# Perun: Secure Multi-Stakeholder Machine Learning Framework with GPU Support

arXiv: https://arxiv.org/abs/2103.16898 · HTML: https://mlsanity.com/paper/2103.16898/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 54 references that are in the map.
- First posted on arXiv 31 Mar 2021.

## Builds on (most cited first, 16 of 16)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [U-Net: Convolutional Networks for Biomedical Image Segmentation](https://mlsanity.com/paper/1505.04597/) (2015)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [A large annotated medical image dataset for the development and evaluation of segmentation algorithms](https://mlsanity.com/paper/1902.09063/) (2019)
- [Gazelle: A Low Latency Framework for Secure Neural Network Inference](https://mlsanity.com/paper/1801.05507/) (2018)
- [Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware](https://mlsanity.com/paper/1806.03287/) (2018)
- [CrypTFlow: Secure TensorFlow Inference](https://mlsanity.com/paper/1909.07814/) (2019)
- [Spectre Attacks: Exploiting Speculative Execution](https://mlsanity.com/paper/1801.01203/) (2018)
- [Chiron: Privacy-preserving Machine Learning as a Service](https://mlsanity.com/paper/1803.05961/) (2018)
- [SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution](https://mlsanity.com/paper/1802.09085/) (2018)
- [secureTF: A Secure TensorFlow Framework](https://mlsanity.com/paper/2101.08204/) (2021)
- [Integrating Remote Attestation with Transport Layer Security](https://mlsanity.com/paper/1801.05863/) (2018)
- [Conclave: secure multi-party computation on big data (extended TR)](https://mlsanity.com/paper/1902.06288/) (2019)
- [GOAT: GPU Outsourcing of Deep Learning Training With Asynchronous Probabilistic Integrity Verification Inside Trusted Execution Environment](https://mlsanity.com/paper/2010.08855/) (2020)
- [Trust Management as a Service: Enabling Trusted Execution in the Face of Byzantine Stakeholders](https://mlsanity.com/paper/2003.14099/) (2020)
- [Intel SGX Enabled Key Manager Service with OpenStack Barbican](https://mlsanity.com/paper/1712.07694/) (2017)

## Built on by (most cited first, 2 of 2)

- [Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective](https://mlsanity.com/paper/2111.03308/) (2021)
- [SecFL: Confidential Federated Learning using TEEs](https://mlsanity.com/paper/2110.00981/) (2021)

## Abstract (arXiv)

Confidential multi-stakeholder machine learning (ML) allows multiple parties to perform collaborative data analytics while not revealing their intellectual property, such as ML source code, model, or datasets. State-of-the-art solutions based on homomorphic encryption incur a large performance overhead. Hardware-based solutions, such as trusted execution environments (TEEs), significantly improve the performance in inference computations but still suffer from low performance in training computations, e.g., deep neural networks model training, because of limited availability of protected memory and lack of GPU support. To address this problem, we designed and implemented Perun, a framework for confidential multi-stakeholder machine learning that allows users to make a trade-off between security and performance. Perun executes ML training on hardware accelerators (e.g., GPU) while providing security guarantees using trusted computing technologies, such as trusted platform module and integrity measurement architecture. Less compute-intensive workloads, such as inference, execute only inside TEE, thus at a lower trusted computing base. The evaluation shows that during the ML training on CIFAR-10 and real-world medical datasets, Perun achieved a 161x to 1560x speedup compared to a pure TEE-based approach.