--- title: 'Trust and Split: Mechanisms & Implications' url: https://www.emergentmind.com/topics/trust-and-split type: topic --- # Trust and Split: Mechanisms & Implications “Trust and split” denotes a recurrent analytical pattern in which trust is organized through separation rather than treated as a single undifferentiated relation. In the cited literature, the relevant split may be a permanent division of social roles, a partition of epistemic state space, a separation between trust and distrust as constructs, a decomposition of trust evidence into heterogeneous channels, a client–server–client partition of a neural network, a division of signing authority across key shares, or a compartmentalization of safety-critical protocol logic. Taken together, these works suggest that trust is often governed by the boundaries introduced by the split itself: who may imitate whom, which distinctions a source is trusted to make, what intermediate representations another party may observe, and which subsystems must collectively validate an action. ## 1. Structured separation as a trust mechanism Across the surveyed work, trust is repeatedly formalized by restricting interaction across an interface rather than by assuming global confidence in another party. In the asymmetric multiplayer trust game, investors and trustees remain in fixed roles and imitate only within role populations, so the split preserves the meaning of trusting and reciprocating [2305.01413]. In belief revision, trust is represented by state partitions or pseudometrics that determine which distinctions a reporting agent is trusted to make [1405.0034]. In human–AI measurement, trust and distrust are treated as distinct constructs rather than opposite ends of a single continuum [2403.00582]. In split learning and split computing, raw data remain local while activations, gradients, or hidden states cross the cut layer, making the interface itself the locus of privacy and trust risk [2301.08778]. In distributed trust infrastructures, either the private key is split across nodes or the protocol logic is split across trusted compartments so that no single component is trusted with the whole decision [2310.04898][2205.08938]. | Domain | What is split | Trust consequence | |---|---|---| | Evolutionary trust game | Investors and trustees are fixed roles | Trust and trustworthiness coevolve without role collapse | | Belief revision | Reports are filtered through partitions/pseudometrics | Only trusted distinctions are revised on | | Human–AI measurement | Trust and distrust are measured separately | Low trust is not identical to distrust | | Split learning | Model computation is partitioned across parties | Raw data stay local but intermediate signals matter | | Trust infrastructure | Keys or protocol logic are divided | Agreement depends on collective validation | This recurring design choice does not eliminate trust requirements. A plausible implication is that it relocates them from monolithic actors to the interfaces between separated roles, channels, or components. ## 2. Role asymmetry in multiplayer trust games The asymmetric \(N\)-player trust game studies two infinite populations, one of investors and one of trustees. In each interaction, a group of \(N_I\) investors and \(N_T\) trustees is drawn, with \(N=N_I+N_T\). Each investor chooses either to invest or not to invest, and each trustee chooses to be trustworthy or untrustworthy. Social learning is role-aware: investors imitate investors and trustees imitate trustees. This asymmetry is introduced to correct two deficiencies in an earlier multiplayer model, namely that investors were forced to invest and that investors and trustees could imitate one another until one role disappeared [2305.01413]. The total invested value is aggregated nonlinearly. If \(k_i\) investors invest, the total value is $$ \frac{1-w^{k_i}}{1-w} = \begin{cases} 0 & \text{if } k_i=0,\\ 1 & \text{if } k_i=1,\\ 1+w+w^2+\cdots+w^{k_i-1} & \text{if } k_i\ge 2. \end{cases} $$ Here \(w>0\) governs nonlinearity: \(01\) is super-linear or synergistic. Trustees share the total investment equally. An untrustworthy trustee receives $$ \Pi_u^o(k_i)=\frac{1}{N_T}\frac{1-w^{k_i}}{1-w}, $$ whereas a trustworthy trustee receives only a fraction \(r\), with \(01\) as administrative cost. The dynamics are then governed by asymmetric replicator equations, $$ \dot{y}_i = y_i(1-y_i)(P_i-P_n), \qquad \dot{y}_t = y_t(1-y_t)(P_t-P_u). $$ The phase portrait depends sharply on both the payoff nonlinearity and the trustee incentive. Without incentives to trustees, \(v_T=0\), the system is attracted to the edge \(y_i=0\), so trust is not sustained. When $$ 01\), it is unstable and trajectories approach the heteroclinic cycle $$ (0,0)\rightarrow(0,1)\rightarrow(1,1)\rightarrow(1,0)\rightarrow(0,0). $$ At \(v_T=v_T^*\), a line of equilibria appears on \(y_i=1\), and for \(v_T>v_T^*\) the fully cooperative state \((1,1)\) becomes globally asymptotically stable. The welfare analysis is equally specific. Social welfare is the population-average payoff, and increasing the investor incentive always lowers this average payoff because $$ \frac{\partial P}{\partial v_I} = -\frac{N_I(a-y_i)}{N_I+N_T}<0. $$ The model therefore identifies trustee-targeted incentives as the main policy lever. For \(0r_1^*=\frac{a-1}{a+1}, $$ the optimal outcome is full trust and full trustworthiness, achieved by \(v_I=0\) and \(v_T=v_T^*+\epsilon\). In large super-linear regimes, either \(N_I\to\infty\) or \(w\to\infty\), the threshold becomes $$ r_2^*=\frac{a}{a+1}. $$ The paper also reports that numerical tests with \(\log(k_i+1)/\log 2\) and \(\exp(0.7k_i)-1\) produce qualitatively similar dynamics. The substantive conclusion is not that nonlinearity simply amplifies cooperation, but that it changes the topology of the trust dynamics. ## 3. Epistemic partitions, split constructs, and compartmental trust In belief revision, trust is modeled as a pre-processing step before revision rather than a property of the revision operator itself. For an agent \(A\), the trust function maps a reporter \(B\) to a state partition \(T_A(B)=\Pi_A^B\). If two states lie in different cells, \(A\) trusts \(B\) to distinguish them; if they lie in the same cell, \(A\) does not. A report \((B,\phi)\) is transformed by the partition closure $$ \Pi_A^B[\phi] = \bigcup\{\Pi_A^B(s)\mid s\models \phi\}, $$ and trust-sensitive revision selects the \(\prec_K\)-minimal states in that closure. The syntactic counterpart is the trust expansion \(\phi_A^B\). The framework recovers standard extremes: the trivial partition yields no learning, while the unit partition yields ordinary AGM revision. To compare different degrees of trust across sources, the paper generalizes partitions to pseudometrics \(d_B\) on states and selects the least threshold \(m\) at which simultaneous trusted reports become jointly compatible [1405.0034]. The psychometric literature on human–AI interaction introduces a different but related split. A pre-registered \(2\times 2\) within-subject online experiment with 1485 participants and 2970 complete scale responses compared trustworthy and untrustworthy chatbot and autonomous-vehicle scenarios. The Trust Scale for the AI Context was largely supported as a single-factor trust measure, with \(\chi^2(20)=258.81\), \(RMSEA=.073\), \(SRMR=.021\), \(CFI=.986\), and reliability \(\alpha=.95\), \(\omega=.95\). By contrast, the Trust between People and Automation scale did not fit as a single factor, with \(\chi^2(54)=2857.47\), \(RMSEA=.157\), \(SRMR=.085\), \(CFI=.887\); exploratory factor analysis supported a two-factor split between trust and distrust, and after removing items 4 and 12 the fit improved to \(\chi^2(34)=903.26\), \(RMSEA=.110\), \(SRMR=.053\), \(CFI=.961\). The reported pattern supports the view that trust and distrust are distinct constructs that may coexist independently [2403.00582]. A stochastic compartmental model of trust in society makes the split explicit at the population level. The population is partitioned into trusters \(T\), skeptics \(S\), and doubters \(C\), with bounded confidence: trusters and doubters do not communicate directly. The social transitions are \(T\leftrightarrow S\) and \(S\to C\), supplemented by births into \(T\) and deaths from all compartments. The fluid model has stationary points $$ \mathbf X_1=(1,0,0),\quad \mathbf X_2=\left(\frac{\nu}{\gamma},1-\frac{\nu}{\gamma},0\right),\quad \mathbf X_3=\left(\frac{\mu}{\gamma+\mu},\frac{\nu}{\mu},\frac{\gamma}{\gamma+\mu}-\frac{\nu}{\mu}\right), $$ with stability depending on \(\gamma=\alpha-\beta\), \(\mu\), and \(\nu\). The paper reports that an increase in life-expectancy and a greater population may increase the proportion of individuals who lose their trust completely, and that the relation between the rate at which doubters convince skeptics and the expected number of doubters is not monotonic [2409.12686]. Here the skeptical middle is not incidental; it is the only channel through which trust and complete distrust can influence one another. ## 4. Decomposed evidence in computational trust prediction Dynamic trust prediction in graphs extends the same logic from roles and belief states to evidence channels. TCHG argues that trust evidence should not be treated as an undifferentiated input, but decomposed into entity reliability, interaction-behavior reliability, and contextual trust. For a candidate event $$ e_{ij,t}=(u_i,u_j,r,t,y_{ij,t},\mathbf{x}_{ij,t}), $$ the evidence is partitioned as $$ \mathbf{x}_{ij,t}=\{\mathbf{x}_{ij,t}^{q}\mid q\in\{E,B,C\}\}, $$ where \(E\), \(B\), and \(C\) correspond to those three channels. Each channel is encoded separately into a latent representation \(\mathbf z_{ij,t}^q\) and a scalar credibility strength \(\tau_{ij,t}^q\). The three channels are then assigned distinct control roles over heterogeneous message passing: entity reliability governs message admission, interaction-behavior reliability modulates propagation strength, and contextual trust chooses a propagation operator through a context-conditioned soft mixture over a bank \(\mathcal W_r=\{W_{r,1},\ldots,W_{r,K}\}\) [2606.16611]. The temporal structure is equally split. TCHG maintains independent temporal states \(M_E\), \(M_B\), and \(M_C\) with non-uniform decay $$ \bar M_q^t=\exp(-\lambda_q\Delta t)M_q^{t-1}, \qquad U_q^t=1-\exp(-\eta_q\Delta t), $$ using \(\lambda_E=0.015\), \(\lambda_B=0.045\), \(\lambda_C=0.090\) and \(\eta_E=0.025\), \(\eta_B=0.060\), \(\eta_C=0.120\). This prevents rapidly changing contextual signals from overwriting slowly accumulated entity reliability. The model predicts both trust probability and uncertainty, $$ p_{ij}=\sigma(s_{ij}), \qquad u_{ij}=\sigma(a_{ij}), $$ and optimizes $$ \mathcal L=\mathcal L_{BCE}+\lambda_{brier}\mathcal L_{brier}+\lambda_{unc}\mathcal L_{unc}+\lambda_{uerr}\mathcal L_{uerr}+\lambda_{div}\mathcal L_{div}, $$ followed by post-hoc calibration $$ p_{ij}^{cal}=\sigma(\alpha_{cal}s_{ij}+\beta_{cal}). $$ The empirical results are reported on Epinions, Ciao, and CiaoDVD. On Epinions under the 80%-10%-10% observed-user split, TCHG reaches \(MRR=0.8811\), \(AP=0.9832\), and \(AUC=0.9866\); in the unobserved-user setting it still reaches \(MRR=0.7018\), \(AP=0.9755\), and \(AUC=0.9690\). On Ciao, it reaches \(MRR=0.6499\), and on CiaoDVD \(MRR=0.9325\). The ablations show that “Feature Injection Only” and “Attention Only” underperform the full model, and removing component-wise memory produces the largest degradation. The uncertainty estimates are also operational: on Epinions observed-user data, rejecting the most uncertain half of the edges raises MRR from \(0.7171\) to \(0.9701\) [2606.16611]. The model therefore treats trust as a multichannel control problem rather than a single score. ## 5. Privacy-preserving split computation and split learning Split learning and split computing reframe trust as a problem of what crosses the cut layer. In standard split learning, a client computes early layers on raw data, sends the split activation to a server, and receives gradients for backpropagation. The basic privacy advantage is that raw data are not transmitted, but the trust problem persists because activation maps and gradients may still leak sensitive information. This concern is explicit in both medical time-series split learning and generative-AI split computing [2301.08778][2310.14651]. Several systems attempt to preserve the computational benefit of splitting while reducing what the remote side can infer. In U-shaped split learning with homomorphic encryption, the client holds the early and final layers, encrypts the split activation map, and the server evaluates its middle layer on ciphertexts. For a 1D CNN on ECG signals, the encrypted U-shaped protocol reports a best test accuracy of \(85.41\%\), only \(2.65\%\) below the plaintext baseline of \(88.06\%\), under \(P=4096\), \(C=[40,20,20]\), and scale \(=2^{21}\); raw training data privacy is preserved, although the backward pass still contains a residual leakage caveat because sending \(\partial J/\partial a^{(L)}\) and \(\partial J/\partial w^{(L)}\) to the server “leads to a privacy leakage of the activation maps” [2301.08778]. A related HE-based U-shaped protocol on the PTB-XL ECG dataset reports a local plaintext accuracy of \(67.68\%\) and a best encrypted accuracy of \(65.42\%\), again a \(2.65\%\) drop, but with large training-duration and communication costs depending on the HE parameters [2309.10517]. Function Secret Sharing extends this line by combining U-shaped split learning with two non-colluding servers. SplitHappens masks the activation map as $$ x_{pub}=ATm+\alpha, $$ keeps the final prediction layer on the client, and thereby hides labels and final outputs from the servers. Under a semi-honest adversary that corrupts at most one server, the paper states LIA soundness and MIA soundness: a corrupted server cannot successfully launch label inference or model inversion. On MNIST, FMNIST, and CIFAR, SplitHappens matches prior accuracy in many settings while being much faster than full FSS training; private training nevertheless remains hundreds to over \(900\times\) slower than public training, and communication costs are roughly \(2\)–\(3\times\) higher for private methods [2507.10494]. Generative split computing applies a similar principle to inference rather than training. \(\Lambda\)-Split partitions a generative model into three sub-models: head and tail on the local device, body on the cloud. Raw prompts and final outputs remain local, and only hidden-layer outputs traverse the network. On Llama-2-7b-chat-hf, caching reduces transmitted data from about \(875\) MB total to about \(6.34\)–\(6.36\) MB total, roughly a \(99\%\) reduction, and improves throughput up to \(6.07\) tokens/s for the \(2{:}30\) split. For Stable Diffusion XL, INT8 affine quantization yields a \(75\%\) reduction in transmitted volume relative to FP32 and produces images with PSNR/SSIM around \(29/0.83\), while FP16 remains around \(41/0.99\) [2310.14651]. The security claim is not formal cryptographic secrecy; the paper explicitly treats resistance to inversion from hidden states as an open problem. At the transcript level, split learning has also been defended with differential privacy. TPSL perturbs gradients along the label-separating direction rather than isotropically, using $$ \textsf{GradPerturb}(y,g_0,g_1)=g_y+u\cdot(g_{1-y}-g_y). $$ If the perturbation mechanism is \((\epsilon,0)\)-DP, TPSL is \((2\epsilon,0)\)-transcript DP, with a refinement to \((\epsilon,0)\)-transcript DP when the perturbation is moved to the final hidden layer of the label party’s network. On Avazu, plaintext split learning yields attack AUC values near perfect label recovery, with NA AUC \(\approx 0.9897\), SA AUC \(\approx 0.9890\), and SDA AUC \(=1.0000\); under Laplace TPSL at \(\epsilon=1\), the test AUC is about \(0.7416\) versus the non-private baseline \(0.7523\) [2203.02073]. A separate line of work introduces R\(^3\)eLU as a privacy-preserving tunnel for SplitNN, using randomized response, Laplace noise, and top-\(K\) clipping in both forward and backward propagation to resist property inference, data reconstruction, and feature space hijacking [2304.09515]. ## 6. Verifiability, robustness, and provenance in partially trusted collaborative learning Privacy-preserving splitting does not by itself guarantee honest computation. Verifiable split learning addresses this by attaching Groth16 zk-SNARK proofs to both directions of the protocol. The split network is written as $$ f(\mathbf{x};\mathbf{w})=f_s\bigl(f_c(\mathbf{x};\mathbf{w}_c);\mathbf{w}_s\bigr), $$ and an external Prover Entity generates proofs that the client-side smashed activation and the server-side backward vector were correctly computed. A Verifying Entity checks those proofs before the receiving worker accepts the message. Invalid or missing proofs are discarded, and a client is excluded from the round if verification fails. In the paper’s comparison, blockchain logging is lightweight because it only records updates, timestamps, and metadata, but it remains unverifiable: it does not prove that the client-side activation or server-side gradient was computed correctly [2511.01356]. Robustness against active attacks introduces another trust dimension. SecureSplit is a server-side defense against backdoor attacks in split learning, where malicious clients alter embeddings to implant hidden triggers. The defense first reshapes the embedding space by $$ \mathbf U=\text{UMAP}(\mathbf E), \qquad \mathbf H=\text{PKT}(\mathbf U), $$ then computes the coordinate-wise median \(\mathbf\Lambda\) and an adaptive radius $$ R_{\text{adp}}=\left(1+\frac{1}{\alpha+\sigma}\right)R, $$ with \(\alpha=1.5\), retaining embeddings satisfying $$ \|\bar{\mathbf E}_k-\mathbf\Lambda\|_2\le R_{\text{adp}}. $$ On CIFAR-10 under VILLAIN, SecureSplit reports \(ACC=0.85\) and \(ASR=0.06\), versus \(0.83/0.57\) for TrMean, \(0.77/0.48\) for Multi-Krum, and \(0.76/0.17\) for VFLIP. The paper further reports that as poison rate increases from \(0.5\%\) to \(10\%\), SecureSplit keeps ASR below \(10\%\) across the range, and it remains robust as trigger magnitude increases from \(0.5\) to \(8\) [2601.14054]. Client-cooperative split learning treats trust as partial and economically consequential. CliCooper assumes a data client with private dataset \(\mathbb D\) and true labels \(Y\), trainer clients \(\mathcal T_1,\dots,\mathcal T_n\) that process successive model segments, and a fully trusted verifier \(\mathcal V\). Privacy is provided by secret label expansion $$ Y \xrightarrow{\ \mathcal G_Y\ } Y^* $$ and by DP-protected activations $$ \mathbb M_{\mathcal C^{DP}}=\bar A+\mathrm{Laplace}\!\left(0,\frac{\Delta_1}{\varepsilon}\right), \qquad \Delta_1\le 2S. $$ Ownership and training provenance are enforced through dynamic chained watermarking: each trainer’s watermark is derived from the predecessor’s activation digest and identity information, then embedded by minimizing $$ W_{\mathcal T_i}=\arg\min_W\left(l_w(W)+\lambda l_\Lambda(W)\right). $$ The experiments report that CliCooper reduces the success rate of clustering attacks to \(0\%\), decreases inversion-reconstruction similarity from \(0.50\) to \(0.03\), and limits model-extraction-based surrogates to about \(1\%\) accuracy, comparable to random guessing; watermark extraction accuracy remains above \(99\%\) [2603.08421]. Here the split is not merely computational. It is also a provenance chain. ## 7. Split-key trust infrastructures and compartmentalized consensus Outside machine learning, trust-by-splitting appears in cryptographic infrastructures and Byzantine agreement. In segmented or isolated networks where external PKI cannot be assumed, a leaderless multi-domain trust infrastructure uses Pedersen distributed key generation so that each node contributes a secret polynomial, receives a signing share \(\textsf{sk}_j\), and the domain collectively obtains a group public key $$ \textsf{pk}=\sum_{i=1}^{n}\mathbf c_{i0}. $$ Threshold signing then produces partial responses $$ z_j:=a_j+(b_j\cdot \beta_j)+\lambda_j\cdot \textsf{sk}_j\cdot c_j $$ that are aggregated into a final signature \(\sigma=(R,z)\). The paper evaluates DKG for \(n=4\) to \(255\) nodes with threshold \(t=3\): Round 1 rises from \(3.4\) ms to \(222.1\) ms, while Round 2 rises from \(12.4\) ms to \(30{,}760\) ms. By contrast, distributed signing remains under \(10.3\) ms across the tested sizes in a \(3\)-of-\(n\) scheme. The aggregation method has communication complexity \(O(c\log^2 n)\) and expected termination in roughly \(O(c\log n)\) rounds [2310.04898]. The split private key turns consensus into a collective cryptographic act. SplitBFT compartmentalizes trust inside each replica rather than across a signing group. Starting from PBFT’s standard \(n=3f+1\) baseline, it places safety-critical logic into three SGX-protected compartments: preparation, confirmation, and execution. The host environment is untrusted; enclaves themselves may also be Byzantine; and faults are assumed independent across compartment types. Safety-critical transitions occur only after the relevant quorum certificates have been checked across compartment boundaries. Applied to PBFT, the preparation compartment handles `PrePrepare` and `NewView`, the confirmation compartment handles `Prepare`, `Commit`, and `ViewChange`, and the execution compartment waits for a quorum of `Commit`s, executes requests, and maintains application state. On Azure SGX-enabled VMs, SplitBFT reaches about \(43\%\)–\(74\%\) of PBFT throughput on a key-value workload and \(38\%\)–\(59\%\) on a blockchain workload without batching; with batching, the figures are about \(64\%\) and \(55\%\), respectively [2205.08938]. The architecture does not reduce the replica count. It instead changes the fault model by splitting a replica into smaller trusted compartments. These literatures do not present a single unified theory, but they converge on a common operational lesson. Splitting can preserve the semantics of trust, limit what another party can learn, force collective authorization, and make correctness auditable. It can also create new attack surfaces at the very interfaces it introduces. The central problem is therefore not simply whether to trust, but how trust is redistributed when roles, evidence, computation, or authority are split. Source: https://www.emergentmind.com/topics/trust-and-split