BettiSplit: Topology-Guided Privacy-Aware Split Learning Against Feature Inversion and Gradient Leakage
2026-07-27 • Machine Learning
Machine LearningArtificial IntelligenceCryptography and Security
AI summaryⓘ
The authors study split learning, where parts of a neural network run on different devices, which can risk leaking private data through shared information. They find that this privacy risk varies a lot depending on where the network is split, and it isn't just about how deep the layer is. By using a mathematical tool called Betti complexity, they can detect which layers reveal more private information. Based on this, they propose BettiSafe, a method to choose safer split points without needing to try actual attacks, improving privacy while keeping model accuracy. They also show that adding Betti-based regularization makes it even harder to steal information without hurting the model's usefulness.
split learningneural networksprivacy leakageintermediate representationspersistent Betti complexityfeature inversionSSIMtopologyregularizationprivacy-utility tradeoff
Authors
Akarsh K. Nair, Muhammad Arifur Rahman, David Brown, Mufti Mahmud
Abstract
Split learning enables collaborative model training by partitioning neural networks across clients and servers. However, improper split placement can lead to severe privacy leakage through intermediate representations. In this work, we propose a topology-guided framework for privacy-aware split learning based on the persistent Betti complexity of smashed activations. Through comprehensive layer-wise analysis, we show that privacy risk in split learning is highly non-uniform across layers and exhibits sharp transition regions that are not captured by architectural depth alone. In particular, feature inversion fidelity increases from negligible reconstruction to as high as 0.98 SSIM at deeper, privacy-critical split points. We further demonstrate that Betti complexity consistently identifies representation regimes associated with elevated feature-space privacy leakage across architectures and datasets. Leveraging this observation, we introduce BettiSafe, a topology-guided split selection strategy that identifies privacy-sensitive layers without requiring explicit attack execution. BettiSafe improves resistance to feature inversion by 2 to 5 times compared to depth-based heuristics while preserving classification accuracy. In addition, Betti-based regularisation increases inversion difficulty by nearly 5 x without degrading model utility, enabling a favourable privacy utility tradeoff. Overall, our results highlight topological complexity as a promising structural descriptor for secure, adaptive, and representation-aware split learning in real-world collaborative systems