Measuring and Controlling Split Layer Privacy Leakage Using Fisher Information
This work addresses privacy concerns for users of split learning systems, offering a method to measure and enforce privacy levels, though it is incremental as it builds on existing split learning frameworks.
The paper tackles the problem of privacy leakage in split learning and inference by proposing Fisher information as a metric to quantify information leakage through the split layer, and introduces ReFIL to control this leakage while maintaining utility.
Split learning and inference propose to run training/inference of a large model that is split across client devices and the cloud. However, such a model splitting imposes privacy concerns, because the activation flowing through the split layer may leak information about the clients' private input data. There is currently no good way to quantify how much private information is being leaked through the split layer, nor a good way to improve privacy up to the desired level. In this work, we propose to use Fisher information as a privacy metric to measure and control the information leakage. We show that Fisher information can provide an intuitive understanding of how much private information is leaking through the split layer, in the form of an error bound for an unbiased reconstruction attacker. We then propose a privacy-enhancing technique, ReFIL, that can enforce a user-desired level of Fisher information leakage at the split layer to achieve high privacy, while maintaining reasonable utility.