Confidential ML via Program Compartmentalization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to attacks and reverse-engineering due to their deployment in plain or binary code formats, leading to confidentiality issues and significant swapping overhead during execution, which limits their utility.
Innovation Solution
Implementing program compartmentalization by annotating source code to identify sensitive parts, compiling the ML program, and inserting binary code to separate confidential and non-confidential components, with secure communication channels, to protect ML models within a private memory region like an enclave, reducing swapping overhead and enhancing execution efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If ML models are deployed in plain source or binary code format, then ease of operation is improved, but confidentiality is worsened due to vulnerability to attacks and reverse-engineering
Solution Approach 1:
The patent divides the ML program into confidential and non-confidential parts, placing only essential confidential code and data into the enclave. This segmentation allows the system to maintain ease of operation for non-confidential portions while protecting confidential portions, resolving the contradiction between deployment ease and confidentiality.
Solution Approach 2:
The patent introduces an enclave as an intermediary trusted execution environment that mediates between the need for easy deployment and the requirement for confidentiality. The enclave acts as a secure boundary that protects ML models from attacks while allowing controlled access and operation.
2Reliability
If entire ML program is placed in private memory region for confidentiality protection, then confidentiality is improved, but device complexity and execution overhead are worsened
Solution Approach 1:
The patent extracts only the essential confidential parts of the ML program and places them in the private memory region (enclave), while leaving non-confidential parts outside. This extraction reduces the size of data requiring swapping between memory and disk, thereby reducing execution overhead while maintaining confidentiality.
Solution Approach 2:
By segmenting the ML program into confidential and non-confidential portions, the patent minimizes the amount of data that needs to be protected in the enclave, reducing memory footprint and swapping overhead while maintaining necessary confidentiality protection.
Data Source
AI summary
A method for implementing confidential machine learning with program compartmentalization includes implementing a development stage to design an ML program, including annotating source code of the ML program to generate an ML program annotation, performing program analysis based on the development stage, including compiling the source code of the ML program based on the ML program annotation, inserting binary code based on the program analysis, including inserting run-time code into a confidential part of the ML program and a non-confidential part of the ML program, and generating an ML model by executing the ML program with the inserted binary code to protect the confidentiality of the ML model and the ML program from attack.