[Paper Review] Trustworthy AI Inference Systems: An Industry Research View

Rosario Cammarota, Matthias Schunter+27 more|arXiv (Cornell University)|Aug 10, 2020

Adversarial Robustness in Machine Learning88 references4 citations

TL;DR

This paper presents a comprehensive industry research perspective on designing, deploying, and operating trustworthy AI inference systems that ensure data privacy, model intellectual property protection, and system security. It integrates trusted execution environments and advanced cryptographic techniques—such as homomorphic encryption and secure multi-party computation—to enable private, secure, and explainable AI inference across cloud, edge, and on-device deployments.

ABSTRACT

In this work, we provide an industry research view for approaching the design, deployment, and operation of trustworthy Artificial Intelligence (AI) inference systems. Such systems provide customers with timely, informed, and customized inferences to aid their decision, while at the same time utilizing appropriate security protection mechanisms for AI models. Additionally, such systems should also use Privacy-Enhancing Technologies (PETs) to protect customers' data at any time. To approach the subject, we start by introducing current trends in AI inference systems. We continue by elaborating on the relationship between Intellectual Property (IP) and private data protection in such systems. Regarding the protection mechanisms, we survey the security and privacy building blocks instrumental in designing, building, deploying, and operating private AI inference systems. For example, we highlight opportunities and challenges in AI systems using trusted execution environments combined with more recent advances in cryptographic techniques to protect data in use. Finally, we outline areas of further development that require the global collective attention of industry, academia, and government researchers to sustain the operation of trustworthy AI inference systems.

Motivation & Objective

• Address the growing need for trustworthy AI inference systems that protect both private customer data and proprietary AI models.
• Examine the interplay between data privacy, model IP protection, and regulatory compliance in real-world AI deployments.
• Identify critical security and privacy challenges in AI inference, including side-channel attacks and model inversion.
• Propose architectural and cryptographic building blocks to enable secure, private, and composable AI inference systems.
• Call for coordinated industry-academia-government efforts to accelerate adoption of privacy-preserving AI technologies.

Proposed method

• Survey and evaluate existing security and privacy building blocks, including trusted execution environments (TEEs), homomorphic encryption, and secure multi-party computation (sMPC).
• Analyze the integration of TEEs with modern cryptographic techniques to protect data in use during AI inference.
• Assess the feasibility and performance trade-offs of deploying privacy-enhancing technologies (PETs) in real-world AI systems.
• Highlight challenges in physical and side-channel security, especially for specialized AI accelerators.
• Explore the use of explainable AI (XAI) techniques like saliency maps and LIME to improve model interpretability without compromising privacy.
• Propose hybrid architectural solutions combining hardware isolation, cryptography, and secure computation for end-to-end trust.

Experimental results

Research questions

• RQ1 How can AI inference systems be architected to ensure data confidentiality and model integrity across untrusted environments?
• RQ2 What are the key technical and operational challenges in deploying privacy-enhancing technologies (PETs) like homomorphic encryption and sMPC in production AI systems?
• RQ3 How can side-channel attacks—especially timing and power-based leaks—be effectively mitigated in AI inference hardware?
• RQ4 In what ways do privacy-preserving techniques conflict with model explainability, and how can this tension be resolved?
• RQ5 What role can standardization and public-private collaboration play in accelerating the adoption of trustworthy AI inference systems?

Key findings

• Privacy-by-design principles, including end-to-end protection of data in use, are essential for compliance with regulations like GDPR and CCPA.
• Despite their theoretical promise, privacy-enhancing cryptographic techniques such as homomorphic encryption face significant performance and programming complexity barriers to widespread adoption.
• Side-channel attacks remain a critical threat, especially in AI accelerators, and require custom, low-level defenses that are difficult to implement and verify.
• The integration of explainable AI (XAI) tools with privacy-preserving systems is challenging, as model owners lose visibility into inputs and outputs, complicating bias detection.
• Hybrid approaches combining TEEs with advanced cryptography offer a viable path toward secure, private, and efficient AI inference.
• Significant investment and coordinated efforts across industry, academia, and government are needed to standardize and scale trustworthy AI inference systems.