Split Learning

The neural network is divided at a specific cut layer, with initial layers residing on the client and remaining layers on the server. The client processes raw data through its portion of the network and transmits only the smashed data—the intermediate feature representations—to the server. This architectural split ensures that raw input never leaves the client device, providing a fundamental privacy guarantee. The choice of cut layer depth balances privacy preservation against communication overhead, with earlier cuts offering stronger privacy but requiring more data transmission.

Unlike federated learning's parallel client updates, split learning operates sequentially. A single client completes a forward pass through its network segment, sends smashed data to the server, which completes the forward and backward passes, then returns gradients to the client. This sequential nature eliminates the need for clients to store full models and reduces local memory requirements, making it suitable for resource-constrained edge devices. However, it introduces idle time as the server waits for each client, which can be mitigated through parallel client-server configurations.

In standard split learning, the server requires labels to compute the loss. For scenarios where labels are also sensitive, a U-shaped split learning configuration can be employed. In this variant, the network is partitioned into three segments: the initial layers on the client, middle layers on the server, and final layers back on the client. The server never sees either raw data or labels, processing only intermediate activations. This provides end-to-end privacy for both inputs and outputs, critical for applications like private medical diagnosis.

The smashed data transmitted between client and server is typically much smaller than raw input data, offering inherent communication efficiency. For example, in image classification, a 224x224x3 image (150K values) might be reduced to a 7x7x512 feature map (25K values). This dimensionality reduction is a natural byproduct of the network architecture. Additionally, techniques like gradient compression and quantization can be applied to the smashed data and returned gradients to further reduce bandwidth requirements for wireless or low-power deployments.

Split learning can be combined with federated learning to create a split federated learning architecture. In this hybrid, multiple clients each maintain their portion of a split network and train in parallel with a shared server-side segment. The server aggregates smashed data or gradients from multiple clients simultaneously, overcoming the sequential bottleneck of vanilla split learning. This approach marries the model parallelism of split learning with the data parallelism of federated averaging, enabling scalable, privacy-preserving training across large device fleets.

A critical privacy advantage of split learning is that clients never possess the complete model architecture or parameters. The client only holds a partial network up to the cut layer, while the server retains the deeper layers and final classifier. This prevents model inversion attacks that attempt to reconstruct training data from full model weights. Even if a client device is compromised, the adversary gains access only to early-layer features, which are typically less semantically meaningful than deeper representations, providing an additional layer of intellectual property protection for proprietary server-side models.

The intermediate activations (feature maps) produced by the final client-side layer of a split neural network. Instead of raw input, this cut layer output is transmitted to the server, providing an inherent privacy guarantee by obfuscating the original data. The dimensionality and information content of smashed data directly impact both communication efficiency and the privacy-utility trade-off. Unlike federated learning's gradient exchange, smashed data is not a model update but a transformed representation of a single input sample.

A specific split learning configuration designed for dense prediction tasks like channel estimation and spectrogram segmentation. The network is partitioned asymmetrically:

• Client: Hosts the contracting path (encoder) and the expanding path (decoder) up to a bottleneck
• Server: Processes only the deepest, most compressed feature maps This architecture minimizes communication overhead by transmitting only the highly compressed bottleneck activations, making it ideal for bandwidth-constrained RF applications.

A privacy vulnerability in vanilla split learning where the server, by possessing the labels and receiving the smashed data, can compute gradients of the loss with respect to the cut layer activations. These cut layer gradients can be exploited to reconstruct private label information or infer properties of the client's raw data. Defenses include:

• Distance Correlation Minimization: Reducing statistical dependence between smashed data and private labels
• Noisy Gradient Injection: Adding calibrated noise to gradients before backpropagation to the client

A hybrid distributed learning paradigm that combines split learning's model parallelism with federated learning's client parallelism. Multiple clients each hold a portion of the model and train on local data, but instead of sending model updates to a central server, they send smashed data to a shared server-side network. The server aggregates updates across clients before backpropagating. This architecture:

• Reduces client-side computational load compared to full federated learning
• Maintains raw data locality
• Enables parallel training across a large client population

The strategic decision of where to partition a deep neural network between client and server. This choice governs the privacy-computation-communication trade-off:

• Deeper cut (closer to output): Higher privacy (more obfuscation), lower client compute, but larger smashed data tensors
• Shallower cut (closer to input): Lower privacy, higher client compute, smaller communication payload Optimal cut layer selection is often task-dependent and can be dynamically adjusted using neural architecture search or reinforcement learning based on channel conditions.

A defense mechanism against model inversion attacks in split learning. NoPeekNN introduces a distance correlation loss term during training that explicitly minimizes the statistical similarity between the smashed data and the original private input. By decorrelating the intermediate representations from the raw data, the server is prevented from reconstructing client inputs even with full access to the smashed data. This technique provides a quantifiable privacy metric without relying on differential privacy's noise injection.