Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware

By Florian Tramèr, Dan Boneh. 2018

492 citations recorded by the source corpus.

As Machine Learning (ML) gets applied to security-critical or sensitive domains, there is a growing need for integrity and privacy for outsourced ML computations. A pragmatic solution comes from Trusted Execution Environments (TEEs), which use hardware and software protections to isolate sensitive computations from the untrusted software stack. However, these isolation guarantees come at a price in performance, compared to untrusted alternatives. This paper initiates the study of high performance execution of Deep Neural Networks (DNNs) in TEEs by efficiently partitioning DNN computations between trusted and untrusted devices. Building upon an efficient outsourcing scheme for matrix multiplication, we propose Slalom, a framework that securely delegates execution of all linear layers in a DNN from a TEE (e.g., Intel SGX or Sanctum) to a faster, yet untrusted, co-located processor. We evaluate Slalom by running DNNs in an Intel SGX enclave, which selectively delegates work to an untrusted GPU. For canonical DNNs (VGG16, MobileNet and ResNet variants) we obtain 6x to 20x increases in throughput for verifiable inference, and 4x to 11x for verifiable and private inference.

Subfields: Artificial Intelligence, Hardware and Architecture, Model Architectures, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Model Architectures

In Privacy & Security

Citations in the corpus

Advances and Open Problems in Federated Learning (2019, methodology): “[353] F. Tramèr and D. Boneh, “Differentially private learning needs better features (or much more data),” arXiv preprint arXiv:2011.”
Privacy in Deep Learning: A Survey (2020, methodology): “TEEs have been deployed in many forms, including Intel’s SGX-enabled CPUs [154, 155, 156, 157], Arm’s TrustZone [158].”
Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims (2020, background): “67 Demonstrations to date have been carried out on commodity hardware (CPUs [112] [113] and GPUs [114]) or have secure and verifiable outsourcing of parts of the computation to less secure hardware [115] [116], rather than on hardware directly optimized for machine learning (such as TPUs).”
A Study of Face Obfuscation in ImageNet (2021, methodology): “To address hardware/software vulnerabilities, researchers have used enclaves —a hardware mechanism for protecting a memory region from unauthorized access—to execute machine learning workloads (Ohrimenko et al., 2016; Tramer & Boneh, 2018).”
Low Latency Privacy Preserving Inference (2018, background): “Hardware based solutions were also proposed, for example, Tramer & Boneh (2018).”
DarkneTZ: towards model privacy at the edge using trusted execution environments (2020, background): “Accessing a GPU (or NPU) through the secure bus enables the TrustZone to con-trol the GPU so that the confidentiality of DNN models on the GPU cannot be breached and achieve faster executions for partitioned deep learning on devices.”
VerifyNet: Secure and Verifiable Federated Learning (2020, methodology): “To combat that, Several schemes [16], [17] have been successively proposed to alleviate this problem.”
Trustworthy artificial intelligence (2020, methodology): “Extant research has proposed several approaches to protect people’s privacy during the training and operation of an AI, like adding noise to data and models (Sarwate and Chaudhuri 2013), the use of trusted execution environments (Tramer and Boneh 2019), or federated learning for AI model training (S”
Shredder: Learning Noise to Protect Privacy with Partial DNN Inference on the Edge (2019, methodology): “Several research propose running machine learning algorithms in in trusted execution environments such as Intel SGX [55] and ARM TrustZone [56] to address the same remote inference privacy [57, 58, 59, 60] as well as integrity [57].”
Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks (2019, background): “The properties include security (e.g., robustness towards adversarial evasion attacks (Biggio et al., 2013; Goodfel-low et al., 2014; Madry et al., 2018)) and integrity (e.g., running in untrusted environments (Tramer & Boneh, 2019)).”
CrypTFlow: Secure TensorFlow Inference (2019, methodology): “Prior works [74], [69], [38], [11], [23], [29], [51], [32], [77], [83], [44] that combine MPC and hardware (SGX) make stronger trust assumption on the hardware of both confidentiality and integrity, and hence, provide security only in a weaker threat model where the hardware hides the data residing ”
Occlumency: Privacy-preserving Remote Deep-learning Inference Using SGX (2019, methodology): “Chiron [41], Ryoan [42], and Slalom [71] used SGX for ML-inference tasks, including both training and inference.”
ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models (2018, background): “Besides the above, many recent works have tackled security and privacy in machine learning from various perspectives [39], [16], [9], [37], [7], [27], [20], [45], [36], [21], [40], [29], [41], [20].”
Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, methodology): “In [85], the authors propose to use Intel SGX as a hardware root-of-trust, but leverage other hardware such as more powerful (but untrusted) CPUs cores and GPUs to perform inference.”
Cheetah: Optimizing and Accelerating Homomorphic Encryption for Private Inference (2020, background): “, [10], [59] use TEEs to isolate private data from untrusted software.”
MLCapsule: Guarded Offline Deployment of Machine Learning as a Service (2018, methodology): “The implementation uses C++ and is based on Slalom [34], which uses a custom lightweight C++ library for feed-forward networks based on Eigen.”