GINN: Fast GPU-TEE Based Integrity for Neural Network Training

1 INTRODUCTION . Every day , Deep Learning ( DL ) is incorporated into some new aspects of the society . As a result , numerous industries increasingly rely on DL models to make decisions , ranging from computer vision to natural language processing . The training process for these DL models requires a substantial quantity of computational resources ( often in a distributed fashion ) for training , which traditional CPUs are unable to fulfill . Hence , special hardware , with massive parallel computing capabilities such as GPUs , is often utilized Shi et al . ( 2016 ) . At the same time , the DL model building process is increasingly outsourced to the cloud . This is natural , as applying cloud services ( e.g. , Amazon EC2 , Microsoft Azure or Google Cloud ) for DL training can be more fiscally palatable for companies by enabling them to focus on the software aspect of their products . Nevertheless , such outsourcing raises numerous concerns with respect to the privacy and integrity of the learned models . In recognition of the privacy and integrity concerns around DL ( and Machine Learning ( ML ) in general ) , a considerable amount of research has been dedicated to applied cryptography , in three general areas : 1 ) Multi-Party Computation ( MPC ) ( e.g. , Mohassel & Zhang ( 2017 ) ) , 2 ) Homomorphic Encryption ( HE ) ( e.g. , Gilad-Bachrach et al . ( 2016 ) ) , and 3 ) Trusted Execution Environment ( TEE ) ( e.g. , Hunt et al . ( 2018 ) ; Hynes et al . ( 2018 ) ) . However , the majority of these investigations are limited in that : 1 ) they are only applicable to simple shallow network models , 2 ) they are evaluated with datasets that have a small number of records ( such as MNIST LeCun & Cortes ( 2010 ) and CIFAR10 Krizhevsky et al . ) , and 3 ) they incur a substantial amount of overhead that is unacceptable for real-life DL training workloads . In their effort to mitigate some of these problems , and securely move from CPUs to GPUs , Slalom Tramèr & Boneh ( 2019 ) mainly focus on the computational integrity at the test phase while depending on the application context . It can also support enhanced data privacy , however , at a much greater performance cost . To address these limitations , we introduce GINN ( See Figure 1 ) ; a framework for integritypreserving learning as a service that provides integrity guarantees in outsourced DL model training in TEEs . We assume that only the TEE running in the cloud is trusted , and all the other resources such as GPUs can be controlled by an attacker to launch an attack ( e.g. , insert a trojan ) . In this context , our goal is to support the realistic deep learning training workloads while ensuring data and model integrity . To achieve this goal , we focus on the settings where maintaining the learning process ’ s integrity is critical , while the training data may not contain privacy sensitive information . For example , we may want to build a traffic sign detection model on public traffic sign images and may still like to prevent attacks that can insert trojan during the training phase . Furthermore , we want to provide assurances that the model is trained on the specified dataset , with known parameters so that the performance of the model can be replicated and audited for accountability and integrity . The trivial approach of executing the entire learning process inside a TEE is not scalable since TEEs are much slower compared to GPUs . Furthermore , even the existing performance improvement techniques ( e.g. , random matrix verification provided in Tramèr & Boneh ( 2019 ) ) are not enough to scale up to large DL model learning settings . To alleviate the TEE bottleneck , we propose incorporating random verification of the computation steps . This strategy is based on the observation that it is unnecessary to verify all of the GPU ’ s computation steps . Rather , we only need to verify occasionally to catch any deviation with a very high likelihood . Given that random verification may itself be insufficient ( theoretically , an attacker can launch a successful attack by modifying only a single unconstrained gradient update ) , we further show how parts of the DL hyperparameter setting process , such as clipping rate should be modified to prevent single step attacks , and require a larger number of malicious updates by an attacker that controls the GPU . Simply , GINN limits the amount of change an adversary can inflict on a model through a single SGD step . As a consequence , the adversary is forced to keep attacking while randomly being verified by the TEE . Using the state-of-the-art backdoor attacks , we illustrate that random verification technique can detect attacks with a high probability ( e.g. , 0.99 ) while enabling 2x-20x performance gains compared to pure TEE based solutions . The specific contributions of this paper are as follows : • We introduce the first approach to support integrity-preserving DL training by random verification of stochastic gradient ( SGD ) steps inside TEE to ensure the integrity of training pipeline data , parameters , computation function , etc . with a high probability . • We illustrate how gradient clipping can be used as a defensive measure against single ( or infrequent ) step attack in combination with random verification . • We show the effectiveness of our TEE random verification and gradient clipping through extensive experimentation on DNN backdoor attacks . 2 BACKGROUND AND RELATED WORKS . Our system combines deep learning training on specialized fast hardware such as Graphical Processing Units ( GPU ) with Intel Software Guard Extensions ( SGX ) based TEE to ensure the produced model ’ s integrity . Details on SGD training and gradient clipping are provided in Appendices B and C . 2.1 ATTACKS ON DNN MODELS IN TRAINING PHASE . Attacks on DNN models can be realized during both training or test phases . However , GINN is concerned with integrity/accountability issues during the training phase of DNN models , such that attacks related to testing are out of the scope of this paper since test time attacks have been addressed before ( e.g. , Slalom Tramèr & Boneh ( 2019 ) ) . In the literature , particularly in the computer vision domain , targeted trojan attacks on DNN classification models have become a real concern as deep learning has grown in its adoption . These attacks tend to alter the prediction of models if a specific condition in the input is met . These conditions may be feature-based Gu et al . ( 2017 ) ; Liu et al . ( 2017 ) ; Turner et al . ( 2018 ) or instance-based Chen et al . ( 2017 ) ; Shafahi et al . ( 2018 ) . Recently , trojan attacks have been extended to Reinforcement Learning ( RL ) and text classification models Panagiota Kiourti ( 2019 ) ; Sun ( 2020 ) . In practice , these attacks are implemented by manipulating samples during training through data poisoning . For instance , stamping images with a pattern and modifying its label . Interestingly , these models provide similar competitive classification test accuracy compared to clean models ( i.e. , models have not been attacked ) . As a consequence , it is non-trivial to distinguish these trojaned models from non-trojaned ones based on model accuracy alone . To make matters worse , even if the model owner was aware of examples of the trojan trigger pattern , the owner would need to patch the model through re-training to dampen the efficacy of the trojan trigger pattern . Retraining does not always guarantee complete removal of the trojan behavior from the model . To date , various techniques have been proposed to diagnose and mitigate of trojaned models . However , all approaches are either based on unrealistic assumptions or are excessively costly . For instance , the Neural Cleanse Wang et al . ( 2019 ) requires access to a sizable sample of clean inputs to reverse-engineer the backdoor and has shown to be successful only for trigger patterns with a relatively small size . ABS Liu et al . ( 2019 ) improves upon Neural Cleanse in that requires a significantly smaller number of samples ; however , it assumes that the responsible trojan neurons can activate trojan behavior independently from each other , which is unlikely to be true in practice . Attacking the training pipeline to inject a trojan ( s ) in the final model is the cheapest and , thus , is likely the most desirable form of attack for real-world adversaries to launch . As such , throughout this work , we mainly focus on showing our methods ’ effectiveness in preventing this type of attack from happening . It should be noted that our method is orthogonal to attack type and is sufficiently generic to catch any continuous attack during the training of a DNN model . GINN relies upon proactive training as opposed to post-training or deployment-time methods to assess the health of a DNN model . As we explain later in section 3 , we assume that the initial training dataset is provided by an honest user and is free of manipulation . With this as a basis , GINN limits the amount of change an adversary can inflict on a model through a single SGD step . As a consequence , the adversary is forced to keep attacking while randomly being verified by the TEE . 2.2 INTEGRITY FOR DNN TRAINING . GINN ’ s main goal is to enable high-integrity training pipeline so that end users are assured that the model is built on the specified dataset , using specified parameters without modification . Thus , the final model users know who built the model , what dataset was used for training , and what algorithms were put in place for building the model . If , at any point during training , GINN GINN detects a deviation from the specified execution , it will not sign the final model to ascertain its validity . Tramèr & Boneh ( 2019 ) took a first step towards achieving both fast and reliable execution in the test phase but neglected the training phase . The training phase is far more computationally demanding than the test phase , such that verification of all steps in training requires a substantially longer time . Since parameters keep changing , we can not benefit from pre-computation . Second , backward pass involves computing gradients for both the inputs and the parameters and takes longer than forward pass . Despite the mentioned hurdles , as our investigation shows , it may not be necessary to verify every step to achieve integrity guarantees with high probability . 2.3 INTEL SGX . SGX Costan & Devadas ( 2016 ) is an example of a common TEE that is available in many modern-day computers . As outlined in Table 2 , it provides a secluded hardware reserved area , namely , processor reserved memory ( PRM ) , that is kept private ( i.e. , it is not readable in plaintext ) from the host , or any privileged processes , and is free from direct undetected tampering . It also supports remote attestation , such that users can attest the platform and the running code within enclave before provisioning their secrets to a remote server . Calls from routines that should transition to/from enclave are handled through predefined entry points that are called Ecall/Ocall that must be defined in advance , before building the enclave image . While it provides security and privacy for numerous applications ( e.g. , Priebe et al . ( 2018 ) ; Shaon et al . ( 2017 ) ; Kunkel et al . ( 2019 ) ) , due to its limited memory and computational capacity , directly running unmodified applications inside SGX can induce a significant hit on performance . This is especially the case for applications that require large amounts of memory , such as training DNNs .

Summary: The paper presents new techniques to enable secure neural training in the TEE+GPU paradigm. This is a natural extension of previous work like Slalom which only handles the inference case. The authors propose a two-step approach. First, they clip the gradients during training to force the attacker to insert multiple deviations to influence the model. They then randomly verify the integrity a subset of the gradient updates to check for tampering. Combining these two ideas the authors demonstrate a 2-20x improvement over a TEE only benchmark.