Split Learning

The neural network is physically divided into two segments: a client-side model (initial layers) and a server-side model (remaining layers). The client processes raw data locally through its portion of the network, producing compressed intermediate activations at the cut layer. Only these activations—not the original data—are transmitted to the server. The server completes the forward pass, computes the loss, and backpropagates gradients to the cut layer. Gradients at the cut layer are then sent back to the client to update its local weights.

• Cut layer selection critically impacts privacy-utility trade-offs
• Deeper cut layers provide stronger privacy guarantees but increase client compute burden
• No raw data, labels, or model parameters are ever exchanged between parties

The activations shared at the cut layer are termed smashed data—a compressed, non-linear transformation of the original input. Unlike federated learning, where model weights or gradients are shared, split learning transmits only forward-pass activations. This provides a distinct privacy advantage: reconstructing raw inputs from smashed data is computationally difficult, especially when the cut layer is deep within the network. The server never accesses the client-side model architecture or parameters.

• Smashed data dimensionality is typically far lower than raw input
• Provides asymmetric privacy: the server learns labels but not inputs; the client learns inputs but not labels
• Can be combined with differential privacy by adding noise to smashed data before transmission

Split learning operates through a sequential client-server handshake rather than parallel client updates. In each training iteration, the client computes its forward pass and sends smashed data to the server. The server completes the forward and backward passes, then returns gradients to the client. This sequential dependency eliminates the need for simultaneous client participation but introduces idle time where one party waits for the other.

• Naturally handles intermittent client availability
• No requirement for all clients to be online simultaneously
• Can be parallelized across multiple clients using split learning with multiple clients configurations
• Communication cost is proportional to cut layer activation size, not model size

A unique capability of split learning is label privacy: the server can hold labels without the client ever seeing them. This is critical in healthcare scenarios where a hospital (client) holds patient data but a pharmaceutical company (server) holds proprietary diagnostic labels or treatment outcomes. The client never learns the ground truth, and the server never sees raw patient records.

• Enables vertical federated learning scenarios where parties hold different features or labels for the same entities
• Supports multi-institutional collaboration where label ownership is sensitive intellectual property
• The server can be a model owner providing a proprietary classifier as a service

In the U-shaped configuration, the network is split at two points rather than one. The client holds the first and last segments, while the server holds the middle layers. The client sends smashed data to the server, which processes it through its hidden layers and returns intermediate activations back to the client for final classification. This architecture provides mutual privacy: the server never sees raw inputs or final outputs, and the client never sees the server's proprietary intermediate layers.

• Both input and label privacy are preserved simultaneously
• Ideal for competitive collaborations where both parties have sensitive intellectual property
• Increases communication overhead due to bidirectional smashed data transfer

Split learning fundamentally differs from Federated Averaging (FedAvg) in communication patterns. FedAvg transmits full model weights or gradients—potentially millions of parameters—per round. Split learning transmits only smashed data activations, which are typically orders of magnitude smaller. For a ResNet-50 with a cut layer after the third block, smashed data may be only 4KB per sample versus 100MB+ for full model weights.

• Dramatically lower bandwidth requirements per communication round
• Higher total communication rounds due to sequential training
• Best suited for cross-silo settings with reliable, high-latency-tolerant connections
• Can be combined with quantization or sparsification of smashed data for further compression

The intermediate activations transmitted from the client-side cut layer to the server in split learning. This data represents a non-linear, lossy transformation of the raw input, making direct reconstruction of the original sample significantly harder than sharing raw pixels or model gradients. The dimensionality and information content of smashed data are determined by the cut layer depth—deeper cuts produce more abstract, lower-dimensional representations. Unlike gradients in federated learning, smashed data does not directly encode per-sample error signals, reducing susceptibility to gradient leakage attacks.

A split learning architecture where the network is partitioned into three segments: an initial client-side portion, a server-side middle, and a final client-side portion. The raw data enters the first client segment, smashed data travels to the server for processing, and the server's activations return to the client for final layers and loss computation. This configuration ensures labels never leave the client, providing stronger privacy for supervised learning tasks. The U-shape is particularly relevant when the label itself is sensitive, such as in patient diagnosis classification.

A hybrid paradigm that combines the server-side parallelization of federated learning with the model partitioning of split learning. Multiple clients train split network segments simultaneously, and the server aggregates their server-side model updates via federated averaging. This addresses split learning's primary bottleneck—sequential client training—while retaining its privacy advantages. SplitFed is particularly suited for cross-silo deployments where a small number of institutional clients require both computational efficiency and strict data locality.

The strategic decision of where to partition a neural network between client and server, balancing privacy, communication overhead, and computational load. Early cuts (close to the input) transmit larger, more interpretable smashed data but offload more computation to the server—beneficial for resource-constrained edge devices. Late cuts (close to the output) produce highly compressed, abstract representations with stronger privacy guarantees but require the client to handle more computation. Optimal cut selection is often determined empirically through mutual information analysis between smashed data and raw inputs.

A defensive technique that adds a distance correlation minimization loss term during training to explicitly decorrelate smashed data from raw inputs. This reduces the mutual information between the transmitted activations and the original private data, providing a quantifiable privacy guarantee against an honest-but-curious server attempting input reconstruction. NoPeek is complementary to split learning and can be integrated directly into the training objective without requiring cryptographic overhead, making it suitable for latency-sensitive medical imaging applications.

A privacy vulnerability where an adversarial server can infer client labels by analyzing the gradients flowing back through the cut layer during backpropagation. Unlike federated learning where gradient leakage targets input data, split learning's primary label leakage vector arises because the server computes the forward pass through its layers and observes the loss gradients. Defenses include U-shaped configurations that keep the loss computation client-side, gradient perturbation with differential privacy noise, and label differential privacy mechanisms that randomize the training signal.