mlsanityData to 7 Oct 2026

Citadel: Protecting Data Privacy and Model Confidentiality for Collaborative Learning with SGX

arXiv 2105.01281 ↗First posted 4 May 2021cs.CR cs.DC cs.LGcited by 14

Not on the map. Why?

Abstract (arXiv)

With the advancement of machine learning (ML) and its growing awareness, many organizations who own data but not ML expertise (data owner) would like to pool their data and collaborate with those who have expertise but need data from diverse sources to train truly generalizable models (model owner). In such collaborative ML, the data owner wants to protect the privacy of its training data, while the model owner desires the confidentiality of the model and the training method which may contain intellectual properties. However, existing private ML solutions, such as federated learning and split learning, cannot meet the privacy requirements of both data and model owners at the same time. This paper presents Citadel, a scalable collaborative ML system that protects the privacy of both data owner and model owner in untrusted infrastructures with the help of Intel SGX. Citadel performs distributed training across multiple training enclaves running on behalf of data owners and an aggregator enclave on behalf of the model owner. Citadel further establishes a strong information barrier between these enclaves by means of zero-sum masking and hierarchical aggregation to prevent data/model leakage during collaborative training. Compared with the existing SGX-protected training systems, Citadel enables better scalability and stronger privacy guarantees for collaborative ML. Cloud deployment with various ML models shows that Citadel scales to a large number of enclaves with less than 1.73X slowdown caused by SGX.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Builds on 34 of its 96 references that are in the map. First posted on arXiv 4 May 2021.

Builds on

34 of 96 references.

References · 34

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2019Advances and Open Problems in Federated Learningcited by 3,021
  3. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  4. 2016An overview of gradient descent optimization algorithmscited by 1,021
  5. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  6. 2018How To Backdoor Federated Learningcited by 745
  7. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  8. 2017Differentially Private Federated Learning: A Client Level Perspectivecited by 451
  9. 2018Split learning for health: Distributed deep learning without sharing raw patient datacited by 391
  10. 2019Why gradient clipping accelerates training: A theoretical justification for adaptivitycited by 335
  11. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 326
  12. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
22 more
  1. 2018Distributed learning of deep neural network over multiple agentscited by 277
  2. 2017Sparse Communication for Distributed Gradient Descentcited by 243
  3. 2018Don't Use Large Mini-Batches, Use Local SGDcited by 201
  4. 2019SecureBoost: A Lossless Federated Learning Frameworkcited by 174
  5. 2018PipeDream: Fast and Efficient Pipeline Parallel DNN Trainingcited by 116
  6. 2015Asynchronous Parallel Stochastic Gradient for Nonconvex Optimizationcited by 115
  7. 2019Local SGD with Periodic Averaging: Tighter Analysis and Adaptive Synchronizationcited by 106
  8. 2018Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardwarecited by 101
  9. 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
  10. 2018A General Approach to Adding Differential Privacy to Iterative Training Procedurescited by 84
  11. 2020On the Generalization Benefit of Noise in Stochastic Gradient Descentcited by 81
  12. 2020Turbo-Aggregate: Breaking the Quadratic Aggregation Barrier in Secure Federated Learningcited by 78
  13. 2018Adaptive Communication Strategies to Achieve the Best Error-Runtime Trade-off in Local-Update SGDcited by 76
  14. 2018Chiron: Privacy-preserving Machine Learning as a Servicecited by 38
  15. 2018Efficient Deep Learning on Multi-Source Private Datacited by 16
  16. 2018Secure Federated Transfer Learningcited by 13
  17. 2021secureTF: A Secure TensorFlow Frameworkcited by 12
  18. 2020Occlum: Secure and Efficient Multitasking Inside a Single Enclave of Intel SGXcited by 11
  19. 2020PrivFL: Practical Privacy-preserving Federated Regressions on High-dimensional Data over Mobile Networkscited by 10
  20. 2019TensorSCONE: A Secure TensorFlow Framework using Intel SGXcited by 8
  21. 2020PrivColl: Practical Privacy-Preserving Collaborative Machine Learningcited by 8
  22. 2020Trust Management as a Service: Enabling Trusted Execution in the Face of Byzantine Stakeholderscited by 5

Built on by

Cited by year

Citing papers per year: 2021: 2; 2022: 4; 2023: 5; 2024: 3.

14 papers.

Sort:

  1. 2021Privacy-Preserving Machine Learning: Methods, Challenges and Directionscited by 58
  2. 2023A Survey of Trustworthy Federated Learning with Perspectives on Security, Robustness, and Privacycited by 24
  3. 2022Machine Learning with Confidential Computing: A Systematization of Knowledgecited by 13
  4. 2023A Survey of Secure Computation Using Trusted Execution Environmentscited by 8
  5. 2022TEE-based decentralized recommender systems: The raw data sharing redemptioncited by 6
  6. 2022Shielding Federated Learning Systems against Inference Attacks with ARM TrustZonecited by 5
  7. 2023Secure Transformer Inference Protocolcited by 5
  8. 2021Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspectivecited by 4
  9. 2022OLIVE: Oblivious Federated Learning on Trusted Execution Environment against the risk of sparsificationcited by 4
  10. 2024Tempo: Confidentiality Preservation in Cloud-Based Neural Network Trainingcited by 2
  11. 2023Collaborative Distributed Machine Learningcited by 1
  12. 2023Integrating Homomorphic Encryption and Trusted Execution Technology for Autonomous and Confidential Model Refining in Cloudcited by 0
2 more
  1. 2024TensorTEE: Unifying Heterogeneous TEE Granularity for Efficient Secure Collaborative Tensor Computingcited by 0
  2. 2024Protecting Confidentiality, Privacy and Integrity in Collaborative Learningcited by 0