# secureTF: A Secure TensorFlow Framework

arXiv: https://arxiv.org/abs/2101.08204 · HTML: https://mlsanity.com/paper/2101.08204/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 99 references that are in the map.
- First posted on arXiv 20 Jan 2021.

## Builds on (most cited first, 24 of 24)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Densely Connected Convolutional Networks](https://mlsanity.com/paper/1608.06993/) (2016)
- [Rethinking the Inception Architecture for Computer Vision](https://mlsanity.com/paper/1512.00567/) (2015)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learning](https://mlsanity.com/paper/1602.07261/) (2016)
- [Empirical Evaluation of Rectified Activations in Convolutional Network](https://mlsanity.com/paper/1505.00853/) (2015)
- [Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning](https://mlsanity.com/paper/1702.07464/) (2017)
- [Gazelle: A Low Latency Framework for Secure Neural Network Inference](https://mlsanity.com/paper/1801.05507/) (2018)
- [Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware](https://mlsanity.com/paper/1806.03287/) (2018)
- [CrypTFlow: Secure TensorFlow Inference](https://mlsanity.com/paper/1909.07814/) (2019)
- [Spectre Attacks: Exploiting Speculative Execution](https://mlsanity.com/paper/1801.01203/) (2018)
- [Chiron: Privacy-preserving Machine Learning as a Service](https://mlsanity.com/paper/1803.05961/) (2018)
- [A Brief Introduction to Machine Learning for Engineers](https://mlsanity.com/paper/1709.02840/) (2017)
- [Software Grand Exposure: SGX Cache Attacks Are Practical](https://mlsanity.com/paper/1702.07521/) (2017)
- [Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX](https://mlsanity.com/paper/1705.07289/) (2017)
- [SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution](https://mlsanity.com/paper/1802.09085/) (2018)
- [TensorSCONE: A Secure TensorFlow Framework using Intel SGX](https://mlsanity.com/paper/1902.04413/) (2019)
- [Trust Management as a Service: Enabling Trusted Execution in the Face of Byzantine Stakeholders](https://mlsanity.com/paper/2003.14099/) (2020)
- [CYCLOSA: Decentralizing Private Web Search Through SGX-Based Browser Extensions](https://mlsanity.com/paper/1805.01548/) (2018)
- [TEEMon: A continuous performance monitoring framework for TEEs](https://mlsanity.com/paper/2012.06554/) (2020)
- [A practical approach for updating an integrity-enforced operating system](https://mlsanity.com/paper/2101.01289/) (2021)
- [Slick: Secure Middleboxes using Shielded Execution](https://mlsanity.com/paper/1709.04226/) (2017)
- [T-Lease: A Trusted Lease Primitive for Distributed Systems](https://mlsanity.com/paper/2101.06485/) (2021)

## Built on by (most cited first, 12 of 12)

- [Secure Quantized Training for Deep Learning](https://mlsanity.com/paper/2107.00501/) (2021)
- [Citadel: Protecting Data Privacy and Model Confidentiality for Collaborative Learning with SGX](https://mlsanity.com/paper/2105.01281/) (2021)
- [A Survey of Secure Computation Using Trusted Execution Environments](https://mlsanity.com/paper/2302.12150/) (2023)
- [Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective](https://mlsanity.com/paper/2111.03308/) (2021)
- [Plinius: Secure and Persistent Machine Learning Model Training](https://mlsanity.com/paper/2104.02987/) (2021)
- [Trusting What You Cannot See: Auditable Fine-Tuning and Inference for Proprietary AI](https://mlsanity.com/paper/2603.07466/) (2026)
- [Perun: Secure Multi-Stakeholder Machine Learning Framework with GPU Support](https://mlsanity.com/paper/2103.16898/) (2021)
- [Local Model Reconstruction Attacks in Federated Learning and their Uses](https://mlsanity.com/paper/2210.16205/) (2022)
- [Avoid Adversarial Adaption in Federated Learning by Multi-Metric Investigations](https://mlsanity.com/paper/2306.03600/) (2023)
- [VeriSplit: Secure and Practical Offloading of Machine Learning Inferences across IoT Devices](https://mlsanity.com/paper/2406.00586/) (2024)
- [Attribute Inference Attacks for Federated Regression Tasks](https://mlsanity.com/paper/2411.12697/) (2024)
- [Protecting Confidentiality, Privacy and Integrity in Collaborative Learning](https://mlsanity.com/paper/2412.08534/) (2024)

## Abstract (arXiv)

Data-driven intelligent applications in modern online services have become ubiquitous. These applications are usually hosted in the untrusted cloud computing infrastructure. This poses significant security risks since these applications rely on applying machine learning algorithms on large datasets which may contain private and sensitive information. To tackle this challenge, we designed secureTF, a distributed secure machine learning framework based on Tensorflow for the untrusted cloud infrastructure. secureTF is a generic platform to support unmodified TensorFlow applications, while providing end-to-end security for the input data, ML model, and application code. secureTF is built from ground-up based on the security properties provided by Trusted Execution Environments (TEEs). However, it extends the trust of a volatile memory region (or secure enclave) provided by the single node TEE to secure a distributed infrastructure required for supporting unmodified stateful machine learning applications running in the cloud. The paper reports on our experiences about the system design choices and the system deployment in production use-cases. We conclude with the lessons learned based on the limitations of our commercially available platform, and discuss open research problems for the future work.