Clustering Label Inference Attack against Practical Split Learning
  Split learning is deemed as a promising paradigm for privacy-preserving
distributed learning, where the learning model can be cut into multiple
portions to be trained at the participants collaboratively. The participants
only exchange the intermediate learning results at the cut layer, including
smashed data via forward-pass (i.e., features extracted from the raw data) and
gradients during backward-propagation.Understanding the security performance of
split learning is critical for various privacy-sensitive applications.With the
emphasis on private labels, this paper proposes a passive clustering label
inference attack for practical split learning. The adversary (either clients or
servers) can accurately retrieve the private labels by collecting the exchanged
gradients and smashed data.We mathematically analyse potential label leakages
in split learning and propose the cosine and Euclidean similarity measurements
for clustering attack. Experimental results validate that the proposed approach
is scalable and robust under different settings (e.g., cut layer positions,
epochs, and batch sizes) for practical split learning.The adversary can still
achieve accurate predictions, even when differential privacy and gradient
compression are adopted for label protections.
