[Paper Review] GuardNN: Secure Accelerator Architecture for Privacy-Preserving Deep Learning

Weizhe Hua, Muhammad Umar+2 more|arXiv (Cornell University)|Aug 26, 2020

Adversarial Robustness in Machine Learning4 citations

TL;DR

GuardNN proposes a hardware-protected DNN accelerator that ensures end-to-end confidentiality and integrity of model weights, inputs, and outputs in untrusted environments. By customizing the instruction set and memory protection for DNN workloads, it achieves ~3% performance overhead on FPGA while reducing the trusted computing base to just the accelerator, enabling high-performance, privacy-preserving inference and training.

ABSTRACT

This paper proposes GuardNN, a secure DNN accelerator that provides hardware-based protection for user data and model parameters even in an untrusted environment. GuardNN shows that the architecture and protection can be customized for a specific application to provide strong confidentiality and integrity guarantees with negligible overhead. The design of the GuardNN instruction set reduces the TCB to just the accelerator and allows confidentiality protection even when the instructions from a host cannot be trusted. GuardNN minimizes the overhead of memory encryption and integrity verification by customizing the off-chip memory protection for the known memory access patterns of a DNN accelerator. GuardNN is prototyped on an FPGA, demonstrating effective confidentiality protection with ~3% performance overhead for inference.

Motivation & Objective

• Address the lack of high-performance, privacy-preserving DNN acceleration in untrusted environments such as cloud or mobile platforms.
• Overcome the performance and security limitations of general-purpose TEEs (e.g., Intel SGX) for large-scale ML workloads.
• Minimize the trusted computing base (TCB) by isolating security-critical components within a domain-specific accelerator.
• Enable confidentiality protection even when the host CPU is untrusted, through a custom instruction set and off-chip memory encryption.
• Optimize memory protection for DNN-specific access patterns to reduce encryption and integrity verification overhead.

Proposed method

• Design a custom instruction set that ensures all private data remain encrypted outside the accelerator, even when instructions are untrusted.
• Implement hardware-based memory encryption and integrity verification tailored to the predictable, regular memory access patterns of DNN inference and training.
• Use a unique private key per accelerator instance for remote authentication and secure key exchange with remote users.
• Integrate remote attestation and off-chip integrity verification to detect unauthorized modifications to the accelerator state.
• Leverage application-specific simplicity of DNN accelerators to minimize TCB and prevent side-channel leaks via fixed execution timing and memory access patterns.
• Prototype GuardNN on an FPGA using CHaiDNN as a baseline, with custom firmware and protection logic implemented on a microcontroller.

Experimental results

Research questions

• RQ1 Can a domain-specific accelerator provide stronger security and lower performance overhead than general-purpose TEEs for DNN inference and training?
• RQ2 To what extent can application-specific knowledge of DNN memory access patterns reduce the overhead of memory encryption and integrity verification?
• RQ3 Is it possible to achieve strong confidentiality and integrity guarantees with a minimal trusted computing base (TCB) when the host CPU is untrusted?
• RQ4 How does the performance of a hardware-protected DNN accelerator compare to general-purpose TEEs and MPC-based solutions in real-world workloads?
• RQ5 Can a secure accelerator remain secure against memory and timing side-channel attacks through predictable execution behavior?

Key findings

• GuardNN achieves ~3% performance overhead for DNN inference on an FPGA prototype, demonstrating minimal impact on real-world workloads.
• The memory encryption and integrity verification overhead is negligible due to customization for known DNN memory access patterns.
• The trusted computing base (TCB) is reduced to only the accelerator hardware, as the host CPU and software stack are untrusted.
• GuardNN outperforms CPU-based TEEs by three orders of magnitude in performance and energy efficiency, with CPU TEEs adding over 60% overhead on the same benchmarks.
• The design is secure against memory and timing side-channel attacks due to fixed access patterns and constant-time execution, independent of input or weight values.
• Compared to MPC-based approaches, GuardNN offers significantly lower performance overhead while maintaining strong security guarantees, making it suitable for high-throughput, large-scale ML workloads.