Trusted ML Inference Execution Without Model Secret Leakage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The protection of sensitive data and model secrets during machine learning model training and inference is a critical issue, as existing secure computing technologies face challenges in ensuring that model providers' and users' secrets are not leaked.
Innovation Solution
A system and method involving encrypted machine learning models, trusted processing circuits, and secure communication protocols are employed to ensure that only valid and trusted processing circuits can decrypt and execute the models, with additional safeguards like blind signatures and usage limits to prevent unauthorized access and data leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the machine learning model is provided in plaintext to the user, then the model can be executed and used effectively, but the model secrets (structure and weights) can be retrieved and leaked
Solution Approach 1:
A trusted processing circuit acts as an intermediary between the model provider and model user. The circuit receives the plaintext model, executes inference operations, and returns results without allowing direct access to the model parameters. This mediator ensures the model can be used effectively while preventing secret retrieval.
Solution Approach 2:
The inference capability is extracted from the model itself and transferred to the trusted processing circuit. By separating the execution environment from the model parameters, the system allows model usage while isolating the secrets within the secure trusted circuit.
2Reliability
If the machine learning model is encrypted to protect secrets, then model security is improved, but the model cannot be directly executed and usability deteriorates
Solution Approach 1:
The trusted processing circuit serves as an intermediary that handles the decryption and execution process. It receives encrypted model data, decrypts it within the secure environment, executes the inference, and returns results. This allows the model to remain encrypted during transmission while being executable within the trusted circuit.
Solution Approach 2:
The system changes the state of the model from encrypted (for security) to decrypted (for execution) within the controlled environment of the trusted processing circuit. This parameter change is managed securely, allowing the model to transition between security and executability states as needed.
3Productivity
If the model is made accessible to users for inference, then the model utility is improved, but data secrets may be leaked during usage
Solution Approach 1:
The trusted processing circuit acts as an intermediary that processes user data through the model without exposing either the model secrets or the user data secrets. All computations occur within the secure boundary of the trusted circuit, preventing leakage of sensitive information while maintaining model utility.
Solution Approach 2:
The system preemptively prevents data secret leakage by establishing secure computation boundaries before any data processing occurs. The trusted processing circuit creates a protected environment where data secrets cannot be extracted, countering potential leakage before it can happen.
Data Source
AI summary
The present disclosure provides a system including first to second electronic devices. The first electronic device includes a first processor configured to encrypt a machine learning model to generate an encrypted machine learning model. The second electronic device includes a second processor configured to receive the encrypted machine learning model; and a trusted processing circuit configured to decrypt the encrypted machine learning model to get the machine learning model. The third electronic device includes a database configured to store public keys; and a third processor configured to perform a check operation to check whether a first public key of the trusted processing circuit is in the public keys to determine whether the trusted processing circuit is valid. The first processor is further configured to transmit the encrypted machine learning model to the second processor according to the trusted processing circuit determined valid.