GINN: Fast GPU-TEE Based Integrity for Neural Network Training

1 INTRODUCTION . Every day , Deep Learning ( DL ) is incorporated into some new aspects of the society . As a result , numerous industries increasingly rely on DL models to make decisions , ranging from computer vision to natural language processing . The training process for these DL models requires a substantial quantity of computational resources ( often in a distributed fashion ) for training , which traditional CPUs are unable to fulfill . Hence , special hardware , with massive parallel computing capabilities such as GPUs , is often utilized Shi et al . ( 2016 ) . At the same time , the DL model building process is increasingly outsourced to the cloud . This is natural , as applying cloud services ( e.g. , Amazon EC2 , Microsoft Azure or Google Cloud ) for DL training can be more fiscally palatable for companies by enabling them to focus on the software aspect of their products . Nevertheless , such outsourcing raises numerous concerns with respect to the privacy and integrity of the learned models . In recognition of the privacy and integrity concerns around DL ( and Machine Learning ( ML ) in general ) , a considerable amount of research has been dedicated to applied cryptography , in three general areas : 1 ) Multi-Party Computation ( MPC ) ( e.g. , Mohassel & Zhang ( 2017 ) ) , 2 ) Homomorphic Encryption ( HE ) ( e.g. , Gilad-Bachrach et al . ( 2016 ) ) , and 3 ) Trusted Execution Environment ( TEE ) ( e.g. , Hunt et al . ( 2018 ) ; Hynes et al . ( 2018 ) ) . However , the majority of these investigations are limited in that : 1 ) they are only applicable to simple shallow network models , 2 ) they are evaluated with datasets that have a small number of records ( such as MNIST LeCun & Cortes ( 2010 ) and CIFAR10 Krizhevsky et al . ) , and 3 ) they incur a substantial amount of overhead that is unacceptable for real-life DL training workloads . In their effort to mitigate some of these problems , and securely move from CPUs to GPUs , Slalom Tramèr & Boneh ( 2019 ) mainly focus on the computational integrity at the test phase while depending on the application context . It can also support enhanced data privacy , however , at a much greater performance cost . To address these limitations , we introduce GINN ( See Figure 1 ) ; a framework for integritypreserving learning as a service that provides integrity guarantees in outsourced DL model training in TEEs . We assume that only the TEE running in the cloud is trusted , and all the other resources such as GPUs can be controlled by an attacker to launch an attack ( e.g. , insert a trojan ) . In this context , our goal is to support the realistic deep learning training workloads while ensuring data and model integrity . To achieve this goal , we focus on the settings where maintaining the learning process ’ s integrity is critical , while the training data may not contain privacy sensitive information . For example , we may want to build a traffic sign detection model on public traffic sign images and may still like to prevent attacks that can insert trojan during the training phase . Furthermore , we want to provide assurances that the model is trained on the specified dataset , with known parameters so that the performance of the model can be replicated and audited for accountability and integrity . The trivial approach of executing the entire learning process inside a TEE is not scalable since TEEs are much slower compared to GPUs . Furthermore , even the existing performance improvement techniques ( e.g. , random matrix verification provided in Tramèr & Boneh ( 2019 ) ) are not enough to scale up to large DL model learning settings . To alleviate the TEE bottleneck , we propose incorporating random verification of the computation steps . This strategy is based on the observation that it is unnecessary to verify all of the GPU ’ s computation steps . Rather , we only need to verify occasionally to catch any deviation with a very high likelihood . Given that random verification may itself be insufficient ( theoretically , an attacker can launch a successful attack by modifying only a single unconstrained gradient update ) , we further show how parts of the DL hyperparameter setting process , such as clipping rate should be modified to prevent single step attacks , and require a larger number of malicious updates by an attacker that controls the GPU . Simply , GINN limits the amount of change an adversary can inflict on a model through a single SGD step . As a consequence , the adversary is forced to keep attacking while randomly being verified by the TEE . Using the state-of-the-art backdoor attacks , we illustrate that random verification technique can detect attacks with a high probability ( e.g. , 0.99 ) while enabling 2x-20x performance gains compared to pure TEE based solutions . The specific contributions of this paper are as follows : • We introduce the first approach to support integrity-preserving DL training by random verification of stochastic gradient ( SGD ) steps inside TEE to ensure the integrity of training pipeline data , parameters , computation function , etc . with a high probability . • We illustrate how gradient clipping can be used as a defensive measure against single ( or infrequent ) step attack in combination with random verification . • We show the effectiveness of our TEE random verification and gradient clipping through extensive experimentation on DNN backdoor attacks . 2 BACKGROUND AND RELATED WORKS . Our system combines deep learning training on specialized fast hardware such as Graphical Processing Units ( GPU ) with Intel Software Guard Extensions ( SGX ) based TEE to ensure the produced model ’ s integrity . Details on SGD training and gradient clipping are provided in Appendices B and C . 2.1 ATTACKS ON DNN MODELS IN TRAINING PHASE . Attacks on DNN models can be realized during both training or test phases . However , GINN is concerned with integrity/accountability issues during the training phase of DNN models , such that attacks related to testing are out of the scope of this paper since test time attacks have been addressed before ( e.g. , Slalom Tramèr & Boneh ( 2019 ) ) . In the literature , particularly in the computer vision domain , targeted trojan attacks on DNN classification models have become a real concern as deep learning has grown in its adoption . These attacks tend to alter the prediction of models if a specific condition in the input is met . These conditions may be feature-based Gu et al . ( 2017 ) ; Liu et al . ( 2017 ) ; Turner et al . ( 2018 ) or instance-based Chen et al . ( 2017 ) ; Shafahi et al . ( 2018 ) . Recently , trojan attacks have been extended to Reinforcement Learning ( RL ) and text classification models Panagiota Kiourti ( 2019 ) ; Sun ( 2020 ) . In practice , these attacks are implemented by manipulating samples during training through data poisoning . For instance , stamping images with a pattern and modifying its label . Interestingly , these models provide similar competitive classification test accuracy compared to clean models ( i.e. , models have not been attacked ) . As a consequence , it is non-trivial to distinguish these trojaned models from non-trojaned ones based on model accuracy alone . To make matters worse , even if the model owner was aware of examples of the trojan trigger pattern , the owner would need to patch the model through re-training to dampen the efficacy of the trojan trigger pattern . Retraining does not always guarantee complete removal of the trojan behavior from the model . To date , various techniques have been proposed to diagnose and mitigate of trojaned models . However , all approaches are either based on unrealistic assumptions or are excessively costly . For instance , the Neural Cleanse Wang et al . ( 2019 ) requires access to a sizable sample of clean inputs to reverse-engineer the backdoor and has shown to be successful only for trigger patterns with a relatively small size . ABS Liu et al . ( 2019 ) improves upon Neural Cleanse in that requires a significantly smaller number of samples ; however , it assumes that the responsible trojan neurons can activate trojan behavior independently from each other , which is unlikely to be true in practice . Attacking the training pipeline to inject a trojan ( s ) in the final model is the cheapest and , thus , is likely the most desirable form of attack for real-world adversaries to launch . As such , throughout this work , we mainly focus on showing our methods ’ effectiveness in preventing this type of attack from happening . It should be noted that our method is orthogonal to attack type and is sufficiently generic to catch any continuous attack during the training of a DNN model . GINN relies upon proactive training as opposed to post-training or deployment-time methods to assess the health of a DNN model . As we explain later in section 3 , we assume that the initial training dataset is provided by an honest user and is free of manipulation . With this as a basis , GINN limits the amount of change an adversary can inflict on a model through a single SGD step . As a consequence , the adversary is forced to keep attacking while randomly being verified by the TEE . 2.2 INTEGRITY FOR DNN TRAINING . GINN ’ s main goal is to enable high-integrity training pipeline so that end users are assured that the model is built on the specified dataset , using specified parameters without modification . Thus , the final model users know who built the model , what dataset was used for training , and what algorithms were put in place for building the model . If , at any point during training , GINN GINN detects a deviation from the specified execution , it will not sign the final model to ascertain its validity . Tramèr & Boneh ( 2019 ) took a first step towards achieving both fast and reliable execution in the test phase but neglected the training phase . The training phase is far more computationally demanding than the test phase , such that verification of all steps in training requires a substantially longer time . Since parameters keep changing , we can not benefit from pre-computation . Second , backward pass involves computing gradients for both the inputs and the parameters and takes longer than forward pass . Despite the mentioned hurdles , as our investigation shows , it may not be necessary to verify every step to achieve integrity guarantees with high probability . 2.3 INTEL SGX . SGX Costan & Devadas ( 2016 ) is an example of a common TEE that is available in many modern-day computers . As outlined in Table 2 , it provides a secluded hardware reserved area , namely , processor reserved memory ( PRM ) , that is kept private ( i.e. , it is not readable in plaintext ) from the host , or any privileged processes , and is free from direct undetected tampering . It also supports remote attestation , such that users can attest the platform and the running code within enclave before provisioning their secrets to a remote server . Calls from routines that should transition to/from enclave are handled through predefined entry points that are called Ecall/Ocall that must be defined in advance , before building the enclave image . While it provides security and privacy for numerous applications ( e.g. , Priebe et al . ( 2018 ) ; Shaon et al . ( 2017 ) ; Kunkel et al . ( 2019 ) ) , due to its limited memory and computational capacity , directly running unmodified applications inside SGX can induce a significant hit on performance . This is especially the case for applications that require large amounts of memory , such as training DNNs .

Summary: The paper targets security challenges of deep neural networks. While solutions can hardly scale up to support realistic DNN model training workloads, the authors propose GINN to support integrity-preserving DL training by random verification of stochastic gradient steps inside trusted execution environments (TEE). GINN combines random verification and gradient clipping to achieve good performance. The experimental results show that GINN achieves 2x-20x performance improvement compared with the pure TEE based solution while guaranteeing the integrity with high probability.