Secure Machine Learning Network Execution via uTEE and TEE Correction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for executing machine learning networks face challenges in balancing security and efficiency, particularly in protecting the confidentiality of machine learning networks and preventing malicious access, while also managing limited computing resources and storage space.
Innovation Solution
The proposed solution involves executing at least a portion of the machine learning network in an untrusted execution environment (uTEE) and using a trusted execution environment (TEE) to correct intermediate outputs, thereby protecting the confidentiality of the network and ensuring accurate results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the machine learning network is executed entirely within a TEE to protect confidentiality, then security is improved, but execution efficiency and computing resource utilization deteriorate
Solution Approach 1:
The machine learning network is divided into two portions: a first portion executed in the uTEE with modified parameter values for efficiency, and a second portion executed in the TEE with correct parameter values for security-critical operations. This segmentation allows each portion to be optimized for its specific function, resolving the contradiction between security and efficiency.
Solution Approach 2:
The patent introduces an intermediary correction mechanism where the TEE corrects intermediate outputs from the uTEE by using secret data to reverse the parameter modifications. This intermediary correction process allows the system to benefit from both the efficiency of uTEE execution and the security of TEE protection without requiring the entire network to run in the TEE.
2Reliability
If parameter values are modified with secret data to protect confidentiality, then security is improved, but the complexity of executing and correcting computations increases
Solution Approach 1:
The patent extracts the correction functionality from the main execution flow by implementing it as a separate correction process in the TEE. This extraction allows the modification of parameter values in the uTEE without permanently increasing system complexity, as the correction logic is isolated and can be applied selectively to intermediate outputs.
3Productivity
If the entire machine learning network is deployed in uTEE to improve resource utilization, then productivity is improved, but security protection deteriorates
Solution Approach 1:
Different portions of the machine learning network are assigned different execution qualities: the first portion operates in the less secure but more efficient uTEE with modified parameters, while the second portion operates in the secure TEE with correct parameters. This local differentiation allows the system to optimize resource utilization where security is less critical while maintaining protection where it matters most.
Data Source
AI summary
According to implementations of the subject matter described herein, there is provided a solution for secure execution of a machine learning network. An operation of a first network layer of a machine learning network is executed in an uTEE of a computing device based on an input of the first network layer and a first set of modified parameter values, to obtain a first error intermediate In output. The modified parameter values are determined by modifying at least one subset of parameter values of the first network layer with first secret data. A first corrected intermediate output is determined in a TEE of the computing device by modifying the first error intermediate output at least based on the input and first secret data. A network output is determined based on the first corrected intermediate output. In this way, it is possible to protect the confidentiality of the machine learning network.