Partitioned AI Model Secure Execution Area
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for protecting sensitive training data for AI models, such as deep learning models, face challenges including high overhead from homomorphic encryption, inability to use accelerators, complex multi-party federate learning frameworks, and high costs associated with trusted execution environments.
Innovation Solution
The proposed solution involves partitioning an AI model into a secure and a non-secure execution environment, where sensitive data is processed in the secure environment and the results are communicated to the non-secure environment for further computation using model parallelism, allowing the use of accelerators while maintaining data protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If homomorphic encryption is used to protect sensitive training data, then data security is improved, but computational overhead increases significantly
Solution Approach 1:
The AI model is segmented into multiple partitions, with only the first partition executed in the secure trusted execution environment (TEE). This segmentation allows the system to protect sensitive data during initial processing while avoiding the need to execute the entire model in the resource-intensive TEE, thereby reducing computational overhead while maintaining data security.
2Reliability
If trusted execution environment is used to protect sensitive data, then data security is improved, but system cost increases
Solution Approach 1:
The model is divided into partitions where only the first partition requires TEE execution for data protection. Subsequent partitions can execute in standard environments, reducing the need for expensive TEE resources while maintaining security for the most sensitive operations.
Solution Approach 2:
Instead of executing the entire model in the expensive TEE environment, the system applies TEE protection only to the extent necessary - specifically the first partition that processes sensitive training data. This partial application of TEE reduces system costs while maintaining adequate security.
3Reliability
If multi-party federate learning framework is used to protect sensitive data, then data security is improved, but framework complexity increases
Solution Approach 1:
The learning framework is segmented into a secure component (first partition in TEE) and a non-secure component (subsequent partitions). This segmentation simplifies the overall framework by clearly separating security-critical operations from standard processing, avoiding the complexity of multi-party federate learning while maintaining data protection.
4Productivity
If accelerators are used to improve computation speed, then productivity is improved, but data security is compromised
Solution Approach 1:
The model execution is segmented such that only the first partition runs in the secure TEE environment, while subsequent partitions can utilize accelerators for high-speed computation. This segmentation enables the system to maintain data security during sensitive operations while achieving high productivity through accelerator usage in non-sensitive processing stages.
Data Source
AI summary
Techniques for training data protection in an artificial intelligence model execution environment are disclosed. For example, a method comprises executing a first partition of an artificial intelligence model within a secure execution area of an information processing system and a second partition of the artificial intelligence model within a non-secure execution area of the information processing system, wherein data at least one of obtained and processed in the first partition of the artificial intelligence model is inaccessible to the second partition of the artificial intelligence model. Communication between the first partition and the second partition may be enabled via a model parallelism-based procedure. Data obtained in the secure execution area may comprise one or more data samples in an encrypted form usable to train the artificial intelligence model.