MS-PAFL: Privacy-Amplified Federated Learning

• The paper demonstrates how dividing client models into private and public submodels with calibrated noise injection enhances privacy without degrading accuracy.
• It shows that combining structural model splitting with random client participation and data subsampling leads to robust statistical privacy amplification.
• Empirical evaluations on datasets like Adult, MNIST, and CIFAR-10 confirm that MS-PAFL achieves a superior privacy–utility trade-off compared to traditional DP-FL methods.

Searching arXiv for the cited MS-PAFL and closely related model-splitting federated learning papers to ground the article in current literature. Model-Splitting Privacy-Amplified Federated Learning (MS-PAFL) denotes a federated learning framework that combines structural model splitting with statistical privacy amplification. In the formulation that explicitly introduces the term, each client’s model is partitioned into a private submodel, retained locally, and a public submodel, shared for global aggregation; calibrated Gaussian noise is injected only into the public submodel, and the privacy analysis characterizes the joint privacy amplification achieved through random client participation and local data subsampling (Li et al., 30 Sep 2025). Closely related work uses hybrid federated-split architectures, visible and invisible submodels, dynamic quantization, or probabilistic masking. These systems can be read as model-splitting privacy-preserving or privacy-amplified variants, but they do not all adopt the same privacy definition, threat model, or communication pattern (Zhang et al., 2023, Wang et al., 2024, Wang et al., 18 Sep 2025).

1. Terminology, scope, and conceptual lineage

The exact term MS-PAFL appears in “Federated Learning with Enhanced Privacy via Model Splitting and Random Client Participation” (Li et al., 30 Sep 2025). There, the standard FL goal is

$$\min_{\mathbf w\in\mathbb R^d}\ \frac{1}{N}\sum_{i=1}^N F_i(\mathbf w),$$

and the core proposal is to combine Statistical privacy amplification—random client participation and local data subsampling—with Structural privacy protection—splitting the model into a private submodel and a public submodel, and adding DP noise only to the public part (Li et al., 30 Sep 2025).

Earlier and adjacent literature uses different names for closely aligned ideas. “Privacy and Efficiency of Communications in Federated Split Learning” does not use the term MS-PAFL explicitly; the closest matching concept is Federated Split Learning (FSL) plus its Privacy-Aware FSL / Client-Based Privacy Approach (CPA) extensions. Conceptually, that combination is aligned with “Model-Splitting Privacy-Amplified Federated Learning” because it is a hybrid federated-split architecture that splits the model, federates only the server-side portion across pairs via aggregation, and optionally amplifies privacy by perturbing or reshaping the intermediate activations that would otherwise leak information (Zhang et al., 2023).

“A Novel Privacy Enhancement Scheme with Dynamic Quantization for Federated Learning” proposes MSP-FL and MSPDQ-FL. Its main privacy mechanism is not additive noise. Instead, each client splits its local model into visible and invisible submodels, and only the visible submodel is communicated. Privacy comes from hiding the splitting structure and the invisible parts; the extension with Dynamic Quantization is designed to mitigate the communication overhead (Wang et al., 2024). “Towards Privacy-Preserving and Heterogeneity-aware Split Federated Learning via Probabilistic Masking” presents PM-SFL, which can be read as a concrete realization of a model-splitting privacy-amplified federated learning idea in a split-learning setting: it combines client/server partitioning with Probabilistic Mask training and personalized mask learning (Wang et al., 18 Sep 2025).

A common misconception is that all model-splitting methods instantiate the same privacy primitive. The literature is more heterogeneous. MS-PAFL, in the strict sense, is a DP-FL framework with client sampling and data subsampling amplification (Li et al., 30 Sep 2025). FSL + CPA emphasizes reduced exposure of raw inputs and weaker reconstructability of smashed data (Zhang et al., 2023). MSP-FL uses a diameter-based identifiability metric rather than differential privacy (Wang et al., 2024). PM-SFL frames privacy amplification through stochastic masking and reconstruction difficulty in split learning (Wang et al., 18 Sep 2025).

2. Architectural patterns and communication workflows

In the explicit MS-PAFL architecture, each client model at round $t$ is split as

$$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$

where $\mathbf w_{i,\alpha}^t$ is the private submodel, $\mathbf w_{i,p}^t$ is the public submodel, and $d_\alpha+d_p=d$. The split sizes are assumed fixed and known; in the reported experiments the split is even, $d_\alpha=d_p=0.5d$ (Li et al., 30 Sep 2025). The Private submodel is retained locally and never transmitted. The Public submodel is clipped, noised, transmitted to the parameter server, and aggregated globally (Li et al., 30 Sep 2025).

The round-level workflow is explicit. Each client independently decides whether to participate using a Bernoulli variable $\zeta_i^t$ with participation probability $p_i^t$; the PS does not control or know the hidden participation probabilities. A participating client performs $Q$ local SGD steps on minibatches of size $t$0, splits the updated model, clips the public submodel to norm $t$1,

$t$2

adds Gaussian noise only to the public part,

$t$3

and uploads only the noisy public submodel. The PS averages the noisy public submodels using the correction factor

$t$4

after which each client recombines the downloaded global public part with its retained private submodel (Li et al., 30 Sep 2025).

Related split architectures realize model splitting at different interfaces. In FSL, the full neural network is partitioned into a client NN, an edge server NN, and a parameter server that aggregates only the server NN weights across pairs. The paper uses a Cut Index to denote the layer at which the split occurs: the larger the Cut Index, the deeper the client model and the shallower the server model. For each client–server pair, the client computes activations up to the cut layer, sends the intermediate activations to the edge server, the edge server completes the forward pass and backward pass, and the gradient of the split activation is sent back so the client can finish backpropagation. After some epochs, the parameter server averages the weights of the edge-server partitions, not the entire model (Zhang et al., 2023).

MSP-FL and MSPDQ-FL instead split the local model into one visible submodel and $t$5 invisible submodels. Only the visible submodel is sent to the server; invisible submodels remain local/private. PM-SFL retains the split-learning communication pattern—client-side execution up to a cut, transmission of smashed representations, and gradient return—but parameterizes the local model by a masked weight tensor such as

$t$6

so that the client-side subnetwork itself is stochastically thinned by masks (Wang et al., 2024, Wang et al., 18 Sep 2025).

3. Privacy mechanisms and threat models

The principal motivation for MS-PAFL is the privacy–utility trade-off in DP-FL. Standard DP-FL adds Gaussian noise to the entire transmitted model or update vector. This protects privacy but corrupts all parameters uniformly, including those most important for accuracy. MS-PAFL localizes the perturbation: only the shared/public part is perturbed, while the private submodel remains intact and can preserve client-specific, accuracy-critical information. For the same privacy target, the expected degradation in model quality is therefore smaller because the noised portion is smaller and the unshared private component is not corrupted by DP noise (Li et al., 30 Sep 2025).

The privacy amplification mechanisms in MS-PAFL are statistical. The paper combines random client participation and local data subsampling. If each client’s local public update satisfies $t$7-LDP, then applying the mechanism to a subsampled subset of size $t$8 yields amplified privacy. For $t$9, the subsampled mechanism is $$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$0-LDP, where

$$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$1

The paper states that if $$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$2, privacy is amplified, and that WR gives slightly smaller effective $$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$3 than WOR (Li et al., 30 Sep 2025).

Split-based variants foreground a different leakage surface. FSL and SL reduce exposure of the source data because raw inputs do not leave the client, but the paper stresses that split learning still exposes intermediate activations (“smashed data”), and that intermediate data can leak sensitive information because it is derived from the source data. The authors explicitly discuss attacks that reconstruct inputs from these activations. Their Client-based Privacy Approach (CPA) aims to reduce leakage from intermediate activations by making them less informative. CPA-DC is based on Distance Correlation (DC), inspired by NoPeek, and alternates between standard task loss and a privacy loss

$$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$4

that pushes the client representation away from the source input. CPA-DP uses DP-SGD on the client side, adding Gaussian noise to gradients during backpropagation (Zhang et al., 2023).

MSP-FL uses a different privacy primitive. It does not use differential privacy as its primary formal privacy guarantee. Instead, it defines a feasible model set from the adversary-observed information and measures privacy by a diameter-based identifiability metric. Local model privacy of client $$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$5 is insensitive to adversaries if the corresponding diameter is infinite, meaning infinitely many possible local models are consistent with what the adversary sees (Wang et al., 2024).

PM-SFL replaces additive noise with probabilistic masking. It learns a score vector $$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$6, converts it to mask probabilities through a sigmoid, and samples masks via Bernoulli variables: $$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$7 The paper analyzes the masking distribution as a privacy-amplifying randomized mechanism and derives an amplified privacy parameter

$$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$8

Its threat model is a gradient/activation reconstruction threat model in split learning, where the server may observe smashed data, returned gradients, and potentially gradients with respect to mask parameters. The appendix shows that if the server can observe $$\mathbf w_i^t = (\mathbf w_{i,\alpha}^t,\mathbf w_{i,p}^t),$$9 for all layers, then it can iteratively solve for intermediate activations and ultimately recover the raw input; masking is introduced to block this leakage route (Wang et al., 18 Sep 2025).

4. Formal guarantees, optimization objectives, and privacy accounting

MS-PAFL adopts both local DP (LDP) and central DP (CDP). It cites the standard Gaussian mechanism theorem

$\mathbf w_{i,\alpha}^t$0

where $\mathbf w_{i,\alpha}^t$1 is the $\mathbf w_{i,\alpha}^t$2-sensitivity. For MS-PAFL, the sensitivity of the clipped public submodel is bounded by $\mathbf w_{i,\alpha}^t$3, so the noise variance is set from the clipped public update norm, not the full model (Li et al., 30 Sep 2025).

The paper’s core theorem gives a single-round privacy guarantee for the aggregated global public model. If each client’s local public update satisfies $\mathbf w_{i,\alpha}^t$4-LDP, with participation probability $\mathbf w_{i,\alpha}^t$5 and data subsampling ratio $\mathbf w_{i,\alpha}^t$6, then the aggregated global public model in round $\mathbf w_{i,\alpha}^t$7 satisfies $\mathbf w_{i,\alpha}^t$8-CDP: $\mathbf w_{i,\alpha}^t$9

$\mathbf w_{i,p}^t$0

In the uniform case, the bound simplifies accordingly, and under the small-$\mathbf w_{i,p}^t$1 approximation the paper states the scaling

$\mathbf w_{i,p}^t$2

For multiple rounds, the paper derives total privacy for local clients using the moments accountant and for the global model using strong composition; the stated interpretation is that local total privacy loss depends on $\mathbf w_{i,p}^t$3, $\mathbf w_{i,p}^t$4, and $\mathbf w_{i,p}^t$5, and that growth in $\mathbf w_{i,p}^t$6 is $\mathbf w_{i,p}^t$7, not linear (Li et al., 30 Sep 2025).

The hybrid FSL literature formulates a different multi-objective problem. The split point can be optimized via

$\mathbf w_{i,p}^t$8

where $\mathbf w_{i,p}^t$9 is the client NN depth or cut position, $d_\alpha+d_p=d$0 is transmission delay of intermediate activations given bandwidth $d_\alpha+d_p=d$1, and $d_\alpha+d_p=d$2 is computation delay. A more complete formulation is

$d_\alpha+d_p=d$3

where $d_\alpha+d_p=d$4 is accuracy and $d_\alpha+d_p=d$5 is attack resilience. The same paper defines the attack resilience metric

$d_\alpha+d_p=d$6

so that higher $d_\alpha+d_p=d$7 means harder reconstruction (Zhang et al., 2023).

MSP-FL and MSPDQ-FL provide convergence analysis under strong convexity, smoothness, bounded stochastic gradient variance, and bounded gradient norms. For MSP-FL, the reported rate is $d_\alpha+d_p=d$8. For MSPDQ-FL, the quantization adds an extra error term

$d_\alpha+d_p=d$9

but the paper states that the scheme still converges at $d_\alpha=d_p=0.5d$0 because the shrinking interval causes quantization error to vanish asymptotically (Wang et al., 2024).

5. Empirical behavior and benchmarked trade-offs

The explicit MS-PAFL experiments use logistic regression on the Adult dataset with 32,561 training samples, 14 normalized features, $d_\alpha=d_p=0.5d$1 clients, and non-IID label partitioning. The reported metrics are testing accuracy, single-round central privacy loss $d_\alpha=d_p=0.5d$2, cumulative global privacy loss $d_\alpha=d_p=0.5d$3, and cumulative local privacy loss $d_\alpha=d_p=0.5d$4; the baseline is DP-FedAvg without model splitting or privacy amplification. The main findings are that higher $d_\alpha=d_p=0.5d$5 improves testing accuracy, lower $d_\alpha=d_p=0.5d$6 gives stronger privacy amplification but slower convergence, smaller $d_\alpha=d_p=0.5d$7 yields lower central privacy loss, and MS-PAFL consistently outperforms DP-FedAvg in privacy–utility trade-off (Li et al., 30 Sep 2025).

The FSL evaluation is broader in task coverage. It studies VGG-16 + CIFAR-10, LeNet + MNIST, and 1D CNN + ISCX VPN/non-VPN traffic classification, implemented in PyTorch using PySyft/PyGrid, with communication emulated on localhost and no encryption on transmissions. The paper reports that FSL consistently uses less time per training epoch than PSL and FRC in the MNIST and traffic tasks; PSL is usually slowest because the single server becomes a bottleneck; FRC has almost double the total forward/backward time compared with FL in their experiments; and for CIFAR-10/VGG16, FL can sometimes be faster when most layers are on the client because the intermediate activations become large and transmission dominates. It also reports that FSL clients use less memory than FL/FRC clients, and FSL servers use less memory than PSL servers. For privacy inference attacks, the paper reports NoPeek attack resilience of $d_\alpha=d_p=0.5d$8 for PSL and $d_\alpha=d_p=0.5d$9 for FSL on MNIST, and states that increasing cut depth generally improves resilience (Zhang et al., 2023).

MSP-FL and MSPDQ-FL are evaluated on MNIST and CIFAR-10 using CNNs with non-i.i.d. partitioning and partial participation. Against FedAvg, FedAvg + LDP, and JoPEQ, the paper reports that MSP-FL performs nearly as well as vanilla FedAvg, MSPDQ-FL also performs better than FedAvg+LDP and JoPEQ, and that under iDLG-based model inversion attacks MSP-FL and MSPDQ-FL increase reconstruction MSE compared with unprotected training, with MSPDQ-FL giving stronger protection than MSP-FL (Wang et al., 2024).

PM-SFL is reported to improve accuracy, communication efficiency, and robustness to privacy attacks, with particularly strong performance under data and system heterogeneity. The ablation discussion emphasizes that probabilistic masking outperforms plain noise injection in maintaining utility, and that personalized masks and adaptive splitting improve behavior under non-IID data and heterogeneous devices (Wang et al., 18 Sep 2025).

6. Limitations, distinctions, and open questions

Across the literature, model splitting does not eliminate the need to reason about what is still exposed. The FSL paper explicitly notes that privacy relies on architectural assumptions and attack-mitigation methods, not cryptographic protection, because communication is sent without encryption in the experiments. It also states that Partition selection is hard; the paper formulates this as an optimization problem but does not solve it generally. Additional caveats are that No universal best split exists, DP-SGD may destabilize SerAVG when noise is large, the evaluation uses mostly sequential CNNs like LeNet and VGG16, and bandwidth bottlenecks were largely removed by localhost emulation, so real-world wireless latency may be worse (Zhang et al., 2023).

In the explicit MS-PAFL framework, the principal trade-off is between stronger amplification and slower optimization. The paper states that smaller $\zeta_i^t$0 and $\zeta_i^t$1 strengthen privacy but reduce effective training data and may slow convergence. The best privacy–utility trade-off therefore comes from using all three ingredients together—client sampling, data subsampling, and noise only on public parameters—while still keeping participation probabilities and minibatch or subsampling ratios sufficient for convergence (Li et al., 30 Sep 2025).

MSP-FL and MSPDQ-FL differ in a more fundamental way: their privacy notion is diameter-based indistinguishability, not a formal DP guarantee. The privacy theorem requires that the number of invisible submodels $\zeta_i^t$2 is inaccessible to adversaries and that there exists at least one legitimate client that shares mutual trust with the protected client via the trusted authority. This suggests that privacy claims in model-splitting systems are not interchangeable even when the architectures look similar (Wang et al., 2024).

PM-SFL sharpens a further distinction. Its privacy mechanism is structured randomness without relying on explicit noise, but its appendix also shows a leakage route through gradients with respect to mask parameters if those quantities are visible to the server. This underscores a recurrent theme in split and split-federated learning: privacy protection depends not only on what is hidden structurally, but also on exactly which activations, gradients, logits, or mask variables are observable (Wang et al., 18 Sep 2025).

Taken together, the literature supports a narrow and a broad reading of MS-PAFL. In the narrow reading, MS-PAFL is the 2025 DP-FL framework with a private/public submodel split, random client participation, local data subsampling, and Gaussian noise applied only to the public submodel (Li et al., 30 Sep 2025). In the broader reading, it names a family of model-splitting federated or split-federated methods that amplify privacy through reduced exposure, stochastic masking, hidden decomposition, or selective perturbation of communicated components (Zhang et al., 2023, Wang et al., 2024, Wang et al., 18 Sep 2025). The literature does not identify a universal best split, privacy mechanism, or aggregation schedule; the operative design variables remain the split point, the exposed interface, the perturbation or masking rule, and the target balance among accuracy, communication cost, client burden, and attack resilience.