Privacy-Preserving Machine Learning via Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Machine Learning as a Service (MLaaS) systems face challenges in preserving the privacy of source data and model secrecy, as they often require computationally intense cryptographic operations, leading to efficiency penalties and potential leakage of sensitive information.
Innovation Solution
The implementation of a trusted execution environment (TEE) and an untrusted processing system (UPS) within a host processing system, where the TEE performs secure computations and encrypts classifications, while the UPS handles linear operations, ensuring that only the TEE has access to unblinded data, thus maintaining data and model privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional MLaaS systems use cryptographic operations to preserve privacy, then data privacy is improved, but computational efficiency deteriorates due to intensive cryptographic computations
Solution Approach 1:
The patent introduces a Trusted Execution Environment (TEE) as an intermediary component between the untrusted server and client data. The TEE creates a secure enclave that acts as a mediator, allowing the server to process encrypted data without needing to decrypt it, thus preserving privacy while avoiding intensive cryptographic operations during inference. The TEE hardware provides trusted computation that eliminates the need for complex cryptographic protocols.
Solution Approach 2:
The patent replaces software-based cryptographic mechanisms with hardware-based Trusted Execution Environment. Instead of relying on software cryptographic libraries and protocols, the solution uses TEE hardware (such as Intel SGX) to provide security guarantees, substituting mechanical/software security with hardware-enforced security boundaries that are more efficient and reliable.
2Loss of information
If all computations are performed within TEE to ensure security, then data privacy is improved, but computational performance deteriorates due to limited TEE processing capabilities
Solution Approach 1:
The patent segments the machine learning computation into two distinct parts: (1) Training phase that occurs entirely within the TEE to ensure model secrecy and prevent model extraction attacks, and (2) Inference phase that can leverage untrusted server resources for improved performance. This segmentation allows each phase to use the most appropriate execution environment for its specific security and performance requirements.
Solution Approach 2:
The patent applies different security and performance characteristics to different parts of the system. The TEE provides high-security local quality for model training and sensitive operations, while allowing lower-security but higher-performance untrusted server environments for inference computations. This local quality differentiation optimizes both security and performance in their respective domains.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method of instantiating a machine learning model with a host processing system is provided. The host processing system includes a trusted execution environment (TEE) and an untrusted processing system (UPS). The method includes: preparing, with the host processing system, a compiler encoding an architecture of the machine learning model; receiving, from a client processing system, source data; and producing, with the compiler, software based on the received source data and model parameters stored on the host processing system. The software includes an untrusted software component for performance on the UPS and a trusted software component for performance on the TEE. The untrusted software component and the trusted software component are configured to, when performed in concert, instantiate the machine learning model.