Machine Learning with Confidential Computing: A Systematization of Knowledge

Abstract

Privacy and security challenges in Machine Learning (ML) have become increasingly severe, along with ML's pervasive development and the recent demonstration of large attack surfaces. As a mature system-oriented approach, Confidential Computing has been utilized in both academia and industry to mitigate privacy and security issues in various ML scenarios. In this paper, the conjunction between ML and Confidential Computing is investigated. We systematize the prior work on Confidential Computing-assisted ML techniques that provide i) confidentiality guarantees and ii) integrity assurances, and discuss their advanced features and drawbacks. Key challenges are further identified, and we provide dedicated analyses of the limitations in existing Trusted Execution Environment (TEE) systems for ML use cases. Finally, prospective works are discussed, including grounded privacy definitions for closed-loop protection, partitioned executions of efficient ML, dedicated TEE-assisted designs for ML, TEE-aware ML, and ML full pipeline guarantees. By providing these potential solutions in our systematization of knowledge, we aim to build the bridge to help achieve a much stronger TEE-enabled ML for privacy guarantees without introducing computation and system costs.

Survey paper, 37 pages, accepted to ACM Computing Surveys

References in corpus (38)

• Explaining and Harnessing Adversarial Examples
• How transferable are features in deep neural networks?
• Neural Architecture Search: A Survey
• Unsupervised Data Augmentation for Consistency Training
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Identifying Mislabeled Training Data
• MixMatch: A Holistic Approach to Semi-Supervised Learning
• NVAE: A Deep Hierarchical Variational Autoencoder
• Recent Advances in Autoencoder-Based Representation Learning
• A Survey of Privacy Attacks in Machine Learning
• Inverting Gradients -- How easy is it to break privacy in federated learning?
• Chiron: Privacy-preserving Machine Learning as a Service
• Deep learning incorporating biologically-inspired neural dynamics
• MicroNets: Neural Network Architectures for Deploying TinyML Applications on Commodity Microcontrollers
• When Machine Learning Meets Privacy: A Survey and Outlook
• SpArSe: Sparse Architecture Search for CNNs on Resource-Constrained Microcontrollers
• Efficient Deep Learning on Multi-Source Private Data
• DisPFL: Towards Communication-Efficient Personalized Federated Learning via Decentralized Sparse Training
• PPFL: Privacy-preserving Federated Learning with Trusted Execution Environments
• TensorSCONE: A Secure TensorFlow Framework using Intel SGX
• Interpretable Deep Learning: Interpretation, Interpretability, Trustworthiness, and Beyond
• Privado: Practical and Secure DNN Inference with Enclaves
• Privacy-Preserving Inference in Machine Learning Services Using Trusted Execution Environments
• A Scalable Approach for Privacy-Preserving Collaborative Machine Learning
• Parameterized Knowledge Transfer for Personalized Federated Learning
• Confidential Deep Learning: Executing Proprietary Models on Untrusted Devices
• Confidential Inference via Ternary Model Partitioning
• Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective
• Layer-wise Characterization of Latent Information Leakage in Federated Learning
• EIFFeL: Ensuring Integrity for Federated Learning
• CaPC Learning: Confidential and Private Collaborative Learning
• Privacy Auditing with One (1) Training Run
• Towards Characterizing and Limiting Information Exposure in DNN Layers
• SecFL: Confidential Federated Learning using TEEs
• Enclave-Aware Compartmentalization and Secure Sharing with Sirius
• Dash: Accelerating Distributed Private Convolutional Neural Network Inference with Arithmetic Garbled Circuits
• virtCCA: Virtualized Arm Confidential Compute Architecture with TrustZone
• Memory-Efficient Deep Learning Inference in Trusted Execution Environments