Chiron: Privacy-preserving Machine Learning as a Service

By Tyler Hunt, Congzheng Song, Reza Shokri, Vitaly Shmatikov, Emmett Witchel. 2018

225 citations recorded by the source corpus.

Major cloud operators offer machine learning (ML) as a service, enabling customers who have the data but not ML expertise or infrastructure to train predictive models on this data. Existing ML-as-a-service platforms require users to reveal all training data to the service operator. We design, implement, and evaluate Chiron, a system for privacy-preserving machine learning as a service. First, Chiron conceals the training data from the service operator. Second, in keeping with how many existing ML-as-a-service platforms work, Chiron reveals neither the training algorithm nor the model structure to the user, providing only black-box access to the trained model. Chiron is implemented using SGX enclaves, but SGX alone does not achieve the dual goals of data privacy and model confidentiality. Chiron runs the standard ML training toolchain (including the popular Theano framework and C compiler) in an enclave, but the untrusted model-creation code from the service operator is further confined in a Ryoan sandbox to prevent it from leaking the training data outside the enclave. To support distributed training, Chiron executes multiple concurrent enclaves that exchange model parameters via a parameter server. We evaluate Chiron on popular deep learning models, focusing on benchmark image classification tasks such as CIFAR and ImageNet, and show that its training performance and accuracy of the resulting models are practical for common uses of ML-as-a-service.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware (2018, methodology): “Yet, SGX’s security comes at a performance cost, and there remains a large gap between TEEs and untrusted devices.”
DarkneTZ: towards model privacy at the edge using trusted execution environments (2020, background): “and [24]) is to preserve the privacy of a user’s data during inference, while the protection on edge devices preserves both the model privacy and the privacy of the data used in training this model.”
Efficient Deep Learning on Multi-Source Private Data (2018, methodology): “Concurrent work of Hunt et al. [19] introduces Chiron, a system for privacy-preserving ML as a service (MLaaS).”
Privacy-preserving Machine Learning through Data Obfuscation (2018, methodology): “[17] used Intel SGX to restrict the confidential training data from being leaked to adversaries.”
YerbaBuena: Securing Deep Learning Inference Data via Enclave-based Ternary Model Partitioning (2018, methodology): “We have discussed and compared with recent research efforts[22, 23, 38] of employing SGX for privacy-preserving machine learning tasks.”
CrypTFlow: Secure TensorFlow Inference (2019, methodology): “recent results ([61], [75], [57], [25], [44]) in the area of secure machine learning, both in the 2-party [17], [67], [34], [55], [49], [58], [84], as well as in the 3-party setting [72], [60], [79], [12].”
PPFL: privacy-preserving federated learning with trusted execution environments (2021, methodology): “Running ML inside TEEs can hide model parameters from REE adversaries and consequently preserve privacy, as already used for light data analytics on servers [54, 62] and for heavy computations such as DNN training [18, 23, 49, 70].”
Occlumency: Privacy-preserving Remote Deep-learning Inference Using SGX (2019, methodology): “Chiron [41], Ryoan [42], and Slalom [71] used SGX for ML-inference tasks, including both training and inference.”
Model inversion attacks against collaborative inference (2019, methodology): “The SGX security enclaves in Intel processors were used to protect the training tasks against privileged adversaries [24, 34].”
MLCapsule: Guarded Offline Deployment of Machine Learning as a Service (2018, methodology): “[15] used SGX for ML – however in the context of training convolutional neural network models.”
ABY2.0: Improved Mixed-Protocol Secure Two-Party Computation (2020, background): “In the domain of PPML [30, 31, 73, 75], we show that Logistic Regression and Neural Networks can be substantially improved with our building blocks.”
ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models (2018, background): “Besides the above, other recent works on security and privacy in machine learning include [21], [28], [37]”
DarKnight: A Data Privacy Scheme for Training and Inference of Deep Neural Networks (2020, methodology): “Our idea relies on TEEs to perform private inference or training in a secure hardware [5, 6, 7, 8, 9, 10].”
Shredder: Learning Noise Distributions to Protect Inference Privacy (2019, methodology): “ironments. Several research propose running machine learning algorithms in in trusted execution environments such as Intel SGX [55] and ARM TrustZone [56] to address the same remote inference privacy [57, 58, 59, 60] as well as integrity [57]. However, the privacy model in that research requires use”
Shredder: Learning Noise to Protect Privacy with Partial DNN Inference on the Edge (2019, methodology): “Several research propose running machine learning algorithms in in trusted execution environments such as Intel SGX [55] and ARM TrustZone [56] to address the same remote inference privacy [57, 58, 59, 60] as well as integrity [57].”