[Paper Review] ExPLoit: Extracting Private Labels in Split Learning

Sanjay Kariyappa, Moinuddin K. Qureshi|arXiv (Cornell University)|Nov 25, 2021

Privacy-Preserving Technologies in Data4 citations

TL;DR

ExPLoit is a label-leakage attack that enables an adversarial input owner to extract private labels from a label owner in split learning by framing the task as supervised learning using a surrogate model and a novel loss function combining gradient matching and data/model regularizations. The attack achieves up to 99.96% label leakage accuracy, demonstrating that split learning offers negligible label privacy protection.

ABSTRACT

Split learning is a popular technique used for vertical federated learning (VFL), where the goal is to jointly train a model on the private input and label data held by two parties. This technique uses a split-model, trained end-to-end, by exchanging the intermediate representations (IR) of the inputs and gradients of the IR between the two parties. We propose ExPLoit - a label-leakage attack that allows an adversarial input-owner to extract the private labels of the label-owner during split-learning. ExPLoit frames the attack as a supervised learning problem by using a novel loss function that combines gradient-matching and several regularization terms developed using key properties of the dataset and models. Our evaluations show that ExPLoit can uncover the private labels with near-perfect accuracy of up to 99.96%. Our findings underscore the need for better training techniques for VFL.

Motivation & Objective

• To investigate whether split learning provides meaningful privacy guarantees for private labels held by the label owner.
• To develop a practical attack that enables an adversarial input owner to extract the label owner’s private labels during split learning.
• To evaluate the effectiveness of gradient noise as a defense mechanism against such label-leakage attacks.
• To demonstrate that existing split learning protocols fail to protect label privacy, necessitating improved vertical federated learning techniques.

Proposed method

• ExPLoit replaces the label owner’s model and private labels with a learnable surrogate model and surrogate labels, enabling the attack to be framed as a supervised learning problem.
• The attack uses a novel loss function combining gradient-matching, label prior distribution matching, label entropy minimization, and prediction accuracy objectives.
• The surrogate parameters are trained using the intermediate representations (IRs) and gradients exchanged during split learning, leveraging the full set of {z_i, ∇_z L_i} pairs.
• The method enforces regularization via label prior and entropy constraints to ensure surrogate labels reflect the true label distribution and are hard (low entropy).
• The attack is optimized using a composite loss function that balances gradient fidelity, label distribution alignment, and model accuracy.
• The defense is evaluated by adding Gaussian noise to gradients (η ~ N(0, σ)), assessing the resulting utility-privacy trade-off across datasets.

Experimental results

Research questions

• RQ1 Can an adversarial input owner extract the private labels of the label owner in a two-party split learning setup?
• RQ2 To what extent does the proposed ExPLoit attack compromise label privacy in split learning across diverse datasets?
• RQ3 How effective is gradient noise as a defense mechanism in mitigating label leakage, and what is the resulting utility-privacy trade-off?
• RQ4 How does ExPLoit compare in performance to prior label-leakage attacks in split learning?

Key findings

• ExPLoit achieves up to 99.96% label leakage accuracy on multiple datasets, including MNIST, FashionMNIST, CIFAR-10, CIFAR-100, and the Criteo conversion prediction task.
• The attack outperforms recent label-leakage attacks by up to 67.2% in leakage accuracy, demonstrating superior effectiveness.
• Gradient noise defense reduces label leakage accuracy by 77% on MNIST with only a 4% drop in test accuracy, indicating a favorable utility-privacy trade-off for simpler datasets.
• For more complex datasets like CIFAR-10 and CIFAR-100, the same defense causes a 38% drop in test accuracy for a 79% reduction in label leakage, making it impractical for complex models.
• The gradient noise defense degrades the quality of intermediate representations, reducing the efficacy of other attacks like K-Means and model completion, though ExPLoit remains more effective on complex datasets.
• The UnSplit attack remains ineffective even when gradient noise is applied, indicating that noise does not fully neutralize all attack vectors.