  Split learning is a promising paradigm for privacy-preserving distributed
learning. The learning model can be cut into multiple portions to be
collaboratively trained at the participants by exchanging only the intermediate
results at the cut layer. Understanding the security performance of split
learning is critical for many privacy-sensitive applications. This paper shows
that the exchanged intermediate results, including the smashed data (i.e.,
extracted features from the raw data) and gradients during training and
inference of split learning, can already reveal the private labels. We
mathematically analyze the potential label leakages and propose the cosine and
Euclidean similarity measurements for gradients and smashed data, respectively.
Then, the two similarity measurements are shown to be unified in Euclidean
space. Based on the similarity metric, we design three label inference attacks
to efficiently recover the private labels during both the training and
inference phases. Experimental results validate that the proposed approaches
can achieve close to 100% accuracy of label attacks. The proposed attack can
still achieve accurate predictions against various state-of-the-art defense
mechanisms, including DP-SGD, label differential privacy, gradient compression,
and Marvell.
