[Paper Review] Chiron: Privacy-preserving Machine Learning as a Service

Tyler Hunt, Congzheng Song+3 more|arXiv (Cornell University)|Mar 15, 2018

Adversarial Robustness in Machine LearningComputer Science20 references177 citations

TL;DR

Chiron enables training ML models on outsourced services without revealing training data, by using SGX enclaves and a Ryoan sandbox to confine the provider’s code and data. It supports distributed training via a parameter server while preserving model confidentiality and data privacy.

ABSTRACT

Major cloud operators offer machine learning (ML) as a service, enabling customers who have the data but not ML expertise or infrastructure to train predictive models on this data. Existing ML-as-a-service platforms require users to reveal all training data to the service operator. We design, implement, and evaluate Chiron, a system for privacy-preserving machine learning as a service. First, Chiron conceals the training data from the service operator. Second, in keeping with how many existing ML-as-a-service platforms work, Chiron reveals neither the training algorithm nor the model structure to the user, providing only black-box access to the trained model. Chiron is implemented using SGX enclaves, but SGX alone does not achieve the dual goals of data privacy and model confidentiality. Chiron runs the standard ML training toolchain (including the popular Theano framework and C compiler) in an enclave, but the untrusted model-creation code from the service operator is further confined in a Ryoan sandbox to prevent it from leaking the training data outside the enclave. To support distributed training, Chiron executes multiple concurrent enclaves that exchange model parameters via a parameter server. We evaluate Chiron on popular deep learning models, focusing on benchmark image classification tasks such as CIFAR and ImageNet, and show that its training performance and accuracy of the resulting models are practical for common uses of ML-as-a-service.

Motivation & Objective

• Enable data owners to train ML models on outsourced infrastructure without revealing training data to the service provider.
• Preserve model confidentiality and limit exposure to the user by keeping model details private.
• Support distributed, concurrent training with a parameter server while ensuring data privacy.
• Provide a verifiable, hardware-assisted execution environment for the ML toolchain and training process.

Proposed method

• Use SGX enclaves to run a generic ML toolchain (Theano) inside a protected environment.
• Constrain the service provider’s untrusted code with a Ryoan sandbox to prevent data leakage.
• Separate model design (proprietary to the provider) from model training (generic process).
• Coordinate distributed training across multiple enclaves via a parameter server with fixed-rate, data-oblivious exchanges.
• Output encrypted trained models accessible only through user-controlled query enclaves and keys.

Experimental results

Research questions

• RQ1 How can privacy of training data be preserved when ML models are trained on outsourced infrastructure?
• RQ2 Can untrusted provider code be confined so that it cannot exfiltrate training data while allowing flexible model design and training?
• RQ3 What is the impact of hardware-based enclaves and sandboxing on training performance and model accuracy in common benchmarks?
• RQ4 How can distributed ML training be securely coordinated across multiple enclaves without leaking data?
• RQ5 What are the security and practicality implications of using Chiron for ML-as-a-service in real-world benchmarks like CIFAR and ImageNet?

Key findings

• Chiron enables training on outsourced infrastructure with data confidentiality and black-box model access to users.
• A combination of SGX enclaves and the Ryoan sandbox confines untrusted provider code while running a standard ML toolchain inside the enclave.
• Distributed training is supported via a parameter server with secure, fixed-rate exchanges between enclaves.
• The approach is evaluated on standard deep learning benchmarks such as CIFAR and ImageNet, focusing on convergence times, scalability, and accuracy.
• Model training and inference remain practical for common ML-as-a-service use cases within the evaluated settings.