TEE-Partitioned Neural Network Inference for Input Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep learning systems face concerns regarding the confidentiality of end users' input data due to potential security breaches, malicious attacks, and data thefts, which can lead to accidental disclosure of sensitive information.
Innovation Solution
The system partitions deep learning inference pipelines into a FrontNet and a BackNet, utilizing a trusted execution environment (TEE) to protect the confidentiality and integrity of user inputs in the FrontNet model, with optional automated mechanisms to determine the partition point for optimal privacy and performance balance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Power
If deep learning systems process user input data in cloud services, then computational capability and service functionality are improved, but data confidentiality and security are compromised due to potential security breaches and malicious attacks
Solution Approach 1:
The deep learning model is partitioned into two distinct subnets: FrontNet that processes data within the TEE environment, and BackNet that operates outside the TEE. This segmentation allows the system to leverage the computational power of cloud-based deep learning while isolating sensitive user input data processing within the secure TEE boundary, thus resolving the contradiction between computational capability and data confidentiality.
Solution Approach 2:
The Trusted Execution Environment (TEE) acts as an intermediary between the user input data and the deep learning processing system. The TEE provides a hardware-based secure environment that mediates the processing of sensitive data, ensuring confidentiality while still allowing the deep learning model to access and process the data for computational tasks.
2Reliability
If all deep learning computations are performed within a trusted execution environment, then data privacy is improved, but computational performance and processing speed deteriorate due to TEE overhead
Solution Approach 1:
By dividing the deep learning model into FrontNet and BackNet subnets, the system can place only the privacy-critical FrontNet within the TEE environment, while executing the BackNet outside the TEE where computational performance is not constrained by security overhead. This segmentation optimizes both privacy protection and computational efficiency.
Solution Approach 2:
Instead of placing the entire deep learning model within the TEE, the system applies TEE protection partially - only to the FrontNet portion that directly processes user input data. This partial application of security measures achieves sufficient privacy protection while minimizing the performance overhead associated with TEE execution.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Mechanisms are provided to implement an enhanced privacy deep learning system framework (hereafter "framework"). The framework receives, from a client computing device, an encrypted first subnet model of a neural network, where the first subnet model is one partition of multiple partitions of the neural network. The framework loads the encrypted first subnet model into a trusted execution environment (TEE) of the framework, decrypts the first subnet model, within the TEE, and executes the first subnet model within the TEE. The framework receives encrypted input data from the client computing device, loads the encrypted input data into the TEE, decrypts the input data, and processes the input data in the TEE using the first subnet model executing within the TEE.