AIセキュリティポータル K Program
Privacy preserving layer partitioning for Deep Neural Network models
Share
Abstract
MLaaS (Machine Learning as a Service) has become popular in the cloud computing domain, allowing users to leverage cloud resources for running private inference of ML models on their data. However, ensuring user input privacy and secure inference execution is essential. One of the approaches to protect data privacy and integrity is to use Trusted Execution Environments (TEEs) by enabling execution of programs in secure hardware enclave. Using TEEs can introduce significant performance overhead due to the additional layers of encryption, decryption, security and integrity checks. This can lead to slower inference times compared to running on unprotected hardware. In our work, we enhance the runtime performance of ML models by introducing layer partitioning technique and offloading computations to GPU. The technique comprises two distinct partitions: one executed within the TEE, and the other carried out using a GPU accelerator. Layer partitioning exposes intermediate feature maps in the clear which can lead to reconstruction attacks to recover the input. We conduct experiments to demonstrate the effectiveness of our approach in protecting against input reconstruction attacks developed using trained conditional Generative Adversarial Network(c-GAN). The evaluation is performed on widely used models such as VGG-16, ResNet-50, and EfficientNetB0, using two datasets: ImageNet for Image classification and TON IoT dataset for cybersecurity attack detection.
Innovative instructions and software model for isolated execution.
F. McKeen, I. Alexandrovich, A. Berenzon, C. V. Rozas, H. Shafi, V. Shanbhogue, U. R. Savagaonkar
Published: 2013
Ton iot telemetry dataset: A new generation dataset of iot and iiot for data-driven intrusion detection systems
A. Alsaedi, N. Moustafa, Z. Tari, A. Mahmood, A. Anwar
Published: 2020
Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy
Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, John Wensing
Published: 2016
Delphi: A cryptographic inference system for neural networks
Pratyush Mishra, Ryan Lehmkuhl, Akshayaram Srinivasan, Wenting Zheng, Raluca Ada Popa
Published: 2020
Securenn: 3-party secure computation for neural network training
Sameer Wagh, Divya Gupta, Nishanth Chandran
Published: 2019
Learning with privacy at scale
A. Team et al.
Published: 2017
ennclave: offline inference with model confidentiality
A. Schlogl, R. B ¨ ohme
Published: 2020
Aegisdnn: Dependable and timely execution of dnn tasks with sgx
Yecheng Xiang, Yidi Wang, Hyunjong Choi, Mohsen Karimi, Hyoseung Kim
Published: 2021
Slalom: Fast verifiable and private execution of neural networks in trusted hardware
F. Tramr, D. Boneh
Published: 2019
Origami inference: private inference using hardware enclaves
K. G. Narra, Z. Lin, Y. Wang, K. Balasubramanian, M. Annavaram
Published: 2021
Graphene-SGX: A practical library OS for unmodified applications on SGX
C.-C. Tsai, D. E. Porter, M. Vij
Published: 2017
Very deep convolutional networks for large-scale image recognition
K. Simonyan, A. Zisserman
Published: 2015
Deep residual learning for image recognition
Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun
Published: 2016
EfficientNet: Rethinking model scaling for convolutional neural networks
Mingxing Tan, Quoc Le
Published: 2019
Intrusion detection in internet of things using convolutional neural networks
M. Kodys, Z. Lu, K. W. Fok, V. L. Thing
Published: 2021
Share