高级检索

    拆分学习系统的隐私攻击和防御技术综述

    A Survey of Privacy Attack and Defense Techniques for Split Learning Systems

    • 摘要: 拆分学习是一种新兴的分布式学习技术,其主要思想是将完整的机器学习模型进行拆分,并分别部署于客户端和服务器。在系统的训练和推理过程中,客户端的数据保留在本地,只向服务器传递编码后的中间特征,因此在一定程度上保护了客户端的数据隐私,同时缓解了模型端侧运行的计算负荷。随着拆分学习技术在多个领域的广泛应用,针对拆分学习系统的各种隐私攻击也层出不穷,攻击者能利用中间特征和分割层的梯度等中间信息重构出用户隐私数据或者推断出其隐私信息,严重危及数据的隐私性。目前,学术界尚缺乏针对拆分学习研究成果的系统性、全面性综述,部分研究将其与联邦学习技术混淆,或总结不够详尽具体。因此,本文旨在填补这一空白,全面总结拆分学习的相关攻击与防御技术,为后续研究发展提供指导。本文首先介绍了拆分学习技术的定义以及其训练和推理过程,并对其多种扩展架构进行了概述。随后分析了拆分学习系统的威胁模型,并对针对拆分学习系统的重构攻击和属性推理、成员推理、标签推理等推理攻击的基本概念、实施阶段和现有方案进行总结归纳。并总结了相应的防御技术,包括异常检测、正则化防御、添加噪声、对抗性表征训练、特征裁剪等方法。最后,本文探讨了拆分学习中隐私安全问题的研究挑战和未来研究方向。

       

      Abstract: Split learning is an emerging distributed learning technique, whose main idea is to split the complete machine learning model and deploy it on the client and server respectively. During the training and inference process of the system, the client's data is kept locally and only the encoded intermediate features are passed to the server, thus protecting the client's data privacy to a certain extent, while alleviating the computational load of the model's end-side operation. As split learning technology widens its application across various domains, various privacy attacks targeting split learning systems have emerged incessantly. Attackers can leverage intermediate information such as intermediate features and gradients from partition layers to reconstruct users' private data or infer their private information, posing a severe threat to data privacy. Currently, academia lacks a systematic and comprehensive overview of research achievements in split learning, with some studies confusing it with federated learning technology or offering insufficiently detailed summaries. Therefore, this paper aims to fill this gap by comprehensively summarizing relevant attack and defense techniques in split learning, providing guidance for subsequent research and development. Firstly, we introduce the definition of split learning technology, its training and inference processes, and outline its various extended architectures. Subsequently, we analyze the threat model of split learning systems and summarizes the fundamental concepts, implementation stages, and existing schemes of reconstruction attacks, as well as inference attacks such as attribute inference, membership inference, and label inference targeting split learning systems. Furthermore, we summarize corresponding defense techniques, encompassing methods like anomaly detection, regularization defense, noise addition, adversarial representation training, and feature pruning. Finally, we discuss research challenges and future directions in addressing privacy and security issues in split learning.

       

    /

    返回文章
    返回