{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,18]],"date-time":"2026-08-18T01:46:18Z","timestamp":1787017578190,"version":"build-2736575974"},"publisher-location":"New York, NY, USA","reference-count":64,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,11,12]],"date-time":"2021-11-12T00:00:00Z","timestamp":1636675200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,11,12]]},"DOI":"10.1145\/3460120.3485259","type":"proceedings-article","created":{"date-parts":[[2021,11,13]],"date-time":"2021-11-13T12:05:33Z","timestamp":1636805133000},"page":"2113-2129","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":150,"title":["Unleashing the Tiger: Inference Attacks on Split Learning"],"prefix":"10.1145","author":[{"given":"Dario","family":"Pasquini","sequence":"first","affiliation":[{"name":"Sapienza University of Rome & Institute of Applied Computing, IAC-CNR, Rome, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Giuseppe","family":"Ateniese","sequence":"additional","affiliation":[{"name":"George Mason University, Fairfax, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Massimo","family":"Bernaschi","sequence":"additional","affiliation":[{"name":"Institute of Applied Computing, IAC-CNR, Rome, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,11,13]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2020. OpenMined: SplitNN. https:\/\/blog.openmined.org\/tag\/splitnn\/. (2020)."},{"key":"e_1_3_2_1_2_1","volume-title":"Workshop on Split Learning for Distributed Machine Learning (SLDML'21)","unstructured":"2021. Workshop on Split Learning for Distributed Machine Learning (SLDML'21). https:\/\/splitlearning.github.io\/workshop.html. (2021)."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"e_1_3_2_1_4_1","volume-title":"Khan","author":"Abedi Ali","year":"2020","unstructured":"Ali Abedi and Shehroz S. Khan. 2020. FedSL: Federated Split Learning on Distributed Sequential Data in Recurrent Neural Networks. (2020). arXiv:cs.LG\/2011.03180"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3384740"},{"key":"e_1_3_2_1_6_1","unstructured":"Adam James Hall. 2020. Split Neural Networks on PySyft. https:\/\/medium.com\/analytics-vidhya\/split-neural-networks-on-pysyft-ed2abf6385c0. (2020)."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1056\/nejmlim035027"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1504\/IJSN.2015.071829"},{"key":"e_1_3_2_1_9_1","volume-title":"Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Research), Silvia Chiappa and Roberto Calandra (Eds.)","volume":"108","author":"Bagdasaryan Eugene","year":"2020","unstructured":"Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How To Backdoor Federated Learning. In Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Research), Silvia Chiappa and Roberto Calandra (Eds.), Vol. 108. PMLR, Online, 2938--2948. http:\/\/proceedings.mlr.press\/v108\/bagdasaryan20a.html"},{"key":"e_1_3_2_1_10_1","volume-title":"Kamalika Chaudhuri and Ruslan Salakhutdinov (Eds.)","volume":"97","author":"Bhagoji Arjun Nitin","year":"2019","unstructured":"Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. 2019. Analyzing Federated Learning through an Adversarial Lens (Proceedings of Machine Learning Research), Kamalika Chaudhuri and Ruslan Salakhutdinov (Eds.), Vol. 97. PMLR, Long Beach, California, USA, 634--643. http:\/\/proceedings.mlr.press\/v97\/bhagoji19a.html"},{"key":"e_1_3_2_1_11_1","volume-title":"David Petrou, Daniel Ramage, and Jason Roselander.","author":"Bonawitz K. A.","year":"2019","unstructured":"K. A. Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chlo\u00e9 M Kiddon, Jakub Kone?n\u00fd, Stefano Mazzocchi, Brendan McMahan, Timon Van Overveldt, David Petrou, Daniel Ramage, and Jason Roselander. 2019. Towards Federated Learning at Scale: System Design. In SysML 2019. https:\/\/arxiv.org\/abs\/1902.01046 To appear."},{"key":"e_1_3_2_1_12_1","unstructured":"Brendan McMahan Ramesh Raskar Otkrist Gupta Praneeth Vepakomma Hassan Takabi Jakub Kone?n\u00fd. 2019. CVPR Tutorial On Distributed Private Machine Learning for Computer Vision: Federated Learning Split Learning and Beyond. https:\/\/nopeekcvpr.github.io. (2019)."},{"key":"e_1_3_2_1_13_1","unstructured":"Tom B. Brown Benjamin Mann Nick Ryder Melanie Subbiah Jared Kaplan Prafulla Dhariwal Arvind Neelakantan Pranav Shyam Girish Sastry Amanda Askell Sandhini Agarwal Ariel Herbert-Voss Gretchen Krueger Tom Henighan Rewon Child Aditya Ramesh Daniel M. Ziegler Jeffrey Wu Clemens Winter Christopher Hesse Mark Chen Eric Sigler Mateusz Litwin Scott Gray Benjamin Chess Jack Clark Christopher Berner Sam McCandlish Alec Radford Ilya Sutskever and Dario Amodei. 2020. Language Models are Few-Shot Learners. (2020). arXiv:cs.CL\/2005.14165"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.116"},{"key":"e_1_3_2_1_15_1","unstructured":"Iker Ceballos Vivek Sharma Eduardo Mugica Abhishek Singh Alberto Roman Praneeth Vepakomma and Ramesh Raskar. 2020. SplitNN-driven Vertical Partitioning. (2020). arXiv:cs.LG\/2008.04137"},{"key":"e_1_3_2_1_16_1","volume-title":"Proceedings of the Fourteenth International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Research), Geoffrey Gordon, David Dunson, and Miroslav Dud\u00edk (Eds.)","volume":"15","author":"Coates Adam","year":"2011","unstructured":"Adam Coates, Andrew Ng, and Honglak Lee. 2011. An Analysis of Single-Layer Networks in Unsupervised Feature Learning. In Proceedings of the Fourteenth International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Research), Geoffrey Gordon, David Dunson, and Miroslav Dud\u00edk (Eds.), Vol. 15. PMLR, Fort Lauderdale, FL, USA, 215--223. http:\/\/proceedings.mlr.press\/v15\/coates11a.html"},{"key":"e_1_3_2_1_17_1","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Fang Minghong","year":"2020","unstructured":"Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020. Local Model Poisoning Attacks to Byzantine-Robust Federated Learning. In 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, 1605--1622. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/fang"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"e_1_3_2_1_19_1","volume-title":"Jean-Philippe Bossuat, and Jean-Pierre Hubaux.","author":"Froelicher David","year":"2020","unstructured":"David Froelicher, Juan R. Troncoso-Pastoriza, Apostolos Pyrgelis, Sinem Sav, Joao Sa Sousa, Jean-Philippe Bossuat, and Jean-Pierre Hubaux. 2020. Scalable Privacy-Preserving Distributed Learning. (2020). arXiv:cs.CR\/2005.09532"},{"key":"e_1_3_2_1_20_1","volume-title":"The Limitations of Federated Learning in Sybil Settings. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020","author":"Fung Clement","year":"2020","unstructured":"Clement Fung, Chris J. M. Yoon, and Ivan Beschastnikh. 2020. The Limitations of Federated Learning in Sybil Settings. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020). USENIX Association, San Sebastian, 301--316. https:\/\/www.usenix.org\/conference\/raid2020\/presentation\/fung"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243834"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS51746.2020.00017"},{"key":"e_1_3_2_1_23_1","volume-title":"Weinberger (Eds.)","volume":"27","author":"Goodfellow Ian","year":"2014","unstructured":"Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative Adversarial Nets. In Advances in Neural Information Processing Systems, Z. Ghahramani, M. Welling, C. Cortes, N. Lawrence, and K. Q. Weinberger (Eds.), Vol. 27. Curran Associates, Inc., 2672--2680."},{"key":"e_1_3_2_1_24_1","volume-title":"Garnett (Eds.)","volume":"30","author":"Gulrajani Ishaan","year":"2017","unstructured":"Ishaan Gulrajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. 2017. Improved Training of Wasserstein GANs. In Advances in Neural Information Processing Systems, I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (Eds.), Vol. 30. Curran Associates, Inc., 5767--5777."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2018.05.003"},{"key":"e_1_3_2_1_26_1","volume-title":"Skin Lesion Analysis toward Melanoma Detection: A Challenge at the International Symposium on Biomedical Imaging (ISBI)","author":"Gutman David","year":"2016","unstructured":"David Gutman, Noel C. F. Codella, M. Emre Celebi, Brian Helba, Michael A. Marchetti, Nabin K. Mishra, and Allan Halpern. 2016. Skin Lesion Analysis toward Melanoma Detection: A Challenge at the International Symposium on Biomedical Imaging (ISBI) 2016, hosted by the International Skin Imaging Collaboration (ISIC). CoRR abs\/1605.01397 (2016). arXiv:1605.01397 http:\/\/arxiv.org\/abs\/1605.01397"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2945367"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359824"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134012"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICOIN48656.2020.9016486"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2019.2940820"},{"key":"e_1_3_2_1_33_1","volume-title":"Multiple Classification with Split Learning. ArXiv abs\/2008.09874","author":"Kim J.","year":"2020","unstructured":"J. Kim, Sungho Shin, Yeonguk Yu, Junseok Lee, and Kyoobin Lee. 2020. Multiple Classification with Split Learning. ArXiv abs\/2008.09874 (2020)."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3360468.3368176"},{"key":"e_1_3_2_1_35_1","volume-title":"Federated Optimization: Distributed Machine Learning for On-Device Intelligence.","author":"Jakub","year":"2016","unstructured":"Jakub Kone?n\u00fd, H. Brendan McMahan, Daniel Ramage, and Peter Richt\u00e1rik. 2016. Federated Optimization: Distributed Machine Learning for On-Device Intelligence. (2016). arXiv:cs.LG\/1610.02527"},{"key":"e_1_3_2_1_36_1","volume-title":"Ananda Theertha Suresh, and Dave Bacon","author":"Jakub","year":"2017","unstructured":"Jakub Kone?n\u00fd, H. Brendan McMahan, Felix X. Yu, Peter Richt\u00e1rik, Ananda Theertha Suresh, and Dave Bacon. 2017. Federated Learning: Strategies for Improving Communication Efficiency. (2017). arXiv:cs.LG\/1610.05492"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1126\/science.aab3050"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2020.3003307"},{"key":"e_1_3_2_1_39_1","volume-title":"Zehui Xiong, Dusit Niyato, Cyril Leung, Chunyan Miao, and Qiang Yang.","author":"Bryan Lim Wei Yang","year":"2020","unstructured":"Wei Yang Bryan Lim, Jer Shyuan Ng, Zehui Xiong, Dusit Niyato, Cyril Leung, Chunyan Miao, and Qiang Yang. 2020. Incentive Mechanism Design for Resource Sharing in Collaborative Edge Learning. (2020). arXiv:cs.NI\/2006.00511"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"e_1_3_2_1_41_1","volume-title":"Moin Hussain Moti, and D. Chatzopoulos","author":"Palanisamy Kamalesh","year":"2020","unstructured":"Kamalesh Palanisamy, Vivek Khimani, Moin Hussain Moti, and D. Chatzopoulos. 2020. SplitEasy: A Practical Approach for Training ML models on Mobile Devices in a split second. ArXiv abs\/2011.04232 (2020)."},{"key":"e_1_3_2_1_42_1","unstructured":"Maarten G. Poirot Praneeth Vepakomma Ken Chang Jayashree Kalpathy-Cramer Rajiv Gupta and Ramesh Raskar. 2019. Split Learning for collaborative deep learning in healthcare. (2019). arXiv:cs.LG\/1912.12115"},{"key":"e_1_3_2_1_43_1","volume-title":"4th International Conference on Learning Representations, ICLR","author":"Radford Alec","year":"2016","unstructured":"Alec Radford, Luke Metz, and Soumith Chintala. 2016. Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks. In 4th International Conference on Learning Representations, ICLR 2016, San Juan, Puerto Rico, May 2--4, 2016, Conference Track Proceedings, Yoshua Bengio and Yann LeCun (Eds.). http:\/\/arxiv.org\/abs\/1511.06434"},{"key":"e_1_3_2_1_44_1","volume-title":"PyVertical: A Vertical Federated Learning Framework for Multi-headed SplitNN. In ICLR 2021 Workshop on Distributed and Private Machine Learning.","author":"Romanini Daniele","unstructured":"Daniele Romanini, Adam James Hall, Pavlos Papadopoulos, Tom Titcombe, Abbas Ismail, Tudor Cebere, Robert Sandmann, Robin Roehm, and Michael A. Hoeh. 2021. PyVertical: A Vertical Federated Learning Framework for Multi-headed SplitNN. In ICLR 2021 Workshop on Distributed and Private Machine Learning."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2019.2944481"},{"key":"e_1_3_2_1_46_1","unstructured":"Vivek Sharma Praneeth Vepakomma Tristan Swedish Ken Chang Jayashree Kalpathy-Cramer and Ramesh Raskar. 2019. ExpertMatcher: Automating ML Model Selection for Clients using Hidden Representations. (2019). arXiv:cs.CV\/1910.03731"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813687"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_1_49_1","unstructured":"Abhishek Singh Praneeth Vepakomma Otkrist Gupta and Ramesh Raskar. 2019. Detailed comparison of communication efficiency of split learning and federated learning. (2019). arXiv:cs.LG\/1909.09145"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1214\/009053607000000505"},{"key":"e_1_3_2_1_51_1","unstructured":"Chandra Thapa M. A. P. Chamikara and Seyit Camtepe. 2020. SplitFed: When Federated Learning Meets Split Learning. (2020). arXiv:cs.LG\/2004.12088"},{"key":"e_1_3_2_1_52_1","volume-title":"Camtepe","author":"Thapa Chandra","year":"2020","unstructured":"Chandra Thapa, M. A. P. Chamikara, and Seyit A. Camtepe. 2020. Advancements of federated learning towards privacy preservation: from federated learning to split learning. (2020). arXiv:cs.LG\/2011.14818"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1038\/sdata.2018.161"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3386367.3431678"},{"key":"e_1_3_2_1_55_1","volume-title":"Reducing leakage in distributed deep learning for sensitive health data. (05","author":"Vepakomma Praneeth","year":"2019","unstructured":"Praneeth Vepakomma, Otkrist Gupta, Abhimanyu Dubey, and Ramesh Raskar. 2019. Reducing leakage in distributed deep learning for sensitive health data. (05 2019)."},{"key":"e_1_3_2_1_56_1","unstructured":"Praneeth Vepakomma Otkrist Gupta Tristan Swedish and Ramesh Raskar. 2018. Split learning for health: Distributed deep learning without sharing raw patient data. (2018). arXiv:cs.LG\/1812.00564"},{"key":"e_1_3_2_1_57_1","volume-title":"No Peek: A Survey of private distributed deep learning.","author":"Vepakomma Praneeth","year":"2018","unstructured":"Praneeth Vepakomma, Tristan Swedish, Ramesh Raskar, Otkrist Gupta, and Abhimanyu Dubey. 2018. No Peek: A Survey of private distributed deep learning. (2018). arXiv:cs.LG\/1812.03288"},{"key":"e_1_3_2_1_58_1","volume-title":"No Peek: A Survey of private distributed deep learning.","author":"Vepakomma Praneeth","year":"2018","unstructured":"Praneeth Vepakomma, Tristan Swedish, Ramesh Raskar, Otkrist Gupta, and Abhimanyu Dubey. 2018. No Peek: A Survey of private distributed deep learning. (2018). arXiv:cs.LG\/1812.03288"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/IPDPS47924.2020.00031"},{"key":"e_1_3_2_1_60_1","unstructured":"Jiayu Wu Qixiang Zhang and Guoxi Xu. 2020. Tiny ImageNet Challenge. http:\/\/cs231n.stanford.edu\/reports\/2017\/pdfs\/930.pdf . (2020)."},{"key":"e_1_3_2_1_61_1","unstructured":"Han Xiao Kashif Rasul and Roland Vollgraf. 2017. Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms. (2017). arXiv:cs.LG\/1708.07747"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.463"},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00033"},{"key":"e_1_3_2_1_64_1","volume-title":"Garnett (Eds.)","volume":"32","author":"Zhu Ligeng","year":"2019","unstructured":"Ligeng Zhu, Zhijian Liu, and Song Han. 2019. Deep Leakage from Gradients. In Advances in Neural Information Processing Systems, H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alch\u00e9-Buc, E. Fox, and R. Garnett (Eds.), Vol. 32. Curran Associates, Inc. https:\/\/proceedings.neurips.cc\/paper\/2019\/file\/60a6c4002cc7b29142def8871531281a-Paper.pdf"}],"event":{"name":"CCS '21: 2021 ACM SIGSAC Conference on Computer and Communications Security","location":"Virtual Event Republic of Korea","acronym":"CCS '21","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3460120.3485259","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3460120.3485259","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T20:49:36Z","timestamp":1763498976000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3460120.3485259"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,12]]},"references-count":64,"alternative-id":["10.1145\/3460120.3485259","10.1145\/3460120"],"URL":"https:\/\/doi.org\/10.1145\/3460120.3485259","relation":{},"subject":[],"published":{"date-parts":[[2021,11,12]]},"assertion":[{"value":"2021-11-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}