Training on Fake Labels: Mitigating Label Leakage in Split Learning via Secure Dimension Transformation

TL;DR

This paper introduces a novel split learning approach with a secure dimension transformation module and gradient normalization to defend against label inference attacks while maintaining model utility.

Contribution

The paper proposes SecDT, a bidirectional label transformation module, and a gradient normalization technique to enhance privacy in split learning without sacrificing accuracy.

Findings

Effective reduction of attack AUC by over 0.45 on Avazu dataset.

Outperforms existing defense methods in privacy preservation.

Maintains high utility of models across multiple datasets.

Abstract

Two-party split learning has emerged as a popular paradigm for vertical federated learning. To preserve the privacy of the label owner, split learning utilizes a split model, which only requires the exchange of intermediate representations (IRs) based on the inputs and gradients for each IR between two parties during the learning process. However, split learning has recently been proven to survive label inference attacks. Though several defense methods could be adopted, they either have limited defensive performance or significantly negatively impact the original mission. In this paper, we propose a novel two-party split learning method to defend against existing label inference attacks while maintaining the high utility of the learned models. Specifically, we first craft a dimension transformation module, SecDT, which could achieve bidirectional mapping between original labels and increased K-class labels to mitigate label leakage from the directional perspective. Then, a gradient normalization algorithm is designed to remove the magnitude divergence of gradients from different classes. We propose a softmax-normalized Gaussian noise to mitigate privacy leakage and make our K unknowable to adversaries. We conducted experiments on real-world datasets, including two binary-classification datasets (Avazu and Criteo) and three multi-classification datasets (MNIST, FashionMNIST, CIFAR-10); we also considered current attack schemes, including direction, norm, spectral, and model completion attacks. The detailed experiments demonstrate our proposed method's effectiveness and superiority over existing approaches. For instance, on the Avazu dataset, the attack AUC of evaluated four prominent attacks could be reduced by 0.4532+-0.0127.