Exploring the Privacy-Energy Consumption Tradeoff for Split Federated Learning

TL;DR

The paper investigates how cut-layer placement in Split Federated Learning (SFL) shapes both energy consumption and privacy leakage. It formalizes the tradeoff with an energy model $E(\alpha)$ and a privacy metric $RS(\alpha)$ (with SSIM as a proxy) and demonstrates a convex optimization problem to minimize $RS(\alpha)$ subject to $E(\alpha) \le E_{\text{req}}$, solvable by a CVX solver. A case study using Fashion-MNIST shows that deeper client-side partitions increase energy while reducing privacy leakage, placing the optimal cut-layer near the energy-budget boundary. The work identifies open challenges, including applying deep reinforcement learning for dynamic cut-layer control, developing lightweight privacy-preserving designs, and defending against privacy and security threats in SFL.

Abstract

Split Federated Learning (SFL) has recently emerged as a promising distributed learning technology, leveraging the strengths of both federated and split learning. It emphasizes the advantages of rapid convergence while addressing privacy concerns. As a result, this innovation has received significant attention from both industry and academia. However, since the model is split at a specific layer, known as a cut layer, into both client-side and server-side models for the SFL, the choice of the cut layer in SFL can have a substantial impact on the energy consumption of clients and their privacy, as it influences the training burden and the output of the client-side models. In this article, we provide a comprehensive overview of the SFL process and thoroughly analyze energy consumption and privacy. This analysis considers the influence of various system parameters on the cut layer selection strategy. Additionally, we provide an illustrative example of the cut layer selection, aiming to minimize clients' risk of reconstructing the raw data at the server while sustaining energy consumption within the required energy budget, which involves trade-offs. Finally, we address open challenges in this field. These directions represent promising avenues for future research and development.

Figures (5)

• Figure 1: Workflow of SFL: In FL, the full model undergoes local training rather than just a subset. In SL, training processes do not occur in parallel. SFL seamlessly integrates the benefits of both FL and SL by addressing their respective limitations.
• Figure 2: Example of reconstruction and membership inference attacks in SFL as a privacy concern: This highlights the tradeoff between the client model complexity and privacy. Note that A reconstruction attack is an attempt to reconstruct the original input data from the smashed data. Additionally, membership inference attacks are another type of attack, aiming to determine whether a given data record was part of the target model’s training dataset or not (The decision tree-based attack model can be employed in such scenarios.) chen2020practical.
• Figure 3: Proposed cut layer selection considering both energy consumption and privacy level.
• Figure 4: Reconstruction score and energy consumption with respect to the depth of cut layer: This represents the tradeoff between energy consumption and privacy.
• Figure 5: Privacy gain of proposed scheme: It represents that optimal cut layer selection ($\alpha^*$=0.4201) achieves minimum privacy leakage (SSIM) while satisfying the required energy budget.