GAN-based data reconstruction attacks in split learning.

Area of Science:

• Artificial Intelligence
• Machine Learning Security
• Privacy-Preserving Techniques

Background:

• Split learning offers privacy benefits by partitioning models between clients and servers, suitable for resource-limited environments.
• Despite architectural safeguards, split learning remains vulnerable to data reconstruction attacks, even with partial model access.
• Existing attacks often rely on strong assumptions about the attacker's capabilities, typically the server with global information.

Purpose of the Study:

• To develop and validate Generative Adversarial Network (GAN)-based data reconstruction attacks within the U-shaped split learning framework.
• To investigate the feasibility of attacks initiated from both server and client sides.
• To introduce novel attack methodologies that relax prior assumptions and enable client-side data reconstruction.

Main Methods:

• Proposed Model Approximation Estimation Reconstruction Attack (MAERA) for server-initiated attacks, reducing reliance on prior assumptions.
• Introduced Distillation-based Client-side Reconstruction Attack (DCRA) for novel client-initiated data reconstruction.
• Evaluated attack effectiveness and robustness across various datasets, including CIFAR100.

Main Results:

• MAERA successfully performs attacks using only 1% of test and private data samples on CIFAR100.
• DCRA demonstrates the first successful data reconstruction from the client side in split learning.
• DCRA shows superior reconstruction effects on target class samples compared to conventional Maximum A Posteriori (MAP) estimation.

Conclusions:

• GAN-based attacks are feasible and effective in U-shaped split learning from both server and client perspectives.
• MAERA significantly lowers the requirements for successful server-side reconstruction attacks.
• DCRA establishes a new paradigm for client-side privacy threats in split learning frameworks.