# UnSplit: Data-Oblivious Model Inversion, Model Stealing, and Label Inference Attacks Against Split Learning

arXiv: https://arxiv.org/abs/2108.09033 · HTML: https://mlsanity.com/paper/2108.09033/

## Key facts

- Cited by 52 papers in the map (data through 14 Oct 2026).
- Builds on 19 of its 46 references that are in the map.
- First posted on arXiv 20 Aug 2021.

## Builds on (most cited first, 19 of 19)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms](https://mlsanity.com/paper/1708.07747/) (2017)
- [Federated Learning: Strategies for Improving Communication Efficiency](https://mlsanity.com/paper/1610.05492/) (2016)
- [Deep Leakage from Gradients](https://mlsanity.com/paper/1906.08935/) (2019)
- [Towards Federated Learning at Scale: System Design](https://mlsanity.com/paper/1902.01046/) (2019)
- [Federated Optimization: Distributed Machine Learning for On-Device Intelligence](https://mlsanity.com/paper/1610.02527/) (2016)
- [Split learning for health: Distributed deep learning without sharing raw patient data](https://mlsanity.com/paper/1812.00564/) (2018)
- [iDLG: Improved Deep Leakage from Gradients](https://mlsanity.com/paper/2001.02610/) (2020)
- [Distributed learning of deep neural network over multiple agents](https://mlsanity.com/paper/1810.06060/) (2018)
- [The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networks](https://mlsanity.com/paper/1911.07135/) (2019)
- [Coordinate Descent Algorithms](https://mlsanity.com/paper/1502.04759/) (2015)
- [State-of-the-art Speech Recognition With Sequence-to-Sequence Models](https://mlsanity.com/paper/1712.01769/) (2017)
- [Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning](https://mlsanity.com/paper/1904.01067/) (2019)
- [Unleashing the Tiger: Inference Attacks on Split Learning](https://mlsanity.com/paper/2012.02670/) (2020)
- [Label Leakage and Protection in Two-party Split Learning](https://mlsanity.com/paper/2102.08504/) (2021)
- [No Peek: A Survey of private distributed deep learning](https://mlsanity.com/paper/1812.03288/) (2018)

## Built on by (most cited first, 30 of 52)

- [Differentially Private Label Protection in Split Learning](https://mlsanity.com/paper/2203.02073/) (2022)
- [FedVS: Straggler-Resilient and Privacy-Preserving Vertical Federated Learning for Split Models](https://mlsanity.com/paper/2304.13407/) (2023)
- [ExPLoit: Extracting Private Labels in Split Learning](https://mlsanity.com/paper/2112.01299/) (2021)
- [Feature Space Hijacking Attacks against Differentially Private Split Learning](https://mlsanity.com/paper/2201.04018/) (2022)
- [Similarity-based Label Inference Attack against Training and Inference of Split Learning](https://mlsanity.com/paper/2203.05222/) (2022)
- [On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlook](https://mlsanity.com/paper/2307.16680/) (2023)
- [Combined Federated and Split Learning in Edge Computing for Ubiquitous Intelligence in Internet of Things: State of the Art and Future Directions](https://mlsanity.com/paper/2207.09611/) (2022)
- [Federated Learning of Large Models at the Edge via Principal Sub-Model Training](https://mlsanity.com/paper/2208.13141/) (2022)
- [Model Inversion Attacks: A Survey of Approaches and Countermeasures](https://mlsanity.com/paper/2411.10023/) (2024)
- [HashVFL: Defending Against Data Reconstruction Attacks in Vertical Federated Learning](https://mlsanity.com/paper/2212.00325/) (2022)
- [Passive Inference Attacks on Split Learning via Adversarial Regularization](https://mlsanity.com/paper/2310.10483/) (2023)
- [Label Inference Attack against Split Learning under Regression Setting](https://mlsanity.com/paper/2301.07284/) (2023)
- [Secure Split Learning against Property Inference, Data Reconstruction, and Feature Space Hijacking Attacks](https://mlsanity.com/paper/2304.09515/) (2023)
- [Is Vertical Logistic Regression Privacy-Preserving? A Comprehensive Privacy Analysis and Beyond](https://mlsanity.com/paper/2207.09087/) (2022)
- [A Survey of Privacy Threats and Defense in Vertical Federated Learning: From Model Life Cycle Perspective](https://mlsanity.com/paper/2402.03688/) (2024)
- [On the Robustness of Split Learning against Adversarial Attacks](https://mlsanity.com/paper/2307.07916/) (2023)
- [Input Reconstruction Attack against Vertical Federated Large Language Models](https://mlsanity.com/paper/2311.07585/) (2023)
- [Unlocking Visual Secrets: Inverting Features with Diffusion Priors for Image Reconstruction](https://mlsanity.com/paper/2412.10448/) (2024)
- [Split-U-Net: Preventing Data Leakage in Split Learning for Collaborative Multi-Modal Brain Tumor Segmentation](https://mlsanity.com/paper/2208.10553/) (2022)
- [SplitOut: Out-of-the-Box Training-Hijacking Detection in Split Learning via Outlier Detection](https://mlsanity.com/paper/2302.08618/) (2023)
- [Analyzing the vulnerabilities in SplitFed Learning: Assessing the robustness against Data Poisoning Attacks](https://mlsanity.com/paper/2307.03197/) (2023)
- [Protecting Split Learning by Potential Energy Loss](https://mlsanity.com/paper/2210.09617/) (2022)
- [PriMask: Cascadable and Collusion-Resilient Data Masking for Mobile Cloud Inference](https://mlsanity.com/paper/2211.06716/) (2022)
- [Training Latency Minimization for Model-Splitting Allowed Federated Edge Learning](https://mlsanity.com/paper/2307.11532/) (2023)
- [URVFL: Undetectable Data Reconstruction Attack on Vertical Federated Learning](https://mlsanity.com/paper/2404.19582/) (2024)
- [DRAG: Data Reconstruction Attack using Guided Diffusion](https://mlsanity.com/paper/2509.11724/) (2025)
- [S2NeRF: Privacy-preserving Training Framework for NeRF](https://mlsanity.com/paper/2409.01661/) (2024)
- [Edge-Only Universal Adversarial Attacks in Distributed Learning](https://mlsanity.com/paper/2411.10500/) (2024)
- [Adversarial Robustness of Partitioned Quantum Classifiers](https://mlsanity.com/paper/2502.20403/) (2025)
- [A Taxonomy of Attacks and Defenses in Split Learning](https://mlsanity.com/paper/2505.05872/) (2025)

## Abstract (arXiv)

Training deep neural networks often forces users to work in a distributed or outsourced setting, accompanied with privacy concerns. Split learning aims to address this concern by distributing the model among a client and a server. The scheme supposedly provides privacy, since the server cannot see the clients' models and inputs. We show that this is not true via two novel attacks. (1) We show that an honest-but-curious split learning server, equipped only with the knowledge of the client neural network architecture, can recover the input samples and obtain a functionally similar model to the client model, without being detected. (2) We show that if the client keeps hidden only the output layer of the model to "protect" the private labels, the honest-but-curious server can infer the labels with perfect accuracy. We test our attacks using various benchmark datasets and against proposed privacy-enhancing extensions to split learning. Our results show that plaintext split learning can pose serious risks, ranging from data (input) privacy to intellectual property (model parameters), and provide no more than a false sense of security.