Split Learning

The deep neural network is physically split into a client-side segment and a server-side segment at a designated cut layer. The client processes raw private data through initial layers, generating smashed data (intermediate activations) that is transmitted to the server. The server completes forward propagation through the remaining layers, computes the loss, and backpropagates gradients to the cut layer. Only the gradients at the cut layer are sent back to the client, which then completes its own backward pass locally. This architecture ensures the server never accesses raw training samples.

A specialized variant where the network is split at both ends, with the client holding the initial and final layers while the server processes the middle layers. This is particularly valuable for supervised learning with private labels. The client sends activations to the server for intermediate processing, receives activations back, and completes the final layers locally. The loss is computed on the client side, ensuring that label privacy is preserved alongside input privacy. This configuration is ideal for telecom scenarios where both user data and service classifications are sensitive.

Unlike federated learning's parallel client updates, split learning operates sequentially across clients. Each client connects to the server, performs forward propagation through its segment, and waits for the server to complete its portion and return gradients. This sequential nature eliminates the need for global model synchronization and avoids the straggler problem inherent in parallel federated averaging. However, it introduces idle server time between client connections, making it best suited for cross-silo deployments with a manageable number of reliable participants rather than massive cross-device populations.

The cut layer position directly governs the privacy-communication trade-off:

• Early cut layer: More layers on the server, smaller activations transmitted, lower communication cost, but reduced privacy as activations retain more structural information about raw inputs
• Late cut layer: More layers on the client, larger and more abstract activations, higher communication overhead, but stronger privacy guarantees as transmitted data is highly transformed Telecom operators can dynamically adjust the cut layer based on available backhaul bandwidth and the sensitivity of the data being processed at each base station.

A hybrid paradigm that combines split learning's model parallelism with federated learning's data parallelism. Multiple clients each hold a portion of the network split and train in parallel, with a central server aggregating updates similarly to FedAvg. This addresses split learning's sequential bottleneck while maintaining privacy benefits. In telecom RAN deployments, SplitFed enables base stations to train collaboratively in parallel while still preventing raw signal data from leaving the edge, achieving both convergence speed and data locality.

In vertical split learning, the network is partitioned such that the client holds the input layers and the server holds the label-associated layers. This is critical when labels themselves are proprietary—for example, a telecom operator's churn prediction labels or fraud classifications. The server computes the loss without the client seeing the true labels, and only gradients flow back. Combined with differential privacy noise injection on transmitted activations, this provides a rigorous privacy framework for collaborative model training between competing operators or between a telecom and a third-party analytics provider.

The defining structural pattern of split learning where a deep neural network is partitioned into a client-side model and a server-side model. The client processes raw data through initial layers and transmits only the smashed data (intermediate activations) at the cut layer. The server completes the forward pass, computes the loss, and backpropagates gradients to the cut layer, which are then sent back to the client. This creates a U-shaped flow of computation and gradients, ensuring raw data never leaves the client device.

Smashed data refers to the intermediate feature representations output by the client-side portion of a split neural network at the designated cut layer. Rather than transmitting raw input, the client sends these transformed, lower-dimensional activations to the server. The cut layer selection involves a critical trade-off:

• Deeper cut layers provide stronger privacy by abstracting raw features further but increase client computational load
• Shallower cut layers reduce client overhead but may leak more information about the original input Optimal cut point selection balances privacy guarantees against communication efficiency and model accuracy.

In standard split learning, the server requires access to ground-truth labels to compute the loss function, which can be a privacy vulnerability. Label privacy is achieved through a variant called U-shaped training without label sharing, where the loss computation is also moved to the client side. The server transmits gradients back to the cut layer, and the client completes the remaining backward pass and loss calculation locally. This ensures neither raw data nor labels are exposed to the server, making it ideal for sensitive telecom applications like user behavior prediction.

SplitFed combines the privacy benefits of split learning with the parallel training efficiency of federated learning. In this hybrid architecture:

• Multiple clients maintain their own client-side model segments
• A shared federated server aggregates server-side model updates from parallel training rounds
• Clients never share raw data, and the server-side model benefits from diverse, distributed training This approach overcomes the sequential training bottleneck of vanilla split learning—where only one client trains at a time—while maintaining strong privacy guarantees for telecom edge deployments.

Even smashed data can leak information through model inversion attacks that reconstruct input features from intermediate activations. To mitigate this, differential privacy mechanisms inject calibrated noise into the transmitted activations or gradients at the cut layer:

• Gaussian noise is added proportional to the sensitivity of the smashed data
• The privacy budget (ε) controls the trade-off between privacy strength and model accuracy
• Privacy amplification by subsampling occurs naturally when training on random mini-batches This provides formal mathematical guarantees that the server cannot infer individual training samples from the received activations.

Split learning introduces a unique communication pattern where each training iteration requires two round trips between client and server: forward activations and backward gradients. Key optimization strategies include:

• Gradient compression using quantization to reduce the bit-size of transmitted updates
• Adaptive cut layer selection based on available bandwidth and client compute capacity
• Straggler mitigation through timeout thresholds for slow clients in parallel split learning setups For telecom edge deployments, minimizing this communication overhead is critical when operating over bandwidth-constrained RAN interfaces.