CURE: Privacy-Preserving Split Learning Done Right

TL;DR

CURE addresses privacy during split learning by encrypting only the server-side model with the CKKS homomorphic encryption scheme, preserving label confidentiality and optionally data confidentiality. It introduces two packing schemes to enable efficient one-level server operations and generalizes to multi-layer encrypted server models, aided by an estimator that selects practical split points. Empirical results show CURE achieves accuracy close to plaintext SL while delivering up to 16x runtime improvements over prior privacy-preserving alternatives, and robust scaling across architectures, datasets, and network conditions. This approach reduces data exchange and computation on the client while leveraging the server’s computing power, making privacy-preserving training more feasible for healthcare and genomics applications.

Abstract

Training deep neural networks often requires large-scale datasets, necessitating storage and processing on cloud servers due to computational constraints. The procedures must follow strict privacy regulations in domains like healthcare. Split Learning (SL), a framework that divides model layers between client(s) and server(s), is widely adopted for distributed model training. While Split Learning reduces privacy risks by limiting server access to the full parameter set, previous research has identified that intermediate outputs exchanged between server and client can compromise client's data privacy. Homomorphic encryption (HE)-based solutions exist for this scenario but often impose prohibitive computational burdens. To address these challenges, we propose CURE, a novel system based on HE, that encrypts only the server side of the model and optionally the data. CURE enables secure SL while substantially improving communication and parallelization through advanced packing techniques. We propose two packing schemes that consume one HE level for one-layer networks and generalize our solutions to n-layer neural networks. We demonstrate that CURE can achieve similar accuracy to plaintext SL while being 16x more efficient in terms of the runtime compared to the state-of-the-art privacy-preserving alternatives.

Figures (4)

• Figure 1: CURE System's Model. The server side (left) processes data samples $\mathbf{X}$ with $n$ layers, while the client side (right) holds the labels $Y$ and processes $k$ layers of a neural network. Server-side weights $\mathbf{W}_s$ are encrypted, while client-side weights $W_c$ are unencrypted.
• Figure 2: CURE's runtime for one epoch on Model 2, with $b=60$ and $40$ CPU cores with varying $n$, excluding the bootstrapping time.
• Figure 3: CURE's runtime on Model 1 for one epoch with 10,000 samples and $b=256$ with varying numbers of CPUs on a LAN setting.
• Figure 4: Homomorphic dot product scalability with respect to increasing number of data samples.