%PDF-1.6
%
94 0 obj
<<
/Length 9218
>>
stream
0 g 0 G
0 g 0 G
0 g 0 G
0 g 0 G
0 g 0 G
BT
/F96 14.3462 Tf 67.652 675.067 Td [(ResSFL:)-250(A)-250(Resistance)-250(T)74(ransfer)-250(Framew)10(ork)-250(f)25(or)-250(Defending)-250(Model)-250(In)40(v)10(ersion)]TJ 122.652 -17.933 Td [(Attack)-250(in)-250(Split)-250(F)25(ederated)-250(Lear)15(ning)]TJ/F97 11.9552 Tf -118.732 -37.858 Td [(Jingtao)-250(Li)]TJ/F97 7.9701 Tf 48.154 4.339 Td [(1)]TJ/F97 11.9552 Tf 4.484 -4.339 Td [(,)-250(Adnan)-250(Siraj)-250(Rakin)]TJ/F97 7.9701 Tf 94.971 4.339 Td [(1)]TJ/F97 11.9552 Tf 4.483 -4.339 Td [(,)-250(Xing)-250(Chen)]TJ/F97 7.9701 Tf 58.114 4.339 Td [(1)]TJ/F97 11.9552 Tf 4.483 -4.339 Td [(,)-250(Zhezhi)-250(He)]TJ/F97 7.9701 Tf 56.105 4.339 Td [(2)]TJ/F97 11.9552 Tf 4.483 -4.339 Td [(,)-250(Deliang)-250(F)15(an)]TJ/F97 7.9701 Tf 64.57 4.339 Td [(1)]TJ/F97 11.9552 Tf 4.483 -4.339 Td [(,)-250(Chaitali)-250(Chakrabarti)]TJ/F97 7.9701 Tf 103.267 4.339 Td [(1)]TJ -449.588 -13.958 Td [(1)]TJ/F97 11.9552 Tf 7.472 -4.339 Td [(School)-250(of)-250(Electrical)-250(Computer)-250(and)-250(Ener)18(gy)-250(Engineering,)-250(Arizona)-250(State)-250(Uni)25(v)15(ersity)65(,)-250(T)70(empe,)-250(AZ)]TJ/F97 7.9701 Tf -5.535 -9.62 Td [(2)]TJ/F97 11.9552 Tf 7.472 -4.338 Td [(Department)-250(of)-250(Computer)-250(Science)-250(and)-250(Engineering,)-250(Shanghai)-250(Jiao)-250(T)80(ong)-250(Uni)25(v)15(ersity)65(,)-250(Shanghai)]TJ/F99 5.9776 Tf 6.916 -10.139 Td [(1)]TJ/F68 8.9664 Tf 4.084 -3.809 Td [(f)]TJ/F99 8.9664 Tf 4.608 0 Td [(jingtao1,)-600(asrakin,)-600(xchen382,)-600(dfan,)-600(chaitali)]TJ/F68 8.9664 Tf 231.332 0 Td [(g)]TJ/F99 8.9664 Tf 4.608 0 Td [(@asu.edu)]TJ/F97 8.9664 Tf 43.038 0 Td [(;)]TJ/F99 5.9776 Tf 7.225 3.809 Td [(2)]TJ/F68 8.9664 Tf 4.084 -3.809 Td [(f)]TJ/F99 8.9664 Tf 4.608 0 Td [(zhezhi.he)]TJ/F68 8.9664 Tf 48.418 0 Td [(g)]TJ/F99 8.9664 Tf 4.608 0 Td [(@sjtu.edu.cn)]TJ
0 g 0 G
0 g 0 G
/F96 11.9552 Tf -296.524 -41.046 Td [(Abstract)]TJ/F103 9.9626 Tf -83.928 -25.121 Td [(This)-246(work)-247(aims)-246(to)-247(tac)20(kle)-246(Model)-246(In)40(ver)10(sion)-247(\050MI\051)-246(attac)20(k)-247(on)]TJ -11.955 -11.955 Td [(Split)-250(F)75(eder)15(ated)-250(Learning)-250(\050SFL\051.)-250(SFL)-250(is)-250(a)-250(r)37(ecent)-250(distrib)20(uted)]TJ 0 -11.955 Td [(tr)15(aining)-399(sc)15(heme)-399(wher)37(e)-399(multiple)-399(clients)-399(send)-399(intermediate)]TJ 0 -11.955 Td [(activations)-218(\050i.e)15(.,)-224(featur)37(e)-218(map\051,)-225(instead)-218(of)-217(r)15(aw)-218(data,)-225(to)-218(a)-218(cen-)]TJ 0 -11.955 Td [(tr)15(al)-317(server)111(.)-512(While)-318(suc)15(h)-317(a)-317(sc)15(heme)-318(helps)-317(r)37(educe)-317(the)-318(compu-)]TJ 0 -11.955 Td [(tational)-272(load)-271(at)-272(the)-272(client)-272(end,)-277(it)-272(opens)-271(itself)-272(to)-272(r)37(econstruc-)]TJ 0 -11.956 Td [(tion)-262(of)-262(r)15(aw)-262(data)-262(fr)45(om)-262(intermediate)-262(activation)-262(by)-262(the)-262(server)111(.)]TJ 0 -11.955 Td [(Existing)-352(works)-352(on)-352(pr)45(otecting)-352(SFL)-352(only)-352(consider)-352(infer)37(ence)]TJ 0 -11.955 Td [(and)-449(do)-450(not)-449(handle)-449(attac)20(ks)-450(during)-449(tr)15(aining)15(.)-908(So)-449(we)-450(pr)45(o-)]TJ 0 -11.955 Td [(pose)-337(ResSFL,)-338(a)-337(Split)-338(F)75(eder)15(ated)-337(Learning)-337(F)55(r)15(ame)15(work)-338(that)]TJ 0 -11.955 Td [(is)-326(designed)-325(to)-326(be)-325(MI-r)37(esistant)-326(during)-326(tr)15(aining)15(.)-536(It)-326(is)-326(based)]TJ 0 -11.955 Td [(on)-257(deriving)-258(a)-257(r)37(esistant)-257(featur)37(e)-257(e)20(xtr)15(actor)-257(via)-258(attac)20(k)10(er)20(-awar)37(e)]TJ 0 -11.956 Td [(tr)15(aining)10(,)-472(and)-428(using)-428(this)-428(e)20(xtr)15(actor)-427(to)-428(initialize)-428(the)-428(client-)]TJ 0 -11.955 Td [(side)-297(model)-296(prior)-297(to)-296(standar)37(d)-297(SFL)-297(tr)15(aining)15(.)-449(Suc)15(h)-297(a)-297(method)]TJ 0 -11.955 Td [(helps)-305(in)-305(r)37(educing)-305(the)-305(computational)-305(comple)20(xity)-305(due)-305(to)-305(use)]TJ 0 -11.955 Td [(of)-222(str)45(ong)-223(in)40(ver)11(sion)-223(model)-222(in)-222(client-side)-222(adver)10(sarial)-223(tr)15(aining)]TJ 0 -11.955 Td [(as)-210(well)-210(as)-210(vulner)15(ability)-210(of)-210(attac)20(ks)-210(launc)15(hed)-210(in)-210(early)-210(tr)15(aining)]TJ 0 -11.956 Td [(epoc)15(hs.)-623(On)-354(CIF)115(AR-100)-355(dataset,)-380(our)-354(pr)45(oposed)-355(fr)15(ame)15(work)]TJ 0 -11.955 Td [(successfully)-328(mitigates)-328(MI)-328(attac)20(k)-328(on)-328(a)-328(VGG-11)-329(model)-328(with)]TJ 0 -11.955 Td [(a)-440(high)-440(r)37(econstruction)-440(Mean-Squar)37(e-Err)45(or)-440(of)-441(0.050)-440(com-)]TJ 0 -11.955 Td [(par)37(ed)-251(to)-251(0.005)-252(obtained)-251(by)-251(the)-251(ba)-1(s)1(eline)-252(system.)-313(The)-252(fr)15(ame-)]TJ 0 -11.955 Td [(work)-408(ac)15(hie)15(ves)-407(67.5%)-408(accur)15(acy)-407(\050only)-408(1%)-407(accur)15(acy)-408(dr)45(op\051)]TJ 0 -11.955 Td [(with)-306(very)-307(low)-306(computation)-306(o)10(verhead.)-480(Code)-306(is)-306(r)37(eleased)-307(at:)]TJ
0 1 0 0 k 0 1 0 0 K
/F104 9.9626 Tf 0 -11.956 Td [(https://)-4(github.com/)-4(zlijingtao/)-4(ResSFL)]TJ
0 g 0 G
/F103 9.9626 Tf 215.382 0 Td [(.)]TJ/F96 11.9552 Tf -215.382 -39.496 Td [(1.)-250(Intr)18(oduction)]TJ/F97 9.9626 Tf 11.955 -20.139 Td [(Collaborati)25(v)15(e)-302(training)-303(schemes)-302(ha)20(v)15(e)-303(become)-302(popular)-303(in)]TJ -11.955 -11.955 Td [(applications)-355(where)-355(preserving)-355(data)-355(pri)25(v)25(ac)15(y)-355(is)-356(v)15(ery)-355(impor)20(-)]TJ 0 -11.955 Td [(tant.)-613(A)-351(representati)25(v)15(e)-351(e)15(xample)-351(is)-352(federated)-351(learning)-351([)]TJ
0 1 0 rg 0 1 0 RG
[(13)]TJ
0 g 0 G
[(],)]TJ 0 -11.955 Td [(which)-344(has)-344(been)-344(used)-344(in)-344(a)-344(broad)-344(range)-345(of)-344(computer)-344(vision)]TJ 0 -11.956 Td [(tasks)-323(in)40(v)20(olving)-322(pri)25(v)25(ate)-323(data,)-341(such)-322(as)-323(in)-322(human)-323(f)10(ace)-323(recog-)]TJ 0 -11.955 Td [(nition.)-368(Split)-269(Federated)-270(Learning)-269(\050SFL\051)-269([)]TJ
0 1 0 rg 0 1 0 RG
[(19)]TJ
0 g 0 G
[(])-270(is)-269(a)-269(recent)-270(col-)]TJ 0 -11.955 Td [(laborati)25(v)15(e)-233(training)-234(scheme)-233(that)-233(combines)-234(the)-233(merits)-233(of)-234(Split)]TJ 0 -11.955 Td [(Learning)-287(\050SL\051)-286([)]TJ
0 1 0 rg 0 1 0 RG
[(6)]TJ
0 g 0 G
[(])-287(and)-287(Federated)-287(Learning)-286(\050FL\051.)-287(It)-287(has)-287(sig-)]TJ 0 -11.955 Td [(ni\002cant)-290(adv)25(antages)-291(on)-290(computation)-290(reduction)-290(and)-291(memory)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
ET
1 0 0 1 315.05 471.337 cm
q
.68135 0 0 .68135 0 0 cm
q
1 0 0 1 0 0 cm
/Fm1 Do
Q
Q
0 g 0 G
1 0 0 1 -315.05 -471.337 cm
BT
/F97 9.9626 Tf 377.449 459.979 Td [(\050a\051)-250(T)35(raining)-250(process)-250(of)-250(SFL)]TJ
0 g 0 G
ET
1 0 0 1 315.05 384.916 cm
q
.67986 0 0 .67986 0 0 cm
q
1 0 0 1 0 0 cm
/Fm2 Do
Q
Q
0 g 0 G
1 0 0 1 -315.05 -384.916 cm
BT
/F97 9.9626 Tf 374.869 373.559 Td [(\050b\051)-250(Serv)15(er)-250(perform)-250(MI)-250(attack)]TJ
0 g 0 G
ET
1 0 0 1 315.05 294.283 cm
q
.67986 0 0 .67986 0 0 cm
q
1 0 0 1 0 0 cm
/Fm3 Do
Q
Q
0 g 0 G
1 0 0 1 -315.05 -294.283 cm
BT
/F97 9.9626 Tf 340.01 282.925 Td [(\050c\051)-250(Our)-250(proposed)-250(ResSFL)-250(tw)10(o-step)-250(frame)25(w)10(ork)]TJ
0 g 0 G
0 g 0 G
/F97 8.9664 Tf -31.148 -21.22 Td [(Figure)-367(1.)-662(ResSFL)-367(o)15(v)15(ervie)25(w)65(.)-661(\050a\051)-367(Multi-client)-367(SFL)-367(training)-367(pro-)]TJ 0 -10.959 Td [(cess.)-387(\050b\051)-276(MI)-276(attack)-275(performed)-276(by)-276(serv)15(er)55(.)-387(The)-276(client-side)-276(model)-275(is)]TJ 0 -10.959 Td [(queried)-282(to)-282(b)20(uild)-282(in)40(v)15(ersion)-282(model)-282(and)-282(the)-282(clients')-282(intermediate)-282(ac-)]TJ 0 -10.959 Td [(ti)25(v)25(ations)-292(are)-292(us)1(ed)-292(to)-292(reconstruct)-292(pri)25(v)25(ate)-292(data.)-435(\050c\051)-292(High-le)25(v)15(el)-291(vie)25(w)]TJ 0 -10.959 Td [(of)-298(the)-298(ResSFL)-298(frame)25(w)10(ork,)-310(consisting)-298(of)-298(pre-training)-298(step)-297(and)-298(re-)]TJ 0 -10.959 Td [(sistance)-250(transfer)-250(step.)]TJ
0 g 0 G
0 g 0 G
/F97 9.9626 Tf 0 -39.208 Td [(usage)-290(compared)-290(to)-290(FL)-290([)]TJ
0 1 0 rg 0 1 0 RG
[(7)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-157(13)]TJ
0 g 0 G
[(])-290(and)-290(signi\002cantly)-291(f)10(aster)-290(com-)]TJ 0 -11.955 Td [(pared)-250(to)-250(the)-250(original)-250(SL)-250(scheme.)]TJ 11.955 -14.971 Td [(In)-405(SFL,)-406(a)-405(neural)-405(netw)10(ork)-405(model)-406(is)-405(split)-405(into)-405(a)-406(client-)]TJ -11.955 -11.955 Td [(side)-291(model)-290(and)-291(a)-291(serv)15(er)20(-side)-290(model.)-432(Multiple)-291(clients)-291(oper)20(-)]TJ 0 -11.956 Td [(ate)-270(on)-271(their)-270(pri)25(v)25(ate)-270(inputs)-271(usi)1(n)-1(g)-270(their)-270(client-side)-270(model)-271(and)]TJ 0 -11.955 Td [(pass)-332(the)-332(intermediate)-332(acti)25(v)25(ations)-333(to)-332(the)-332(serv)15(er)55(.)-557(The)-332(serv)15(er)]TJ 0 -11.955 Td [(then)-441(computes)-441(on)-440(the)-441(more)-441(e)15(xpensi)25(v)15(e)-441(serv)15(er)20(-side)-441(model)]TJ 0 -11.955 Td [(and)-375(passes)-375(gradients)-376(back)-375(to)-375(clients.)-686(After)-375(an)-375(epoch,)-407(lo-)]TJ
0 g 0 G
0 g 0 G
ET
endstream
endobj
87 0 obj
<<
/Type /XObject
/Subtype /Form
/BBox [0 0 345.091 110.064]
/FormType 1
/Matrix [1 0 0 1 0 0]
/Resources 105 0 R
/Length 41
>>
stream
q
1 0 0 1 -612.067 -380.757 cm
/Im1 Do
Q
endstream
endobj
86 0 obj
<<
/Type /XObject
/Subtype /Form
/FormType 1
/PTEX.FileName (./cvpr2022style/Figure/Tran_fig1A_simple.pdf)
/PTEX.PageNumber 1
/PTEX.InfoDict 107 0 R
/BBox [612.067 380.757 957.159 490.821]
/Group 106 0 R
/Resources <<
/ExtGState <<
/GS5 108 0 R
/GS6 109 0 R
/GS7 110 0 R
>>/Font << /F1 111 0 R/F2 112 0 R/F3 113 0 R>>
/Pattern <<
/P18 114 0 R
>>/ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
/XObject <<
/Image19 115 0 R
/Image8 116 0 R
>>>>
/Length 15795
/Filter /FlateDecode
>>
stream
x}]e} o}K @>n n0!Fngl'G\Nuu=O NsDq냢H_}˯r\1 ⨗o>}o?|YK 5 >??˗_7//-oc:FZ{7KRs'BfC?ڵKڤ~kmJzFXT~R(:Яq\õ\ T*-?5%+ӵd(4#Uo dUCb.O"kZ]?%
5x?.m S~>2A&CNFkgWZ)ȩ lV(i%}DP 5 :. |'^VZ/Cƌ&n@$.0&O02a( [Yʎ0ً!lY(
?=k I#
\ĶTWښc@^X`YU6QN\ ʧ zje /緆B0wya4GBl. 㵭9f X *vQry('.S VSV[C