DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments

Abstract

We present DarkneTZ, a framework that uses an edge device's Trusted Execution Environment (TEE) in conjunction with model partitioning to limit the attack surface against Deep Neural Networks (DNNs). Increasingly, edge devices (smartphones and consumer IoT devices) are equipped with pre-trained DNNs for a variety of applications. This trend comes with privacy risks as models can leak information about their training data through effective membership inference attacks (MIAs). We evaluate the performance of DarkneTZ, including CPU execution time, memory usage, and accurate power consumption, using two small and six large image classification models. Due to the limited memory of the edge device's TEE, we partition model layers into more sensitive layers (to be executed inside the device TEE), and a set of layers to be executed in the untrusted part of the operating system. Our results show that even if a single layer is hidden, we can provide reliable model privacy and defend against state of the art MIAs, with only 3% performance overhead. When fully utilizing the TEE, DarkneTZ provides model protections with up to 10% overhead.

13 pages, 8 figures, accepted to ACM MobiSys 2020

References in corpus (17)

• MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications
• Deep Learning with Differential Privacy
• How transferable are features in deep neural networks?
• RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response
• Understanding Neural Networks Through Deep Visualization
• Renyi Differential Privacy
• Understanding deep learning requires rethinking generalization
• Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX
• Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• Differentially Private Model Publishing for Deep Learning
• A Survey on Homomorphic Encryption Schemes: Theory and Implementation
• Chiron: Privacy-preserving Machine Learning as a Service
• Efficient Deep Learning on Multi-Source Private Data
• MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples
• StreamBox-TZ: Secure Stream Analytics at the Edge with TrustZone
• Memorization in Overparameterized Autoencoders

Cited by in corpus (29)

• Trustworthy Graph Neural Networks: Aspects, Methods and Trends
• Privacy in Deep Learning: A Survey
• PPFL: Privacy-preserving Federated Learning with Trusted Execution Environments
• DynO: Dynamic Onloading of Deep Neural Networks from Cloud to Device
• SoK: A Systematic Review of TEE Usage for Developing Trusted Applications
• Honest-but-Curious Nets: Sensitive Attributes of Private Inputs Can Be Secretly Coded into the Classifiers' Outputs
• Towards Battery-Free Machine Learning and Inference in Underwater Environments
• It's always personal: Using Early Exits for Efficient On-Device CNN Personalisation
• Shielding Federated Learning Systems against Inference Attacks with ARM TrustZone
• RL-DistPrivacy: Privacy-Aware Distributed Deep Inference for low latency IoT systems
• Minimum Viable Device Drivers for ARM TrustZone
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• Layer-wise Characterization of Latent Information Leakage in Federated Learning
• TransLinkGuard: Safeguarding Transformer Models Against Model Stealing in Edge Deployment
• LEAP: TrustZone Based Developer-Friendly TEE for Intelligent Mobile Apps
• Fortress: Securing IoT Peripherals with Trusted Execution Environments
• Pelta: Shielding Transformers to Mitigate Evasion Attacks in Federated Learning
• Policy-Based Federated Learning
• Enclave-Aware Compartmentalization and Secure Sharing with Sirius
• WAFFLE: Watermarking in Federated Learning
• Mitigating Adversarial Attacks by Distributing Different Copies to Different Users
• Anonymizing Sensor Data on the Edge: A Representation Learning and Transformation Approach
• ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networks
• MATEE: Efficiently Bridging the Semantic Gap in TrustZone via Arm Pointer Authentication
• A Generative Framework for Low-Cost Result Validation of Machine Learning-as-a-Service Inference
• Learning to Prevent Leakage: Privacy-Preserving Inference in the Mobile Cloud
• Privacy and Integrity Preserving Training Using Trusted Hardware
• Safe and Practical GPU Acceleration in TrustZone
• An Early Experience with Confidential Computing Architecture for On-Device Model Protection