Model Extraction Attacks on Split Federated Learning

Abstract

Federated Learning (FL) is a popular collaborative learning scheme involving multiple clients and a server. FL focuses on protecting clients' data but turns out to be highly vulnerable to Intellectual Property (IP) threats. Since FL periodically collects and distributes the model parameters, a free-rider can download the latest model and thus steal model IP. Split Federated Learning (SFL), a recent variant of FL that supports training with resource-constrained clients, splits the model into two, giving one part of the model to clients (client-side model), and the remaining part to the server (server-side model). Thus SFL prevents model leakage by design. Moreover, by blocking prediction queries, it can be made resistant to advanced IP threats such as traditional Model Extraction (ME) attacks. While SFL is better than FL in terms of providing IP protection, it is still vulnerable. In this paper, we expose the vulnerability of SFL and show how malicious clients can launch ME attacks by querying the gradient information from the server side. We propose five variants of ME attack which differs in the gradient usage as well as in the data assumptions. We show that under practical cases, the proposed ME attacks work exceptionally well for SFL. For instance, when the server-side model has five layers, our proposed ME attack can achieve over 90% accuracy with less than 2% accuracy degradation with VGG-11 on CIFAR-10.

EMGAN: Early-Mix-GAN on Extracting Server-Side Model in Split Federated Learning

“…In finetuning case when the model is mostly static, attackers can obtain consistent gradient information through gradient queries. It is the consistent gradients that contribute to the success of MEAs such as Craft-ME and GAN-ME in (Li et al 2023b).…”

“…These inconsistent gradients present a challenge for gradient-based MEAs to effectively utilize the gradient information. Prior works (Li et al 2023b) demonstrate that for training-from-scratch case, gradient-based MEAs result in a large accuracy drop of over 40% in the surrogate model.…”

“…However, SFL also suffers from model leakage due to (1) availability of client-side models, and (2) access to gradients sent by the server to clients. It is demonstrated in (Li et al 2023b) that the client-side model along with a small amount of training data is enough to get an accurate model using Train-ME, a method that simply trains the server-side model from scratch. (Li et al 2023b) also mentions four other gradient-based attacks, which can succeed when the model parameters are fixed.…”

“…It is demonstrated in (Li et al 2023b) that the client-side model along with a small amount of training data is enough to get an accurate model using Train-ME, a method that simply trains the server-side model from scratch. (Li et al 2023b) also mentions four other gradient-based attacks, which can succeed when the model parameters are fixed. However, these attacks perform poorly, when the target model is changing such as in the trainingfrom-scratch case.…”

“…

Split Federated Learning (SFL) is an emerging edge-friendly version of Federated Learning (FL), where clients process a small portion of the entire model. While SFL was considered to be resistant to Model Extraction Attack (MEA) by design, a recent work (Li et al 2023b) shows it is not necessarily the case. In general, gradient-based MEAs are not effective on a target model that is changing, as is the case in training-from-scratch applications.

…”