MLCapsule: Guarded Offline Deployment of Machine Learning as a Service

By Lucjan Hanzlik, Yang Zhang, Kathrin Grosse, Ahmed Salem, Maximilian Augustin, Michael Backes, Mario Fritz. 2018

124 citations recorded by the source corpus.

Machine Learning as a Service (MLaaS) is a popular and convenient way to access a trained machine learning (ML) model trough an API. However, if the user’s input is sensitive, sending it to the server is not an option. Equally, the service provider does not want to share the model by sending it to the client for protecting its intellectual property and pay-per-query business model. As a solution, we propose MLCapsule, a guarded offline deployment of MLaaS. MLCapsule executes the machine learning model locally on the user’s client and therefore the data never leaves the client. Meanwhile, we show that MLCapsule is able to offer the service provider the same level of control and security of its model as the commonly used server-side execution. Beyond protecting against direct model access, we demonstrate that MLCapsule allows for implementing defenses against advanced attacks on machine learning models such as model stealing, reverse engineering and membership inference.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware (2018, methodology): “Our work also departs from prior systems that execute DNNs fully in a TEE (Ohrimenko et al., 2016; Hunt et al., 2018; Cheng et al., 2018; Hanzlik et al., 2018).”
DarKnight: A Data Privacy Scheme for Training and Inference of Deep Neural Networks (2020, methodology): “Our idea relies on TEEs to perform private inference or training in a secure hardware [5, 6, 7, 8, 9, 10].”
A framework for the extraction of Deep Neural Networks by leveraging public data (2019, methodology): “[46] design MLCapsule, a guarded offline deployment of MLaaS using Intel SGX.”
ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models (2018, background): “Besides the above, many recent works have tackled security and privacy in machine learning from various perspectives [39], [16], [9], [37], [7], [27], [20], [45], [36], [21], [40], [29], [41], [20].”
DarkneTZ: towards model privacy at the edge using trusted execution environments (2020, background): “Previous work has demonstrated promising results in this space; recent advancements allow for high-performance execution of sensitive operations within a TEE [17, 19, 24, 50, 51].”
Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, background): “In MLCapsule [84], authors develop a machine learning as a service (MLaaS) platform above”
Shredder: Learning Noise Distributions to Protect Inference Privacy (2019, methodology): “Several research propose runningmachine learning algorithms in in trusted execution environments such as Intel SGX [63] andARMTrustZone [64] to address the same remote inference privacy [65–68] as well as integrity [65].”
Shredder: Learning Noise to Protect Privacy with Partial DNN Inference on the Edge (2019, methodology): “Several research propose running machine learning algorithms in in trusted execution environments such as Intel SGX [55] and ARM TrustZone [56] to address the same remote inference privacy [57, 58, 59, 60] as well as integrity [57].”
A Roadmap Toward the Resilient Internet of Things for Cyber-Physical Systems (2018, methodology): “A common approach is to encrypt the data or underlying model [190– 192].”
Membership Inference Attacks on Machine Learning: A Survey (2021, background): “[196] 2020 ICML Classification Black-box Prediction confidence Causal learning Random guess ASR Child, Alarm Sachs, Water colored-MNIST [58] 2021 CVPR Classification Black-box Prediction entropy Prediction perturbation - AUC CIFAR-100”