Split learning is a collaborative learning design that allows several participants (clients) to train a shared model while keeping their datasets private. Recent studies demonstrate that collaborative learning models, specifically federated learning, are vulnerable to security and privacy attacks such as model inference and backdoor attacks. Backdoor attacks are a group of poisoning attacks in which the attacker tries to control the model output by manipulating the model's training process. While there have been studies regarding inference attacks on split learning, it has not yet been tested for backdoor attacks. This paper performs a novel backdoor attack on split learning and studies its effectiveness. Despite traditional backdoor attacks done on the client side, we inject the backdoor trigger from the server side. For this purpose, we provide two attack methods: one using a surrogate client and another using an autoencoder to poison the model via incoming smashed data and its outgoing gradient toward the innocent participants. We did our experiments using three model architectures and three publicly available datasets in the image domain and ran a total of 761 experiments to evaluate our attack methods. The results show that despite using strong patterns and injection methods, split learning is highly robust and resistant to such poisoning attacks. While we get the attack success rate of 100% as our best result for the MNIST dataset, in most of the other cases, our attack shows little success when increasing the cut layer.

翻译：分割学习是一种协作学习设计，允许多个参与者（客户端）在保持数据集私密性的同时训练共享模型。近期研究表明，协作学习模型（特别是联邦学习）易受模型推理和后门攻击等安全与隐私威胁。后门攻击属于投毒攻击的范畴，攻击者试图通过操纵模型训练过程来控制模型输出。尽管已有针对分割学习推理攻击的研究，但其尚未接受后门攻击的测试。本文对分割学习实施了一种新型后门攻击，并研究了其有效性。与传统的客户端后门攻击不同，我们从服务器端注入后门触发器。为此，我们提供了两种攻击方法：一种使用代理客户端，另一种使用自动编码器，通过传入的碎片化数据及其向无辜参与者传输的梯度来污染模型。我们采用三种模型架构和图像领域的三个公开数据集进行了实验，共运行761次实验以评估我们的攻击方法。结果表明，尽管使用了强模式注入方法，分割学习对此类投毒攻击仍具有高度鲁棒性和抗性。虽然我们在MNIST数据集上取得了100%的最佳攻击成功率，但在大多数其他情况下，随着切割层增加，我们的攻击成功率显著降低。