Confidential Deep Learning: Executing Proprietary Models on Untrusted Devices

Abstract

Performing deep learning on end-user devices provides fast offline inference results and can help protect the user's privacy. However, running models on untrusted client devices reveals model information which may be proprietary, i.e., the operating system or other applications on end-user devices may be manipulated to copy and redistribute this information, infringing on the model provider's intellectual property. We propose the use of ARM TrustZone, a hardware-based security feature present in most phones, to confidentially run a proprietary model on an untrusted end-user device. We explore the limitations and design challenges of using TrustZone and examine potential approaches for confidential deep learning within this environment. Of particular interest is providing robust protection of proprietary model information while minimizing total performance overhead.

References in corpus (5)

• Benchmark Analysis of Representative Deep Neural Network Architectures
• Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
• BranchyNet: Fast Inference via Early Exiting from Deep Neural Networks
• Privado: Practical and Secure DNN Inference with Enclaves
• Towards Characterizing and Limiting Information Exposure in DNN Layers

Cited by in corpus (4)

• Machine Learning with Confidential Computing: A Systematization of Knowledge
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• Fortress: Securing IoT Peripherals with Trusted Execution Environments
• Enclave-Aware Compartmentalization and Secure Sharing with Sirius