# NIDN: Neural Inverse Design of Nanostructures

Pablo Gómez  European Space Agency, Advanced Concepts Team, Noordwijk, 2201AZ,
The Netherlands  Corresponding author<EMAIL_ADDRESS>Håvard Hem
Toftevaag  European Space Agency, Advanced Concepts Team, Noordwijk, 2201AZ,
The Netherlands  Torbjørn Bogen-Storø  European Space Agency, Advanced
Concepts Team, Noordwijk, 2201AZ, The Netherlands  Derek Aranguren van Egmond
European Space Agency, Advanced Concepts Team, Noordwijk, 2201AZ, The
Netherlands  José M. Llorens  Instituto de Micro y Nanotecnología, IMN-CNM,
CSIC (CEI UAM+CSIC) Isaac Newton, 8, E-28760, Tres Cantos, Madrid, Spain

###### Abstract

In the recent decade, computational tools have become central in material
design, allowing rapid development cycles at reduced costs. Machine learning
tools are especially on the rise in photonics. However, the inversion of the
Maxwell equations needed for the design is particularly challenging from an
optimization standpoint, requiring sophisticated software.
We present an innovative, open-source software tool called Neural Inverse
Design of Nanostructures (NIDN) that allows designing complex, stacked
material nanostructures using a physics-based deep learning approach. Instead
of a derivative-free or data-driven optimization or learning method, we
perform a gradient-based neural network training where we directly optimize
the material and its structure based on its spectral characteristics. NIDN
supports two different solvers, rigorous coupled-wave analysis and a finite-
difference time-domain method. The utility and validity of NIDN are
demonstrated on several synthetic examples as well as the design of a
$1550\text{\,}\mathrm{nm}$ filter and anti-reflection coating. Results match
experimental baselines, other simulation tools, and the desired spectral
characteristics.
Given its full modularity in regard to network architectures and Maxwell
solvers as well as open-source, permissive availability, NIDN will be able to
support computational material design processes in a broad range of
applications.

## Introduction

Computational tools have been playing an increasingly central role in material
design in recent decades. With lower costs and rapid development cycles they
are an efficient starting point in the material design process that can later
be complemented with experimental validation and refinement [1]. Especially
machine learning techniques have recently seen widespread adoption in
applications ranging from predicting material properties to designing
nanostructures [2, 3] and this work aims to advance and support these efforts.

Brute-force parameter sweeps are increasingly being replaced by more
sophisticated optimization methods in the design of metamaterials and
nanophotonic devices [4, 5, 6, 7, 8, 9, 10]. And, instead of letting human
intuition and analytically derived parameters determine the architecture,
nanostructured devices can now be autonomously designed for high performance,
made possible by the exhaustive exploration of the design space that such
algorithms perform [7]. In this context, this process of determining the
physical characteristics from certain properties [11], e.g., finding the
geometry of a structure for a given optical response, is called inverse
design. Recently, there have been a lot of works on inverse design for
nanophotonics using different techniques, such as generative adversarial
networks [4], variational auto-encoders [5] and other machine learning and
optimization methods [1, 2, 3].

One area where this has received a lot of attention is the space sector, where
reducing the size, weight, power, and cost of objects put into orbit is not
only a high priority, but can in many cases also determine the feasibility of
the project. One example are photon sails, which must have sail thicknesses on
the order of only a few micrometers (the IKAROS solar sail was only
$7.5\text{\,}\mathrm{\SIUnitSymbolMicro m}$ thick [12]) in order to avoid an
unsuitable weight. Recently, there has been research on using metasurfaces for
solar sails, made with both conventional design [13] and inverse design [14]
methods. These metasurfaces might offer, for instance, attitude control [13]
and mass reduction [14] while maintaining a high efficiency.

Figure 1: Training setup for NIDN; regression and classification as well as
RCWA and FDTD are described in detail in Methods.

Recent works have also applied metamaterial knowledge to the optical solar
reflector (OSR), a structure placed on the external surface of a spacecraft
that simultaneously reflects incoming sunlight and emit infrared radiation.
Instead of using the conventional design of planar structures, Sun et al.
showed that a simple metasurface can reduce the thickness [15, 16]. The
terrestrial cousin of the OSR, radiative cooling structures, have followed a
similar trend recently [17].

Overall, these methods rely on sophisticated software tools and datasets which
has inspired efforts to make those available openly as, e.g., in the work of
Jiang et al. [18]. In a similar vain, in this work, we present an open-source
software package called Neural Inverse Design of Nanostructures (NIDN) that
allows designing nanostructures with neural networks using two different,
fully differentiable implementations of Maxwell equations solvers based on the
finite-difference time-domain (FDTD) method [19] and rigorous coupled-wave
analysis (RCWA) [20]. RCWA is a natural and efficient choice for stacked
materials designed with NIDN. FDTD complements it by supporting design in the
visible light range of the spectrum and - depending on geometry - providing
higher accuracy [21]. Both enable the machine-learning-based design of
multilayer materials with patterned nanoscale grids to achieve a desired
spectrum of reflectance, transmittance and absorptance. Thus, NIDN has the
potential to support a wide range of the aforementioned applications. In
comparison to previous similar efforts such as those by Jiang et al. [22] we
utilize a fundamentally different technique relying on directly encoding the
material inside a neural network.
Building on advances in physics-based deep learning [23], in NIDN, we directly
optimize the nanostructure described by the neural network to achieve one
specific spectrum. In this approach, no prior knowledge or training datasets
are required as gradients are backpropagated through a (differentiable)
numerical solver. Also, as the neural network does not need to solve the
problem of fully describing the relationship between any material and spectral
characteristics the task is more tractable. In many previous approaches [24,
25], neural networks effectively need to invert the Maxwell equations to match
material and spectral characteristics to each other. In NIDN, by solving for a
specific reflectance, transmittance and absorptance spectrum, we – from a
mathematical perspective – constrain the inversion to a specific solution of
the Maxwell equations. This furthermore avoids being limited to only a few
degrees of freedom, such as placing a specific structure on top of another, in
the material design [25, 26]; instead we can fully explore the entire search
space of structures. Several nanosurface modification strategies have been
employed to tune spectral response in optical devices. NIDN specifically
excels in the parametric optimization of heterogeneous, multi-layer devices,
which use local composition to tune electromagnetic properties. This is in
contrast to the geometric structuring of a single material surface, which has
limited local spectral tunability.

In fact, the neural network learn to produce a spatially continuous function
describing the material permittivity. We demonstrate the validity and
versatility of the approach by comparing to existing implementations that we
built on. We showcase several examples ranging from simple uniform layers to
practical applications related to photonic filter design and perfect anti-
reflection. NIDN is also capable of running on graphics cards (GPUs) and is
available open-source online.111https://github.com/esa/NIDN Accessed:
2022-04-21 The authors hope to build a community around the software,
extending its capabilities and fidelity even further in the future.

## Results

In the following, we showcase results demonstrating NIDN’s capabilities. In
particular, we first validate the numerical Maxwell solvers in NIDN against
baselines, then show the efficacy of the inverse design on some simple
materials, and, finally, investigate two common design scenarios from the
literature.

### Material Design Setup

The following results were obtained using NIDN and its Maxwell solvers derived
from the RCWA implementations by Jin et al. [14] and an adaption of an open-
source implementation of FDTD in PyTorch
1.9.222https://github.com/flaport/fdtd Accessed: 2022-04-21 Both are described
in more detail in the Section Methods. NIDN utilizes PyTorch 1.9 to enable
automatic differentiation and neural network training to design materials of
stacked layers such as shown in Figure 1. Details on neural network
architectures and training as well as the detailed training setup are given in
the Section Methods. Data on material permittivity are obtained from an online
database.333https://refractiveindex.info Accessed: 2022-04-21 More detailed
info on specific references for each material are provided in the integrated
database of materials in
NIDN.444https://github.com/esa/NIDN/tree/main/nidn/materials/data Accessed
2022-04-21
Permittivity between provided measurement points is interpolated linearly.
Layer thickness if not specified otherwise is
$1\text{\,}\mathrm{\SIUnitSymbolMicro m}$. Grid dimensions if not specified
are $1\text{\,}\mathrm{\SIUnitSymbolMicro m}$ $\times$
$1\text{\,}\mathrm{\SIUnitSymbolMicro m}$. In general, NIDN supports two modes
of inverse design which are described in more detail in the Section Methods:
The first one is referred to as regression, where the permittivity of the
material is predicted within some value range to investigate hypothetical
materials achieving the target spectral characteristics. If not specified
otherwise, the range for relative permittivity $\epsilon_{r}$ considered by
the network is $[0.01,20+3i]$. All references to permittivity refer to
relative permittivity. The second approach is called classification and the
permittivity in this case is chosen as a linear combination of reported
permittivity of real materials. All considered materials are listed in the
codebase. At present, only normal incidence is considered. Figure 1 gives a
high-level overview of the training process.
The number of training iterations depended on the task and solver; for RCWA
between 1000 and 5000 training iterations were used, for FDTD not more than
150 iterations due to the higher computation time. No dispersion model is used
and frequencies are computed independently. For a single uniform layer, a
single training iteration with FDTD requires about eight seconds per
frequency, with RCWA it takes six milliseconds per frequency per iteration. L1
errors reported in the figures refer to the mean absolute error between the
target and obtained spectrum. Inversion with FDTD used a coarser grid in the
numerical discretization than for validation to keep the computational cost
manageable (32 instead of 100).

(a) NIDN RCWA TiO2 Layer Spectrum (b) NIDN FDTD TiO2 Layer Spectrum (c)
Experimental results by Wojcieszak et al.[27] (reprinted with permission)

Figure 2: Comparison of the transmittance of a $380\text{\,}\mathrm{nm}$ thick
layer of TiO2 in NIDN and experimentally measured

(a) Target and Obtained Spectrum (b) Predicted Permittivity

Figure 3: Inversion results for a single-layer TiO2 material using FDTD and
regression; a) displays target and produced spectra, b) shows the utilized
permittivity; differences to Figure 2 are due to smaller number of
discretization grid points

### Validation and Numerical Stability

NIDN contains a fully differentiable RCWA implementation that is derived from
the Python module GRCWA[14]. In contrast to GRCWA, NIDN utilizes PyTorch.
Extensive tests are performed to validate both implementations against the
original implementations and results of these can be found in the
Supplementary Information.
NIDN adapts the FDTD implementation from the Python module with the same name
(fdtd555https://github.com/flaport/fdtd Accessed: 2022-04-21) but adds support
for gradient flow through it and performs post processing. A comparison with
an experimental baseline is given to validate the implemented post processing.
Further, we directly compare results with the original Python module to
validate our changes to it.
A comparison with an experimental measurement of the transmission spectrum of
TiO2 is performed for both. The TiO2 layer in the experiment by Wojcieszak et
al.[27] was $380\text{\,}\mathrm{nm}$ thick and transmission of wavelengths
between $300\text{\,}\mathrm{nm}900\text{\,}\mathrm{nm}$ were measured using a
spectrophotometer. Figure 2 displays transmittance obtained with NIDN RCWA and
FDTD using continuous waves with wavelengths from
$300\text{\,}\mathrm{nm}900\text{\,}\mathrm{nm}$ as well as the experimental
result. Overall, it can be seen that the transmittance in NIDN resembles the
one observed in the experiment. Point clustering in the FDTD version is a
discretization effect due to the number of grid points used in the simulation.

(a) Target and Obtained Spectrum (b) Predicted Permittivity

Figure 4: Inversion results for a single-layer TiO2 material using FDTD and
classification; a) displays target and produced spectra, b) shows the utilized
permittivity; differences to Figure 2 are due to smaller number of
discretization grid points

### Material and Structure Inference

As a first demonstration of NIDN’s capabilities, we present results on some
rudimentary examples. These examples aim to reconstruct a material for which
the spectral characteristics were computed with RCWA / FDTD, thus the
inversion is certain to have a solution obtainable by the network. In
particular, these results show that, depending on the complexity of the
spectral characteristics, almost perfect results can be obtained. Furthermore,
we can investigate how unique solutions are by studying the similarity of
designed materials with the ground-truth baseline.

#### Uniform TiO2 Layer Inversion

First, we show that NIDN is capable of recreating the permittivity of a single
layer of TiO2, with FDTD in the visible range of the spectrum (for RCWA a more
complex three-layer example is tested).
Figure 3 showcases these results. Note that to save computational time, a
limited number of frequency points, i.e. 20, were investigated. A clear
convergence towards the ground truth is visible. However, the predicted
permittivity clearly differs from the real one.

Even though the inversion with the regression approach was successful, it was
not constrained to realistic materials. In Figure 4 we show results for the
classification approach for this single-layer material. Overall, the inversion
is successful and the obtained spectral characteristics are even closer to the
target. Furthermore, as seen in Figure 4b, the used epsilon value now
corresponds well to the experimental permittivity of TiO2.

(a) Target and Obtained Spectrum (b) Predicted Permittivity

Figure 5: Inversion results for a three-layer material using RCWA and
regression; a) displays target and produced spectra, b) shows the utilized
permittivity for each layer

(a) Target and Obtained Spectrum (b) Predicted Permittivity

Figure 6: Inversion results for a three-layer material using RCWA and
classification; a) displays target and produced spectra, b) shows the utilized
permittivity for each layer

#### Three-Layer Uniform Material

The second example is the design of a three-layer material consisting of TiO2,
Germanium (Ge) and Ta2O5. Figure 5 displays the regression results with RCWA
for this material. Again, the design of the spectral properties is successful.
However, permittivities of the different layers are notably further from real
materials. The obtained permittivity is not resemblant of the used materials.
In contrast, with the classification and RCWA approach, the restriction for
the permittivity actually leads to the network learning the permittivity of
the utilized materials for each layer, as can be seen in Figure 6.
Furthermore, the achieved spectral characteristics also almost perfectly match
the design goal of the ground truth.

(a) Target and Obtained Spectrum (b) Predicted Permittivity

Figure 7: Inversion results for a two-layer patterned material using RCWA and
regression; a) displays target and produced spectra, b) each line shows the
utilized permittivity for a grid cell

(a) Target and Obtained Spectrum (b) Predicted Permittivity

Figure 8: Inversion results for a two-layer patterned material using RCWA and
classification; a) displays target and produced spectra, b) each line shows
the utilized permittivity for a grid cell

#### Two-Layer Patterned Material

The last case based on a ground truth from the forward models (i.e., the RCWA
and FDTD implementations) is a two-layer patterned material consisting of TiO2
and Ge with a square pattern in the center similar to those shown in the
Supplementary Information. In the upper layer the square is made of TiO2 and
surroundings of Ge and vice versa for the bottom layer. This test case is only
studied with RCWA as support for patterned layers is currently still in
development for FDTD.
Figure 7 displays the obtained spectral characteristics with regression and
RCWA. The desired spectrum is reproduced very well as can be seen in Figure
7a. However, the utilized permittivity is not close to any material available
in NIDN as 7b shows and the reconstructed pattern is not resemblant of the
ground truth.
For the classification approach and RCWA, shown in Figure 8, comparable errors
are obtained. In this case – as can be seen in Figure 8b – the permittivity
chosen by the network is close to those of used in the ground truth, i.e.,
TiO2 and Ge. The pattern of the ground truth was not reconstructed implying
that the network found a good solution without it.

(a) Target and Obtained Spectrum (b) Predicted Permittivity

Figure 9: Inversion results for designing a bandpass filter with a ten layer
stack using RCWA and regression; a) displays target and produced spectra, b)
shows the utilized permittivity for each layer and closest material in NIDN
(dashed)

### Filter Design

The first test case closer to a potential application is the design of a
bandpass filter. In this case, the target spectral properties are defined
manually. Hence, the spectral characteristics may actually not be obtainable
with the material properties the network is allowed to utilize. A stack of ten
uniform layers is used to design the material. Due to the larger computational
cost of FDTD, only RCWA was studied in this case. Also, the classification for
this test case did not converge - likely because the available materials in
database did not suffice to find a solution for this problem.

#### Regression

With the regression, the chosen range for the relative permittivity is
$\epsilon_{r}\in[0,20+1i]$. The achieved spectral characteristics with
regression and RCWA of the designed filter are shown in Figure 9. The designed
material captures the gap at the chosen wavelength around 1550 nm very well.
Notably, the utilized permittivity is not similar to those of existing
materials with erratic peaks in the real component of the permittivity for
some of the layers.

### Perfect Anti-Reflection Coating

This second test case related to an application explores the scenario of
building a perfect anti-reflection on top of a substrate with relative
permittivity $\epsilon_{r}=16$. This is closely related to the research
described by Kim & Park [28]. Thus, we use a stack of eight
$0.1\text{\,}\mathrm{\SIUnitSymbolMicro m}$ thick layers on top of the higher
permittivity substrate to achieve an anti-reflection coating (ARC).

(a) Target and Obtained Spectrum (b) Predicted Permittivity

Figure 10: Inversion results for designing an anti-reflection coating with an
eight layer stack using RCWA and regression; a) displays target and produced
spectra, b) shows the utilized permittivity for each layer and closest
material in NIDN (dashed)

#### Regression

For the regression with RCWA, Figure 10 displays the achieved spectral
characteristics. The obtained transmittance is above 0.9975 for the entire
range between $400\text{\,}\mathrm{nm}700\text{\,}\mathrm{nm}$, a peak
transmittance of 0.9990 is achieved, the average is 0.9985. However, once
again we can observe – as seen in Figure 10b – that the chosen permittivity
does not resemble real material properties.

(a) Target and Obtained Spectrum (b) Predicted Permittivity

Figure 11: Inversion results for designing an anti-reflection coating with an
eight layer stack using RCWA and classification; a) displays target and
produced spectra, b) shows the utilized permittivity for each layer and
closest material in NIDN (dashed)

#### Classification

With the classification approach, the material design is still successful as
can be seen in Figure 11. On average, the transmittance is 0.9011 with all
values being over 0.7822 and a peak at 0.9756. As discernible in Figure 11b,
the chosen materials for the layers in this approach are similar to existing
ones such as Silicon Nitride and TiO2.

## Discussion

Overall, the results presented in this work clearly highlight the capabilities
and potential of NIDN. We have shown it is able to correctly reproduce the
material properties of several synthetic examples, which demonstrates that the
inversion and training is successful for both, RCWA and FDTD. Similarly, the
creation of both a $1550\text{\,}\mathrm{nm}$ filter and a perfect ARC are
achieved. However, especially the regression approach is susceptible to
finding solutions which are not plausible for real materials. The main reason
for this is the lack of constraints on the chosen permittivity. Currently, the
constraints on physical plausibility in NIDN are implicitly given through the
numerical simulations for determining the spectral characteristics. An
additional component that checks if the predicted permittivity matches a
realistic permittivity may be needed. The classification approach is able to
partially remedy this, but for the real-world examples of filter design and
ARC it is less effective at matching desired spectral characteristics. This is
likely due to the limited number (12) of materials currently available in
NIDN. The number can be increased, however, this also creates a harder
classification problem which may in turn require finding an optimal trade-off
of the number and diversity of available materials vs. the design limitations
induced by fewer available materials.

One aspect where NIDN is more versatile than previous approaches [25] is that
no imposition of shape or form is required or performed. In fact, even the
discretization into a grid is not a constraint as it is only required by the
solver (RCWA or FDTD); the neural network output is spatially continuous. One
thing that has been observed is, however, that the simpler case of having
uniform layers benefits training convergence when utilizing RCWA. The reason
for this is likely the need to iteratively solve an eigenvalue problem if non-
uniform layers are present which may deteriorate gradients. This may be
remedied, e.g., by returning to a stochastic setting where gradients are
averaged over several tested materials to make the training more robust. This
does come at an increased computational cost but may be parallelized.

In summary, NIDN demonstrates the flexibility of physics-based deep learning
methods. The range of applications for the software goes well beyond the shown
test cases of filters and ARC as it conceivably can be used for a broad range
applications such as radiative materials [15, 16] or solar sails [14]. With
RCWA and FDTD, two complementary solvers are integrated, RCWA being fast and
well-suited for higher wavelength and FDTD being more potent and capable to
investigate nanostructures in the visible and infrared spectrum. In the
future, optimization and parallelization of the solvers will be critical to
improve performance as especially training with FDTD for complex materials
becomes prohibitively computationally expensive. Further, FDTD can also be
used for the design of non-periodic structures which is a feature not yet
implemented in NIDN.

## Methods

### Rigorous Coupled-Wave Analysis (RCWA)

The RCWA method is a well-established tool for modeling scattering of stacked
structures [20]. In the NIDN implementation, single material as well as
patterned layers can be stacked. A detailed overview of the capabilities can
be found in the documentation of the Python module grcwa [14] which NIDN’s
implementation is derived from. Note that the numerical stability of RCWA is
dependent on the ratio of the size of the material grid to the investigated
wavelength, i.e., for ratios above one RCWA may produce non-physical results.
The implementation in NIDN supports specifying a top or bottom layer in
addition to the material; by default a vacuum layer is placed at both. The
grid dimensions, number of layers and thicknesses of all layers can be
specified manually. The default truncation order for simulations is 11 to keep
computational costs low but it is configurable. The implementation employs a
relaxation by adding a fictitious material absorption loss [14, 29]. For now,
we only investigated inversion with perpendicular light incidence angles and
polarized light, however, both are also configurable in the RCWA
implementation.

### Finite-Difference Time-Domain (FDTD)

FDTD is a simulation method that models the electric and magnetic field using
a regular grid as a spatial discretization with a finite difference method
[30]. The electric and magnetic fields at each grid point are calculated with
numerical approximations of Maxwell’s equations; more specifically the
electric field at each point is calculated using the curl of the magnetic
field surrounding the point, and the magnetic field is calculated using the
curl of the electric field surrounding the point.

The grid size is set to one tenth of the smallest wavelength used in the
simulations, based on recommendations from the fdtd module’s
documentation.666https://fdtd.readthedocs.io/en/latest/ Accessed: 2022-05-02
The time step is set according to the Courant-Friedrichs-Lewy Condition [31],
to ensure numerical stability:

$\Delta t=\frac{S_{c}\cdot\Delta x}{u}$ (1)

where $\Delta t$ is the time step, $u$ is the wave velocity, $\Delta x$ is the
spatial resolution and $S_{c}=\sqrt{dim}=\sqrt{2}$ is the Courant number.

In this work, the FDTD simulations were setup with periodic boundaries in the
directions orthogonal to the wave-propagation to simulate an infinite plane.
In the direction of propagation, Perfectly Matching Layers (PML) were used.
PMLs aim to absorb as much of the electromagnetic-wave as possible to avoid
reflections at the boundaries of the grid. In the propagation direction, the
grid is built up by a PML layer of 1.5 µm, a vacuum layer of 1.0 µm, the
material(s) chosen with the specified thicknesses, a vacuum layer of 1.0 µm
and finally another PML layer of 1.5 µm. The source is a line across the width
of the grid, radiating a continuous wave, placed at the interface between the
first PML-layer and the free-space layer.

We measure the electromagnetic wave at placed detectors in the FDTD
simulations such that the signal is independent of the direction of the
incoming wave. Due to this, a correction of the reflected signal is necessary
as the raw signal contains both the forward-going wave before reflection and
the reflected wave. For the correction, we use an identical simulation setup
without a material, the so-called free-space case, and subtract the measured
signal from this simulation from the one with a material.

The transmission and reflection coefficients are calculated by comparing the
energy of the wave after the transmission and a free-space case where there is
no loss from a material such that

$T=\frac{P_{i}}{P_{t}}=\frac{E_{0i}^{2}}{E_{0t}^{2}}$ (2)

where the subscripts $i$,$t$ and $0$ refer to incident wave, transmitted wave
and amplitude of the wave, respectively. Since the mean squared value of an
integer number of periods of a sine wave equals $\frac{E_{0}^{2}}{2}$, the
mean squared value is used to calculate the transmission coefficients. The
same is the case for the corrected reflection signal. No dispersion model has
been implemented as frequencies are computed independently. By running the
simulation for all desired wavelengths, the coefficients from each simulation
were accumulated to obtain a transmission and reflection spectrum. The
absorption spectrum is calculated by $A=1-T-R$.

The number of time steps were chosen such that both the reflected signal and
transmitted signal have at least two peaks, such that the mean square can be
calculated over at least one period. The loss from a material in FDTD comes
from the conductivity parameter. This is included in the AbsorbingObject from
the fdtd module, which is the only object/material type currently implemented
in NIDN. The conductivity $\sigma$ is set to
$\sigma=\epsilon^{\prime\prime}\cdot\epsilon_{0}\cdot\omega$

### Model Inversion Approach

The inversion process in NIDN is inspired by recent research related to
physics-based deep learning [23] and in directly optimizing physical
properties using differentiable simulations [32]. The main advantage of these
approaches is that gradients in training neural networks are propagated
directly through a numerical simulation (also referred to as forward model in
the context of inverse problems). Thus, there is no need to build a dataset of
any kind. In particular, the process in NIDN consists of the following steps
which are also depicted in Figure 1:

  1. 1.

Specify target spectral characteristics (reflectance, transmittance,
absorptance) and material properties (size, allowed permittivity, simulation
parameters)

  2. 2.

Randomly initialize a neural network that prompted with a position returns the
material’s permittivity at that position

  3. 3.

Perform an evaluation of the numerical model for all target frequencies, i.e.,
compute the spectral characteristics for the materials as described by the
network

  4. 4.

Compute the loss, i.e., the difference in the target spectral characteristics
and those obtained through the network’s material

  5. 5.

Backpropagate the gradients and update the network parameters to iteratively
minimize the difference between target and obtained spectral characteristics

  6. 6.

Until results are satisfactory, return to Step 3

After this process, the network is directly encoding the designed material by
providing a permittivity for each position in the material. Herein, the
conversion from a position to a permittivity is a particularly critical aspect
to allow successful inverse design which will now be described in more detail.

### Direct Permittivity Inference

NIDN implements two different ways to determine the relative permittivity
$\epsilon_{r}^{P}$ at a point $P=(x,y,z,f)$ where $x$ and $y$ are the point’s
location in a layer, $z$ is the index of the layer it is on and $f$ is the
frequency at which we are evaluating. The first way is referred to as
regression because the network herein directly infers a permittivity mapping
$P\mapsto\epsilon_{r}^{P}$. The values are then clipped at some specified
range to restrict it to physically plausible permittivity values. However, as
can be seen in the results section, the frequency-dependent permittivity is
still fairly unconstrained, allowing for materials that are not plausible as
they, e.g., do not necessarily satisfy the Kramers-Kronig relationship [33].
But, the advantage of this approach is the direct optimization of the material
permittivity to obtain a solution that – at least with regard to the Maxwell
solver – is plausible and can give a first idea of the hypothetical
feasibility of some spectral characteristic assuming few constraints on
permittivity. Permittivity values close to 0 are clipped to $\pm 0.01$ to
avoid singularities in the Maxwell solvers.

### Material Classification

In order to obtain materials of higher physical fidelity, NIDN implements a
second way of encoding material permittivity in the neural network. Naively,
one may assume that it would be easiest to have the network perform a
classification by assigning one specific material (and hence its permittivity)
to each grid cell. Unfortunately, this is infeasible as the necessary argmax
operation in a classification (to select the most probable material) is not
differentiable and thus would break the gradient flow. As an alternative, NIDN
features a collection of $N$ \- at time of writing twelve - materials from
which we determine the relative permittivity $\epsilon_{r}$ at a point $P$
through a linear combination such that

$\epsilon_{r}^{P}=\sum_{i=1}^{N}y^{P}\epsilon_{r}^{i},$ (3)

where $y^{P}\in[0,1]^{N}$ is the neural network output for point $P$ and its
$i$-th entry describes the probability of the $i$-th material at the point $P$
and $\epsilon_{r}^{i}$ is the relative permittivity of the $i$-th material in
NIDN, respectively. Thus, the produced permittivity is strongly resemblant of
real experimental permittivity as can be seen in the results for the
classification approach. Furthermore, to push the network towards picking one
material without breaking gradient flow, the output $y^{P}$ is passed through
a softmax function with $\beta=16$.

### Neural Network Training

The neural network training in NIDN is inspired by several previous works in
the field of differentiable models [32, 34, 35, 36]. Thus, dense neural
networks, namely the NeRF [35] and Siren [36] architecture are employed. NIDN
allows a variety of losses such as absolute mean error or L2 error. For the
classification, an additional regularization loss is used penalizing
probabilities for their distance from the values 0 and 1. Training uses the
Adam optimizer, a default learning rate of $8\cdot 10^{-5}$ and a learning
rate scheduler to reduce the learning rate upon encountering a plateauing
loss.

### Software Structure

In general, NIDN enables users with two potential use cases: The first is to
run forward model simulations using either RCWA or FDTD to obtain the spectral
characteristics of a material. The second is the inverse design using neural
network models to describe a material structure that produces certain spectral
characteristics. NIDN’s software repository has Jupyter notebooks describing
both processes in detail for RCWA and FDTD to enable users to run their own
experiments. The project is open to contributions and under a permissive GPL-3
open-source license to allow customization.
NIDN is designed with modularity in mind, allowing for arbitrary neural
network models and Maxwell solvers to be plugged in. It uses a continuous
integration methodology with automated unit tests to ensure the correctness of
the implementation. Several plotting utilities, such as those used for the
figures in this work are available. It is the authors’ hope that the described
steps and features will allow others to build and improve upon it.

## References

  * [1] Wei, J. _et al._ Machine learning in materials science.  _InfoMat_ 1, 338–358 (2019).
  * [2] Liu, Y., Zhao, T., Ju, W. & Shi, S.  Materials discovery and design using machine learning.  _Journal of Materiomics_ 3, 159–177 (2017).
  * [3] Jiang, J., Chen, M. & Fan, J. A.  Deep neural networks for the evaluation and design of photonic devices.  _Nature Reviews Materials_ 6, 679–700 (2021).
  * [4] Liu, Z., Zhu, D., Rodrigues, S. P., Lee, K.-T. & Cai, W.  Generative model for the inverse design of metasurfaces.  _Nano Letters_ 18, 6570–6576, DOI: 10.1021/acs.nanolett.8b03171 (2018).
  * [5] Ma, W., Cheng, F., Xu, Y., Wen, Q. & Liu, Y.  Probabilistic representation and inverse design of metamaterials based on a deep generative model with semi-supervised learning strategy.  _Advanced Materials_ 31, 1901111, DOI: 10.1002/adma.201901111 (2019).
  * [6] Tahersima, M. H. _et al._ Deep neural network inverse design of integrated photonic power splitters.  _Scientific Reports_ 9, DOI: 10.1038/s41598-018-37952-2 (2019).
  * [7] Piggott, A. Y., Petykiewicz, J., Su, L. & Vučković, J.  Fabrication-constrained nanophotonic inverse design.  _Scientific Reports_ 7, DOI: 10.1038/s41598-017-01939-2 (2017).
  * [8] Rodríguez, J. A. _et al._ Inverse design of plasma metamaterial devices for optical computing.  _Physical Review Applied_ 16, DOI: 10.1103/physrevapplied.16.014023 (2021).
  * [9] Sajedian, I., Badloe, T. & Rho, J.  Finding the best design parameters for optical nanostructures using reinforcement learning.  _arXiv preprint arXiv:1810.10964_ (2018).
  * [10] Sajedian, I., Badloe, T. & Rho, J.  Optimisation of colour generation from dielectric nanostructures using reinforcement learning.  _Optics express_ 27, 5874–5883 (2019).
  * [11] Molesky, S. _et al._ Inverse design in nanophotonics.  _Nature Photonics_ 12, 659–670, DOI: 10.1038/s41566-018-0246-9 (2018).
  * [12] MORI, O. _et al._ First solar power sail demonstration by IKAROS.  _Transactions of the Japan Society for Aeronautical and Space Sciences, Aerospace Technology Japan_ 8, To_4_25–To_4_31, DOI: 10.2322/tastj.8.to_4_25 (2010).
  * [13] Ullery, D. C. _et al._ Strong solar radiation forces from anomalously reflecting metasurfaces for solar sail attitude control.  _Scientific Reports_ 8, DOI: 10.1038/s41598-018-28133-2 (2018).
  * [14] Jin, W., Li, W., Orenstein, M. & Fan, S.  Inverse design of lightweight broadband reflector for relativistic lightsail propulsion.  _ACS Photonics_ 7, 2350–2355, DOI: 10.1021/acsphotonics.0c00768 (2020).
  * [15] Sun, K. _et al._ Metasurface optical solar reflectors using AZO transparent conducting oxides for radiative cooling of spacecraft.  _ACS Photonics_ 5, 495–501, DOI: 10.1021/acsphotonics.7b00991 (2017).
  * [16] Sun, K. _et al._ VO2 thermochromic metamaterial-based smart optical solar reflector.  _ACS Photonics_ 5, 2280–2286, DOI: 10.1021/acsphotonics.8b00119 (2018).
  * [17] Hossain, M. M., Jia, B. & Gu, M.  A metamaterial emitter for highly efficient radiative cooling.  _Advanced Optical Materials_ 3, 1047–1051, DOI: 10.1002/adom.201500119 (2015).
  * [18] Jiang, J. _et al._ Metanet: a new paradigm for data sharing in photonics research.  _Optics Express_ 28, 13670–13681 (2020).
  * [19] Sullivan, D. M.  _Electromagnetic simulation using the FDTD method_ (John Wiley & Sons, 2013).
  * [20] Moharam, M. & Gaylord, T.  Rigorous coupled-wave analysis of planar-grating diffraction.  _JOSA_ 71, 811–818 (1981).
  * [21] Han, K. & Chang, C.-H.  Numerical modeling of sub-wavelength anti-reflective structures for solar module applications.  _Nanomaterials_ 4, 87–128 (2014).
  * [22] Jiang, X. _et al._ Implementation of radiative cooling with an inverse-designed selective emitter.  _Optics Communications_ 497, 127209, DOI: 10.1016/j.optcom.2021.127209 (2021).
  * [23] Thuerey, N. _et al._ Physics-based deep learning.  _arXiv preprint arXiv:2109.05237_ (2021).
  * [24] Ma, W. & Liu, Y.  A data-efficient self-supervised deep learning model for design and characterization of nanophotonic structures.  _Science China Physics, Mechanics & Astronomy_ 63, DOI: 10.1007/s11433-020-1575-2 (2020).
  * [25] Nadell, C. C., Huang, B., Malof, J. M. & Padilla, W. J.  Deep learning for accelerated all-dielectric metasurface design.  _Optics Express_ 27, 27523, DOI: 10.1364/oe.27.027523 (2019).
  * [26] Colburn, S. & Majumdar, A.  Inverse design and flexible parameterization of meta-optics using algorithmic differentiation.  _Communications Physics_ 4, DOI: 10.1038/s42005-021-00568-6 (2021).
  * [27] Wojcieszak, D., Kaczmarek, D. & Domaradzki, J.  Analysis of surface properties of semiconducting (ti,pd,eu)ox thin films.  _Opto-Electronics Review_ 24, 15–19, DOI: doi:10.1515/oere-2016-0003 (2016).
  * [28] Kim, K.-H. & Park, Q.-H.  Perfect anti-reflection from first principles.  _Scientific reports_ 3, 1–5 (2013).
  * [29] Liang, X. & Johnson, S. G.  Formulation for scalable optimization of microcavities via the frequency-averaged local density of states.  _Optics express_ 21, 30812–30841 (2013).
  * [30] Schneider, J. B.  Understanding the finite-difference time-domain method (2010).
  * [31] De Moura, C. A. & Kubrusly, C. S.  The courant–friedrichs–lewy (cfl) condition.  _AMC_ 10 (2013).
  * [32] Izzo, D. & Gómez, P.  Geodesy of irregular small bodies via neural density fields: geodesynets.  _arXiv preprint arXiv:2105.13031_ (2021).
  * [33] Lucarini, V., Saarinen, J. J., Peiponen, K.-E. & Vartiainen, E. M.  _Kramers-Kronig relations in optical materials research_ , vol. 110 (Springer Science & Business Media, 2005).
  * [34] von Looz, M., Gomez, P. & Izzo, D.  Study of the asteroid bennu using geodesyanns and osiris-rex data.  _arXiv preprint arXiv:2109.14427_ (2021).
  * [35] Mildenhall, B. _et al._ Nerf: Representing scenes as neural radiance fields for view synthesis.  In _European conference on computer vision_ , 405–421 (Springer, 2020).
  * [36] Sitzmann, V., Martel, J., Bergman, A., Lindell, D. & Wetzstein, G.  Implicit neural representations with periodic activation functions.  _Advances in Neural Information Processing Systems_ 33, 7462–7473 (2020).

## Author contributions statement

P.G. and H.H.T. conceived of the presented idea, P.G., H.H.T and T.B.S.
developed the computational framework and performed computations, P.G. and
T.B.S. conducted the simulations, H.H.T, T.B.S., D.A.E. and J.M.L. contributed
to the interpretation of results. J.M.L. provided supporting software and
calculations. P.G. took the lead in writing the manuscript. All authors
provided critical feedback and helped shape the research, analysis and
manuscript.

## Data availability statement

All code and results presented in this paper are available open-source and
open-access in the associated GitHub repository under
https://github.com/esa/NIDN. Jupyter notebooks in the repository contain all
data shown in this article.

## Additional information

The authors declare no competing interests.

##  Appendix A Supplementary Information

We show the numerical comparison between the original implementation of RCWA
in the Python package grcwa with the implementation in NIDN. Figure A.1
contains the details of the uniform and patterned unit cells. Figure A.2 shows
the comparison in reflectance and transmittance of the unit cell from Figure
A.1a and, correspondingly, Figure A.3 from Figure A.1b.

The validation of the FDTD impelementation in NIDN with respect to the
original package fdtd is shown in Figure A.4 through the electric field in a
TiO2 slab of 300 nm.

(a) Uniform Grid Test Case (b) Patterned Grid Test Case

Figure A.1: Geometry of test cases for validation against the original
implementation of RCWA in the Python module grcwa. A three-layer homogeneous
material and a two-layer patterned material are investigated. Figure A.2: A
three-layer uniform material with a layer of Germanium, Titanium Dioxide
(TiO2) and Tantalum Pentoxide (Ta2O5), respectively. The spectral
characteristics are investigated at wavelengths between
$1\text{\,}\mathrm{\SIUnitSymbolMicro m}50\text{\,}\mathrm{\SIUnitSymbolMicro
m}$. The mean absolute error between GRCWA and NIDN is $7.90\cdot 10^{-5}$.
Overall, the spectra are very similar and differences are likely in the range
of numerical errors. Figure A.3: The second test case is a material consisting
of two patterned $$0.1\text{\,}\mathrm{\SIUnitSymbolMicro
m}$\times$0.1\text{\,}\mathrm{\SIUnitSymbolMicro m}$$ layers consisting of
Ta2O5 with an embedded square and circle component of ZnO and TiO2 in the
center, respectively. A range of $1\text{\,}\mathrm{\SIUnitSymbolMicro
m}10\text{\,}\mathrm{\SIUnitSymbolMicro m}$ is chosen. Obtained mean absolute
error are between the spectra is $1.70\cdot 10^{-3}$. Again, the obtained
spectra match almost perfectly.

(a) fdtd vs. NIDN signal (b) Error between fdtd and NIDN

Figure A.4: Direct comparison of a single $300\text{\,}\mathrm{nm}$ thick TiO2
layer obtained with NIDN’s FDTD implementation and the one from the fdtd
Python module for a continuous light source at a wavelength
$1\text{\,}\mathrm{\SIUnitSymbolMicro m}$. The mean absolute error between the
original FDTD and NIDN is $6.88\cdot 10^{-7}$. Overall, results remain
virtually identical apart from numerical errors.


# ResSFL: A Resistance Transfer Framework for Defending Model Inversion Attack
in Split Federated Learning

Jingtao Li1, Adnan Siraj Rakin1, Xing Chen1, Zhezhi He2, Deliang Fan1,
Chaitali Chakrabarti1
1 School of Electrical Computer and Energy Engineering, Arizona State
University, Tempe, AZ
2 Department of Computer Science and Engineering, Shanghai Jiao Tong
University, Shanghai
1{jingtao1, asrakin, xchen382, dfan<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

This work aims to tackle Model Inversion (MI) attack on Split Federated
Learning (SFL). SFL is a recent distributed training scheme where multiple
clients send intermediate activations (i.e., feature map), instead of raw
data, to a central server. While such a scheme helps reduce the computational
load at the client end, it opens itself to reconstruction of raw data from
intermediate activation by the server. Existing works on protecting SFL only
consider inference and do not handle attacks during training. So we propose
ResSFL, a Split Federated Learning Framework that is designed to be MI-
resistant during training. It is based on deriving a resistant feature
extractor via attacker-aware training, and using this extractor to initialize
the client-side model prior to standard SFL training. Such a method helps in
reducing the computational complexity due to use of strong inversion model in
client-side adversarial training as well as vulnerability of attacks launched
in early training epochs. On CIFAR-100 dataset, our proposed framework
successfully mitigates MI attack on a VGG-11 model with a high reconstruction
Mean-Square-Error of 0.050 compared to 0.005 obtained by the baseline system.
The framework achieves 67.5% accuracy (only 1% accuracy drop) with very low
computation overhead. Code is released at:
https://github.com/zlijingtao/ResSFL.

##  1 Introduction

Collaborative training schemes have become popular in applications where
preserving data privacy is very important. A representative example is
federated learning [13], which has been used in a broad range of computer
vision tasks involving private data, such as in human face recognition. Split
Federated Learning (SFL)[19] is a recent collaborative training scheme that
combines the merits of Split Learning (SL)[6] and Federated Learning (FL). It
has significant advantages on computation reduction and memory usage compared
to FL [13, 7] and significantly faster compared to the original SL scheme.

(a) Training process of SFL

(b) Server perform MI attack

(c) Our proposed ResSFL two-step framework

Figure 1: ResSFL overview. (a) Multi-client SFL training process. (b) MI
attack performed by server. The client-side model is queried to build
inversion model and the clients’ intermediate activations are used to
reconstruct private data. (c) High-level view of the ResSFL framework,
consisting of pre-training step and resistance transfer step.

In SFL, a neural network model is split into a client-side model and a server-
side model. Multiple clients operate on their private inputs using their
client-side model and pass the intermediate activations to the server. The
server then computes on the more expensive server-side model and passes
gradients back to clients. After an epoch, local copies of client-side model
are averaged similar to FL. Such a scheme is described in Figure 1(a). Thus
SFL avoids clients’ raw data being sent to the server and also reduces
client’s computation overhead.

Unfortunately, SFL is reported to be vulnerable to Model Inversion (MI)
attack[9, 22]. Here the honest-but-curious [18] server behaves as the
attacker. As shown in Figure 1(b), by training an inversion model of the
client-side model, the server can reconstruct clients’ raw data from
intermediate activations it received during SFL training.

Prior works provide MI resistance for SFL inference by protecting intermediate
activations [21, 9, 22, 20] or confidence score (intermediate activations of
last softmax layer) [25, 23, 24]. However, MI resistance at training time is
significantly more difficult. While inference-time defense only needs to make
the final model resistant to MI attack, training-time defense must be
resistant to MI attack anytime during the SFL training process. This is
because the honest-but-curious server has access to all intermediate
activations and can launch an attack anytime.

To defend against MI attack during training and achieve low computational
capability of the clients, we present ResSFL, a two-step Split Learning
framework that is resistant to MI attacks. The first step uses attacker-aware
training to develop MI-resistant feature extractor and the second step uses
this extractor to initialize client-side training prior to standard SFL-based
training. An overview of our proposed framework is depicted in Figure 1(c).

The attacker-aware training emulates a strong attacker using a strong
inversion model and adds bottleneck layers [2] to the inversion model to
reduce the feature space. To reduce the computational complexity of such a
process at the client-side and address vulnerability issues in early training
epochs, the attacker-aware training scheme is implemented on an expert device
and the MI resistant model is used to initialize the client side model. The
clients then implement a lite-version attacker-aware training to achieve good
accuracy on the new task while maintaining the resistance of the expert. Our
contributions can be summarized as follows:

  * •

Two-step resistant SFL framework. We present a novel two-step resistant SFL
framework based on the proposed attacker-aware training and resistance
transfer. To the best of our knowledge, this is the first work that
successfully mitigates training-time MI attack while achieving good accuracy
in SFL.

  * •

Attacker-aware Training Method. We use a combination of (i) strong inversion
model to mimic the MI attack behavior and (ii) bottleneck layers to shrink the
large feature space resulting in good MI resistance and accuracy.

  * •

Protect Training by Resistance Transfer. We use transfer learning to protect
early-epoch vulnerability of attacker-aware training as well as reduce high
computation cost of client-end training with complex inversion models.

##  2 Background

###  2.1 Split Learning

Split Learning[6] is a collaborative training scheme that is suitable for
training using low-end edge devices. By splitting the neural network model
into a client-side model and a server-side model, most of the computations can
be offloaded to the server. We use cut-layer to denote the split location.
Figure 1 (a) shows a SL scheme with cut-layer of 4, implying that the client-
side model has 4 layers.

In the state-of-the-art variant of SL called Split Federated Learning (SFL)
[19], multiple clients participate in the training process in parallel. The
clients’ models are averaged at the beginning of each epoch similar to FL. The
parallelism makes it much faster than the original scheme [6], where only one
client can train at a time and passes the updated client-side model to the
next in a round-robin fashion. We specifically consider the SFL-V2 scheme in
[19] and refer to it as SFL in the rest of the paper.

###  2.2 Threat Model

In the SFL scheme, each client has a local copy of the client-side model
denoted as $C^{i}$ for client $i$; the server-side model is denoted as $S$.
The training process executes for a total of $T$ epochs with client models
being synchronized by averaging the local copies at the beginning of each
epoch at the server; the synchronized central copy is denoted as $C^{*}$. The
intermediate activations of all training data from client $i$ at epoch $t$
($t>0$) is denoted as ${\bm{\mathsfit{A}}}^{i}_{t}$.

The server uses MI attack [3] to reconstruct the raw inputs. We only consider
the training-based MI attack [3, 26] where an auxiliary dataset with similar
data distribution is required. The other optimization-based MI attack [1, 9]
has weaker performance and is included only in the supplementary material. To
perform MI attack, at epoch $t$, the attacker uses an inversion model $G$ that
maps the feature space of ${\bm{\mathsfit{A}}}^{i}_{t}$ to input space. Model
$G$ is trained to minimize Mean-Square-Error (MSE) loss between the ground-
truth image and the reconstructed image. We assume the server use the
validation dataset as the auxiliary dataset, ${\bm{x}}_{aux}$. The
optimization process of $G$ is:

$G=\operatorname*{arg\,min}_{G}MSE(G(C({\bm{x}}_{aux})),{\bm{x}}_{aux})$ (1)

Then, the trained inversion model $G$ is used to reconstruct the intermediate
activation ${\bm{\mathsfit{A}}}^{i}_{t}$ sent by client $i$ to reveal its
private training data.

${\bm{x}}^{*}_{priv}=G({\bm{\mathsfit{A}}}^{i}_{t})$ (2)

Assumption I. HBC condition. We assume the server is honest-but-curious (HBC)
[18], that is, it follows the protocol properly and sends back computationally
correct results. However, it records all the intermediate activation
${\bm{\mathsfit{A}}}^{i}_{t}$ sent by the client $i$. We rule out malicious
conditions in [17] since a malicious server can neutralize any possible
defense.

Assumption II. White-box assumption. The server has full query access and
white-box assumption on client-side model $C^{*}$, the training algorithm
including defensive methods, architecture information and model parameters.
The assumption is practical since the server can also act as a participating
client with its own private data.

Assumption III. Increased Strength of Inversion Model. We assume that the
server can try different model architectures to instantiate the inversion
model for MI attack. Unlike previous works [26, 22, 20] which use a single
architecture (usually very simple), we allow the server to use inversion
models with increased complexity, as shown in Table 1. Note that since the
server has no dearth of computational resources, it can easily support high
complexity models.

Table 1: Description of inversion models with increasing complexity L0
$\rightarrow$ L3.

| Depth | Width | FLOPs*
---|---|---|---
L0 |  2$\times$ Conv2D + Conv2DTranspose | 16 Channels | 3.6M
L1 |  2$\times$ BasicBlocks + Conv2DTranspose | 16 Channels | 5.1M
L2 |  4$\times$ BasicBlocks + Conv2DTranspose | 32 Channels | 18.7M
L3 |  6$\times$ BasicBlocks + Conv2DTranspose | 64 Channels | 76.2M

*: FLOPs are measured using an input of size [1,128,8,8], which corresponds to intermediate activation of VGG-11 model with cut-layer of 2. In comparison, the client-side model has 21.5 M FLOPs. Architecture details are provided in supplementary material.

###  2.3 Resistance Definition

Similar to previous works on MI attack [26, 24], we define MI resistance as
the MSE between the ground-truth image $x_{priv}$ and the reconstructed image
$x^{*}_{priv}$ generated using inversion model $G$. We choose the inversion
model from Table 1 that achieves the best performance. Empirically, we set an
MSE value of 0.02 as the resistance target.

##  3 Motivation

###  3.1 High Computation Cost

Attacker-aware training is a popular defense method adopted in defending
adversarial attacks [5, 8]. It is also used for protecting confidence score
from MI attack during inference [25]. Here an inversion model is used to train
the “purifier” that modifies the confidence score to fool the MI attack.

While this method can be used during SFL training, an inversion model needs
access to ground-truth data, meaning the inversion model must be kept locally
at client-side. Simulating a weak attacker using the low end L0 or L1
inversion models during training is fine but does not help defend against a
strong attacker (as shown later in Figure 4). On the other hand, simulating a
strong attacker has a high computation cost. For example, using the L3 decoder
costs 76.2M FLOPs, which is over 3x higher than the client-side model (21.5M
FLOPs). Such a method is clearly not acceptable for SFL, which is designed for
resource-constrained clients.

###  3.2 Early-Epoch Vulnerability

We note that early epochs of the training process can be vulnerable even with
a proper defense. Evaluation with our proposed attacker-aware training shows
that while the system is able to build up enough resistance at the end of the
training process, the early stages show very low resistance (shown later in
Figure 5). This is because resistance building is a slow progressive process,
similar to accuracy. Thus during the early training epochs, the model has
vulnerable interfaces that can be exploited for an MI attack.

##  4 Defense Framework

To address the high computational cost of implementing strong inversion models
at the client side and early-epoch vulnerability issues, we build a two-step
framework called ResSFL. It consists of a pre-training step, where we build up
a feature extractor with strong MI resistance, and a follow-up resistance
transfer step, where the resistant feature extractor is used to initialize the
client-side model of the SFL scheme. Figure 2 describes the proposed scheme.
Specifically, an expert (i.e. one powerful client or a third party) that has a
high computation budget handles the pre-training step on a source task (task
1). The pre-training step utilizes attacker-aware training (A1) and bottleneck
layers (A2). Then, the resistant feature extractor is used as an
initialization for SFL scheme on a new task (task 2). A low complexity
attacker-aware fine-tuning method (B1) is used to update the client-side model
to adapt to the new task with high accuracy while preserving MI resistance.

Figure 2: The proposed ResSFL scheme. The expert builds a MI-resistant client-
side model using attacker-aware training in step (A). This is followed by a
resistance transfer step (B) that solves a new task by reusing the client-side
model obtained in (A). Note: (A1) consists of two training steps in Algorithm
1, and (B1) is described in section 4.2.

###  4.1 Attacker-aware Training

The proposed attacker-aware training includes an inversion model $D^{i}$
parameterized by ${\bm{W}}_{D}^{i}$ for client $i$. $D^{i}$ takes the
intermediate activation ${\bm{\mathsfit{A}}}^{i}$ as input and generates the
reconstructed image ${\bm{x}}^{*}_{i}$ – similar to what a real attacker would
do. The attacker-aware training with $D^{i}$ takes the Min-Max optimization
form of:

$\displaystyle\min_{{\bm{W}}_{C}^{i},{\bm{W}}_{S}}\max_{{\bm{W}}_{D}^{i}}$
$\displaystyle\underbrace{\sum_{i=1}^{N}{\mathcal{L}_{CE}(S({\bm{W}}_{S};C^{i}({\bm{W}}_{C}^{i};{\bm{x}}_{i}),{\bm{y}}_{i})}}_{\text{Cross-
Entropy Loss}}+$ (3)
$\displaystyle\lambda\times\underbrace{\sum_{i=1}^{N}{\mathbb{R}(D^{i}({\bm{W}}_{D}^{i};C^{i}({\bm{W}}_{C}^{i};{\bm{x}}_{i})),{\bm{x}}_{i})}}_{\text{Inversion
Score}}$

where ${\bm{W}}_{C}^{i},{\bm{W}}_{S}$ denote the parameters for client-side
and server-side models. $\mathcal{L}_{{\bm{x}}_{i},{\bm{y}}_{i}}$ is cross-
entropy loss calculated on client $i$’s private data
(${\bm{x}}_{i},{\bm{y}}_{i}$). $\mathbb{R}$ is the score function which
evaluates the quality of the reconstructed images compared to ground-truth
images ${\bm{x}}_{i}$. $\lambda$ is a constant that controls the strength of
the inversion score.

From equation 3, we see that computing the inversion score requires access to
the private image ${\bm{x}}_{i}$, meaning the second optimization must be done
locally at client side in a SFL scheme. We use structural similarity index
(SSIM) score [27] for the $\mathbb{R}$ function to evaluate the quality of the
image reconstruction. SSIM has a better correlation with human perceived image
quality compared to MSE and is widely adopted in image restoration tasks.

Algorithm 1 Attacker-aware Training

0: For $N$ clients (N = 1 in pre-training step), instantiate private training
data (${\mathbf{X}}_{i},{\mathbf{Y}}_{i}$) for $1,2,...,N$, client-side model
$C^{i}$, local inversion model $D^{i}$ and server-side model $S$. $\lambda$ is
the strength of the inversion score.

1: function Train (${\mathbf{X}}_{i}$, ${\mathbf{Y}}_{i}$)

2: initialize $C^{i},D^{i},S$

3: for epoch $t\leftarrow 1$ to num_epochs do

4: $C^{*}=\frac{1}{N}\sum_{i=1}^{N}{C^{i}}$

5: for client $i\leftarrow 1$ to $N$ in Parallel do

6: $C^{i}\leftarrow C^{*}$

7: for step $s\leftarrow 1$ to num_batches do

8: Image batch (${\bm{x}}_{i},{\bm{y}}_{i}$) $\leftarrow$
(${\mathbf{X}}_{i},{\mathbf{Y}}_{i}$)

9: ${\bm{\mathsfit{A}}}^{i}_{t}=C^{i}({\bm{x}}_{i})$

10:
$score=\mathbb{R}(D^{i}({\bm{W}}_{D}^{i};{\bm{\mathsfit{A}}}^{i}_{t}),{\bm{x}}_{i})$

11: $\max_{{\bm{W}}_{D}^{i}}(score)$

12:
$loss=\mathcal{L}_{CE}(S({\bm{W}}_{S};{\bm{\mathsfit{A}}}^{i}_{t}),{\bm{y}}_{i})$

13: $\min_{{\bm{W}}_{C}^{i},{\bm{W}}_{S}}(loss+\lambda score)$

14: end for

15: end for

16: end for

17: end function

Algorithm 1 shows the detailed process of attacker-aware training applied on a
SFL scheme. $N$ clients compute in parallel (line 7), and client-side model
synchronization (line 4) is done at the beginning of each epoch. We adopt the
same strategy as in [4] to solve the Min-Max optimization problem. Each client
$i$ undergoes two training steps in each epoch $t$ (corresponding to line 11
and line 13). The first training step (line 11) adapts the inversion model
$D^{i}$ by maximizing the score $\mathbb{R}$ by keeping $C^{i}$ fixed. The
second training step (line 13) is the standard training process, where
$W_{C}^{i}$ and $W_{S}$ are updated to minimize the cross-entropy loss. Here,
we add the inversion model’s score as a regularization term. We limit the
regularization effect to $W_{C}^{i}$ by keeping $D^{i}$ fixed, similar to [4],
which fixes the discriminator when training the generator. The strength of the
regularization is controlled by $\lambda$.

Addition of Bottleneck Layers: The accuracy and resistance performance of the
attacker-aware training outlined above is not as good, as shown later in
Figure 4. The large feature space of the intermediate activation makes it more
vulnerable to MI attack. In fact, it has been shown in [14] that attacking
intermediate activation rather than confidence score, can result in better MI
attack performance.

So our approach is to reduce the dimension of intermediate activations through
the use of bottleneck layers introduced in [2]. We implement bottleneck layers
using a pair of Conv2D layers $l_{in}$ and $l_{out}$. $l_{in}$ has input
channel size same as original channel size of the intermediate activation, and
output channel size of $C$, while $l_{out}$ has input channel size of $C$ and
output channel size same as the input channel size of $l_{in}$. Both layers
have kernel size of 3. For simplicity, we use $Cx$-$Sy$ to denote bottleneck
layers with channel size of $x$ and stride of $y$.

While use of bottleneck layer in mitigating MI attack is new, use of only
bottleneck layers does not improve performance, as much as will be shown later
in Table 4. However a combination of attacker-aware training and bottleneck
layers gives us way better performance in terms of both resistance and
accuracy. Thus, we present attacker-aware training with bottleneck layers as
the method on which to build up model resistance.

###  4.2 Attacker-aware fine-tuning

Typically in transfer learning, a complex task is transferred to simple tasks
and so domain transfer can be done by freezing the client-side model and fine-
tuning the server-side model. However, freezing the client-side model can
cause significant accuracy drop. Another option is to allow a small learning
rate, which leads to a compromised resistance performance. To balance accuracy
and resistance, we allow the initial model to be tunable and propose a cheaper
version of attacker-aware training with low learning rate called attacker-
aware fine-tuning, to preserve the resistance. We only allow a low learning
rate of 0.005 (compared to a learning rate of 0.02 for rest of the model) on
the client-side model and apply the attacker-aware training using the least
complex L0 inversion model. Also, we reduce the frequency of inversion model
training (line 11 in Algorithm 1) to once every 5 training steps ($f=5$) to
reduce the overhead of training inversion model at the client-side.

##  5 Experiments

Settings. To simulate a multi-client SFL, we randomly partition the training
dataset evenly to create training datasets (private data) for each client. The
server uses validation dataset to validate the model as well as perform the MI
attack. We use Stochastic Gradient Descent (SGD) for client-side model and
server-side model, and set learning rate to 0.05 with proper learning rate
decay. We use Adam optimizer[10] with learning rate of 0.001 for training both
the inversion model in performing MI attack as well as in attacker-aware
training. Each model is trained for 200 epochs. Our scheme has two
hyperparameters: inversion score strength parameter $\lambda$ for attacker-
aware training and $Cx$-$Sy$ for the bottleneck layers. We refer to baseline
methods as those that apply attacker-aware training from scratch in SFL,
instead of the two-step ResSFL method. We fix the model architecture to VGG-11
and cut-layer setting to 2 in this section.

###  5.1 Build MI-resistant Model (Pre-training)

Figure 3: Baseline attacker-aware training methods with L0 (weak) and L3
(strong) inversion models without adding bottleneck layers, on VGG-11 with
cut-layer of 2 on CIFAR-100 datasets.

Inversion Model Complexity. Figure 3 shows that using a weak inversion model
in baseline attacker-aware training (without bottlneck layers) suffers from
low resistance (low MSE). We found that the inversion score of the weak
inversion model is stuck at a very low value implying a bad reconstruction
which translates to poor inversion ability. In contrast, using a strong
inversion model (L3) closely simulates the attacker and provides high MI
resistance for a large $\lambda$. As shown in Figure 3, the resistance
improves significantly for inversion model L3 when $\lambda=1.2$ but with
significant drop in accuracy.

Adding Bottleneck Layers. For the pre-training step, we apply the proposed
attacker-aware training together with bottleneck layers, and train a VGG-11
model with cut-layer of 2. We vary the bottleneck setting and regularization
strength $\lambda$ in equation 3 and show corresponding results in Figure 4.
Clearly, bottleneck settings ($C12$-$S1$ and $C8$-$S1$) achieves much better
resistance than without Bottleneck (None). On CIFAR-10 & CIFAR-100, attacker-
aware training with a narrow bottleneck setting of $C8$-$S1$ can increase the
MSE to above 0.02 while still maintaining over 90% accuracy.

(a) CIFAR-10

(b) CIFAR-100

Figure 4: Attacker-aware training applied on VGG-11 with cut-layer of 2 for
CIFAR-10/CIFAR-100 datasets. $Cx-Sy$ stands for channel size $x$ and stride of
$y$.

###  5.2 Transfer MI resistance (SFL training)

Different Transfer Strategies. We transfer the pre-trained resistant model
from two source tasks CIFAR-10 and CIFAR-100 to different target tasks
CIFAR-100/CIFAR-10[11], Facescrub[16], SVHN[15] and MNIST[12] on a 2-client
SFL scheme. For FaceScrub and MNIST, we scale the original image to 32x32x3 so
that it can be fed into the same client-side model that was pre-trained on
CIFAR-10/CIFAR-100. The performance of resistance transfer is shown in Table
3. The proposed attacker-aware fine-tuning achieves a good balance between
accuracy and resistance compared to simple strategies such as freeze and
simple fine-tuning with small learning rate (set at 0.005). For instance, on
CIFAR-100, compared to simple fine-tuning, our proposed attacker-aware fine-
tuning achieves only 0.4% lower accuracy with 0.028 higher MSE. And on SVHN,
our proposed method achieves almost no drop in accuracy with only 0.004 lower
MSE than freeze.

Transfer Performance to Different Datasets. The resistance transfer
performance is excellent when transferring from CIFAR-10 to CIFAR-100. For
example, CIFAR10 to CIFAR-100 transfer achieves a very high MSE of 0.050 with
only 1% accuracy drop. This is because CIFAR-10 is more difficult to achieve
resistance while CIFAR-100 is easier as shown in Figure 4. So a model being
resistant on CIFAR-10 should still be resistant on CIFAR-100. Same for the
SVHN dataset, where we successfully reach MSE of 0.045 with almost no accuracy
drop. However, resistance transfer fails when transferring a simple task to a
hard task. For example in CIFAR-100 to CIFAR-10, the MSE is very low at 0.006
on CIFAR-10 even if we only freeze the client-side model. It also shows that
the resistance performance weakens when transferring from a source dataset
with multiple input channel to a target dataset with a single input channel
(i.e. MNIST). We plan to investigate this in the near future.

Generalization to Multiple Clients. We generalize the experiments from 2
clients to more client cases. As shown in Table 2, when the number of clients
increase to 20, the proposed scheme achieves similar resistance performance
with slight drop in accuracy. Using a client sampling technique, we can extend
to 100 clients.

Table 2: Resistance transfer results for multiple clients from CIFAR-10 to
SVHN and CIFAR-100 dataset of VGG-cut2 model.

N | SVHN | CIFAR-100
---|---|---
Accu | MSE | Accu | MSE
2 | 96.0 | 0.045 | 67.5 | 0.050
5 | 95.8 | 0.041 | 66.9 | 0.050
10 | 95.5 | 0.041 | 66.6 | 0.050
20 | 95.5 | 0.041 | 66.6 | 0.048
100a | 95.4 | 0.040 | 65.8 | 0.046

a with a sampling rate of 10% per round.

Table 3: Transfer resistance of pre-trained VGG-11 model with cut-layer of 2
on a two-client SFL scheme. Results of fine-tuning client-side model with
lite-version attacker-aware training are shown in the last three columns.

Source Task | Target Task |  Baseline Accuracy | Freeze |  Simple Fine-tuning |  Attacker-aware Fine-tuning
---|---|---|---|---|---
Accu | MSE | Accu | MSE | Accu | MSE
CIFAR-10 | SVHN | 96.1 | 92.2 | 0.049 | 95.9 | 0.037 | 96.0 | 0.045
CIFAR-10 | CIFAR-100 | 68.5 | 62.4 | 0.077 | 67.9 | 0.022 | 67.5 | 0.050
CIFAR-10 | FaceScrub | 82.2 | 63.5 | 0.021 | 68.1 | 0.015 | 65.2 | 0.021
CIFAR-10 | MNIST | 99.6 | 99.6 | 0.003 | 99.6 | 0.002 | 99.4 | 0.003
CIFAR-100 | SVHN | 96.1 | 93.6 | 0.050 | 96.0 | 0.023 | 95.8 | 0.039
CIFAR-100 | FaceScrub | 82.2 | 65.0 | 0.019 | 69.1 | 0.015 | 67.8 | 0.021
CIFAR-100 | CIFAR-10 | 91.9 | 89.5 | 0.006 | 91.5 | 0.004 | 90.8 | 0.005
CIFAR-100 | MNIST | 99.6 | 99.6 | 0.003 | 99.6 | 0.002 | 99.4 | 0.003

###  5.3 Training-time Resistance Performance

To showcase how our framework based on resistance transfer addresses the
training-time MI attack, we perform the MI attack at different epochs during
SFL training. We use the VGG-cut2 model as the representative model for our
ResSFL framework. For comparison, we use two versions of the baseline method
with $\lambda=0.3$ with and without $C8$-$S1$ bottleneck layers. Figure 5
shows the performance of the baseline method and the ResSFL on MI attack at
different epochs (t = 1, 5, …, 200). ResSFL framework has a steady MI
resistance during the training-time, and is consistently better than the
target resistance of 0.02 MSE (the red dashed line).

Figure 5: Resistance performance of ResSFL and two baseline methods (with and
without bottleneck layers) against training-time MI attack as a function of
epoch number.

###  5.4 Evaluation of Existing Methods

Table 4: Comparison with previous defenses against MI attack on VGG-11 with
cut-layer of 2 in a two-client SFL scheme, on CIFAR-100 dataset with original
accuracy of 68.5% (w.o. any defense). All previous methods fail to get a value
over 0.02 MSE while keeping the accuracy drop to be less than 5%. In contrast,
our proposed ResSFL achieves 0.050 MSE with only 1% accuracy drop.

| Accuracy |  MSE (L0) |  MSE (Best) |  | Accuracy |  MSE (L0) |  MSE (Best)
---|---|---|---|---|---|---|---
Laplacian[20] | $b=0.05$ | 65.4 | 0.009 | 0.006 | AdvNoise[24] | $\epsilon=0.05$ | 65.8 | 0.012 | 0.007
$b=0.08$ | 62.2 | 0.012 | 0.008 | $\epsilon=0.08$ | 64.6 | 0.026 | 0.012
$b=0.10$ | 58.4 | 0.016 | 0.011 | $\epsilon=0.10$ | 62.0 | 0.037 | 0.018
Dropout[9] | $p=0.15$ | 64.2 | 0.010 | 0.006 | DistCorr[22] | $\alpha=1.0$ | 63.6 | 0.014 | 0.009
$p=0.20$ | 61.6 | 0.011 | 0.007 | $\alpha=1.5$ | 63.2 | 0.036 | 0.014
$p=0.25$ | 57.8 | 0.012 | 0.009 | $\alpha=2.0$ | 62.1 | 0.051 | 0.019
TopkPrune[26] | $k=50$ | 65.4 | 0.007 | 0.004 |  Bottleneck Layers[2] |  $c16$-$s1$ | 64.4 | 0.008 | 0.008
$k=60$ | 61.1 | 0.007 | 0.004 |  $c8$-$s1$ | 63.4 | 0.020 | 0.013
$k=70$ | 50.4 | 0.008 | 0.005 |  $c4$-$s1$ | 58.0 | 0.032 | 0.020
ResSFL |  $\lambda$0.3-$c8$-$s1$ | 67.5 | 0.072 | 0.050 |  |  |  |  |

Existing methods on protecting MI on SFL target protection of intermediate
activations using perturbation-based methods and regularization-based methods.
Perturbation-based methods include Laplacian noise [20], dropout [9], topk-
prune described in [26] and adversarial noise [24]. The method in [20] adds
noise to the intermediate activation, where the noise follows a Laplacian
distribution parameterized by scale $b$ (location parameter $\mu$ is kept at
0). [9] uses a mask (each element takes 0 with probability $p$ otherwise 1)
and multiplies it element-wise with the intermediate activation. Topk-prune
preserves top $k$ percent elements while setting others to zero. [24] crafts
adversarial noise using FGSM[5] on a surrogate inversion model (we use L3
inversion model) and adds it to the intermediate activation, we use the
$\epsilon$ to scale the gradient’s sign. Another line of works apply
regularization-based method to build model’s intrinsic resistance, similar to
our proposed attacker-aware training. Works based on information correlation
such as [23] and [22] use mutual information and distance correlation to
regularize the training. However, [23] is not suitable for SFL as it requires
a lot of local computation and so we only include [22] in Table 4.

We vary hyper-parameter settings for each method and keep accuracy in a
reasonable range. Except for perturbation-based methods that directly apply on
a trained model, we retrain the model and test the MI resistance during
inference. As shown in Table 4, all previous defensive methods cannot achieve
more than 0.02 MSE using both L0 and the best inversion model in MI attacks
with accuracy drop of less than 5%. Distance correlation method performs well
against simple L0 inversion model, but fails badly under a strong MI attack
using the best inversion model.

Table 5: Transfer resistance of pre-trained models with different
architectures on a two-client SFL scheme, from source task CIFAR-10 to target
task CIFAR-100. We include FLOPs (measured by feeding a single image), and two
popular image quality metrics SSIM and Peak Signal-to-Noise Ratio (PSNR)
(using the best inversion model); higher means better image quality.

Topology |  ResSFL Setting | FLOPs |  Original Accuracy |  ResSFL Accuracy | MSE | SSIM | PSNR
---|---|---|---|---|---|---|---
VGG-cut1 |  $\lambda$0.5-$c1$-$s1$ | 2.1M | 68.5 | 52.3 | 0.041 | 0.553 | 14.4
VGG-cut2 |  $\lambda$0.3-$c8$-$s1$ | 21.5M | 68.5 | 67.5 | 0.050 | 0.547 | 14.2
VGG-cut3 |  $\lambda$0.3-$c12$-$s1$ | 41.6M | 68.5 | 67.8 | 0.038 | 0.539 | 15.3
Res-cut2 |  $\lambda$2.0-$c1$-$s2$ | 5.3M | 67.8 | 55.2 | 0.052 | 0.554 | 13.6
Res-cut3 |  $\lambda$0.3-$c1$-$s1$ | 10.2M | 67.8 | 62.0 | 0.048 | 0.556 | 13.9
Res-cut4 |  $\lambda$0.5-$c2$-$s1$ | 15.1M | 67.8 | 65.6 | 0.043 | 0.719 | 15.6
Mob-cut2 |  $\lambda$0.5-$c1$-$s1$ | 3.7M | 71.4 | 67.3 | 0.020 | 0.787 | 17.6
Mob-cut3 |  $\lambda$0.5-$c2$-$s1$ | 18.7M | 71.4 | 70.9 | 0.037 | 0.717 | 15.6
Mob-cut4 |  $\lambda$0.3-$c4$-$s1$ | 31.6M | 71.4 | 70.8 | 0.062 | 0.538 | 13.3

###  5.5 Cost Analysis

The number of parameters and floating point operations (FLOPs) of different
schemes are listed in Table 6. The computation overhead of inversion model
training depends on its complexity and updating frequency. Using the proposed
attacker-aware fine-tuning, ResSFL has much less computation overhead with 27%
FLOPs and 20% parameters compared to the the original SFL scheme, and use
0.01% parameters and 0.17% FLOPs compared to the popular FL scheme [13].

Table 6: Cost analysis of competing schemes on VGG-11 with cut-layer 2 on
CIFAR-100.

Scheme |  Parameters |  FLOPs |  Resistance
---|---|---|---
FL | 9.8M | (1.00x) | 153.7M | (1.00x) | High
SFL | 76.0K | (0.01x) | 20.9M | (0.14x) | Low
ResSFL | 91.5K | (0.01x) | 26.5M | (0.17x) | High

##  6 Ablation Study

Choice of Topology. We extend the ResSFL framework to other topologies (with
different architecture and different cut-layer settings). The second column in
Table 5 presents the settings on VGG-11 architecture with cut-layer of 1 and
2, ResNet-20 architecture with cut-layer of 2, 3 and 4, and MobileNet-V2
architecture with cut-layer of 2, 3, and 4 are presented. We act as the expert
and tune the channel size/stride size of bottleneck and inversion score
strength $\lambda$, to train client-side models towards the resistance target
of 0.02 MSE on CIFAR-10 dataset. For example, for ResNet20 architecture with
cut-layer of 3, the target resistance is achieved with $C1$-$S1$ bottleneck
and $\lambda$=0.3. The right three columns in Table 5 show the resistance
achieved on CIFAR-100 dataset using resistance transfer for different
topologies. We notice that for the same architecture, increasing the cut-layer
gets a better accuracy, and better resistance most of the time. Across
architecture choices, the MobileNet-V2 performs typically well. Applying
ResSFL on MobilNet-V2 with cut-layer of 2 helps achieve a very good accuracy
as well as a super high MSE with very small number of FLOPs. VGG-11
architecture can also achieve a very good resistance with only 1% accuracy
drop. Thus, different topologies have different computation complexities,
accuracy and resistance tradeoffs, and the topology design space needs further
investigation.

##  7 Conclusion

We present ResSFL, a two-step SFL framework that consists of an attacker-aware
training that achieves high MI resistance by an expert and then transferring
the resistance to the clients to improve their MI resistance during SFL
training. We show that a combination of attacker-aware training with a complex
inversion model and addition of bottleneck layers to the model helps the
expert build up strong MI resistance. Transferring this resistance to the
clients not only reduces the computational demands at the client-end but also
addresses the vulnerability due to attacks in earlier training epochs. We show
using the attacker-aware fine-tuning can achieve better balance between
accuracy and resistance. We also show that the framework can support multiple
clients and can be generalized to different architecture-cut-layer
configurations. Finally, we show that ResSFL applied to VGG11 model on
CIFAR-100 dataset achieves 0.050 MSE compared to 0.005 MSE obtained by the
baseline scheme with only 1% accuracy drop; the corresponding reconstructed
faces are very noisy, as shown in Figure 6, and demonstrate the power of the
proposed ResSFL scheme.

Figure 6: Visualization of MI attack reconstructed images. Model architecture
is VGG-11 with cut-layer of 2.

## References

  * [1] Alexey Dosovitskiy and Thomas Brox.  Inverting visual representations with convolutional networks.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 4829–4837, 2016.
  * [2] Amir Erfan Eshratifar, Amirhossein Esmaili, and Massoud Pedram.  Bottlenet: A deep learning architecture for intelligent mobile cloud computing services.  In 2019 IEEE/ACM International Symposium on Low Power Electronics and Design (ISLPED), pages 1–6. IEEE, 2019.
  * [3] Matt Fredrikson, Somesh Jha, and Thomas Ristenpart.  Model inversion attacks that exploit confidence information and basic countermeasures.  In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pages 1322–1333, 2015.
  * [4] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial nets.  In Advances in Neural Information Processing Systems, pages 2672–2680, 2014.
  * [5] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  arXiv preprint arXiv:1412.6572, 2014.
  * [6] Otkrist Gupta and Ramesh Raskar.  Distributed learning of deep neural network over multiple agents.  Journal of Network and Computer Applications, 116:1–8, 2018.
  * [7] Chaoyang He, Murali Annavaram, and Salman Avestimehr.  Group knowledge transfer: Federated learning of large CNNs at the edge.  Advances in Neural Information Processing Systems, 33:14068–14080, 2020.
  * [8] Zhezhi He, Adnan Siraj Rakin, and Deliang Fan.  Parametric noise injection: Trainable randomness to improve deep neural network robustness against adversarial attack.  In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 588–597, 2019.
  * [9] Zecheng He, Tianwei Zhang, and Ruby B Lee.  Attacking and protecting data privacy in edge–cloud collaborative inference systems.  IEEE Internet of Things Journal, 8(12):9706–9716, 2020.
  * [10] Diederik P Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  arXiv preprint arXiv:1412.6980, 2014.
  * [11] Alex Krizhevsky, Geoffrey Hinton, et al.  Learning multiple layers of features from tiny images.  2009\.
  * [12] Yann LeCun.  The MNIST database of handwritten digits.  http://yann. lecun. com/exdb/mnist/, 1998.
  * [13] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas.  Communication-efficient learning of deep networks from decentralized data.  In Artificial Intelligence and Statistics, pages 1273–1282. PMLR, 2017.
  * [14] Kanghua Mo, Teng Huang, and Xiaoyu Xiang.  Querying little is enough: Model inversion attack via latent information.  In International Conference on Machine Learning for Cyber Security, pages 583–591. Springer, 2020.
  * [15] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng.  Reading digits in natural images with unsupervised feature learning.  2011\.
  * [16] Hong-Wei Ng and Stefan Winkler.  A data-driven approach to cleaning large face datasets.  In 2014 IEEE international conference on image processing (ICIP), pages 343–347. IEEE, 2014.
  * [17] Dario Pasquini, Giuseppe Ateniese, and Massimo Bernaschi.  Unleashing the tiger: Inference attacks on split learning.  In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 2113–2129, 2021.
  * [18] AJ Paverd, Andrew Martin, and Ian Brown.  Modelling and automatically analysing privacy properties for honest-but-curious adversaries.  Tech. Rep, 2014.
  * [19] Chandra Thapa, Mahawaga Arachchige Pathum Chamikara, Seyit Camtepe, and Lichao Sun.  Splitfed: When federated learning meets split learning.  arXiv preprint arXiv:2004.12088, 2020.
  * [20] Tom Titcombe, Adam J Hall, Pavlos Papadopoulos, and Daniele Romanini.  Practical defences against model inversion attacks for split neural networks.  arXiv preprint arXiv:2104.05743, 2021.
  * [21] Praneeth Vepakomma, Otkrist Gupta, Abhimanyu Dubey, and Ramesh Raskar.  Reducing leakage in distributed deep learning for sensitive health data.  arXiv preprint arXiv:1812.00564, 2019.
  * [22] Praneeth Vepakomma, Abhishek Singh, Otkrist Gupta, and Ramesh Raskar.  Nopeek: Information leakage reduction to share activations in distributed deep learning.  In 2020 International Conference on Data Mining Workshops (ICDMW), pages 933–942. IEEE, 2020.
  * [23] Tianhao Wang, Yuheng Zhang, and Ruoxi Jia.  Improving robustness to model inversion attacks via mutual information regularization.  In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 11666–11673, 2021.
  * [24] Jing Wen, Siu-Ming Yiu, and Lucas CK Hui.  Defending against model inversion attack by adversarial examples.  In 2021 IEEE International Conference on Cyber Security and Resilience (CSR), pages 551–556. IEEE, 2021.
  * [25] Ziqi Yang, Bin Shao, Bohan Xuan, Ee-Chien Chang, and Fan Zhang.  Defending model inversion and membership inference attacks via prediction purification.  arXiv preprint arXiv:2005.03915, 2020.
  * [26] Ziqi Yang, Jiyi Zhang, Ee-Chien Chang, and Zhenkai Liang.  Neural network inversion in adversarial setting via background knowledge alignment.  In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 225–240, 2019.
  * [27] Hang Zhao, Orazio Gallo, Iuri Frosio, and Jan Kautz.  Loss functions for image restoration with neural networks.  IEEE Transactions on computational imaging, 3(1):47–57, 2016.