mlsanityData to 7 Oct 2026

Machine Learning with Confidential Computing: A Systematization of Knowledge

arXiv 2208.10134 ↗First posted 22 Aug 2022cs.CR cs.LGcited by 13

Not on the map. Why?

Abstract (arXiv)

Privacy and security challenges in Machine Learning (ML) have become increasingly severe, along with ML's pervasive development and the recent demonstration of large attack surfaces. As a mature system-oriented approach, Confidential Computing has been utilized in both academia and industry to mitigate privacy and security issues in various ML scenarios. In this paper, the conjunction between ML and Confidential Computing is investigated. We systematize the prior work on Confidential Computing-assisted ML techniques that provide i) confidentiality guarantees and ii) integrity assurances, and discuss their advanced features and drawbacks. Key challenges are further identified, and we provide dedicated analyses of the limitations in existing Trusted Execution Environment (TEE) systems for ML use cases. Finally, prospective works are discussed, including grounded privacy definitions for closed-loop protection, partitioned executions of efficient ML, dedicated TEE-assisted designs for ML, TEE-aware ML, and ML full pipeline guarantees. By providing these potential solutions in our systematization of knowledge, we aim to build the bridge to help achieve a much stronger TEE-enabled ML for privacy guarantees without introducing computation and system costs.

Key facts. Cited by 13 papers in the map (data through 7 Oct 2026). Builds on 87 of its 278 references that are in the map. First posted on arXiv 22 Aug 2022.

Builds on

87 of 278 references.

References · 87

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2019Advances and Open Problems in Federated Learningcited by 3,021
  5. 2018Federated Optimization in Heterogeneous Networkscited by 2,971
  6. 2016Deep Learning with Differential Privacycited by 2,682
  7. 2013Visualizing and Understanding Convolutional Networkscited by 2,278
  8. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  9. 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,531
  10. 2019MixMatch: A Holistic Approach to Semi-Supervised Learningcited by 1,390
  11. 2014How transferable are features in deep neural networks?cited by 1,216
  12. 2019Unsupervised Data Augmentation for Consistency Trainingcited by 1,057
38 more
  1. 2020Adaptive Federated Optimizationcited by 1,036
  2. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  3. 2019Deep Leakage from Gradientscited by 1,004
  4. 2021Membership Inference Attacks From First Principlescited by 839
  5. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  6. 2016Universal adversarial perturbationscited by 774
  7. 2018How To Backdoor Federated Learningcited by 745
  8. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 707
  9. 2020NVAE: A Deep Hierarchical Variational Autoencodercited by 635
  10. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  11. 2020Federated Learning with Matched Averagingcited by 564
  12. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  13. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  14. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  15. 2020HeteroFL: Computation and Communication Efficient Federated Learning for Heterogeneous Clientscited by 334
  16. 2019Deep Learning Recommendation Model for Personalization and Recommendation Systemscited by 327
  17. 2017Deep Models Under the GAN: Information Leakage from Collaborative Deep Learningcited by 326
  18. 2018Not All Samples Are Created Equal: Deep Learning with Importance Samplingcited by 323
  19. 2021See through Gradients: Image Batch Recovery via GradInversioncited by 320
  20. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  21. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  22. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 266
  23. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 265
  24. 2022Prioritized Training on Points that are Learnable, Worth Learning, and Not Yet Learntcited by 233
  25. 2017Learning Explanatory Rules from Noisy Datacited by 210
  26. 2019A Survey on Distributed Machine Learningcited by 187
  27. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  28. 2020A Theory of Usable Information Under Computational Constraintscited by 153
  29. 2020A Survey of Privacy Attacks in Machine Learningcited by 143
  30. 2018Recent Advances in Autoencoder-Based Representation Learningcited by 130
  31. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  32. 2021Interpretable Deep Learning: Interpretation, Interpretability, Trustworthiness, and Beyondcited by 116
  33. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  34. 2021Parameterized Knowledge Transfer for Personalized Federated Learningcited by 108
  35. 2018Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardwarecited by 101
  36. 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
  37. 2022DisPFL: Towards Communication-Efficient Personalized Federated Learning via Decentralized Sparse Trainingcited by 74
  38. 2020When Machine Learning Meets Privacy: A Survey and Outlookcited by 67

50 most cited of 87 All 87 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 5; 2026: 6.

13 papers.

Sort:

By area:

  1. 2025Atlas: A Framework for ML Lifecycle Provenance & Transparencycited by 8
  2. 2025Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environmentscited by 8
  3. 2025Confidential LLM Inference: Performance and Cost Across CPU and GPU TEEscited by 5
  4. 2024Fortify Your Foundations: Practical Privacy and Security for Foundation Model Deployments In The Cloudcited by 4
  5. 2026MemTrust: A Zero-Trust Architecture for Unified AI Memory Systemcited by 3
  6. 2024Privacy-Preserving and Trustworthy Deep Learning for Medical Imagingcited by 0
  7. 2025Towards Anonymous Neural Network Inferencecited by 0
  8. 2025Securing Generative AI in Healthcare: A Zero-Trust Architecture Powered by Confidential Computing on Google Cloudcited by 0
  9. 2026SoK: Enhancing Cryptographic Collaborative Learning with Differential Privacycited by 0
  10. 2026Making AI-Assisted Grant Evaluation Auditable without Exposing the Modelcited by 0
  11. 2026Selective Token-Level Cryptographic Redaction for Privacy-Preserving Clinical Deployment of Large Language Modelscited by 0
  12. 2026The Serialized Bridge: Understanding and Recovering LLM Serving Performance under Blackwell GPU Confidential Computingcited by 0
1 more
  1. 2026SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channelscited by 0