Survey of split learning data privacy

QIN Yiqun; MA Xiaojing; FU Jiayun; HU Pingyi; XU Peng; JIN Hai

doi:10.11959/j.issn.2096-109x.2024037

您当前的位置：

首页 >

文章列表页 >

Survey of split learning data privacy

Reviews | 更新时间：2024-08-14

- Survey of split learning data privacy
- Chinese Journal of Network and Information Security Vol. 10, Issue 3, Pages: 20-37(2024)
- 作者机构：
  
  1.大数据技术与系统国家地方联合工程研究中心, 服务计算技术与系统教育部重点实验室, 湖北武汉 430074
  2.华中科技大学网络空间安全学院, 湖北武汉 430074
  3.华中科技大学计算机科学与技术学院, 湖北武汉 430074
- 作者简介：
- 基金信息：
  
  National Nature Science Foundation of China(62272175)
- DOI：10.11959/j.issn.2096-109x.2024037
  CLC： TP309.2
- Received：02 March 2023，
  
  Revised：2024-03-04，
  
  Published：25 June 2024
- 稿件说明：
移动端阅览
秦轶群, 马晓静, 付佳韵, 等. 分割学习数据隐私研究综述[J]. 网络与信息安全学报, 2024, 10(3): 20-37.

QIN Y Q, MA X J, FU J Y, et al. Survey of split learning data privacy[J]. Chinese Journal of Network and Information Security, 2024, 10(3): 20-37.
秦轶群, 马晓静, 付佳韵, 等. 分割学习数据隐私研究综述[J]. 网络与信息安全学报, 2024, 10(3): 20-37. DOI： 10.11959/j.issn.2096-109x.2024037.

QIN Y Q, MA X J, FU J Y, et al. Survey of split learning data privacy[J]. Chinese Journal of Network and Information Security, 2024, 10(3): 20-37. DOI： 10.11959/j.issn.2096-109x.2024037.

摘要

随着机器学习的快速发展，以其为核心的人工智能技术已经应用于生活的各个领域，但人们也日益担忧机器学习会泄露隐私信息。为了保护国家和公民的信息安全，我国颁布了《中华人民共和国个人信息保护法》来规范隐私信息的收集、使用和传输。然而机器学习需要使用大量数据，因此需要隐私保护技术在合法合规的情况下完成数据的收集和处理。分割学习可以在不共享原始数据的情况下在多个参与方之间训练分布式模型，成为机器学习隐私保护领域的研究热点。分割学习面临着数据隐私遭受攻击的风险，目前已有多种不同的攻击方法和对应的防御方法被提出，但已有的综述未对分割学习训练阶段数据隐私的研究内容进行讨论和总结。因此对分割学习训练阶段的数据隐私攻防技术进行综述。归纳了分割学习定义，给出了其原理和分类；介绍了分割学习中两类常见的攻击方法，原始数据重建攻击和标签推断攻击，分析了分割学习训练阶段数据隐私受到数据隐私攻击的原因，并总结了相应的防御方法；最后，讨论了分割学习数据隐私研究的未来发展方向。

Abstract

With the rapid development of machine learning

artificial intelligence technology has been widely applied across various domains of life. However

concerns regarding the privacy risks associated with machine learning have increased. In response to these concerns

the Personal Information Protection Law of the People's Republic of China was promulgated to regulate the collection

use

and transmission of private information. Despite this

machine learning requires a large amount of data

necessitating the development of privacy protection technologies that allow for the collection and processing of data under legal and compliant conditions. Split learning

a privacy-preserving machine learning technique that enables the training of distributed models among multiple participants without sharing raw data

has emerged as a research focus. It has been recognized that split learning is vulnerable to data privacy attacks

and various attacks along with corresponding defenses have been proposed. However

existing surveys have not discussed and summarized research on data privacy during the training phase of split learning. The comprehensive overview of data privacy attack and defense techniques in the training phase of split learning was offered. Initially

the definition

principles

and classifications of split learning were summarized. Subsequently

two common attacks in split learning

namely the raw data reconstruction attack and the label leakage attack

were introduced. The causes of these attacks in the training phase of split learning were then analyzed

and corresponding defenses were presented. Finally

future research directions in the area of data privacy for split learning were discussed.

关键词

Keywords

references

KONEČNÝ J , MCMAHAN H B , YU F X , et al . Federated learning: strategies for improving communication efficiency [EB ] . arXiv Preprint arXiv: 1610.05492 , 2016 .

VEPAKOMMA P , GUPTA O , SWEDISH T , et al . Split learning for health: distributed deep learning without sharing raw patient data [EB ] . arXiv preprint arXiv: 1812.00564 , 2018 .

POIROT M G , VEPAKOMMA P , CHANG K , et al . Split Learning for collaborative deep learning in healthcare [EB ] . arXiv Preprint arXiv: 1912.12115 , 2019 .

HA Y J , LEE G S , YOO M , et al . Feasibility study of multi-site split learning for privacy-preserving medical systems under data imbalance constraints in COVID-19, X-ray, and cholesterol dataset [J ] . Scientific Reports , 2022 , 12 : 1534 .

ROTH H R , HATAMIZADEH A , XU Z Y , et al . Split-U-Net: preventing data leakage in split learning for collaborative multi-modal brain tumor segmentation [C ] // Proceedings of International Workshop on Distributed, Collaborative, and Federated Learning, Workshop on Affordable Healthcare and AI for Resource Diverse Global Health . Cham : Springer , 2022 : 47 - 57 .

PARK S , KIM G , KIM J , et al . Federated split vision transformer for COVID-19 CXR diagnosis using task-agnostic training [EB ] . arXiv Preprint arXiv: 2111.01338 , 2021 .

OH S , PARK J , BAEK S , et al . Differentially private CutMix for split learning with vision transformer [EB ] . arXiv Preprint arXiv: 2210.15986 , 2022 .

SHAN C Q , JIAO H Y , FU J . Towards representation identical privacy-preserving graph neural network via split learning [EB ] . arXiv Preprint arXiv: 2107.05917 , 2021 .

JIANG L L , WANG Y X , ZHENG W Y , et al . LSTMSPLIT: effective split learning based LSTM on sequential time-series data [EB ] . arXiv Preprint arXiv: 2203.04305 , 2022 .

陈晋音 , 李荣昌 , 黄国瀚 , 等 . 纵向联邦学习方法及其隐私和安全综述 [J ] . 网络与信息安全学报 , 2023 , 9 ( 2 ): 1 - 20 .

CHEN J Y , LI R C , HUANG G H , et al . Survey on vertical federated learning: algorithm, privacy and security [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 2 ): 1 - 20 .

YANG Q , LIU Y , CHEN T J , et al . Federated machine learning [J ] . ACM Transactions on Intelligent Systems and Technology , 2019 , 10 ( 2 ): 1 - 19 .

VEPAKOMMA P , SWEDISH T , RASKAR R , et al . No Peek: a survey of private distributed deep learning [EB ] . arXiv Preprint arXiv: 1812.03288 , 2018 .

THAPA C , CHAMIKARA M A P , CAMTEPE S A . Advancements of federated learning towards privacy preservation: from federated learning to split learning [M ] . REHMAN MHU, GABER MM. Federated Learning Systems. Cham : Springer , 2021 .

THAPA C , CAMTEPE S . Precision health data: requirements, challenges and existing techniques for data security and privacy [J ] . Computers in Biology and Medicine , 2021 , 129 : 104130 .

USYNIN D , ZILLER A , MAKOWSKI M , et al . Adversarial interference and its mitigations in privacy-preserving collaborative machine learning [J ] . Nature Machine Intelligence , 2021 , 3 : 749 - 758 .

MA C , LI J , WEI K , et al . Trusted AI in multi-agent systems: an overview of privacy and security for distributed learning [J ] . arXiv Preprint arXiv: 2202.09027 , 2022 .

SOYKAN EU , KARAÇAY L , KARAKOÇ F , et al . A survey and guideline on privacy enhancing technologies for collaborative machine learning [J ] . IEEE Access , 2022 , 10 : 97495 - 97519 .

VEPAKOMMA P , RASKAR R . Split learning: a resource efficient model and data parallel approach for distributed deep learning [M ] . LUDWIG H, BARACALDO N. Federated Learning. Cham : Springer , 2022 .

THAPA C , MAHAWAGA ARACHCHIGE P C , CAMTEPE S , et al . SplitFed: when federated learning meets split learning [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2022 , 36 ( 8 ): 8485 - 8493 .

CHOPRA A , SAHU S K , SINGH A , et al . AdaSplit: adaptive trade-offs for resource-constrained distributed deep learning [EB ] . arXiv Preprint arXiv: 2112.01637 , 2021 .

ERDOĞAN E , KÜPÇÜ A , ERCÜMENT ÇIÇEK A . UnSplit: data-oblivious model inversion, model stealing, and label inference attacks against split learning [C ] // Proceedings of the 21st Workshop on Privacy in the Electronic Society . New York : ACM , 2022 : 115 - 124 .

GAO X , ZHANG L . PCAT: functionality and data stealing from split learning by pseudo-client attack [C ] // Proceedings of 32nd USENIX Security Symposium(USENIX Security) . [ S.l. : s.n. ] , 2023 .

YE P , JIANG Z F , WANG W , et al . Feature reconstruction attacks and countermeasures of DNN training in vertical federated learning [EB ] . arXiv Preprint arXiv: 2210.06771 , 2023 .

PASQUINI D , ATENIESE G , BERNASCHI M . Unleashing the tiger: inference attacks on split learning [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2021 .

ZHENG F , CHEN C C , YAO B H , et al . Making split learning resilient to label leakage by potential energy loss [EB ] . arXiv preprint arXiv: 2210.09617 , 2022 .

LI O , SUN J K , YANG X , et al . Label leakage and protection in two-party split learning [EB ] . arXiv Preprint arXiv: 2102.08504 , 2021 .

LIU J L , LYU X C , CUI Q M , et al . Similarity-based label inference attack against training and inference of split learning [EB ] . arXiv Preprint arXiv: 2203.05222 , 2022 .

FU C , ZHANG X , JI S , et al . Label inference attacks against vertical federated learning [C ] //Proceedings of 31st USENIX Security Symposium(USENIX Security). Boston, [S.n. ] , 2022 .

YUAN S , XUE M , WANG K , et al . Deep gradient attacks with strong DP-SGD lower bounds for label privacy [C ] // Proceedings of International Conference on Learning Representations Workshop(ICLRW) . [ S.l. : s.n. ] , 2021 .

KARIYAPPA S , QURESHI M K . ExPLoit: extracting private labels in split learning [C ] // Proceedings of the 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) . Piscataway : IEEE Press , 2023 : 165 - 175 .

RUDIN L I , OSHER S , FATEMI E . Nonlinear total variation based noise removal algorithms [J ] . Physica D , 1992 , 60 : 259 - 268 .

ABUADBBA S , KIM K , KIM M , et al . Can we use split learning on 1D CNN models for privacy preserving training [C ] // Proceedings of the 15th ACM Asia Conference on Computer and Communications Security . New York : ACM , 2020 .

LI J T , RAKIN A S , CHEN X , et al . ResSFL: a resistance transfer framework for defending model inversion attack in split federated learning [C ] // Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . Piscataway : IEEE Press , 2022 : 10184 - 10192 .

XIAO D Y , YANG C G , WU W G . Mixing activations and labels in distributed training for split learning [J ] . IEEE Transactions on Parallel and Distributed Systems , 2022 , 33 ( 11 ): 3165 - 3177 .

VEPAKOMMA P , SINGH A , GUPTA O , et al . NoPeek: information leakage reduction to share activations in distributed deep learning [C ] // Proceedings of the 2020 International Conference on Data Mining Workshops (ICDMW) . Piscataway : IEEE Press , 2020 : 933 - 942 .

VEPAKOMMA P , GUPTA O , DUBEY A , et al . Reducing leakage in distributed deep learning for sensitive health data [EB ] . arXiv Preprint arXiv: 1812.00564 , 2019 .

VEPAKOMMA P , SINGH A , ZHANG E , et al . NoPeek-Infer: preventing face reconstruction attacks in distributed inference after on-premise training [C ] // Proceedings of the 2021 16th IEEE International Conference on Automatic Face and Gesture Recognition (FG 2021) . Piscataway : IEEE Press , 2021 : 1 - 8 .

PHAM N D , ABUADBBA A , GAO Y , et al . Binarizing split learning for data privacy enhancement and computation reduction [EB ] . arXiv Preprint arXiv: 2206.04864 , 2022 .

QIU P Y , ZHANG X H , JI S L , et al . HashVFL: defending against data reconstruction attacks in vertical federated learning [EB ] . arXiv Preprint arXiv: 2212.00325 , 2022 .

ZHOU J , ZHENG L F , CHEN C C , et al . Toward scalable and privacy-preserving deep neural network via algorithmic-cryptographic co-design [J ] . ACM Transactions on Intelligent Systems and Technology , 2022 , 13 ( 4 ): 1 - 21 .

DEMMLER D , SCHNEIDER T , ZOHNER M . ABY-A framework for efficient mixed-protocol secure two-party computation [C ] // Proceedings of 2015 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2015 .

ERDOGAN E , KÜPÇÜ A , CICEK A E . SplitGuard: detecting and mitigating training-hijacking attacks in split learning [C ] // Proceedings of the 21st Workshop on Privacy in the Electronic Society . New York : ACM , 2022 .

WANG Y L , LV Q Z , ZHANG H , et al . Beyond model splitting: preventing label inference attacks in vertical federated learning with dispersed training [J ] . World Wide Web , 2023 , 26 ( 5 ): 2691 - 2707 .

YANG X , SUN J K , YAO Y S , et al . Differentially private label protection in split learning [EB ] . arXiv Preprint arXiv:2203. 02073 , 2022 .

谭作文 , 张连福 . 机器学习隐私保护研究综述 [J ] . 软件学报 , 2020 , 31 ( 7 ): 2127 - 2156 .

TAN Z W , ZHANG L F . Survey on privacy preserving techniques for machine learning [J ] . Journal of Software , 2020 , 31 ( 7 ): 2127 - 2156 .

DWORK C , MCSHERRY F , NISSIM K , et al . Calibrating noise to sensitivity in private data analysis [M ] . Theory of Cryptography . Berlin, Heidelberg : Springer Berlin Heidelberg , 2006 .

DOLEV D , YAO A . On the security of public key protocols [J ] . IEEE Transactions on Information Theory , 1983 , 29 ( 2 ): 198 - 208 .

苏冠通 , 徐茂桐 . 安全多方计算技术与应用综述 [J ] . 信息通信技术与政策 , 2019 , ( 5 ): 19 - 22 .

SU G T , XU M T . Survey of secure multiparty computing technology and application [J ] . Information and Communication Technol-ogy and Policy , 2019 , ( 5 ): 19 - 22 .

GENTRY C . Fully homomorphic encryption using ideal lattices [C ] // Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing(STOC) . Bethesda, [s.n.] , 2009 .

BONEH D , SAHAI A , WATERS B . Functional encryption: definitions and challenges [M ] . ISHAI Y, ed. Theory of Cryptography. Berlin, Heidelberg : Springer Berlin Heidelberg , 2011 .

WANG R , KARIMI A H , GHODSI A . Distance correlation autoencoder [C ] // Proceedings of the 2018 International Joint Conference on Neural Networks (IJCNN) . Piscataway : IEEE Press , 2018 : 1 - 8 .

SENIN P . Dynamic time warping algorithm review [J ] . Information and Computer Science Department University of Hawaii at Manoa Honolulu , 2008 , 855 ( 1-23 ): 40 .

DOSOVITSKIY A , BEYER L , KOLESNIKOV A , et al . An image is worth 16x16 words: transformers for image recognition at scale [EB ] . arXiv Preprint arXiv: 2010.11929 , 2020 .

YUN S , HAN D , CHUN S , et al . CutMix: regularization strategy to train strong classifiers with localizable features [C ] // Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision (ICCV) . Piscataway : IEEE Press , 2019 : 6022 - 6031 .

MOHASSEL P , ZHANG Y P . SecureML: a system for scalable privacy-preserving machine learning [C ] // Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2017 : 19 - 38 .

XU R H , JOSHI J , LI C . NN-EMD: efficiently training neural networks using encrypted multi-sourced datasets [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , 19 ( 4 ): 2807 - 2820 .

GAWRON G , STUBBINGS P . Feature space hijacking attacks against differentially private split learning [EB ] . arXiv Preprint arXiv: 2201.04018 , 2022 .

FU J Y , MA X J , ZHU B B , et al . Focusing on pinocchio's nose: a gradients scrutinizer to thwart split-learning hijacking attacks using intrinsic attributes [C ] // Proceedings of 2023 Network and Distributed System Security Symposium . Reston, VA : Internet Society , 2023 .

BERNSTEIN J , WANG Y X , AZIZZADENESHELI K , et al . SignSGD: compressed optimisation for non-convex problems [EB ] . arXiv Preprint arXiv: 1802. 04434 , 2018

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Bidirectional privacy authorization for large models based on private set intersection

Research on searchable encryption scheme based on enhanced PIR

Differential privacy protection method for localization of ADS-B message positioning data oriented to LBS

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Secure aggregation for semi-decentralized federated learning under heterogeneous data

Related Author

YANG Shuai

HAN Yiliang

WU Xuguang

FENG Haokang

WANG Yuanyuan

TANG Liang

MA Limin

YANG Hongyu

Related Institution

Key Laboratory of Counter-Terrorism Command Information Engineering of the Ministry of Education, Engineering University of PAP

College of Cryptography Engineering, Engineering University of PAP

College of Computer Science，Beijing Information Science and Technology University

Beijing Academy of Educational Science

School of Safety Science and Engineering, Civil Aviation University of China

⁰