SplitGuard：检测和缓解分裂学习中的训练劫持攻击
SplitGuard: Detecting and Mitigating Training-Hijacking Attacks in Split Learning
摘要：
分布式深度学习框架（如分裂学习）在训练深度神经网络的计算成本和一组数据持有者的集体数据的隐私意识利用方面提供了巨大的好处。具体来说，分裂学习通过在客户端和服务器之间划分神经网络来实现这一目标，这样客户端计算初始层集合，服务器计算其余部分。然而，这种方法为试图窃取客户端私有数据的恶意服务器引入了一个独特的攻击向量：服务器可以引导客户端模型学习其选择的任何任务，例如输出容易可逆的值。通过已经提出的具体示例（Pasquini等人，CCS '21），这种训练劫持攻击对分裂学习客户端的数据隐私构成了重大风险。在本文中，我们提出了SplitGuard，这是一种分裂学习客户端可以检测其是否被训练劫持攻击的方法。我们通过实验评估我们的方法的有效性，将其与潜在的替代品进行比较，并详细讨论与其使用相关的各个点。我们的结论是，SplitGuard可以有效地检测训练劫持攻击，同时最大限度地减少由对手恢复的信息量。
英文摘要：
Distributed deep learning frameworks such as split learning provide great benefits with regards to the computational cost of training deep neural networks and the privacy-aware utilization of the collective data of a group of data-holders. Split learning, in particular, achieves this goal by dividing a neural network between a client and a server so that the client computes the initial set of layers, and the server computes the rest. However, this method introduces a unique attack vector for a malicious server attempting to steal the client's private data: the server can direct the client model towards learning any task of its choice, e.g. towards outputting easily invertible values. With a concrete example already proposed (Pasquini et al., CCS '21), such training-hijacking attacks present a significant risk for the data privacy of split learning clients. In this paper, we propose SplitGuard, a method by which a split learning client can detect whether it is being targeted by a training-hijacking attack or not. We experimentally evaluate our method's effectiveness, compare it with potential alternatives, and discuss in detail various points related to its use. We conclude that SplitGuard can effectively detect training-hijacking attacks while minimizing the amount of information recovered by the adversaries.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
