Pith. sign in

REVIEW 3 major objections 5 minor 96 references

A Taxonomy of Attacks and Defenses in Split Learning

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper builds a taxonomy of split-learning attacks and defenses along strategy, constraint, and effectiveness, then locates the field's open problems.

desk verdict Useful SL security taxonomy whose central Table 2 misclassifies several papers; fixable with revision. read the letter →

arxiv 2505.05872 v1 pith:H5I2FMTW submitted 2025-05-09 cs.CR cs.LG

Aqsa Shabbir , Halil İbrahim Kanpak , Alptekin Küpçü , Sinem Sav This is my paper · ORCID
classification cs.CRcs.LG
keywords splitlearningtaxonomyattacksdefensesdifferentialprivacyhomomorphicencryptionfeature-spacehijackinglabelinference
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Split learning lets resource-constrained clients train deep models by sharing intermediate activations, or 'smashed data,' with a server—but that sharing creates a recurring leak point. The paper argues that the scattered attack and defense literature can be organized into a single framework with three axes: the strategy employed, the operational constraints, and the measured effectiveness. If the framework holds, researchers gain a shared language for positioning new attacks and defenses, and the field's blind spots become visible—for example, the heavy reliance on semi-honest adversary assumptions and the neglect of no-label and multi-hop split learning. The paper also argues that the cut layer, where smashed data and gradients cross the client–server boundary, is the invariant weak point across all split-learning variants.

What carries the argument

The organizing device is a three-dimensional taxonomy (strategies, constraints, effectiveness) applied to a table of surveyed papers, with the cut layer—the interface where smashed data $z_c$ and gradients $\nabla z_c$ pass between client and server—identified as the recurring architectural vulnerability that most attacks exploit and most defenses try to protect.

What would settle it

Inspect Table 2: [22] is an attack paper demonstrating feature-space hijacking against differentially private split learning, yet it is listed in the defense block with strategy 'Differential Privacy', while [45] proposes label-protection defenses yet is listed as attack-only with 'NA' for defense. A reader could re-derive the taxonomy from the cited papers and check whether the three dimensions are applied consistently; systematic misclassification would invalidate the survey's counts and gap analysis.

Watch

Extended reading notes

Core claim

The paper claims that the security and privacy landscape of split learning can be systematically taxonomized along three dimensions: strategies (what the attack or defense actually does), constraints (the adversarial capabilities and operational assumptions), and effectiveness (how well it works and at what cost). Applying this framework to the surveyed literature, it claims to identify the dominant attack vectors—data reconstruction, label inference, property inference, and model manipulation—and the corresponding defense families, including differential privacy, homomorphic encryption, function secret sharing, architectural modification, and detection mechanisms. The central substantive finding is that intermediate representations and gradients exchanged at the cut layer leak sensitive information across all split-learning variants, so that defenses aimed only at raw inputs are insufficient. The paper further claims that most existing work assumes semi-honest adversaries, leaving stronger threats such as collusion and malicious manipulation underexplored, and that no-label and multi-hop split learning remain the least characterized variants.

Load-bearing premise

The taxonomy holds together only if every surveyed paper is sorted correctly into attack or defense; internal evidence shows at least two placements that appear wrong, and if these are not isolated, the framework misrepresents the literature.

Editorial extensions

If this is right

  • New attacks and defenses can be positioned against a common reference grid, making it easier to compare results across papers that use different split-learning variants and datasets.
  • The cut-layer bottleneck means that privacy defenses must act directly on smashed data and gradients, not only on raw inputs, or reconstruction and label-inference attacks will persist.
  • Differential privacy alone is not a sufficient defense in split learning; the survey cites multiple attacks that circumvent it, so defenses should combine noise with architectural or protocol changes.
  • Research attention should shift toward no-label split learning and multi-hop split learning, whose distinct trust and communication structures create unexplored attack surfaces.
  • Threat models need to move beyond semi-honest adversaries to include malicious and colluding parties, since several surveyed attacks (poisoning, backdoors, hijacking) exceed semi-honest assumptions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same three-axis structure could be applied beyond split learning to any protocol that exchanges intermediate representations, since the leak mechanism is generic rather than architecture-specific.
  • The taxonomy's own misclassifications—an attack paper listed as a defense and a defense paper listed as attack-only—suggest the community would benefit from a living, versioned classification that is corrected as papers are re-examined.
  • If the cut layer is truly the invariant weak point, then quantifying information leakage in $z_c$ with information-theoretic measures could offer a principled way to select cut points, connecting this paper's observations to a quantitative design rule.
  • A testable extension would be to take papers excluded because they do not explicitly reference split learning and see whether their attacks or defenses transfer to the split-learning setting, which would reveal whether the taxonomy's boundaries are too narrow.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper presents a systematization of security attacks and defenses in split learning (SL). It introduces a taxonomy with three dimensions—strategies, constraints, and effectiveness—for both attacks (data reconstruction, label inference, property inference, model manipulation) and defenses (data perturbation, secure computation, structural/protocol modifications, and detection). It reviews SL variants, gives formalized attack and defense formulations, summarizes the surveyed works in Table 2, and derives observations and open research directions, including broadening threat models beyond semi-honest adversaries, studying under-explored NLSL and MHSL variants, and designing uncertainty-aware defenses.

Significance. If the taxonomy is made reliable, this paper would be a useful reference: it consolidates a fragmented literature, distinguishes protection from detection, provides mathematical summaries of representative attacks and defenses, and offers concrete, falsifiable open problems such as adaptive differential privacy for SL and entropy-based cut-layer selection. The contribution is not circular: the taxonomy's structure does not depend on the truth of the authors' own attack and defense results, even though those works are cited. The main weaknesses are the reliability of Table 2 and the incomplete operationalization of two of the three claimed dimensions; once those are corrected, the paper could serve as a standard index for SL security research.

major comments (3)
  1. [Table 2; Sections 4.1.1.1, 4.3, 5.1.1.1] Table 2 places Gawron et al. [22] in the defense block with Defense Strategy 'Differential Privacy' and Attack Strategy 'NA'. This contradicts the manuscript's own description: Section 4.1.1.1 and Supplementary B present [22] as a feature-space-hijacking attack, and Section 4.3 lists [22] among works showing that differential privacy is insufficient against advanced SL attacks. Section 5.1.1.1 also cites [22] as a paper on how DP should be applied, repeating the miscategorization. Because Table 2 is the central index from which the distribution figures and gap analysis are built, this is a load-bearing reliability error, not a cosmetic one.
  2. [Table 2; Section 2; Sections 4.1.2.1 and 4.1.1.3] The binary structure of Table 2 cannot represent papers that propose both attacks and defenses. Section 2 states that each paper was classified 'considering multiple aspects such as the defense mechanisms it proposes in case of an attack paper and the attacks it addresses in case of a defense paper,' yet Table 2 assigns exactly one of Attack Strategy or Defense Strategy and fills the other with 'NA.' Li et al. [45], whose title is 'Label Leakage and Protection in Two-party Split Learning' and which is the basis of No-Label SL in Section 3, is listed only as 'Label Inference - Gradient-Based Label Inference' with Defense 'NA'; Zhang et al. [92] (PCAT), whose title explicitly includes 'target defenses,' is likewise attack-only. The taxonomy needs a schema that records both contributions, or the 'NA' entries need to mean 'not addressed' rather than 'not applicable.'
  3. [Table 2; Sections 4.2, 4.3, 5.2, 5.3] The claimed three-dimensional classification is only partially operationalized. The abstract and Section 2 promise categorization along strategies, constraints, and effectiveness, but Table 2 contains only strategy columns; constraints and effectiveness are presented as narrative groupings in Sections 4.2, 4.3, 5.2, and 5.3 without per-paper coded entries. A reader cannot verify or reuse the constraint and effectiveness dimensions from the paper's central artifact, so the systematic claim of the taxonomy is currently stronger than the evidence it ships.
minor comments (5)
  1. [Section 1, RQ5] 'Wat are the common techniques' should read 'What are the common techniques.'
  2. [Section 5.1.1.2] 'Khann et al. [38]' should read 'Khan et al. [38].'
  3. [Sections 4.2 and 5.2] Several cross-references are misplaced: Section 5.2 refers to 'attacks discussed in Section 5.3.1,' which is a defense subsection, and Section 4.2 refers forward to 'Section 5.3.1' for the threat model discussion.
  4. [References [32] and [33]] References [32] and [33] appear to be the same paper (Ismail and Shukla, arXiv:2307.03197), yet the text cites both without distinguishing them.
  5. [Figures 4, 5, 7, and 8] The distribution figures report counts without an underlying data table; please make the counts derivable from Table 2 or add a supplementary data table.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the taxonomy is constructed from the surveyed literature, and no prediction or derivation reduces to the paper's own inputs.

full rationale

This is a survey/SoK paper, not a derivation. The central claims are the organization of SL attacks and defenses along strategies, constraints, and effectiveness, plus an identification of research gaps. These are built from, not used to derive, the surveyed papers: Section 2 states 'we aligned and classified them to develop our overall taxonomy for SL systematization,' and the equations in Sections 4 and 5 are standard formulations of attack/defense objectives (e.g., reconstruction loss in Eq. (1), differential privacy guarantee in Eq. (9)), not predictions fitted to data. The authors do cite their own prior work ([10,11,12,13,35]) in several places, but in each occurrence the same claim is independently supported by external references (e.g., gradient-detection defenses cite Fu et al. [18] alongside [11,12,13]; homomorphic encryption defenses cite [57,61] alongside [35]), and no load-bearing argument reduces to an unverified self-citation. No uniqueness theorem is imported, no ansatz is smuggled in via citation, and no known result is merely renamed. The internal inconsistency in Table 2 noted by the reader (e.g., Gawron et al. [22] appears in the defense block while Section 4.1.1.1 describes it as a feature-space hijacking attack; Li et al. [45] is listed attack-only despite its label-protection content) is a correctness/classification flaw in the survey artifact, not circularity: the taxonomy's categories are not defined in terms of the disputed table rows, and the paper's argumentative chain does not reduce to its own inputs. Accordingly, no specific circular step can be exhibited under the required standard, and the appropriate score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The central claim rests on two untested assumptions: that the three chosen dimensions are sufficient and disjoint, and that the selected papers are representative and correctly labeled. The former is asserted in Section 2; the latter is undermined by Table 2 errors. No free parameters or invented entities are introduced.

assumptions (3)
  • ad hoc to paper The three taxonomy dimensions (strategy, constraints, effectiveness) are sufficient and largely non-overlapping for describing all SL attacks and defenses.
    The paper asserts this framing in Section 2 without a formal definition or proof of coverage; it is not derived from data.
  • domain assumption The papers in Table 2 are representative of the SL security literature and are classified correctly.
    The search methodology in Section 2 is informal (no PRISMA flow or screening counts), and Table 2 contains apparent misclassifications of Gawron et al. [22] and Li et al. [45].
  • domain assumption Threat models in SL are meaningfully partitioned into semi-honest and malicious adversaries.
    Assumed throughout Sections 4 and 5 for organizing defenses; not formally justified.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Taxonomy of Attacks and Defenses in Split Learning." pith.science (2026). https://pith.science/paper/H5I2FMTW

@misc{pith2026250505872,
  author       = {Pith},
  title        = {Pith review of: A Taxonomy of Attacks and Defenses in Split Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H5I2FMTW}},
  note         = {Machine review of arXiv:2505.05872}
}
read the original abstract

Split Learning (SL) has emerged as a promising paradigm for distributed deep learning, allowing resource-constrained clients to offload portions of their model computation to servers while maintaining collaborative learning. However, recent research has demonstrated that SL remains vulnerable to a range of privacy and security threats, including information leakage, model inversion, and adversarial attacks. While various defense mechanisms have been proposed, a systematic understanding of the attack landscape and corresponding countermeasures is still lacking. In this study, we present a comprehensive taxonomy of attacks and defenses in SL, categorizing them along three key dimensions: employed strategies, constraints, and effectiveness. Furthermore, we identify key open challenges and research gaps in SL based on our systematization, highlighting potential future directions.

Figures

Figures reproduced from arXiv: 2505.05872 by the authors.

Figure 1
Figure 1. SL attack and defense timeline (2021–2025), with attacks on the top [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of three key SL variants: Vanilla Split Learning, U-shaped Split Learning, and Split Federated Learning. The figure highlights their architectural [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. A taxonomy of attacks in SL categorizing attack vectors into: (1) [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The distribution of adversarial models of surveyed attacks in SL. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: The distribution of defense mechanisms classified in the surveyed [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Taxonomy of Defense Strategies 5.1.1. Protection Mechanisms Protection mechanisms aim to secure parties preemptively before attacks occur. These approaches generally conceal or limit the information an adversary can extract, often assuming a semi-honest threat model. 5…
Figure 7
Figure 7. Figure 7: The distribution of split learning types in the surveyed literature on [PITH_FULL_IMAGE:figures/full_fig_p022_7.png]
Figure 8
Figure 8. Figure 8: The distribution of client-server architectures in the surveyed litera [PITH_FULL_IMAGE:figures/full_fig_p023_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

96 extracted references · 70 canonical work pages

  1. [22]

    Gawron and P

    G. Gawron and P. Stubbings. Feature space hijack- ing attacks against differentially private split learning. arXiv:2201.04018, 2022

    arXiv 2022

  2. [45]

    O. Li, J. Sun, X. Yang, W. Gao, H. Zhang, J. Xie, V . Smith, and C. Wang. Label leakage and protection in two-party split learning.arXiv:2102.08504, 2018

    arXiv 2018

  3. [92]

    Zhang, X

    L. Zhang, X. Gao, Y . Li, and Y . Liu. Functionality and data stealing by pseudo-client attack and target defenses in split learning.IEEE TDSC, 2024

    work page 2024

  4. [32]

    A. T. Z. Ismail and R. M. Shukla. Analyzing the vul- nerabilities in splitfed learning: Assessing the robustness against data poisoning attacks.arXiv:2307.03197, 2023

    work page Pith review arXiv 2023

  5. [33]

    A. T. Z. Ismail and R. M. Shukla. Analyzing the vul- nerabilities in splitfed learning: Assessing the robustness against data poisoning attacks, 2023

    work page 2023

  6. [1]

    Abuadbba, K

    S. Abuadbba, K. Kim, M. Kim, C. Thapa, S. A. Camtepe, Y . Gao, H. Kim, and S. Nepal. Can we use split learning on 1d cnn models for privacy preserving training? In ASIACCS, 2020

    2020

  7. [2]

    Arora, O

    R. Arora, O. Dekel, and A. Tewari. Online bandit learning against an adaptive adversary: from regret to policy regret. arXiv:1206.6400, 2012

    arXiv 2012

  8. [3]

    Aumann and Y

    Y . Aumann and Y . Lindell. Security against covert adver- saries: Efficient protocols for realistic adversaries.Jour- nal of Cryptology, 2010

    2010

Show all 96 references
  1. [4]

    Y . Bai, Y . Chen, H. Zhang, W. Xu, H. Weng, and D. Good- man.{VILLAIN}: Backdoor attacks against vertical split learning. InUSENIX Security, 2023

    2023

  2. [5]

    Boyle, N

    E. Boyle, N. Gilboa, and Y . Ishai. Function secret sharing. InEUROCRYPT. Springer, 2015

    2015

  3. [6]

    Carlini, S

    N. Carlini, S. Deng, S. Garg, S. Jha, S. Mahloujifar, M. Mahmoody, S. Song, A. Thakurta, and F. Tramèr. Is private learning possible with instance encoding? 2021

    2021

  4. [7]

    Z. Chen, H. Zheng, and G. Liu. Awdp-fl: An adaptive differential privacy federated learning framework.Elec- tronics, 2024

    2024

  5. [8]

    Debenedetti, G

    E. Debenedetti, G. Severi, N. Carlini, C. A. Choquette- Choo, M. Jagielski, M. Nasr, E. Wallace, and F. Tramèr. Privacy side channels in machine learning systems. In USENIX Security, 2024

    2024

  6. [9]

    C. Dwork. Differential privacy. InICALP, 2006

    2006

  7. [10]

    Erdo ˘gan, A

    E. Erdo ˘gan, A. Küpçü, and A. E. Çiçek. Unsplit: Data- oblivious model inversion, model stealing, and label infer- ence attacks against split learning. InACM WPES, 2022

    2022

  8. [11]

    Erdogan, U

    E. Erdogan, U. Teksen, M. S. Celiktenyildiz, A. Kupcu, and A. E. Cicek. Splitout: Out-of-the-box training- hijacking detection in split learning via outlier detection. InCANS, 2024

    2024

  9. [12]

    Erdo ˘gan, A

    E. Erdo ˘gan, A. Küpçü, and A. E. Çiçek. Splitguard: De- tecting and mitigating training-hijacking attacks in split learning. InWPES, 2022

    2022

  10. [13]

    Erdo ˘gan, U

    E. Erdo ˘gan, U. Tek¸ sen, M. S. Çeliktenyıldız, A. Küpçü, and A. E. Çiçek. Defense mechanisms against training- hijacking attacks in split learning.IEEE TKDE, 2023

    2023

  11. [14]

    M. Fan, C. Chen, C. Wang, W. Zhou, and J. Huang. On the robustness of split learning against adversarial attacks. InECAI. 2023. 15

    2023

  12. [15]

    M. Fang, X. Cao, J. Jia, and N. Gong. Local model poi- soning attacks to{Byzantine-Robust}federated learning. InUSENIX Security, 2020

    2020

  13. [16]

    C. Fu, J. Zhang, T. Zhu, W. Zhou, and P. S. Yu. Label inference attacks against vertical federated learning. In USENIX Security, 2022

    2022

  14. [17]

    J. Fu, Z. Chen, and X. Han. Adap dp-fl: Differentially private federated learning with adaptive noise, 2022

    2022

  15. [18]

    J. Fu, X. Ma, B. B. Zhu, P. Hu, R. Zhao, Y . Jia, P. Xu, H. Jin, and D. Zhang. Focusing on pinocchio’s nose: A gradients scrutinizer to thwart split-learning hijacking at- tacks using intrinsic attributes. InNDSS, 2023

    2023

  16. [19]

    Gajbhiye, P

    S. Gajbhiye, P. Singh, and S. Gupta. Data poisoning attack by label flipping on splitfed learning. InRTIP2R, 2022

    2022

  17. [20]

    Ganin and V

    Y . Ganin and V . Lempitsky. Unsupervised domain adap- tation by backpropagation. InICML, 2015

    2015

  18. [21]

    Y . Gao, M. Du, X. Zhang, and Y . Xiang. Combined feder- ated and split learning in edge computing: Taxonomy and open issues.Sensors, 2022

    2022

  19. [23]

    Goodfellow, J

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio. Generative adversarial nets.NIPS, 2014

    2014

  20. [24]

    Gretton, D

    A. Gretton, D. Sejdinovic, H. Strathmann, S. Balakrish- nan, M. Pontil, K. Fukumizu, and B. K. Sriperumbudur. Optimal kernel choice for large-scale two-sample tests. NIPS, 2012

    2012

  21. [25]

    Gupta and R

    O. Gupta and R. Raskar. Distributed learning of deep neu- ral network over multiple agents, 2018

    2018

  22. [26]

    Y . He, C. Hu, Y . Pu, J. Chen, and X. Li. Advusl: Targeted adversarial attack against u-shaped split learning. InIEEE MASS, 2024

    2024

  23. [27]

    Z. He, T. Zhang, and R. B. Lee. Model inversion attacks against collaborative inference. InACSAC, 2019

    2019

  24. [28]

    Hitaj, G

    B. Hitaj, G. Ateniese, and F. Perez-Cruz. Deep models un- der the gan: Information leakage from collaborative deep learning. InACM SIGSAC, 2017

    2017

  25. [29]

    Z. Hu, T. Zhou, B. Wu, C. Chen, and Y . Wang. A review and experimental evaluation on split learning.Future In- ternet, 2025

    2025

  26. [30]

    Huang, X

    H. Huang, X. Li, and W. He. Pixel-wise reconstruction of private data in split federated learning. InICICS, 2023

    2023

  27. [31]

    Huang, Y

    W. Huang, Y . Wang, A. Cheng, A. Zhou, C. Yu, and L. Wang. A fast, performant, secure distributed training framework for llm. InICASSP, 2024

    2024

  28. [34]

    Joshi, C

    P. Joshi, C. Thapa, S. Camtepe, M. Hasanuzzaman, T. Scully, and H. Afli. Performance and information leakage in splitfed learning and multi-head split learning in healthcare data and beyond.Methods and Protocols, 2022

    2022

  29. [35]

    H. I. Kanpak, A. Shabbir, E. Genç, A. Küpçü, and S. Sav. Cure: Privacy-preserving split learning done right, 2024

    2024

  30. [36]

    Karakoç, A

    F. Karakoç, A. Küpçü, and M. Önen. Fault tolerant and malicious secure federated learning. InCANS, 2024

    2024

  31. [37]

    Kariyappa and M

    S. Kariyappa and M. K. Qureshi. Exploit: Extracting pri- vate labels in split learning. InSaTML. IEEE, 2023

    2023

  32. [38]

    T. Khan, M. Budzys, and A. Michalas. Make split, not hijack: Preventing feature-space hijacking attacks in split learning. InSACMAT, 2024

    2024

  33. [39]

    T. Khan, K. Nguyen, and A. Michalas. A more secure split: Enhancing the security of privacy-preserving split learning. InAsiaCCS. Tampere University, 2023

    2023

  34. [40]

    T. Khan, K. Nguyen, and A. Michalas. Split ways: Privacy-preserving training of encrypted data using split learning. InarXiv:2301.08778, 2023, 2023

    2023 arXiv

  35. [41]

    T. Khan, K. Nguyen, A. Michalas, and A. Bakas. Love or hate? share or split? privacy-preserving training using split learning and homomorphic encryption, 2023

    2023

  36. [42]

    S. A. Khowaja, I. H. Lee, K. Dev, M. A. Jarwar, and N. M. F. Qureshi. Get your foes fooled: Proximal gradient split learning for defense against model inversion attacks on iomt data.IEEE TNSE, 2024

    2024

  37. [43]

    Kohankhaki, A

    M. Kohankhaki, A. Ayad, M. Barhoush, and A. Schmeink. Detecting data poisoning in split learning using intraclass- distance inflated loss. InIEEE GC Wkshps, 2023

    2023

  38. [44]

    J. Li, A. S. Rakin, X. Chen, Z. He, D. Fan, and C. Chakrabarti. Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning. InCVPR, 2022

    2022

  39. [46]

    Z. Li, S. Si, J. Wang, and J. Xiao. Federated split bert for heterogeneous text classification, 2022. 16

    2022

  40. [47]

    Z. Li, C. Yan, X. Zhang, G. Gharibi, Z. Yin, X. Jiang, and B. A. Malin. Split learning for distributed collaborative training of deep learning models in health informatics. In AMIA Annu. Symp. Proc, 2024

    2024

  41. [48]

    J. Liu, X. Lyu, Q. Cui, and X. Tao. Similarity-based la- bel inference attack against training and inference of split learning.IEEE TIFS, 2024

    2024

  42. [49]

    M. Long, Y . Cao, J. Wang, and M. Jordan. Learning trans- ferable features with deep adaptation networks. InPMLR, 2015

    2015

  43. [50]

    Maeng, C

    K. Maeng, C. Guo, S. Kariyappa, and G. E. Suh. Bound- ing the invertibility of privacy-preserving instance encod- ing using fisher information.NeurIPS, 2023

    2023

  44. [51]

    Mansouri, M

    M. Mansouri, M. Önen, W. B. Jaballah, and M. Conti. Sok: Secure aggregation based on cryptographic schemes for federated learning.PoPETs, 2023

    2023

  45. [52]

    Y . Mao, Z. Xin, Z. Li, J. Hong, Q. Yang, and S. Zhong. Secure split learning against property inference, data re- construction, and feature space hijacking attacks. InES- ORICS, 2023

    2023

  46. [53]

    M. Nasr, R. Shokri, and A. Houmansadr. Machine learn- ing with membership privacy using adversarial regulariza- tion. InACM SIGSAC, 2018

    2018

  47. [54]

    M. Nasr, R. Shokri, and A. Houmansadr. Comprehen- sive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and feder- ated learning. InIEEE S&P, 2019

    2019

  48. [55]

    L. K. Ng and S. S. Chow. Sok: cryptographic neural- network computation. InIEEE S&P, 2023

    2023

  49. [56]

    K. T. P. Ngoc Duy Pham and N. Chilamkurti. Enhancing accuracy-privacy trade-offin differentially private split learning, 2024

    2024

  50. [57]

    Nguyen, T

    K. Nguyen, T. Khan, and A. Michalas. Split without a leak: Reducing privacy leakage in split learning. InSe- cureComm, 2025

    2025

  51. [58]

    Gpt-4o: Multimodal ai model

    OpenAI. Gpt-4o: Multimodal ai model

  52. [59]

    Pasquini, G

    D. Pasquini, G. Ateniese, and M. Bernaschi. Unleashing the tiger: Inference attacks on split learning. InACM CCS, 2021

    2021

  53. [60]

    Z. Peng, T. Wang, C. Zhao, G. Liao, Z. Lin, Y . Liu, B. Cao, L. Shi, Q. Yang, and S. Zhang. A survey of zero- knowledge proof based verifiable machine learning, 2025

    2025

  54. [61]

    Pereteanu, A

    G.-L. Pereteanu, A. Alansary, and J. Passerat-Palmbach. Split he: Fast secure inference combining split learning and homomorphic encryption, 2022

    2022

  55. [62]

    N. D. Pham, A. Abuadbba, Y . Gao, T. K. Phan, and N. Chilamkurti. Binarizing split learning for data privacy enhancement and computation reduction, 2022

    2022

  56. [63]

    N. D. Pham and N. Chilamkurti. Data leakage threats and protection in split learning: A survey. InICEA, 2023

    2023

  57. [64]

    N. D. Pham, K. T. Phan, and N. Chilamkurti. Enhancing accuracy-privacy trade-offin differentially private split learning.IEEE TIFS, 2024

    2024

  58. [65]

    N. D. Pham, T. K. Phan, A. Abuadbba, Y . Gao, D. Nguyen, and N. Chilamkurti. Split learning without local weight sharing to enhance client-side data privacy. arXiv:2212.00250, 2022

    2022 arXiv

  59. [66]

    N. D. Pham, T. K. Phan, A. Abuadbba, Y . Gao, V .-D. Nguyen, and N. Chilamkurti. Split Learning without Lo- cal Weight Sharing To Enhance Client-side Data Privacy . IEEE TDSC, (01):1–13, Apr. 5555

  60. [67]

    Podschwadt, D

    R. Podschwadt, D. Takabi, and P. Hu. Sok: Privacy- preserving deep learning with homomorphic encryption. arXiv:2112.12855, 2021

    2021 arXiv

  61. [68]

    M. G. Poirot, P. Vepakomma, K. Chang, J. Kalpathy- Cramer, R. Gupta, and R. Raskar. Split learning for col- laborative deep learning in healthcare.arXiv:1912.04966, 2019

    1912 arXiv

  62. [69]

    Rieger, A

    P. Rieger, A. Pegoraro, K. Kumari, T. Abera, J. Knauer, and A.-R. Sadeghi. Safesplit: A novel defense against client-side backdoor attacks in split learning. InNDSS, 2025

    2025

  63. [70]

    H. R. Roth, A. Hatamizadeh, Z. Xu, C. Zhao, W. Li, A. Myronenko, and D. Xu. Split-u-net: Preventing data leakage in split learning for collaborative multi-modal brain tumor segmentation, 2022

    2022

  64. [71]

    L. I. Rudin, S. Osher, and E. Fatemi. Nonlinear total vari- ation based noise removal algorithms.Physica D, 1992

    1992

  65. [72]

    M. D. Ryan. Cloud computing privacy concerns on our doorstep.Communications of the ACM, 2011

    2011

  66. [73]

    Singh, A

    A. Singh, A. Chopra, V . Sharma, E. Garza, E. Zhang, P. Vepakomma, and R. Raskar. Disco: Dynamic and in- variant sensitive channel obfuscation for deep neural net- works, 2021

    2021

  67. [74]

    Tajalli, O

    B. Tajalli, O. Ersoy, and S. Picek. On feasibility of server- side backdoor attacks on split learning. InIEEE SPW, 2023

    2023

  68. [75]

    Talaei and I

    M. Talaei and I. Izadi. Adaptive differential pri- vacy in federated learning: A priority-based approach. arXiv:2401.02453, 2024

    2024 arXiv

  69. [76]

    Thapa, M

    C. Thapa, M. A. P. Chamikara, S. Camtepe, and L. Sun. Splitfed: When federated learning meets split learning. In AAAI, 2022

    2022

  70. [77]

    Titcombe, A

    T. Titcombe, A. J. Hall, P. Papadopoulos, and D. Ro- manini. Practical defences against model inversion attacks for split neural networks. InICLR Workshop on DPML, 2021. 17

    2021

  71. [78]

    Turina, Z

    V . Turina, Z. Zhang, F. Esposito, and I. Matta. Feder- ated or split? a performance and privacy analysis of hy- brid split and federated learning architectures. InCLOUD, 2021

    2021

  72. [79]

    Vepakomma, J

    P. Vepakomma, J. Balla, and R. Raskar. Privatemail: Su- pervised manifold learning of deep features with differen- tial privacy for image retrieval, 2021

    2021

  73. [80]

    Vepakomma, O

    P. Vepakomma, O. Gupta, A. Dubey, and R. Raskar. Re- ducing leakage in distributed deep learning for sensitive health data.arXiv:1812.00564, 2019

    2019 arXiv

  74. [81]

    Vepakomma, O

    P. Vepakomma, O. Gupta, T. Swedish, and R. Raskar. Split learning for health: Distributed deep learning with- out sharing raw patient data, 2018

    2018

  75. [82]

    Vepakomma, A

    P. Vepakomma, A. Singh, O. Gupta, and R. Raskar. Nopeek: Information leakage reduction to share activa- tions in distributed deep learning, 2020

    2020

  76. [83]

    X. Wan, J. Sun, S. Wang, L. Chen, Z. Zheng, F. Wu, and G. Chen. Pslf: Defending against label leakage in split learning. InACM CIKM, 2023

    2023

  77. [84]

    Y . Wang, C. Zhang, Z. Zheng, J. Wang, and X. Li. Stitch- able split learning assisted multi-uav systems.IEEE Open J. Comput. Soc, 2024

    2024

  78. [85]

    X. Wu, H. Yuan, X. Li, J. Ni, and R. Lu. Evaluating se- curity and robustness for split federated learning against poisoning attacks.IEEE TIFS, 2024

    2024

  79. [86]

    S. Xie, X. Yang, Y . Yao, T. Liu, T. Wang, and J. Sun. La- bel inference attack against split learning under regression setting.arXiv:2301.07284, 2023

    2023 arXiv

  80. [87]

    X. Xu, M. Yang, W. Yi, Z. Li, J. Wang, H. Hu, Y . Zhuang, and Y . Liu. A stealthy wrongdoer: Feature-oriented re- construction attack against split learning. InCVPR, 2024

    2024

  81. [88]

    X. Yang, J. Sun, Y . Yao, J. Xie, and C. Wang. Dif- ferentially private label protection in split learning. arXiv:2203.02073, 2022

    2022 arXiv

  82. [89]

    F. Yu, L. Wang, B. Zeng, K. Zhao, Z. Pang, and T. Wu. How to backdoor split learning.Neural Networks, 2023

    2023

  83. [90]

    F. Yu, B. Zeng, K. Zhao, Z. Pang, and L. Wang. Chronic poisoning: Backdoor attack against split learning. In AAAI, 2024

    2024

  84. [91]

    B. Zeng, S. Luo, F. Yu, G. Yang, K. Zhao, and L. Wang. Gan-based data reconstruction attacks in split learning. Neural Networks, 2025

    2025

  85. [93]

    K. Zhao, X. Chuo, F. Yu, B. Zeng, Z. Pang, and L. Wang. Splitaum: Auxiliary model-based label inference attack against split learning.IEEE TNSM, 2024

    2024

  86. [94]

    Y . Zhao, M. Li, L. Lai, N. Suda, D. Civin, and V . Chandra. Federated learning with non-iid data.arXiv:1806.00582, 2018

    2018 arXiv

  87. [95]

    L. Zhu, Z. Liu, and S. Han. Deep leakage from gradients. InNeurIPS, 2019

    2019

  88. [96]

    X. Zhu, X. Luo, Y . Wu, Y . Jiang, X. Xiao, and B. C. Ooi. Passive inference attacks on split learning via adversarial regularization.arXiv:2310.10483, 2023. 18 Supplementary Material A. Additional Split Learning Variants Here, we explain the remaining SL variants, namely mult...

    2023 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.