# Split HE: Fast Secure Inference Combining Split Learning and Homomorphic Encryption

arXiv: https://arxiv.org/abs/2202.13351 · HTML: https://mlsanity.com/paper/2202.13351/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 26 references that are in the map.
- First posted on arXiv 27 Feb 2022.

## Builds on (most cited first, 17 of 17)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Distilling the Knowledge in a Neural Network](https://mlsanity.com/paper/1503.02531/) (2015)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Membership Inference Attacks against Machine Learning Models](https://mlsanity.com/paper/1610.05820/) (2016)
- [Deep Layer Aggregation](https://mlsanity.com/paper/1707.06484/) (2017)
- [Split learning for health: Distributed deep learning without sharing raw patient data](https://mlsanity.com/paper/1812.00564/) (2018)
- [Systematic Evaluation of Privacy Risks of Machine Learning Models](https://mlsanity.com/paper/2003.10595/) (2020)
- [Gazelle: A Low Latency Framework for Secure Neural Network Inference](https://mlsanity.com/paper/1801.05507/) (2018)
- [Data-Free Model Extraction](https://mlsanity.com/paper/2011.14779/) (2020)
- [Unleashing the Tiger: Inference Attacks on Split Learning](https://mlsanity.com/paper/2012.02670/) (2020)
- [CrypTFlow2: Practical 2-Party Secure Inference](https://mlsanity.com/paper/2010.06457/) (2020)
- [Cryptanalytic Extraction of Neural Network Models](https://mlsanity.com/paper/2003.04884/) (2020)
- [NoPeek: Information leakage reduction to share activations in distributed deep learning](https://mlsanity.com/paper/2008.09161/) (2020)
- [TenSEAL: A Library for Encrypted Tensor Operations Using Homomorphic Encryption](https://mlsanity.com/paper/2104.03152/) (2021)
- [DISCO: Dynamic and Invariant Sensitive Channel Obfuscation for deep neural networks](https://mlsanity.com/paper/2012.11025/) (2020)
- [Intel HEXL: Accelerating Homomorphic Encryption with Intel AVX512-IFMA52](https://mlsanity.com/paper/2103.16400/) (2021)
- [Syft 0.5: A Platform for Universally Deployable Structured Transparency](https://mlsanity.com/paper/2104.12385/) (2021)

## Built on by (most cited first, 11 of 11)

- [Secure Split Learning against Property Inference, Data Reconstruction, and Feature Space Hijacking Attacks](https://mlsanity.com/paper/2304.09515/) (2023)
- [Split Without a Leak: Reducing Privacy Leakage in Split Learning](https://mlsanity.com/paper/2308.15783/) (2023)
- [SplitOut: Out-of-the-Box Training-Hijacking Detection in Split Learning via Outlier Detection](https://mlsanity.com/paper/2302.08618/) (2023)
- [Privacy-Preserving Split Learning with Vision Transformers using Patch-Wise Random and Noisy CutMix](https://mlsanity.com/paper/2408.01040/) (2024)
- [Training on Fake Labels: Mitigating Label Leakage in Split Learning via Secure Dimension Transformation](https://mlsanity.com/paper/2410.09125/) (2024)
- [Compact: Approximating Complex Activation Functions for Secure Computation](https://mlsanity.com/paper/2309.04664/) (2023)
- [The Art of Mixology: Mixup-based Obfuscation for Privacy-Preserving Split Learning in Large Language Models](https://mlsanity.com/paper/2606.16801/) (2026)
- [GAN-based Vertical Federated Learning for Label Protection in Binary Classification](https://mlsanity.com/paper/2302.02245/) (2023)
- [SoK: Enhancing Cryptographic Collaborative Learning with Differential Privacy](https://mlsanity.com/paper/2601.09460/) (2026)
- [A Survey on Split Learning for LLM Fine-Tuning: Models, Systems, and Privacy Optimizations](https://mlsanity.com/paper/2604.24468/) (2026)
- [Revisiting Privacy Preservation in Brain-Computer Interfaces: Conceptual Boundaries, Risk Pathways, and a Protection-Strength Grading Framework](https://mlsanity.com/paper/2605.11386/) (2026)

## Abstract (arXiv)

This work presents a novel protocol for fast secure inference of neural networks applied to computer vision applications. It focuses on improving the overall performance of the online execution by deploying a subset of the model weights in plaintext on the client's machine, in the fashion of SplitNNs. We evaluate our protocol on benchmark neural networks trained on the CIFAR-10 dataset using SEAL via TenSEAL and discuss runtime and security performances. Empirical security evaluation using Membership Inference and Model Extraction attacks showed that the protocol was more resilient under the same attacks than a similar approach also based on SplitNN. When compared to related work, we demonstrate improvements of 2.5x-10x for the inference time and 14x-290x in communication costs.