DarkneTZ: towards model privacy at the edge using trusted execution environments
By Fan Mo, Ali Shahin Shamsabadi, Kleomenis Katevas, Soteris Demetriou, Ilias Leontiadis, Andrea Cavallaro, Hamed Haddadi. 2020
240 citations recorded by the source corpus.
We present DarkneTZ, a framework that uses an edge device's Trusted Execution Environment (TEE) in conjunction with model partitioning to limit the attack surface against Deep Neural Networks (DNNs). Increasingly, edge devices (smartphones and consumer IoT devices) are equipped with pre-trained DNNs for a variety of applications. This trend comes with privacy risks as models can leak information about their training data through effective membership inference attacks (MIAs). We evaluate the performance of DarkneTZ, including CPU execution time, memory usage, and accurate power consumption, using two small and six large image classification models. Due to the limited memory of the edge device's TEE, we partition model layers into more sensitive layers (to be executed inside the device TEE), and a set of layers to be executed in the untrusted part of the operating system. Our results show that even if a single layer is hidden, we can provide reliable model privacy and defend against state of the art MIAs, with only 3% performance overhead. When fully utilizing the TEE, DarkneTZ provides model protections with up to 10% overhead.
Subfields: Artificial Intelligence
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Praneeth Vepakomma
- Abhishek Singh
- Ramesh Raskar
- Hadi Esmaeilzadeh
- Mohammadkazem Taram
- Hamed Haddadi
- Fatemehsadat Mirshghallah
- Diego Perino
Citations in the corpus
- Privacy in Deep Learning: A Survey (2020, methodology): “In a more recent work [95], Mohassel et al design protocols for secure three-party training of DNNs with a majority of honest parties.”
- PPFL: privacy-preserving federated learning with trusted execution environments (2021, methodology): “Running ML inside TEEs can hide model parameters from REE adversaries and consequently preserve privacy, as already used for light data analytics on servers [54, 62] and for heavy computations such as DNN training [18, 23, 49, 70].”