Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
arXiv:2111.03308 · doi:10.1109/ACCESS.2021.3136889
Abstract
As machine learning (ML) technologies and applications are rapidly changing many computing domains, security issues associated with ML are also emerging. In the domain of systems security, many endeavors have been made to ensure ML model and data confidentiality. ML computations are often inevitably performed in untrusted environments and entail complex multi-party security requirements. Hence, researchers have leveraged the Trusted Execution Environments (TEEs) to build confidential ML computation systems. We conduct a systematic and comprehensive survey by classifying attack vectors and mitigation in confidential ML computation in untrusted environments, analyzing the complex security requirements in multi-party scenarios, and summarizing engineering challenges in confidential ML implementation. Lastly, we suggest future research directions based on our study.
arXiv commentPublished to IEEE Access, URL: https://ieeexplore.ieee.org/document/9656734
References in corpus (44)
- PyTorch: An Imperative Style, High-Performance Deep Learning Library
- Communication-Efficient Learning of Deep Networks from Decentralized Data
- Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Stealing Machine Learning Models via Prediction APIs
- Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
- Software Grand Exposure: SGX Cache Attacks Are Practical
- Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing
- Inverting Gradients -- How easy is it to break privacy in federated learning?
- Differential Privacy and Machine Learning: a Survey and Review
- DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments
- Practical Secure Aggregation for Federated Learning on User-Held Data
- Chiron: Privacy-preserving Machine Learning as a Service
- I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators
- Occlum: Secure and Efficient Multitasking Inside a Single Enclave of Intel SGX
- ARMageddon: Cache Attacks on Mobile Devices
- Privacy in Deep Learning: A Survey
- Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
- Stealing Neural Networks via Timing Side Channels
- Efficient Deep Learning on Multi-Source Private Data
- SGXIO: Generic Trusted I/O Path for Intel SGX
- Membership Inference Attacks and Defenses in Classification Models
- Twine: An Embedded Trusted Runtime for WebAssembly
- Stealing Hyperparameters in Machine Learning
- SGX-LKL: Securing the Host OS Interface for Trusted Execution
- PPFL: Privacy-preserving Federated Learning with Trusted Execution Environments
- Stealing Links from Graph Neural Networks
- secureTF: A Secure TensorFlow Framework
- Hermes Attack: Steal DNN Models with Lossless Inference Accuracy
- TensorSCONE: A Secure TensorFlow Framework using Intel SGX
- Offline Model Guard: Secure and Private ML on Mobile Devices
- Privado: Practical and Secure DNN Inference with Enclaves
- Privacy-Preserving Inference in Machine Learning Services Using Trusted Execution Environments
- Mind Your Weight(s): A Large-scale Study on Insufficient Machine Learning Model Protection in Mobile Apps
- Deep Leakage from Gradients
- Confidential Deep Learning: Executing Proprietary Models on Untrusted Devices
- Confidential Inference via Ternary Model Partitioning
- Enabling Privacy-Preserving, Compute- and Data-Intensive Computing using Heterogeneous Trusted Execution Environment
- GOAT: GPU Outsourcing of Deep Learning Training With Asynchronous Probabilistic Integrity Verification Inside Trusted Execution Environment
- ESMFL: Efficient and Secure Models for Federated Learning
- DeepPeep: Exploiting Design Ramifications to Decipher the Architecture of Compact DNNs
- Perun: Secure Multi-Stakeholder Machine Learning Framework with GPU Support
- Citadel: Protecting Data Privacy and Model Confidentiality for Collaborative Learning with SGX
- ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networks