Label Leakage and Protection in Two-party Split Learning

Oscar LiJiankai SunXin YangWeihao GaoHongyi ZhangJunyuan XieVirginia SmithChong Wang

article2022ICLR170 citations

Exposes how adversaries can reconstruct private labels in two-party split learning and develops Marvell, an optimized perturbation defense that minimizes worst-case label leakage while preserving model utility.

Listen

Modern privacy regulations and competitive concerns make it critical for organizations to collaborate on machine learning without sharing proprietary raw data or sensitive target labels, such as user purchase conversions or medical diagnoses. Two-party split learning is widely viewed as a privacy-preserving framework because organizations split a deep neural network across intermediate model layers and exchange only intermediate outputs and gradients rather than raw records. However, because each transmitted gradient corresponds to an aligned, specific data record, standard aggregate privacy defenses like differential privacy cannot be applied directly. This raises an urgent question regarding whether communicating cut-layer gradients unintentionally reveals the proprietary target labels.

The article evaluates the vulnerability of two-party split learning to private label theft during model training, quantifies this privacy loss, and develops principled noise-perturbation defenses to safeguard sensitive labels without degrading model utility.

To investigate this issue, the authors formalize a threat model involving an honest-but-curious non-label party seeking to reconstruct the other party's binary labels from cut-layer gradients. They introduce a privacy loss metric termed leak AUC, which measures an adversary's classification performance across all decision thresholds, where a value of 1.0 indicates total label leakage and 0.5 denotes random guessing. The authors demonstrate two realistic attack methods based on gradient length and direction. To counter these threats, they formulate a defense named Marvell, which mathematically optimizes class-specific Gaussian noise perturbations to minimize worst-case label leakage under strict optimization power constraints. The authors evaluate these attacks and defenses across three large-scale benchmark datasets: online advertising datasets Criteo and Avazu, and the SIIM-ISIC skin lesion image dataset.

The findings demonstrate that split learning without active defenses suffers from severe privacy leakage. In unperturbed training across all datasets, both the gradient norm and gradient direction scoring attacks consistently achieve leak AUC values near 1.0, enabling the non-label party to fully reconstruct private ground-truth labels at both the cut layer and internal network layers. Standard isotropic Gaussian noise fails to defend against directional attacks, leaving leak AUC values above 0.9 on the image dataset even when high noise is added. In contrast, Marvell reduces worst-case leak AUC close to the baseline level of 0.5 across both cut and earlier network layers while preserving predictive accuracy. An alternative heuristic defense, max_norm, also effectively mitigates the identified attacks but lacks the mathematical flexibility to tune privacy-utility tradeoffs.

These results demonstrate that standard split learning provides an illusion of label privacy. Gradient exchanges create substantial compliance, security, and competitive risks for institutions handling proprietary outcomes. Marvell demonstrates that mathematically structured noise—aligning perturbations with the difference between positive and negative class gradient distributions—effectively eliminates label reconstruction risks while maintaining viable model utility and generalization performance on real-world tasks.

Organizations deploying split learning in production should not rely on raw gradient exchanges and should implement structured perturbation defenses. Marvell is recommended when organizations require explicit, tunable control over the balance between privacy protection and predictive performance. For simpler implementations where hyperparameter tuning is impractical, the max_norm heuristic offers an effective out-of-the-box alternative against standard geometric attacks. Future development should evaluate defenses in multi-class classification, multi-party federated architectures, and against potential multi-step attacks where adversaries track historical gradients over multiple update iterations.

The conclusions are supported by theoretical bounds and extensive empirical validations across tabular and image domains. However, decision-makers should recognize that the optimization framework assumes class-conditional gradients approximate Gaussian distributions and focuses on binary classification. Confidence in the defense is high for standard single-iteration attacks, but additional testing is warranted before deploying in non-binary or multi-party collaborative environments.

ByteDance Carnegie Mellon University individual privacy perturbation techniques online learning two-party split learning label leakage label protection

arXiv: 2102.08504 OscarcarLi/label-protection

Paper: Deep Leakage from Gradients, Ligeng Zhu et al. (2019). This seminal paper demonstrates how private training inputs and labels can be mathematically inverted and reconstructed from shared gradients in collaborative learning architectures.
Paper: Inverting Gradients - How easy is it to break privacy in federated learning?, Jonas Geiping et al. (2020). This work establishes theoretical bounds and numerical methods showing that deep network layer inputs can be reconstructed strictly from parameter gradient updates.
Paper: Exploiting Unintended Feature Leakage in Collaborative Learning, Luca Melis et al. (2018). This study analyzes passive and active feature and property leakage stemming from intermediate gradient exchanges in collaborative multi-party learning.
Paper: Deep Learning with Differential Privacy, Martín Abadi et al. (2016). This foundational work introduces gradient perturbation mechanisms and privacy budgeting via differentially private stochastic gradient descent.
Paper: Federated Machine Learning, Qiang Yang et al. (2019). This paper establishes the taxonomy and architecture of vertical and split federated learning across organizations with partitioned features and labels.
Paper: Differentially Private Empirical Risk Minimization, Kamalika Chaudhuri et al. (2009). This study formalizes objective and output perturbation strategies for differential privacy in risk minimization, grounding noise optimization under utility constraints.

Paper: Hyperparameter Tuning with Renyi Differential Privacy, Nicolas Papernot et al. (2022). This work extends rigorous differential privacy protection frameworks into the hyperparameter tuning phase of machine learning training.
Paper: Flocks of Stochastic Parrots: Differentially Private Prompt Learning for Large Language Models, Haonan Duan et al. (2023). This paper extends differential privacy and gradient perturbation principles to prevent private prompt data leakage in large language models.

Cover for Label Leakage and Protection in Two-party Split Learning

Abstract

Two-party split learning is a popular technique for learning a model across feature-partitioned data. In this work, we explore whether it is possible for one party to steal the private label information from the other party during split training, and whether there are methods that can protect against such attacks. Specifically, we first formulate a realistic threat model and propose a privacy loss metric to quantify label leakage in split learning. We then show that there exist two simple yet effective methods within the threat model that can allow one party to accurately recover private ground-truth labels owned by the other party. To combat these attacks, we propose several random perturbation techniques, including $\texttt{Marvell}$ , an approach that strategically finds the structure of the noise perturbation by minimizing the amount of label leakage (measured through our quantification metric) of a worst-case adversary. We empirically demonstrate the effectiveness of our protection techniques against the identified attacks, and show that $\texttt{Marvell}$ in particular has improved privacy-utility tradeoffs relative to baseline approaches.

Topics

individual privacy perturbation techniques online learning

Keywords

two-party split learning label leakage label protection differential privacy privacy-utility tradeoffs direction-based attacks norm leak privacy loss quantification

1 Introduction
2 Related Work
3 Label Leakage in Split Learning
3.1 Two-party Split Learning in Binary Classification
3.2 Threat Model and Privacy Quantification
3.3 Practical Attack Methods
4 Label Leakage Protection Methods
4.1 A Heuristic Protection Approach
4.2 Optimized Perturbation Method: Marvell
5 Experiments
5.1 Label Leakage and Marvell’s Strong and Flexible Protection
5.2 Privacy-Utility Trade-off Comparison
6 Conclusion
References
A Appendix
A.1 Expressing AUC(r)\textrm{AUC}(r) as an integral
A.2 Toy example of positive example prediction lacking confidence
A.3 Proof of Theorem
A.4 Proof and Interpretation of Theorem
A.5 Marvell algorithm description
A.6 Data Setup and Experimental Details
A.6.1 Dataset preprocessing
A.6.2 Model architecture details
A.6.3 Model training details
A.7 Complete Experimental Results
A.7.1 Leak AUC progression for Avazu and Criteo
A.7.2 Complete Privacy-Utility tradeoffs

Knowls

Knowl 1 — Upper Bound on Worst-Case Label Leakage AUC via Symmetrized KL Divergence
theoretical result
Let $\tilde{P}^{(1)}$ and $\tilde{P}^{(0)}$ denote the perturbed cut-layer gradient distributions for the positive ( $y=1$ ) and negative ( $y=0$ ) classes respectively, which are absolutely continuous with respect to each other.

For any adversary scoring function $r: \mathbb{R}^d \to \mathbb{R}$ , let $\text{AUC}(r)$ denote the area under the ROC curve measuring the adversary's ability to classify the ground-truth label $y$ from the perturbed gradient $\tilde{g}$ . If the symmetrized Kullback-Leibler (KL) divergence between the perturbed distributions satisfies

$\text{KL}(\tilde{P}^{(1)} \parallel \tilde{P}^{(0)}) + \text{KL}(\tilde{P}^{(0)} \parallel \tilde{P}^{(1)}) \le \epsilon$

for some $0 \le \epsilon < 4$ , then the maximum leak AUC across all measurable scoring functions is bounded by:

$\max_r \text{AUC}(r) \le \frac{1}{2} + \frac{\sqrt{\epsilon}}{2} - \frac{\epsilon}{8}$

Because $\frac{1}{2} + \frac{\sqrt{\epsilon}}{2} - \frac{\epsilon}{8}$ decreases monotonically as $\epsilon \to 0$ , minimizing the symmetrized KL divergence directly minimizes the worst-case adversary's label-recovery capability.
Knowl 2 — Optimal Perturbation Noise Covariance Structure in Marvell
theoretical result
Assume unperturbed cut-layer gradients for the positive and negative classes follow isotropic Gaussian distributions $g^{(1)} \sim \mathcal{N}(\bar{g}^{(1)}, v I_d)$ and $g^{(0)} \sim \mathcal{N}(\bar{g}^{(0)}, u I_d)$ , where $\bar{g}^{(1)}, \bar{g}^{(0)} \in \mathbb{R}^d$ are class mean gradient vectors, $u, v > 0$ are scalar variances, and $I_d$ is the $d \times d$ identity matrix. Let $\Delta g := \bar{g}^{(1)} - \bar{g}^{(0)}$ be the difference between class means.

Consider additive zero-mean Gaussian perturbations $\eta^{(1)} \sim \mathcal{N}(0, \Sigma_1)$ and $\eta^{(0)} \sim \mathcal{N}(0, \Sigma_0)$ with commuting positive semidefinite covariance matrices $\Sigma_1 \Sigma_0 = \Sigma_0 \Sigma_1$ , subject to the total noise power constraint

$p \cdot \text{tr}(\Sigma_1) + (1-p) \cdot \text{tr}(\Sigma_0) \le P$

where $p \in (0, 1)$ is the positive class proportion and $P > 0$ is the noise power budget.

The optimal covariance matrices $\Sigma_1^*, \Sigma_0^*$ minimizing the symmetrized KL divergence $\text{KL}(\mathcal{N}(\bar{g}^{(1)}, v I_d + \Sigma_1) \parallel \mathcal{N}(\bar{g}^{(0)}, u I_d + \Sigma_0)) + \text{KL}(\mathcal{N}(\bar{g}^{(0)}, u I_d + \Sigma_0) \parallel \mathcal{N}(\bar{g}^{(1)}, v I_d + \Sigma_1))$ are given by:

$\Sigma_1^* = \frac{\lambda_1^{(1)*} - \lambda_2^{(1)*}}{\|\Delta g\|_2^2} (\Delta g)(\Delta g)^\top + \lambda_2^{(1)*} I_d$

$\Sigma_0^* = \frac{\lambda_1^{(0)*} - \lambda_2^{(0)*}}{\|\Delta g\|_2^2} (\Delta g)(\Delta g)^\top + \lambda_2^{(0)*} I_d$

where $(\lambda_1^{(0)*}, \lambda_2^{(0)*}, \lambda_1^{(1)*}, \lambda_2^{(1)*})$ is the solution to the 4-variable convex optimization problem:

$\min_{\lambda_1^{(0)}, \lambda_1^{(1)}, \lambda_2^{(0)}, \lambda_2^{(1)}} (d-1)\frac{\lambda_2^{(0)} + u}{\lambda_2^{(1)} + v} + (d-1)\frac{\lambda_2^{(1)} + v}{\lambda_2^{(0)} + u} + \frac{\lambda_1^{(0)} + u + \|\Delta g\|_2^2}{\lambda_1^{(1)} + v} + \frac{\lambda_1^{(1)} + v + \|\Delta g\|_2^2}{\lambda_1^{(0)} + u}$

subject to

$p \lambda_1^{(1)} + p(d-1)\lambda_2^{(1)} + (1-p)\lambda_1^{(0)} + (1-p)(d-1)\lambda_2^{(0)} \le P$

$-\lambda_1^{(1)} \le 0, \quad -\lambda_1^{(0)} \le 0, \quad -\lambda_2^{(1)} \le 0, \quad -\lambda_2^{(0)} \le 0$

$\lambda_2^{(1)} - \lambda_1^{(1)} \le 0, \quad \lambda_2^{(0)} - \lambda_1^{(0)} \le 0$

At the optimal solution, $\lambda_2^{(1)*} = 0$ if $u < v$ and $\lambda_2^{(0)*} = 0$ if $u \ge v$ , reducing the active variables to three.
Knowl 3 — Marvell Algorithm for Label Leakage Protection
algorithm
Marvell (optiMized perturbAtion to pReVEnt Label Leakage) is executed by the label party at each training step of two-party split learning. It dynamically estimates batch statistics, solves a 3-variable convex subproblem to find optimal perturbation covariance matrices $\Sigma_1^*$ and $\Sigma_0^*$ , and perturbs positive and negative cut-layer gradients prior to sending them back to the non-label party.
Input: Batch gradients $g \in \mathbb{R}^{B \times d}$ , labels $y \in \{0, 1\}^B$ , privacy scale hyperparameter $s > 0$
Output: Perturbed batch gradients $\tilde{g} \in \mathbb{R}^{B \times d}$
$p \leftarrow \frac{1}{B} \sum_{j=1}^B y[j]$
$\bar{g}^{(1)} \leftarrow \frac{1}{\sum_{j=1}^B y[j]} \sum_{j: y[j]=1} g[j]$
$\bar{g}^{(0)} \leftarrow \frac{1}{\sum_{j=1}^B (1-y[j])} \sum_{j: y[j]=0} g[j]$
$v \leftarrow \frac{1}{d \sum_{j=1}^B y[j]} \sum_{j: y[j]=1} \|g[j] - \bar{g}^{(1)}\|_2^2$
$u \leftarrow \frac{1}{d \sum_{j=1}^B (1-y[j])} \sum_{j: y[j]=0} \|g[j] - \bar{g}^{(0)}\|_2^2$
$\Delta g \leftarrow \bar{g}^{(1)} - \bar{g}^{(0)}$
$P \leftarrow s \cdot \|\Delta g\|_2^2$
if $u < v$ then
     $\lambda_2^{(1)} \leftarrow 0$
    Initialize $\lambda_1^{(1)}, \lambda_1^{(0)}, \lambda_2^{(0)}$ in the feasible region
else
     $\lambda_2^{(0)} \leftarrow 0$
    Initialize $\lambda_1^{(1)}, \lambda_2^{(1)}, \lambda_1^{(0)}$ in the feasible region
end if
while not converged do
    Fix one of the three active optimization variables
    Update the other two variables along the hyperplane constraint via 1D line-search minimization of the convex objective
end while
$\Sigma_1^* \leftarrow \frac{\lambda_1^{(1)} - \lambda_2^{(1)}}{\|\Delta g\|_2^2} (\Delta g)(\Delta g)^\top + \lambda_2^{(1)} I_d$
$\Sigma_0^* \leftarrow \frac{\lambda_1^{(0)} - \lambda_2^{(0)}}{\|\Delta g\|_2^2} (\Delta g)(\Delta g)^\top + \lambda_2^{(0)} I_d$
$\tilde{g} \leftarrow 0_{B \times d}$
for $j = 1$ to $B$ do
    if $y[j] = 1$ then
        Sample $\eta^{(1)} \sim \mathcal{N}(0, \Sigma_1^*)$
         $\tilde{g}[j] \leftarrow g[j] + \eta^{(1)}$
    else
        Sample $\eta^{(0)} \sim \mathcal{N}(0, \Sigma_0^*)$
         $\tilde{g}[j] \leftarrow g[j] + \eta^{(0)}$
    end if
end for
return $\tilde{g}$
Knowl 4 — Leak AUC Privacy Quantification Metric
definition
In two-party split learning for binary classification with private labels $y \in \{0, 1\}$ , privacy leakage to an honest-but-curious non-label party is quantified using the Leak AUC metric. Let $P^{(1)}$ and $P^{(0)}$ denote the cut-layer gradient distributions for the positive and negative class, respectively.

The adversary employs a classifier represented by a real-valued scoring function $r: \mathbb{R}^d \to \mathbb{R}$ and threshold $t \in \mathbb{R}$ , predicting $\hat{y} = 1$ when $r(g) > t$ and $\hat{y} = 0$ otherwise. The false positive rate and true positive rate at threshold $t$ are:

$\text{FPR}_r(t) := P^{(0)}(\{g \in \mathbb{R}^d : r(g) > t\})$

$\text{TPR}_r(t) := P^{(1)}(\{g \in \mathbb{R}^d : r(g) > t\})$

The Leak AUC of scoring function $r$ is defined via the Riemann-Stieltjes integral:

$\text{AUC}(r) = \int_{t=\infty}^{t=-\infty} \text{TPR}_r(t) \, d\text{FPR}_r(t) \in [0, 1]$

A Leak AUC of $1.0$ indicates complete label recovery, whereas $\text{AUC}(r) \approx 0.5$ denotes non-informative random guessing. Differential privacy is not directly applicable because communicated cut-layer gradients are example-specific matrices in $\mathbb{R}^{B \times d}$ whose rows cannot be aggregated or permuted without destroying non-label parameter updates.
Knowl 5 — Norm-Based and Direction-Based Label Leakage Attacks in Two-Party Split Learning
model/method
In two-party split binary classification with loss $L = \log(1 + \exp(-\ell)) + (1-y)\ell$ , the cut-layer gradient sent from the label party to the non-label party is $g = (\tilde{p}_1 - y) \nabla_z h(z)|_{z=f(X)} \in \mathbb{R}^d$ , where $\tilde{p}_1 = 1/(1 + \exp(-\ell))$ is the model's positive class probability and $h$ is the label party's logit function.

The non-label party can exploit two structural properties of $g$ :
1. Norm-based scoring function $r_n(g) = \|g\|_2$ : Because neural networks typically have lower prediction confidence for positive instances ( $1 - \tilde{p}_1$ ) than negative instances ( $\tilde{p}_1$ ), the confidence gap $|\tilde{p}_1 - y|$ is larger for $y=1$ than for $y=0$ . Since $\|\nabla_z h(z)\|_2$ is independent of $y$ , $\|g\|_2 = |\tilde{p}_1 - y| \cdot \|\nabla_z h(z)\|_2$ is systematically larger for positive examples.
2. Direction-based scoring function $r_d(g) = \cos(g, g^+)$ : For two examples $a$ and $b$ , $\cos(g_a, g_b) = \text{sgn}(\tilde{p}_{1,a} - y_a) \text{sgn}(\tilde{p}_{1,b} - y_b) \cos(\nabla_z h(z_a), \nabla_z h(z_b))$ . When monotonic activations (such as ReLU) are used, gradients of $h$ lie in the first hyperorthant so $\cos(\nabla_z h(z_a), \nabla_z h(z_b)) > 0$ . Thus, same-class pairs always produce positive cosine similarity, and opposite-class pairs produce negative cosine similarity. Using a single clean positive gradient $g^+$ (or majority counting under class imbalance), $r_d(g) = \cos(g, g^+)$ separates positive from negative examples.
Knowl 6 — Max-Norm Heuristic Perturbation Defense
model/method
The max-norm heuristic ( $\text{max\_norm}$ ) is a parameter-free perturbation method designed to neutralize norm- and direction-based gradient attacks in two-party split learning while keeping gradient estimates unbiased ( $\mathbb{E}[\tilde{g} \mid g] = g$ ).

For a mini-batch of cut-layer gradients $\{g_j\}_{j=1}^B \subset \mathbb{R}^d$ , the label party determines the maximum squared 2-norm:

$\|g_{\max}\|_2^2 = \max_{j \in \{1, \dots, B\}} \|g_j\|_2^2$

For each gradient $g_j$ , zero-mean Gaussian noise $\eta_j$ is added along the 1-dimensional subspace defined by $g_j$ with rank-1 covariance matrix:

$\text{Cov}[\eta_j] = \sigma_j^2 g_j g_j^\top \quad \text{where} \quad \sigma_j = \sqrt{\frac{\|g_{\max}\|_2^2}{\|g_j\|_2^2} - 1}$

This ensures that every perturbed gradient $\tilde{g}_j = g_j + \eta_j$ has expected squared 2-norm equal to the batch maximum: $\mathbb{E}[\|g_j + \eta_j\|_2^2] = \|g_{\max}\|_2^2$ .
Knowl 7 — Two-Party Split Learning Protocol for Binary Classification
model/method
Two-party split learning for binary classification distributes a composition model $h \circ f$ between a non-label party and a label party over domain $\mathcal{X} \times \{0, 1\}$ :
1. Forward Pass: The non-label party holds raw features $X \in \mathcal{X}$ and representation function $f: \mathcal{X} \to \mathbb{R}^d$ . It computes cut-layer activation $f(X) \in \mathbb{R}^d$ and sends it to the label party. The label party holds ground-truth labels $y \in \{0, 1\}$ and logit function $h: \mathbb{R}^d \to \mathbb{R}$ . It computes logit $\ell = h(f(X))$ , positive class probability $\tilde{p}_1 = 1/(1 + \exp(-\ell))$ , and cross-entropy loss $L = \log(1 + \exp(-\ell)) + (1-y)\ell$ .
2. Backward Pass: The label party computes the loss gradient with respect to the cut-layer activation:
$g := \nabla_{f(X)} L = (\tilde{p}_1 - y) \nabla_z h(z)\Big|_{z=f(X)} \in \mathbb{R}^d$

The label party updates its parameters in $h$ using $\nabla L$ , and sends $g$ back to the non-label party. The non-label party continues backpropagation from $g$ to update parameters in $f$ .
Knowl 8 — Empirical Privacy-Utility Trade-Offs of Marvell vs. Baselines
empirical result
Experiments evaluated Marvell, isotropic Gaussian noise ( $\text{iso}$ with $\eta \sim \mathcal{N}(0, (t/d)\|g_{\max}\|_2^2 I_d)$ ), $\text{max\_norm}$ , and unperturbed training ( $\text{no\_noise}$ ) on Criteo and Avazu (click-through rate prediction using Wide&Deep models) and SIIM-ISIC (skin lesion classification using a 6-layer CNN, subsampled to a 10% positive ratio). Privacy is evaluated using the 95th percentile of batch-computed norm and cosine Leak AUC at both the cut layer and the first layer; utility is evaluated via test loss, test AUC, and train loss across 20+ runs per method.

Key empirical results include:
1. High baseline leakage: Without perturbation ( $\text{no\_noise}$ ), norm leak AUC exceeds 0.9 and cosine leak AUC equals 1.0 across iterations at both the cut layer and first layer, demonstrating severe label leakage.
2. Marvell vs. Isotropic Gaussian: Marvell achieves strictly superior privacy-utility curves over $\text{iso}$ . On ISIC, even with large isotropic noise ( $t > 20$ ), $\text{iso}$ 's cosine leak AUC remains $> 0.9$ at the cut layer, while Marvell reduces cosine leak AUC to $\approx 0.6$ with test AUC $\approx 0.83$ and test loss $\approx 0.38$ .
3. Flexible protection: Varying Marvell's scale parameter $s$ from 0.1 to 4.0 continuously reduces both norm and cosine leak AUC from $\approx 1.0$ down to $\approx 0.5$ (random guess) at both the cut layer and the non-label party's first layer.
4. Max-norm heuristic: The parameter-free $\text{max\_norm}$ matches or slightly outperforms Marvell at a single fixed privacy-utility operating point, but lacks a tuning hyperparameter to adjust the trade-off.

Coverage note — No substantial contributed material was omitted; all core theoretical bounds, algorithmic specifications, attack formulations, heuristic defenses, and empirical results are included.

References

1.Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics, pages 1273–1282. PMLR, 2017.
2.Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and applications. ACM Transactions on Intelligent Systems and Technology (TIST), 10(2):1–19, 2019.
3.Otkrist Gupta and Ramesh Raskar. Distributed learning of deep neural network over multiple agents. Journal of Network and Computer Applications, 116:1–8, 2018.
4.Praneeth Vepakomma, Otkrist Gupta, Tristan Swedish, and Ramesh Raskar. Split learning for health: Distributed deep learning without sharing raw patient data. arXiv preprint arXiv:1812.00564, 2018.
5.Vladimir Kolesnikov, Ranjit Kumaresan, Mike Rosulek, and Ni Trieu. Efficient batched oblivious prf with applications to private set intersection. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, CCS ’16, page 818–829, 2016.
6.Benny Pinkas, Thomas Schneider, and Michael Zohner. Scalable private set intersection based on ot extension. ACM Transactions on Privacy and Security (TOPS), 21(2):1–35, 2018.
7.Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In Advances in Neural Information Processing Systems, pages 14774–14784, 2019.
8.Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients. arXiv preprint arXiv:2001.02610, 2020.
9.Praneeth Vepakomma, Otkrist Gupta, Abhimanyu Dubey, and Ramesh Raskar. Reducing leakage in distributed deep learning for sensitive health data. arXiv preprint arXiv:1812.00564, 2019.
10.Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1175–1191, 2017.
11.Pramod Subramanyan, Rohit Sinha, Ilia Lebedev, Srinivas Devadas, and Sanjit A Seshia. A formal foundation for secure remote execution of enclaves. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 2435–2450, 2017.
12.Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308–318, 2016.
13.H. Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. In International Conference on Learning Representations, 2018. URL https://openreview.net/forum?id=BJ0hF1Z0b.
14.Úlfar Erlingsson, Vitaly Feldman, Ilya Mironov, Ananth Raghunathan, Kunal Talwar, and Abhradeep Thakurta. Amplification by shuffling: From local to central differential privacy via anonymity. In Proceedings of the Thirtieth Annual ACM-SIAM Symposium on Discrete Algorithms, pages 2468–2479. SIAM, 2019.
15.Albert Cheu, Adam Smith, Jonathan Ullman, David Zeber, and Maxim Zhilyaev. Distributed differential privacy via shuffling. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 375–403. Springer, 2019.
16.Cynthia Dwork. Differential privacy. In Michele Bugliesi, Bart Preneel, Vladimiro Sassone, and Ingo Wegener, editors, Automata, Languages and Programming, pages 1–12, Berlin, Heidelberg, 2006. Springer Berlin Heidelberg. ISBN 978-3-540-35908-1.
17.Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4):211–407, 2014.
18.Kamalika Chaudhuri and Daniel Hsu. Sample complexity bounds for differentially private learning. In Proceedings of the 24th Annual Conference on Learning Theory, pages 155–186. JMLR Workshop and Conference Proceedings, 2011.
19.Badih Ghazi, Noah Golowich, Ravi Kumar, Pasin Manurangsi, and Chiyuan Zhang. On deep learning with label differential privacy. arXiv preprint arXiv:2102.06062, 2021.
20.Criteo. Criteo display advertising challenge, 2014. URL https://www.kaggle.com/c/criteo-display-ad-challenge/data.
21.Avazu. Avazu click-through rate prediction, 2015. URL https://www.kaggle.com/c/avazu-ctr-prediction/data.
22.ISIC. Siim-isic melanoma classification, 2020. URL https://www.kaggle.com/c/siim-isic-melanoma-classification/data.
23.Heng-Tze Cheng, Levent Koc, Jeremiah Harmsen, Tal Shaked, Tushar Chandra, Hrishi Aradhye, Glen Anderson, Greg Corrado, Wei Chai, Mustafa Ispir, et al. Wide & deep learning for recommender systems. In Proceedings of the 1st workshop on deep learning for recommender systems, pages 7–10, 2016.

Citation

MLA

Li, O., et al. “Label Leakage and Protection in Two-party Split Learning”. arXiv, 2021, http://arxiv.org/abs/2102.08504v3.

APA

Li, O., Sun, J., Yang, X., Gao, W., Zhang, H., Xie, J., Smith, V., & Wang, C. (2021). Label Leakage and Protection in Two-party Split Learning. arXiv. http://arxiv.org/abs/2102.08504v3

Chicago

Li, O., J. Sun, X. Yang, et al. 2021. “Label Leakage and Protection in Two-party Split Learning”. arXiv. http://arxiv.org/abs/2102.08504v3.

Harvard

Li, O. et al. (2021) “Label Leakage and Protection in Two-party Split Learning”, arXiv [Preprint]. Available at: http://arxiv.org/abs/2102.08504v3.

Vancouver

1. Li O, Sun J, Yang X, Gao W, Zhang H, Xie J, Smith V, Wang C (2021) Label Leakage and Protection in Two-party Split Learning. arXiv

BibTeX

@article{li2021label,
  title = {Label Leakage and Protection in Two-party Split Learning},
  author = {Li, Oscar and Sun, Jiankai and Yang, Xin and Gao, Weihao and Zhang, Hongyi and Xie, Junyuan and Smith, Virginia and Wang, Chong},
  year = {2021},
  journal = {arXiv},
  url = {http://arxiv.org/abs/2102.08504v3},
  eprint = {2102.08504}
}

Metadata:arXiv

Source Code

This paper has an official code repository available. Click below to access the source code.

View Repository

Access the Paper

This paper is available from its original source. Click below to access the PDF.

Open PDF

License: Authors

Label Leakage and Protection in Two-party Split Learning

Abstract

Topics

Keywords

Table of Contents

Knowls

Knowl 1 — Upper Bound on Worst-Case Label Leakage AUC via Symmetrized KL Divergence

Knowl 2 — Optimal Perturbation Noise Covariance Structure in Marvell

Knowl 3 — Marvell Algorithm for Label Leakage Protection

Knowl 4 — Leak AUC Privacy Quantification Metric

Knowl 5 — Norm-Based and Direction-Based Label Leakage Attacks in Two-Party Split Learning

Knowl 6 — Max-Norm Heuristic Perturbation Defense

Knowl 7 — Two-Party Split Learning Protocol for Binary Classification

Knowl 8 — Empirical Privacy-Utility Trade-Offs of Marvell vs. Baselines

References

Citation

BibTeX

Source Code

Access the Paper