{"id":"84ae4633-cebe-4475-b44c-e85478f6d1b5","arxiv_id":"2412.11689","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"MLP-based client models in split learning resist state-of-the-art feature reconstruction attacks that succeed against CNN-based models.","lead":"Tests on split learning show that feature reconstruction attacks fail when the client's model uses dense linear layers instead of convolutional layers. The authors give a simple invariance argument and experimental evidence that MLP-based clients withstand state-of-the-art attacks on several image datasets.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The abstract's no-prior claim fails in the server-knows-W case: Corollary 1's own setup allows exact reconstruction X = H W^{-1} when W is invertible, so a secret orthogonal transformation is required, not merely the absence of a data prior.","rationale":"The reader's weakest_assumption identifies the same load-bearing flaw: the paper's no-prior claim is only true when the client holds a secret orthogonal transformation, and Corollary 1's statement that a server knowing an invertible W still cannot reconstruct is internally inconsistent. This is the single most important weakness because it directly contradicts the abstract's headline claim. However, the paper's experimental contribution—black-box UnSplit and FSHA failing on dense-layer clients—is a separate, testable claim, and the code is available; the theoretical overstatement can be corrected by narrowing the claim or explicitly adding the secret-transformation assumption. Hence the appropriate verdict is CONDITIONAL, not REJECT: the empirical phenomenon may be real, but the paper must fix the theory and add the server-knows-W control experiment.","tokens_in":23582,"tokens_out":7150,"duration_ms":67652,"concrete_test":"Run the paper's one-layer client on MNIST with a square invertible W (d = d_h, as Corollary 1 assumes) and have the server, which is given W, compute X_hat = H W^{-1} on a held-out batch at the first protocol step, then report pixel error. If X_hat reproduces X to numerical precision, exact reconstruction without any data prior is demonstrated, contradicting the abstract. For completeness, repeat with a random orthogonal U applied to X before W; the server should then recover XU, not X, confirming that the actual privacy mechanism is the secret transformation, not the absence of a prior.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's central theoretical claim (abstract; Contribution 1) is that feature reconstruction 'cannot succeed without knowledge of the prior distribution on data.' The proof rests on Lemma 1's orthogonal-pair indistinguishability, but Corollary 1 extends this to a server that knows the first-layer weight matrix W1 and assumes W1 is invertible. In that case, for a one-layer client H1 = X W1, the server computes X_hat = H1 W1^{-1} = X exactly, with no data prior. The corollary's proof instead computes \\tilde H1 W1^{-1} with \\tilde H1 = \\tilde X W1, which conflates the rotated pair (\\tilde X, \\tilde W1 = U^\\top W1) with the untransformed weight W1; under the actual protocol the server receives \\tilde X \\tilde W1 = X W1 and, knowing W1, inverts to X. Non-recoverability holds only if the client applies a secret orthogonal matrix before W1 (Lemma 2's assumption), which is not part of the standard attack model and is absent from the abstract's categorical statement. This is load-bearing because the main theoretical motivation and the abstract's headline assertion are false as stated; the empirical black-box results may survive, but they test a different (server-does-not-know-W) setting.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies feature reconstruction attacks in vertical federated learning (specifically two-party split learning) and argues that MLP-based client architectures are resistant to state-of-the-art attacks (UnSplit model inversion and Feature-space Hijacking) without any additional defense, while preserving model accuracy. The theoretical part claims that, absent a prior on the data distribution, the server cannot reconstruct client features; the argument is based on orthogonal transformations of data and weights producing identical activations (Lemma 1), with extensions to known first-layer weights (Corollary 1), malicious servers (Lemma 2), and activations before the cut layer (Lemma 3). The experimental part compares CNN-based and MLP-based clients on MNIST, F-MNIST, and CIFAR-10 under the UnSplit and FSHA attacks, reporting MSE, FID, and accuracy.","tokens_in":23809,"tokens_out":8199,"duration_ms":81614,"significance":"If the main claim were correct, the paper would identify a simple, utility-preserving architectural defense against two important black-box feature reconstruction attacks, and its proposal to evaluate reconstruction quality with FID rather than MSE is a useful methodological point. The paper also deserves credit for releasing code, testing standard attack implementations, and including additional ablations (SmallMLP and class-wise MSE) in the appendix. However, the central theoretical statement is substantially overclaimed as written: the no-prior impossibility result does not hold in the stated generality, the proof of Corollary 1 is internally inconsistent, and the experimental evidence on CIFAR-10 partially points against the paper's narrative. The empirical phenomenon may still hold under a more carefully stated threat model, but the current version does not establish the advertised result.","major_comments":[{"comment":"Corollary 1 is false as stated. If the server knows the first-layer weight matrix W1 and W1 is invertible, then from the transmitted activations H1 = X W1 it computes X_hat = H1 W1^{-1} = X exactly, with no data prior. The proof's 'client performs an orthogonal transformation leading to tilde X' changes the data without the corresponding weight rotation from Lemma 1; under the Lemma 1 pair (tilde X = XU, tilde W1 = U^T W1), the same computation recovers X because tilde X tilde W1 = X W1. Thus the non-recoverability claim holds only under Lemma 2's additional assumption that the client secretly applies an orthogonal transformation before W1, an assumption absent from the abstract and Contribution 1. This is load-bearing: the headline 'cannot succeed without knowledge of the prior' is not supported.","section":"Section 3.2, Corollary 1 (also abstract and Contribution 1)"},{"comment":"Lemma 2's positive result depends crucially on the client inserting a non-trainable secret orthogonal matrix before W1. With that assumption, the server knowing W1 can recover only XU, i.e., the data up to an unknown orthogonal transformation. This is an active defense mechanism and a change of threat model, not merely a consequence of using a dense layer. The abstract and Section 3.3 nevertheless state the conclusion as 'MLP-based models are resistant' without this precondition. The experiments never let the server know W1, so they do not test the Corollary 1 scenario; this gap should be acknowledged and the theoretical claims restated to match the assumptions actually used.","section":"Section 3.2, Lemma 2 and Remark 3"},{"comment":"The CIFAR-10 row contradicts the resistance narrative under the paper's preferred metric. The MLP-Mixer client has FID 423 versus 455 for the CNN client; since lower FID means closer to the real data distribution, the reconstructed CIFAR-10 images are at least as good for the MLP-Mixer as for the CNN, even though the MSE in image space is much higher (1.398 vs 0.056). On F-MNIST, the CNN has lower MSE (0.37 vs 0.19) and much lower FID (169 vs 361), so those two metrics agree there, but on CIFAR-10 they disagree sharply. The paper should report reconstructions and per-class FID values for CIFAR-10 and explain how the MLP-Mixer result supports the claim that the attack fails.","section":"Section 4, Table 1"},{"comment":"There is an inconsistency between the main text and the appendix about the architectures used in the headline experiments. Section 4.1 states that 'the client's part holds only one-layer model,' while Appendix C states that the MLP used for MNIST and F-MNIST is a four-layer MLP with ReLU activations. Since Lemma 1 applies only to a one-layer linear model and Lemma 3 applies to general networks with a linear cut layer, it matters which theoretical result is being tested by which experiment. The paper should report the exact client architectures used for each figure and table, and clarify which rows of Table 1 correspond to one-layer versus multi-layer clients. This is also relevant to the utility claim, because the SmallMLP one-layer client achieves much lower accuracy (92.6% vs 98.5% on MNIST), so the utility-preservation argument relies on the deeper MLP.","section":"Section 4.1 and Appendix C"},{"comment":"Contribution 1 states that orthogonal transformations 'do not affect convergence for Adam-like algorithms,' but Section 3.2 and Example 1 in Appendix A.4.1 explicitly show that Adam can converge to a local minimum after an orthogonal transformation for a non-convex function. The convergence result in Lemmas 4-6 is proved only under the PL condition together with L-smoothness and bounded-gradient assumptions. The contribution should be restated to say that convergence is preserved under those conditions, not unconditionally.","section":"Contribution 1 and Appendix A.4.1"}],"minor_comments":[{"comment":"The paper contains several typos: 'continually many' should be 'continuum many' in Lemmas 1 and 3; 'tif' appears in Lemma 2; 'descrepancy' in Appendix A.4.2; 'isotopic' should be 'isotropic' in Appendix A.5; 'MNSIT' in Appendix C; and 'depence' in the caption of Figure 7.","section":"Throughout"},{"comment":"The notation in the proof has minor issues: the base case writes H1 = X1W1 = X1U U^T W1 = tilde X1 tilde W1, but the order of U and U^T should be checked; more importantly, the proof should state whether the same mini-batch indices are used for Xk and tilde Xk at every step, since SGD with random reshuffling could break the inductive coupling.","section":"Section 3.2, Lemma 1 proof"},{"comment":"The Cut Layer Lemma proof demonstrates equality of transmitted activations for the first two iterations and then concludes the proof. For a fully rigorous statement, an induction step for all k should be written out, and the argument that the gradient with respect to the preceding-layer parameters theta remains identical should be presented more explicitly.","section":"Section 3.3, Lemma 3 proof"},{"comment":"The paper mentions that the original UnSplit reconstruction degraded for deeper cut layers and that comparisons were therefore run with cut layer = 1, but it does not report how many hidden layers the client-side model has in that setting. Please state clearly whether the four-layer MLP's cut layer is after the first layer or after all four layers, since this affects the relevance of Lemma 3.","section":"Section 4.1, UnSplit setup"},{"comment":"The FSHA figures show reconstructed images but no quantitative FID or MSE for the FSHA attack in the main text; Table 1 only covers UnSplit. Adding FSHA-specific numbers would make the resistance claim easier to verify.","section":"Section 4.2, FSHA experiments"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely and practically relevant question, and the empirical phenomenon may well be real under the correct threat model. However, the central theoretical claim in the abstract and Contribution 1 is not correct as stated: the server-knows-W case permits exact recovery, and the proof of Corollary 1 conflates the untransformed and transformed weight matrices. The authors need to either restrict the impossibility claim to the secret-orthogonal-preprocessing setting or remove the 'no prior needed' phrasing, and they should reconcile the CIFAR-10 FID results with the resistance claim. The architectural inconsistency between Section 4.1 and Appendix C should also be fixed. I see this as a major revision rather than a rejection, because the experimental setup and code release provide a basis for a revised, more carefully scoped claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Plainly: the paper has a real empirical result buried under a theoretical claim that doesn't survive contact with linear algebra. The new thing here is the systematic evaluation of UnSplit and FSHA against dense-layer clients, showing both attacks fail when the cut layer is right after a linear layer, with code shipped. That is worth knowing; prior attack papers only demonstrated against CNNs. The orthogonal-invariance observation (Lemma 1) is simple and partly anticipated by [84], but the paper adds a correct correction about Adam and a clean Cut Layer Lemma.\n\nNow the soft spots. The abstract's claim that reconstruction cannot succeed without a data prior is false as stated. For one-layer linear client H = XW; a server that knows W, with W invertible, computes X = H W^{-1} exactly, no prior. Corollary 1 tries to block this but its proof assumes the client applied a secret orthogonal transform before W1. That is exactly Lemma 2's assumption, and it is not part of the abstract's categorical statement. Non-recoverability requires the secret rotation; otherwise the server's knowledge of W is enough. The reader's stress-test note is right, and it is not a nitpick—it is the paper's headline claim.\n\nSecond, the experiments are thinner than the abstract suggests. The main results use a one-layer dense client (cut layer=1), not multi-layer MLPs. Appendix C mentions a four-layer MLP, but Table 1 is built on the one-layer setting. And the CIFAR-10 FID numbers point the wrong way: MLP-Mixer gives FID 423 vs CNN 455, i.e., the attack against the MLP-Mixer produced more realistic images than against the CNN. The paper does not address that. Also, they could not reproduce UnSplit beyond cut layer=1, which should be stated as a limitation rather than hidden in Sec 4.1.\n\nTo be fair, the black-box attack setting in the experiments assumes the server does not know the client weights. In that setting the empirical resistance of dense layers may be real, and that is the useful contribution. The fix is to narrow the theoretical claim to the black-box setting or to the secret-rotation model, and to add multi-layer dense client experiments with a careful FID analysis.\n\nRecommendation: This deserves a serious referee. The question matters, the empirical effect is worth testing, and the paper is honest enough to ship code and discuss limitations. But I would not accept it in current form. The theoretical core needs rewriting and the experiments need to match the claim. If the authors can do that, this could be a solid privacy paper.","headline":"Useful empirical observation about dense-layer clients resisting UnSplit/FSHA, but the headline theoretical claim is false as stated; needs a major rewrite around the black-box setting.","tokens_in":24366,"tokens_out":3713,"would_cite":false,"duration_ms":34984,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that feature reconstruction attacks in split learning cannot succeed without a prior distribution on the data, and that MLP-based client architectures stop the state-of-the-art attacks without any defense mechanism.","keywords":["vertical federated learning","split learning","feature reconstruction attack","model inversion","feature-space hijacking","MLP privacy","orthogonal transformation","Fréchet inception distance"],"falsifier":"Run the one-layer linear client setup with no secret orthogonal pre-transformation, hand the server the trained first-layer weight matrix $W$ after training, and have it compute $X = H W^{-1}$ from the transmitted activations; exact recovery of the original images would falsify the paper's unconditional no-prior claim. A second falsifier is any feature reconstruction attack that succeeds against an MLP-based client while knowing no prior on the data.","tokens_in":23321,"feed_emoji":"🔒","tokens_out":8370,"duration_ms":77928,"temperature":0.7,"pith_summary":"Vertical federated learning protects raw data by having each client send only intermediate activations to the server. This paper argues that those activations are safe from feature reconstruction attacks unless the attacker already knows the data distribution. The argument turns on a symmetry: for a one-layer linear client, replacing the data $X$ by $XU$ and the weights $W$ by $U^\\top W$ produces exactly the same training protocol, so infinitely many distinct datasets look identical to the server. The paper then shows experimentally that replacing CNN clients with MLP-based clients makes the UnSplit and Feature-space Hijacking attacks fail on MNIST, Fashion-MNIST, and CIFAR-10, while model accuracy stays roughly the same. If the claim is right, architectural choice alone, with no added noise, obfuscation, or cryptography, can protect client features in split learning.","feed_headline":"MLP-based clients defeat feature-stealing attacks in split learning","feed_subtitle":"Dense layers before the cut layer block feature reconstruction, even against an attacker with public data.","key_machinery":"The load-bearing object is the orthogonal-transformation equivalence class $\\{XU, U^\\top W\\}$: rotating the client data and correspondingly rotating the weight initialization, or applying a non-trainable orthogonal pre-multiplication before the first layer, leaves the transmitted activations $H = XW$ invariant under GD and SGD updates. This makes the server unable to distinguish among a continuum of datasets, so reconstruction without a prior distribution is impossible. For Adam-like optimizers the exact invariance breaks, but the paper proves convergence to the same optimal value under a Polyak-\\Lojasiewicz condition. In the experimental setting, dense layers before the cut layer instantiate the relevant non-invertibility: unlike a convolution, a dense linear map's weight matrix can absorb a general orthogonal factor, so the mapping from data to activations is not invertible from activations alone.","core_discovery":"The paper's central claim is that feature reconstruction attacks in two-party split learning cannot succeed without prior knowledge of the data distribution, and that a simple architectural choice, using dense (MLP) layers rather than convolutional layers on the client side, is enough to block the current state-of-the-art attacks. The theoretical core is Lemma 1: for a one-layer linear client model updated by GD or SGD, every orthogonal transformation of the data and the matching rotation of the weight initialization yield identical activations at every training step. Hence the server sees exactly the same protocol for infinitely many datasets and cannot single out the real $X$. A Cut Layer Lemma extends the indistinguishability to activations before the cut layer. Experimentally, the paper reports that UnSplit and Feature-space Hijacking fail on MNIST, Fashion-MNIST, and CIFAR-10 when the client is an MLP or MLP-Mixer, with near-identical activations in the hidden space but unusable reconstructions in image space, while accuracy remains close to the CNN baseline.","pith_inferences":["The guarantee is equivalence-class privacy rather than absolute secrecy: if the server ever learns the client's first-layer weight matrix $W$ and $W$ is invertible, it can compute $X = H W^{-1}$ directly, so the no-prior claim implicitly assumes $W$ stays hidden or that a secret orthogonal pre-transformation is applied.","A practical, testable extension suggested by the argument is to prepend a fixed random orthogonal matrix to a dense client layer; because the server cannot separate $X$ from $XU$, this could harden even CNN-based clients at the cost of a few extra parameters.","Re-running existing attack and defense comparisons with FID instead of MSE could change reported privacy rankings, since the paper shows that MSE can understate or overstate reconstruction quality in opposite directions.","The argument implies that any client architecture beginning with dense layers, such as transformers or MLP-Mixers, should inherit the protection for continuous-input tasks, though the authors note their continuous-input argument does not directly transfer to discrete NLP inputs."],"forward_implications":["Switching client-side CNNs to MLP-based architectures should neutralize UnSplit and Feature-space Hijacking attacks in split learning without degrading the main-task accuracy.","A server with no prior on the client's data distribution cannot recover original features from cut-layer activations, even for a single-layer linear client, because orthogonal rotations of data and weights are indistinguishable.","The same reasoning protects pre-cut-layer activations: even if the server has a prior on the raw data, it can at best recover activations up to an orthogonal transformation.","The exact training-protocol invariance holds for GD and SGD, while Adam-like optimizers converge to the same optimum under a PL condition, so the protection is not tied to one optimizer.","Reconstruction quality should be evaluated with FID rather than MSE, since MSE can be lower for worse reconstructions, as observed on Fashion-MNIST."],"supporting_citations":[{"why":"Supplies the UnSplit model inversion attack whose failure on MLP clients is the paper's main experimental evidence.","marker":"[11]"},{"why":"Supplies the Feature-space Hijacking attack, whose public-dataset prior the paper argues is necessary and which also fails on MLP clients.","marker":"[56]"},{"why":"Defines Adam, the optimizer whose exact rotation invariance is shown to break but whose convergence to the same optimum is proved under a PL condition.","marker":"[36]"},{"why":"Provides the bounded-gradient analysis style the paper adapts for the Adam convergence argument under orthogonal transformations.","marker":"[8]"},{"why":"Defines the FID metric the paper uses to argue that MSE misrepresents reconstruction quality.","marker":"[28]"},{"why":"States a related orthogonal-transformation remark about split learning that the paper identifies as incorrect for Adam and RMSprop.","marker":"[84]"},{"why":"Provides the MLP-Mixer architecture used to test dense-layer clients on CIFAR-10.","marker":"[71]"},{"why":"MNIST dataset used to demonstrate UnSplit and FSHA failure on MLP clients.","marker":"[39]"},{"why":"Fashion-MNIST dataset used to demonstrate the attacks' failure and the MSE versus FID discrepancy.","marker":"[80]"},{"why":"CIFAR-10 dataset used with MLP-Mixer to show dense-layer resistance extends beyond simple digit images.","marker":"[38]"}],"fun_headline_variants":["Dense layers defeat feature reconstruction in split learning","MLP blocks feature attacks in vertical federated learning","Simple MLP shift fends off feature-stealing in VFL","MLP-based clients resist feature reconstruction attacks","Dense clients stymie reconstruction attacks in split learning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The result depends on the attacker not knowing the client's first-layer weights; if the attacker learns those weights and they form an invertible matrix, it can recover the data directly from the activations, so the no-prior claim no longer holds.","fun_headline_variants_meta":{"raw":{"variants":["Dense layers defeat feature reconstruction in split learning","MLP blocks feature attacks in vertical federated learning","Simple MLP shift fends off feature-stealing in VFL","MLP-based clients resist feature reconstruction attacks","Dense clients stymie reconstruction attacks in split learning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000204,"raw_usage":{"total_tokens":1341,"prompt_tokens":846,"completion_tokens":495,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":462,"completion_tokens_details":{"reasoning_tokens":418}},"tokens_in":462,"tokens_out":495,"duration_ms":5059,"temperature":1.0,"reasoning_tokens":418,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:40:45.877776+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the one-layer linear client setup with no secret orthogonal pre-transformation, hand the server the trained first-layer weight matrix $W$ after training, and have it compute $X = H W^{-1}$ from the transmitted activations; exact recovery of the original images would falsify the paper's unconditional no-prior claim. A second falsifier is any feature reconstruction attack that succeeds against an MLP-based client while knowing no prior on the data.","supporting_citations":[{"cited_title":"Unleashing the tiger: Inference attacks on split learning, 2021","cited_arxiv_id":null,"evidence_quote":"Supplies the Feature-space Hijacking attack, whose public-dataset prior the paper argues is necessary and which also fails on MLP clients."},{"cited_title":"Gans trained by a two time-scale update rule converge to a local nash equilibrium","cited_arxiv_id":null,"evidence_quote":"Defines the FID metric the paper uses to argue that MSE misrepresents reconstruction quality."},{"cited_title":"Feature reconstruction attacks and countermeasures of dnn training in vertical federated learning, 2022","cited_arxiv_id":null,"evidence_quote":"States a related orthogonal-transformation remark about split learning that the paper identifies as incorrect for Adam and RMSprop."},{"cited_title":"Mlp-mixer: An all-mlp architecture for vision, 2021","cited_arxiv_id":null,"evidence_quote":"Provides the MLP-Mixer architecture used to test dense-layer clients on CIFAR-10."},{"cited_title":"Learning multiple layers of features from tiny images","cited_arxiv_id":null,"evidence_quote":"CIFAR-10 dataset used with MLP-Mixer to show dense-layer resistance extends beyond simple digit images."}],"review_version":1}