TensorSCONE: A Secure TensorFlow Framework using Intel SGX

Abstract

Machine learning has become a critical component of modern data-driven online services. Typically, the training phase of machine learning techniques requires to process large-scale datasets which may contain private and sensitive information of customers. This imposes significant security risks since modern online services rely on cloud computing to store and process the sensitive data. In the untrusted computing infrastructure, security is becoming a paramount concern since the customers need to trust the thirdparty cloud provider. Unfortunately, this trust has been violated multiple times in the past. To overcome the potential security risks in the cloud, we answer the following research question: how to enable secure executions of machine learning computations in the untrusted infrastructure? To achieve this goal, we propose a hardware-assisted approach based on Trusted Execution Environments (TEEs), specifically Intel SGX, to enable secure execution of the machine learning computations over the private and sensitive datasets. More specifically, we propose a generic and secure machine learning framework based on Tensorflow, which enables secure execution of existing applications on the commodity untrusted infrastructure. In particular, we have built our system called TensorSCONE from ground-up by integrating TensorFlow with SCONE, a shielded execution framework based on Intel SGX. The main challenge of this work is to overcome the architectural limitations of Intel SGX in the context of building a secure TensorFlow system. Our evaluation shows that we achieve reasonable performance overheads while providing strong security properties with low TCB.

References in corpus (5)

• TensorFlow: A system for large-scale machine learning
• Improving neural networks by preventing co-adaptation of feature detectors
• Empirical Evaluation of Rectified Activations in Convolutional Network
• Privacy Preserving Stream Analytics: The Marriage of Randomized Response and Approximate Computing
• Slick: Secure Middleboxes using Shielded Execution

Cited by in corpus (13)

• Physical Fault Injection and Side-Channel Attacks on Mobile Devices: A Comprehensive Analysis
• secureTF: A Secure TensorFlow Framework
• Machine Learning with Confidential Computing: A Systematization of Knowledge
• Mind Your Weight(s): A Large-scale Study on Insufficient Machine Learning Model Protection in Mobile Apps
• Differentially private cross-silo federated learning
• Deep Learning in Mining Biological Data
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• CryptoSPN: Privacy-preserving Sum-Product Network Inference
• GOAT: GPU Outsourcing of Deep Learning Training With Asynchronous Probabilistic Integrity Verification Inside Trusted Execution Environment
• Citadel: Protecting Data Privacy and Model Confidentiality for Collaborative Learning with SGX
• ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networks
• Binary Compatibility For SGX Enclaves
• S3ML: A Secure Serving System for Machine Learning Inference