# Binarizing Split Learning for Data Privacy Enhancement and Computation
Reduction

Ngoc Duy Pham, Alsharif Abuadbba, Yansong Gao, Tran Khoa Phan, Naveen
Chilamkurti Pham, Phan, and Chilamkurti are with School of Computing,
Engineering, and Mathematical Sciences (SCEMS), La Trobe University, Victoria,
Australia. Email<EMAIL_ADDRESS>is with CSIRO’s Data61 & Cybersecurity CRC, Australia. Email:
<EMAIL_ADDRESS>is with Nanjing University of Science and
Technology, China. Email<EMAIL_ADDRESS>
###### Abstract

Split learning (SL) enables data privacy preservation by allowing clients to
collaboratively train a deep learning model with the server without sharing
raw data. However, SL still has limitations such as potential data privacy
leakage and high computation at clients. In this study, we propose to binarize
the SL local layers for faster computation (up to $17.5$ times less forward-
propagation time in both training and inference phases on mobile devices) and
reduced memory usage (up to $32$ times less memory and bandwidth
requirements). More importantly, the binarized SL (B-SL) model can reduce
privacy leakage from SL smashed data with merely a small degradation in model
accuracy. To further enhance the privacy preservation, we also propose two
novel approaches: 1) training with additional local leak loss and 2) applying
differential privacy, which could be integrated separately or concurrently
into the B-SL model. Experimental results with different datasets have
affirmed the advantages of the B-SL models compared with several benchmark
models. The effectiveness of B-SL models against feature-space hijacking
attack (FSHA) is also illustrated. Our results have demonstrated B-SL models
are promising for lightweight IoT/mobile applications with high privacy-
preservation requirements such as mobile healthcare applications.

###### Index Terms:

Split learning, Binarization, Privacy preservation, Leakage loss, Differential
privacy.

##  I Introduction

Deep learning (DL) has achieved remarkable performance in many domains such as
computer vision, natural language processing, intrusion detection, and anomaly
detection [1, 2]. The success of DL stems from the amount of high-quality
large-scale datasets, the advancement of high-performance computing, and the
maturity of open-source DL frameworks [3]. For effective standard DL, data
from source(s) need to be collected and trained centrally, for example, using
cloud infrastructure. However, such DL approach poses data security and/or
privacy concerns that violate certain rules such as the general data
protection regulation (GDPR) and the health insurance portability and
accountability act (HIPAA) [4]. Data privacy is especially crucial as sensing
devices such as smartphones, wearable devices, or even laptops have been
becoming personalized with sensitive information. Thus, investigating privacy-
preserving DL techniques has been an active research area [5, 6, 7].

For privacy preservation in DL, various approaches have been developed such as
differential privacy (DP) mechanisms, homomorphic encryption (HE), secure
multi-party computation (SMC), model splitting, partial parameters sharing,
mimic learning [8] with their own advantages and shortcomings. For instance,
encryption-based techniques, such as HE and SMC [7], allow computation over
encrypted data which suffers from substantially increased computation overhead
and latency, rendering likely unacceptable energy consumption [9]. In
addition, these techniques have some limitations in terms of the functions
they can support [7]. While DP techniques can provide a provable privacy
guarantee for individuals [6], it requires a balance between privacy and
accuracy when applying DP to DL despite research efforts to alleviate the
impact of noise perturbation on the accuracy of the inference phase [10]. To
avoid the undesired centralized data collection, federated learning (FL)
allows local data processing without the need to transfer data to the server.
In FL, local models are trained on local data before their parameters are
exchanged to aggregate a global model. However, training a whole DL model
locally can create a large overhead for low-end resource-constrained devices.
Besides, it has been shown that there are potential information leaks by
observing parameter gradients of FL to conduct various privacy inference
attacks (i.e. membership inference attack, data inversion attack, and
preference profiling attack) [11, 12, 13].

Keeping distributed setting but relaxing full local training, split learning
(SL) splits and allocates layers to both the client and the central server.
The local client performs the first few layers and the computation of rest
majority layers are offloaded to the more powerful server. This is
particularly attractive for IoT as the latest generation DL models consist of
million up to hundred million parameters that require enormous computing
ability to train and process [10]. Compared with FL, in SL, partial model
weights stay private, hence white-box model inversion attacks on clients are
not possible. Messaging and network overhead of SL are significantly less than
FL especially for large model since model parameters never leave the client.
Nevertheless, the computation overhead from industry-standard models or
communication during learning between clients and server in SL is still
expensive for resource-limited clients [14]. Second, it has been shown that SL
suffers from high data leakage in the case of time-series data [15]. There
have been progresses to address these limitations of SL.

Figure 1: Visual invertibility of a typical CNN under SL setting. The feature
maps show images visually plotted from a channel in the first convolution and
subsampling layers.

Recently, Abuadbba et al. [15] have studied the application of SL to perform
privacy-preserving training for ECG health data. The authors have demonstrated
that pure SL on 1D-CNN may fail to protect raw data privacy. Fig. 1 exhibits
the potential leakage of raw data at the split layer under a typical CNN
model. With a similar slitting manner, Dong et al. [16, 17] have proposed to
split the deep network into two parts and localize only the first hidden
layer. The authors then apply the Dropping activation outputs method to the
local layer’s activations to make them non-invertible to prevent leakage.
However, when applying their method to the first convolution layer of a CNN,
leakage could happen when visually plotting feature maps as we experimentally
demonstrated in Fig. 2. Likewise, Yu et al. [18] also partition the model
after the first layer and apply the proposed Stepwise activation function
method to make activation outputs irreversible. The effectiveness of their
proposal is proportional to the Stepwise parameters and it also exhibits a
trade-off between accuracy and privacy preservation. Studying another
approach, in NoPeek [19, 20], Vepakomma et al. have shown that by reducing the
distance correlation between the intermediary representations and raw data,
information leakage from reconstruction attacks could be prevented. The
authors focus on distance correlation metric and white-box reconstruction
attacks without considering direct leakage from visual invertibility. In
additions, NoPeek is ineffective against the feature-space hijacking attack
(FSHA) [21] which is a state-of-the-art black-box attack aiming to reconstruct
local private raw data.

Figure 2: Visual invertibility of [16] and [18] approaches from our
experiments. The top row, from left to right, shows the visually plotted
images from activations of a convolution layer using Dropping activation
outputs with $p$ set to $0$, $5$, and $9$ [16]. The bottom row shows the
reconstruction results using Stepwise activation function with $v=10$, $n$ set
to $2$, $11$ and $21$ [18].

Our contributions. Taking into account the privacy preservation and
computation issues in SL, our study focuses on the development of novel SL
models to reduce data leaks with low computation overhead by leveraging
Binarized Neural Network (BNN) [22, 23]. BNN is hardware-friendly in terms of
computation costs and memory usage with binary weights and activations.
Binarization, an extreme quantization, causes loss of information which
consequently is a potential technique to ensure privacy [24]. In summary, the
main contributions to this paper are:

  * •

We propose B-SL to binarize only the local part of SL to make the model light
on the clients, but can still achieve accuracy comparable to those of the full
precision models. We rigorously analyze the computation overhead and privacy
preservation capability of the proposed approach.

  * •

We propose a leakage-restriction training strategy to further reduce data
leaks. This method combines leak loss of local private data and main accuracy
loss that enhance privacy while maintaining model utility.

  * •

We propose three approaches to integrate DP into B-SL and prove that
binarization naturally satisfies $(\epsilon,\delta)$-DP [25] with a bounded
$\epsilon$ corresponding to a given $\delta$.

  * •

We present a comprehensive empirical evaluation of the proposed B-SL models on
standard image classification tasks and compare the achieved results with
those of four other baselines. We also experimentally demonstrate the
effectiveness of B-SL against FHSA. Our code is open-sourced to
GitHub111https://github.com/phamngocduy/BinarizeLocalizedLayers.

The remainder of this paper is organized as follows: Section II provides
background information about SL and BNN. The design, implementation, and
analysis of B-SL are detailed in Section III. Two proposed techniques to
further enhance privacy preservation for B-SL are described in Section IV.
Section V describes the experimental results in terms of accuracy and privacy
of the proposed B-SL and other benchmark models followed by the conclusion in
Section VI.

##  II Background

This section provides the background information for SL and BNN, which is the
stepping stone for our proposed B-SL.

###  II-A Split Learning

Split learning splits a DL model into multiple parts which are trained on
different entities [26]. The training of the network is carried forward by
transferring the activations of the last layer of each part (also known as the
split layer) to the next part. Thus, no raw data is shared among entities
except split layer’s activations. SL is considered and validated for multi-
dimensional (e.g. 1D, 2D) models with various architectures such as LeNet,
VGG, AlexNet [15, 26]. Fig. 3 depicts a simplified vanilla configuration of SL
between a client (e.g., a smart camera continuously collects environmental
information) and a server.

$s\leftarrow$ client socket initialized

$s.connectAndSyncParams(Server)$

for  _each batch $(x,y)$_ do

Forward propagation:

$a^{(0)}\leftarrow x$

for  _$i\leftarrow 1$ to $l$_ do

$z^{(i)}\leftarrow f^{(i)}(a^{(i-1)},w^{(i)})$

$a^{(i)}\leftarrow g^{(i)}(z^{(i)})$

end for

$s.send\left((a^{(l)},y)\right)$

Backward propagation:

$\frac{\partial E}{\partial a^{(l)}}\leftarrow s.receive()$

for  _$i\leftarrow l$ downto $1$_ do

$\frac{\partial E}{\partial z^{(i)}}\leftarrow\frac{\partial E}{\partial
a^{(i)}}\times g^{(i)}{{}^{\prime}}\left(z^{(i)}\right)$

$\frac{\partial E}{\partial w^{(i)}}\leftarrow\frac{\partial E}{\partial
z^{(i)}}\times\frac{\partial z^{(i)}}{\partial w^{(i)}}$

if  _$i\neq 1$_ then

$\frac{\partial E}{\partial a^{(i-1)}}\leftarrow\frac{\partial E}{\partial
z^{(i)}}\times\frac{\partial z^{(i)}}{\partial a^{(i-1)}}$

Update $w^{(i)}$ using $\frac{\partial E}{\partial w^{(i)}}$

end for

end for

$s.close()$

Algorithm 1 SL process on the client.

Consider a deep model that has $L$ layers excluding the input layer and assume
that we split the model after layer $(l)$. The first $l$ layers from $(1)$ to
$(l)$ are deployed in the client and the remaining layers from $(l+1)$ to
$(L)$ are in the server. Denote $w^{(i)}$, $f^{(i)}$, $z^{(i)}$, and $a^{(i)}$
as weights, forward function, output tensors, and activation output at layer
$(i)$, respectively. The procedures for processing learning on each side are
presented in Algorithms 1 and 2. The SL process starts on the client following
Alg. 1.

  1. 1.

Client. Firstly, the client connects to the server for synchronizing training
hyper-parameters (e.g. batch size, learning rate, …). For each batch, the
client processes forward propagation up to layer $(l)$ and then sends
$a^{(l)}$ to the server. Later, on receiving $\frac{\partial E}{\partial
a^{(l)}}$ (where $E$ is the model’s loss) from the server, the gradients are
back-propagated from $(l)$ to the first hidden layer.

  2. 2.

Server. As indicated in Alg. 2, the server conducts a traditional learning
process by continuing the forward propagation after receiving activations
$a^{(l)}$ from the client. Subsequently, the server calculates the loss $E$
between the model outputs and labels passed by the client. Then, gradients
calculated from loss $E$ are back-propagated from the last layer $(L)$ until
$(l+1)$ followed by sending $\frac{\partial E}{\partial a^{(l)}}$ to the
client for continuing the back-propagation locally.

$s\leftarrow$ server socket initialized

$s_{C}\leftarrow s.acceptAndSyncParams(Client)$

for  _$i\leftarrow 1$ to $N$_ do

Forward propagation:

$(a^{(l)},y)\leftarrow s_{C}.receive()$

for  _$i\leftarrow l+1$ to $L$_ do

$z^{(i)}\leftarrow f^{(i)}(a^{(i-1)},w^{(i)})$

$a^{(i)}\leftarrow g^{(i)}(z^{(i)})$

end for

$E\leftarrow\mathcal{L}(a^{(L)},y)$

Backward propagation:

Compute $\frac{\partial E}{\partial a^{(L)}}$

for  _$i\leftarrow L$ downto $l+1$_ do

$\frac{\partial E}{\partial z^{(i)}}\leftarrow\frac{\partial E}{\partial
a^{(i)}}\times g^{(i)}{{}^{\prime}}(z^{(i)})$

$\frac{\partial E}{\partial w^{(i)}}\leftarrow\frac{\partial E}{\partial
z^{(i)}}\times\frac{\partial z^{(i)}}{\partial w^{(i)}}$

$\frac{\partial E}{\partial a^{(i-1)}}\leftarrow\frac{\partial E}{\partial
z^{(i)}}\times\frac{\partial z^{(i)}}{\partial a^{(i-1)}}$

Update $w^{(i)}$ using $\frac{\partial E}{\partial w^{(i)}}$

end for

$s_{C}.send\left(\frac{\partial E}{\partial a^{(l)}}\right)$

end for

$s_{C}.close()$

Algorithm 2 SL process on the server. Figure 3: SL network architecture with
two parties.

The split layer’s activations, which are transmitted from client to server
during forwarding propagation, are also called smashed data [27]. As the
output of a function (smasher) on raw data, this smashed data results in
potential leakage that could be reduced by the proposed binarization of SL in
the next section.

###  II-B Binarized Neural Network

BNNs [28, 22, 23] are neural networks where weights and activations are
constrained to either $-1$ or $+1$ for mathematical convenience. We can
implement BNN using $\\{0,1\\}$ encoding with XNOR and a few integer
operations (i.e. bit-count) which are the most energy-efficient [29]. The main
drawback of BNNs is that they might not be able to achieve as good accuracy as
their full-precision counterparts. However, there have been recent
advancements to narrow the accuracy gap [30]. Currently, BNN is a good
candidate for DL implementations on FPGAs and ASICs [31].

##  III Binarized split learning

In this section, we propose an algorithm to binarize SL for enhancing privacy
preservation and reducing computation overhead and memory usage.

###  III-A Binarized SL (B-SL)

Consider the SL architecture depicted in Fig. 3, we propose to binarize the
local part of the deep model to speed up computation on the clients.
Meanwhile, most of the resource-hungry operations which run on the powerful
server are kept in high-precision computation to retain the accuracy of the
whole DL model. The proposed B-SL is described in Alg. 3 with all
modifications compared to pure SL being highlighted with red color. We use the
deterministic Sign function to binarize/transform weights and activations from
real values to binary values:

$x_{b}=\textsf{Sign}(x)=\begin{cases}+1&\text{if $x\geq 0$}\\\
-1&\text{otherwise,}\end{cases}$ (1)

where $x_{b}$ is the binarized value of the real-value variable $x$. Because
the gradient of the Sign function is zero for almost the values, a solution is
using Straight-Through Estimator [32, 33] which passes the gradient exactly as
it is during back-propagation. This simplifies the back-propagation for
threshold (Sign) function in BNN and has shown to work very well. In back-
propagation, because real-valued gradients of weights are accumulated in real-
valued variables, we need to use real-value weights for Stochastic Gradient
Descent to work at all. Batch Normalization [34] and Weights Clipping [23] are
also the key techniques to accelerate the training and to reduce the impact of
the weights’ scale because real-valued weights would grow very large without
any impact on the binary weights. More details on BNNs can be referred to
[23]. In Alg. 3 where we present the B-SL process on the client, BatchNorm
indicates batch normalization and BackBatchNorm specifies how to back-
propagate through the BatchNorm. The process of B-SL is as follows:

$s\leftarrow$ client socket initialized

$s.connectAndSyncParams(Server)$

for  _each batch $(x,y)$_ do

Forward propagation:

$a_{{\color[rgb]{1,0,0}b}}^{(0)}\leftarrow x$

for  _$i\leftarrow 1$ to $l$_ do

$w_{b}^{(i)}\leftarrow\textsf{Sign}\left(w^{(i)}\right)$

$z^{(i)}\leftarrow
f^{(i)}\left(a_{{\color[rgb]{1,0,0}b}}^{(i-1)},w_{{\color[rgb]{1,0,0}b}}^{(i)}\right)$

$a^{(i)}\leftarrow{\color[rgb]{1,0,0}\textsf{BatchNorm}}\left(z^{(i)}\right)$

${\color[rgb]{1,0,0}a_{b}^{(i)}\leftarrow\textsf{Sign}\left(a^{(i)}\right)}$

end for

$s.send\left((a_{{\color[rgb]{1,0,0}b}}^{(l)},y)\right)$

Backward propagation:

$\frac{\partial E}{\partial a_{{\color[rgb]{1,0,0}b}}^{(l)}}\leftarrow
s.receive()$

for  _$i\leftarrow l$ downto $1$_ do

$\frac{\partial E}{\partial a^{(i)}}\leftarrow\frac{\partial E}{\partial
a_{b}^{(i)}}\circ{1}_{|a^{(i)}|\leq{1}}$

$\frac{\partial E}{\partial z^{(i)}}\leftarrow\frac{\partial E}{\partial
a^{(i)}}\times{\color[rgb]{1,0,0}\textsf{BackBatchNorm}\left(z^{(i)}\right)}$

$\frac{\partial E}{\partial
w_{{\color[rgb]{1,0,0}b}}^{(i)}}\leftarrow\frac{\partial E}{\partial
z^{(i)}}\times\frac{\partial z^{(i)}}{\partial
w_{{\color[rgb]{1,0,0}b}}^{(i)}}$

if  _$i\neq 1$_ then

$\frac{\partial E}{\partial
a_{{\color[rgb]{1,0,0}b}}^{(i-1)}}\leftarrow\frac{\partial E}{\partial
z^{(i)}}\times\frac{\partial z^{(i)}}{\partial
a_{{\color[rgb]{1,0,0}b}}^{(i-1)}}$

Update $w^{(i)}$ using $\frac{\partial E}{\partial
w_{{\color[rgb]{1,0,0}b}}^{(i)}}$

${\color[rgb]{1,0,0}w^{(i)}\leftarrow\textsf{Clip}\left(w^{(i)},-1,1\right)}$

end for

end for

$s.close()$

Algorithm 3 B-SL process on the client.

  * •

Client. After connecting to the server and synchronizing configuration, for
each batch, the client processes forward propagation until the split layer
$l$. At each layer $i$, we first binarize $w^{(i)}$ to $w_{b}^{(i)}$ which is
used to compute layer’s output $z^{(i)}$. Next, we apply a batch normalization
followed by a binarization to obtain layer’ activations $a_{b}^{(i)}$ which is
fed as input to the next layer until layer $l$. Then, the client sends
activations $a_{b}^{(l)}$ to the server.
On receiving $\frac{\partial E}{\partial a_{b}^{(l)}}$ from the server, the
client processes the back-propagation back to the first hidden layer. At each
layer $i$, we obtain $\frac{\partial E}{\partial a^{(i)}}$ from
$\frac{\partial E}{\partial a_{b}^{(i)}}$ via straight-through-estimator:
$g_{r}=g_{b}\circ 1_{|r|\leq 1}$ [23]. $\frac{\partial E}{\partial a^{(i)}}$
is used to compute gradients of layer’s weights and previous layer’s gradients
also. After updating layer’s weights, we constrain them into $[-1,1]$ by using
the Clip function.

  * •

Server. The process in the server is kept intact as in learning with the high-
precision model (see Alg. 2). Note that, the server receives binary
activations from the client instead of real values as in traditional SL.
Despite the server receives the binary values, it will treat them as full-
precision values for the server side forward computation.

###  III-B Computation and Memory Reduction Analysis of B-SL

Binarization not only saves the expensive model storage but also reduces the
matrix computation costs by using XNOR and bit-count operations. Hubara et al.
[23] claimed their implemented binary matrix multiplication is $7$ times
faster on the GPU than the non-binary version, while Rastegari et al. [35]
reported that BNN can have $32$ times lower memory saving and $58$ times
faster convolution operations than 32-bit CNN. By binarizing the local model
of SL, clients would inherit all benefits brought by BNN which is a huge
advantage for IoT.

We affirm the advantages of binarization by comparing the running time during
inference of binarization and non-binarization versions of a convolution layer
on mobile devices. Besides using bit packing, XNOR operation, and bit-count
instruction as in [23] and [35], with convolution layer we replicate kernel
along with a variable to perform multi convolve within an operation as
described in Fig. 4a. Running on 64-bit architecture devices, Fig. 4b presents
the speedup ratio over different kernel sizes. We can observe that on a
powerful server (Linux based Intel Xeon CPU 2.3GHz) with integrated floating-
point units, the speedup of binarization is up to $7$ times while the
binarized convolutions on laptops (Windows based AMD Ryzen 5 4600H) and mobile
phones (Android based Qualcomm Snapdragon 435) achieve a higher speedup that
is up to $17.5$ times compared to non-binarization.

With regards to memory storage, by binarization, we replace a 32-bit floating-
point number with a 1-bit binary value so the memory saved is clearly 32
times. In addition, if bit-packing technique is used (pack $32$ bits into a
$32$-bit integer number), it could save more memory storage. Besides
computation overhead, the cost of smashed data transmitting between client and
server in SL is also an important concern [14]. Therefore, data size saving
via binarization ($32$ or $64$ times, depending on processor architecture) is
a significant advantage that leads to saving bandwidth/energy and improving
the throughput of client-server wireless communication.

(a) Replicating kernels

(b) Speedup ratio

Figure 4: Convolution speedup with kernel replication.

It should be noted that during the training phase, backward propagation is
still working with real-value gradients. In order to accumulate these
gradients, we have to keep the full-precision variables of local layer weights
($w^{(i)}$) which then be binarized ($w_{b}^{(i)}$) to process forward pass.
This extra storage overhead only appears in the training phase; while during
the inference phase, only binary weights are needed to achieve a smaller model
size with fast forward propagation. Of course, during training phase, we still
achieve similar benefit of fast forward propagation and small size activations
transferring between client and server.

###  III-C Privacy Preservation Analysis of B-SL

Although SL has maintained local data untouched from outside, leakage still
happens in previous works. In order to analyze the privacy leakage of the
B-SL, we define a threat model as follows.

#### Threat model.

We assume that the server is an honest-but-curious [36] adversary, i.e., the
server will perform all its operations as specified but is curious about the
raw data located on the clients. Such adversarial server tries to reconstruct
raw data from smashed data that are delivered by the client during forwarding
propagation.

In the B-SL model, privacy leakage happens when the server can infer raw data
from the received smashed data [15, 10, 37]. As a popular mitigation
technique, Differential Privacy (DP) can provide a formal privacy guarantee
for smashed data [15, 10] in terms of privacy budget $\epsilon$. A common
approach to achieve $\epsilon$-DP (a mathematical definition for the privacy
loss from [38]) for a mechanism $\mathcal{M}$ is adding Laplace noises to the
output of a function $f(.)$ such as:

$\mathcal{M}(x)=f(x)+\textsf{Lap}(s/\epsilon)$ (2)

where $s$ is the sensitivity of $f$ and Lap$(S)$ denotes sampling from Laplace
distribution with center $0$ and scale $S$. As a function on raw input data
$x$, if we add noise Lap$(s/\epsilon)$ to the split layer’s activations $f(x)$
then the smashed data $\mathcal{M}(x)$ provides $\epsilon$-DP. Based on the
Laplace noise adding, we analyze and prove that binarization provides better
privacy protection compared to non-binarization as follows.

Considering our proposed B-SL where the smashed data is binarized, we rewrite
Eq. 2 as:

$\begin{split}\mathcal{M}_{b}(x)&=\textsf{Sign}(\mathcal{M}(x))\\\
&=\textsf{Sign}\left(\textsf{Sign}(f(x))+\textsf{Lap}(2/\epsilon)\right)\end{split}$
(3)

where the sensitivity of the Sign function is $2$. If
$|\textsf{Lap}(2/\epsilon)|<1$ then $\mathcal{M}_{b}(x)=\textsf{Sign}(f(x))$.
It means that binarization naturally contains a small latent noise. Having
added noise protects privacy better. In addition, regarding Eq. 3,
binarization would provide $\epsilon$-DP with some specific $\epsilon$ values.
In order to find the lower bound of these $\epsilon$s, we denote cdf as the
cumulative distribution function of Laplace, then the probability of
$|\textsf{Lap}(2/\epsilon)|<1$ is calculated as:

$\begin{split}\textsf{Pr}\left[\left|\textsf{Lap}(2/\epsilon)\right|<1\right]&=1-\left[\textsf{cdf}(1)-\textsf{cdf}(-1)\right]\\\
&=1-\exp(-\epsilon/2).\end{split}$ (4)

Regarding the definition of approximate DP, $(\epsilon,\delta)$-DP [25],
deterministic binarization could provide $\epsilon$-DP with probability
$(1-\exp(-\epsilon/2))$. That means binarization naturally provides
$(\epsilon,\delta)$-DP with $\delta=\exp(-\epsilon/2)$; the lower bound of
$\epsilon$ is $-2\log(\delta)$. Therefore, we can conclude that binarization
preserves better privacy compared to non-binarization. In the next section, we
investigate further privacy enhancement via investigate binarization with
fully $\epsilon$-DP (with any $\epsilon$) together with a novel leakage
restriction training.

##  IV Privacy-enhancing binarized SL

To further reduce privacy leakage, we investigate a number of strategies that
could be incorporated into the B-SL model. Specifically, we propose i) leakage
restriction training and ii) applying DP on smashed data, which are
complementary.

###  IV-A Leakage Restriction Training

Inspired by the device level sanitization scheme [19] where the authors
proposed to quick decorrelate the distance correlation between the client’s
raw data and intermediate activations before allowing any communication for
training; we propose to exploit an additional loss term along with the model
accuracy loss. The additional loss, called leak loss, is used to measure the
leakage of local private data. Leak loss is minimized during training to
further reduce the leakage from smashed data before being delivered to the
server. The leak loss in our approach is general that could be any leakage
metric instead of the specific distance correlation in [19].

$s\leftarrow$ client socket initialized

$s.connectAndSyncParams(Server)$

for  _each batch $(x,y)$_ do

Forward propagation:

$a_{b}^{(0)}\leftarrow x$

for  _$i\leftarrow 1$ to $l$_ do

Same as in Algorithm 3

end for

$s.send\left((a_{b}^{(l)},y)\right)$

${\color[rgb]{1,0,0}E_{2}\leftarrow\mathcal{L}_{2}\left(a_{b}^{(l)},x\right)}$

Backward propagation:

$\frac{\partial E_{{\color[rgb]{1,0,0}1}}}{\partial a_{b}^{(l)}}\leftarrow
s.receive()$

${\color[rgb]{1,0,0}\frac{\partial E}{\partial
a_{b}^{(l)}}\leftarrow\lambda\frac{\partial E_{1}}{\partial
a_{b}^{(l)}}+(1-\lambda)\frac{\partial E_{2}}{\partial a_{b}^{(l)}}}$

for  _$i\leftarrow l$ downto $1$_ do

Same as in Algorithm 3

Update $w^{(i)}$ using Eq. (6)

end for

end for

$s.close()$

Algorithm 4 B-SL with leakage restriction (procedure on the client).

The total loss function for input data $x$, activations $a^{(l)}$ of split
layer, predicted labels $a^{(L)}$, true labels $y$ and a scalar weights
$\lambda$ is given by:

$\begin{split}\mathcal{L}_{total}&=\lambda E_{1}+(1-\lambda)E_{2}\\\
&=\lambda\ \underset{W_{1},W_{2}}{\mathcal{L}_{1}}(a^{(L)},y)+(1-\lambda)\
\underset{W_{1}}{\mathcal{L}_{2}}(a^{(l)},x)\end{split}$ (5)

where $\mathcal{L}_{1}$ is the main accuracy loss of the deep model.
$\mathcal{L}_{2}$ is the leak loss which can be any leakage measure that we
want to optimize. The model parameters $W$ ($w^{(1)}\dots w^{(L)}$) is split
as $W_{1}$ ($w^{(1)}\dots w^{(l)}$) and $W_{2}$ ($w^{(l+1)}\dots w^{(L)}$)
which are distributed to partial models on the client and the server,
respectively. From Eq. (5), $\mathcal{L}_{2}$ is calculated on the basis of
local data and is influenced only by these data. Therefore, we localize the
calculating leak loss and the step of updating gradient based on this loss to
the device. After sending activations to the server, the client calculates the
loss $E_{2}=\mathcal{L}_{2}(a^{(l)},x)$. Then, upon computing $\frac{\partial
E_{1}}{\partial w^{(l)}}$ from the received $\frac{\partial E_{1}}{\partial
a^{(l)}}$, along with the locally computed gradient $\frac{\partial
E_{2}}{\partial w^{(l)}}$, the client updates its local parameters as
following:

$w^{(i)}=w^{(i)}-\eta\left(\lambda\frac{\partial E_{1}}{\partial
w^{(i)}}+(1-\lambda)\frac{\partial E_{2}}{\partial w^{(i)}}\right)$ (6)

where $\lambda$ is a scalar weight which helps to locally balance between
accuracy and privacy. We update Alg. 3 by adding an additional loss that helps
further restrict leakage as indicated in Alg. 4.

$s\leftarrow$ client socket initialized

$s.connectAndSyncParams(Server)$

for  _each batch $(x,y)$_ do

Forward propagation:

$a_{b}^{(0)}\leftarrow x$

for  _$i\leftarrow 1$ to $l$_ do

Same as in Algorithm 3

end for

$a{\color[rgb]{1,0,0}{}^{\prime}}_{b}^{(l)}\leftarrow
a_{b}^{(l)}{\color[rgb]{1,0,0}+noise}$

$s.send\left((a{\color[rgb]{1,0,0}{}^{\prime}}_{b}^{(l)},y)\right)$

Backward propagation:

$\frac{\partial E}{\partial a_{b}^{(l)}}\leftarrow s.receive()$

for  _$i\leftarrow l$ downto $1$_ do

Same as in Algorithm 3

end for

end for

$s.close()$

Algorithm 5 B-SL with DP integration (procedure on the client).

###  IV-B Differential Privacy Integration

In recent years, many researches study try to exploit DP to protect the
privacy of SL such as [15, 10, 39]. Therefore, DP could potentially be
integrated into the proposed B-SL to mathematically guarantee privacy. Based
on Eq. (2), in Alg. 5 we integrate DP into B-SL (Alg. 3) by adding noise to
the split layer’s activations (${a^{\prime}}_{b}^{(l)}\leftarrow
a_{b}^{(l)}+noise$) before sending them to the server. However, due to
binarization, smashed data is constrained to binary values instead of real
values of noise added data. Therefore, instead of directly adding Laplace
noise, we propose three different approaches to provide $\epsilon$-DP and also
satisfy the binary output for smashed data as follows:

  1. 1.

Stochastic binarization: instead of deterministic binarization, Shekhovtsov et
al. [40] proposed a stochastic binarization where they add a noise $z$ to real
data such as $x_{b}=\textsf{Sign}(x-z)$. We could replace the noise $z$ by
$\textsf{Lap}(\frac{s}{\epsilon})$ then the binarization
$x_{b}^{\prime}=\textsf{Sign}(x-\textsf{Lap}(s/\epsilon))$ provides
$\epsilon$-DP where $s$ is the sensitivity of $x$. In order for this
stochastic binarization to work, the authors proposed a new Straight Through
Estimator which can be found in detail in [40]. We formulate the equation for
integrating DP into B-SL as follows.

${a^{\prime}}_{b}^{(l)}\leftarrow\textsf{NewStraightThroughEstimator}(a_{b}^{(l)})$

  2. 2.

Double binarization: the idea of this second approach is simple and
straightforward, that is to binarize a $\epsilon$-DP satisfied binarization to
keep the output in form of binary values. The equation is as follows. Note
that, based on post processing rule then ${a^{\prime}}_{b}^{(l)}$ provides
$\epsilon$-DP.

${a^{\prime}}_{b}^{(l)}=\textsf{Sign}(a_{b}^{(l)}+\textsf{Lap}(2/\epsilon))$

  3. 3.

Randomizing response: this approach is motivated by a method of Warner et. al.
[41] to improve bias in survey responses about sensitive issues. When a coin
is flipped; if the coin is head, returns true value. If the coin is tail, flip
another coin. If the second coin is head, return $1$; otherwise, return $-1$.
With the probability $p$ of head or tail is $0.5$ then this mechanism
satisfies $\epsilon$-DP with $\epsilon\approx 1.04$ [42]. In general,
randomizing response satisfies $\epsilon$-DP with
$\epsilon=\log(\frac{1+p}{1-p})$ where $p$ is the probability of the first
coin is head. The equation for this approach is:

${a^{\prime}}_{b}^{(l)}=\begin{cases}{a}_{b}^{(l)}\ \ \ \ \ \ \ &\text{with
probability $p$}\\\ +1&\text{with probability $(1-p)/2$}\\\ -1&\text{with
probability $(1-p)/2$}\end{cases}$

In the next section, we will present the experimental results of these three
approaches and suggest the better one in terms of less affecting model
accuracy.

##  V Experimental evaluation

We evaluate the performance of the proposed B-SL models in various
classification tasks on 2D-image datasets. For privacy preservation
evaluation, the correlation/similarity between raw and smashed data is used to
measure leakage with various metrics such as mean square error,
Kullback–Leibler divergence (KL-D) [16], distance correlation (DCOR) [15, 19],
structural similarity index measure (SSIM), and peak signal-to-noise ratio
(PNSR) [37]. In this work, KL-D and SSIM are chosen as the main metrics. While
KL-D measures the difference between two probability distributions, SSIM
measures the human perceptual similarity of two images and is used to
demonstrate the visual reconstruction of the raw images from smashed data.
Smaller distribution differences (smaller KL-D) and higher image similarities
(larger SSIM) indicate high leaks and vice-versa.

###  V-A Experiment Setup

We set up an SL network containing a client connected to a server as depicted
in Fig. 3 where we localize the input and the first hidden layer while the
rest are deployed in the server. The deep models are trained for $400$ epochs
and an SGD optimizer [43] with a batch size of $64$ is set. The SGD optimizer
has the learning rate of $1e-2$, the momentum of $0.8$, and a weight decay of
$5e-4$ by default. In addition, Dropout [44] is used as a regularization
technique to reduce overfitting. We store the best-trained models based on
validation loss which are then used to measure model accuracy on the test set.

TABLE I: Accuracy and privacy comparison between CNN, B-CNN and B-SL. Scheme | B-CNN | B-SL | CNN | B-SL | CNN | B-SL | CNN
---|---|---|---|---|---|---|---
Measure | Accuracy ($\%$) | KL-D ($\geq 0$) | SSIM ($[0,1]$)
MNIST | $96.8$ | $99.2$ | $99.2$ | $3.7$ | $1.5$ | $0.2$ | $0.2$
Fashion MNIST | $82.8$ | $90.2$ | $90.9$ | $3.3$ | $1.8$ | $0.1$ | $0.1$
SVHN | $72.9$ | $90.0$ | $90.4$ | $2.6$ | $1.1$ | $0.1$ | $0.1$
CIFAR-10 | $70.5$ | $83.6$ | $83.8$ | $2.4$ | $0.9$ | $0.1$ | $0.1$
Note: higher KL-D and smaller SSIM values indicates lower leakage.

Datasets and deep models. Four datasets with different complexities and
domains have been used in the experiments: MNIST [45], Fashion-MNIST [46],
SVHN [47], and CIFAR-10 [48]. These datasets contain grey-scale (MNIST and
Fashion-MNIST) or color (SVHN and CIFAR-10) images in $10$ classes. To focus
more on privacy preservation, data augmentation or pre-processing is not
employed in these datasets. Regarding the deep models, our experiments
evaluated LeNet-5 for MNIST and VGG-small [49] for the rest datasets. For easy
referencing, we refer to all CNN based full-precision models as CNN; B-CNN is
the complete binarization (binarize every convolution and fully connected
layers, except the input and output layers) of the corresponding CNN; and B-SL
is the proposed binarized SL model.

###  V-B Performance Evaluation

Table I presents the accuracy when conducting classification tasks on the four
datasets. We conducted experiments and measured the accuracy of pure CNN-based
models as a baseline for comparison with B-CNN and our B-SL models of the same
architecture (same number of layers). We can see that B-CNN is less accurate
than CNN due to data loss during binarization; the accuracy degradation is
from $3\%$ to $27\%$ (e.g. $96.8\%$ compared to $99.2\%$ of CNN on MNIST or
$70.5\%$ compared to $83.8\%$ of CNN on CIFAR-10). Our proposed model, B-SL,
achieves far better results than B-CNN and is comparable to CNN with less than
$1\%$ difference in accuracy. For instance, the accuracy of B-SL is equal to
CNN on MNIST while it is reduced by $0.7\%$, $0.4\%$ and $0.2\%$ respectively
on Fashion MNIST, SVHN, and CIFAR-10 datasets.

In SL, the number of localized layers would have a significant impact on the
local computation overhead of the client. Binarizing local layers would speed
up the computation, but this could lead to more losses. In order to evaluate
the effect of adding local layers to the model accuracy, we conducted
experiments on CIFAR-10 dataset where the first, second, and third convolution
layers of the VGG-small model are binarized and localized accordingly. The
experiment results show that the accuracy is reduced from $83.6\%$ to $81.6\%$
and $81.1\%$ corresponding to splitting after one, two, and three convolution
layers, respectively. By shifting a layer from the server to the client
(further splitting point), we have more binarized layers (with more losses)
and fewer full-precision layers that could explain the degraded accuracy of
the entire model. However, in other experiments, we maintain the server-side
model by distributing the first convolution layer to the client. Besides, at
the client side we replicate this convolution layer multiple times. Then, the
model accuracy is increased from $83.6\%$ to $84.7\%$ and $86.0\%$
corresponding to having one, two, and three local binarized convolutions,
respectively. Therefore, adding more local binarized layers would increase or
decrease the model accuracy depending on the splitting strategy (i.e. shifting
or replicating layers). The addition of local layers definitely increases
computation costs for the clients; however, regarding the effect of adding
more layers to privacy leakage, we present the experimental results in the
following subsection.

TABLE II: Effects of adding additional leakage loss to the client compared to related work. Dataset | Model |  Leakage restriction training approach |  Accuracy ($\%$) | Leakage measure
---|---|---|---|---
KL-D | SSIM | DCOR
MNIST | CNN |  [16] with $p=0.2$ | $99.1$ | $1.5$ | $0.2$ | $0.7$
MNIST | CNN |  [18] with $n=21$ | $99.0$ | $1.7$ | $0.2$ | $0.8$
MNIST | CNN | Ours, DCOR loss [19] | $99.2$ | $1.7$ | $0.2$ | $0.8$
MNIST | CNN | Ours, SSIM loss | $99.4$ | $2.3$ | $0.1$ | $0.8$
MNIST | B-SL | Ours, SSIM loss | $99.1$ | $3.1$ | $0.1$ | $0.5$
CIFAR-10 | CNN |  [16] with $p=0.1$ | $83.2$ | $0.9$ | $0.1$ | $0.7$
CIFAR-10 | CNN |  [18] with $n=231$ | $83.1$ | $0.9$ | $0.1$ | $0.7$
CIFAR-10 | CNN | Ours, DCOR loss [19] | $83.1$ | $0.7$ | $0.1$ | $0.6$
CIFAR-10 | CNN | Ours, SSIM loss | $83.9$ | $0.8$ | $0.1$ | $0.6$
CIFAR-10 | B-SL | Ours, SSIM loss | $83.8$ | $2.9$ | $0.1$ | $0.8$

###  V-C Privacy Evaluation

Figure 5: Visualizing activations from non-binarization (upper row),
binarization (middle row) convolutions, and binarization with leakage
restriction training (lower row). Raw input is on the top left.

#### With binarization

We measure raw data leakage to evaluate the privacy preservation of our B-SL
compared to pure CNN. In order to isolate the effect of subsampling (e.g. max-
pooling layers), we extract outputs from the last convolution layer towards
the split layer for measuring leakages. We first visually reconstruct the 2D
images from the activations and then compare them to the original image
inputted to the model. Fig. 5 demonstrates images visually plotted from
activations at the split layer of a CNN and B-SL with one localized
convolution. We observe that binarization destroys color space and also
maintains the partial shape of raw input which is similar to non-binarization.
Similar to the accuracy experiments, we measured leakage of CNN and B-SL
models over four datasets. The mean values of leakage from all channels are
presented in Table I. Because of pixels pattern distorted by binarization,
KL-D measurement of B-SL is outperform CNN. Note that, a higher KL-D value
means greater dissimilarity and the KL-D values of B-SL are almost $2$ times
higher than CNN. Besides, SSIM measurements reveal that CNN and B-CNN both
maintain image structure and these models have equal results as 0.2 with MNIST
and 0.1 on other datasets. SSIM scalar values are in the range $[0,1]$ where
$1$ presents the most similar and $0$ is the least similar.

#### With leakage restriction training

In the experiments related to the proposed leakage restriction training
approach, we implement SSIM as an additional leak loss and based on
experimental results select the appropriate weight between effectiveness and
privacy to balance the model’s high accuracy while reducing leakage. Observing
the experimental results presented in Table II, we find that the model
accuracy remains high (within $\pm 0.5\%$ differs) while the SSIM values are
further reduced up to $50\%$ in the case of evaluating both CNN and B-SL. For
example, with MNIST experiments, the SSIM value is reduced from $0.2$ to
$0.1$. The results from Table II show that our proposed scheme achieves higher
KL-D and smaller SSIM compared to other targets, including the work of [16],
[18], and [19]. We also visually reconstructed images from the split layer’s
activations of B-CNN after optimizing leakage and observe that there are some
filters set to zero in order to minimize the leak loss. Zero-value filters
could be removed from the model to make it lighter and therefore reduce
computation overhead.

#### With differential privacy

In order to evaluate the performance of the three proposed approaches for
integrating DP into B-SL, we conducted experiments on the MNIST dataset where
we run Alg. 5 with stronger $\epsilon$ values. For each $\epsilon$ value, we
sequentially apply stochastic binarization (SB), double binarization (DB), and
randomizing response (RR) to the split layer’s activations of B-SL then
measure the affected accuracy of the models. We also measure the effect of
$\epsilon$ on the accuracy of CNN (non-binarization) as the baseline for
comparison. The results are plotted in Fig. 6 which reveals that the RR
approach provides the smallest accuracy trade-off compared to SB and DB, and
is comparable to the non-binarization model. Based on the experimental
results, we could recommend that providing $\epsilon$-DP for B-SL by
randomizing response would achieve better accuracy results.

(a) Visualizing activations at split layer under DP protection with different
epsilons.

(b) Accuracy changes after applying DP with different $\epsilon$ among DP
integration approaches for B-SL on MNIST dataset.

Figure 6: Effects of applying $\epsilon$-DP on split layer of B-SL.

To evaluate the effect of adding more local layers to privacy preservation, we
conducted experiments on both shifting layers from the server to the client
and replicating the local layer. Experimental results are presented in Table
III where B$X$-SL is B-SL with $X$ first convolutions are deployed at the
client and $X$B-SL is B-SL with the first local convolution replicates $(X-1)$
times. Under this naming convention, B1-SL and 1B-SL are examples of B-SL that
are used in other experiments. The results reveal that adding more local
layers slightly reduces leakage (such as increasing KL-D from $2.4$ to $2.9$).
Moreover, shifting layers reduces more leakage than replicating layers because
the latter convolutions usually produce smaller feature maps. However, the
leakage reduction is not commensurate with the computation costs as adding one
more layer would result in double overheads, especially with latter
convolutions that have a high number of filters. In summary, considering
accuracy, we suggest limiting the number of local layers to $2$ (by
replicating the first convolution) to obtain higher results of both accuracy
and privacy.

TABLE III: Leakage comparison when adding local layers in experiments with CIFAR-10 dataset. Metric | KL-D | SSIM
---|---|---
Scheme | B1-SL | B2-SL | B3-SL | B1-SL | B2-SL | B3-SL
Measure | $2.35$ | $2.64$ | $2.58$ | $0.12$ | $0.08$ | $0.05$
Scheme | 1B-SL | 2B-SL | 3B-SL | 1B-SL | 2B-SL | 3B-SL
Measure | $2.35$ | $2.81$ | $2.87$ | $0.12$ | $0.11$ | $0.09$

Last, the binarization of weights, especially convolutional parameters, would
lead to duplication of kernels. Duplicated kernels cause redundant computation
that can be removed to reduce computational overhead [50]. Considering
experiments on CIFAR-10 dataset, for example, the localized convolution has
$64$ kernels of size $3\times 3$. If we resize these kernels to $2\times 2$,
then there are possible $2^{4}$ different binary kernels which means high
duplication during the model training. We performed again the experiments on
CIFAR-10 with B-SL that has the localized convolution with $64$ of $2\times 2$
kernels. The experiment results show that there are $42$ duplicated kernels
over $64$ in total (corresponds to $66\%$). The same experiment on CNN models
has shown that there is no duplication. Thus, binarization helps to reduce
computation and cause duplicated kernels, which means a high possibility of
reducing more computation costs that are a great advantage on mobile or IoT
devices.

###  V-D B-SL Against Feature-Space Hijacking Attack

Feature-space hijacking attack (FSHA) [21] is a novel attack that could lead
to rethinking the SL protocol as the privacy-preserving properties are
violated. Unlike the previous honest-but-curious server threat model, FSHA
assumes a threat model with a dishonest server that actively hijacks the local
private model by providing intentional gradients which combine true gradients
(for model utility) and malicious gradients for mapping the local model to a
pilot model. Then, the server could use the pilot model to reconstruct raw
private data on receiving smashed data from the client. In [21], the authors
demonstrated the effects of FSHA on SL, SL’s variants such as SplitFed [51],
and defensive techniques such as NoPeek [19]. In our experiment, we study the
defensive effectiveness of B-SL against FHSA.

Figure 7: Images reconstruction when adopting FSHA on SL (middle row) and B-SL
(bottom row) for the split 1. Top row shows original images.

We setup an attack scenario that follows split $1$ and $2$ as presented in
[21] where we localize one and two convolutions, respectively. We apply the
same architecture for attacker’s models (i.e. $\tilde{f}$, $\tilde{f}^{-1}$,
and $D$) as suggested in [21]. Figs. 7 and 8 demonstrate the reconstruction
results when FSHA is adopted to SL and B-SL. Visually, it can be observed that
FSHA could successfully reconstruct raw data from SL’s learning process.
Regarding B-SL, interestingly, binarization helps relax this vulnerability. In
order to numerically evaluate and compare B-SL to SL, we feed forward the
reconstructed images from FSHA to the deep models to obtain the classification
results. Besides the reconstruction loss (using MSE) between reconstructed and
raw images, high classification accuracy results from reconstructed images
indicates a high reconstruction quality. Without FSHA, both SL and B-SL models
perform $99\%$ classification accuracy on MNIST dataset. Table IV presents the
experimental results when FSHA is adopted. For split 1, when adopting FSHA,
the accuracy of SL is slightly reduced by $2\%$ (from $99\%$ without FSHA to
$98\%$) while B-SL accuracy is more reduced by $3\%$ (from $99\%$ to $94\%$).
The error of reconstruction which is measured by MSE loss between SL and B-SL
are equal $0.7$; however, the quality of reconstruction images from SL is
visually much better than from B-SL as shown in Fig. 7. Because of lower
reconstruction quality, the accuracy of classification task on images
reconstructed from B-SL is much lower than from SL, which are $10\%$ and
$71\%$ respectively. When we increase the number of local layers to $2$ (split
$2$), the quality of reconstruction is better than split 1 (see Fig. 8) and
the accuracy of the classification on reconstructed images is also improved
for both SL and B-SL (see Table IV). Note that, B-SL still preserve better
data privacy with reconstruction accuracy is $64\%$ compared to $96\%$ of SL.

TABLE IV: Performance of FSHA on SL and B-SL over MNIST dataset. Scenario | Scheme |  Model Accuracy |  Reconstruction Loss (MSE) |  Reconstruction Accuracy
---|---|---|---|---
Split 1 | SL | $97\%$ | $0.7$ | $71\%$
B-SL | $94\%$ | $0.7$ | $10\%$
Split 2 | SL | $98\%$ | $0.7$ | $96\%$
B-SL | $95\%$ | $0.6$ | $64\%$
Figure 8: Images reconstruction when adopting FSHA on SL (middle row) and B-SL
(bottom row) for the split 2. Top row shows original images.

On the experimental results related to FSHA, we could observe that B-SL helps
relax the vulnerability of SL which is claimed to force rethinking the
protocol [21]. Regarding B-SL, when FSHA is adopted, the model accuracy drop
is larger (than SL), an indicator for detecting the attack. Besides, when the
local model is thin (less number of layers on the client-side), the
effectiveness of FSHA is significantly reduced. These results could draw to
insight for future investigations to study FSHA detection and defending.

##  VI Conclusion

We have investigated the practicality of binarizing split learning to
facilitate deep learning applications on mobile and IoT devices. We have
introduced a hybrid deep model for collaboratively distributed learning where
we only binarized the localized part while the server part is kept intact. We
have proposed a leakage restriction training approach in order to further
reduce leakage from the shared smashed data while balancing the high
classification accuracy of the models. To evaluate the proposal, we
extensively conducted experiments on four commonly benchmarked datasets. The
results demonstrate that adopting binarization helps lighten the localized
model, speed up computation (up to $17.5$ forward-propagation times), reduce
memory usage, and save data transmission bandwidth (up to $32$ times).
Binarization models allow better privacy preservation in terms of KL-D and
SSIM metrics compared to other targets experimentally. Moreover, training with
leakage restriction further reduces leakage (measured by SSIM metric) up to
$50\%$ and this method gets better results in binarization models. Finally, we
could fully provide $\epsilon$-differential privacy for binarization models
with the suggested randomizing response method to achieve the least accuracy
trade-off. Taking these into account, our proposal would enable high-
performance deep learning in an IoT environment with the maximum benefits at
the inference stage. In future work, end-to-end evaluation in low-end devices
should be thoroughly studied; and evaluating data leaks with other metrics on
large-scale datasets should be further investigated.

## References

  * [1] W. Liu, Z. Wang, X. Liu, N. Zeng, Y. Liu, and F. E. Alsaadi, “A survey of deep neural network architectures and their applications,” _Neurocomputing_ , vol. 234, pp. 11–26, 2017.
  * [2] Y. Zheng, M. Jin, Y. Liu, L. Chi, K. T. Phan, and Y.-P. P. Chen, “Generative and contrastive self-supervised learning for graph anomaly detection,” _IEEE Transactions on Knowledge and Data Engineering_ , pp. 1–1, 2021.
  * [3] L. Yu, L. Liu, C. Pu, M. E. Gursoy, and S. Truex, “Differentially private model publishing for deep learning,” in _2019 IEEE Symposium on Security and Privacy (SP)_ , 2019, pp. 332–349.
  * [4] R. T. Mercuri, “The hipaa-potamus in health care data security,” _Commun. ACM_ , vol. 47, no. 7, pp. 25–28, 2004.
  * [5] P. Vepakomma, T. Swedish, R. Raskar, O. Gupta, and A. Dubey, “No peek: A survey of private distributed deep learning,” 2018.
  * [6] M. Gong, Y. Xie, K. Pan, K. Feng, and A. Qin, “A survey on differentially private machine learning [review article],” _IEEE Computational Intelligence Magazine_ , vol. 15, no. 2, pp. 49–64, 2020.
  * [7] F. Mireshghallah, M. Taram, P. Vepakomma, A. Singh, R. Raskar, and H. Esmaeilzadeh, “Privacy in deep learning: A survey,” 2020.
  * [8] A. Boulemtafes, A. Derhab, and Y. Challal, “A review of privacy-preserving techniques for deep learning,” _Neurocomputing_ , vol. 384, pp. 21–45, 2020\.
  * [9] J. Yu, A. Lukefahr, D. Palframan, G. Dasika, R. Das, and S. Mahlke, “Scalpel: Customizing dnn pruning to the underlying hardware parallelism,” in _2017 ACM/IEEE 44th Annual International Symposium on Computer Architecture (ISCA)_ , 2017, pp. 548–560.
  * [10] J. Wang, J. Zhang, W. Bao, X. Zhu, B. Cao, and P. S. Yu, “Not just privacy: Improving performance of private deep learning in mobile cloud,” in _Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_, ser. KDD ’18. New York, NY, USA: Association for Computing Machinery, 2018, pp. 2407–2416.
  * [11] L. Zhu, Z. Liu, and S. Han, _Deep Leakage from Gradients_. Red Hook, NY, USA: Curran Associates Inc., 2019, pp. 14 774–14 784.
  * [12] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, “Inverting gradients - how easy is it to break privacy in federated learning?” in _Advances in Neural Information Processing Systems_ , H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, Eds., vol. 33. Curran Associates, Inc., 2020, pp. 16 937–16 947.
  * [13] C. Zhou, Y. Gao, A. Fu, K. Chen, Z. Dai, Z. Zhang, M. Xue, and Y. Zhang, “Ppa: Preference profiling attack against federated learning,” _arXiv preprint arXiv:2202.04856_ , 2022.
  * [14] Y. Matsubara, M. Levorato, and F. Restuccia, “Split computing and early exiting for deep learning applications: Survey and research challenges,” 2021\.
  * [15] S. Abuadbba, K. Kim, M. Kim, C. Thapa, S. A. Camtepe, Y. Gao, H. Kim, and S. Nepal, “Can we use split learning on 1d cnn models for privacy preserving training?” in _Proceedings of the 15th ACM Asia Conference on Computer and Communications Security_ , ser. ASIA CCS ’20. New York, NY, USA: Association for Computing Machinery, 2020, pp. 305–318.
  * [16] H. Dong, C. Wu, Z. Wei, and Y. Guo, “Dropping activation outputs with localized first-layer deep network for enhancing user privacy and data security,” _IEEE Transactions on Information Forensics and Security_ , vol. 13, no. 3, pp. 662–670, 2018.
  * [17] X. Tan, H. Li, L. Wang, and Z. Xu, “Comments on “dropping activation outputs with localized first-layer deep network for enhancing user privacy and data security”,” _IEEE Transactions on Information Forensics and Security_ , vol. 15, pp. 3938–3939, 2020.
  * [18] C.-H. Yu, C.-N. Chou, and E. Chang, “Distributed layer-partitioned training for privacy-preserved deep learning,” in _2019 IEEE Conference on Multimedia Information Processing and Retrieval (MIPR)_ , 2019, pp. 343–346.
  * [19] P. Vepakomma, A. Singh, O. Gupta, and R. Raskar, “Nopeek: Information leakage reduction to share activations in distributed deep learning,” in _2020 International Conference on Data Mining Workshops (ICDMW)_ , 2020, pp. 933–942.
  * [20] P. Vepakomma, O. Gupta, A. Dubey, and R. Raskar, “Reducing leakage in distributed deep learning for sensitive health data,” _Presented at the ICLR AI for social good workshop 2019_ , 05 2019.
  * [21] D. Pasquini, G. Ateniese, and M. Bernaschi, “Unleashing the tiger: Inference attacks on split learning,” ser. CCS ’21. New York, NY, USA: Association for Computing Machinery, 2021, p. 2113–2129.
  * [22] M. Courbariaux, I. Hubara, D. Soudry, R. El-Yaniv, and Y. Bengio, “Binarized neural networks: Training deep neural networks with weights and activations constrained to +1 or -1,” 2016.
  * [23] I. Hubara, M. Courbariaux, D. Soudry, R. El-Yaniv, and Y. Bengio, “Binarized neural networks,” in _Proceedings of the 30th International Conference on Neural Information Processing Systems_ , ser. NIPS’16. Red Hook, NY, USA: Curran Associates Inc., 2016, pp. 4114–4122.
  * [24] F. Farokhi, “Noiseless privacy,” 2019. [Online]. Available: https://arxiv.org/abs/1910.13027
  * [25] C. Dwork, K. Kenthapadi, F. McSherry, I. Mironov, and M. Naor, “Our data, ourselves: Privacy via distributed noise generation,” in _Advances in Cryptology - EUROCRYPT 2006_ , S. Vaudenay, Ed. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 486–503.
  * [26] O. Gupta and R. Raskar, “Distributed learning of deep neural network over multiple agents,” _Journal of Network and Computer Applications_ , vol. 116, pp. 1–8, 2018.
  * [27] A. Singh, P. Vepakomma, O. Gupta, and R. Raskar, “Detailed comparison of communication efficiency of split learning and federated learning,” 2019.
  * [28] M. Courbariaux, Y. Bengio, and J.-P. David, “Binaryconnect: Training deep neural networks with binary weights during propagations,” in _Proceedings of the 28th International Conference on Neural Information Processing Systems - Volume 2_ , ser. NIPS’15. Cambridge, MA, USA: MIT Press, 2015, pp. 3123–3131.
  * [29] A. Livochka and A. Shekhovtsov, “Initialization and transfer learning of stochastic binary networks from real-valued ones,” in _2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW)_ , 2021, pp. 4655–4663.
  * [30] H. Qin, R. Gong, X. Liu, X. Bai, J. Song, and N. Sebe, “Binary neural networks: A survey,” _Pattern Recognition_ , vol. 105, p. 107281, 2020.
  * [31] T. Simons and D.-J. Lee, “A review of binarized neural networks,” _Electronics_ , vol. 8, no. 6, 2019.
  * [32] Y. Bengio, N. Léonard, and A. Courville, “Estimating or propagating gradients through stochastic neurons for conditional computation,” 2013.
  * [33] P. Yin, J. Lyu, S. Zhang, S. Osher, Y. Qi, and J. Xin, “Understanding straight-through estimator in training activation quantized neural nets,” 2019\.
  * [34] S. Ioffe and C. Szegedy, “Batch normalization: Accelerating deep network training by reducing internal covariate shift,” in _Proceedings of the 32nd International Conference on International Conference on Machine Learning \- Volume 37_ , ser. ICML’15. JMLR.org, 2015, pp. 448–456.
  * [35] M. Rastegari, V. Ordonez, J. Redmon, and A. Farhadi, “Xnor-net: Imagenet classification using binary convolutional neural networks,” in _Computer Vision – ECCV 2016_ , B. Leibe, J. Matas, N. Sebe, and M. Welling, Eds. Cham: Springer International Publishing, 2016, pp. 525–542.
  * [36] A. J. Paverd and A. C. Martin, “Modelling and automatically analysing privacy properties for honest-but-curious adversaries,” 2014.
  * [37] Z. He, T. Zhang, and R. B. Lee, “Model inversion attacks against collaborative inference,” in _Proceedings of the 35th Annual Computer Security Applications Conference_ , ser. ACSAC ’19. New York, NY, USA: Association for Computing Machinery, 2019, pp. 148–162.
  * [38] C. Dwork, “Differential privacy,” in _Automata, Languages and Programming_ , M. Bugliesi, B. Preneel, V. Sassone, and I. Wegener, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2006, pp. 1–12.
  * [39] J. Ryu, Y. Zheng, Y. Gao, S. Abuadbba, J. Kim, D. Won, S. Nepal, H. Kim, and C. Wang, “Can differential privacy practically protect collaborative deep learning inference for the internet of things?” 2021.
  * [40] A. Shekhovtsov and V. Yanush, “Reintroducing straight-through estimators as principled methods for stochastic binary networks,” in _Pattern Recognition_ , C. Bauckhage, J. Gall, and A. Schwing, Eds. Cham: Springer International Publishing, 2021, pp. 111–126.
  * [41] S. L. Warner, “Randomized response: A survey technique for eliminating evasive answer bias,” _Journal of the American Statistical Association_ , vol. 60, no. 309, pp. 63–69, 1965.
  * [42] J. P. Near and C. Abuah, _Programming Differential Privacy_ , 2021, vol. 1. [Online]. Available: https://uvm-plaid.github.io/programming-dp/
  * [43] S. Ruder, “An overview of gradient descent optimization algorithms,” 2016. [Online]. Available: https://arxiv.org/abs/1609.04747
  * [44] N. Srivastava, G. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhutdinov, “Dropout: A simple way to prevent neural networks from overfitting,” _J. Mach. Learn. Res._ , vol. 15, no. 1, pp. 1929–1958, 2014.
  * [45] L. Deng, “The mnist database of handwritten digit images for machine learning research [best of the web],” _IEEE Signal Processing Magazine_ , vol. 29, no. 6, pp. 141–142, 2012.
  * [46] H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” 2017.
  * [47] Y. Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y. Ng, “Reading digits in natural images with unsupervised feature learning,” in _NIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011_ , 2011. [Online]. Available: http://ufldl.stanford.edu/housenumbers/nips2011\\_housenumbers.pdf
  * [48] A. Krizhevsky, “Learning multiple layers of features from tiny images,” Master’s thesis, Department of Computer Science, University of Toronto, Tech. Rep., 2009.
  * [49] W. Rawat and Z. Wang, “Deep convolutional neural networks for image classification: A comprehensive review,” _Neural Comput._ , vol. 29, no. 9, pp. 2352–2449, 2017.
  * [50] A. RoyChowdhury, P. Sharma, and E. Learned-Miller, “Reducing duplicate filters in deep neural networks,” in _NIPS workshop on Deep Learning: Bridging Theory and Practice 2017_ , 2017.
  * [51] C. Thapa, M. A. P. Chamikara, S. Camtepe, and L. Sun, “Splitfed: When federated learning meets split learning,” 2021.