Pith. sign in

REVIEW 6 major objections 6 minor 27 references

The loop complexity of intermediate activations predicts which split layers leak private inputs, so splits can be chosen without running attacks.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 11:42 UTC pith:4LAHZEG4

load-bearing objection Useful packaging of TDA for attack-free SL cut selection, but the flagship Betti–SSIM numbers do not support the abstract’s “consistently identifies” claim. the 6 major comments →

arxiv 2607.24556 v1 pith:4LAHZEG4 submitted 2026-07-27 cs.LG cs.AIcs.CR

BettiSplit: Topology-Guided Privacy-Aware Split Learning Against Feature Inversion and Gradient Leakage

Akarsh K.Nair , Muhammad Arifur Rahman , David Brown , Mufti Mahmud This is my paper
classification cs.LG cs.AIcs.CR
keywords Split LearningPrivacy LeakagePersistent HomologyBetti NumbersFeature InversionFederated LearningSmashed ActivationsTopological Data Analysis
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Split learning keeps raw data on the client but still ships intermediate activations to a server, and those activations can be inverted into near-perfect images if the cut is placed badly. This paper argues that privacy risk is not a smooth function of depth: it jumps sharply at certain layers, and those jumps track the topological complexity of the activation cloud, measured by how many persistent loops appear in a Vietoris–Rips filtration (Betti-1). From that score the authors build BettiSafe, which ranks candidate cut layers from forward passes alone and picks safer splits than depth heuristics, and an optional Betti penalty that further flattens reconstructible structure during training. Across several CNNs and image datasets, the method raises inversion difficulty several-fold while holding accuracy steady. A sympathetic reader cares because it turns split placement from a costly attack-and-check loop into a cheap structural diagnostic that collaborative systems can run at design time.

Core claim

Privacy leakage in split learning is highly non-uniform across layers and shows sharp transition regions that depth alone does not capture; the persistent Betti-1 complexity of smashed activations consistently flags the representation regimes where feature inversion becomes severe (up to ~0.98 SSIM), so topology-guided split selection (BettiSafe) and Betti regularisation can cut inversion success by roughly 2–5× without sacrificing classification accuracy.

What carries the argument

BettiLeak: the count of persistent 1-dimensional loops in the activation point cloud, normalised by sample count and feature dimension, used both to rank cut layers (BettiSafe) and as a training penalty that suppresses loop-rich structure.

Load-bearing premise

That the number of persistent loops in the intermediate activation cloud is a reliable structural proxy for how invertible those activations are—even when the big privacy jump and the big loop-count jump do not always land on the same layer.

What would settle it

On a held-out architecture and dataset, rank every feasible cut by BettiLeak, run feature inversion at each cut, and check whether the lowest-Betti cuts systematically yield lower SSIM than depth-matched baselines; a clean counterexample is a setting where high-Betti layers stay hard to invert and low-Betti layers invert easily.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Split placement can be chosen from forward activations alone, without running reconstruction attacks at design time.
  • Depth-based rules (avoid early layers) will keep missing privacy-critical transition layers that topology flags.
  • A Betti penalty at the cut can be added to standard training to raise inversion difficulty by about 5× with little or no accuracy loss.
  • System designers can treat topological complexity as a third axis beside communication size and latency when picking the cut.
  • The same descriptor is most informative for feature-space inversion and less so for pure gradient-matching attacks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If loop structure really drives invertibility, cheaper loop proxies (persistent entropy, mapper graphs, or learned topological summaries) could replace full Vietoris–Rips in large-scale or online split selection.
  • The same cut-ranking idea should transfer to split federated learning and vertical partitions, where multiple clients expose different intermediate manifolds.
  • When Betti and SSIM disagree (as in some MobileNet cases), combining topology with spectral or bottleneck diagnostics may stabilise the ranking.
  • Attack-agnostic topology scores could become a pre-deployment checklist item for any pipeline that ships intermediate representations off-device.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

6 major / 6 minor

Summary. The paper proposes BettiSplit, a topology-guided framework for privacy-aware split learning. Its core claim is that the 1-dimensional persistent Betti number (loop count β1 of a Vietoris–Rips filtration over smashed activations, normalized as "BettiLeak") is a reliable proxy for feature-inversion vulnerability, enabling (i) BettiSafe, an attack-free split-layer selection rule claimed to improve inversion resistance 2–5× over depth heuristics, and (ii) a Betti-regularised training objective claimed to raise inversion difficulty ~5× at no accuracy cost. Empirical support is presented over LeNet/SimpleCNN/ResNet-18/MobileNetV2 on FashionMNIST/CIFAR-10/SVHN, with feature inversion (SSIM/MSE), DLG/iDLG/GradInv attacks, and a controlled bottleneck experiment. The idea is original and the design-time, forward-only metric is attractive, but the quantitative backbone of the paper contains internal contradictions that bear directly on the central claim.

Significance. If the central claim holds, the contribution is valuable: an attack-free, design-time indicator of inversion risk in split learning, computable in ~10 ms per layer on CPU, would be genuinely useful for SL deployment, and the paper offers a novel conceptual link between persistent homology and privacy leakage. Strengths worth naming: the framework is cheap and reproducible in principle (Ripser on subsampled, PCA-reduced activations); the threat model is standard; the evaluation spans four architectures, three datasets, and four attacks; and the paper is unusually candid about negative results (flat DLG correlation, negative MobileNetV2/FashionMNIST correlation). However, the headline evidence is currently not self-consistent — the flagship Spearman coefficient cannot be reproduced from the paper's own Table 1, and the transition-detection narrative is contradicted by the same table — so the significance of the claimed '2–5×' and '5×' improvements cannot be assessed until the quantitative backbone is repaired.

major comments (6)
  1. [§5.3, Table 2 vs Table 1] Table 2 (Spearman ρ = 1.000 for FashionMNIST/LeNet) is arithmetically irreproducible from Table 1's own columns. Perfect rank concordance fails in at least three places: layer 4 has β1 = 0.002563 > layer 8's 0.002344 while SSIM 0.000 < 0.912; layer 9 has β1 = 0.003534 > layer 10's 0.002790 while SSIM 0.9125 < 0.9826; and layers 0–5 all tie at SSIM = 0 with distinct β1 values. With ties and rank inversions, ρ = 1.000 is impossible for the printed data. Either Table 2 was computed on unreported data or the statistic is in error. Since this is the single strongest quantitative claim of 'consistent' identification, the authors must publish the exact numbers fed into the correlation and recompute.
  2. [§5.2–5.3, Figs. 2–3, Table 1] The claimed alignment between Betti-1 and the privacy transition is contradicted by the paper's own flagship analysis. The SSIM cliff occurs at layer 6 (0.000 → 0.802) while β1 is essentially flat there (0.001953 → 0.002197); the only large β1 increase (~8×, to 0.0234) occurs at layer 11, after SSIM has already saturated at ~0.98. A signal that fires five layers after the event cannot be said to have 'identified' the transition, yet Fig. 3's discussion claims the β1 increase 'aligns closely with the emergence of inversion vulnerability.' The text must be revised to state accurately what BettiLeak does and does not detect, or the claim reframed (e.g., as ranking within the vulnerable regime rather than locating the transition).
  3. [§3.5, Algorithm 2] The regulariser L_B = |{(b,d) ∈ dgms1 : d > b}| / (N·D) is an integer-valued, piecewise-constant function of the network parameters, so ∇_θ L is zero almost everywhere and undefined at filtration events. Algorithm 2's update 'θ ← θ − η∇_θ L' cannot be executed as written, and no differentiable relaxation (e.g., persistence-based losses à la Hofer et al.), surrogate gradient, or straight-through estimator is described. Because the nearly-5× inversion-error increase in Table 4 is one of the paper's two headline results, the training procedure that produced it must be fully specified and shown to be reproducible.
  4. [§5.9, Table 6 and Algorithm 1] Two inconsistencies: (i) With λ = 0, Algorithm 1 selects argmin β̂, which per Table 1 is layer 7 (β1 = 0.001563), yet Table 6 reports BettiSafe choosing layer 4 for LeNet/FashionMNIST; the value of λ used is never stated, so the selection rule that produced Table 6 is not reconstructible. (ii) In all three MobileNetV2 rows (FashionMNIST, CIFAR-10, SVHN) the Betti split equals the heuristic split (17/17), so for that architecture no improvement over the baseline is demonstrated at all — yet the abstract's '2–5×' improvement is stated without qualification. The per-row gains, and the rows with no gain, should be reported transparently.
  5. [§5.10, Table 5 vs Table 1] Table 5's SSIM column contradicts Table 1 at the same layers and configuration (LeNet/FashionMNIST): layer 3 SSIM is 0.559 in Table 5 vs 0.000 in Table 1; layer 6 is 0.504 vs 0.802; layer 9 is 0.346 vs 0.913. The only explanation offered is that 'the SSIM values reported in Table 5 correspond to the system-level evaluation setting and are therefore not directly comparable.' What differs (attack iterations? model training? evaluation set?) is never specified. Since both tables feed the split-selection narrative, the discrepancy must be explained or reconciled.
  6. [Title/abstract vs §5.5] The title and abstract claim protection against 'Feature Inversion and Gradient Leakage,' but §5.5 reports that Betti-1 shows 'no meaningful correlation' with DLG reconstruction error, and Table 1 confirms DLG error is flat (~1.06–1.33) across all splits, including the layers BettiSafe selects. The framework therefore offers no demonstrated benefit against gradient-based leakage, and BettiSafe's selections are not shown to reduce it. Either the title/abstract should be scoped to feature inversion, or evidence of gradient-leakage mitigation should be provided.
minor comments (6)
  1. [Tables 4 and 6] Table 6's typesetting is garbled in several rows (e.g., the FashionMNIST/LeNet row reads '4 60.446 1.060.3277'; Table 4 reads '0.0233.99×10⁻⁴'), making the MSE and split columns ambiguous. Please reformat with clear column separation.
  2. [Figures 5–6] Figure 5's caption says 'across architectures on CIFAR-10' but §5.7 references Fig. 5 for the FashionMNIST cross-architecture analysis, and Fig. 6's caption describes the FashionMNIST phase diagram. The captions appear swapped or mislabelled relative to the text.
  3. [§5.11 and Algorithms 1–2] Key hyperparameters are not reported: the values of Nmax and Dmax in Algorithm 1 (§5.11 mentions 64 samples and PCA to 30 dims, but this is stated only in passing), the trade-off λ used for Table 6, and the regularisation weight λ_B for Table 4. Sensitivity of BettiLeak to subsampling and PCA dimension should at least be spot-checked.
  4. [Table 1] Table 1's variance and spectral entropy columns are nearly constant within blocks (e.g., variance 0.24, 2.47, 1.50, 5.09 with identical entropy), suggesting they are computed on pooled rather than per-layer statistics; clarify how they were computed, since they are offered as baselines to the topological descriptor.
  5. [§2.4, §3.5] Missing relevant references: differentiable persistent-homology losses (e.g., Hofer et al., NeurIPS 2017; Chen et al. 2019) for §3.5, and prior TDA-based analysis of neural representations beyond [21]. Also 'for for post hoc analysis' (§2.4) and other minor typos.
  6. [§5.7] The MobileNetV2/FashionMNIST BettiLeak values {0.0068, 0.0083, 0.0063, 0.0031} for layers {4, 9, 14, 17} are stated inline; argmin over these is layer 17, consistent with Table 6, but the per-layer BettiLeak tables for the other architectures in Table 6 (SimpleCNN, ResNet-18) are never shown, so those selections cannot be verified.

Circularity Check

0 steps flagged

No definitional or fitted-input circularity: BettiLeak is an independent forward-pass TDA statistic; attack metrics are separate evaluations.

full rationale

The paper’s chain is empirical, not definitional. BettiLeak(k) is defined solely from the 1-dimensional persistence diagram of smashed activations (normalized loop count via Vietoris–Rips/Ripser on forward activations; §3.2–3.3, Alg. 1). Feature-inversion SSIM/MSE and DLG/iDLG/GradInv errors are computed by separate optimization attacks (§4.2–4.3, §5). BettiSafe’s argmin/argmax over normalized β̂_k does not algebraically determine those attack scores; any claimed 2–5× resistance gain is an empirical comparison of independently measured quantities (Table 6), not a fit renamed as a prediction. Betti-regularisation adds λ_B·β1 to the CE loss (Alg. 2) and again reports separately measured inversion MSE (Table 4). There is no self-definitional loop (X defined via Y), no parameter fitted to attack data then “predicted” back, no load-bearing self-cited uniqueness theorem, and no ansatz smuggled in via overlapping-author citation. Skeptic concerns about Spearman ρ = 1.000 vs Table 1 ranks and β1/SSIM transition misalignment are correctness/reproducibility issues, not circularity by construction. Score 0; steps empty.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 3 invented entities

The claim rests on standard TDA constructions plus domain choices about which homology, normalization, and threat model matter for privacy, and on several hand-set computational knobs (subsampling, PCA dim, λ, λB). No new physical entity is postulated; the invented pieces are named metrics and procedures whose validity is almost entirely internal to the reported experiments.

free parameters (4)
  • Betti regularisation weight λ_B = ≥0, experiment-specific (not uniquely fixed)
    Scales L_B in the training objective; chosen to show privacy–utility tradeoff (Table 4) rather than derived.
  • BettiSafe trade-off λ = λ≥0; privacy-only mode uses λ=0
    Controls J_k = s_k − λ c_k between server and client cumulative complexity in Algorithm 1.
  • TDA subsample caps Nmax, Dmax and PCA dim 30 = calibration minibatch 64; PCA to 30 dimensions (stated)
    Activation matrices are row/column subsampled and reduced before Ripser; changes the measured β1 and thus BettiLeak rankings.
  • BettiLeak normalization by N·D = BettiLeak(k)=|{d>b}|/(N·D)
    β1 count is divided by sample-feature product; this scaling choice affects cross-layer comparability and is not theoretically mandated.
axioms (5)
  • domain assumption Vietoris–Rips persistent homology on smashed-activation point clouds yields privacy-relevant geometric descriptors.
    Section 3.2–3.3 treats β1 of IR as indicative of inversion susceptibility without a proven information-theoretic link.
  • ad hoc to paper One-dimensional Betti number β1 (loops) is the primary complexity descriptor; β0 and higher homology are de-emphasized.
    Justified by stability/efficiency narrative in §3.2 and limitations §7.4, not by comparative ablation proving uniqueness.
  • domain assumption Honest-but-curious server with access to smashed activations, server-side gradients, and full architecture; no active protocol deviation.
    Threat model §4.1 standard in SL security literature; bounds what ‘privacy risk’ means.
  • domain assumption Feature inversion success (SSIM/MSE) is the primary operational definition of feature-space leakage used to validate topology.
    Sections 4.3 and 5.2; gradient attacks are secondary and weakly related.
  • standard math Persistent homology / Ripser and standard SL training mathematics.
    Background TDA and autodiff training assumed correct as used in Algorithms 1–2.
invented entities (3)
  • BettiLeak score no independent evidence
    purpose: Scalar privacy-sensitivity indicator for a candidate split layer from normalized persistent β1.
    Defined in §3.3; no external calibration against a formal leakage bound.
  • BettiSafe split selection no independent evidence
    purpose: Attack-free ranking/selection of cut layer from BettiLeak (and optional cumulative J_k).
    Algorithm 1; validated only via the paper’s attack tables.
  • Betti-regularised split learning objective no independent evidence
    purpose: Add λ·β1(h_k) to cross-entropy to suppress topological complexity at the cut.
    Algorithm 2 / §3.5; utility shown only in reported runs (Table 4).

pith-pipeline@v1.2.0-grok45-kimik3 · 22311 in / 4055 out tokens · 92198 ms · 2026-07-31T11:42:44.729562+00:00 · methodology

0 comments
read the original abstract

Split learning enables collaborative model training by partitioning neural networks across clients and servers. However, improper split placement can lead to severe privacy leakage through intermediate representations. In this work, we propose a topology-guided framework for privacy-aware split learning based on the persistent Betti complexity of smashed activations. Through comprehensive layer-wise analysis, we show that privacy risk in split learning is highly non-uniform across layers and exhibits sharp transition regions that are not captured by architectural depth alone. In particular, feature inversion fidelity increases from negligible reconstruction to as high as 0.98 SSIM at deeper, privacy-critical split points. We further demonstrate that Betti complexity consistently identifies representation regimes associated with elevated feature-space privacy leakage across architectures and datasets. Leveraging this observation, we introduce BettiSafe, a topology-guided split selection strategy that identifies privacy-sensitive layers without requiring explicit attack execution. BettiSafe improves resistance to feature inversion by 2 to 5 times compared to depth-based heuristics while preserving classification accuracy. In addition, Betti-based regularisation increases inversion difficulty by nearly 5 x without degrading model utility, enabling a favourable privacy utility tradeoff. Overall, our results highlight topological complexity as a promising structural descriptor for secure, adaptive, and representation-aware split learning in real-world collaborative systems

Figures

Figures reproduced from arXiv: 2607.24556 by Akarsh K.Nair, David Brown, Mufti Mahmud, Muhammad Arifur Rahman.

Figure 1
Figure 1. Figure 1: The workflow diagram of the BettiSplit framework When privacy is the sole objective, BettiSafe selects the split layer exhibiting the lowest normalised topological leakage: k ⋆ = arg min k∈K βˆ k where K denotes the set of feasible split layers. To account for deployment constraints, BettiSafe can additionally balance client-side and server-side topological complexity. Let: ck = X k i=1 βˆ ∗ i and sk = X∗i… view at source ↗
Figure 2
Figure 2. Figure 2: Layer-wise SSIM recon￾struction leakage across split layers. 0 5 10 0 0.5 1 1.5 ·10−2 Layer Index Betti-1 [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 5
Figure 5. Figure 5: Relationship between Betti complexity and SSIM-based inversion leakage across architectures on CIFAR-10. 0 0.2 0.4 0.6 0.8 1 1.2 1.4 ·10−2 0.2 0.4 0.6 0.8 Betti-1 Complexity SSIM Reconstruction Quality LeNet SimpleCNN ResNet18 MobileNetV2 [PITH_FULL_IMAGE:figures/full_fig_p014_5.png] view at source ↗
Figure 7
Figure 7. Figure 7: Layer-wise privacy behaviour and topological complexity across architectures and datasets. [2] Bo Zeng, Sida Luo, Fangchao Yu, Geying Yang, Kai Zhao, and Lina Wang. Gan-based data reconstruction attacks in split learning. Neural Networks, 185:107150, 2025. ISSN 0893-6080. doi:https://doi.org/10.1016/j.neunet.2025.107150. [3] Boris Radovic, Marco Canini, Samuel Horváth, Veljko Pejovi ˇ c, and Praneeth Vepak… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

27 extracted references · 2 canonical work pages

  1. [1]

    Federated learning for privacy preservation in smart healthcare systems: A comprehensive survey.IEEE Journal of Biomedical and Health Informatics, 27(2): 778–789, 2023

    Mansoor Ali, Faisal Naeem, Muhammad Tariq, and Georges Kaddoum. Federated learning for privacy preservation in smart healthcare systems: A comprehensive survey.IEEE Journal of Biomedical and Health Informatics, 27(2): 778–789, 2023. doi:10.1109/JBHI.2022.3181823. 17 BettiSplit: Topology-Guided Privacy-Aware Split Learning Against Feature Inversion and Gra...

    arXiv 2023

  2. [2]

    Gan-based data reconstruction attacks in split learning.Neural Networks, 185:107150, 2025

    Bo Zeng, Sida Luo, Fangchao Yu, Geying Yang, Kai Zhao, and Lina Wang. Gan-based data reconstruction attacks in split learning.Neural Networks, 185:107150, 2025. ISSN 0893-6080. doi:https://doi.org/10.1016/j.neunet.2025.107150

    arXiv 2025

  3. [3]

    Towards a unified framework for split learning

    Boris Radoviˇc, Marco Canini, Samuel Horváth, Veljko Pejovi´c, and Praneeth Vepakomma. Towards a unified framework for split learning. InProceedings of the 5th Workshop on Machine Learning and Systems, EuroMLSys ’25, page 183–191, New York, NY , USA, 2025. Association for Computing Machinery. ISBN 9798400715389. doi:10.1145/3721146.3721936

    arXiv 2025

  4. [4]

    Split learning over wireless networks: Parallel design and resource management.IEEE Journal on Selected Areas in Communications, 41(4):1051–1066, 2023

    Wen Wu, Mushu Li, Kaige Qu, Conghao Zhou, Xuemin Shen, Weihua Zhuang, Xu Li, and Weisen Shi. Split learning over wireless networks: Parallel design and resource management.IEEE Journal on Selected Areas in Communications, 41(4):1051–1066, 2023. doi:10.1109/JSAC.2023.3242704

    arXiv 2023

  5. [5]

    Ppsfl: Privacy-preserving split federated learning for heterogeneous data in edge-based internet of things.Future Generation Computer Systems, 156:231–241, 2024

    Jiali Zheng, Yixin Chen, and Qijia Lai. Ppsfl: Privacy-preserving split federated learning for heterogeneous data in edge-based internet of things.Future Generation Computer Systems, 156:231–241, 2024. ISSN 0167-739X. doi:https://doi.org/10.1016/j.future.2024.03.020

    work page doi:10.1016/j.future.2024.03.020 2024

  6. [6]

    Surojit Ganguli, Zeyu Zhou, Christopher Brinton, and David I. Inouye. Robust collaborative inference with verti- cally split data over dynamic device environments. InProceedings of the Twenty-Sixth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing, MobiHoc ’25, page 191–200, New York, ...

    arXiv 2025

  7. [7]

    Sia: A sustainable in- ference attack framework in split learning.Neural Networks, 171:396–409, 2024

    Fangchao Yu, Lina Wang, Bo Zeng, Kai Zhao, Tian Wu, and Zhi Pang. Sia: A sustainable in- ference attack framework in split learning.Neural Networks, 171:396–409, 2024. ISSN 0893-6080. doi:https://doi.org/10.1016/j.neunet.2023.12.033

    work page doi:10.1016/j.neunet.2023.12.033 2024

  8. [8]

    Evaluating privacy leakage in split learning, 2024

    Xinchi Qiu, Ilias Leontiadis, Luca Melis, Alex Sablayrolles, and Pierre Stock. Evaluating privacy leakage in split learning, 2024

    2024

  9. [9]

    PCAT: Functionality and data stealing from split learning by Pseudo-Client attack

    Xinben Gao and Lan Zhang. PCAT: Functionality and data stealing from split learning by Pseudo-Client attack. In32nd USENIX Security Symposium (USENIX Security 23), pages 5271–5288, Anaheim, CA, August 2023. USENIX Association. ISBN 978-1-939133-37-3

    2023

  10. [10]

    Passive inference attacks on split learning via adversarial regularization, 2025

    Xiaochen Zhu, Xinjian Luo, Yuncheng Wu, Yangfan Jiang, Xiaokui Xiao, and Beng Chin Ooi. Passive inference attacks on split learning via adversarial regularization, 2025. URLhttps://arxiv.org/abs/2310.10483

    Pith/arXiv arXiv 2025

  11. [11]

    Safesplit: A novel defense against client-side backdoor attacks in split learning

    Phillip Rieger, Alessandro Pegoraro, Kavita Kumari, Tigist Abera, Jonathan Knauer, and Ahmad-Reza Sadeghi. Safesplit: A novel defense against client-side backdoor attacks in split learning. In32nd Annual Network and Distributed System Security Symposium, NDSS, 2025

    2025

  12. [12]

    Model rake: A defense against stealing attacks in split learning

    Qinbo Zhang, Xiao Yan, Yanfeng Zhao, Fangcheng Fu, Quanqing Xu, Yukai Ding, Xiaokai Zhou, Chuang Hu, and Jiawei Jiang. Model rake: A defense against stealing attacks in split learning. InProceedings of the Thirty-Fourth International Joint Conference on Artificial Intelligence, pages 7002–7010, 2025

    2025

  13. [13]

    The impact of cut layer selection in split federated learning, 2024

    Justin Dachille, Chao Huang, and Xin Liu. The impact of cut layer selection in split federated learning, 2024. URLhttps://arxiv.org/abs/2412.15536

    Pith/arXiv arXiv 2024

  14. [14]

    Training latency minimization for model-splitting allowed federated edge learning.IEEE Transactions on Network Science and Engineering, 12(3):2081–2092,

    Yao Wen, Guopeng Zhang, Kezhi Wang, and Kun Yang. Training latency minimization for model-splitting allowed federated edge learning.IEEE Transactions on Network Science and Engineering, 12(3):2081–2092,

    2081

  15. [15]

    Dynamic split federated learning for resource-constrained iot systems.Com- puter Communications, 242:108275, 2025

    Mohamad Wazzeh, Ahmad Hammoud, Azzam Mourad, Hadi Otrok, Chamseddine Talhi, Zbigniew Dziong, Chang- Dong Wang, and Mohsen Guizani. Dynamic split federated learning for resource-constrained iot systems.Com- puter Communications, 242:108275, 2025. ISSN 0140-3664. doi:https://doi.org/10.1016/j.comcom.2025.108275

    arXiv 2025

  16. [16]

    Nguyen, Duy Dong Le, Thai Thinh Dang, and Tran Anh Khoa

    Le Hoang Trung, Tan Y . Nguyen, Duy Dong Le, Thai Thinh Dang, and Tran Anh Khoa. Latency-aware split learning optimization via genetic algorithms. InProceedings of the 6th Workshop on Intelligent Cross-Data Analysis and Retrieval, ICDAR ’25, page 14–19, New York, NY , USA, 2025. Association for Computing Machinery. ISBN 9798400718908. doi:10.1145/3733566.3734433

    arXiv 2025

  17. [17]

    Vincent Poor

    Joohyung Lee, Mohamed Seif, Jungchan Cho, and H. Vincent Poor. Exploring the privacy-energy consumption tradeoff for split federated learning.IEEE Network, 38(6):388–395, 2024. doi:10.1109/MNET.2024.3395904

    arXiv 2024

  18. [18]

    Topological deep learning: A review of an emerging paradigm

    A Zia, A Khamis, J Nichols, Z Hayder, V Rolland, and L Peterssonet. Topological deep learning: A review of an emerging paradigm. arxiv.arXiv preprint arXiv:2302.03836, 2023

    Pith/arXiv arXiv 2023

  19. [19]

    Topological data analysis and topological deep learning beyond persistent homology: a review.Artificial Intelligence Review, 2025

    Zhe Su, Xiang Liu, Layal Bou Hamdan, Vasileios Maroulas, Jie Wu, Gunnar Carlsson, and Guo-Wei Wei. Topological data analysis and topological deep learning beyond persistent homology: a review.Artificial Intelligence Review, 2025

    2025

  20. [20]

    Position: Topological deep learning is the new frontier for relational learning.Proceedings of machine learning research, 235:39529, 2024

    Theodore Papamarkou, Tolga Birdal, Michael Bronstein, Gunnar Carlsson, Justin Curry, Yue Gao, Mustafa Hajij, Roland Kwitt, Pietro Lio, Paolo Di Lorenzo, et al. Position: Topological deep learning is the new frontier for relational learning.Proceedings of machine learning research, 235:39529, 2024

    2024

  21. [21]

    Corneanu, and Sergio Escalera

    Rubén Ballester, Xavier Arnal Clemente, Carles Casacuberta, Meysam Madadi, Ciprian A. Corneanu, and Sergio Escalera. Predicting the generalization gap in neural networks using topological data analysis.Neurocomputing, 596:127787, 2024. ISSN 0925-2312. doi:https://doi.org/10.1016/j.neucom.2024.127787

    arXiv 2024

  22. [22]

    Graphpulse: Topological representations for temporal graph property prediction

    Kiarash Shamsi, Farimah Poursafaei, Shenyang Huang, Bao Tran Gia Ngo, Baris Coskunuzer, and Cuneyt Gurcan Akcora. Graphpulse: Topological representations for temporal graph property prediction. InThe Twelfth International Conference on Learning Representations, 2024

    2024

  23. [23]

    The distilled vietoris rips filtration for persistent homology and a new memory efficient algorithm, 2024

    Musashi Ayrton Koyama, Vanessa Robins, and Katharine Turner. The distilled vietoris rips filtration for persistent homology and a new memory efficient algorithm, 2024. URLhttps://arxiv.org/abs/2412.07805

    Pith/arXiv arXiv 2024

  24. [24]

    Deep leakage from gradients

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In H. Wallach, H. Larochelle, A. Beygelz- imer, F. d'Alché-Buc, E. Fox, and R. Garnett, editors,Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc., 2019

    2019

  25. [25]

    idlg: Improved deep leakage from gradients, 2020

    Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients, 2020. URL https://arxiv.org/abs/2001.02610

    Pith/arXiv arXiv 2020

  26. [26]

    Understanding deep image representations by inverting them

    Aravindh Mahendran and Andrea Vedaldi. Understanding deep image representations by inverting them. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2015. 19

    2015

  27. [2025]

    18 BettiSplit: Topology-Guided Privacy-Aware Split Learning Against Feature Inversion and Gradient LeakageA PREPRINT

    doi:10.1109/TNSE.2025.3544313. 18 BettiSplit: Topology-Guided Privacy-Aware Split Learning Against Feature Inversion and Gradient LeakageA PREPRINT

    arXiv 2025