提出防御分裂学习中后门攻击的新方法，有效识别并清除恶意数据。
SecureSplit: Mitigating Backdoor Attacks in Split Learning
- 通过维度变换增强正常与污染嵌入的差异
- 用多数投票机制过滤掉受攻击的嵌入，保留纯净数据
- 在4个数据集、5种攻击下均表现优异，适合隐私保护场景
分裂学习（Split Learning, SL）提供了一种尊重数据隐私的协作训练框架，允许参与者共享同一数据集但保持各自特征集独立。然而，SL易受后门攻击影响，恶意客户端会微调其嵌入以植入隐藏触发器，从而破坏最终训练模型。为此，本文提出SecureSplit，一种专为SL设计的防御机制。该方法采用维度变换策略，放大正常与中毒嵌入间的细微差异，促进两者分离；在此基础上，构建基于多数投票的自适应过滤方法，有效剔除受污染嵌入，同时保留清洁样本。在四个数据集（CIFAR-10、MNIST、CINIC-10、ImageNette）、五种后门攻击场景及七种现有防御方法的对比实验中，SecureSplit展现出卓越鲁棒性，在多种严苛条件下均验证了其有效性。
原文摘要 · Abstract (English)
Split Learning (SL) offers a framework for collaborative model training that respects data privacy by allowing participants to share the same dataset while maintaining distinct feature sets. However, SL is susceptible to backdoor attacks, in which malicious clients subtly alter their embeddings to insert hidden triggers that compromise the final trained model. To address this vulnerability, we introduce SecureSplit, a defense mechanism tailored to SL. SecureSplit applies a dimensionality transformation strategy to accentuate subtle differences between benign and poisoned embeddings, facilitating their separation. With this enhanced distinction, we develop an adaptive filtering approach that uses a majority-based voting scheme to remove contaminated embeddings while preserving clean ones. Rigorous experiments across four datasets (CIFAR-10, MNIST, CINIC-10, and ImageNette), five backdoor attack scenarios, and seven alternative defenses confirm the effectiveness of SecureSplit under various challenging conditions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。