Chiron: Privacy-preserving Machine Learning as a Service

Abstract

Major cloud operators offer machine learning (ML) as a service, enabling customers who have the data but not ML expertise or infrastructure to train predictive models on this data. Existing ML-as-a-service platforms require users to reveal all training data to the service operator. We design, implement, and evaluate Chiron, a system for privacy-preserving machine learning as a service. First, Chiron conceals the training data from the service operator. Second, in keeping with how many existing ML-as-a-service platforms work, Chiron reveals neither the training algorithm nor the model structure to the user, providing only black-box access to the trained model. Chiron is implemented using SGX enclaves, but SGX alone does not achieve the dual goals of data privacy and model confidentiality. Chiron runs the standard ML training toolchain (including the popular Theano framework and C compiler) in an enclave, but the untrusted model-creation code from the service operator is further confined in a Ryoan sandbox to prevent it from leaking the training data outside the enclave. To support distributed training, Chiron executes multiple concurrent enclaves that exchange model parameters via a parameter server. We evaluate Chiron on popular deep learning models, focusing on benchmark image classification tasks such as CIFAR and ImageNet, and show that its training performance and accuracy of the resulting models are practical for common uses of ML-as-a-service.

References in corpus (2)

• TensorFlow: A system for large-scale machine learning
• Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX

Cited by in corpus (45)

• Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
• DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments
• Blockchain-based Federated Learning with Secure Aggregation in Trusted Execution Environment for Internet-of-Things
• Data Minimization for GDPR Compliance in Machine Learning Models
• Efficient Deep Learning on Multi-Source Private Data
• Privacy-preserving Machine Learning through Data Obfuscation
• Towards Energy-Efficient and Secure Edge AI: A Cross-Layer Framework
• PPFL: Privacy-preserving Federated Learning with Trusted Execution Environments
• secureTF: A Secure TensorFlow Framework
• Machine Learning with Confidential Computing: A Systematization of Knowledge
• Leakage of Dataset Properties in Multi-Party Machine Learning
• Privado: Practical and Secure DNN Inference with Enclaves
• Machine Learning with Membership Privacy using Adversarial Regularization
• Differentially private cross-silo federated learning
• DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips
• Confidential Inference via Ternary Model Partitioning
• An Overview of Privacy in Machine Learning
• DarKnight: A Data Privacy Scheme for Training and Inference of Deep Neural Networks
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• Privacy-Preserving Blockchain Based Federated Learning with Differential Data Sharing
• Visor: Privacy-Preserving Video Analytics as a Cloud Service
• Towards Characterizing and Limiting Information Exposure in DNN Layers
• GOAT: GPU Outsourcing of Deep Learning Training With Asynchronous Probabilistic Integrity Verification Inside Trusted Execution Environment
• SESAME: Software defined Enclaves to Secure Inference Accelerators with Multi-tenant Execution
• The Value of Collaboration in Convex Machine Learning with Differential Privacy
• Shredder: Learning Noise Distributions to Protect Inference Privacy
• SOTERIA: In Search of Efficient Neural Networks for Private Inference
• PrivacyGuard: Enforcing Private Data Usage Control with Blockchain and Attested Off-chain Contract Execution
• Understanding TEE Containers, Easy to Use? Hard to Trust
• Enclave-Aware Compartmentalization and Secure Sharing with Sirius
• Sisyphus: A Cautionary Tale of Using Low-Degree Polynomial Activations in Privacy-Preserving Deep Learning
• S++: A Fast and Deployable Secure-Computation Framework for Privacy-Preserving Neural Network Training
• Citadel: Protecting Data Privacy and Model Confidentiality for Collaborative Learning with SGX
• Separation of Powers in Federated Learning
• Machine Learning Models Disclosure from Trusted Research Environments (TRE), Challenges and Opportunities
• Customizing Trusted AI Accelerators for Efficient Privacy-Preserving Machine Learning
• Reaching Data Confidentiality and Model Accountability on the CalTrain
• Confidential Attestation: Efficient in-Enclave Verification of Privacy Policy Compliance
• Golden Grain: Building a Secure and Decentralized Model Marketplace for MLaaS
• Identifying and Exploiting Structures for Reliable Deep Learning
• Sharing in a Trustless World: Privacy-Preserving Data Analytics with Potentially Cheating Participants
• P2FAAS: Toward Privacy-Preserving Fuzzing as a Service
• Accelerating 2PC-based ML with Limited Trusted Hardware
• Secure Machine Learning in the Cloud Using One Way Scrambling by Deconvolution
• Privacy and Integrity Preserving Training Using Trusted Hardware