Split Learning

The neural network is surgically divided at a specific cut layer. The client retains the initial layers close to the data, while the server holds the deeper layers. Only the smashed data (intermediate activations) and corresponding gradients cross the network boundary, ensuring raw training data never leaves the client device.

Unlike federated learning's parallel client updates, split learning operates sequentially. A single client performs forward propagation up to the cut layer, sends activations to the server, which completes the forward pass and backpropagation, then returns gradients to the client. This eliminates the need for clients to compute full model gradients, reducing their computational burden.

In U-shaped configurations, labels never leave the server. The server computes the loss and initiates backpropagation without the client ever accessing ground truth labels. This is critical for applications where labels themselves are sensitive, such as medical diagnosis codes or financial fraud classifications.

Because the client never receives the full model's gradients—only the gradients flowing back to the cut layer—the attack surface for gradient inversion is significantly reduced. The server's gradients are computed on activations, not raw data, making reconstruction attacks substantially harder compared to federated learning.

Split learning naturally accommodates heterogeneous client capabilities. A low-power IoT sensor can run a few convolutional layers, while a GPU-rich server handles transformer backbones. This makes it ideal for tinyML and edge deployments where clients cannot store or execute large models.

To further enhance privacy, clients can apply differential privacy mechanisms directly to the smashed data before transmission. By clipping and adding calibrated Gaussian noise to activations, the client enforces a formal privacy budget on the information revealed to the server, providing mathematical guarantees against leakage.