Privado: Practical and Secure DNN Inference with Enclaves

Abstract

Cloud providers are extending support for trusted hardware primitives such as Intel SGX. Simultaneously, the field of deep learning is seeing enormous innovation as well as an increase in adoption. In this paper, we ask a timely question: "Can third-party cloud services use Intel SGX enclaves to provide practical, yet secure DNN Inference-as-a-service?" We first demonstrate that DNN models executing inside enclaves are vulnerable to access pattern based attacks. We show that by simply observing access patterns, an attacker can classify encrypted inputs with 97% and 71% attack accuracy for MNIST and CIFAR10 datasets on models trained to achieve 99% and 79% original accuracy respectively. This motivates the need for PRIVADO, a system we have designed for secure, easy-to-use, and performance efficient inference-as-a-service. PRIVADO is input-oblivious: it transforms any deep learning framework that is written in C/C++ to be free of input-dependent access patterns thus eliminating the leakage. PRIVADO is fully-automated and has a low TCB: with zero developer effort, given an ONNX description of a model, it generates compact and enclave-compatible code which can be deployed on an SGX cloud platform. PRIVADO incurs low performance overhead: we use PRIVADO with Torch framework and show its overhead to be 17.18% on average on 11 different contemporary neural networks.

13 pages, 5 figures

References in corpus (10)

• SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and <0.5MB model size
• Deep Learning with Differential Privacy
• Wide Residual Networks
• Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
• Software Grand Exposure: SGX Cache Attacks Are Practical
• Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing
• Chiron: Privacy-preserving Machine Learning as a Service
• Efficient Deep Learning on Multi-Source Private Data
• TAPAS: Tricks to Accelerate (encrypted) Prediction As a Service
• Integrating Remote Attestation with Transport Layer Security

Cited by in corpus (10)

• secureTF: A Secure TensorFlow Framework
• Machine Learning with Confidential Computing: A Systematization of Knowledge
• Keystone: An Open Framework for Architecting TEEs
• Confidential Deep Learning: Executing Proprietary Models on Untrusted Devices
• QEnclave -- A practical solution for secure quantum cloud computing
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• Enclave-Aware Compartmentalization and Secure Sharing with Sirius
• Perun: Secure Multi-Stakeholder Machine Learning Framework with GPU Support
• Privacy-Preserving Machine Learning in Untrusted Clouds Made Simple
• BesFS: A POSIX Filesystem for Enclaves with a Mechanized Safety Proof