10"},{"comment":"The DCT low-frequency cutoff is never specified. Equation (2) writes St = DCTlow(Bt − Bt−1), but the paper does not state which coefficients (e.g., a top-left k×k block, or a fraction of the coefficient vector) are retained, nor how cutoff choices affect the distances in Eq. (3). Since this is a free parameter of the detection procedure, the static-analysis component is not reproducible, and the reader cannot assess whether the reported benign/malicious separation is robust or tuned. Please specify the cutoff and include a sensitivity analysis over reasonable values.","section":"§V-C, Eq. (2), Alg. 1 line 10"},{"comment":"The rotational distance construction contains several ad-hoc steps—computing row and column means, multiplying them with the 2D weight matrix to form x/y coordinate vectors, applying arctan, computing ω(t)/2π, and finally summing absolute pairwise differences. The main text never specifies the pairwise summation that App. H introduces, and no ablation or alternative—such as cosine similarity or angle between flattened gradient vectors—is provided to justify these specific choices. Because the rotational metric is one of the two load-bearing detection signals, this under-specification and lack of justification is a substantive reproducibility and evidentiary issue.","section":"§V-D and App. H"},{"comment":"The evaluation reports no standard deviations, no error bars, and no information about random seeds or repeated runs. Since the paper's universal claim is that SafeSplit “was always able to mitigate the backdoor” and reduced BA below 5% in all experiments, the near-threshold result for FMNIST (BA 3.4% in Table II) makes the absence of repeated-run statistics load-bearing. Please provide means and variances over multiple seeds, or otherwise state the number of runs behind each reported number.","section":"§VI, Tables II–VI"}],"minor_comments":[{"comment":"The PSmallestMajority function returns a sorted list of the N/2+1 smallest values, but lines 12 and 16 assign this list to Ei and Ri, whereas the text describes the score as a sum of distances. Please clarify whether the score is the sum or the list, and make the pseudocode consistent.","section":"Alg. 1, lines 12 and 16"},{"comment":"The intersection of rotationmajority and frequencymajority could in principle be empty, in which case the loop at line 20 finds no benign checkpoint; the paper does not specify the fallback behavior for this case.","section":"Alg. 1, line 19"},{"comment":"Equation (4) writes arctan(Bt) for a tensor-valued backbone, while Appendix H defines θ(t) = arctan(Bx_t, By_t) with coordinate-wise meaning. The notation should be made precise and consistent.","section":"§V-D, Eq. (4)"},{"comment":"The sentence “the obtained two 2D matrices are flattened to construct the x- and y-coordinate vectors Bx_t and By_t” is unclear about how the row/column mean vectors are multiplied with the 2D matrix, and what the resulting dimensions are. A concrete example or explicit algebra would help reproducibility.","section":"Appendix H"},{"comment":"The comparison with FreqFed, KRUM, and differential privacy would be more informative if the authors reported the parameter settings used for those baselines, since small changes in their hyperparameters can significantly alter their effectiveness.","section":"§VI-F, Fig. 7"},{"comment":"The paper does not mention whether code or configurations will be released; for a defense paper, providing the implementation is important for reproducibility and for verifying the security claims.","section":"General"}],"recommendation":"major_revision","confidential_remarks":"The paper builds on the authors' own FreqFed work for the frequency-analysis intuition, and the genuinely new parts are the rotational metric and the circular rollback mechanism. The main risk is the head-embedded attack gap, which is within the stated threat model and would invalidate the universal mitigation claim. The paper is empirically strong but not yet a complete security argument. I also note that the 'first defense' novelty claim is not deeply verified against concurrent work, though the cited related work appears largely appropriate. If the authors can either add the head-embedded attack experiment or clearly restrict the threat model and claims, the paper could become acceptable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things about SafeSplit. First, it is genuinely the first server-side defense for client-side backdoors in U-shaped split learning, and the evaluation is broad: five datasets, several architectures, client counts, IID rates, and adaptive loss-constrained attacks, with backdoor accuracy consistently pushed below 5%. Second, the headline claim that SafeSplit \"was always able to mitigate the backdoor\" is stronger than the evidence supports, because the defense inspects only the server backbone and the paper never proves that a backdoor must change the backbone.\n\nThe frequency-domain static analysis is adapted from FreqFed (with overlapping authors), but the rotational distance metric and the circular rollback mechanism are new in this setting, and the sequential-training problem they address is real. The comparison against FL defenses adapted to SL is fair, and the runtime scaling plot is a nice practical addition.\n\nNow the soft spots, in proportion. The biggest is the head-embedded backdoor. The threat model gives the adversary complete control of the client-held head and tail, and Section VII simply asserts that \"changing the backbone is essential for injecting the backdoor.\" The tail-only attack in Section VI-E does not test this: it blocks server gradients for poisoned batches, so it never checks whether a malicious head can make triggered smashed data resemble a target-class sample while the backbone stays benign. Such an attack would produce benign-looking DCT and rotational scores, and SafeSplit would keep the malicious head. The stress-test concern lands.\n\nThere is also an architectural mismatch the paper itself notes: the default protocol forwards head and tail directly from client to client, and the server never sees them, but the rollback mechanism needs the server to select and forward the benign head and tail. The paper says SafeSplit can be \"straightforwardly adapted\" to a server-mediated protocol, but that adaptation is not evaluated, and it changes the privacy assumptions of the system.\n\nSmaller issues: no error bars or seeds, no code release, the DCT low-frequency cutoff is unspecified, and the rotational coordinate construction is ad hoc. The absence of a formal separation guarantee is a limitation, not a fatal flaw, because this is an empirically evaluated heuristic defense.\n\nBottom line: SafeSplit is a credible defense against backbone-poisoning attacks and a solid baseline for future work. What it is not is a universal defense against all client-side backdoors in U-shaped split learning. If I were refereeing the full version, I would send it to review and ask for code and seeds, a specified DCT cutoff, and either an evaluation of the head-embedded attack or a softened claim. It is worth your reading-group time.","headline":"A useful first defense against client-side backdoors in U-shaped split learning, with broad empirical support for the attacks it tests, but the universal mitigation claim rests on an unproven assumption that backdoors must disturb the server-side backbone.","tokens_in":26593,"tokens_out":3521,"would_cite":true,"duration_ms":38743,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SafeSplit claims a split-learning server can catch client-side backdoors by checking each backbone checkpoint's frequency signature and rotational motion, then rolling back to the latest benign checkpoint.","keywords":["split learning","backdoor attacks","client-side poisoning","frequency-domain analysis","rotational distance","anomaly detection","model rollback","distributed deep learning"],"falsifier":"Train a U-shaped split learning system with ten clients, two of them malicious, where the malicious clients optimize a combined loss that simultaneously minimizes the low-frequency DCT distance and the rotational distance of their backbone updates to a benign reference while still maximizing backdoor accuracy; if those poisoned checkpoints enter the benign majority for several consecutive rounds and the final model's backdoor accuracy exceeds 5%, SafeSplit's separation claim is refuted.","tokens_in":25702,"feed_emoji":"🛡️","tokens_out":8216,"duration_ms":61770,"temperature":0.7,"pith_summary":"SafeSplit is a server-side defense for U-shaped split learning, where clients keep the network's head and tail and the server holds the backbone. After each client finishes training, SafeSplit scores the recent backbone checkpoints in two ways: a static score measures Euclidean distances between low-frequency DCT representations of consecutive updates, and a dynamic score measures how much parameter orientation rotates between training steps. A checkpoint is treated as benign only if it lies in the smallest majority of scores for both metrics; otherwise the server rolls back to the most recent checkpoint that does, so the next client starts from a clean state. The paper claims this is the first defense against client-side backdoor attacks in split learning and reports that across datasets, architectures, client counts, and adaptive attacks it reduced backdoor accuracy to below 5% while keeping main task accuracy close to the undefended baseline.","feed_headline":"Backdoor success falls below 5% under SafeSplit rollback","feed_subtitle":"A server checks the frequency and rotation of each backbone checkpoint and rewinds to the latest clean one.","key_machinery":"The carrying mechanism is the circular backward-analysis loop over a FIFO of the last $N$ server-side backbone checkpoints, combined with two scoring functions. The static function is the truncated low-frequency DCT update distance $S_t = \\mathrm{DCT}_{\\mathrm{low}}(B_t - B_{t-1})$, scored by Euclidean distance and summed over the $N/2+1$ nearest neighbors. The dynamic function is the rotational distance metric $RD = \\omega/(2\\pi)$, built from coordinate-wise angle $\\arctan$ of the backbone weights, angular velocity, and pairwise absolute differences of rotational frequencies. The intersection of the two majority sets determines the benign checkpoint, and the newest member of that intersection becomes the base model for the next client.","core_discovery":"The central claim is that poisoning a shared U-shaped split-learning model necessarily disturbs the server-side backbone in a way that ordinary training does not, and that two complementary measurements expose that disturbance. The static measurement takes the difference between consecutive backbone states, applies a 2-D discrete cosine transform, keeps only low frequencies, and computes pairwise Euclidean distances; the dynamic measurement computes an angular displacement $\\theta(t)=\\arctan(B_t)$, an angular velocity $\\omega(t)=(\\theta(t)-\\theta(t-1))/\\Delta t$, and a rotational frequency $RD=\\omega(t)/(2\\pi)$, then compares these across checkpoints. A checkpoint is judged benign only if it is among the $N/2+1$ closest under both scores. When a poisoned checkpoint is found, SafeSplit does not discard the client permanently; it re-examines the FIFO history of backbones and installs the most recent checkpoint that passes both tests, so subsequent benign clients never train on the poisoned state. The paper's evidence is its evaluation: in every experiment the backdoor accuracy fell below 5%, often to 0%, while main task accuracy stayed close to the no-defense baseline.","pith_inferences":["A would-be evader must now look unlike a backdoor under two orthogonal statistics at once while still redirecting predictions; forcing that trade-off is the real security contribution, and it suggests that future attacks will need to hide poison in the client-held head and tail across multiple sequential clients rather than in the backbone.","Since the paper's separation is empirical rather than proven, an adversary with full knowledge of both score functions and a benign reference checkpoint could try to optimize the combined evasion loss directly; whether such a model remains detectable is a testable open question.","The circular rollback pattern of scoring a sliding window of chained model states and rewinding to the newest trusted one applies beyond split learning to any sequential training pipeline where a coordinator stores checkpoints, including sequential fine-tuning or model handoff between parties.","The paper's appendix notes that the score gap between benign and poisoned checkpoints shrinks as main-task accuracy converges, so stopping training at convergence matters; an attacker operating in the late, low-gap regime is the most plausible challenge to the defense."],"forward_implications":["In a U-shaped split learning system with a benign majority of clients, the server can prevent a poisoned backbone from propagating to later clients by rolling back to the latest checkpoint that passes both the frequency and rotation tests.","Backdoor accuracy is driven below 5% across pixel-trigger and semantic-trigger attacks on CIFAR-10, MNIST, FMNIST, CIFAR-100, and GTSRB, with different client numbers, data distributions, and poisoned model rates.","Adaptive adversaries who know the defense and add loss constraints that minimize the rotational or DCT distance to a reference model are still detected, because the optimizer must trade off hiding the poison against implanting it.","When no attack is present, SafeSplit does not loop forever or remove clients permanently; the paper measures only a modest main-task accuracy drop of about 2.7 percentage points after 50 rounds compared to training without any defense."],"supporting_citations":[{"why":"It supplies the frequency-domain analysis approach whose low-frequency DCT distance SafeSplit adapts to split learning.","marker":"[14]"},{"why":"It establishes the spectral-bias observation that early training mainly changes low-frequency model components.","marker":"[40]"},{"why":"It provides the complementary result that low frequencies dominate early training while high frequencies change near convergence.","marker":"[61]"},{"why":"It contributes the nearest-neighbor majority scoring idea that SafeSplit uses to resist score manipulation.","marker":"[8]"},{"why":"It defines the backdoor-injection and loss-constraint attack template that SafeSplit's adaptive-attack evaluation adapts.","marker":"[5]"},{"why":"It is a client-side backdoor attack against split neural networks that SafeSplit targets.","marker":"[22]"},{"why":"It shows how to backdoor split learning and defines the threat that motivates a server-side defense.","marker":"[64]"}],"fun_headline_variants":["SafeSplit halts backdoor attacks in split learning","Client backdoors exposed by rotation and frequency checks","Rollback to clean checkpoints blocks split-learning backdoors","Backdoor success under 5% with SafeSplit's dual analysis","Server-side checks rewind poisoned split models"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense assumes that a backdoor attack must change the server-side backbone enough that the poisoned checkpoint stands out from benign training in low-frequency DCT distance or rotational distance; if an attacker can produce poisoned updates that look benign on both scores, the majority vote has nothing to separate.","fun_headline_variants_meta":{"raw":{"variants":["SafeSplit halts backdoor attacks in split learning","Client backdoors exposed by rotation and frequency checks","Rollback to clean checkpoints blocks split-learning backdoors","Backdoor success under 5% with SafeSplit's dual analysis","Server-side checks rewind poisoned split models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00021,"raw_usage":{"total_tokens":1463,"prompt_tokens":1050,"completion_tokens":413,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":666,"completion_tokens_details":{"reasoning_tokens":336}},"tokens_in":666,"tokens_out":413,"duration_ms":70980,"temperature":1.0,"reasoning_tokens":336,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T20:56:10.451634+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a U-shaped split learning system with ten clients, two of them malicious, where the malicious clients optimize a combined loss that simultaneously minimizes the low-frequency DCT distance and the rotational distance of their backbone updates to a benign reference while still maximizing backdoor accuracy; if those poisoned checkpoints enter the benign majority for several consecutive rounds and the final model's backdoor accuracy exceeds 5%, SafeSplit's separation claim is refuted.","supporting_citations":[{"cited_title":"Freqfed: A frequency analysis- based approach for mitigating poisoning attacks in federated learning","cited_arxiv_id":null,"evidence_quote":"It supplies the frequency-domain analysis approach whose low-frequency DCT distance SafeSplit adapts to split learning."},{"cited_title":"Hamprecht, Yoshua Bengio, and Aaron Courville","cited_arxiv_id":null,"evidence_quote":"It establishes the spectral-bias observation that early training mainly changes low-frequency model components."},{"cited_title":"Training behavior of deep neural network in frequency domain","cited_arxiv_id":null,"evidence_quote":"It provides the complementary result that low frequencies dominate early training while high frequencies change near convergence."},{"cited_title":"Machine Learning with Adversaries: Byzantine Tolerant Gradi- ent Descent","cited_arxiv_id":null,"evidence_quote":"It contributes the nearest-neighbor majority scoring idea that SafeSplit uses to resist score manipulation."},{"cited_title":"How To Backdoor Federated Learning","cited_arxiv_id":null,"evidence_quote":"It defines the backdoor-injection and loss-constraint attack template that SafeSplit's adaptive-attack evaluation adapts."},{"cited_title":"Backdoor attack against split neural network-based vertical federated learning","cited_arxiv_id":null,"evidence_quote":"It is a client-side backdoor attack against split neural networks that SafeSplit targets."},{"cited_title":"How to backdoor split learning","cited_arxiv_id":null,"evidence_quote":"It shows how to backdoor split learning and defines the threat that motivates a server-side defense."}],"review_version":1}