Pith. sign in

REVIEW 4 major objections 6 minor 68 references

SafeSplit: A Novel Defense Against Client-Side Backdoor Attacks in Split Learning (Full Version)

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SafeSplit claims a split-learning server can catch client-side backdoors by checking each backbone checkpoint's frequency signature and rotational motion, then rolling back to the latest benign checkpoint.

desk verdict A useful first defense against client-side backdoors in U-shaped split learning, with broad empirical support for the attacks it tests, but the universal mitigation claim rests on an unproven assumption that backdoors must disturb the server-side backbone. read the letter →

arxiv 2501.06650 v2 pith:D4N3T2TX submitted 2025-01-11 cs.CR cs.DCcs.LG

Phillip Rieger , Alessandro Pegoraro , Kavita Kumari , Tigist Abera , Jonathan Knauer , Ahmad-Reza Sadeghi This is my paper · ORCID
classification cs.CRcs.DCcs.LG
keywords splitlearningbackdoorattacksclient-sidepoisoningfrequency-domainanalysisrotationaldistanceanomalydetectionmodelrollbackdistributeddeep
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SafeSplit is a server-side defense for U-shaped split learning, where clients keep the network's head and tail and the server holds the backbone. After each client finishes training, SafeSplit scores the recent backbone checkpoints in two ways: a static score measures Euclidean distances between low-frequency DCT representations of consecutive updates, and a dynamic score measures how much parameter orientation rotates between training steps. A checkpoint is treated as benign only if it lies in the smallest majority of scores for both metrics; otherwise the server rolls back to the most recent checkpoint that does, so the next client starts from a clean state. The paper claims this is the first defense against client-side backdoor attacks in split learning and reports that across datasets, architectures, client counts, and adaptive attacks it reduced backdoor accuracy to below 5% while keeping main task accuracy close to the undefended baseline.

What carries the argument

The carrying mechanism is the circular backward-analysis loop over a FIFO of the last $N$ server-side backbone checkpoints, combined with two scoring functions. The static function is the truncated low-frequency DCT update distance $S_t = \mathrm{DCT}_{\mathrm{low}}(B_t - B_{t-1})$, scored by Euclidean distance and summed over the $N/2+1$ nearest neighbors. The dynamic function is the rotational distance metric $RD = \omega/(2\pi)$, built from coordinate-wise angle $\arctan$ of the backbone weights, angular velocity, and pairwise absolute differences of rotational frequencies. The intersection of the two majority sets determines the benign checkpoint, and the newest member of that intersection becomes the base model for the next client.

What would settle it

Train a U-shaped split learning system with ten clients, two of them malicious, where the malicious clients optimize a combined loss that simultaneously minimizes the low-frequency DCT distance and the rotational distance of their backbone updates to a benign reference while still maximizing backdoor accuracy; if those poisoned checkpoints enter the benign majority for several consecutive rounds and the final model's backdoor accuracy exceeds 5%, SafeSplit's separation claim is refuted.

Watch

Extended reading notes

Core claim

The central claim is that poisoning a shared U-shaped split-learning model necessarily disturbs the server-side backbone in a way that ordinary training does not, and that two complementary measurements expose that disturbance. The static measurement takes the difference between consecutive backbone states, applies a 2-D discrete cosine transform, keeps only low frequencies, and computes pairwise Euclidean distances; the dynamic measurement computes an angular displacement $\theta(t)=\arctan(B_t)$, an angular velocity $\omega(t)=(\theta(t)-\theta(t-1))/\Delta t$, and a rotational frequency $RD=\omega(t)/(2\pi)$, then compares these across checkpoints. A checkpoint is judged benign only if it is among the $N/2+1$ closest under both scores. When a poisoned checkpoint is found, SafeSplit does not discard the client permanently; it re-examines the FIFO history of backbones and installs the most recent checkpoint that passes both tests, so subsequent benign clients never train on the poisoned state. The paper's evidence is its evaluation: in every experiment the backdoor accuracy fell below 5%, often to 0%, while main task accuracy stayed close to the no-defense baseline.

Load-bearing premise

The defense assumes that a backdoor attack must change the server-side backbone enough that the poisoned checkpoint stands out from benign training in low-frequency DCT distance or rotational distance; if an attacker can produce poisoned updates that look benign on both scores, the majority vote has nothing to separate.

Editorial extensions

If this is right

  • In a U-shaped split learning system with a benign majority of clients, the server can prevent a poisoned backbone from propagating to later clients by rolling back to the latest checkpoint that passes both the frequency and rotation tests.
  • Backdoor accuracy is driven below 5% across pixel-trigger and semantic-trigger attacks on CIFAR-10, MNIST, FMNIST, CIFAR-100, and GTSRB, with different client numbers, data distributions, and poisoned model rates.
  • Adaptive adversaries who know the defense and add loss constraints that minimize the rotational or DCT distance to a reference model are still detected, because the optimizer must trade off hiding the poison against implanting it.
  • When no attack is present, SafeSplit does not loop forever or remove clients permanently; the paper measures only a modest main-task accuracy drop of about 2.7 percentage points after 50 rounds compared to training without any defense.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A would-be evader must now look unlike a backdoor under two orthogonal statistics at once while still redirecting predictions; forcing that trade-off is the real security contribution, and it suggests that future attacks will need to hide poison in the client-held head and tail across multiple sequential clients rather than in the backbone.
  • Since the paper's separation is empirical rather than proven, an adversary with full knowledge of both score functions and a benign reference checkpoint could try to optimize the combined evasion loss directly; whether such a model remains detectable is a testable open question.
  • The circular rollback pattern of scoring a sliding window of chained model states and rewinding to the newest trusted one applies beyond split learning to any sequential training pipeline where a coordinator stores checkpoints, including sequential fine-tuning or model handoff between parties.
  • The paper's appendix notes that the score gap between benign and poisoned checkpoints shrinks as main-task accuracy converges, so stopping training at convergence matters; an attacker operating in the late, low-gap regime is the most plausible challenge to the defense.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes SafeSplit, a server-side defense against client-side backdoor attacks in U-shaped split learning. The server keeps a sliding window of the last N backbone states; after each client's training it computes two anomaly scores for every state in the window: a static score based on the Euclidean distance between low-frequency 2D-DCT representations of backbone updates, and a dynamic score based on a newly introduced rotational distance metric derived from angular displacement, angular velocity, and rotational frequency. The defense defines a benign majority as the intersection of the N/2+1 smallest-score sets under the two metrics, rolls back to the most recent backbone state in that intersection, and instructs the next client to use the corresponding head and tail. The evaluation covers five datasets, several architectures, varying client counts, IID rates, poisoned-model rates, poisoned-data rates, and several adaptive attacks, including loss-constraint variants and a tail-only attack; the authors report backdoor accuracy below 5% in all experiments while largely preserving main-task accuracy.

Significance. If the security claim holds, SafeSplit is a meaningful first step toward backdoor defenses in U-shaped split learning. Its strengths are that it is deployable solely on the server, addresses the sequential-training challenge with a rollback mechanism, and is evaluated extensively across datasets, architectures, client counts, data distributions, and adaptive adversaries. The frequency/rotation dual analysis is a plausible heuristic, and the runtime measurements in Appendix G indicate scalability. However, the defense is an empirically evaluated heuristic rather than a derived guarantee; the central claims of universality and of backbone-essentiality for backdoor injection are not supported by the experiments as reported. The lack of code release, unspecified DCT cutoff, and absence of repeated-run statistics further limit the strength of the empirical claims.

major comments (4)
  1. [§V-C, Eq. (2), Alg. 1 line 10] The claim in §VII that “changing the backbone is essential for injecting the backdoor” is not demonstrated and is in tension with the threat model of §III-B, which gives the adversary full control over the head, tail, smashed data, gradients, and loss. The tail-only attack evaluated in §VI-E is not a test of a head-embedded backdoor: in that experiment the malicious client still uses the server for forward propagation on poisoned batches and only skips backpropagation, so the backbone and head are trained only on clean data and the backbone is genuinely benign. An in-scope adversary could instead train or replace the head so that triggered inputs produce smashed data that the benign backbone maps to the target class, while leaving the backbone parameters untouched. SafeSplit inspects only backbone states, so such an attack would yield benign-looking DCT and rotational scores, and the rollback would preserve the malicious head. No experiment in §VI covers this adversary, so the headline claim that SafeSplit “was always able to mitigate the backdoor” is not supported for the stated threat model. I ask for a concrete experiment with a head-embedded attack or, alternatively, an explicit narrowing of the adversarial scope.
  2. [§V-C, Eq. (2), Alg. 1 line 10] The DCT low-frequency cutoff is never specified. Equation (2) writes St = DCTlow(Bt − Bt−1), but the paper does not state which coefficients (e.g., a top-left k×k block, or a fraction of the coefficient vector) are retained, nor how cutoff choices affect the distances in Eq. (3). Since this is a free parameter of the detection procedure, the static-analysis component is not reproducible, and the reader cannot assess whether the reported benign/malicious separation is robust or tuned. Please specify the cutoff and include a sensitivity analysis over reasonable values.
  3. [§V-D and App. H] The rotational distance construction contains several ad-hoc steps—computing row and column means, multiplying them with the 2D weight matrix to form x/y coordinate vectors, applying arctan, computing ω(t)/2π, and finally summing absolute pairwise differences. The main text never specifies the pairwise summation that App. H introduces, and no ablation or alternative—such as cosine similarity or angle between flattened gradient vectors—is provided to justify these specific choices. Because the rotational metric is one of the two load-bearing detection signals, this under-specification and lack of justification is a substantive reproducibility and evidentiary issue.
  4. [§VI, Tables II–VI] The evaluation reports no standard deviations, no error bars, and no information about random seeds or repeated runs. Since the paper's universal claim is that SafeSplit “was always able to mitigate the backdoor” and reduced BA below 5% in all experiments, the near-threshold result for FMNIST (BA 3.4% in Table II) makes the absence of repeated-run statistics load-bearing. Please provide means and variances over multiple seeds, or otherwise state the number of runs behind each reported number.
minor comments (6)
  1. [Alg. 1, lines 12 and 16] The PSmallestMajority function returns a sorted list of the N/2+1 smallest values, but lines 12 and 16 assign this list to Ei and Ri, whereas the text describes the score as a sum of distances. Please clarify whether the score is the sum or the list, and make the pseudocode consistent.
  2. [Alg. 1, line 19] The intersection of rotationmajority and frequencymajority could in principle be empty, in which case the loop at line 20 finds no benign checkpoint; the paper does not specify the fallback behavior for this case.
  3. [§V-D, Eq. (4)] Equation (4) writes arctan(Bt) for a tensor-valued backbone, while Appendix H defines θ(t) = arctan(Bx_t, By_t) with coordinate-wise meaning. The notation should be made precise and consistent.
  4. [Appendix H] The sentence “the obtained two 2D matrices are flattened to construct the x- and y-coordinate vectors Bx_t and By_t” is unclear about how the row/column mean vectors are multiplied with the 2D matrix, and what the resulting dimensions are. A concrete example or explicit algebra would help reproducibility.
  5. [§VI-F, Fig. 7] The comparison with FreqFed, KRUM, and differential privacy would be more informative if the authors reported the parameter settings used for those baselines, since small changes in their hyperparameters can significantly alter their effectiveness.
  6. [General] The paper does not mention whether code or configurations will be released; for a defense paper, providing the implementation is important for reproducibility and for verifying the security claims.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SafeSplit's detection metrics and majority rule are not fitted to the evaluation data, and its empirical claims do not reduce to self-citations.

full rationale

SafeSplit does not contain a derivation chain in which a predicted quantity is defined in terms of the data used to evaluate it. The two detection scores are computed from server-side backbone states (DCT of updates, Eqs. 2-3; rotational distance, Eqs. 4-6) and combined by a fixed majority rule N/2+1 taken from the threat model, not learned or fitted to the evaluation set. The static-analysis rationale cites both external spectral-bias results [40], [61] and FreqFed [14]; although FreqFed shares authors, it is peer-reviewed and the present SL rollback and rotational metric are tested against held-out trigger sets independently of FreqFed's fitted values. The paper's statement that SafeSplit 'was always able to mitigate the backdoor attack and reduced in all experiments the BA to less than 5%' is an empirical summary of experiments, not a quantity forced by construction. The weakest point—the unsupported assertion in Section VII that 'changing the backbone is essential for injecting the backdoor'—is a threat-model coverage and robustness limitation (e.g., head-embedded backdoors are not tested), not a circularity in the sense of a result being equivalent to its input.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the empirical separability of poisoned and benign backbone states, not on a proven bound. The defense uses two heuristic scores with no learned thresholds, but it depends on an unspecified DCT low-frequency cutoff and an ad hoc coordinate construction for the rotational metric. The ledger lists these hand-chosen components and the domain assumptions about the adversary and the SL protocol.

free parameters (2)
  • DCT low-frequency cutoff = not specified
    Equation (2) uses DCTlow of the backbone update, but the number of retained low-frequency coefficients is never stated; all frequency scores depend on this hand-chosen quantity.
  • Rotational coordinate construction = ad hoc vectors Bx_t, By_t
    Appendix H builds x and y coordinate vectors by multiplying row and column means into the reshaped tensor before applying arctan; this choice is not derived from optimization or geometry and directly determines theta, omega, and RD.
assumptions (5)
  • domain assumption The majority of clients (at least N/2+1 of N) are benign.
    Stated in Section III-B; the majority intersection in Algorithm 1 selects benign states by assuming a benign majority in every FIFO window.
  • domain assumption Injecting a backdoor requires significant changes to the server-side backbone that differ from benign training dynamics.
    Section IV states that backdoor behavior contradicts benign behavior and therefore significant changes need to be applied by the attacker; both detection metrics depend on this separation.
  • domain assumption Low-frequency DCT components capture anomalous model updates because early training primarily changes low frequencies.
    Section IV and Appendix C invoke prior work on spectral bias to justify Equation (2).
  • ad hoc to paper The rotational coordinate construction (row and column mean multiplication followed by arctan) measures meaningful orientation shifts in parameter space.
    Appendix H defines this transformation without deriving it from optimization or geometry; the RD metric is built entirely on this equivalence.
  • domain assumption The server can obtain the head and tail corresponding to a benign backbone checkpoint.
    Section V-B notes that in the default protocol head and tail are forwarded client-to-client and SafeSplit can be straightforwardly adapted to server-mediated forwarding; rollback to H_c and T_c requires this access.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SafeSplit: A Novel Defense Against Client-Side Backdoor Attacks in Split Learning (Full Version)." pith.science (2026). https://pith.science/paper/D4N3T2TX

@misc{pith2026250106650,
  author       = {Pith},
  title        = {Pith review of: SafeSplit: A Novel Defense Against Client-Side Backdoor Attacks in Split Learning (Full Version)},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D4N3T2TX}},
  note         = {Machine review of arXiv:2501.06650}
}
read the original abstract

Split Learning (SL) is a distributed deep learning approach enabling multiple clients and a server to collaboratively train and infer on a shared deep neural network (DNN) without requiring clients to share their private local data. The DNN is partitioned in SL, with most layers residing on the server and a few initial layers and inputs on the client side. This configuration allows resource-constrained clients to participate in training and inference. However, the distributed architecture exposes SL to backdoor attacks, where malicious clients can manipulate local datasets to alter the DNN's behavior. Existing defenses from other distributed frameworks like Federated Learning are not applicable, and there is a lack of effective backdoor defenses specifically designed for SL. We present SafeSplit, the first defense against client-side backdoor attacks in Split Learning (SL). SafeSplit enables the server to detect and filter out malicious client behavior by employing circular backward analysis after a client's training is completed, iteratively reverting to a trained checkpoint where the model under examination is found to be benign. It uses a two-fold analysis to identify client-induced changes and detect poisoned models. First, a static analysis in the frequency domain measures the differences in the layer's parameters at the server. Second, a dynamic analysis introduces a novel rotational distance metric that assesses the orientation shifts of the server's layer parameters during training. Our comprehensive evaluation across various data distributions, client counts, and attack scenarios demonstrates the high efficacy of this dual analysis in mitigating backdoor attacks while preserving model utility.

Figures

Figures reproduced from arXiv: 2501.06650 by the authors.

Figure 1
Figure 1. Comparison of splitting the Deep Neural Network [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Following existing literature [18], [32], [39], [68], we [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 2
Figure 2. Overview of a Split Learning (SL) system that utilizes data from mobile devices but executes the computation-heavy [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figures from the paper (8 more)
Figure 3
Figure 3. Figure 3: Workflow of SafeSplit to skip or poisoned models based on an analysis of the models in the frequency domain and [PITH_FULL_IMAGE:figures/full_fig_p006_3.png]
Figure 4
Figure 4. Figure 4: Overview of SafeSplit, using the latest backbone model [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: BA and MA for different participant numbers. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: BA and MA for various Poisoned Model Rates (PMRs). [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: Comparison of different state-of-the-art defense tech [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 9
Figure 9. Figure 9: Rotational and Frequency distance scores for an IID [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: Confusion matrix for triggered inputs applied on a [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]
Figure 11
Figure 11. Figure 11: Evaluation times of SafeSplit and its individual [PITH_FULL_IMAGE:figures/full_fig_p018_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

68 extracted references · 55 canonical work pages

  1. [1]

    https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/ PLAW-104publ191.pdf

    Health Insurance Portability and Accountability Act, 1996. https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/ PLAW-104publ191.pdf

    work page 1996

  2. [2]

    https://eur-lex.europa.eu/eli/ reg/2016/679/oj

    General Data Protection Regulation, 2018. https://eur-lex.europa.eu/eli/ reg/2016/679/oj

    work page 2018

  3. [3]

    https://pytorch.org

    Pytorch, 2022. https://pytorch.org

    work page 2022

  4. [4]

    Discrete cosine transform

    Nasir Ahmed, T Natarajan, and Kamisetty R Rao. Discrete cosine transform. IEEE transactions on Computers , 100(1):90–93, 1974

    work page 1974

  5. [5]

    How To Backdoor Federated Learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How To Backdoor Federated Learning. In AISTATS, 2020

    work page 2020

  6. [6]

    VILLAIN: Backdoor attacks against vertical split learning

    Yijie Bai, Yanjiao Chen, Hanlei Zhang, Wenyuan Xu, Haiqin Weng, and Dou Goodman. VILLAIN: Backdoor attacks against vertical split learning. In USENIX Security, 2023

    work page 2023

  7. [7]

    Analyzing federated learning through an adversarial lens

    Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In ICML. PMLR, 2019

    work page 2019

  8. [8]

    Machine Learning with Adversaries: Byzantine Tolerant Gradi- ent Descent

    Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine Learning with Adversaries: Byzantine Tolerant Gradi- ent Descent. In NIPS, 2017

    work page 2017

Show all 68 references
  1. [9]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping

    Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In NDSS, 2021

    2021

  2. [10]

    Provably secure federated learning against malicious clients

    Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Provably secure federated learning against malicious clients. In AAAI Conference on Artificial Intelligence, 2021. 14

    2021

  3. [11]

    Fledge: Ledger-based federated learning resilient to inference and backdoor attacks

    Jorge Castillo, Phillip Rieger, Hossein Fereidooni, Qian Chen, and Ahmad Sadeghi. Fledge: Ledger-based federated learning resilient to inference and backdoor attacks. In ACSAC, 2023

    2023

  4. [12]

    Harrison Smith, and S

    Wen-Hsiung Chen, C. Harrison Smith, and S. C. Fralick. A fast compu- tational algorithm for the discrete cosine transform. IEEE Transactions on communications, 1977

    1977

  5. [13]

    Splitguard: Detecting and mitigating training-hijacking attacks in split learning

    Ege Erdogan, Alptekin K ¨upc ¸¨u, and A Ercument Cicek. Splitguard: Detecting and mitigating training-hijacking attacks in split learning. In Workshop on Privacy in the Electronic Society , 2022

    2022

  6. [14]

    Freqfed: A frequency analysis- based approach for mitigating poisoning attacks in federated learning

    Hossein Fereidooni, Alessandro Pegoraro, Phillip Rieger, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. Freqfed: A frequency analysis- based approach for mitigating poisoning attacks in federated learning. In NDSS, 2024

    2024

  7. [15]

    Label inference attacks against vertical federated learning

    Chong Fu, Xuhong Zhang, Shouling Ji, Jinyin Chen, Jingzheng Wu, Shanqing Guo, Jun Zhou, Alex X Liu, and Ting Wang. Label inference attacks against vertical federated learning. In USENIX Security, 2022

    2022

  8. [16]

    Focusing on pinocchio’s nose: A gradients scrutinizer to thwart split-learning hijacking attacks using intrinsic attributes

    Jiayun Fu, Xiaojing Ma, Bin B Zhu, Pingyi Hu, Ruixin Zhao, Yaru Jia, Peng Xu, Hai Jin, and Dongmei Zhang. Focusing on pinocchio’s nose: A gradients scrutinizer to thwart split-learning hijacking attacks using intrinsic attributes. In NDSS, 2023

    2023

  9. [17]

    The limitations of federated learning in sybil settings

    Clement Fung, Chris JM Yoon, and Ivan Beschastnikh. The limitations of federated learning in sybil settings. In RAID, 2020

    2020

  10. [18]

    PCAT: Functionality and data stealing from split learning by Pseudo-Client attack

    Xinben Gao and Lan Zhang. PCAT: Functionality and data stealing from split learning by Pseudo-Client attack. In USENIX Security, 2023

    2023

  11. [19]

    End-to-end evaluation of federated learning and split learning for internet of things

    Yansong Gao, Minki Kim, Sharif Abuadbba, Yeonjae Kim, Chandra Thapa, Kyuyeon Kim, Seyit A Camtepe, Hyoungshick Kim, and Surya Nepal. End-to-end evaluation of federated learning and split learning for internet of things. arXiv preprint arXiv:2003.13376 , 2020

    2003 arXiv

  12. [20]

    Distributed learning of deep neural network over multiple agents

    Otkrist Gupta and Ramesh Raskar. Distributed learning of deep neural network over multiple agents. Journal of Network and Computer Applications, 116:1–8, 2018

    2018

  13. [21]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE conference on computer vision and pattern recognition , 2016

    2016

  14. [22]

    Backdoor attack against split neural network-based vertical federated learning

    Ying He, Zhili Shen, Jingyu Hua, Qixuan Dong, Jiacheng Niu, Wei Tong, Xu Huang, Chen Li, and Sheng Zhong. Backdoor attack against split neural network-based vertical federated learning. IEEE Transactions on Information Forensics and Security , 2023

    2023

  15. [23]

    Advances and open problems in federated learning

    Peter Kairouz, H Brendan McMahan, Brendan Avent, Aur ´elien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. Foundations and trends® in machine learning, 14(...

    2021

  16. [24]

    Exploit: Extracting private labels in split learning

    Sanjay Kariyappa and Moinuddin K Qureshi. Exploit: Extracting private labels in split learning. In IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) . IEEE, 2023

    2023

  17. [25]

    Mesas: Poisoning defense for federated learning resilient against adaptive attackers

    Torsten Krauß and Alexandra Dmitrienko. Mesas: Poisoning defense for federated learning resilient against adaptive attackers. In CCS, 2023

    2023

  18. [26]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Citeseer, 2009

    2009

  19. [27]

    Baybfed: Bayesian backdoor defense for federated learning

    Kavita Kumari, Phillip Rieger, Hossein Fereidooni, Murtuza Jadliwala, and Ahmad-Reza Sadeghi. Baybfed: Bayesian backdoor defense for federated learning. In IEEE S&P. IEEE Computer Society, 2023

    2023

  20. [28]

    Flairs: Fpga-accelerated inference-resistant & secure federated learning

    Huimin Li, Phillip Rieger, Shaza Zeitouni, Stjepan Picek, and Ahmad- Reza Sadeghi. Flairs: Fpga-accelerated inference-resistant & secure federated learning. arXiv preprint arXiv:2308.00553 , 2023

    2023 arXiv

  21. [29]

    Label leakage and protection in two-party split learning

    Oscar Li, Jiankai Sun, Xin Yang, Weihao Gao, Hongyi Zhang, Junyuan Xie, Virginia Smith, and Chong Wang. Label leakage and protection in two-party split learning. arXiv preprint arXiv:2102.08504 , 2021

    2021 arXiv

  22. [30]

    Federated learning: Challenges, methods, and future directions

    Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions. IEEE signal processing magazine , 37(3):50–60, 2020

    2020

  23. [31]

    Clustering label inference attack against practical split learning

    Junlin Liu and Xinchen Lyu. Clustering label inference attack against practical split learning. arXiv preprint arXiv:2203.05222 , 2022

    2022 arXiv

  24. [32]

    Similarity-based label inference attack against training and inference of split learning

    Junlin Liu, Xinchen Lyu, Qimei Cui, and Xiaofeng Tao. Similarity-based label inference attack against training and inference of split learning. IEEE Transactions on Information Forensics and Security , 2024

    2024

  25. [33]

    Secure split learning against property inference, data reconstruction, and feature space hijacking attacks

    Yunlong Mao, Zexi Xin, Zhenyu Li, Jue Hong, Qingyou Yang, and Sheng Zhong. Secure split learning against property inference, data reconstruction, and feature space hijacking attacks. In European Sym- posium on Research in Computer Security . Springer, 2023

    2023

  26. [34]

    Federated learning: Collabora- tive Machine Learning without Centralized Training Data

    Brendan McMahan and Daniel Ramage. Federated learning: Collabora- tive Machine Learning without Centralized Training Data. Google AI, 2017

    2017

  27. [35]

    Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang

    H. Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning Differentially Private Language Models Without Losing Ac- curacy. In ICLR, 2018

    2018

  28. [36]

    Co, and Emil C

    Luis Mu ˜noz-Gonz´alez, Kenneth T. Co, and Emil C. Lupu. Byzantine- Robust Federated Machine Learning through Adaptive Model Averaging. In arXiv preprint:1909.05125, 2019

    1909 arXiv

  29. [37]

    Discrete cosine transform

    Ahmed Nasir, Natarajan T, and R Rao Kamisetty. Discrete cosine transform. IEEE Transactions on Computers , 1974

    1974

  30. [38]

    Unleashing the tiger: Inference attacks on split learning

    Dario Pasquini, Giuseppe Ateniese, and Massimo Bernaschi. Unleashing the tiger: Inference attacks on split learning. In CCS, 2021

    2021

  31. [39]

    Poirot, Praneeth Vepakomma, Ken Chang, Jayashree Kalpathy-Cramer, Rajiv Gupta, and Ramesh Raskar

    Maarten G. Poirot, Praneeth Vepakomma, Ken Chang, Jayashree Kalpathy-Cramer, Rajiv Gupta, and Ramesh Raskar. Split learn- ing for collaborative deep learning in healthcare. arXiv preprint arXiv:1912.12115, 2019

    1912 arXiv

  32. [40]

    Hamprecht, Yoshua Bengio, and Aaron Courville

    Nasim Rahaman, Aristide Baratin, Devansh Arpit, Felix Draxler, Min Lin, Fred A. Hamprecht, Yoshua Bengio, and Aaron Courville. On the spectral bias of neural networks. In International Conference on Machine Learning, 2019

    2019

  33. [41]

    Crowdguard: Federated backdoor detection in federated learning

    Phillip Rieger, Torsten Krauß, Markus Miettinen, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. Crowdguard: Federated backdoor detection in federated learning. In NDSS, 2024

    2024

  34. [42]

    Safesplit: A novel defense against client-side backdoor attacks in split learning

    Phillip Rieger, Alessandro Pegoraro, Kavita Kumari, Tigist Abera, Jonathan Knauer, and Ahmad-Reza Sadeghi. Safesplit: A novel defense against client-side backdoor attacks in split learning. In NDSS, 2025

    2025

  35. [43]

    Hidden trigger backdoor attacks

    Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor attacks. In AAAI, 2020

    2020

  36. [44]

    Auror: Defending Against Poisoning Attacks in Collaborative Deep Learning Systems

    Shiqi Shen, Shruti Tople, and Prateek Saxena. Auror: Defending Against Poisoning Attacks in Collaborative Deep Learning Systems. In ACSAC, 2016

    2016

  37. [45]

    Manipulating sgd with data ordering attacks

    Ilia Shumailov, Zakhar Shumaylov, Dmitry Kazhdan, Yiren Zhao, Nico- las Papernot, Murat A Erdogdu, and Ross J Anderson. Manipulating sgd with data ordering attacks. NeurIPS, 2021

    2021

  38. [46]

    Very deep convolutional networks for large-scale image recognition

    K Simonyan and A Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR. Computational and Biological Learning Society, 2015

    2015

  39. [47]

    Detailed comparison of communication efficiency of split learning and federated learning

    Abhishek Singh, Praneeth Vepakomma, Otkrist Gupta, and Ramesh Raskar. Detailed comparison of communication efficiency of split learning and federated learning. arXiv preprint arXiv:1909.09145, 2019

    1909 arXiv

  40. [48]

    The german traffic sign recognition benchmark: a multi-class classifica- tion competition

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. The german traffic sign recognition benchmark: a multi-class classifica- tion competition. In International joint conference on neural networks . IEEE, 2011

    2011

  41. [49]

    Going deeper with convolutions

    Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In IEEE conference on computer vision and pattern recognition , 2015

    2015

  42. [50]

    On feasibility of server-side backdoor attacks on split learning

    Behrad Tajalli, O ˘guzhan Ersoy, and Stjepan Picek. On feasibility of server-side backdoor attacks on split learning. In IEEE Security and Privacy Workshops (SPW). IEEE, 2023

    2023

  43. [51]

    Advancements of federated learning towards privacy preser- vation: from federated learning to split learning

    Chandra Thapa, Mahawaga Arachchige Pathum Chamikara, and Seyit A Camtepe. Advancements of federated learning towards privacy preser- vation: from federated learning to split learning. Federated Learning Systems: Towards Next-Generation AI , pages 79–109, 2021

    2021

  44. [52]

    How to prove it: A structured approach

    Daniel J Velleman. How to prove it: A structured approach . Cambridge University Press, 2019

    2019

  45. [53]

    Split learning for health: Distributed deep learning without sharing raw patient data

    Praneeth Vepakomma, Otkrist Gupta, Tristan Swedish, and Ramesh Raskar. Split learning for health: Distributed deep learning without sharing raw patient data. arXiv preprint arXiv:1812.00564 , 2018

    2018 arXiv

  46. [54]

    Flare: defending federated learning against model poisoning attacks via latent space representations

    Ning Wang, Yang Xiao, Yimin Chen, Yang Hu, Wenjing Lou, and Y Thomas Hou. Flare: defending federated learning against model poisoning attacks via latent space representations. In Asia Conference on Computer and Communications Security , 2022

    2022

  47. [55]

    Fast algorithms for the discrete w transform and for the discrete fourier transform

    Zhongde Wang. Fast algorithms for the discrete w transform and for the discrete fourier transform. IEEE Transactions on Acoustics, Speech, and Signal Processing , 1984

    1984

  48. [56]

    Backdoor attacks against deep learning systems in the physical world

    Emily Wenger, Josephine Passananti, Arjun Nitin Bhagoji, Yuanshun Yao, Haitao Zheng, and Ben Y Zhao. Backdoor attacks against deep learning systems in the physical world. In IEEE conference on computer vision and pattern recognition , 2021

    2021

  49. [57]

    Micronnet: A highly compact deep convolutional neural network archi- tecture for real-time embedded traffic sign classification

    Alexander Wong, Mohammad Javad Shafiee, and Michael St Jules. Micronnet: A highly compact deep convolutional neural network archi- tecture for real-time embedded traffic sign classification. IEEE Access, 6:59803–59810, 2018. 15

    2018

  50. [58]

    A study on quantization effects of dct based compression

    Xiao, Wu Xiaolin, and Liu Bolin. A study on quantization effects of dct based compression. IEEE International Conference on Image Processing (ICIP), 2017

    2017

  51. [59]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms, 2017

    Han Xiao, Kashif Rasul, and Roland V ollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms, 2017

    2017

  52. [60]

    DBA: Distributed backdoor attacks against federated learning

    Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. DBA: Distributed backdoor attacks against federated learning. In ICLR, 2020

    2020

  53. [61]

    Training behavior of deep neural network in frequency domain

    Zhi-Qin John Xu, Yaoyu Zhang, and Yanyang Xiao. Training behavior of deep neural network in frequency domain. In International Conference on Neural Information Processing . Springer, 2019

    2019

  54. [62]

    Differentially private label protection in split learning

    Xin Yang, Jiankai Sun, Yuanshun Yao, Junyuan Xie, and Chong Wang. Differentially private label protection in split learning. arXiv preprint arXiv:2203.02073, 2022

    2022 arXiv

  55. [63]

    Robust split federated learning for u-shaped medical image networks

    Ziyuan Yang, Yingyu Chen, Huijie Huangfu, Maosong Ran, Hui Wang, Xiaoxiao Li, and Yi Zhang. Robust split federated learning for u-shaped medical image networks. arXiv preprint arXiv:2212.06378 , 2022

    2022 arXiv

  56. [64]

    How to backdoor split learning

    Fangchao Yu, Lina Wang, Bo Zeng, Kai Zhao, Zhi Pang, and Tian Wu. How to backdoor split learning. Neural Networks, 168:326–336, 2023

    2023

  57. [65]

    Chronic poisoning: Backdoor attack against split learning

    Fangchao Yu, Bo Zeng, Kai Zhao, Zhi Pang, and Lina Wang. Chronic poisoning: Backdoor attack against split learning. In AAAI, 2024

    2024

  58. [66]

    Wide residual networks

    Sergey Zagoruyko. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016

    2016 arXiv

  59. [67]

    Label inference attack based on soft label towards two-party split learning

    Chenchen Zhou, Hongbo Cao, Yingying Zhao, Sicong Zhao, and Yongqi Sun. Label inference attack based on soft label towards two-party split learning. In IEEE International Symposium on Parallel Architectures, Algorithms and Programming (PAAP) . IEEE, 2023

    2023

  60. [68]

    Passive inference attacks on split learning via adversarial regularization

    Xiaochen Zhu, Xinjian Luo, Yuncheng Wu, Yangfan Jiang, Xiaokui Xiao, and Beng Chin Ooi. Passive inference attacks on split learning via adversarial regularization. arXiv preprint arXiv:2310.10483 , 2023. APPENDIX A. Deep Neural Network (DNN) A DNN is a mathematical function de...

    2023 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.