mlsanityData to 7 Oct 2026

Model Extraction Attacks on Split Federated Learning

arXiv 2303.08581 ↗First posted 13 Mar 2023cs.LG cs.CVcited by 5

Not on the map. Why?

Abstract (arXiv)

Federated Learning (FL) is a popular collaborative learning scheme involving multiple clients and a server. FL focuses on protecting clients' data but turns out to be highly vulnerable to Intellectual Property (IP) threats. Since FL periodically collects and distributes the model parameters, a free-rider can download the latest model and thus steal model IP. Split Federated Learning (SFL), a recent variant of FL that supports training with resource-constrained clients, splits the model into two, giving one part of the model to clients (client-side model), and the remaining part to the server (server-side model). Thus SFL prevents model leakage by design. Moreover, by blocking prediction queries, it can be made resistant to advanced IP threats such as traditional Model Extraction (ME) attacks. While SFL is better than FL in terms of providing IP protection, it is still vulnerable. In this paper, we expose the vulnerability of SFL and show how malicious clients can launch ME attacks by querying the gradient information from the server side. We propose five variants of ME attack which differs in the gradient usage as well as in the data assumptions. We show that under practical cases, the proposed ME attacks work exceptionally well for SFL. For instance, when the server-side model has five layers, our proposed ME attack can achieve over 90% accuracy with less than 2% accuracy degradation with VGG-11 on CIFAR-10.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 23 of its 33 references that are in the map. First posted on arXiv 13 Mar 2023.

Builds on

23 of 33 references.

References · 23

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  6. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  7. 2018Co-teaching: Robust Training of Deep Neural Networks with Extremely Noisy Labelscited by 1,053
  8. 2018LEAF: A Benchmark for Federated Settingscited by 780
  9. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  10. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  11. 2020SplitFed: When Federated Learning Meets Split Learningcited by 308
  12. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
11 more
  1. 2018Distributed learning of deep neural network over multiple agentscited by 277
  2. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  3. 2020Data-Free Model Extractioncited by 121
  4. 2017Distributed Deep Neural Networks over the Cloud, the Edge and End Devicescited by 119
  5. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
  6. 2018Model Reconstruction from Model Explanationscited by 84
  7. 2019Diversity-Sensitive Conditional Generative Adversarial Networkscited by 77
  8. 2018Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Datacited by 69
  9. 2020NoPeek: Information leakage reduction to share activations in distributed deep learningcited by 66
  10. 2022ResSFL: A Resistance Transfer Framework for Defending Model Inversion Attack in Split Federated Learningcited by 36
  11. 2020Introspective Learning by Distilling Knowledge from Online Self-explanationcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 2; 2025: 1; 2026: 1.

5 papers.

  1. 2023Federated Generative Learning with Foundation Modelscited by 23
  2. 2024A Survey of Privacy Threats and Defense in Vertical Federated Learning: From Model Life Cycle Perspectivecited by 7
  3. 2024Just a Simple Transformation is Enough for Data Protection in Vertical Federated Learningcited by 1
  4. 2025Evaluating Query Efficiency and Accuracy of Transfer Learning-based Model Extraction Attack in Federated Learningcited by 0
  5. 2026Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunitiescited by 0