[Paper Review] YerbaBuena: Securing Deep Learning Inference Data via Enclave-based Ternary Model Partitioning

Zhongshu Gu, Heqing Huang+6 more|arXiv (Cornell University)|Jul 3, 2018

Adversarial Robustness in Machine LearningComputer Science70 references27 citations

TL;DR

YerbaBuena proposes an enclave-based deep learning inference system that uses ternary model partitioning to securely isolate sensitive input data in trusted execution environments. By splitting models into secure enclave-executed and externally accelerated components, it achieves strong confidentiality with minimal performance overhead.

ABSTRACT

Deploying and serving deep learning (DL) models in the public cloud facilitates the process to bootstrap artificial intelligence (AI) services. Yet, preserving the confidentiality of sensitive input data remains a concern to most service users. Accidental disclosures of user input data may breach increasingly stringent data protection regulations and inflict reputation damage. In this paper, we systematically investigate the life cycles of input data in deep learning image classification pipelines and further identify the potential places for information disclosures. Based on the discovered insights, we build YerbaBuena, an enclave-based model serving system to protect the confidentiality and integrity of user input data. To accommodate the performance and capacity limitations of today's enclave technology, we employ a Ternary Model Partitioning strategy that allows service users to securely partition their proprietary DL models on local machines. Therefore, we can (I) enclose sensitive computation in a secure enclave to mitigate input information disclosures and (II) delegate non-sensitive workloads to run out of enclave with hardware-assisted DL acceleration. Our comprehensive partitioning analysis and workload measurement demonstrate how users can automatically determine the optimal partitioning for their models, thus to maximize confidentiality guarantees with low performance costs.

Motivation & Objective

• Address the confidentiality risks of user input data in public cloud-based deep learning inference pipelines.
• Identify critical points in the input data lifecycle where sensitive information may be exposed.
• Develop a system that enables secure model partitioning to isolate sensitive computations within hardware-protected enclaves.
• Minimize performance costs by delegating non-sensitive workloads to hardware-accelerated off-processor execution.

Proposed method

• Analyze the full lifecycle of input data in deep learning image classification pipelines to identify disclosure attack surfaces.
• Design a ternary model partitioning strategy that splits a model into three components: enclave-resident, off-processor, and shared layers.
• Use hardware-enforced trusted execution environments (e.g., Intel SGX) to execute sensitive computation and protect input data confidentiality.
• Leverage hardware-accelerated inference for non-sensitive components to mitigate performance bottlenecks of enclave execution.
• Automate the partitioning process using workload and security analysis to determine optimal splits that maximize confidentiality with minimal performance cost.
• Integrate with existing deep learning frameworks to enable seamless deployment and execution of partitioned models.

Experimental results

Research questions

• RQ1 Where in the deep learning inference pipeline are user input data most vulnerable to disclosure?
• RQ2 How can model partitioning be strategically applied to isolate sensitive computation within hardware-protected enclaves?
• RQ3 What performance and security trade-offs arise from partitioning deep learning models across trusted and untrusted execution environments?
• RQ4 Can automated partitioning strategies achieve high confidentiality with acceptable performance overhead in real-world workloads?

Key findings

• Input data disclosure risks exist at multiple stages in the inference pipeline, particularly during intermediate tensor computations.
• Ternary model partitioning enables secure execution of sensitive model components within hardware-protected enclaves while offloading less sensitive parts to accelerators.
• The proposed system achieves strong confidentiality guarantees by ensuring that no raw input data leaves the enclave environment.
• Workload measurements show that the performance overhead of enclave execution is minimized through intelligent partitioning and hardware acceleration.
• The automated partitioning strategy effectively balances security and performance, enabling practical deployment in cloud-based AI services.
• The system maintains integrity and confidentiality even under adversarial conditions targeting the untrusted execution environment.