# Split Learning with Differential Privacy:
Balancing between Privacy and Utility

Ngoc Duy Pham, Tran Khoa Phan, Naveen Chilamkurti Pham, Phan, and Chilamkurti
are with School of Computing, Engineering, and Mathematical Sciences (SCEMS),
La Trobe University, Victoria, Australia. Email: {ngocduy.pham, k.phan,
<EMAIL_ADDRESS>
###### Abstract

Split learning (SL) has recently emerged as an appealing framework designed to
enable deep learning on resource-constrained devices by partitioning a deep
model into multiple parts to distribute between the data owners and the cloud
server. Only smashed data can leave the client to the server during the
learning process, thereby preserving the data’s privacy. However, recently
proposed model inversion attacks can effortlessly recover the original data
given this smashed data. To address such privacy issues, a common strategy is
to adopt differential privacy (DP), which involves protecting the smashed data
at the cost of introducing a certain level of accuracy loss. In this paper, we
present the first study that identifies the potential accuracy degradation
when training multiple clients in SL with various privacy requirements, i.e.,
different levels of DP noise. We then propose two approaches reviewing
clients’ DP noise and smashed data at the server to tackle this challenge.
Additionally, we further examine the application of DP to the local model of
SL to gain insights into the trade-off between accuracy and privacy.
Specifically, we meticulously investigate the trade-offs associated with
introducing noise into different local layers, and our findings indicate that
introducing noise in the later layers yields the most favorable trade-off
between accuracy and privacy. Based on our insights into this trade-off, we
propose a method to reduce the size of smashed data to lower communication
overhead, which is one of the notable drawbacks of SL. Our comprehensive
experimental evaluation demonstrates that the proposed approaches provide the
most favorable trade-off for incorporating DP into SL, enhancing training
accuracy for multi-client SL under both IID and non-IID data distributions.
This underscores the feasibility of collaborative learning in practical
environments characterized by intricate privacy requirements.

##  I Introduction

Privacy concerns are prevalent across diverse domains, spanning healthcare,
finance, e-commerce, and more. The concerns often impose limitations on
sharing the raw data essential for training accurate deep neural networks
(DNNs), also referred to as deep models [PrivacySurvey20Fatemehsadat,
SurveyPPFL21Yin]. Highly personal user data, such as medical or financial
records, falls within the category of sensitive information, making the
reluctance to share such data understandable. This situation underscores the
importance of privacy-preserving deep learning (DL) frameworks, which aim to
leverage DL applications’ potential while respecting privacy constraints. For
instance, sensitive data can be employed to develop DL applications providing
insights into areas such as predicting rare diseases or identifying financial
irregularities. However, the challenge lies in achieving these objectives
without direct access to the raw data. Various techniques can be employed,
including anonymization, obfuscation, or data encryption. However, a
persistent concern is the possibility of decrypting the original data from the
trained model through adversarial attacks [SurveyPPFL21Yin]. Therefore, it is
crucial to facilitate collaborative training of distributed machine learning
models without requiring data sharing.

A recent approach known as Split learning (SL) [SplitLearning18Gupta,
SL4Health18Vepakomma] has emerged as a solution to address this challenge,
enabling multiple parties to collaboratively train a model without explicitly
sharing raw input data. In a standard two-party SL setup, the deep model is
partitioned between two entities: the data owner, referred to as the client,
and the computing service, known as the public server in the cloud. Throughout
the training process, during the forward propagation phase, the client feeds
its raw data into its designated model part. It then transmits the processed
data, often termed ‘smashed data’ (which is the output of the final layer,
also called as the split layer, within the client’s section), to the server.
Subsequently, the server continues the forward pass by further processing the
received data through its respective model part. During the back-propagation
phase, the gradients of the split layer are sent back to the client. This
mechanism allows the client to train the collaborative model without exposing
its private training data to the server.

Figure 1: SL with DP noise for privacy-preserving enhancement.

Unfortunately, merely sharing the smashed data does not provide an absolute
guarantee of protecting raw private data. The shared smashed data inherently
contains substantial latent information about the private data and could
potentially serve as a basis for relatively straightforward reversal
techniques, such as visualization [SLon1DCNN20Sharif, BinarizingSL23Pham], or
more intricate reconstructions like model inversion attacks
[AttackingProtecting22He, ModelInversion19He, UnSplit22Erdogan]. Several
efforts [SLon1DCNN20Sharif, BinarizingSL23Pham, AttackingProtecting22He,
NotJustPrivacy18Wang, Shredder20Mireshghallah, PracticalDefences21Titcombe,
CollaborativeInference22Ryu] aim to mitigate this risk through the
implementation of differential privacy (DP), which is currently a standard
practice in privacy-preserving machine learning. For example, in
[CollaborativeInference22Ryu], researchers explore the utilization of DP to
safeguard users’ data privacy during collaborative inference using SL for IoT.
Fig. 1 visually illustrates the integration of DP noise into smashed data to
enhance data privacy preservation in the context of SL. A notable privacy
vulnerability of SL arises from the fact that a neural network operates as a
differentiable smooth function, inherently susceptible to functional
inversion. Partitioning the model between clients and the server does not
alter this characteristic [CombinedFLSL22Duan]. Researchers propose countering
this vulnerability by introducing DP noise to the smashed data, making
individual identification no longer feasible. They assess the effectiveness of
their approach across various image datasets, demonstrating that DP can
effectively safeguard users’ data privacy while incurring an amount of
accuracy reduction.

The application of DP to smashed data for safeguarding user data can be
extended to a multi-data-owner environment where multiple clients
collaboratively conduct model training with a cloud server. In most cases, a
uniform privacy level is considered for all clients. However, recent work in
[InputDiscriminativeDP20Gu] explores the context of local DP, where each data
item is associated with distinct privacy levels, and noisy data is sent to a
public server for processing frequency estimation tasks. The authors
demonstrate that their approach outperforms other related local DP mechanisms,
which require a unique privacy budget for all categorical data. However, both
[InputDiscriminativeDP20Gu] and its successor in [TuningPrivacyBudgets23],
which focuses on tuning privacy budgets to minimize the risk of re-
identification attacks, only evaluate the efficiency of their schemes based on
the total query utility. They do not consider the impact of varying privacy
levels on the utility of queries associated with specific privacy levels.
Inspired by the concept of multi-level privacy, we investigate varying privacy
levels for each client in a multi-client SL setting and identify the accuracy
degradation depending on the distribution of privacy per client. To our
knowledge, this study is the first to investigate SL in multiple clients with
various privacy levels, revealing that accuracy is susceptible to the inherent
forgetting phenomenon of SL, especially as the server sequentially learns with
various noise levels applied to clients’ smashed data. To address this
concern, we propose a training approach that incorporates server-side noise
and data review, aiming to enhance performance.

In much of the existing literature, it is noteworthy that calibrated noise is
primarily added exclusively to the outputs from the split layer of SL, with
little consideration for applying DP to other local layers. In the paper
[AttackingProtecting22He], alongside their comprehensive privacy attack
proposals, the authors explore the application of noise at the original input
to defense, claiming its superior effectiveness compared to noise at the split
layer. However, this claim lacks a deeper investigation or thorough
evaluation. Nevertheless, a central challenge with DP lies in striking the
right balance between preserving model utility and ensuring data privacy.
Increased noise levels can provide stronger privacy guarantees, but inevitably
impact the overall model utility (accuracy). Concerning SL with DP, a
fundamental question arises: Where within the SL framework should DP be
applied to achieve the optimal trade-off between model accuracy and data
privacy? To address this research question, we examine the trade-off between
accuracy and privacy when applying DP to different local layers of SL, to
identify the most effective position for introducing DP noise and achieving an
improved trade-off. Our findings indicate that placing DP noise farther from
the input layer yields a superior balance. Specifically, implementing DP noise
in the shadow layer results in a more significant reduction in model accuracy
but enhances reconstruction quality. Based on these insights, we propose a
method to reduce the size of smashed data, thereby reducing SL communication
costs while maintaining the most favorable accuracy and privacy trade-offs. In
summary, our contributions to this paper include:

  1. 1.

Identifying the influence of varying privacy levels on the accuracy of multi-
client SL and introducing two server-side approaches to address the forgetting
phenomenon, thereby enhancing learning performance. [Khoa: Overall, this study
sounds interesting but personally, I think the (experimental) results are
weak/not so convincing. You might wanna think carefully how to present the
findings in a more convincing way.]

  2. 2.

Analyzing the trade-offs between model accuracy and data privacy by applying
DP at different local layers in SL, with our findings highlighting that
introducing DP noise to the split layer yields the most favorable trade-off.
We also propose a method to enhance the performance of SL with DP.

  3. 3.

Conducting an extensive empirical evaluation using real-world datasets,
including multiple clients subjected to both IID and non-IID data
distributions. Our experiments validate the efficacy of our proposed methods,
effectively mitigating the forgetting effect and substantially improving
learning performance, aligning it closely with the baseline.

The rest of the paper is structured as follows: Section II provides background
information on multi-client SL, model inversion attacks, and DP-based defense.
In Section III, we present the two proposed approaches aimed at addressing the
identified accuracy degradation of multi-client SL considering diverse privacy
requirements. The analysis of the trade-offs between model utility and data
privacy in SL is detailed in Section IV, followed by the proposed approach to
enhance the performance of SL with DP. Section V presents the experimental
results pertaining to the trade-off analysis and the efficacy of the proposed
approaches. Finally, the paper concludes with insights and future research
directions in Section VI.

##  II Preliminaries

This section provides background knowledge about multi-client SL, with the
current model inversion attacks and commonly employed defenses involving DP.

###  II-A Multi-client split learning

The fundamental concept behind SL is to horizontally divide the deep model,
denoted as $h_{\theta}=f_{u}\cdot g_{w}$ where $\theta$, or $u$ and $w$
represent the model’s parameters that need to be optimized during the model
training process. The initial layers, referred to as $f_{u}$, are executed on
client devices, while the remaining layers, designated as $g_{w}$, reside on
the central server. This architectural approach addresses the constraint that
arises due to resource limitations on clients, preventing them from training a
comprehensive model independently. During the training process, the $i$-th
client ($C_{i}$) inputs its data, $x^{t}$, into its local model, carrying out
forward propagation until reaching the split layer. The output, represented as
the smashed data $z^{t}\triangleq f_{u_{i}}(x^{t})$, along with the
corresponding label, $y^{t}$, are then transmitted to the server.
Subsequently, the server continues the forward propagation process and
computes the derivative of the loss function, and then initiating back
propagation until the split layer. The gradients associated with the split
layer are conveyed back to the client to complete the remaining back
propagation steps. Both the server and the client update their respective
model parameters, $u_{i}$ and $w$, using the gradient descent algorithm. At
the end of each iteration, client $C_{i}$ shares the updated model parameters,
$u_{i}$, with the subsequent client, $C_{i+1}$, to repeat the aforementioned
process. This cycle persists until all clients complete one full round of
training. Such a complete global iteration is repeated until the model
converges.

###  II-B Model inversion attacks on SL

The privacy preservation of SL, where user data remain local, faces potential
vulnerabilities from recently proposed model inversion attacks
[ModelInversion19He, AttackingProtecting22He], which aim to reconstruct user
raw data from the exposed smashed data. In a black-box setting, the authors of
[ModelInversion19He] introduce an inverse network as an effective means of
accurately recovering raw data. The procedure involves the adversary
generating a set of samples $X=\\{x_{1},x_{2},\cdots,x_{m}\\}$ of the same
type as the training data. These samples are used to query the target system,
resulting in corresponding smashed data denoted as $Z=\\{f_{u}(x_{i})|x_{i}\in
X\\}$. Subsequently, the inverse network can be directly trained using $Z$ as
the training input and $X$ as the training output, guided by Eq. (1):

$f^{-1}=arg\min_{v}\frac{1}{m}\sum^{m}_{i=1}||g_{v}\bigl{(}f_{u}(x_{i})\bigr{)}-x_{i}||^{2}$
(1)

Here, $g_{v}$ represents the inverse network subject to optimization
[ModelInversion19He]. Once the inverse network is established, the adversary
can recover any raw data from the smashed data, effectively achieving
$x=f^{-1}(z)$. In terms of defense, obfuscating smashed data with DP noise is
one of the general approaches suggested by the authors.

###  II-C SL with differential privacy

Differential privacy (DP) [DifferentialPrivacy06Dwork] is a mathematical
framework designed for privacy-preserving data analysis, defined as follows:

Definition Given any two neighboring inputs $D$ and $D^{\prime}$, which differ
in only one data item, a mechanism $\mathcal{M}$ provides
$(\epsilon,\delta)$-differential privacy if:

$\Pr[\mathcal{M}(D)\in S]\leq e^{\epsilon}\cdot\Pr[\mathcal{M}(D^{\prime})\in
S]+\delta$ (2)

Intuitively, it should be challenging to determine whether a given output is
produced from $D$ or $D^{\prime}$. The parameter $\epsilon$ is often referred
to as the privacy budget, with a lower value indicating stronger privacy
protection. To establish DP, the typical approach involves introducing
calibrated noise to the output of a function $f(\cdot)$, relying on specific
probability distributions [DifferentialPrivacy06Dwork]. In our study, we
utilize the widely used Gaussian distribution, denoted as
$\mathcal{N}(\sigma^{2})$, which represents Gaussian (normal) distribution
centered at 0 with a variance of $\sigma^{2}$, as formulated below:

$\mathcal{F}(x)=f(x)+\mathcal{N}(\sigma^{2}),$ (3) $\text{where
}\sigma^{2}=\frac{2s^{2}\log(1.25/\delta)}{\epsilon^{2}}.$

$\mathcal{F}$ is said to provide $(\epsilon,\delta)$-DP, with $s$ representing
the sensitivity of $f$. Our choice of the Gaussian mechanism is motivated by
its lower sensitivity requirement for vector-based functions and its ability
to accommodate the summation of two distributions, which will be utilized in
our subsequent proposal. Considering $f$ as the local model, the literature
encompasses a substantial body of work [SLon1DCNN20Sharif, BinarizingSL23Pham,
AttackingProtecting22He, NotJustPrivacy18Wang, Shredder20Mireshghallah,
PracticalDefences21Titcombe, CollaborativeInference22Ryu] dedicated to
introducing DP noise to smashed data to mitigate the risk associated with raw
data reconstruction.

##  III Multi-client SL with Diverse Privacy Requirements

Given the widespread data distribution, clients stand to gain from engaging in
collaborative learning. In many practical scenarios, different clients have
different degrees of sensitivity, i.e., varying privacy expectations regarding
the raw data. However, existing literature does not address this scenario for
SL. This section presents the first investigation of multi-client SL with
diverse privacy requirements, including identifying accuracy degradation and
proposed approaches to enhance training performance.

###  III-A Diverse privacy requirements

We initiate our preliminary experiments by configuring a setup involving $5$
clients and $1$ server. The training data is randomly and evenly distributed
among the clients, adhering to the IID (independent and identically
distributed) principle. In this context, each client has the option of either
possessing no privacy requirement (thus necessitating no DP noise) or
specifying a privacy requirement with a budget of $\epsilon=2$ (along with a
small value for $\delta$). These experiments utilize the foundational LeNet-5
model on the straightforward MNIST dataset [LeNet98Lecun]. The learning model
is split after the first pooling layer to distribute the head part to clients
and the rest to the server, respectively. The post-training accuracy results
are summarized in Table III-A, revealing that the incorporation of various
noise levels leads to a decrease in training accuracy for all clients when
contrasted with scenarios where all clients demand the same noise scale,
indicating a consistent privacy level. These latter scenarios serve as our
baseline for comparison. In particular, when all clients require the same
noise level ($\epsilon=2$), the accuracy for all clients remains quite
uniform, with an average value of $73.4\%$. However, when some clients require
no noise, the accuracy drops to $66.3\%$, as observed when only a single
client demands noise. The decline in accuracy becomes evident when examining a
client across various scenarios with different number of clients not requiring
noise. For instance, the highlighted accuracy of $C_{1}$ in Table III-A
illustrates a pattern where the drop in accuracy is directly related to the
number of clients not requiring noise. These findings offer insight into what
could be termed the ‘forgetting phenomenon’ of SL, in which the server’s
learning process on smashed data is sequentially impacted by different
distributions (smashed data with and without additional DP noise). In
situations where more clients require no noise, the server might ‘forget’ the
noise distribution while learning with ‘clean’ smashed data. This ultimately
diminishes accuracy when working with noisy smashed data. These observations
underscore the importance of addressing the forgetting phenomenon to enhance
learning accuracy. In the subsequent section, a novel training methodology is
proposed to tackle this challenge.

TABLE I: Training accuracy of $5$ clients with varying numbers requiring noise
($\epsilon=2$) using SL.

—c—c—c—c—c—c— No. of clients Training accuracy ($\%$)
require noise $C_{1}$ $C_{2}$ $C_{3}$ $C_{4}$ $C_{5}$
$0$ client $99.2$
$1$ client $66.3$ $98.8$
$2$ clients $70.1$ $69.3$ $98.3$
$3$ clients $71.3$ $70.9$ $71.1$ $97.7$
$4$ clients $72.1$ $71.9$ $71.9$ $72.5$ $96.5$
$5$ clients $74.0$ $73.4$ $72.9$ $73.4$ $73.5$
[Khoa: The results in Table I is natural and not surprising. When a client
requires noise, its accuracy decreases. The clients without noise still have
high accuracy. When all clients require noise, accuracy for all clients
decrease. I’m not sure how the forgetting factor comes in the picture here. ]

###  III-B Enhancing learning performance

To mitigate the performance deterioration arising from training with diverse
DP requirements, we propose adapting server-side training, which involves
additional processing of the training smashed data to effectively address the
forgetting phenomenon.

####  III-B1 Reviewing other noise distributions

Building upon the insights derived from the phenomenon of forgetting during
sequential training with various noisy smashed data, we propose a strategy to
address this by reviewing the noise distributions of clients with higher
privacy requirements at the server side. Our approach involves introducing
redundant data with increased noise levels for server-side training. This
augmentation enhances the server’s learning process, allowing it to review a
more challenging noise distribution while learning from less noisy (or noise-
free) smashed data. This helps alleviate the potential catastrophic forgetting
that can arise during sequential training of the server model across clients.
To implement this proposed approach, we modify the execution of SL with
multiple clients, as outlined in Alg. 1, with a particular focus on the
server’s role. The modification involves the server’s preparation of
supplementary data using incoming smashed data from clients (Alg. 1, line
$6$). The specific steps for data preparation are illustrated in Alg. 2.

Algorithm 1 One global epoch of SL.

$Clients$ and $Server$ receive their model parts and initialize corresponding
weights

1:$Server$ sets $Client_{0}$ as the last trained client each $Client_{i}$
among all the $Clients$

2:$Client_{i}$ requests weights from the last trained client

3:and updates its weights $Client_{i}$ has data to train with $Server$

4:$Client_{i}$ performs forward propagation on its data

5:and sends output with labels to $Server$

6:$Server$ prepares data using incoming features

7:$Server$ propagates prepared data through its model and computes gradients
for its output layer

8:$Server$ back-propagates the error to its first layer

9:$Server$ sends split layer’s gradients to $Client_{i}$

10:$Client_{i}$ back-propagates the received gradients

11:$Client_{i}$ and $Server$ update their model weights

12:$Server$ sets $Client_{i}$ as the last trained client

Algorithm 2 Server data preparation.

Input: Incoming features with labels

Output: Prepared data for server training

1:$Server$ duplicates $Client_{i}$’s smashed data and labels

2:$Server$ adds additional noise to the duplicated smashed data and
concatenates it with $Client_{i}$’s smashed data

3:$Server$ concatenates the duplicated labels with $Client_{i}$’s labels

In each iteration of client $C_{i}$’s training, after receiving the smashed
data (features), denoted as $z^{t}\triangleq f_{u_{i}}(x^{t})$, and the
corresponding labels, $y^{t}$, the server initiates by duplicating the data
(see Alg. 2, line $1$). Subsequently, it applies additional noise to the
duplicated smashed data before performing concatenation to form
$([z^{t},z^{t}+\mathcal{N}(\sigma)],[y^{t},y^{t}])$ as depicted in lines
$2$–$3$ of Alg. 2. Denoting the loss function that calculates the difference
between the ground-truth labels and model-predicted outputs as $\mathcal{L}$,
the computation of gradients at the server’s last layer proceeds as follows:

$\nabla\mathcal{L}(output,labels)=\underset{u_{i},w}{\nabla}\mathcal{L}\Big{(}g_{w}\big{(}[z^{t},z^{t}+\mathcal{N}(\sigma)]\big{)},[y^{t},y^{t}]\Big{)}$
(4)

Using SGD, these gradients are back-propagated to update the weights of the
server model part, starting from the last layer and moving towards the first
layer. It is crucial to highlight that the computed gradients for the split
layer have dimensions matching the concatenated data, rather than the size of
the original smashed data, $z^{t}$. Therefore, the server must slice these
gradients to align with the size of $z^{t}$ before transmitting them to the
client (see line $9$ of Alg. 1) to complete the back-propagation. Referring
back to Eq. 4, these gradients are calculated by considering not only errors
stemming from training with $C_{i}$’s smashed data but also errors originating
from the data with augmented noise. This approach enables the server, by
updating $g_{w}$ using these gradients, to simultaneously learn from the
distribution of $C_{i}$’s smashed data and the distribution with additional
noise.

Assuming that all clients utilize the Gaussian mechanism
($\mathcal{N}(\sigma)$) to safeguard their data privacy, and each employing
distinct privacy budgets (requirements), our objective is to improve training
accuracy by empowering the server to review the distribution of the more
challenging added DP noise (characterized by a larger noise scale) during its
training. Since the sum of two normal distributions follows a normal
distribution [SumGuassians], we formulate the scale of the augmented noise
using the following equation:

$\sigma^{2}=\sigma_{j}^{2}-\sigma_{i}^{2},$ (5)

where $\sigma_{i}$ and $\sigma_{j}$ denote the noise scales of the current
client and the client with higher privacy requirements, respectively. We also
make the assumption that the current client applies noise to its split layer
(i.e., max-pool layer in our experiments). However, if noise is applied to the
output of the preceding activation function prior to the max-pool, the
equation remains applicable due to the inherent properties of operations such
as max-pool, which preserve the additive noise.

####  III-B2 Reviewing data from other clients

The previously proposed approach involves the server reviewing noise
distributions from clients with higher noise requirements during training.
However, when training with clients who require higher privacy, the server
might potentially forget the learned knowledge from other clients due to the
absence of additional data. To maintain a balance in this reviewing process,
we introduce the incorporation of reviewing training data from other clients
using the ‘caching smashed data approach’, as proposed in
[NonLocalSharing23Pham]. The integration of noise augmentation and data
caching is depicted in Alg. 3, which serves as a replacement for Alg. 2.

Algorithm 3 Server data preparation – 2.

Input: Incoming features with labels

Output: Prepared data for server training

1:$Server$ caches smashed data and labels into cache pool

2:$Server$ duplicates data with additional noise, then concatenates it into
incoming data

3:$Server$ randomly selects cached data from the pool, then concatenates it
into incoming data

Upon receiving the client $C_{i}$’s smashed data, $z^{t}\triangleq f(x^{t})$,
and the corresponding labels, $y^{t}$, the server stores them in a cache pool
(Alg. 3, line $1$). Following that, the server prepares data using Alg. 2
(Alg. 3, line $2$), which involves concatenating the duplicated smashed data
with augmented noise based on the noise level of the current client and
others. Prior to executing the forward propagation, the server randomly
selects cached data from the cache pools and concatenates it with the prepared
data (Alg. 3, line $3$). The resultant data, $[z^{t},z^{noisy},z^{cache}]$,
along with the corresponding labels, $[y^{t},y^{t},y^{cache}]$, is then
employed to carry out the forward and backward passes at the server, much like
the standard SL procedure. Please remember that, the gradients corresponding
to the split layer need to be sliced to match the size of $z^{t}$ before being
sent back to the client.

In the proposed approaches, we make modifications exclusively to the server’s
training procedure, while ensuring that the costs incurred at the clients
remain unaffected. The additional expenses introduced at the server, such as
storing duplicated and cached data, and performing concatenation, are
considered manageable since the server is assumed to possess sufficient
computational resources to accommodate multiple clients. Regarding privacy,
the proposed approach aligns with privacy concerns as the server processes
noisy smashed data that retains privacy guarantees due to the post-processing
property of DP. As a result, the new training method neither escalates costs
for the clients nor compromises the privacy of local data. However, there is
an increased demand for computational and storage resources at the server,
which is more feasible to address compared to the limitations of less powerful
devices on the client side. Comprehensive evaluation of the proposed
approaches will be presented in the evaluation section.

[Khoa: It seems that the modified algorithm does not provide much benefits or
only in limited scenarios, i.e., see results in Table 1, 4. The reviewers
might argue that too.]

##  IV Utility and Privacy Trade-offs in SL

In SL, DP noise is typically applied to the split layer without further
consideration or analysis, as seen in the previous study and much of the
existing literature. However, drawing inspiration from the work presented in
[AttackingProtecting22He], where the authors investigate the effects of adding
noise at the input layer to mitigate data leakage via reconstruction attacks,
we empirically analyze the application of noise across different SL local
layers in this section. We begin by defining the threat model for our data
leakage analysis, followed by our findings regarding the optimal position for
introducing noise to achieve the most favorable trade-offs between privacy and
accuracy.

###  IV-A Threat model

We consider SL with two parties, where multiple clients collaborate in
learning with a server. The target model is split into two parts:
$h_{\theta}=f_{u}\cdot g_{w}$. The clients, performing $f_{u}$, are implicitly
trusted to never leak their raw data to other parties. However, the server,
performing $g_{w}$, is considered semi-trusted (honest-but-curious
[HonestButCurious14Paverd]), meaning it faithfully adheres to the training
procedure but may have a certain level of curiosity about clients’ private
data. During collaborative learning, given smashed data, the server employs
model inversion attacks [ModelInversion19He, AttackingProtecting22He] to
reveal clients’ raw data. For simplicity and without loss of generality, we
use a two-participant system (a client and a server) to evaluate the leakage
of client’s data.

Unlike the adversarial approach in [AdversarialApproachAnalysis22Gursoy],
which analyzes DP mechanisms on categorical data, these model inversion
attacks provide a means for assessing leakage on general data with high-
quality visual results. Our investigation focuses on the attack within the
black-box setting, known for its heightened effectiveness
[ModelInversion19He]. To facilitate black-box setting attacks, we assume that
the server has the capability to query one of the clients to construct the
inverse network, aligning with the assumption in [ModelInversion19He]. By
maximizing the adversary’s capabilities and effectiveness, we aim to provide a
more realistic reflection of DP’s practical utility in safeguarding user
private data.

In addition to visualizing reconstructed images, various metrics such as MSE,
SSIM, PSNR and KL divergence have been employed in the literature
[SLon1DCNN20Sharif, ModelInversion19He, DroppingActivation18Dong,
NoPeek20Vepakomma] to quantify the effectiveness of the reconstruction. These
metrics typically gauge the disparity between the original images and their
reconstructed counterparts. In our study, we primarily employ SSIM
[SSIM04Wang] as the key metric for assessing the similarity between raw and
reconstructed data, which effectively quantifies data leakage. SSIM, being a
perceptual metric, evaluates the degradation of image quality, offering a more
intuitive and interpretable measure compared to other alternatives
[CollaborativeInference22Ryu].

###  IV-B Trade-offs between accuracy and privacy budget

We conduct preliminary experiments using the LeNet-5 model on the MNIST
dataset. In the context of SL, we explore two potential model splitting points
after each pooling layer, denoted as Split-1 and Split-2, for distribution
between clients and the server. Table II provides an overview of the model
parts allocated to clients and the server, corresponding to the splitting
points after the first and second convolutional groups. A convolutional group
consists of a 2D-convolution layer (Conv), followed by an activation function
and, if applicable, a pooling operation. We use the rectified linear unit
(ReLU) for activation and the max-pool operation (MaxP) for pooling. As a
result, layers such as Conv(1), ReLU(1), and MaxP(1) belong to the first
convolutional group (1st Conv.), while Conv(2), ReLU(2), and MaxP(2)
constitute the second convolutional group (2nd Conv.). These configurations
are tested in a single-client setting, and with these settings, we achieve an
accuracy exceeding $99\%$, which is comparable to the current state-of-the-art
results [MNISTAccuracy].

TABLE II: Distribution of model parts between the client and server. Case | Client model part | Server model part
---|---|---
Split-1 | 1st Conv. – 2nd Conv. | 2nd Conv. – 1st Dense – 2nd Dense
Split-2 | 1st Conv. – 2nd Conv. |  2nd Conv. – 1st Dense – 2nd Dense

We introduce Gaussian noise (Eq. 3) to every local layer and evaluate its
impact on the model’s accuracy. Following [GRNN22Ren], we set the
$L2$-sensitivity $\Delta f$ to $1$ and systematically adjust $\epsilon$.
Subsequently, we plot the accuracy of the affected model against the
corresponding privacy budgets to analyze the inherent trade-offs.

(a) Within the 1st Conv., Split-1

(b) Within the 2nd Conv., Split-2

Figure 2: Trade-offs between accuracy and privacy budgets, with LeNet-5 on
MNIST.

The results align with our expectations, showing a decrease in accuracy with a
reduction in the privacy budget, $\epsilon$. Based on the collected results
visualized in Fig. 2, it becomes evident that applying DP noise to the input
layer results in the most significant accuracy degradation (Fig. 1a, the
dashed line). In contrast, introducing noise to the Conv and ReLU layers
produces comparable results. However, a slight accuracy reduction is observed
when noise is introduced to the pooling layer, which can be attributed to the
data size reduction caused by the MaxP operation (the green lines). Moreover,
applying noise to the deeper layers, specifically the 2nd Conv. (Fig. 1b, the
solid lines), results in improved accuracy compared to the shallower layers,
namely the 1st Conv. (Fig. 1b, the dashed line). This improvement can be
attributed to the reduced amplification of noise within those layers.

###  IV-C Trade-offs between accuracy and data leakage

While noise-based mechanisms theoretically guarantee DP within a specified
budget, the nature of model splitting introduces a potential vulnerability,
allowing raw data leakage from the smashed data. This vulnerability poses a
challenge to the privacy principles inherent in the design of SL. To
quantitatively assess the privacy loss attributed to data leakage, we evaluate
the quality of reconstructed data (using model inversion attacks) by comparing
it to raw data, utilizing the SSIM metric. For illustrative purposes, we plot
accuracy against dissimilarity results, formulated as (1–SSIM), to facilitate
the observation of trade-offs.

Continuing our preliminary experiments, we implement the model inversion
attack on the server, adhering to a black-box setting, as described in the
threat model. We then assess the effectiveness of the attack (in terms of SSIM
values) when DP noise is introduced to different local layers, with the deep
model partitioned as per the configuration specified earlier in Table II.

(a) Within the 1st Conv., Split-1 (b) Within the 2nd Conv., Split-2

Figure 3: Trade-offs between accuracy and data leakage, with LeNet-5 on MNIST.

Similar to evaluating the trade-offs between accuracy and the privacy budget,
we observe analogous trade-offs when introducing noise to different layers
within the same convolutional group. Notably, introducing noise to the input
layer significantly degrades accuracy, accompanied by a substantial reduction
in reconstruction quality. This pattern results in trade-offs similar to those
witnessed in other layers within the 1st Conv.

As depicted in Fig. 3, the most favorable trade-offs are achieved by adding
noise to the layers within the 2nd Conv. While adding noise to the 2nd Conv.
helps improve accuracy slightly (see Fig. 1b), it significantly impacts the
reconstruction results, leading to superior privacy compared to noise in the
1st Conv. Particularly, with a similar amount of sacrificed accuracy, adding
noise to the 2nd Conv. results in double the privacy compared to the 1st Conv.
This observation aligns with the findings from [SLon1DCNN20Sharif], where the
authors claim that adding more hidden layers on the client side helps further
reduce data leakage from visualizing smashed data. Even though leakage from
visualizing smashed data is not as significant as leakage from model inversion
attacks [BinarizingSL23Pham], adding more hidden layers (convolutional groups)
also helps further reduce leakage from model inversion attacks, hence further
preserving privacy. However, these results lead to another trade-off related
to computational costs on the client side because more layers significantly
increase the local overhead of the clients, which are typically low-end
devices with limited resource capabilities.

Another observation is that within a convolutional group, introducing noise to
Conv, ReLU, or MaxP layers results in similar trade-offs, with the most
favorable trade-off occurring at the pooling layer. In Fig. 2b, we also plot
the trade-off when noise is applied to the MaxP(1) layer, and we attempt to
reconstruct the raw data from the smashed data obtained in Split-1 and
Split-2. Surprisingly, even though noise propagates through the 2nd Conv. in
Split-2, the trade-off is similar to that in Split-1, which confirms the
insight into achieving a better trade-off when noise is introduced in the
latter layers. Therefore, this finding provides an explanation for the
practice of introducing noise to the split layer in most of the literature’s
work.

In summary, based on our assessment through these preliminary experiments, it
becomes evident that applying noise to deeper layers (preferably closer to the
split layer) yields more favorable trade-offs between accuracy and privacy.
Typically, in SL, the sub-sampling or pooling layer is chosen as the split
layer to reduce client-server communication overhead. Taking the privacy
budget into account, the application of DP noise to the layer immediately
preceding the pooling (split layer) yields the most optimal trade-off. When
considering data leakage, applying DP noise to the split layer yields the best
balance between accuracy and privacy trade-offs. Regarding introducing noise
to the input layer, which leads to high privacy preservation but also
significantly impacts accuracy, we will discuss and propose an approach to
improve accuracy while aiming for a more balanced trade-off.

###  IV-D Enhancing performance of SL-DP

Comparing to federated learning (FL) [FederatedLearning17Jakub], another
popular distributed learning approach, SL stands out as particularly suitable
for low-end devices. This advantange arises from the fact that most of the
computational model parts are offloaded to a powerful server, while the
clients handle a smaller head part of a deep model. This efficient
distribution allows clients to save on computing power. However, it also comes
with higher communication costs as clients need to transmit the smashed data
and receive corresponding gradients to and from the server. To illustrate,
consider the LeNet-5 model with Split-1, where the head model part is deployed
at the client. Training on the MNIST dataset would necessitate three times the
bandwidth of the dataset size for each global epoch. These evaluated
communication costs pose a significant challenge for low-end devices like
mobiles or IoT devices.

In terms of privacy preservation, introducing noise to the input layer before
sending it directly to the server offers noticeable advantages, including
reduced data leakage (as demonstrated earlier) and lower communication costs
due to the smaller data size compared to the smashed data. However, this
approach comes at the cost of a significant impact on model accuracy, which
remains a major concern. Conversely, applying noise to deeper layers, such as
the 1st Conv. or the 2nd Conv., results in higher model accuracy and more
favorable trade-offs. Nevertheless, the smashed data generated from these
subsequent layers increase communication costs for both the training and
inference phases. Inspired by these observations, we propose an approach to
reduce the size of the smashed data while maintaining the high accuracy
achieved by adding noise to the hidden layers. Simultaneously, we aim to lower
the communication costs of SL.

Consider a deep model, $h=\mathcal{F}\cdot g$, divided into two parts,
$\mathcal{F}$ and $g$, distributed to the clients and server, respectively.
Here, $\mathcal{F}$ is the differentially private version of $f$, denoted as
$\mathcal{F}=f+\mathcal{N}(\sigma)$. We propose appending a small component
with a few layers, denoted as $f^{\prime}$, which converts the smashed data to
the size of the input. The new deep model is then formulated as:

$h=(\mathcal{F}\cdot f^{\prime})\cdot(f\cdot g),$

where $\mathcal{F}\cdot f^{\prime}$ is distributed to the clients, while
$f\cdot g$ remains on the server. In this proposed deep model design, we
increase the computational cost at the client due to the processing of
$f^{\prime}$, while the server incurs additional costs for executing $f$.
Fortunately, these increased costs at the server are manageable due to its
resource assumptions, and the additional costs at the client can be considered
a trade-off for bandwidth savings. Moreover, smaller data sizes contribute to
increased privacy preservation. Considering the selected LeNet-5 model, which
is based on a convolutional neural network (CNN), we design $f^{\prime}$ as a
transposed convolutional (de-convolutional) layer [Deconvolutional11Zeiler]
for up-sampling the smashed data to match the original input data size. Given
the widespread use of CNN-based deep models across various domains and data
types [SurveyCNN20Khan], this design is widely applicable. We will conduct a
performance evaluation and analyze the accuracy-privacy trade-offs of our
proposed approach in the following section.

##  V Experimental Evaluation

In this section, we conduct comprehensive experiments using a deeper model and
a more challenging dataset to thoroughly assess the trade-offs between
accuracy and privacy and evaluate the proposed methods.

We select CIFAR-10 [CIFAR09Krizhevsky], an established computer vision dataset
that is a subset of the $80$ million tiny images dataset. CIFAR-10 comprises
$60k$ $32\times 32$ color images distributed across $10$ distinct object
classes, with $6k$ images per class. For our experiments, we utilize a VGG-11
[VGG15Simonyan] based deep model. We split the model after the first pooling
layer, with the client handling the head part and the server managing the
remaining layers. The architectural details of the deep model, including layer
structure and splitting point, are presented in Table III.

TABLE III: Architecture of the selected VGG-11-based deep model. Client part |  Input – C3-32 – C3-32 – MaxP $<$–Split–$>$
---|---
Server part |  C3-64 – C3-64 – MaxP – C3-128 – C3–128 – MaxP – C3-256 – C3-256 – MaxP – D128 – D10 – Output

In Table III, the notation C3-32 denotes a convolution layer with $32$ filters
of size $3$, followed by a ReLU activation function. Similarly, D128
represents a fully connected (dense) layer with $128$ output units. Following
the naming convention used in our preliminary experiments, we label the layers
in the client’s model part as follows in our plots: Input, Conv(1), ReLU(1)
(1st Conv.), Conv(2), ReLU(2), and MaxP (2nd Conv.). Throughout our
experiments, we conduct model training for $100$ epochs, and employing the
Adam optimizer [Adam17Kingma] with default parameters and a batch size of
$64$. The learning rate is adjusted using a cosine annealing scheduler
[CosineAnnealingLR], with the maximum number of iterations set equal to the
number of epochs. After training, we evaluate the model (by combining the
client’s part with the server’s model part) on the test set and present the
results accordingly.

###  V-A Training with various noise levels

Continuing from the scenario outlined in the preliminary experiments presented
earlier, involving $5$ clients with either no noise or $\epsilon=2$ noise
requirements, we proceed to implement the proposed approaches aimed at
modifying the server’s training procedure to enhance the accuracy of all
clients. The results, as depicted in Table IV, clearly demonstrate the
efficacy of our proposed strategy. Specifically, in scenarios where only one
client requires noise, the accuracy witnesses an improvement from $66.3\%$ to
$72.8\%$, while the accuracy of clients that require no noise remains at
$98.5\%$. Similarly, in other settings, the accuracy of clients requiring
noise ranges between $73-74\%$, closely aligning with the accuracy observed in
the scenario where all clients demand the same level of noise. Next, we delve
deeper into the evaluation of the proposed approaches, focusing on their
effectiveness across a wider range of noise levels, encompassing both IID and
non-IID data distribution scenarios.

TABLE IV: Training accuracy ($\%$) of $5$ clients with varying numbers requiring noise ($\epsilon=2$) using SL-A. DP ratio | $C_{1}$ | $C_{2}$ | $C_{3}$ | $C_{4}$ | $C_{5}$
---|---|---|---|---|---
$1$ client | $72.8$ | $98.5$
$2$ clients | $73.3$ | $73.5$ | $98.0$
$3$ clients | $72.5$ | $73.3$ | $73.8$ | $97.6$
$4$ clients | $74.8$ | $73.5$ | $73.9$ | $74.1$ | $96.9$

####  V-A1 Training with IID data

In this scenario, the $5$ clients continue to receive a similar amount of data
from all classes, and they introduce distinct levels of DP noise to the
smashed data before transmitting it to the server for training. The two
proposed approaches are labeled as Adding noise (A) and Caching data (C), in
accordance with the proposed strategies of reviewing noise distribution and
reviewing other clients’ data, respectively.

TABLE V: Training accuracy ($\%$) of 5 clients with different required noise
levels on IID data. LeNet-5 on MNIST dataset
---
Scheme | $\epsilon=2$ | $\epsilon=3$ | $\epsilon=4$ | $\epsilon=5$ | $\epsilon=7$
Baseline | 74.4 | 88.3 | 94.0 | 96.5 | 98.1
SL | 69.2 | 87.3 | 93.1 | 95.8 | 97.3
SL-A | 73.0 | 88.2 | 93.3 | 95.7 | 97.0
SL-AC | 72.4 | 87.7 | 93.3 | 95.5 | 97.2
VGG-11 on CIFAR10 dataset
Scheme | $\epsilon=2$ | $\epsilon=3$ | $\epsilon=5$ | $\epsilon=10$ | $\epsilon=20$
Baseline | 80.3 | 83.8 | 86.4 | 87.6 | 87.4
SL | 76.2 | 83.6 | 85.7 | 86.4 | 86.5
SL-A | 80.1 | 83.6 | 85.7 | 86.5 | 86.5
SL-AC | 79.6 | 83.2 | 84.7 | 85.7 | 86.8

We vary the privacy budgets for the $5$ clients, using $\\{2,3,4,5,7\\}$ for
the MNIST dataset and $\\{2,3,5,10,20\\}$ for the CIFAR10 dataset. We evaluate
each client’s performance using pure SL (without our proposed approaches), and
with our proposed approaches of adding noise and caching data. The
experimental results are shown in Table V. Additionally, we establish a
baseline by considering the results when all clients possess the same privacy
budget, e.g., when all clients have $\epsilon=2$, the averaged accuracy serves
as a reference point for comparison. [Khoa: I do not think this is a good
baseline. The baseline can just be SL without modification.] Analyzing the
MNIST results, it’s evident that after training with pure SL, the accuracy of
all clients, with varying noise levels, decreases compared to the baseline.
This decline is attributed to the server being trained on diverse data
distributions, resulting in a larger and more complex dataset for the server
model to learn. Furthermore, the phenomenon of forgetting emerges during
sequential learning on data with different added noise distributions. The
accuracy of clients that require more noise is most impacted due to their
higher noise levels and the associated forgetting. Upon applying our first
proposed method, which involves adding more noise to duplicated smashed data
(SL-A), the accuracy of these clients significantly improves, approaching the
baseline. However, the accuracy of clients requiring less noise is slightly
affected, experiencing a drop of within $1\%$ accuracy. When our second
approach, caching other clients’ data (SL-AC), is employed, it slightly
improves the learning performance of clients requiring less noise. But, this
approach also results in a slight decrease in the accuracy of other clients
with higher noise requirements. This trade-off is expected, as SL-A prompts
the server to review the noise distribution of clients with higher noise
requirements, potentially affecting the less noisy data and causing some loss
of information. Conversely, in SL-AC, the server reviews the less noisy data
more extensively from the cache, boosting the accuracy of clients with lower
noise requirements, but at the cost of impacting clients with higher noise
requirements. Similar results are observed in the experiments using the
CIFAR10 dataset. The proposed approaches certainly enhance the accuracy of
clients requiring more noise, and the performance of SL-A and SL-AC is quite
similar on IID data. In the following section, we proceed to implement a non-
IID data distribution to comprehensively evaluate the proposed approaches.
[Khoa: From the results, I’m not sure whether SL-AC is worth considering. It
is more complex than SL-A but not always provide benefits. When it does, the
benefit is very small too.]

####  V-A2 Training with non-IID data

Given that the training data is sourced from individual clients and is based
on local environments and client usage patterns, it is realistic to assume
that the data is non-IID distributed. Going further, we continue to evaluate
the proposed approaches in a non-IID setting, which simulates the worst-case
scenario of statistical heterogeneity in local data. Following the non-IID
setting outlined in [EvaluationDML22Gao], we distribute data from only a
subset of classes to each client. Specifically, for the experiments using the
MNIST dataset, we distribute only $2$ out of the $10$ classes to each client.
Similarly, for the CIFAR10 dataset, we distribute only $6$ out of the $10$
classes to each client.

TABLE VI: Training accuracy ($\%$) of 5 clients with different required noise
levels on non-IID data. MNIST dataset with $2$ classes per client
---
Scheme | $\epsilon=2$ | $\epsilon=3$ | $\epsilon=4$ | $\epsilon=5$ | $\epsilon=7$
SL | 28.1 | 42.7 | 49.7 | 53.4 | 49.4
SL-A | 33.4 | 39.1 | 40.8 | 40.9 | 38.4
SL-AC | 42.2 | 58.5 | 61.8 | 64.1 | 61.9
CIFAR10 dataset with $6$ classes per client
Scheme | $\epsilon=2$ | $\epsilon=3$ | $\epsilon=5$ | $\epsilon=10$ | $\epsilon=20$
SL | 63.4 | 74.0 | 78.3 | 79.1 | 79.4
SL-A | 68.8 | 73.3 | 75.2 | 76.3 | 76.5
SL-AC | 72.9 | 77.9 | 80.7 | 81.4 | 80.1

The extreme skewness of this data distribution is evident in the MNIST
experiment, where applying noise results in a substantial reduction in
learning performance (without noise, achieving $94\%$ accuracy after
training). Table VI clearly demonstrates that under this non-IID setting,
accuracy is notably affected. The client with the lowest noise requirement
achieves only $50\%$ accuracy, while the client requiring the most noise
achieves a mere $28\%$ accuracy. When applying noise augmentation, the
accuracy of the high-noise client improves, but it impacts the clients with
lower noise requirements. However, noise augmentation combined with caching
significantly enhances the learning performance of all clients, as evidenced
in the table. The concept of caching improving learning performance in SL on
non-IID data is demonstrated in [NonLocalSharing23Pham]. This paper proposes a
combination of noise reviewing and caching to enhance the learning performance
of SL in non-IID settings, encompassing various clients with differing privacy
requirements. With the CIFAR10 dataset, where $60\%$ of the classes are
distributed to each client, we achieve similar results, with accuracy reaching
up to $80\%$ for the client with the lowest noise requirements. SL-AC has a
significant impact in the context of non-IID data distribution.

###  V-B Trade-offs between accuracy and privacy

We investigate the impact of applying DP noise to different local layers on
model accuracy and data reconstruction results.

Fig. 4 plots the trade-offs between accuracy and privacy budgets, illustrating
alignment with the findings from our previous preliminary experiments. When
noise is added to the input layer, it has the most substantial impact on
accuracy. Conversely, applying noise to the Conv or the subsequent activation
layer, ReLU, yields comparable accuracy impacts. Notably, noise introduced in
latter layers (e.g., Conv(2), ReLU(2)) results in less accuracy reduction,
offering a more favorable trade-off. While adding DP noise to the split layer
(MaxP) causes a minor decrease in accuracy compared to Conv(2) or ReLU(2), we
still recommend applying DP noise to the layer immediately preceding the split
layer for achieving the best trade-off between accuracy and the privacy
budget.

(a) Within the 1st Conv. (b) Within the 2nd Conv.

Figure 4: Trade-offs between accuracy and privacy budgets, with VGG-11 on
CIFAR10.

Fig. 5 illustrates the trade-offs between accuracy and privacy concerning data
leakage. The findings from Fig. 4b are quite apparent: applying noise to
latter layers leads to a more favorable trade-off, exhibiting worse
reconstruction results while sacrificing similar levels of accuracy. Within a
convolutional group, similar trade-off are observed when noise is added to the
Conv or the subsequent ReLU layer. Notably, applying noise to the MaxP layer
yields the most optimal trade-off due to sub-sampling data. Consequently,
adhering to the conventional practice of applying noise to the split layer at
the client side, as seen in the literature, indeed yields the best compromise
between accuracy and data privacy.

The results with the CIFAR10 dataset align with the preliminary experiments,
confirming our findings about the accuracy-privacy trade-off when introducing
DP to SL. Based on these findings, privacy practitioners can select
appropriate strategies to achieve the most favorable outcomes.

(a) Within the 1st Conv. (b) Within the 2nd Conv.

Figure 5: Trade-offs between accuracy and data leakage, with VGG-11 on
CIFAR10.

###  V-C Enhancing performance of SL-DP

We initially evaluate the performance of our proposed approach to enhance SL-
DP by continuing the preliminary experiments using LeNet-5 and the MNIST
dataset. We append a transposed convolutional layer (ConvTranspose) for up-
sampling the smashed data and deploy the full LeNet-5 model at the server, as
presented in Table VII.

TABLE VII: Distribution of model parts between the client and server. Case | Client model part | Server model part
---|---|---
Cut-1 | 1st Conv. – ConvTranspose | LeNet-5 model
Cut-2 | 1st Conv. – 2nd Conv. – ConvTranspose | LeNet-5 model

(a) Accuracy vs privacy budget

(b) Accuracy vs data leakage

Figure 6: Accuracy and privacy trade-offs of our approach on the MNIST
dataset.

(a) Accuracy vs privacy budget

(b) Accuracy vs data leakage

Figure 7: Accuracy and privacy trade-offs of our approach on the CIFAR10
dataset.

Fig. 5a presents the trade-off between accuracy and the privacy budget,
illustrating that our proposal maintains the similar accuracy trend as when
introducing noise to the MaxP layers in both Split-1 and Split-2. Using our
proposed approach, the smashed data has the same size as the input data,
significantly reducing transmission costs and data exposure. Fig. 5b
illustrates the trade-offs between accuracy and data leakage, showing that our
approach is more favorable than introducing noise to the MaxP layer, which
achieved the most favorable trade-offs in our preliminary experiments.

Further evaluation on the CIFAR10 dataset with a deeper model yields similar
results, as shown in Fig. 7, where our approach maintains the accuracy of
noise introduced at the split layer while achieving low leakage similar to
noise introduced at the input layer. The result demonstrates that our approach
provides the most favorable trade-offs compared to introducing noise to any SL
local layers, with only a marginal additional computation overhead. Regarding
the additional local computation cost, it is minimal since the appended layer
is very thin, and we can offset the communication costs as a return. The
amount of communication costs saved (bandwidth, energy, and time) depends on
the dataset size and the number of training rounds (epochs). In our
experiments, considering that an image from CIFAR10 has the size of $3\times
32\times 32$ (channels $\times$ width $\times$ height), the smashed data size
(without our approach) is $32\times 16\times 32$, and the dataset’s size is
$50k$, with training conducted for $100$ epochs. Utilizing our proposed
approach could save approximately $5.3\times$ communication costs during the
training procedure, which is a significant advantage for low-end devices.

##  VI Conclusion

This paper investigates the delicate balance between accuracy and privacy when
leveraging DP to protect data privacy in collaborative SL under a semi-trusted
environment. The study primarily explores the trade-offs between accuracy and
privacy by introducing DP noise to various local layers with varying privacy
budgets. Additionally, privacy is quantified in terms of data leakage, using
contemporary model inversion attacks as a benchmark. The evaluation process
presented in this study reaffirms the widely adopted practice of applying DP
noise to the split layer, consistent with prevailing literature. Expanding the
scope to encompass a multi-client environment, each with distinct privacy
requirements, reveals potential accuracy reduction among clients following
training. To tackle this challenge, the study proposes two specific approaches
to bolster learning performance. Through a comprehensive array of experiments
utilizing real-world datasets, the results presented demonstrate a significant
improvement in accuracy for all clients, effectively aligning their
performance with a baseline reference. Notably, this enhancement is
particularly substantial in scenarios involving non-IID data distribution.
Examining the accuracy-privacy trade-off and introducing strategies to enhance
client accuracy provide valuable insights for effectively preserving data
privacy in the context of distributed learning across heterogeneous devices,
such as mobiles and IoT. Future research directions include exploring the
optimal augmented data size to optimize server computations and further
advancing the field of privacy-preserving distributed learning.