Guarding the Middle: Protecting Intermediate Representations in Federated Split Learning

Obaidullah Zaland; Sajib Mistry; Monowar Bhuyan

cs.LGFeb 19, 2026

Guarding the Middle: Protecting Intermediate Representations in Federated Split Learning

Authors: Obaidullah Zaland, Sajib Mistry, Monowar Bhuyan

Organizations: Department of Computing Science, Umeå Unviersity, Umeå, SE-90187, Sweden · Curtin University, Bentley WA 6102, Australia

Abstract

Big data scenarios, where massive, heterogeneous datasets are distributed across clients, demand scalable, privacy-preserving learning methods. Federated learning (FL) enables decentralized training of machine learning (ML) models across clients without data centralization. Decentralized training, however, introduces a computational burden on client devices. U-shaped federated split learning (UFSL) offloads a fraction of the client computation to the server while keeping both data and labels on the clients' side. However, the intermediate representations (i.e., smashed data) shared by clients with the server are prone to exposing clients' private data. To reduce exposure of client data through intermediate data representations, this work proposes k-anonymous differentially private UFSL (KD-UFSL), which leverages privacy-enhancing techniques such as microaggregation and differential privacy to minimize data leakage from the smashed data transferred to the server. We first demonstrate that an adversary can access private client data from intermediate representations via a data-reconstruction attack, and then present a privacy-enhancing solution, KD-UFSL, to mitigate this risk. Our experiments indicate that, alongside increasing the mean squared error between the actual and reconstructed images by up to 50% in some cases, KD-UFSL also decreases the structural similarity between them by up to 40% on four benchmarking datasets. More importantly, KD-UFSL improves privacy while preserving the utility of the global model. This highlights its suitability for large-scale big data applications where privacy and utility must be balanced.

Figures & tables

Figure 1: The clients’ data on the top, and reconstructed data from the client’s smashed data at the bottom.

Not.	Explanation	Not.	Explanation
$\mathcal{C}$	Set of participating clients	$\mathcal{G}$	Set of client groups
$n$	Number of participating clients	k	Number of groups for k-anonymity
$\mathbf{D}_{c}$	Private dataset at client $c\in\mathcal{C}$	$\mathbf{D}$	Complete dataset in all clients
$F_{c}(w)$	Local objective function for client $c\in\mathcal{C}$	$w_{c}^{t}$	Local model weights for client $c\in\mathcal{C}$ in iteration $t$
$\mathcal{H}_{c}$	Head network for client $c\in\mathcal{C}$	$w_{\mathcal{H}}$	Weights for the head network
$\mathcal{B}_{c}$	Body network for client $c\in\mathcal{C}$	$w_{\mathcal{B}}$	Weights for the body network

Table I : Notations used in this paper

Figure 2: The process of training UFSL with model-level k-anonymity or micro-aggregation.

Dataset	No. of samples	No. of classes	Fraction used
CIFAR10	60,000	10	1.0
EMNIST	800,000	26	0.1
FashionMNIST	70,000	10	0.4
SVHN	600,000	10	0.1

Table II : Datasets used in this work.

Figure 3: ResNet-18 architecture split into head, body, and tail networks alongside the inversion network. RB1 refers to ResBlock1 and so on.

Network	Method	Metric	CIFAR10	EMNIST	FashionMNIST	SVHN
ResNet18	UFSL	MSE $\uparrow$	0.007	0.344	0.655	0.046
		SSIM $\downarrow$	0.949	0.159	0.212	0.846
	UFSL+DP ${}_{\sigma^{2}=0.2}$	MSE $\uparrow$	0.010	0.302	0.403	0.054
		SSIM $\downarrow$	0.922	0.240	0.176	0.758
	UFSL+KA k=3	MSE $\uparrow$	0.035	0.417	0.881	0.047
		SSIM $\downarrow$	0.752	0.164	0.150	0.852

Table III : Averaged test dataset per image MSE and SSIM between actual and reconstructed data for KD-UFSL and baselines, across different networks. (Bold results represent the best value over the network and the dataset.)

Figure 4: Actual images and reconstructed images from the client’s smashed data of different training strategies, using the inversion network. Each row represents a single model.

Figure 5: Accuracy over global rounds of the final global model for KD-UFSL and baselines. CN refers to ConvNet, and RN18 refers to ResNet18.

Figure 6: Impact of $\sigma^{2}$ on MSE and SSIM every 5th global iteration on the ConvNet architecture.

Figure 7: Impact of $k$ on MSE and SSIM every 5th global iteration on the ConvNet architecture.

Head Depth	CIFAR10		SVHN
	MSE $\uparrow$	SSIM $\downarrow$	MSE $\uparrow$	SSIM $\downarrow$
RB1	0.045	0.762	0.057	0.882
RB2	0.086	0.547	0.099	0.572
RB3	0.313	0.035	0.274	0.043

Table IV : Impact of head network depth on KD-UFSL performance. Depth up to layer RBi also includes layer RBi.

Figure 8: Impact of number of clients on SSIM, MSE, and accuracy in the KD-UFSL framework with the ConvNet architecture.

Training Data Reconstruction Attacks

See all 17 papers

Collaborative Synthetic Data Generation for Knowledge Transfer in Federated Learning
Jul 8, 2026Maximilian Andreas Hoefler, Karsten Mueller, Wojciech SamekNon-IID Federated Learning Federated Learning
Fraunhofer Heinrich Hertz Institute · BIFOLD Technical University Berlin
BESplit: Bias-Compensated Split Federated Learning with Evidential Aggregation
May 17, 2026Yuhan Xie, Chen Lyu, Jingrong HuangFederated Learning Aggregation Split Federated Learning
Shanghai University of Finance and Economics, China · MoE Key Laboratory of Interdisciplinary Research of Computation and Economics, China.
Secure and Privacy-Preserving Vertical Federated Learning
Apr 15, 2026Shan Jin, Sai Rahul Rachuri, Yizhen Wang +2Privacy-Preserving Federated Learning Federated Learning
Visa Research

Jul 8, 2026J/K move · Enter open · S save

Collaborative Synthetic Data Generation for Knowledge Transfer in Federated Learning

Maximilian Andreas Hoefler, Karsten Mueller, Wojciech Samek

Fraunhofer Heinrich Hertz Institute · BIFOLD Technical University Berlin

Non-IID Federated Learning Federated Learning Synthetic Data Generation Federated Learning Aggregation Differentially Private Federated Learning Knowledge Distillation+1

Open paper AskPDF arXiv

One-shot federated learning (OSFL) addresses the communication overhead of federated learning by limiting training to a single round, but doing so without sacrificing model quality is non-trivial, particularly when client data distributions diverge. Recent work has addressed this challenge by aggregating client knowledge on the server through the construction of transferable synthetic datasets or distillates. However, most of these methods lack formal privacy guarantees, leaving a gap in jointly achieving low communication, robustness to heterogeneity, and rigorous privacy. We propose FedKT-CSD (Federated Knowledge Transfer via Collaborative Synthetic Data), a framework inspired by neural image compression that closes this gap by leveraging publicly pretrained autoencoders as a shared latent space. Each client encodes its private data in a single forward pass, computes class-conditional latent statistics, and transmits these to the server. The server aggregates these statistics via secure aggregation, adds calibrated differential privacy noise, and decodes a synthetic dataset for training a global model and further downstream tasks. This design provides formal

(\varepsilon,δ)

-differential privacy by construction, while keeping client-side computation and communication lightweight. Despite operating under privacy constraints, FedKT-CSD is competitive with and even outperforms non-private baselines across diverse datasets and heterogeneity settings, and scales to a large number of clients. Our code is available at: https://github.com/an7123/FedKT-CSD

Abstract

Training Data Reconstruction Attacks

Explore similar work

Collaborative Synthetic Data Generation for Knowledge Transfer in Federated Learning

BESplit: Bias-Compensated Split Federated Learning with Evidential Aggregation

Secure and Privacy-Preserving Vertical Federated Learning