ResearchPod Summary
Split learning (SL) allows collaborative model training by partitioning neural networks between clients and servers. While this keeps raw data on the client, the intermediate representations (IRs) exchanged during training can be vulnerable to feature inversion and gradient leakage. This paper addresses the lack of systematic, architecture-agnostic methods for selecting privacy-preserving split points, aiming to quantify privacy risk without the computational burden of running actual reconstruction attacks.
The authors propose BettiSplit, a framework grounded in Topological Data Analysis (TDA). They hypothesize that the geometric structure of smashed activations—the data sent from client to server—is a strong indicator of privacy risk. By using persistent homology, specifically the first Betti number (Betti-1), they measure the 'topological complexity' of these activations. They introduce two primary tools: BettiLeak, a metric that assigns a privacy risk score to each layer based on its topological structure, and BettiSafe, a selection strategy that uses these scores to choose the safest split point. Additionally, they propose a Betti-based regularization term that can be added to the training loss to suppress excessive topological complexity, thereby making the representations harder to invert.
The study demonstrates that privacy risk in split learning is highly non-uniform and does not simply correlate with architectural depth. Instead, topological complexity provides a consistent, reliable indicator of susceptibility to feature inversion. BettiSafe, the proposed selection strategy, improves resistance to feature inversion by 2 to 5 times compared to standard depth-based heuristics. Furthermore, applying Betti-based regularization during training increases the difficulty of inversion attacks by nearly 5 times without sacrificing classification accuracy, offering a favorable trade-off between privacy and model utility.
This work provides a proactive, design-time solution for securing split learning systems. By moving away from reactive, attack-based evaluation, BettiSplit allows developers to identify privacy-sensitive layers and optimize model architecture before deployment. It establishes a conceptual bridge between TDA and privacy-preserving machine learning, offering a robust, computationally efficient tool for real-world collaborative systems where privacy is a primary constraint.
AI-generated third-party summary by ResearchPod. Not official content or an endorsement by the paper authors or affiliated organizations.