Confidential Inference via Ternary Model Partitioning
arXiv:1807.00969
Abstract
Today's cloud vendors are competing to provide various offerings to simplify and accelerate AI service deployment. However, cloud users always have concerns about the confidentiality of their runtime data, which are supposed to be processed on third-party's compute infrastructures. Information disclosure of user-supplied data may jeopardize users' privacy and breach increasingly stringent data protection regulations. In this paper, we systematically investigate the life cycles of inference inputs in deep learning image classification pipelines and understand how the information could be leaked. Based on the discovered insights, we develop a Ternary Model Partitioning mechanism and bring trusted execution environments to mitigate the identified information leakages. Our research prototype consists of two co-operative components: (1) Model Assessment Framework, a local model evaluation and partitioning tool that assists cloud users in deployment preparation; (2) Infenclave, an enclave-based model serving system for online confidential inference in the cloud. We have conducted comprehensive security and performance evaluation on three representative ImageNet-level deep learning models with different network depths and architectural complexity. Our results demonstrate the feasibility of launching confidential inference services in the cloud with maximized confidentiality guarantees and low performance costs.
References in corpus (8)
- Communication-Efficient Learning of Deep Networks from Decentralized Data
- Striving for Simplicity: The All Convolutional Net
- Understanding Neural Networks Through Deep Visualization
- Opening the Black Box of Deep Neural Networks via Information
- Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
- Chiron: Privacy-preserving Machine Learning as a Service
- Efficient Deep Learning on Multi-Source Private Data
- ZombieLoad: Cross-Privilege-Boundary Data Sampling