Training deep learning models collaboratively on decentralized edge devices has attracted significant attention recently. The two most prominent schemes for this problem are Federated Learning (FL) and Split Learning (SL). Although there have been several surveys and experimental evaluations for FL in the literature, SL paradigms have not yet been systematically reviewed and evaluated. Due to the diversity of SL paradigms in terms of label sharing, model aggregation, cut layer selection, etc., the lack of a systematic survey makes it difficult to fairly and conveniently compare the performance of different SL paradigms. To address the above issue, in this paper, we first provide a comprehensive review for existing SL paradigms. Then, we implement several typical SL paradigms and perform extensive experiments to compare their performance in different scenarios on four widely used datasets. The experimental results provide extensive engineering advice and research insights for SL paradigms. We hope that our work can facilitate future research on SL by establishing a fair and accessible benchmark for SL performance evaluation.

Data heterogeneity and backdoor attacks rank among the most significant challenges facing federated learning (FL). For data heterogeneity, personalized federated learning (PFL) enables each client to maintain a private personalized model to cater to client-specific knowledge. Meanwhile, vanilla FL has proven vulnerable to backdoor attacks. However, recent advancements in PFL community have demonstrated a potential immunity against such attacks. This paper explores this intersection further, revealing that existing federated backdoor attacks fail in PFL because backdoors about manually designed triggers struggle to survive in personalized models. To tackle this, we design Bad-PFL, which employs features from natural data as our trigger. As long as the model is trained on natural data, it inevitably embeds the backdoor associated with our trigger, ensuring its longevity in personalized models. Moreover, our trigger undergoes mutual reinforcement training with the model, further solidifying the backdoor's durability and enhancing attack effectiveness. The large-scale experiments across three benchmark datasets demonstrate the superior performance of our attack against various PFL methods, even when equipped with state-of-the-art defense mechanisms.