secureTF: A Secure TensorFlow Framework

Abstract

Data-driven intelligent applications in modern online services have become ubiquitous. These applications are usually hosted in the untrusted cloud computing infrastructure. This poses significant security risks since these applications rely on applying machine learning algorithms on large datasets which may contain private and sensitive information. To tackle this challenge, we designed secureTF, a distributed secure machine learning framework based on Tensorflow for the untrusted cloud infrastructure. secureTF is a generic platform to support unmodified TensorFlow applications, while providing end-to-end security for the input data, ML model, and application code. secureTF is built from ground-up based on the security properties provided by Trusted Execution Environments (TEEs). However, it extends the trust of a volatile memory region (or secure enclave) provided by the single node TEE to secure a distributed infrastructure required for supporting unmodified stateful machine learning applications running in the cloud. The paper reports on our experiences about the system design choices and the system deployment in production use-cases. We conclude with the lessons learned based on the limitations of our commercially available platform, and discuss open research problems for the future work.

arXiv admin note: text overlap with arXiv:1902.04413

References in corpus (17)

• TensorFlow: A system for large-scale machine learning
• Deep Learning with Differential Privacy
• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Empirical Evaluation of Rectified Activations in Convolutional Network
• Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX
• SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution
• Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
• Software Grand Exposure: SGX Cache Attacks Are Practical
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• Gazelle: A Low Latency Framework for Secure Neural Network Inference
• Chiron: Privacy-preserving Machine Learning as a Service
• TensorSCONE: A Secure TensorFlow Framework using Intel SGX
• CYCLOSA: Decentralizing Private Web Search Through SGX-Based Browser Extensions
• Privado: Practical and Secure DNN Inference with Enclaves
• Slick: Secure Middleboxes using Shielded Execution
• A practical approach for updating an integrity-enforced operating system
• T-Lease: A Trusted Lease Primitive for Distributed Systems

Cited by in corpus (8)

• SoK: A Systematic Review of TEE Usage for Developing Trusted Applications
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• Secure Quantized Training for Deep Learning
• A practical approach for updating an integrity-enforced operating system
• SecV: Secure Code Partitioning via Multi-Language Secure Values
• TEEMon: A continuous performance monitoring framework for TEEs
• Citadel: Protecting Data Privacy and Model Confidentiality for Collaborative Learning with SGX
• Perun: Secure Multi-Stakeholder Machine Learning Framework with GPU Support