Split learning of deep neural networks (SplitNN) has provided a promising solution to learning jointly for the mutual interest of a guest and a host, which may come from different backgrounds, holding features partitioned vertically. However, SplitNN creates a new attack surface for the adversarial participant, holding back its practical use in the real world. By investigating the adversarial effects of highly threatening attacks, including property inference, data reconstruction, and feature hijacking attacks, we identify the underlying vulnerability of SplitNN and propose a countermeasure. To prevent potential threats and ensure the learning guarantees of SplitNN, we design a privacy-preserving tunnel for information exchange between the guest and the host. The intuition is to perturb the propagation of knowledge in each direction with a controllable unified solution. To this end, we propose a new activation function named R3eLU, transferring private smashed data and partial loss into randomized responses in forward and backward propagations, respectively. We give the first attempt to secure split learning against three threatening attacks and present a fine-grained privacy budget allocation scheme. The analysis proves that our privacy-preserving SplitNN solution provides a tight privacy budget, while the experimental results show that our solution performs better than existing solutions in most cases and achieves a good tradeoff between defense and model usability.

翻译：深度神经网络的分割学习（SplitNN）为拥有垂直划分特征、可能来自不同背景的客方与主方提供了联合学习的可行方案。然而，SplitNN为敌对方创造了新的攻击面，阻碍了其在现实世界中的实际应用。通过研究属性推理、数据重建及特征劫持攻击等高威胁性攻击的对抗效应，我们揭示了SplitNN的内在脆弱性，并提出了一种对策。为防范潜在威胁并保障SplitNN的学习安全性，我们设计了一个用于客方与主方之间信息交换的隐私保护通道。其核心思想是通过可控的统一解决方案，扰动每个方向上的知识传播。为此，我们提出名为R3eLU的新型激活函数，该函数在前向传播中将私有压缩数据、在反向传播中将部分损失函数分别转化为随机化响应。我们首次尝试针对三种威胁性攻击保护分割学习，并提出了细粒度的隐私预算分配方案。分析证明，我们的隐私保护SplitNN方案能提供紧致的隐私预算，而实验结果表明，在多数情况下，该方案性能优于现有方案，并在防御能力与模型可用性之间实现了良好权衡。