# SplitGuard: Detecting and Mitigating Training-Hijacking Attacks in Split Learning

arXiv: https://arxiv.org/abs/2108.09052 · HTML: https://mlsanity.com/paper/2108.09052/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 28 references that are in the map.
- First posted on arXiv 20 Aug 2021.

## Builds on (most cited first, 17 of 17)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms](https://mlsanity.com/paper/1708.07747/) (2017)
- [Federated Learning: Strategies for Improving Communication Efficiency](https://mlsanity.com/paper/1610.05492/) (2016)
- [An overview of gradient descent optimization algorithms](https://mlsanity.com/paper/1609.04747/) (2016)
- [Towards Federated Learning at Scale: System Design](https://mlsanity.com/paper/1902.01046/) (2019)
- [Federated Optimization: Distributed Machine Learning for On-Device Intelligence](https://mlsanity.com/paper/1610.02527/) (2016)
- [Split learning for health: Distributed deep learning without sharing raw patient data](https://mlsanity.com/paper/1812.00564/) (2018)
- [Distributed learning of deep neural network over multiple agents](https://mlsanity.com/paper/1810.06060/) (2018)
- [SGD on Neural Networks Learns Functions of Increasing Complexity](https://mlsanity.com/paper/1905.11604/) (2019)
- [The Computational Limits of Deep Learning](https://mlsanity.com/paper/2007.05558/) (2020)
- [Unleashing the Tiger: Inference Attacks on Split Learning](https://mlsanity.com/paper/2012.02670/) (2020)
- [A generic framework for privacy preserving deep learning](https://mlsanity.com/paper/1811.04017/) (2018)
- [Detailed comparison of communication efficiency of split learning and federated learning](https://mlsanity.com/paper/1909.09145/) (2019)
- [No Peek: A Survey of private distributed deep learning](https://mlsanity.com/paper/1812.03288/) (2018)

## Built on by (most cited first, 20 of 20)

- [Feature Space Hijacking Attacks against Differentially Private Split Learning](https://mlsanity.com/paper/2201.04018/) (2022)
- [On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlook](https://mlsanity.com/paper/2307.16680/) (2023)
- [Combined Federated and Split Learning in Edge Computing for Ubiquitous Intelligence in Internet of Things: State of the Art and Future Directions](https://mlsanity.com/paper/2207.09611/) (2022)
- [Passive Inference Attacks on Split Learning via Adversarial Regularization](https://mlsanity.com/paper/2310.10483/) (2023)
- [SafeSplit: A Novel Defense Against Client-Side Backdoor Attacks in Split Learning (Full Version)](https://mlsanity.com/paper/2501.06650/) (2025)
- [SplitOut: Out-of-the-Box Training-Hijacking Detection in Split Learning via Outlier Detection](https://mlsanity.com/paper/2302.08618/) (2023)
- [PFSL: Personalized & Fair Split Learning with Data & Label Privacy for thin clients](https://mlsanity.com/paper/2303.10624/) (2023)
- [Speed Up Federated Learning in Heterogeneous Environment: A Dynamic Tiering Approach](https://mlsanity.com/paper/2312.05642/) (2023)
- [URVFL: Undetectable Data Reconstruction Attack on Vertical Federated Learning](https://mlsanity.com/paper/2404.19582/) (2024)
- [Communication-Efficient Training Workload Balancing for Decentralized Multi-Agent Learning](https://mlsanity.com/paper/2405.00839/) (2024)
- [A Taxonomy of Attacks and Defenses in Split Learning](https://mlsanity.com/paper/2505.05872/) (2025)
- [Privacy-Preserving Collaborative Split Learning Framework for Smart Grid Load Forecasting](https://mlsanity.com/paper/2403.01438/) (2024)
- [Just a Simple Transformation is Enough for Data Protection in Vertical Federated Learning](https://mlsanity.com/paper/2412.11689/) (2024)
- [A Distributed Generative AI Approach for Heterogeneous Multi-Domain Environments under Data Sharing constraints](https://mlsanity.com/paper/2507.12979/) (2025)
- [Oops!... They Stole it Again: Attacks on Split Learning](https://mlsanity.com/paper/2508.10598/) (2025)
- [GAN-based Vertical Federated Learning for Label Protection in Binary Classification](https://mlsanity.com/paper/2302.02245/) (2023)
- [Pigeon-SL: Robust Split Learning Framework for Edge Intelligence under Malicious Clients](https://mlsanity.com/paper/2508.02235/) (2025)
- [Towards Privacy-Preserving and Heterogeneity-aware Split Federated Learning via Probabilistic Masking](https://mlsanity.com/paper/2509.14603/) (2025)
- [Server-Enforced Watermarking in U-Shaped Split Federated Learning](https://mlsanity.com/paper/2511.14422/) (2025)
- [LightSplit: Practical Privacy-Preserving Split Learning via Orthogonal Projections](https://mlsanity.com/paper/2605.13265/) (2026)

## Abstract (arXiv)

Distributed deep learning frameworks such as split learning provide great benefits with regards to the computational cost of training deep neural networks and the privacy-aware utilization of the collective data of a group of data-holders. Split learning, in particular, achieves this goal by dividing a neural network between a client and a server so that the client computes the initial set of layers, and the server computes the rest. However, this method introduces a unique attack vector for a malicious server attempting to steal the client's private data: the server can direct the client model towards learning any task of its choice, e.g. towards outputting easily invertible values. With a concrete example already proposed (Pasquini et al., CCS '21), such training-hijacking attacks present a significant risk for the data privacy of split learning clients. In this paper, we propose SplitGuard, a method by which a split learning client can detect whether it is being targeted by a training-hijacking attack or not. We experimentally evaluate our method's effectiveness, compare it with potential alternatives, and discuss in detail various points related to its use. We conclude that SplitGuard can effectively detect training-hijacking attacks while minimizing the amount of information recovered by the adversaries.