Search papers, labs, and topics across Lattice.
CliCooper is introduced as a multi-client cooperative split learning framework designed for heterogeneous and partially trusted environments, where one client provides data and others act as trainers. It protects data privacy using differential privacy-based activation protection and secret label obfuscation, maintaining model performance. The framework also incorporates a dynamic chained watermarking scheme to ensure verifiable training integrity, robust model provenance, and copyright protection.
Achieve near-perfect privacy against clustering and inversion attacks in split learning without sacrificing model accuracy by using differential privacy and secret label obfuscation.
Model training is increasingly offered as a service for resource-constrained data owners to build customized models. Split Learning (SL) enables such services by offloading training computation under privacy constraints, and evolves toward serverless and multi-client settings where model segments are distributed across training clients. This cooperative mode assumes partial trust: data owners hide labels and data from trainer clients, while trainer clients produce verifiable training artifacts and ownership proofs. We present CliCooper, a multi-client cooperative SL framework tailored for cooperative model training services in heterogeneous and partially trusted environments, where one client contributes data, while others collectively act as SL trainers. CliCooper bridges the privacy and trust gaps through two new designs. First, differential privacy-based activation protection and secret label obfuscation safeguard data owners'privacy without degrading model performance. Second, a dynamic chained watermarking scheme cryptographically links training stages on model segments across trainers, ensuring verifiable training integrity, robust model provenance, and copyright protection. Experiments show that CliCooper preserves model accuracy while enhancing resilience to privacy and ownership attacks. It reduces the success rate of clustering attacks (which infer label groups from intermediate activation) to 0%, decreases inversion-reconstruction (which recovers training data) similarity from 0.50 to 0.03, and limits model-extraction-based surrogates to about 1% accuracy, comparable to random guessing.
