Research map / Federated learning and privacy / Privacy attacks and secure learning
A Stealthy Wrongdoer: Feature-Oriented Reconstruction Attack against Split Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FORA, a semi-honest data reconstruction attack on split learning that trains a substitute client via discriminator and MK-MMD feature alignment using public auxiliary data, then inverts its features to reconstruct private images.
Problem
Data reconstruction attacks by a semi-honest server in split learning, under realistic assumptions where the server lacks client data, client architecture, and cannot query the client model.
Approach
Builds a substitute client that mimics the victim client's representation preference (feature-level behavior) by aligning its smashed data on public auxiliary samples with a domain discriminator and MK-MMD loss, then trains an inverse network on the substitute's features to reconstruct private inputs from the target's smashed data.
Key results
- On CelebA at layer 2, FORA reaches PSNR 17.11 versus 12.05 for PCAT and 8.70 for UnSplit.
- On CIFAR-10 at layer 1, FORA achieves SSIM 0.926 and LPIPS 0.120, better than PCAT (0.853, 0.219) and UnSplit (0.171, 0.677).
- FSHA reconstructions are detected by the Gradients Scrutinizer defense and training halts, so FORA avoids that detection while achieving similar quality to FSHA.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FORA instead of PCAT | CIFAR-10 image reconstruction · CIFAR-10 layers 1–3 | PSNR: 22.10 -> 25.87; 17.29 -> 22.19; 13.18 -> 18.93 | Helped |
| Use FORA instead of PCAT | CIFAR-10 image reconstruction · CIFAR-10 layer 4 | PSNR: 11.08 -> 10.45 | Hurt |
| Use FORA instead of PCAT | CelebA image reconstruction · CelebA layers 1–4 | PSNR: 13.45 -> 17.72; 12.05 -> 17.11; 11.63 -> 14.19; 10.60 -> 13.00 | Helped |
| Add DCOR (ablation) | FORA on CIFAR-10 · CIFAR-10 layer 2 | SSIM: 0.830 -> 0.692; 0.830 -> 0.628; 0.830 -> 0.563 | Hurt |
| Add differential privacy (ablation) | FORA on CIFAR-10 · CIFAR-10 layer 2 | SSIM: 0.830 -> 0.711; 0.830 -> 0.621 | Hurt |
| Add noise obfuscation (ablation) | FORA on CIFAR-10 · CIFAR-10 layer 2 | SSIM: 0.830 -> 0.640; 0.830 -> 0.583; 0.830 -> 0.394 | Hurt |
| Use same-distribution rather than different-distribution auxiliary data (ablation) | FORA on CIFAR-10 · CIFAR-10 layer 2 | PSNR: 22.19 -> 22.78 | Helped |
| Use same-distribution rather than different-distribution auxiliary data (ablation) | FORA on CelebA · CelebA layer 2 | PSNR: 17.11 -> 21.55 | Helped |
| Use auxiliary data without Living categories (ablation) | FORA on CIFAR-10 · CIFAR-10 layer 2 | PSNR | Hurt |
| Use auxiliary data without Non-living categories (ablation) | FORA on CIFAR-10 · CIFAR-10 layer 2 | PSNR | Hurt |
| Vary auxiliary dataset size from 5000 to 2500 to 1000 samples (ablation) | FORA on CIFAR-10 · CIFAR-10 layer 2 | reconstruction quality | Mixed |
| Vary auxiliary dataset size from 10000 to 5000 to 2000 samples (ablation) | FORA on CelebA · CelebA layer 2 | reconstruction quality | Mixed |
Surprising findings
- FORA outperforms PCAT even though PCAT uses a subset of the private data while FORA only uses auxiliary data from a different distribution.
- Absence of an entire class from the auxiliary set still allows FORA to reconstruct samples of that class.
Limitations
- Performance degrades on the more complex CelebA dataset under distribution shift between auxiliary and private data.
- Reconstruction quality at deeper split points (layer 4) is weak, with FORA slightly underperforming PCAT on CIFAR-10 layer 4 in SSIM and PSNR.
Experimental setup
Datasets: CIFAR-10 CelebA CINIC-10 FFHQ
Benchmarks: CIFAR-10 CelebA
Metrics: SSIM PSNR LPIPS Cosine Similarity Mean Square Error test accuracy
Baselines: FSHA UnSplit PCAT FSHA with Gradients Scrutinizer
Builds on: FSHA UnSplit PCAT MK-MMD domain adaptation domain discriminator
Closest papers by meaning
- IBAS:Imperceptible Backdoor Attacks in Split Learning with Limited Information (AAAI 2025 · similarity 0.88)
- Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.88)
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.87)
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.85)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.85)
- Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security (ICML 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.