[Paper Review] Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware

Florian Tramèr, Dan Boneh|arXiv (Cornell University)|Jun 8, 2018

Adversarial Robustness in Machine LearningComputer Science46 references226 citations

TL;DR

Slalom partitions DNN inference between a trusted execution environment and an untrusted co-located processor, enabling fast, verifiable, and private neural network execution with significant throughput gains over running entirely in a TEE.

ABSTRACT

As Machine Learning (ML) gets applied to security-critical or sensitive domains, there is a growing need for integrity and privacy for outsourced ML computations. A pragmatic solution comes from Trusted Execution Environments (TEEs), which use hardware and software protections to isolate sensitive computations from the untrusted software stack. However, these isolation guarantees come at a price in performance, compared to untrusted alternatives. This paper initiates the study of high performance execution of Deep Neural Networks (DNNs) in TEEs by efficiently partitioning DNN computations between trusted and untrusted devices. Building upon an efficient outsourcing scheme for matrix multiplication, we propose Slalom, a framework that securely delegates execution of all linear layers in a DNN from a TEE (e.g., Intel SGX or Sanctum) to a faster, yet untrusted, co-located processor. We evaluate Slalom by running DNNs in an Intel SGX enclave, which selectively delegates work to an untrusted GPU. For canonical DNNs (VGG16, MobileNet and ResNet variants) we obtain 6x to 20x increases in throughput for verifiable inference, and 4x to 11x for verifiable and private inference.

Motivation & Objective

• Motivate secure, high-performance outsourced ML in trusted execution environments for sensitive or security-critical applications.
• Propose a practical outsourcing framework that preserves integrity and privacy while leveraging faster untrusted hardware.
• Enable verifiable (and private) inference by outsourcing linear layers and using Freivalds’ algorithm for verification.
• Quantitatively evaluate throughput gains on canonical CNNs and discuss openness issues for verifiable training.
• Highlight design considerations and limitations of deploying Slalom in real TEEs.

Proposed method

• Quantize inputs and weights and embed them in a finite field to enable secure computation.
• Outsource linear layers to a faster untrusted processor and verify correctness using Freivalds’ probabilistic algorithm.
• Encrypt the inputs to preserve privacy via a pre-computed pseudorandom stream and recover outputs with offline pre-computed values.
• Maintain integrity by selectively outsourcing linear operations while non-linearities are computed inside the TEE.
• Provide two Slalom variants: one focused on integrity and another on privacy plus integrity.

Experimental results

Research questions

• RQ1 Can DNN inference be accelerated by outsourcing linear layers from a TEE to a co-located untrusted processor while maintaining integrity?
• RQ2 Can Slalom provide privacy for outsourced computations without prohibitive communication or computation overhead?
• RQ3 How much throughput improvement can verifiable (and private) inference achieve on canonical networks compared to running entirely in a TEE?
• RQ4 What are the practical considerations and limitations for deploying Slalom on TEEs like Intel SGX or Sanctum?
• RQ5 How does Slalom compare to existing cryptographic or baseline outsourcing approaches in terms of performance and security guarantees?

Key findings

• Outsourcing linear layers to a faster untrusted GPU while keeping non-linearities in the TEE achieves 6× to 20× throughput increase for verifiable inference.
• For verifiable and private inference, Slalom achieves 4× to 11× throughput gains over the baseline.
• Compared with running the full DNN in the TEE, Slalom substantially improves throughput and energy efficiency across VGG16, MobileNet, and ResNet variants.
• Freivalds’ algorithm provides a concrete, low-overhead integrity check for outsourced matrix multiplications.
• A two-stage approach with offline preprocessing can extend Slalom to private, verifiable inference without excessive online interaction.
• The framework is applicable to common CNN architectures and can be extended to residual networks.