Pith. sign in

REVIEW 4 major objections 6 minor 46 references

P3SL: Personalized Privacy-Preserving Split Learning on Heterogeneous Edge Devices

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read P3SL claims that letting each edge device choose its own split point and noise level reduces privacy leakage and cuts energy consumption by up to 59.12% while keeping accuracy high.

desk verdict A useful real-device split learning system with a circular privacy evaluation; the energy testbed is worth citing, the privacy claims need rework. read the letter →

arxiv 2507.17228 v2 pith:6R4ECUSC submitted 2025-07-23 cs.LG cs.AIcs.DC

Wei Fan , JinYi Yoon , Xiaochang Li , Huajie Shao , Bo Ji This is my paper · ORCID
classification cs.LGcs.AIcs.DC
keywords splitlearningedgecomputingpersonalizedprivacyheterogeneousdevicespointselectionbi-leveloptimizationenergyefficiencymembershipinferenceattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

P3SL is a split-learning framework aimed at the realistic situation where edge devices differ in compute, communication, environment, and privacy needs. The paper's central claim is that each client can pick its own split point and Laplacian noise level, coordinated by a server-side optimizer, and that this personalization lowers privacy leakage and energy use without sacrificing accuracy. The authors support the claim with a testbed of seven devices (Jetson Nano, Raspberry Pi, laptop) and report that P3SL reduces system energy by up to 59.12% relative to SSL and 38.68% relative to ARES, while keeping accuracy at or above these baselines and lowering FSIM-based reconstruction risk. The reason this matters is that it points to a deployable way to train one shared model across heterogeneous IoT devices without forcing all clients into the same split point or revealing their private operating constraints to the server.

What carries the argument

The load-bearing objects are the server-built Privacy Leakage Table (an FSIM lookup over split points $1,\dots,s_{\max}$ and noise levels $0.00$ to $2.50$), the client-built Energy and Power Consumption Table, and the bi-level optimizer that connects them. At the lower level, client $i$ minimizes $\alpha_i\,\mathrm{FSIM}(\sigma_i,s_i)+(1-\alpha_i)E^{\mathrm{total}}_i(s_i)$; at the upper level, the server minimizes $\sum_i \mathrm{FSIM}(\sigma_i,s_i)$ subject to global accuracy $G_{\mathrm{acc}}(\sigma,s)\ge A_{\min}$ and peak power $p^{\mathrm{peak}}_i(s_i)\le P^{\max}_i$. The problem is solved iteratively with a metaheuristic approach. If accuracy falls short of $A_{\min}$, the server applies the noise-reassignment rule $\sigma^{t+1}_i=\sigma^t_i(1-2(A_{\min}-A_t))$ to reduce noise and recover utility. A weighted aggregation step every $R$ epochs, combined with sleep-awake scheduling and no distribution of the aggregated model, carries the communication and energy savings.

What would settle it

Run P3SL with two clients whose private data distributions differ sharply (for example, clinical images versus natural photos), keep the same model and the same split point, and compare the FSIM score of an UnSplit reconstruction from each client's data with the value predicted by the server's public-dataset Privacy Leakage Table at the chosen noise level. The central claim is falsified if the table's predicted FSIM deviates from the measured FSIM by more than the measurement's resolution at that split point, since the chosen protection would then not match the client's actual leakage.

Watch

Extended reading notes

Core claim

On its own terms, the paper establishes a protocol in which the server first profiles a Privacy Leakage Table by running the UnSplit data-reconstruction attack on a public dataset and recording FSIM scores across split points and noise levels, while each client privately profiles its own Energy and Power Consumption Table including peak power limits. The joint choice of split points and noise levels is then posed as a bi-level optimization: the server minimizes total system FSIM subject to a global accuracy floor $A_{\min}$ and each client's peak-power constraint, and each client chooses $s_i$ to minimize $\alpha_i\,\mathrm{FSIM}(\sigma_i, s_i) + (1-\alpha_i)\,E^{\mathrm{total}}_i(s_i)$, where $\alpha_i$ is its private privacy-versus-energy preference. Training proceeds sequentially through clients, with Laplacian noise added to each client's intermediate representation and a weighted aggregation every $R$ epochs that never sends the global model back to clients. The paper's claimed discovery is that this decoupled decision structure yields per-client privacy protection and energy savings while maintaining high global accuracy.

Load-bearing premise

The load-bearing premise is that the server's Privacy Leakage Table, built by attacking a public dataset, transfers to every client's private data because, as the paper asserts, privacy leakage profiling is model-dependent rather than dataset-specific; if a client's data distribution makes reconstruction easier or harder than the public dataset, the chosen split points and noise levels will not deliver the claimed per-client privacy.

Editorial extensions

If this is right

  • A weak, privacy-sensitive device (for example, a home assistant with sensitive data) can use a shallow split with heavy noise, while a stronger, less-sensitive device uses a deep split with light noise, all within one shared training run.
  • The server never learns a client's resource constraints, environmental conditions, or privacy preference $\alpha_i$, so the amount of sensitive metadata disclosed to the server is smaller than in server-assigned heterogeneous split learning.
  • Energy consumption drops because communication-heavy shallow splits are chosen only when privacy needs require them, and because the global model is not distributed back after aggregation.
  • Global accuracy is protected by the server's threshold $A_{\min}$; when noise pushes accuracy below it, the reassignment rule lowers noise until the threshold is met, keeping utility high.
  • With L2 regularization, membership-inference attack accuracy drops to roughly 50 percent (random-guess level) across aligned shadow and target training stages, indicating that the intermediate representations leak little membership information.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The transferability of the server-built Privacy Leakage Table is the juncture most worth probing: comparing FSIM measured on a client's own data with the table's predicted value at the chosen $(s_i,\sigma_i)$ would directly test the model-dependent rather than dataset-specific premise.
  • The reported 59.12% energy reduction bundles three mechanisms—personalized split points, less frequent weighted aggregation without model redistribution, and sleep-awake scheduling—so ablations that isolate each mechanism would show how much of the saving comes from the optimization itself.
  • The noise-reassignment rule $\sigma^{t+1}_i=\sigma^t_i(1-2(A_{\min}-A_t))$ is a fixed heuristic; replacing it with per-client utility-aware schedules could change the accuracy/privacy trade-off and is a natural next experiment.
  • The large-scale simulations show a fixed total privacy budget shared among more clients, which suggests a testable extension: make the privacy budget scale with client count or with each client's data sensitivity.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes P3SL, a split learning framework that lets each client select a personalized split point and Laplacian noise level to balance energy consumption, privacy leakage, and model accuracy under heterogeneous device and environmental conditions. A bi-level optimization is formulated: the server chooses noise levels to minimize total FSIM-based privacy leakage subject to an accuracy threshold, while each client minimizes a weighted sum of energy and FSIM to choose its split point; the solution is implemented with a heuristic iterative noise-reassignment procedure. The system is deployed on a testbed of four Jetson Nanos, two Raspberry Pis, and a laptop, and evaluated on three models and three datasets. The paper claims up to 59.12% energy reduction, lower FSIM privacy leakage, and maintained accuracy compared to SSL, ARES, and ASL baselines.

Significance. If the reported results hold, P3SL would be a useful step toward practical personalized privacy in split learning on heterogeneous edge devices. The paper has real strengths: it builds a physical testbed with seven devices, reports credible per-device energy and power measurements under controlled environmental settings, supports personalized split points and noise levels without requiring clients to disclose privacy constraints to the server, and includes robustness experiments for dynamic client participation and membership inference attacks. The sequential training scheme with weighted aggregation and no inter-client model sharing is a reasonable design. However, the central privacy claim is currently supported by a circular evaluation: FSIM is both the optimized objective and the reported privacy metric, and the privacy table is assumed to transfer across datasets without evidence. The energy comparison is also confounded by sleep-awake scheduling applied only to P3SL. These issues must be fixed before the headline claims can be accepted.

major comments (4)
  1. [Section 4.2, Eqs. (3) and (4a), Tables 4-6] The privacy evaluation is circular. The server builds a Privacy Leakage Table by simulating UnSplit attacks on a public dataset and computing FSIM; the same FSIM values are then minimized in the client objective (Eq. (3)) and in the server's upper-level objective (Eq. (4a)), and finally reported as the privacy outcome in Tables 4, 5, and 6. The near-identical FSIM total values across CIFAR-10, Fashion-MNIST, and Flower-102 (e.g., 2.52, 2.51, and 2.50 for VGG16-BN, ResNet18, and ResNet101, respectively) are consistent with table lookup rather than with independently measured reconstruction attacks on the transmitted representations of each private dataset. To support the claim that P3SL significantly mitigates privacy leakage, the authors must report an independent attack evaluation: run UnSplit (or another reconstruction attack) against the actual noise-injected intermediate representations at the selected (σ_i, s_i) for each dataset, and report FSIM, PSNR, or reconstruction accuracy.
  2. [Section 7 vs. Section 4.2] The transferability assumption underlying the Privacy Leakage Table is unvalidated. Section 7 states that 'privacy leakage profiling is model-dependent rather than dataset-specific,' but Section 4.2 requires the public dataset used for calibration to 'closely match the distribution of the clients' datasets.' These two statements are in tension, and no evidence is provided that FSIM values measured on CIFAR-10 transfer to Fashion-MNIST or Flower-102. Since the selected split points and noise levels are chosen from this table, a mismatch would invalidate the per-client privacy guarantee. At minimum, the authors should measure FSIM from attacks on each private dataset at the chosen operating points, or provide a sensitivity analysis of the Privacy Leakage Table to distribution shift.
  3. [Section 6.1, Baselines; Tables 4 and 5] The energy comparison is not fair across systems. P3SL uses sleep-awake scheduling (Section 6.1) and periodic aggregation every R=5 epochs, while ARES and SSL are evaluated without the same scheduling. The claimed 38.68% and 59.12% energy reductions therefore conflate the benefit of the proposed split-point/noise optimization with the benefit of sleep-awake idle management. Please either apply the same sleep-awake scheduling to all baselines, or ablate P3SL with and without sleep-awake scheduling so that the energy savings attributable to split-point selection alone can be isolated.
  4. [Section 5.2] The bi-level optimization solution is a hand-crafted heuristic without any convergence or optimality guarantee, and Eq. (5) is an ad hoc noise-reassignment rule. Since the paper's central claim is that clients determine optimal personalized split points, the authors should provide at least: (i) a description of the specific meta-heuristic from [19] used and its parameter settings; (ii) an ablation showing the number of iterations needed for convergence and the sensitivity of the final solution to initialization; and (iii) a comparison against exhaustive search over the (σ_i, s_i) grid for a small client set to quantify the suboptimality of the heuristic.
minor comments (6)
  1. [Section 1, Contributions] The word 'deisgn' should be 'design'.
  2. [Section 6.1] The word 'exmaple' should be 'example'.
  3. [Section 6.1, Baselines] ASL appears in Tables 4 and 5 but is not listed among the baselines in Section 6.1; either describe ASL and cite it properly, or remove it from the tables.
  4. [Section 5.2, Eq. (5)] The constant factor 2 in the noise reassignment rule is unexplained; please clarify how it was chosen and whether results are sensitive to it.
  5. [Table 6] The 'FSIM (Before → After)' column should state explicitly that 'Before' and 'After' refer to table values from the Privacy Leakage Table (before and after noise injection), not to independently measured attacks on the actual transmitted representations.
  6. [Section 7, Label Leakage] The sentence 'the threat model considered in this work is not affected by label leakage' needs a one-sentence justification, since labels are transmitted to the server during training.

Circularity Check

1 steps flagged · score 6.0 of 10

Privacy-leakage evaluation is circular: the FSIM values minimized in Eqs. (3)-(4a) are the same tabulated entries reported as the privacy outcome in Tables 4 and 6, so the claimed FSIM-based privacy mitigation is not independently measured.

  1. self definitional [Section 4.2 (Privacy Leakage Table), Eqs. (3) and (4a), Section 6.1 (Evaluation Metrics), Tables 4 and 6]
    "the server simulates data reconstruction attacks on a public dataset to generate the Privacy Leakage Table . ... this table evaluates FSIM for each split point from 1 to smax within a specified noise range (0.00 to 2.50 with 0.05 interval) ... f (σi, si) :=αi · FSIM(σi, si) + (1− αi) · Etotal i (si) ... min σ,s F (σ, s) := N X i=1 FSIM(σi, si) ... The overall system privacy leakage, denoted as FSIM total, is to reflect the whole system’s privacy leakage level, measured by averaging the sum of all clients’ privacy leakage index values over five rounds."

    Eq. (3) and Eq. (4a) optimize over FSIM values stored in the Privacy Leakage Table, which is built by simulating UnSplit attacks once on a public dataset. The reported outcome, 'FSIM total', is defined as the sum of the clients' privacy leakage index values—the same tabulated FSIM entries used in the objective—and Tables 4 and 6 report these values (e.g., 2.52; '0.366 → 0.355' for Client 4) as measured privacy. No reconstruction attack on actual private datasets at the selected (σ_i, s_i) is reported. The claimed FSIM reduction is therefore the value of the objective P3SL was designed to minimize, making the privacy evaluation equivalent to its optimization input by construction.

full rationale

P3SL's energy consumption and accuracy claims are supported by independent testbed measurements (Tables 4-5, Fig. 8), and the MIA experiments (Table 8) provide a non-FSIM privacy signal, so the paper is not wholly circular. The problematic step is confined to the FSIM-based privacy-leakage evaluation: the same Privacy Leakage Table value appears as the optimization objective (Eqs. 3, 4a) and as the reported privacy metric (Tables 4, 6), so the 'significantly mitigates privacy leakage' claim is at least partly a restatement of the objective. The paper's Section 7 assertion that profiling 'is model-dependent rather than dataset-specific' is an important external-validity assumption, but it is a transferability risk rather than a circular step. No load-bearing self-citation was found: [1] is only a preliminary-version pointer, and the cited UnSplit/NoPeekNN/FSIM results are external. Overall score 6: partial circularity in the central privacy claim, with independent energy/accuracy/MIA evidence preventing a higher score.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on hand-chosen coefficients (alpha_i, beta), an ad hoc noise-reassignment rule, and two strong transfer assumptions about profiling tables. No new physical entities are introduced.

free parameters (5)
  • personalized privacy sensitivity coefficient alpha_i = alpha = [0.4, 0.2, 0.5, 0.9, 0.7, 0.3, 0.8]
    Set by hand in Section 6.1 to reflect client preferences; directly controls the split point choice in Eq. (3).
  • accuracy discount factor beta = 0.05
    Set in Section 6.1, defines the acceptable accuracy sacrifice in Eq. (2); no sensitivity analysis is provided.
  • noise reassignment coefficient 2 = 2
    Appears in Eq. (5); this multiplicative update rule is presented without derivation or justification.
  • FSIM threshold T_FSIM = not reported
    Used to build the initial Noise Assignment Table in Section 5.2, but the actual numeric value is not given, making the procedure hard to replicate.
  • aggregation period R = 5 epochs
    Chosen in Section 6.1 without experiments showing how accuracy or energy depend on this value.
assumptions (5)
  • domain assumption FSIM score is a valid proxy for privacy leakage or reconstruction risk.
    The paper uses FSIM as both the optimization objective (Eq. 3, Eq. 4a) and the primary evaluation metric (Tables 4 and 5), assuming it captures the true privacy risk.
  • ad hoc to paper Privacy leakage profiling on a public dataset transfers to client private data.
    Section 7 states that 'privacy leakage profiling is model-dependent rather than dataset-specific', but no evidence is given that FSIM values on public data match those on each client's private distribution.
  • domain assumption Reference accuracy A_ref from a public dataset predicts global model accuracy on real client data.
    Used in Section 4.2 to set the minimum accuracy threshold A_min; it assumes the public dataset 'closely matches the distribution of the clients' datasets'.
  • domain assumption Laplacian noise injected into intermediate representations provides meaningful privacy protection without destroying utility.
    The noise mechanism is borrowed from NoPeekNN and used throughout; the paper does not analyze privacy guarantees, it only measures FSIM under noise.
  • domain assumption Sequential training with periodic weighted aggregation converges to a useful global model.
    The framework relies on the SSL-style sequential pipeline plus Eq. (1) aggregation, but no convergence analysis is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of P3SL: Personalized Privacy-Preserving Split Learning on Heterogeneous Edge Devices." pith.science (2026). https://pith.science/paper/6R4ECUSC

@misc{pith2026250717228,
  author       = {Pith},
  title        = {Pith review of: P3SL: Personalized Privacy-Preserving Split Learning on Heterogeneous Edge Devices},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6R4ECUSC}},
  note         = {Machine review of arXiv:2507.17228}
}
read the original abstract

Split Learning (SL) is an emerging privacy-preserving machine learning technique that enables resource constrained edge devices to participate in model training by partitioning a model into client-side and server-side sub-models. While SL reduces computational overhead on edge devices, it encounters significant challenges in heterogeneous environments where devices vary in computing resources, communication capabilities, environmental conditions, and privacy requirements. Although recent studies have explored heterogeneous SL frameworks that optimize split points for devices with varying resource constraints, they often neglect personalized privacy requirements and local model customization under varying environmental conditions. To address these limitations, we propose P3SL, a Personalized Privacy-Preserving Split Learning framework designed for heterogeneous, resource-constrained edge device systems. The key contributions of this work are twofold. First, we design a personalized sequential split learning pipeline that allows each client to achieve customized privacy protection and maintain personalized local models tailored to their computational resources, environmental conditions, and privacy needs. Second, we adopt a bi-level optimization technique that empowers clients to determine their own optimal personalized split points without sharing private sensitive information (i.e., computational resources, environmental conditions, privacy requirements) with the server. This approach balances energy consumption and privacy leakage risks while maintaining high model accuracy. We implement and evaluate P3SL on a testbed consisting of 7 devices including 4 Jetson Nano P3450 devices, 2 Raspberry Pis, and 1 laptop, using diverse model architectures and datasets under varying environmental conditions.

Figures

Figures reproduced from arXiv: 2507.17228 by the authors.

Figure 1
Figure 1. Comparison of SSL, PSL, and P3SL frameworks: [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Impact of split points on privacy leakage and defense [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Impact of different split points (SP) on energy con [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: System architecture of P3SL: with s of split points and σ of privacy protection (noise) levels, clients generate intermediate representations, inject noise, and upload them to the server for ⃝1 -⃝9 sequential model training. Every R epoch, clients upload their local mo…
Figure 5
Figure 5. Figure 5: An example of profiling tables clients’ datasets. This simulation provides the reference ac￾curacy Aref, as an ideal accuracy baseline. During this phase, the server also fine-tunes the training hyperparameters and shares them with clients to prepare for the following …
Figure 6
Figure 6. Figure 6: Optimal split point selection for different personal [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Adaptability to Varying Network Connections [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Accuracy comparison between P3SL and ARES with [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 37 canonical work pages

  1. [19]

    A review on bilevel optimization: From classical to evolutionary approaches and applications,

    Sinha et al., “A review on bilevel optimization: From classical to evolutionary approaches and applications,” IEEE Transactions on Evolutionary Computation, vol. 22, no. 2, pp. 276–295, 2018

    work page 2018

  2. [1]

    P3sl: Personalized privacy-preserving split learning on heterogeneous edge devices,

    W. Fan, J. Yoon, X. Li, H. Shao, and B. Ji, “P3sl: Personalized privacy-preserving split learning on heterogeneous edge devices,” in 2025 34th International Conference on Computer Communications and Networks (ICCCN), 2025

    work page 2025

  3. [2]

    Asteroid: Resource- efficient hybrid pipeline parallelism for collaborative dnn training on heterogeneous edge devices,

    S. Ye, L. Zeng, X. Chu, G. Xing, and X. Chen, “Asteroid: Resource- efficient hybrid pipeline parallelism for collaborative dnn training on heterogeneous edge devices,” in Proceedings of the 30th Annual International Conference on Mobile Computing and Networking , 2024, pp. 312–326

    work page 2024

  4. [3]

    Deepiot: Compressing deep neural network structures for sensing systems with a compressor-critic framework,

    S. Yao, Y. Zhao, A. Zhang, L. Su, and T. Abdelzaher, “Deepiot: Compressing deep neural network structures for sensing systems with a compressor-critic framework,” in Proceedings of the 15th ACM conference on embedded network sensor systems , 2017, pp. 1–14

    work page 2017

  5. [4]

    Splitfed: When federated learning meets split learn- ing,

    Thapa et al., “Splitfed: When federated learning meets split learn- ing,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 36, no. 8, 2022, pp. 8485–8493

    work page 2022

  6. [5]

    On-device Training: A First Overview on Existing Systems

    S. Zhu, T. Voigt, J. Ko, and F. Rahimian, “On-device training: A first overview on existing systems,” arXiv preprint arXiv:2212.00824 , 2022

    work page Pith review arXiv 2022

  7. [6]

    Distributed learning of deep neural network over multiple agents,

    O. Gupta and R. Raskar, “Distributed learning of deep neural network over multiple agents,” Journal of Network and Computer Applications, vol. 116, pp. 1–8, 2018

    work page 2018

  8. [7]

    Data-free one-shot federated learning under very high statistical heterogeneity,

    C. E. Heinbaugh, E. Luz-Ricca, and H. Shao, “Data-free one-shot federated learning under very high statistical heterogeneity,” in The Eleventh International Conference on Learning Representations , 2023

    work page 2023

Show all 46 references
  1. [8]

    Thapa, M

    C. Thapa, M. A. P . Chamikara, and S. A. Camtepe, Advancements of Federated Learning Towards Privacy Preservation: From Federated Learning to Split Learning. Cham: Springer International Publish- ing, 2021, pp. 79–109

    2021

  2. [9]

    End-to-end evaluation of feder- ated learning and split learning for internet of things,

    Y. Gao, M. Kim, S. Abuadbba, Y. Kim, C. Thapa, K. Kim, S. A. Camtep, H. Kim, and S. Nepal, “End-to-end evaluation of feder- ated learning and split learning for internet of things,” in 2020 International Symposium on Reliable Distributed Systems (SRDS) , 2020, pp. 91–100

    2020

  3. [10]

    Split learning in 6g edge networks,

    Z. Lin, G. Qu, X. Chen, and K. Huang, “Split learning in 6g edge networks,” IEEE Wireless Communications, pp. 1–7, 2024

    2024

  4. [11]

    Vepakomma and R

    P . Vepakomma and R. Raskar, Split Learning: A Resource Efficient Model and Data Parallel Approach for Distributed Deep Learning . Cham: Springer International Publishing, 2022, pp. 439–451

    2022

  5. [12]

    Improving the commu- nication and computation efficiency of split learning for iot appli- cations,

    A. Ayad, M. Renner, and A. Schmeink, “Improving the commu- nication and computation efficiency of split learning for iot appli- cations,” in 2021 IEEE Global Communications Conference (GLOBE- COM), 2021, pp. 01–06

    2021

  6. [13]

    Privacy-sensitive parallel split learning,

    J. Jeon and J. Kim, “Privacy-sensitive parallel split learning,” in 2020 International Conference on Information Networking (ICOIN) . IEEE, 2020, pp. 7–9

    2020

  7. [14]

    Inside the AI care home: the smart tech making old people safer,

    R. Taylor, “Inside the AI care home: the smart tech making old people safer,” The Sunday Times , Nov. 2024. [Online]. Available: https://www.thetimes.com/uk/healthcare/article/ inside-the-ai-care-home-the-end-of-the-human-touch-3l0w083sx? utm source=chatgpt.com&region=global

    2024

  8. [15]

    Ares: Adaptive resource- aware split learning for internet of things,

    E. Samikwa, A. D. Maio, and T. Braun, “Ares: Adaptive resource- aware split learning for internet of things,”Computer Networks, vol. 218, p. 109380, 2022

    2022

  9. [16]

    Adaptive split learning over energy-constrained wireless edge networks,

    Z. Li, W. Wu, S. Wu, and W. Wang, “Adaptive split learning over energy-constrained wireless edge networks,” 2024

    2024

  10. [17]

    Resource- efficient parallel split learning in heterogeneous edge computing,

    M. Zhang, J. Cao, Y. Sahni, X. Chen, and S. Jiang, “Resource- efficient parallel split learning in heterogeneous edge computing,” arXiv preprint arXiv:2403.15815, 2024

    2024 arXiv

  11. [18]

    Unsplit: Data-oblivious model inversion, model stealing, and label inference attacks against split learning,

    E. Erdo ˘gan, A. K ¨upc ¸¨u, and A. E. C ¸ ic ¸ek, “Unsplit: Data-oblivious model inversion, model stealing, and label inference attacks against split learning,” inProceedings of the 21st Workshop on Privacy in the Electronic Society, 2022, pp. 115–124. JOURNAL OF LATEX CLASS ...

    2022

  12. [20]

    Constrained bi-level optimization: Proximal lagrangian value function approach and hessian-free algorithm,

    W. Yao, C. Yu, S. Zeng, and J. Zhang, “Constrained bi-level optimization: Proximal lagrangian value function approach and hessian-free algorithm,” ArXiv, vol. abs/2401.16164, 2024. [Online]. Available: https://api.semanticscholar.org/CorpusID: 267311912

    2024 arXiv

  13. [21]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” ArXiv, vol. abs/1708.07747, 2017

    2017 arXiv

  14. [22]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, “Learning multiple layers of features from tiny images,” University of Toronto, 05 2012

    2012

  15. [23]

    Automated flower classifi- cation over a large number of classes,

    M.-E. Nilsback and A. Zisserman, “Automated flower classifi- cation over a large number of classes,” in Indian Conference on Computer Vision, Graphics and Image Processing, Dec 2008

    2008

  16. [24]

    Fsim: A feature similarity index for image quality assessment,

    L. Zhang, L. Zhang, X. Mou, and D. Zhang, “Fsim: A feature similarity index for image quality assessment,” IEEE Transactions on Image Processing, vol. 20, no. 8, pp. 2378–2386, 2011

    2011

  17. [25]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tram `er, “Membership inference attacks from first principles,” in 2022 IEEE Symposium on Security and Privacy (SP) , 2022, pp. 1897–1914

    2022

  18. [26]

    Split learning for health: Distributed deep learning without sharing raw patient data,

    P . Vepakomma, O. Gupta, T. Swedish, and R. Raskar, “Split learning for health: Distributed deep learning without sharing raw patient data,” arXiv preprint arXiv:1812.00564, 2018

    2018 arXiv

  19. [27]

    Server-side local gradient averaging and learning rate acceleration for scalable split learning,

    S. Pal, M. Uniyal, J. Park, P . Vepakomma, R. Raskar, M. Bennis, M. Jeon, and J. D. Choi, “Server-side local gradient averaging and learning rate acceleration for scalable split learning,” ArXiv, vol. abs/2112.05929, 2021

    2021 arXiv

  20. [28]

    Split federated learning over heterogeneous edge devices: Algorithm and optimization,

    Y. Sun, G. Hu, Y. Teng, and D. Cai, “Split federated learning over heterogeneous edge devices: Algorithm and optimization,” 2024. [Online]. Available: https://arxiv.org/abs/2411.13907

    2024 arXiv

  21. [29]

    Unleashing the tiger: Inference attacks on split learning,

    D. Pasquini, G. Ateniese, and M. Bernaschi, “Unleashing the tiger: Inference attacks on split learning,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’21. New York, NY, USA: Association for Computing Machinery, 2021, p. 2113–2129

    2021

  22. [30]

    Get your foes fooled: Proximal gradient split learning for defense against model inversion attacks on iomt data,

    S. A. Khowaja, I. H. Lee, K. Dev, M. A. Jarwar, and N. M. F. Qureshi, “Get your foes fooled: Proximal gradient split learning for defense against model inversion attacks on iomt data,” IEEE Transactions on Network Science and Engineering, 2022

    2022

  23. [31]

    Label leakage and protection in two-party split learning,

    O. Li, J. Sun, X. Yang, W. Gao, H. Zhang, J. Xie, V . Smith, and C. Wang, “Label leakage and protection in two-party split learning,” in International Conference on Learning Representations , 2022

    2022

  24. [32]

    Prac- tical defences against model inversion attacks for split neural net- works,

    T. Titcombe, A. J. Hall, P . Papadopoulos, and D. Romanini, “Prac- tical defences against model inversion attacks for split neural net- works,” ICLR Workshop on Distributed and Private Machine Learning (DPML), 2021

    2021

  25. [33]

    Recon- structing training data from trained neural networks,

    N. Haim, G. Vardi, G. Yehudai, O. Shamir, and M. Irani, “Recon- structing training data from trained neural networks,” Advances in Neural Information Processing Systems , vol. 35, pp. 22 911–22 924, 2022

    2022

  26. [34]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Advances in neural information processing systems , vol. 32, 2019

    2019

  27. [35]

    Ppsfl: Privacy-preserving split federated learning for heterogeneous data in edge-based internet of things,

    J. Zheng, Y. Chen, and Q. Lai, “Ppsfl: Privacy-preserving split federated learning for heterogeneous data in edge-based internet of things,” Future Generation Computer Systems , vol. 156, pp. 231–241, 2024. [Online]. Available: https://www.sciencedirect. com/science/article/pi...

    2024

  28. [36]

    Cure: Privacy-preserving split learning done right,

    H. I. Kanpak, A. Shabbir, E. Genc ¸, A. K ¨upc ¸¨u, and S. Sav, “Cure: Privacy-preserving split learning done right,” 2024. [Online]. Available: https://arxiv.org/abs/2407.08977

    2024 arXiv

  29. [37]

    Split learning without local weight sharing to enhance client-side data privacy,

    N. D. Pham, T. K. Phan, A. Abuadbba, Y. Gao, V .-D. Nguyen, and N. Chilamkurti, “Split learning without local weight sharing to enhance client-side data privacy,” IEEE Transactions on Dependable and Secure Computing, pp. 1–13, 2025

    2025

  30. [38]

    Very deep convolutional net- works for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional net- works for large-scale image recognition,” in 3rd International Con- ference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, Y. Bengio and Y. LeCun, Eds., 2015

    2015

  31. [39]

    Jetson nano - power- ful ai at your edge

    N. Corporation, “Jetson nano - power- ful ai at your edge.” [Online]. Avail- able: https://www.nvidia.com/en-us/autonomous-machines/ embedded-systems/jetson-nano/product-development/

  32. [40]

    Talbi, A Taxonomy of Metaheuristics for Bi-level Optimization

    E.-G. Talbi, A Taxonomy of Metaheuristics for Bi-level Optimization . Berlin, Heidelberg: Springer Berlin Heidelberg, 2013, pp. 1–39

    2013

  33. [41]

    python-kasa: Python api for tp-link smarthome products

    I. Kasa Companies, “python-kasa: Python api for tp-link smarthome products.”

  34. [42]

    Vta- smac: Variable traffic-adaptive duty cycled sensor mac protocol to enhance overall qos of s-mac protocol,

    M. U. Rehman, I. Uddin, M. Adnan, A. Tariq, and S. Malik, “Vta- smac: Variable traffic-adaptive duty cycled sensor mac protocol to enhance overall qos of s-mac protocol,” IEEE Access , vol. 9, pp. 33 030–33 040, 2021

    2021

  35. [43]

    Gradient leak- age attacks in federated learning: Research frontiers, taxonomy, and future directions,

    H. Yang, M. Ge, D. Xue, K. Xiang, H. Li, and R. Lu, “Gradient leak- age attacks in federated learning: Research frontiers, taxonomy, and future directions,” IEEE Network, vol. 38, no. 2, pp. 247–254, 2024

    2024

  36. [44]

    Gradient diffusion: A perturbation-resilient gradient leakage attack,

    X. Liu, S. Cai, Q. Zhou, S. Guo, R. Li, and K. Lin, “Gradient diffusion: A perturbation-resilient gradient leakage attack,” CoRR, vol. abs/2407.05285, 2024

    2024 arXiv

  37. [45]

    U-shaped split federated learning: An efficient cross-device learning frame- work with enhanced privacy-preserving,

    Z. Zhao, D. Liu, Y. Cao, T. Chen, S. Zhang, and H. Tang, “U-shaped split federated learning: An efficient cross-device learning frame- work with enhanced privacy-preserving,” in 2023 9th International Conference on Computer and Communications (ICCC), 2023, pp. 2182– 2186

    2023

  38. [46]

    Active client selection for clustered federated learning,

    H. Huang, W. Shi, Y. Feng, C. Niu, G. Cheng, J. Huang, and Z. Liu, “Active client selection for clustered federated learning,” IEEE Transactions on Neural Networks and Learning Systems , pp. 1– 15, 2023

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.