Split Learning

The neural network is physically divided into two segments: a client-side portion that remains on the data-holding institution's infrastructure, and a server-side portion hosted remotely. The client computes forward passes up to a designated cut layer, then transmits only the resulting smashed data (intermediate activations) to the server. The server completes the forward pass, computes the loss, and backpropagates gradients to the cut layer. Crucially, the server never accesses raw input data or full model gradients, fundamentally limiting information leakage compared to federated averaging approaches.

Split learning employs a sequential, U-shaped communication pattern rather than parallel client updates. The process flows:

• Forward Pass: Client computes to cut layer → transmits activations → server completes forward pass
• Backward Pass: Server computes gradients to cut layer → transmits gradients back → client completes backpropagation This sequential nature eliminates the need for clients to share model weights, but introduces communication latency as a primary engineering consideration. The protocol is particularly suited for cross-silo settings where institutions have reliable, high-bandwidth connections.

Unlike federated learning where labels may be inferred from gradient updates, split learning can be configured so that labels remain exclusively on the server side. In medical imaging contexts, this means the institution holding patient scans (the client) never needs to share diagnostic labels with external parties. The server computes the loss function without the client accessing label information, creating an asymmetric privacy guarantee. This architecture is valuable when labels themselves constitute protected health information or proprietary clinical annotations.

SplitFed combines the privacy properties of split learning with the parallel training efficiency of federated learning. Multiple clients maintain their own client-side network segments and train simultaneously, while a shared server-side network processes all smashed data. This hybrid architecture:

• Reduces the idle time inherent in sequential split learning
• Preserves the raw data privacy guarantees of the split architecture
• Enables multi-institutional collaboration at scales impractical for pure split learning SplitFed is emerging as a practical compromise for healthcare consortia requiring both privacy and throughput.

The choice of cut layer represents a critical design decision balancing privacy, communication efficiency, and model performance:

• Shallow cut (early layers): More computation on server, smaller transmitted activations, but greater information leakage risk from low-level features
• Deep cut (later layers): Stronger privacy guarantees as transmitted features are more abstract, but larger activation tensors increase bandwidth requirements
• Optimal placement depends on the specific data modality, network architecture, and threat model. For medical imaging, deeper cuts are typically preferred to ensure transmitted representations cannot be inverted to reconstruct identifiable patient scans.

A fundamental distinction from federated learning: split learning clients never transmit model gradients to any external party. Only intermediate activations flow from client to server, and only gradients up to the cut layer flow back. This eliminates entire classes of gradient leakage attacks that can reconstruct training data from shared weight updates. The server learns only the representation at the cut layer, not the parameters or gradients of the client-side network. This property makes split learning particularly compelling for regulatory compliance under GDPR and HIPAA frameworks where gradient sharing may be considered a data transfer.

The foundational federated learning algorithm where clients train a complete local model and share weight updates with a central server for aggregation. Unlike Split Learning, which partitions the network architecture, FedAvg partitions the data and requires clients to have sufficient compute resources to train the entire model locally. The server computes a weighted average of all client updates to produce a new global model.

A mathematical framework that injects calibrated statistical noise into data or model updates to provide a provable guarantee against membership inference. In the context of Split Learning, DP can be applied to the smashed data (intermediate activations) transmitted by the client, ensuring that even if an adversary intercepts the communication, they cannot determine if a specific patient's scan was used in training. The privacy loss is tracked by a parameter called epsilon (ε).

A cryptographic subfield enabling multiple parties to jointly compute a function over their private inputs while ensuring that no party learns anything beyond the final output. SMPC can be integrated with Split Learning to secure the aggregation of multiple client-side model segments without revealing individual activations to a central server, moving beyond a simple two-party client-server split to a fully decentralized computation.

A cryptographic scheme that enables computation directly on ciphertext, producing an encrypted result that, when decrypted, matches the output of operations performed on the original plaintext. In Split Learning, HE allows the server to perform forward and backward propagation on the encrypted activations received from the client, ensuring the server never sees the raw intermediate data or learns anything about the private input.

A variant configuration where the network is partitioned such that the initial and final layers reside on the client side, while the deep intermediate layers are processed by a server. The client sends activations to the server, which processes them through its layers and returns the intermediate gradients. The client then completes the backward pass locally. This prevents the server from seeing both the raw input and the final label.

The divergence of locally trained model segments from an optimal collaborative objective caused by heterogeneous, Non-IID data distributions across participating client nodes. In Split Learning, client drift manifests when different clients train their respective network partitions on vastly different patient demographics, leading to unstable convergence when the server-side model attempts to reconcile these divergent statistical signals.