Split Federated Learning

SFL decomposes a neural network into a client-side model and a server-side model at a designated cut layer. The client executes the initial layers on private data, transmitting only smashed data—intermediate feature representations—to the server. The server completes the forward pass, computes the loss, and backpropagates gradients to the cut layer. The client then finalizes backpropagation locally. This partitioning ensures that raw training samples never leave the client device, while the server never accesses the complete model architecture.

In standard split learning, the server requires access to ground-truth labels to compute the loss function. SFL addresses this vulnerability by adopting a U-shaped configuration: the server processes smashed data through its layers, then returns intermediate gradients to the client, which holds the final classification head and labels locally. This architectural choice prevents label leakage to an honest-but-curious server, a critical requirement for applications in healthcare diagnostics and financial fraud detection where label privacy is paramount.

Unlike sequential split learning, SFL enables concurrent training across multiple clients. Each client maintains its own client-side model and collaborates with the server on its server-side model. After local forward-backward passes, clients upload their client-side model updates to a federated aggregation server. The server performs weighted averaging—typically Federated Averaging (FedAvg)—to produce a global client-side model, which is then redistributed. This parallelism dramatically reduces wall-clock training time compared to sequential approaches.

SFL's privacy guarantees stem from the fundamental principle that only intermediate activations and gradients traverse the network boundary. The server receives smashed data—a lossy, task-specific compression of the input—rather than the original sample. Furthermore, techniques like differential privacy can be applied to the transmitted smashed data by adding calibrated Gaussian noise, providing formal privacy guarantees. This gradient-only communication paradigm satisfies stringent regulatory requirements under frameworks like GDPR and HIPAA, making SFL suitable for cross-silo collaborations between hospitals or financial institutions.

By offloading the server-side model—typically the most computationally intensive layers—to a powerful edge or cloud server, SFL significantly reduces the on-device compute requirements. The client executes only a shallow feature extractor, which can be optimized for resource-constrained hardware such as smartphones or IoT sensors. This asymmetry enables participation from devices that would be incapable of training a full model locally, democratizing access to collaborative learning for TinyML and microcontroller-class devices.

SFL inherits federated learning's robustness to non-IID data distributions—the common real-world scenario where client datasets are statistically heterogeneous. Because each client trains its own client-side model on local data, the feature extraction process adapts to individual data characteristics. The server-side model learns from diverse smashed data representations, improving generalization. Advanced aggregation strategies like FedProx or SCAFFOLD can be integrated to further stabilize convergence when client data distributions diverge significantly.

A distributed machine learning paradigm where a shared global model is trained across multiple decentralized clients holding local data samples, without exchanging the raw data. Only model updates (gradients or weights) are sent to a central aggregation server, typically using Federated Averaging (FedAvg). This contrasts with Split Federated Learning, where the model itself is partitioned, not just the data.

A collaborative inference paradigm that partitions a single deep neural network into a head (executed on-device) and a tail (executed on an edge server). The intermediate activations, often called smashed data, are transmitted at the partition point. Split Federated Learning extends this concept to the training phase, combining model parallelism with privacy-preserving aggregation.

The strategic division of a neural network's computational graph into distinct segments for distributed execution. Key considerations include:

• Bottleneck layer selection to minimize transmission overhead
• Balancing compute load between client and server
• Privacy budget analysis of transmitted activations
• Network bandwidth and latency constraints

A rigorous mathematical framework that provides provable privacy guarantees by injecting calibrated statistical noise into model updates or transmitted activations. In the context of Split Federated Learning, differential privacy mechanisms can be applied to the smashed data or gradients before transmission, ensuring that the server cannot reconstruct private training samples from intermediate representations.

A federated learning variant where participants hold different feature spaces for the same set of entities. Unlike standard (horizontal) federated learning where data is partitioned by samples, vertical FL requires entity alignment and secure computation of split gradients. Split Federated Learning naturally accommodates vertical partitioning by placing the overlapping portion of the model on a neutral server.

A cryptographic protocol suite that enables multiple parties to jointly compute a function over their private inputs without revealing those inputs to each other. In Split Federated Learning, SMPC can protect the intermediate activations and gradients exchanged at the partition point, providing stronger privacy guarantees than differential privacy alone, though at higher computational and communication cost.