Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective

arXiv 2111.03308 ↗First posted 5 Nov 2021cs.CR cs.LGcited by 4

Not on the map. Why?

Abstract (arXiv)

As machine learning (ML) technologies and applications are rapidly changing many computing domains, security issues associated with ML are also emerging. In the domain of systems security, many endeavors have been made to ensure ML model and data confidentiality. ML computations are often inevitably performed in untrusted environments and entail complex multi-party security requirements. Hence, researchers have leveraged the Trusted Execution Environments (TEEs) to build confidential ML computation systems. We conduct a systematic and comprehensive survey by classifying attack vectors and mitigation in confidential ML computation in untrusted environments, analyzing the complex security requirements in multi-party scenarios, and summarizing engineering challenges in confidential ML implementation. Lastly, we suggest future research directions based on our study.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Builds on 56 of its 148 references that are in the map. First posted on arXiv 5 Nov 2021.

Builds on

56 of 148 references.

References · 56

2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
2019Advances and Open Problems in Federated Learningcited by 3,046
2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
2016Adversarial examples in the physical worldcited by 1,769
2019Deep Leakage from Gradientscited by 1,021
2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
2016Stealing Machine Learning Models via Prediction APIscited by 619
2017In-Datacenter Performance Analysis of a Tensor Processing Unitcited by 618
2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 520
2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 446

38 more

2017Efficient Processing of Deep Neural Networks: A Tutorial and Surveycited by 434
2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
2020Data Poisoning Attacks Against Federated Learning Systemscited by 275
2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
2016Practical Secure Aggregation for Federated Learning on User-Held Datacited by 178
2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 122
2018Stealing Hyperparameters in Machine Learningcited by 118
2020Stealing Links from Graph Neural Networkscited by 115
2018Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardwarecited by 102
2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
2020Privacy in Deep Learning: A Surveycited by 71
2014Differential Privacy and Machine Learning: a Survey and Reviewcited by 67
2020DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environmentscited by 58
2018Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architecturescited by 57
2018Stealing Neural Networks via Timing Side Channelscited by 43
2020Hermes Attack: Steal DNN Models with Lossless Inference Accuracycited by 41
2018Chiron: Privacy-preserving Machine Learning as a Servicecited by 40
2020Mind Your Weight(s): A Large-scale Study on Insufficient Machine Learning Model Protection in Mobile Appscited by 36
2018MLCapsule: Guarded Offline Deployment of Machine Learning as a Servicecited by 31
2019Open DNN Box by Power Side-Channel Attackcited by 28
2018I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Acceleratorscited by 27
2020Stealing Deep Reinforcement Learning Models for Fun and Profitcited by 24
2018Efficient Deep Learning on Multi-Source Private Datacited by 17
2019Privacy-Preserving Inference in Machine Learning Services Using Trusted Execution Environmentscited by 17
2017Software Grand Exposure: SGX Cache Attacks Are Practicalcited by 15
2021Citadel: Protecting Data Privacy and Model Confidentiality for Collaborative Learning with SGXcited by 14
2021secureTF: A Secure TensorFlow Frameworkcited by 12
2016Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowingcited by 10
2019TensorSCONE: A Secure TensorFlow Framework using Intel SGXcited by 8
2017CacheZoom: How SGX Amplifies The Power of Cache Attackscited by 7
2020Offline Model Guard: Secure and Private ML on Mobile Devicescited by 7
2019An Off-Chip Attack on Hardware Enclaves via the Memory Buscited by 6
2020GOAT: GPU Outsourcing of Deep Learning Training With Asynchronous Probabilistic Integrity Verification Inside Trusted Execution Environmentcited by 6
2020Confidential Machine Learning on Untrusted Platforms: A Surveycited by 4
2017SGXIO: Generic Trusted I/O Path for Intel SGXcited by 3
2019Enabling Privacy-Preserving, Compute- and Data-Intensive Computing using Heterogeneous Trusted Execution Environmentcited by 3
2019Confidential Deep Learning: Executing Proprietary Models on Untrusted Devicescited by 3
2020DeepPeep: Exploiting Design Ramifications to Decipher the Architecture of Compact DNNscited by 3

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year

Citing papers per year: 2022: 1; 2023: 1; 2024: 1; 2025: 1.

4 papers.

2022Machine Learning with Confidential Computing: A Systematization of Knowledgecited by 15
2023A Survey of Secure Computation Using Trusted Execution Environmentscited by 8
2025Towards Confidential and Efficient LLM Inference with Dual Privacy Protectioncited by 1
2024Analysis, Modeling and Design of Personalized Digital Learning Environmentcited by 0