Privacy-Preserving Split Learning via Noise Adaptive Representation Training

Abstract

Split learning reduces client-side computation and limits the direct exposure of private data, but it does not fully eliminate privacy leakage because the server can still observe intermediate smashed representations. These representations may preserve sensitive attributes of client inputs and enable property inference attacks. In this paper, we propose Noise-Adaptive Training (NAT), a client-side protocol that prevents the server from accessing clean smashed data. NAT generates two perturbed views of each input using private noise scaling factors and sends only their noisy representations to the server. The server performs standard computation on these noisy representations, while the client recovers a task-useful representation through a differentiable linear combination of the returned outputs. We evaluate NAT on multiple datasets, model architectures, and noise distributions. The results show that NAT consistently reduces property inference risk while maintaining high task accuracy and introducing negligible client-side overhead.