Distance-Based Online Label Inference Attacks Against Split Learning

Abstract

Split learning is a promising paradigm for distributed learning at resource-constrained devices, where the learning model is split to be trained at the participants collaboratively. Unlike federated learning that shares the entire gradients among participants, split learning only exchanges the intermediate learning results (i.e., the extracted features/smashed data and gradients) at the cut layer between participants and server. This requires different/new attack designs to understand the security performance of various privacy-sensitive applications using split learning. This paper focuses on private labels and proposes three label inference attacks based on the similarities between exchanged gradients/smashed data and sample points. We mathematically analyze and unify these similarities (for retrieving accurate labels) as Euclidean distance, such that the attack can be conducted by finding the nearest sample point from target data in Euclidean space. We also show that transfer learning can help retrieve private labels directly from raw data. Experimental results demonstrate that our attacks can recover private labels against three state-of-the-art label protection methods.