Secure Enclave for Privacy-Preserving Split Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed learning methods like Split Learning and Federated Learning are vulnerable to data reconstruction and model inversion attacks due to the exchange of intermediate updates, which can be used by malicious servers to reconstruct original training data.
Innovation Solution
Implementing secure enclaves on server and client devices to encrypt and decrypt data within a trusted environment, ensuring that sensitive information remains private and inaccessible to external applications, even if the underlying platform is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If distributed learning methods (Split Learning or Federated Learning) are used to train global models from decentralized datasets, then data privacy is partially preserved by keeping training data within owner's organization, but intermediate updates (smashed data) exchanged with the server can be exploited by malicious servers to reconstruct original training data through data reconstruction attacks or model inversion attacks
Solution Approach 1:
The patent introduces a secure enclave as an intermediary trusted execution environment between the client and server. The secure enclave acts as a mediator that receives smashed data, performs forward propagation to generate predictions, computes loss values, and returns gradients to the client without allowing the malicious server to access the original training data. This intermediary layer preserves the benefits of distributed learning while blocking the attack vector.
Solution Approach 2:
The patent creates a secure, isolated execution environment (secure enclave) that acts as an inert atmosphere protecting the training data from external attacks. Within this trusted environment, the server can process smashed data without the risk of data reconstruction attacks, as the enclave's security mechanisms prevent unauthorized access and extraction of sensitive information.
2Reliability
If a secure enclave is implemented on the server side to prevent malicious servers from reconstructing original training data, then data privacy protection is improved, but the device complexity and computational overhead increase
Solution Approach 1:
The patent segments the learning system into distinct components with clear boundaries: the client device, the secure enclave, and the external server. By dividing the system this way, the complex security requirements are isolated to the secure enclave component, while the rest of the system can operate with standard security measures. This segmentation makes the overall system more manageable despite the complexity introduced by the enclave.
Data Source
AI summary
A system and method are disclosed for providing a privacy-preserving training approach for split learning methods, including blind learning. A method includes receiving, at a server device, encrypted smashed data from a client device, using a secure enclave on the server device, moving, on the server device, a server model, the encrypted smashed data and computer code for a blind learning operation into the secure enclave, performing, in the secure enclave, forward propagation using the decrypted smashed data to generate predicted values, comparing the predicted values to true labels using a loss function to yield a loss value, repeating the comparing step for all smashed data received at the server device from a plurality of clients to yield a plurality of loss values, averaging the plurality of loss values to yield an average loss value, updating model weights of the server model using the average loss value to yield gradients of the smashed data and transmitting the gradients of the smashed data to the client device.