[Paper Review] Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective

Kha Dinh Duy, Taehyun Noh+2 more|arXiv (Cornell University)|Nov 5, 2021

Security and Verification in Computing4 citations

TL;DR

This paper presents a comprehensive survey of confidential machine learning computation in untrusted environments using Trusted Execution Environments (TEEs), focusing on attack vectors, multi-party security requirements, and engineering challenges. It systematizes threats like side-channel attacks, analyzes TEE-based solutions for cloud and edge deployments, and identifies future research directions in secure accelerators, on-line training, and integrated model confidentiality defenses.

ABSTRACT

As machine learning (ML) technologies and applications are rapidly changing many computing domains, security issues associated with ML are also emerging. In the domain of systems security, many endeavors have been made to ensure ML model and data confidentiality. ML computations are often inevitably performed in untrusted environments and entail complex multi-party security requirements. Hence, researchers have leveraged the Trusted Execution Environments (TEEs) to build confidential ML computation systems. We conduct a systematic and comprehensive survey by classifying attack vectors and mitigation in confidential ML computation in untrusted environments, analyzing the complex security requirements in multi-party scenarios, and summarizing engineering challenges in confidential ML implementation. Lastly, we suggest future research directions based on our study.

Motivation & Objective

• To systematically analyze security threats and mitigation strategies in confidential machine learning computations within untrusted environments such as cloud and edge platforms.
• To examine the complex security requirements arising in multi-party ML scenarios involving mutually distrusting entities like model owners, data contributors, and service providers.
• To identify and address key engineering challenges in implementing confidential ML systems, including TEE memory limitations and ML framework porting.
• To explore underexplored research areas such as edge-based confidential ML, secure accelerators, and on-line training with confidentiality guarantees.
• To propose a comprehensive, future-oriented research agenda for advancing secure and confidential machine learning systems in practice.

Proposed method

• Classifying and analyzing attack vectors in TEE-protected ML computations, particularly side-channel attacks targeting Intel SGX and ARM TrustZone.
• Surveying over 140 works to evaluate TEE-based confidential ML systems, focusing on Intel SGX for cloud and ARM TrustZone for edge computing.
• Analyzing multi-party security requirements in confidential ML, including trust trade-offs between model owners, data providers, and platform operators.
• Evaluating engineering trade-offs such as batch size reduction due to TEE memory constraints and challenges in porting ML frameworks like PyTorch and TensorFlow to TEEs.
• Proposing future system designs for secure accelerators (e.g., GPU, NPU) that support confidential ML workloads without compromising confidentiality.
• Integrating in-system attacks (e.g., side-channels) with external threats (e.g., API-based model reconstruction) to advocate for holistic model confidentiality protection.

Experimental results

Research questions

• RQ1 What are the primary in-system attack vectors threatening model and data confidentiality in TEE-protected ML computations?
• RQ2 How do multi-party trust dynamics in ML workflows affect the design and security guarantees of confidential ML systems?
• RQ3 What are the key engineering challenges in deploying confidential ML on TEEs, especially regarding memory constraints and framework porting?
• RQ4 What are the open research challenges in enabling confidential on-line training and secure hardware accelerators for ML workloads?
• RQ5 How can in-system side-channel attacks and external API-based model inversion attacks be jointly mitigated to ensure end-to-end model confidentiality?

Key findings

• Side-channel attacks remain a major threat to TEE-protected ML computations, particularly in cloud environments using Intel SGX, with multiple practical exploitation vectors demonstrated.
• ARM TrustZone-based confidential ML systems are under-researched compared to SGX, despite increasing demand for on-device and edge ML security.
• Current TEE-based ML systems face significant performance and scalability limitations due to constrained memory, often requiring workloads to be split into smaller batches.
• Porting popular ML frameworks like PyTorch and TensorFlow to TEEs is highly complex and results in a large trusted codebase, increasing attack surface.
• No commercially available secure accelerator (e.g., GPU or NPU) exists that natively supports confidential ML workloads, though prototype designs like Graviton and SafeTPU show promise.
• The combination of in-system side-channel attacks and external API-based model reconstruction attacks remains unexplored, highlighting a critical gap in comprehensive model confidentiality protection.