DarKnight: A Data Privacy Scheme for Training and Inference of Deep Neural Networks
Authors: Hanieh Hashemi
Yongqin Wang
Murali Annavaram
Venue:  (2021)
Keywords: Data Privacy
Information-theoretic Privacy
DNN Privacy
Trusted Execution Environment
Intel SGX

Abstract: Protecting the privacy of input data is of growing importance as machine learning methods reach new application domains.
In this paper, we provide a unified training and inference framework for large DNNs while protecting input privacy and computation integrity. Our approach called DarKnight uses a novel data blinding strategy using matrix masking to create input obfuscation within a trusted execution environment (TEE). Our rigorous mathematical proof demonstrates that our blinding process provides an information-theoretic privacy guarantee by bounding information leakage. The obfuscated data can then be offloaded to any GPU for accelerating linear operations on blinded data. The results from linear operations on blinded data are decoded before performing non-linear operations within the TEE. This cooperative execution allows DarKnight to exploit the computational power of GPUs to perform linear operations while exploiting TEEs to protect input privacy.  We implement DarKnight on an Intel SGX TEE augmented with a GPU to evaluate its performance.

Under review as a conference paper at ICLR 2021
DARKNIGHT: A DATA PRIVACY SCHEME FOR TRAIN- ING AND INFERENCE OF DEEP NEURAL NETWORKS
Anonymous authors Paper under double-blind review
ABSTRACT
Protecting the privacy input data is of growing importance as machine learning methods reach new application domains. In this paper, provide unified train- ing and inference framework for large DNNs while protecting input privacy and computation integrity. Our approach called DarKnight uses novel data blinding strategy using matrix masking to create input obfuscation within a trusted execu- tion environment (TEE). Our rigorous mathematical proof demonstrates that our blinding process provides information-thherrtiic privacy guarantee by bounding information leakage. The obfuscated data can then be offloaded to any GPU for accelerating linear operations on blinded data. The results from linear operations blinded data are decoded before performing non-linear operations within the TEE. This cooperative execution allows DarKnight to exploit the computational power of GPUs to perform linear operations while exploiting TEEs to protect in- put privacy. We implement DarKnight on an Intel SGX TEE augmented with a GPU evaluate performance.
INTRODUCTION
The need for protecting input privacy in Deep learning is growing rapidly in many such as health care (Esteva et al.) 2019). autonomous vehicles (Zhu et al. 2014), finance (Heaton et al.) 2017), communication technologies (Foerster al. 2016) etc. Many of the data holders are, how- ever, not machine learning experts. Hence, the need for machine learning as service (MLaaS) has emerged. Microsoft Azure ML (Microsoft) 2020), Google Al platform (Google) 2020). Ama- zon MI. (Amazon 2020) are some examples. These services provide computing infrastructure and MI runtime to enable data holders to quickly set up their models and train. While these platforms accelerate the MI. setup process, they exacerbate the user's concern regarding the data privacy.
In this paper, we propose DarKnight, unified inference and training framework that protects data privacy with rigorous bounds on information leakage. DarKnight takes a unique hybrid-execution approach where uses trusted execution environments(TEE) to blind input data using matrix mask- ing techniques, and then uses GPUs to accelerate DNN's linear computations on the blinded data. Training or inference solely within TEEs can provide data privacy, by blocking access to TEE mem- ory for all intruders, including root users, using hardware encryption and isolation mechanisms. However, TEE-enabled CPUs have limited computation power and memory availability, which cre- ates unacceptable performance hurdles to run an entire model within TEE. Linear operations (con- volution, matrix multiplication, etc) are orders of magnitudes faster on a GPU compared to a TEE- enabled CPU. DarKnight offloads these compute-intensive linear operations to GPU. DarKnight's usage of TEEs is limited to protecting the privacy of data through novel matrix masking of multiple inputs and performing non-lineat operations (ReIU, Maxpool).
In terms of applicability, DarKnight allows users to train using floating -pinn (FP) representation for model parameters, while still providing rigorous bounds on information leakage. FP models are rou- tinely used in training due to convergence, accuracy and faster implementation considerations (John-) son 2018 Guo et al.. 2020 Imani et al. 2019). Many DNN accelerators use biloat 16 (Kalamkar et al. 2019) which is half precision FP. This format is used in Intel Xeon Processors, Intel FP-
GAs (Nevvanal 2018), Google Cloud TPUs (Cloud 2018) and Tenserflow (Google) 2018). Several prior works protecting privacy, however, use operations
finite fields to provide formal bounds. Such an approach limits their usage to integer arithmetic on quantized models (Mohassel & Zhang
2017 Gascón et al. 2017 So et al. 2019). In this work, we allow training FP values and

---

Under review as a conference paper at ICLR 2021
bound the amount of information leakage with a rigorous mathematical proof. The information leakage is bounded by the variance of the additive noise and other parameters of the DarKnight blinding.
We implemented DarKnight using an Intel SGX-enabled CPU to perform matrix masking and non- linear DNN operations, while using an Nvidia GPU to accelerate linear operations. The blinding parameters in our experiments were chosen so as to preserve the original accuracy of training a model. Using these parameters DarKnight guarantees that no more than one bit of information is leaked from a one megapixel input image. Note that this will be an upper bound on the leaked information, assuming that the adversary has access to unlimited computation power to decode the blinded inputs. To the best of our knowledge, this is the first work that uses TEE-GPU collaboration for training large DNNs.
The rest of the paper is organized as follow. In Section we explain the background. Section describes the methodology for inference and training. In section | privacy theorem is provided. Experimental results are presented in section In section 6 we draw the conclusion.
2
RELATED WORK AND BACKGROUND
2.1
INTEL SGX
TEEs such as ARMTrustZone (Alves 2004). Intel SGX (Costan & Devadas 2016), and Sanctum
(Csstan et al. 2016) provide an execution environment where computational integrity of user's application is guaranteed by the hardware. TEEs generally provide a limited amount of secure memory that is tamper proof even from a root user. SGX provides 128 MB as the enclave memory. An entire DNN model and data can be wrapped in an enclave for private execution but if size of the private data exceeds the 128MB TEE limit, it will pay a significant performance penalty for encryption and eviction of pages for swapping. While some types of side-channel attacks have been performed on SGX, many of these attacks are being fixed actively (Costan & Devadas [2016] Xu et al. 2013). In this work we assume that SGX computations are invisible to the outside entities.
2.2
RELATED WORK
There are variety of approaches for protecting input privacy during DNN training and inference. We categorized these approaches in [T Homomorphic encryption (HE) techniques encrypt in- put data and then perform inference directly on encrypted data, albeit with significant performance penalty (and hence are rarely used in training DNNs) Secure multi-party computing (MPC) is an- other approach, where multiple non-colluding servers may use custom data exchange protocols to protect input data. However, this approach requires multiple servers to perform training inference. An entirely orthogonal approach is to use differential privacy (DifP), which protects user informa- tion through probabilistic guarantees. Additive Noise is another approach mostly used for inference, where there is trade-off between the privacy, computational complexity and, model accuracy. In some of the works mentioned below a combination of forenamed techniques is used. Among those approaches, (Tramer& & Bonch 2018) introduced Slalom an inference framework that uses TEE-GPU collaboration to protect data privacy and integrity. However, as stated in their work their quantized model was not designed for training DNNs. We elaborate on these reasons in Appendix E.
Table 1: Various prior techniques and their applicability
FINE Garea Prc
Mllpouz Havaltee PAIES
Oryashes
3lln
Sulve
M V7P BEER
AB75
BNN
3 DARKNIGHT
3.1 THREAT MODEL
Adversary capabilities: While adversaries can perform various attacks on DNN models and datasets (Riazi et al. (2019). DarKnight focuses on attacks that expose the datasets used in training or inference and attacks that modify computational results on untrusted hardware. Model privacy and side channel attacks are out of the scope of this work. Within this scope, the adversary is assumed to have the full root access to the system, which includes the GPU in our setup. The adversary cannot see any computations or data stored within the TEE. But the adversary has unrestricted access to data that leaves TEE, such as the blinded input data and can alter computational results performed
2

---

Under review as a conference paper at ICLR 2021
on the GPU. Since model protection is outside of the scope assume the adversary can access the DNN model parameters.
Informatiio--teooreiee Data Privacy: We quantify information leakage in terms of the mutual information between original inputs and blinded inputs that are visible to the adversary. More pre- cisely, from information theoretical point of view, adversary with unlimited computation power who observes unlimited number of blinded inputs cannot gain more information about origi- nal inputs than what our upper bound on leakage provides. This upper bound itself can be controlled by the power of noise and other blinding parameters in our design. In our implementation we se- lected these parameters such that the overall training or inference accuracy not reduced due to them. In section and Appendix A, we provide the details of our theoretical analysis.
Since the adversary has access to blinded inputs, it can alter the returned values to the TEE to manipulate model training or inference. DarKnight can verify the computations performed in the unsecured GPU up to the computation precision. In the other words, DarKnight detects if the results are altered more than the computation precision by an adversary.
Computation Integrity:
3.2 DARKNIGHT OVERVIEW
DarKnight supports both private inference and training in a single framework. Fig. [ depicts the overall execution flow of DarKnight. A cloud server with an SGX enclave and GPU accelerator forms the computing base DarK- night uses SGX to blind input data while en- abling GPUs to perform computationally inten- sive linear operations on private data. The ini- tial model (W) that a user wants to train is loaded into the cloud server, and is made ac- cessible to the untrusted GPU as well. DarK- night then uses the following steps: (1) A batch of training/inference input data set encrypted by the client using mutually agreed keys with SGX and sent to the server. (2) SGX decrypts the images and starts the forward and backward propagation. (3) During the forward/backward pass, each layer requires some linear and nonlinear operations. Before offloading linear operations to GPU, SGX calls DarKnight's blinding mechanism to seal the data. To seal the data, DarKnight uses the notion of a virtual batch, where K inputs are linearly combined to form K coded inputs. The size of the virtual batch is limited by the size of the SGX memory that is necessary to blind K images, typically 4-8 images at time. (4) The blinded data is offloaded to GPU for linear operation. (5) GPU performs linear operations on blinded data and returns the data back to SGX labeled as step 6. (7) SGX decodes the received computational outputs using DarKnight's 's decoding strategy and then performs any non-lineat operations within SGX. This process is repeated both for forward and backward propagation of each layer.
Gloud
Trusted Execution Environment (SGX)
Untrusted Handware (GPU)
Unltinding
Activataa
Oycralls (Chen, Stairts
Figure 1: General steps of one forward/backward pass of DarKnight for training a DNN
3.3 PRIVACY IN INFERENCE
In this section, we start with DarKnight's inference strategy. We consider trained DNN, represented by model parameters W with T. layers, which performing inference on input xo, which must be protected. At a layer the inference process computes yı (W1, xI). where W; and x; represent the model parameters and inputs in layer I, and ( corresponds to the bilinear operation at that layer (e.g. matrix product, convolution, etc.). After the linear operation finishes, activation function (o(-)) creates the next layer input X1+1 = g(yi). Within this context, DarKnight first receives a
(1)
(K) for batch inference from client. Our goal is perform linear (K)
set of K inputs x ..... X
(Wo, x0 (x)) on the GPU without exposing the inputs the GPU. Note that the subscript 0 in all these variables refers the first layer. At this
(1) = (Wo, x (1) ".."")....)) yy
calculations of yo
point, we drop the subscript for a more clear notation. Also, we apply x for the inputs that need to be protected and for the blinded inputs to visually distinguish different notations.
The main idea behind DarKnight's privacy protection scheme is the fact that the most computationally intensive operator (such as convolutions) is bilinear. Thus, instead of asking the GPU to calculate (W,(")). which exposes the inputs, DarKnight uses matrix masking linearly
Key Insight:
3

---

Under review as a conference paper at ICLR 2021
combine the inputs and add random noise to them. Due to the bilinear property, any linear opera- tion on K masked inputs can be recovered if there are K different linear computations performed.
Matrix Masking: Introduced by (Cox 1980, 1994, Kim 1986; Spruill 1983). matrix masking scheme can be used for variety of reasons such as noise addition, sampling and etc. The general form of B X A + C is used for protecting Matrix X. Any of these matrices can be used for masking data based on the data privacy goal. For DarKnight we use A and C as we explain the in this section.
DarKnight Matrix Masking(Blinding) More specifically, DarKnight creates K + inputs
x(1)
x x(K), follows,
x(1)
xx,1x + 05, + +a(K++)) i i= +1
(1)
The scalars oz,j and the noise vector r are randomly generated; and the size of matches that of x. The scalars aij" 's are represented by matrix A, which are dynamically generated for each batch and securely stored inside SGX for unblinding. Hence, by revealing the values x(0ss to GPU, do not expose the inputs x "s) At the next step, the blinded data x(0)s are sent to the GPU which
performs the following computations: y(0) = (W,x(") ) i = 1..... (K + 1). Please note that matrix A can be chosen such that its condition number close to one, so that blinding and unblinding algorithm remains numerically stable. For this purpose, orthogonal matrices serve us the best.
DarKnight Unblinding: The K + 1 outputs y(i returned from the GPU must be unblinded to extract the original results (() These value can be extracted as follows,
Y W, [x
(k)))) = (W. (x(1)
(K) x1)
A
A
(2)
DarKnight Advantages: (1) Unlike prior works (Tramer & Boneh 2018) DarKnight does not need to store W r within the SGX memory thereby significantly enhancing our ability to infer with much larger models.
(2) size of the matrix A is proportional to the number of inputs that are blinded together (K), and is orders of magnitude smaller the model size W. Hence, the order complexity of (Blinding/Unblindiii millions of parameters. (3) The process of unblinding K inputs with one random noise requires K + computations. During unblinding we extract W r, but that value is just dropped. Thus DarKnight trades 1/K additional computations in order to eliminate the need to secure very large model parameters.
operations is much less than the linear operations ((W ,.)) in a DNN with
3.4 PRIVACY IN TRAINING
In the training setting, for model with L layers which is being trained with batch of K inputs, the model parameters Wt at layer are updated using the well known SGD process as:
W.ew
Wold nx WW.
VW
Here 17 is the learning rate, and 8 is the gradient of the loss for the 2th point in the training batch, with respect to the output of layer 1. DarKnight must protect (() for each layer of the DNN when the layer's linear operations are outsourced to GPU. Recall that the decoding pro-
cess for inference exploited the invariant property of model parameter for any given input such that (W, [x() ( x = (w, [x(1) ..... ,..,,
x(() x()),r)) A. meaning that a single W was shared
between all the inputs of that layers. However, during the training process, we have different of
for each input x Thus, decoding the (5( x(") from obfuscated inputs (o xx()) is more
challenging that requires training specific decoding approach.
Key Insight: The key insight is that while training batch of inputs, it is not necessary to compute the (8/)) xi ()) for each input ( Instead, the training process only needs to compute cumulative parameter updates for the entire batch of inputs. Hence, what is necessary to compute is the entire VW, which is a summation over multiple inputs in the batch.
DarKnight Blinding: DarKnight exploits this insight to protect privacy without significantly in- creasing the blinding and unblinding complexity of the blinding process. In particular, DarKnight uses new linear encoding scheme to combine inputs (covered by noise). As shown in equation 3
4

---

Under review as a conference paper at ICLR 2021
there are K inputs which gradients are computed. Instead of calculating the K products in equa- tion DarKnight calculate the following K + equations, in the backward propagation.
K+1
K
VW
Eq
Eq, Σ
Bu 866) .x0)
(4)
In the above equations, x(0 is the blinded input as produced by Equation 1, while the gradients are multiplied with the $3.s in the GPU. In contrast to inference where W's are fixed (independent of the input), during training the parameter updates are with respect to a specific input. Hence, each 6(')ss corresponds to different x during training. As such, DarKnight uses different blinding strategy where the overall parameter updates v vW can be decoded very efficiently. In particular, DarKnight selects og, ss 33, and 7 's such that
0
0
A
(5)
(x((+1)
Assuming batch size is equal to K, the Bi,, parameters used for scaling values is gathered in the K' + 1 by K matrix, B. Os., 's are gathered in the K + 1 by K + matrix A, the scalar matrix with the same size for intermediate features and 7/'s form the diagonal of K + 1 by K + matrix r, that gives us the proper parameters for efficient decoding. The proof is discussed in Appendix D.
DarKnight Unblinding: Given the constraint imposed on ay,s's, 's, B3.s's
and 7/'s 's the decoding pro-
cess is trivially simple to extract VW. It is easy to that if the scalars 0; Br. and 7/3 's satisfy the relation equation 5
we will have
K+1
K Σ
2 K
7 Eq
15
VW,
(6)
K
1=1
In other words, the unblinding process only involves calculating a linear combination of the values in equation [ which calculated in the untrusted GPU.
DarKnight Training Complexity: It is important to note that DarKnight's 's training approach for blinding and unblinding is very simple. The size of the a, 8 and 7 matrices just proportional to the square of the batch size that is being processed at one time. Therefore, generating them for every batch has a negligible performance overhead. Even with 8-64 batch size, (commonly used in VGG training (Canziani et al., 2016 Han et al. 2015 Narra et al.) (019a) these scaling values are substantially smaller than the model parameters
W. More implementation details Appendix C.
3.5 EXTENDING DARKNIGHT TO VERIFY DATA INTEGRITY WITH UNTRUSTED GPU
Apart from protecting privacy, DarKnight can be extended easily to a scenario when GPU's com- putation cannot be trusted. In this case, the linear computations performed by the GPU must also be verified. In the interest of space, we just provide an insight into how DarKnight can perform data integrity checks for inference and we leave the details for the Appendix D. Similar extensions for training are also possible. Recall that DarKnight creates K + 1 blinded inputs x(1) ..... ( +1) for original inputs. To provide integrity, DarKnight creates one additional linear combination of inputs (say ( using the same approach as in equation | This additional equation allows us to verify the accuracy of each result (x) by computing it redundantly twice using two of equa- tions. An error is detected if the difference between the two estimations is larger than our desired computation precision. case an error detected, TEE may perform additional corrective action, such as executing on another GPU worker or perform additional redundant computations. But these actions are outside the scope of our current work.
PRIVACY GUARANTEE
In this section, we bound the information that leaks, when using Darknight's blinding approach. In particular, measure the amount of information the adversary can potentially gain about the raw data from the blinded data, if the adversary has access to an unlimited computation power. The amount of information leaked by x(''ss about x6) is the mutual information (MI) between these two variables, defined by (Cover) 1999
T(x( (().....((+.))))
((++)))- h(x(1)) 1(x()) x(K+1)).
5

---

Under review as a conference paper at ICLR 2021
Here, h(-)) denotes the Shannon entropy function. Note that the information that adversary can potentially learn about x by having all x'ss is fundamentally bounded by / ;xx())xx() ..... x(K+1))
This mutual information in Dar Dight can be bounded by the parameters used to blind the data.
Theorem 1. Assume that X ,.,...,'" X are scalars such that |X & C1 for all i. Suppose as,j are real non-zero scalars and R. denotes a Gaussian random variable with variance o². Also X defined as
X
Σ j=1
ajaaa + aaK+t),R i
Then the information leaked from X about X is bounded by
( x(.t))))))))))))))))) (K + +1)ffa?
J I....,K.
(9)
a²o²
Here maxi. |orي] and o minay loagsl
The details of our proof is provided in Appendix Note that there is one source of information leakage not considered in the above bound, namely the leakage of inputs from gradients with re- spect to weight W).. But as we described in Equation 4 we only provide single model update computed across all the inputs in batch, which is similar to the state of art secure aggregation
mechanisms used to bound such leakage (Bonawitz al. 2017
Zhu et al. 2019).
EXPERIMENTS
5.1 SETUP
DarKnight server consisted of an Intel(R) Coffee Lake E-2174G 3.80GHz processor and an Nvidia GeForce GTX 1080 Ti. The server has 64 GB RAM and supports Intel Soft Guard Extension (SGX). Due to enclave thread creation overheads, our experiments a single thread was created to perform the blinding and unblinding operations within the TEE. Parts of the DarKnight inference code based on Slalom code (Tramer & Boneh, (018) but uses DarKnight's 's unique blinding an unblinding mechanisms in addition to various other enhancements, and also eliminated the need to store blinding factors within the enclave.
We used three different DNN models: VGG16 (Simonyan & Zisserman 2014). ResNet152 (He jet al. 2016) and, MobileNet (Sandler et al., 2018 Howard et al.] 2017). We chose MobileNet because the worst-case benchmark for model reduces linear operations considerably (using depth-wise separable convolution). thereby reducing the need for GPU acceleration. We
used ImageNet (Russakovsky al. 2015), CIFAR-10 and CIFAR- 100 (Krizhevsky al. 2009) as
our datasets. All the parameters, models' and implementation details, and dataset descriptions are attached in the supplementary material.
5.2 INFERENCE RESULTS
For a fair comparison, in extracting inference timing for all of our implementations. we use the same library that Slalom used which is called Eigen library. Eigen is high performance C++ based linear algebra library. For GPU linear operations we used Keras 1.5, Tenseflow 1.8.0, and Python 3.6.8.
Darkiighos)) Salom-iniegrtt Darkkggtte-hhhssiit
Darknighh1)) Darkright2)) Dankright4)) DurKnighue)
Spocdtu robivv CorKoight
Spoci rtatve Baoelin
1.5
MobilNNaV1
Unblidiig
Blinding
Rolu
Maxpoolling
Total
Modal
Operations
Figure a)Inference speedup comparison with different implementations relative to SGX for VGG16, and MobileNetVI ImageNet. b) Inference speedup comparison of different operations relative to DarKnight(1) for different virtual batch-sizes for VGG16 on ImageNet.

---

Under review as a conference paper at ICLR 2021
Inference Speedup: Fig. 2 a)) compares the speedup of the inference for VGG16 and MobileNetVI across five different configurations. The baseline bar (SGX) performs all the calculations within SGX. The red bar uses Slalom blinding while trusting GPU that results are always correct, DarK- night(4) is our model while using a virtual batch size of 4. Slalom+Integrity bar shows the perfor- mance when Slalom's 's data integrity verification(Freivlld. is deployed to verify GPU computations. DarKnigh((3)+Inneeri uses DarKnight with virtual batch size of 3 and an additional equation to redundantly compute all the results twice for integrity verification.
For VGGI6, DarKnight(4) provides 15X speedup, compared to the SGX only baseline, and 30% improvement over Slalom. Slalom's 's implementation encrypts W r and stores them outside of SGX memory. At each layer, they retrieve the necessary unblinding factors into SGX, then decrypt them before using them. When providing the additional integrity checks, DarKnight(3) provides about 13X speedup over baseline, and 1.45X speedup over Slalom. For integrity checks, we used the DarKnight(3) model in which three images are linearly combined. The reason is that when integrity checks are added to the design, we will have 5 equations and 4 unknowns. Creating an additional equation takes more SGX memory, thereby limiting the DarKnight's 's virtual batch size to 3, which is further quantified below. Although MobilenetV1 1 shows the least speedup because it reduces the number of linear operations considerably, we still have more than 8X speedup.
Effect of Virtual Batch Size: Recall that virtual batch size is the number of images that are linearly combined in equation [ Fig. 2b) quantifies the effect of batch size on the inference time. In the figure, DarKnight( is used denote a virtual batch size of K. For the same number of input data points with different batch sizes, we issue inference requests and divided the total inference time across four categories of operations: unblinding, blinding, Relu and Maxpooling operations. We used DarKnight(1) as baseline. It represents the case where single image is combined with random Gaussian noise to create two equations using equation[] [ As the virtual batch size increases the total speedup improved as long as the virtual batch size fits within SGX memory limits. As the virtual batch size exceeds 4, the execution time gets worse due to SGX memory overflow.
Table 2: Effect of different noise signals on the accuracy of DarKnight inference for VGG16, 52 and MobileNetVI I on ImageNet
VGG16
ResNei152
Vob
All Models MI upper bound
Noise
Topl Accuracy
Top5 Accuracy
Topl Accuracy
Tops Accuracy
Topl Accuracy
Top5 Accuracy
No privacy
64.26
85:01
72.93
90.60
64.56
85,29
Ni4e3, 1.677)
64.23
85.01
72.46
90.47
64.99
85,26
5 10-1
72.35
64.81
85,26
3.2 10-1
A[144, 168)
64.25
85.05
71.87
89.93
64,54
85.15
8 10-6
N/ 4e8)
85.01
72.24
90.09
85.19
10-
Af (68)
64.22
85.02
70.78
89.33
64.41
84.87
0.8 x 10-
Mutual Information Upper Bound and Random Noise Strength: We use a random Gaussian vector with iid entries, .NJ,, as the noise vectors r, r,'s, where 0² is the order of magnitude strength over the typical model parameter values seen in a model. In Table [ we investigated the effect of various noise strengths, on the inference accuracy. For some of the large noise strengths, negligible accuracy loss was observed while for most cases, adding a noise signals cause no accuracy degradation. Last column represents the upper bound of mutual information. For computing that, Comp we used the rigorous bound of Theorem In this setting the value of K is set to 4, q² I 10 and
C 1 using é normalization in prepossessing. For instance, using = (0, 9e8) will bound the information leakage to 0.8 * 10-6, which is lower than one bit leakage in a Megapixel image. This selection of blinding parameters cause no accuracy loss in VGG16 and MobileNetV1, and around 2% degradation in Top accuracy, and 1 1% loss in Top 5 accuracy in ResNet152.
5.3 TRAINING RESULTS
For SGX implementations, we used Intel Deep Neural Network Library (DNNL) for designing the DNN layers including the Convolution layer, ReL.U, MaxPooling, and Eigen library for Dense layer. For linear operations on GPU we used Keras 2.1.5, Tenseflow 1.8.0, and Python 3.6.8. For evaluating training performance, two aspects are examined: accuracy impact and the execution time of training.
Effect of Random Noise on Accuracy: As depicted in Fig. 4 the accuracy of training for different noise strengths is measured on VGG16, ResNet152, and MobileNetV2. Fig. 4{a) shows the accuracy of training for VGG16 on CIFAR- 10 dataset. The accuracy loss after epoch 50 is less than 0.001 compared to training on open data without any privacy controls. Very similar behaviour is observed across a wide range of input datasets and models. More results in Appendix D.
7

---

Under review as a conference paper at ICLR 2021
-Clar D1t -1344 ROMA 140 -N 1AR
Coan -50e Sptel 1A0 MIN N40
02
30
(a) CIFAR-10 on VGG16 (b) CIFAR-100 on ResNet152 (c) CIFAR- 100 on MobileNetV2
Figure 3: Training accuracy of DarKnight in different DNNs and datasets for batch-size 128
Training Execution Time: As illustrated in Table 3 for the baseline majority of time is spent in the linear operations (84% for VGG16). By speeding up the linear operations in DarKnight (which include convolution and matrix multiplication) balance is now tilted towards to non-linear (including ReLU, Maxpooling, blinding. unblinding. batch normalization) operations. With DarKnight the non-linear operations consume about 84% of the execution time while the linear operation time is substantially reduced. Fig. 4 demonstrates the speedup of training using DirKnight relative to the baseline fully implemented on SGX. It breaks down the execution time spent into GPU operations and SGX operations. Note that SGX operations include all the non-linear operations along with the blinding and unblinding overheads. For instance for VGG16, as shown in the third sets of bar, DarKnight speeds up the total linear operation time by 52x by using the vast GPU parallelism. For SGX operations, DarKnight pays overheads for blinding/ubliindnng while the baseline has to deal with encryption/deeryytion mechanism when data does not fit the SGX memory. That is why for SGX operations we only observe 1.88 times speedup in DarKnight. Overall the execution time is improved by about 10X with DarKnight. As explained MobilenetV2 reduced the amount of linear operations considerably. Even in this worst-case scenario for DarKnight, we improved the performance by 2.5 times. ResNet152 provides 4.7 times speedup. Both ResNet and MobileNet models have batch normalization layers that are computation intensive and we cannot simply offload them to GPU. As a result their speedup is less than VGG models.
Table 3: Percentage of Execution Time Spent on Linear Operations in Training of ImageNet for VGGI6, R5sNet152, MobileNetV2
Phase
VGGI6
ResNet152
MobileNetV2
DarKnight
Basline
DarKnight
Basline
DarKnight
Basline
Forward Pass
0.13
0.90
0.13
0.62
0.23
0.50
Backward propagation
0.20
0.81
0.15
0.60
0.17
0.66
Forward Backward
0.16
0.84
0.15
0.61
0.19
0.62
ON Des 550 Op
CPU a 504 Dey
(a) ImageNet on VGG16
(b) ImageNet on ResNet152 (c) ImageNet on MobileNetV2
Figure Training Execution Time Breakdown
CONCLUSION
This work proposes DarKnight unified inference and training platform that uses TEE to perform data obfuscation and uses GPU to perform linear operations on obfuscated data. DarKnight uses a novel matrix masking to prevent data exposure. We provide a rigorous proof that bounds DarK- night's information leakage using mutual information. We achieved the privacy of bit leakage on a Megapixel image while using IP operations. We evaluated three different models and datasets to demonstrate considerable speedups with provably bounded data privacy leakage and also verifying the computational integrity from GPU, For large DNNs, we observe an average of 12X speedup for inference and 5.8.X speedup for training without accuracy degradation over the baseline fully implemented inside TEF.
8

---

Under review as a conference paper at ICLR 2021
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308-300-300 -18--18, 2016.
Intel Al. Intel Lays Out New Roadmap for Al Portfolio, 2018. URL http:/::/www..oopop/ org/ hewg//ww///eee htw.a//ta-aoa--tttttttt-----rrro -aa.--foraa---oo-1111000
Tiago Alves. Trustzone: Integrated hardware and software security. White paper, 2004.
Amazon. Machine Learning on AWS, 2020.
URL
https:/ :tttps://ws..maaznn com/
machine- Learning
Tensorflow Authors. RexNel-50 Using BFloa16 on TPU, 2018. URL /RL/ttsps///ithhubccoo
[ersorrlow//a//zzee//eeeeEEffff2 oatpaa/ceee..aaaaeee....eaeaeaaa midelss/experrimmtta//eeeeee httpessnet__llloao__e_ bfloat16
Raad Bahmani, Manuel Barbosa, Ferdinand Brasser, Bernardo Portela, Ahmad-Reza Sadeghi, Guil- laume Scerri, and Bogdan Warinschi. Secure multiparty computation from sgx. In International Conference Financial Cryptography and Data Security, pp. 477-497. Springer, 2017.
Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy- preserving machine learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 1175-1191, 2017.
Alfredo Canziani, Adam Paszke, and Eugenio Culurciello. An analysis of deep neural network models for practical applications. arXiv preprint arXiv: TrX5v::605.07777 2016.
Google Cloud. Using bfloat16 in Google TPU, 2018. ops
URL https:: https://cloud.googg/ com/
Victor Costan and Srinivas Devadas. Intel sgx explained. IACR Cryptology ePrint Archive, 2016 (086))1-118, 2016.
Victor Costan, Ilia Lebedev, and Srinivas Devadas. Sanctum: Minimal hardware extensions for strong software isolation. In 25th 2 {USENIX) Security Symposium (aprossimmm(u ([USENIX) Security 16), pp- 857-874, 2016.
Thomas M Cover. Elements of information theory. John Wiley Sons, 1999.
Lawrence H Cox. Suppression methodology and statistical disclosure control. Journal of the Amer- ican Statistical Association, 75(370):377-385, 1980.
LH Cox. Matrix masking methods for disclosure limitation in microdata. Surv. Methodol., 20: 165-169, 1994.
Úlfar Erlingsson, Vasyl Pihur, and Aleksandra Korolova. Rappor: Randomized aggregatable privacy-preservin ordinal response. In Proceedings of the 2014 ACM SIGSAC conference on computer and communications security, pp. 1054-1067, 2014.
Andre Esteva, Alexandre Robicquet, Bharath Ramsundar, Volodymyr Kuleshov, Mark DePristo, Katherine Chou, Claire Cui, Greg Corrado, Sebastian Thrun, and Jeff Dean. A guide to deep learning in healthcare. Nature medicine, 25(1):24-29, 2019.
Jakob Foerster, Ioannis Alexandros Assael, Nando De Freitas, and Shimon Whiteson. Learning to communicate with deep multi-agent reinforcement learning. In Advances in neural information processing systems, pp. 2137-2145, 2016.
Adrià Gascón, Phillipp Schoppmann, Borja Balle, Mariana Raykova, Jack Doerner, Samee Zahur, and David Evans. Privacy preseeving distributed linear regression on high-dimensional data. Pro- ceedings Privacy Enhancing Technologies, 2017(4)345-364,
2017. 2017.

---

Under review as a conference paper at ICLR 2021
Craig Gentry, Fully homomorphic encryption using ideal lattices. In Proceedings of the forty-fira annual ACM symposium on Theory of computing, pp. 169-178, 2009.
Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Nachrig, and John Werns- ing. Cryptonets: Applying neural networks encrypted data with high throughput and accuracy. In International Conference on Machine Learning, pp. 201-210, 2016.
Google. Using bfloat16 with TensorFlow models, 2018. URL Sspu/docsbbflon loat16
Google. Google Al platform, 2020.
Zhongshu Gu, Heqing Huang, Jialong Zhang, Dong Su, Ankita Lamba, Dimitrios Pendarakis, and Ian Molloy. Securing input data of deep learning inference systems via partitioned enclave exe- cution. arXiv preprint arXiv: (007:088800009000 2018.
Anubhav Guleria, Lakshmi, and Chakri Padala. Quadd: Quantifying accelerator disaggregated dat- acenter efficiency. 2019 IEEE 12th International Conference on Cloud Computing (CLOUD), pp. 349 349-357. IEEE, 2019.
Chuan Guo, Awni Hannun, Brian Knott, Laurens van der Maaten, Mark Tygert, and Ruiyu Zhu. Secure multiparty computations in floating-pont point arithmetic. arXiv preprint arXiv:2001.03192, 2020.
Song Han, Huizi Mao, and William J Dally. Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding. arXiv preprint arXiv:1510.0014: 2015.
Lucjan Hanzlik, Yang Zhang, Kathrin Grosse, Ahmed Salem, Max Augustin, Michael Backes, and Mario Fritz. MIcapsule: Guarded offline deployment of machine learning service. arXiv preprint arXiv: 00590, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp- 770-778, 2016.
JB Heaton, NG Polson, and Jan Hendrik Witte. Deep learning for finance: deep portfolios. Applied Stochastic Models in Business and Industry, 33(1):3-12, 2017.
Andrew Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang. Tobias Weyand, Marco Andreetto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint 1004.0:7704004800 2017.
Tyler Hunt, Congzheng Song, Reza Shokri, Vitaly Shmatikov, and Emmett Witchel. Chiron: 2018.
Privacy-preserving machine learning as a service. arXiv preprint
Nick Hynes, Raymond Cheng, and Dawn Song. Efficient deep learning on multi-source private data. arXiv preprint arXiv: 1807.068800663) 2018
Mohsen Imani, Saransh Gupta, Yeseong Kim, and Tajana Rosing. Floatpim: In-memory accel- eration of deep neural network training with high precision. 2019 ACM/IEEE 46th Anmual International Symposium Computer Architecture (ISCA), pp. 802-815. IEEF, 2019.
Jeff Johnson. Rethinking floating point for deep learning. arXiv preprint arXiv:1811.01721, 2018.
Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. {GAZELLE): A low la- tency framework for secure neural network inference. In 27th {USENIX) Security Symposium ((USENIX) Security 18), pp. 1651-1669, 2018.
Dhiraj Kalamkar, Dheevatsa Mudigere, Naveen Mellempudi. Dipankar Das, Kunal Banerjec, Sasikanth Avancha, Dharma Teja Vooturi, Nataraj Jammalamadaka, Jianyu Huang, Hector Yuen, et al. A study of 6 for deep learning training. arXiv preprint arXiv: 1905. / 2019.
Jay J Kim. A method for limiting disclosure in microdata based on random noise and transformation. In Proceedings of the section on survey research methods, pp. 303-308. American Statistical A Association Alexandria, VA, 1986.
10

---

Under review as a conference paper at ICLR 2021
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. online: http://www. cs. toronto. edu/kriz/cifar html, 2009.
Sam Leroux, Tim Verbelen, Pieter Simoens, and Bart Dhoedt. Privacy aware offloading of deep neural networks. arXiv preprint arXiv: 120244 2018.
Kevin Lim, Jichuan Chang, Trevor Mudge, Parthasarathy Ranganathan, Steven K Reinhardt, and Thomas F Wenisch. Disaggregated memory for expansion and sharing in blade servers. ACM SIGARCH computer architecture news, 37(3):667-278, 2009.
Jian Liu, Mika Juuti, Yao Lu, and Nadarajah Asokan. Oblivious neural network predictions via minionn transformations. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 619-631, 2017.
Gregory J Matthews, Ofer Harel, al. Data confidentiality: A review of methods for statistical disclosure limitation and methods for assessing privacy. Statistics Surveys, 5:1-29, 2011.
Microsoft. Azure Machine Learning, 2020. URL https://azure.mi.rooee
com/
en-us/ wess/eeve serveiiiee www.///wssccccceeco.ooo mwch ne- learning
Fatemehsadat Mireshghallah, Mohammadkazem Taram, Prakash Ramrakhyani, Ali Jalali, Dean Tullsen, and Hadi Esmaeilzadeh. Shredder: Learning noise distributions to protect inference privacy. In Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 3-18, 2020.
Payman Mohassel and Peter Rindal. Aby3: A mixed protocol framework for machine learning. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 35-52, 2018.
Payman Mohassel and Yupeng Zhang. Secureml: A system for scalable crivacy-preeervngg machine learning. 2017 IEEE Symposium on Security and Privacy (SP), pp. 19-38. IEEE, 2017.
Krishna Giri Narra, Zhifeng Lin, Mehrdad Kiamari, Salman Avestimehr, and Murali Annavaram. Slack squeeze coded computing for adaptive straggler mitigation. In Proceedings of the Inter- national Conference for High Performance Computing, Networking, Storage and Analysis, pp- 1-16, 2019a.
Krishna Giri Narra, Zhifeng Lin, Yongqin Wang, Keshav Balasubramaniam, and Murali Annavaram. inference in machine learning services using trusted execution environments. arXiv preprint arXiv: 1912.0449 2019b.
Intel
Nervana. AI training. 2018.
Intel
unveils
Neural Net L-1000 for accelerated URL -et--eettt----
Nervana
intel-und sitellunveils Seeveilll-ervanee nervana neural net-netee 1-1000 for 1cc100000oooooeelleeeeeeee -
Olga Ohrimenko, Felix Schuster, Cédric Fournet, Aastha Mehta, Sebastian Nowozin, Kapil Vaswani, and Manuel Costa. Oblivious multi-party machine learning on trusted processors. In 25th {USENIX) Security Symposium (( (USENIX) Security 16). pp. 619-636, 2016.
M Sadegh Riazi, Bita Darvish Rouani, and Farinaz Koushanfar. Deep learning on private data. IEEE
Security & Privacy, 17(6):54 63, 2019.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3)2211-25) 2015.
Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang Chich Chen. Mo- bilenetv2: Inverted residuals and linear bottlenecks. Proceedings of the IEEE conference on computer vision and patlern recognition, pp. 4510-4520, 2018
Reza Shokri and Vitaly Shmatikov.
deep learning. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, pp. 1310-1321, 2015.

---

Under review as a conference paper at ICLR 2021
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 2014.
Jinhyun So, Basak Guler, A Salman Avestimehr, and Payman Mohassel. Codedprivateml: A fast and privacy-preserving framework for distributed machine learning. arXiv preprint 2019.
Nancy Spruill. The confidentiality and analytic usefulness of masked business microdata. Proceed- ings of the Section on Survey Research Methods, 1983, pp. 602-607, 1983.
ADP Team. Learning with privacy at scale. Apple Mach. Learn. J, 1(9), 2017.
Florian Tramer and Dan Boneh. Slalom: Fast, verifiable and private execution neural networks in trusted hardware. arXiv preprint arXiv:1806.0323) 2018.
Sameer Wagh, Divya Gupta, and Nishanth Chandran. Securenn: 3-party secure computation for neural network training. Proceedings on Privacy Enhancing Technologies, 2019(3):26 2019.
Ji Wang, Jianguo Zhang, Weidong Bao, Xiaomin Zhu, Bokai Cao. and Philip S Yu. Not jus privacy: Improving performance of private deep learning in mobile cloud. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 2407- 2416, 2018
Yuanzhong Xu, Weidong Cui, and Mareus Peinado. Controlled-channel attacks: Deterministic side channels for untrusted operating systems. In 2015 IEEE Symposium Security and Privacy, pp. 640-656. IEEE, 2015.
Jiajun Zhu, David Ferguson, and Dmitri A Dolgov. System and method for predicting behaviors of detected objects, February 25 2014. US Patent 8,660,734.
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In Advances in Neural Information Processing Systems, pp. 14747-14756, 2019.
A PRIVACY GUARANTEE
Darknight provides privacy by matrix masking. But how can one implement matrix masking, to attain desirable privacy measures?
popular approach would to keep all the variables in their floating point representations, while adding Gaussian noise (or uniform noise) to the vector we would like to protect. This line of work has gained attention recently, as the industry moving towards efficient floating-pot -pintt computa- tions. Many DNN accelerators use BF (Kalamkar et al. 2019) which is half precision floating point. This format is used in Intel Xeon Processors, Intel FPGAs (Nervana 2018 AI 2018). Google Cloud TPUs (Cloud) 2018 Authors (018) and Tenserflow (Google 2018 Authors 2018). In this scenario, we measure privacy through the concept of leaked information. Leaked information indicates how much information the masked vector (data after blinding) posses, about the raw data (Guo et al., 2020) Matthews et al. 2011). In the other words, it represents the amount of information the adversary can potentially gain from the data, if it has access to an unlimited computational power.
In this section, we will keep all the variables in their floating point representations. Thus, all the numbers and random variables are real valued, even when not stated explicitly. We will first explain a general matrix masking introduced by (Cox) 1994). Next, we will explain Darknight privacy, through the notation used in matrix masking. Finally, we will calculate the information leakage in our masked matrix, as measure of privacy.
Matrix Masking: Introduced by (Cox) 1980 1994), matrix masking scheme can be used for variety of reasons such as noise addition, sampling and etc. The general form of BXA C' is used for protecting Matrix X. In the above formula B, A and C are called record transformation mask, attribute transformation mask and displacing mask respectively. Any of these matrices can be used for encoding data based on the data privacy goal. For instance, (Kim 1986) et al. first added a random noise to data and then transformed it to form distribution with the desired expected value and variance, by carefully
12

---

Under review as a conference paper at ICLR 2021
tuning A and B. (Spruill 1983) empirically compared different masking schemes including additive and multipiccative noise. We will show that how Darknight can be a form matrix masking, with the right choice of the matrices A, B and C.
DarKnight with Matrix Masking: Following notation in equation 1 our goal is protect the vectors x,, by adding random noise to each as follows
x0
02,1 + xi,Kx(K) + Oi,(K+))F. i= 1. (K + 1)
(10)
where r is random noise vector, and ai,j's are also chosen randomly. Now first, we denote X [x()), ,..., xx(),...,((t xx) the masked matrix that we send to unsecured GPU. In this case, the equation equation I0 can be
be the matrix that we would like to protect, and X [x().... x(K) to be
rewritten as follows.
X-X-Atr.c
(11)
where the matrix A lasglas E R(*+)x((++)) contains some values of as 's, and c.. (on,(K+)):....... ((K+),(()))))))))
We also prefer to choose a matrix A, with a condition number close to one, so that our blinding and unblinding algorithm remains numerically stable. For this purpose, orthogonal matrices serve us the best. In addition to that, the transformation of the matrix whose entities are independent and identically distributed standard normal variants is invariant under orthogonal transformations. Therefore, if an orthogonal matrix is used for blinding, the distribution of the raw data and blinded
data remains the same (Kmm 1986). which is preferable in data privacy.
Measuring Privacy Performance:
In this section, we bound the information that leaks, when using Darknight's masking approach.
The amount of information leaked by x(0's about x()) is the mutual information between these two variables, defined by
1(x0))x()) ((Kt)) = =((()) (oxx)))-n(x(01)) 1xx(0)x(1)
x(K+))).
(12)
Here, 1(--) denotes the Shannon entropy function. Note that the information that adversary can po- tentially learn about x by having all x' is fundamentally bounded by / x(1) x(K+))) Next, we will rigorously bound this information leakage and show how can be bounded by prop- erties of the noise.
Theorem 2. Assume that X X'....,X X are scalars such that |X C1 for all i. Suppose ai 's real non-zero scalars and R. denotes a Gaussian random variable with variance o². Also X' is defined as
K X
Σ J=1
aKKH)RR 1= K+
(13)
Then the information leaked from Xt's about Xi is bounded by
K2(K +1)0fa²
Tx';,' x(k+1) ...K,,,,((K,t)))
j =1...., K.
(14)
Q²0²
Here ā = m |رريع and a = min.,j laa.t-
Proof. To prove equation 14 first note that
K+1
1
1xx;;X) < (K (K+1) max (x);8))
(15)
13

---

Under review as a conference paper at ICLR 2021
Now if we conclude the proof by just showing that r(x;;
K² Caa² 0²
Since anj 's are non-zero,
we have
I (x = I (,,,,);;')
I
aj,i' Σ anxx + tocktNiiR)
K
H
Σ
X'' + taktt))lll) - 11
Σ a + +acK+1,.Rf
(3)
K
H
Σ
'n + +a(K+))aR H (oCK+),)l)
V=1
1
Σ ai,ix
Σ
aiii + aikt)))lt)
(16)
Here, for equality (1), we simply replaces X with its definition. (2) is due to the definition of the mutual information (I(X; + Y) H(X + Y) HY))). Finally, incquality (3) holds due to Lemma Now, note that since | S C1 we have
K
Σ x
S C1
Σ and & K C1 max lar,sl 1=1
(17)
1,
Thus, ΣK at X is bounded by KCjā and also o(K+1) is zero-mean Gaussian random variable with variance al a2 Therefore, using Lemma we have
K
K
Var EE axx))
Σ
a x + +a(K1)aRR <
(KT1),,
1=1
1=1
K²Cfa² a²0²
(18)
Finally, using equation 16 equation
18
we conclude that
K2G02
(19)
a²0²
Combining equation and equation 19 yields our result,
K2(K + 1)Cfa²
1 7xx);11 ..... p(K+1)) )
< (K 11 max 7 (x);8') <
(20)
a²0²
Lemma 1. Suppose that X and Y are two independent random variables. Then have,
max (H()) < H(X + +Y).
(21)
Proof. Since X and Y are independent, we have H[X++11 X(Y and H(YIX) H(Y)) Therefore,
H(X Y) 2 H(X Y|X) H( H(Y) The argument shows that H(X + Y) 2 H(X), which concludes the proof.
(22)
n
14

---

Under review as a conference paper at ICLR 2021
Assume that X Px is a random variable, and R (H, is Gaussian random variable with variance o² and mean μ.. Then we have.
Lemma 2.
( Var(X)
(23)
σ²
where Var(X) is variance of the random variable X.
Proof. Because is fixed and so T(X; X + R) T(X:X R- 11). without loss of generality, we assume that l = O. Define the random variable Z f-) to be the probability density function of the random variables X and Z. respectively, Also let ((x) V2
X + R, and let fx(+) and
/2 to be the probability density function of standard Gaussian random variable.
We are interested in
T(X: X = H HR).
(24)
Since R is a zero-mean Gaussian random variables with variance o², we have
((R) 2
log (og(2
(25)
It remains to bound (z) in equation 24 Note that the probability distribution function of Z. fz)),,
will be
fz(t) f
/ fx(x)
x
dx ExxPx
[ x
(26)
where the last expected value is over the distribution of X. Now that we have pdf of the random variable Z. we can calculate and bound its entropy as follows.
/ fz(z) log (fz(2)) de
H(Z)
EXINPX
I1
2
log
ExINPx
-
Φ
22
dz
S f
EEIMPX
I1
2
Exerr Px
log
- Φ
22
2
dz
F1 - 2
22
2
EF P2
log
de
(27)
The only inequality in the equations above is due to Jensen's 's inequality (since - (og(z) is a convex function). Now we can explicitly calculate the integral in the last line of equation 27 (as they are all Gaussian integrals).
) log
11
D2
1 )) dz log(2Teeo)) +
202 (01 xx2)
(28)
2
Combining equation and
and equation 27 bounds (Z) as desired,
1
log (2Tee=²) 2 + X)r(X)
(2) < Er, pr Px
log(2 (TTeo + 20 (x) - x2
(29)
2
o²
Finally, combining equation
24
equation 25 and equation 29 yields
log (2me0²) + Var(X)
= Var(X)
I(X;X +
log( (og(2neo))=
(30)
2
o²
2
o²
which concludes the proof.
Theorem 2 shows that by increasing power of the noise, one arbitrarily reduce the leaked in- formation. Please note that for deep learning applications normalization is common in the prepos- sessing phase. Furthermore, many of the networks such as MobileNet and ResNet variants take advantage of the batch normalization layers. Hence, the value of C₁ in the above theorem is bound
by (= in case l2 normalization is used (which obviously implies C₁ < 1). With batch size of == 4 in the our scheme, setting variance of the noise, r. to be o² Se and limiting a²
a² 10, we
have the upper bound 1e-6 on the leaked information, through Theorem 2 This means that in a Megapixel image, the maximum information leakage is bound by pixel.
15

---

Under review as a conference paper at ICLR 2021
B
TRAINING DECODING
(K)
01,1
01,K+1
[K
122
A
X
0K+11
OK+LK+1
(K+1)x(K+1)
(K)
IN
(N)x(K+1)
8(2))
((K)
B1,1
3L,K
8
B
.
82,1
8K
(K+1)x(K)
((K
(N)
(I)
[K++1)
8
{(K)
(K+1)
82
82
X
8
1K+1)
N
N
(N)x(K+1)
N
(N)x(K)
We formed & = xA in TEE and send it to GPU, at the same time GPU generates ő 6B and then computes y 8Tx X.
Tr|X] = Σ X
i=1 TrXY = Tr\YX]
(AB)* = AT
(A")*=A
The goal is to compute Σx= x(0)x ()) by simply multiplying
Tr(ro" X) = TrTB55 > = Tr(A "'A'" x) = TT((BTT)) (6'x)
Hence if the below equation holds, we get the desired combination in the decoding:
1
0
0
A
Kx((+1)
C TRAINING ALGORITHM
In this section we provide implementation modifications for training algorithm.
Forward Pass: In order to use intermediate feature maps for backward propagation, need to store them during forward pass. To achieve this goal without compromising privacy, the encoded inputs(x(*) are stored in GPU memory during forward pass.
Backward Propagation: In the backward propagation there are two sets of linear operations that we are willing to offload to GPU. First computing gradients with respect to input (6) and second the gradient with respect to weight (v W). For computing (8), wights are already stored in the GPU, derivative of activation function is computed inside SGX and offloaded to GPU, 5 of the next layer is also computed in the GPU and passed to this layer. the other hand, for computing (vW) the blinded inputs are used. We also do not expose each individuals weight update as we explain in the weight update section.
16

---

Under review as a conference paper at ICLR 2021
Please note that in equation 4 the encoding of å does not have a privacy reasons. We use this type of encoding for enabling the simple secure aggregation mechanism. In other words, linearly combining g(t)s can be operated the GPU and we do not need to protect matrix B.
Matrix B:
Matrix A and r: We need to mention In equation 5 the only exposed matrix is matrix B. Matrix A and are kept inside SGX and we use them for blinding/unbinddng.
Weight Updates and DarKnight Secure Aggregation: We use customized version of secure ag- gregation for weigh updates (Bonawitz et al. 2017] Zhu al., 2019). As explained section [.4 weights are stored outside the enclave and hence, update the weights. To protect the input data, we need to have in mind V W may Icak some informa- tion about the intermediate features which leads to input leakage. For preventing this data leakage, one solution is increasing the batch size and, hence the number of V V that are merged increases. Nonetheless, it infeasible to store VW for all the layers inside SGX at the same time because of the memory limitation. To resolve this, we introduce the term Viriual Batch, which is essentially the largest number of images that we can be processed the same time and fits inside SGX. After each virtual batch computation, we have to evict the pages storing V VW to the untrusted hardware consid- ering required precautions to store encrypted data. After computing a certain number of v V''s, we use sharding mechanism and partition these vW read the corresponding partitions inside the SGX, process them one by one and send the updates to the weights on the fly.
need to send v W to the untrusted hardware to
The algorithm backward propagation for one epoch is shown below:
Algorithm Backward Propagation Algorithm for one epoch
1: procedure BACKWARD(W..0
gets current weights and loss function as inputs
2: V +- Virtual Batch.size()
3:
K N +- V
4: for = 1,2.... N do
D for each virtual batch
5:
Pages
6:
for 1 = 1, 2, L do
D for each layer
7:
Compute 7WT Compute 67-1
D weight updates for layer I and virtual batch
8:
b delta of the previous layer for virtual batch v
9:
Encrypt(Page.)
> Encrypt page for virtual batch
10:
Evict(Page.))
> Evict page for virtual batch
11:
Pages.append(C Page,)
D Keeps the pointer to Page,)
12:
WW + Weight_ Update(Pagss))
13:
W WBow Wiew 1 x vW,
14:
return w
D the new weights for the next epoch
In line 3, the actual batch size is divided to the virtual batch size to get the number of virtual batches we have to process. Line 4 repeats the For loop for each virtual batch size. Line 6 to 8 shows how VW is computed for each layer of DNN Line 9 Encrypt page that is containing all the weight updates of the network for that virtual batch. Line 10 calls evict function for page v that is containing V As a result, this page moved to GPU memory with all the precaution. In line 11 that reference to that specific page will be saved for W Weight U Udate function. This function has a reference to all the pages containing part of the VW and construct the whole vW. Finally in Line 13 the v W is sent to GPU for the weight updates.
further computations. Line 12 calls
Training Accuracy: More results on the effect of noise power on training accuracy provided in
Fig. 5
D INTEGRITY
As explained in section 3.5 we provide integrity check by adding redundant equation to each virtual batch. This leads to having K + 2 linear equations for recovering K + 1 unknowns. The extra equation can help us verify the solution of the first K + 1 equation for the K + 1 unknowns, in the last equation. If the solution is not consistent with the last equations, this means one of the GPU cores may not function properly their data is modified by an attacker. So any single faulty
17

---

Under review as a conference paper at ICLR 2021
Oten -utel ND -A2ee wi
Dats 5004 200n ROM
der
Nember
Wander Spaat
(b) CIFAR-I0 on ResNet152 (c) CIFAR-IO on MobileNetV2 Figure 5: Training accuracy of DarKnight in different DNNs and datasets for batch-size 128
(a) CIFAR-100 on VGG16
computation or multiple non-colluding faulty computations can be detected. The forenamed system of linear equations is described below.
K+1
K
K (B3s (0) B3,CK1)) r) j j= 1.... K+2
VW,
Eg
j
(i) 0
Σ
(31)
In order to avoid floating point arithmetic round off errors affecting our judgment on error detection, we define a threshold on the amount of data mismatch our system tolerate. This threshold should be larger than the system precision because we do not want computation round off to be flagged as error. In scenario where adversary adds perturbation modify the result, If the amount of this perturbation is less than the system precision, it doesn't affect the convergence and hence we discard it.
E SLALOM
Among those approaches, Tramer & Boneh (2018) introduced Slalom an inference framework that uses TEEs to protect data privacy and integnity. Slalom uses the Intel SGX enclave to blind input data x from client with additive stream cipher noise r. The blinded data (x + r) is then sent to an untrusted GPU where linear operations are performed. The computed data W (x + r) is then returned the enclave which decode the correct computational output W by subtracting the precomputed W r. Here W the model parameter matrix. Securely storing multiple instances of r's and their corresponding W r's within the enclave memory, occupies substantial amount of memory for large DNNs. On the other hand, storing an encrypted version of these values outside the enclave memory, leads to sigmificant encryption and decryption costs, as these values are needed after each linear operation. In addition to that, Slalom cannot be used for training, since it precomputes W Precomputing the blinding factors is not feasible during training since the model parameters W are updated after processing every batch. Computing W r inside the SGX after every batch also defeats the purpose of offloading the linear computations to GPU. Moreover, Slalom works quantized models which needs a meticulous quantization algorithm not to affect the accuracy training. Hence, the idea cannot be used in training as it is. Our idea addressed all the issues that Slalom paper introduced its challenges for training.
F GPU COMPARISON AND SCALABILITY
Table 4 shows the performance of a baseline that uses GPU to perform the entire training. Clearly users of this baseline cannot protect their data. However, using GPU for training large DNNs can give us 120X speedup relative to baseline fully implemented on SGX. DarKnight bridges this gap by more than 10X while protecting data privacy. Hence, there is no free lunch to obtain privacy, but goal is to provide the best performance when privacy is not optional, is the case in many operational settings such as medical imaging.
As we showed in our earlier analysis DarKnight tilts the computational balance from linear oper- ations to non-linear operations running on SGX. Hence, the overall execution time is determined by SGX performance. But this tradeoff is not fundamental bottleneck to scalability. With the shift towards server disaggregation Lim et al. (2009); Guleria et al. (2019) in the cloud it is possible separate GPU pool from CPU pool and increase the number of concurrent SGX enclaves that
18

---

Under review as a conference paper at ICLR 2021
Table Speedup in GPU relative to SGX in VGG16 Training on ImageNet. The baseline is imple- mented fully on Intel SGX
Operations
Linear Ops
Maxpool Time
Relu Time
Total
Forward Pass
126.85 149.13
11.86 5.47
119.60 6.59
119.03
Backward Propagation
124.56
can concurrently feed GPU. Furthermore, DarKnight can be seamlessly adapted to a distributed training platform that uses data parallelism across GPUs, since inputs sent to different GPUs can be concurrently blinded using a dedicated set of SGX enclaves that feed these GPUs. Hence, we believe DirK has cost-effective scalability characteristics when privacy an important consideration in training.
19


Reviews:
[{"review_id": "qjyNn5zx_u2", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper uses a combination of a Trusted Execution Environment and masking techniques to perform secure inference and training with the help of GPUs.\n\nOverall the paper is well written but could be improved in the presentation of its security guarantees and how it presents related work.\n\nTable 1 is confusing; please consider removing it or clarifying that security/privacy guarantees in each approach are completely different and solve orthogonal problems. Additionally please consider referencing the work more precisely on what training and inference algorithms you refer to.\nFor example:\n- how do DP mechanisms such as Rappor perform training\n- which inference algorithms do you refer to in MlCapsule, which training algorithms in ObliviousTEE.\n- is Chiron used only for training.\n\nPrivacy/integrity guarantees obtained should be clearly stated; how they are different from those achieved by SGX, FHE, MPC, DiffPrivacy. Please see table 1 in Slalom (ICLR 2019) for an example.\nIt also seems that weights are revealed after every batch update. The paper says that it is fine referring to the work by Bonawitz et al.; but they do so in federated learning setting which is different from the one considered here.\n\nClarity:\nThe paper is presented in an accessible manner. \nSome details however need to be explained further regarding generation of the masking variables for inference and training. For example, how are \\alpha, \\beta and \\gamma generated. It is also important to include the time it takes to compute them in the evaluation. It seems they have to be re-generated for every batch.\nIn the experimental section please clarify if blinded batches can be generated in a streaming manner.\n\n\nOriginality:\nThe paper expands the ideas from Slalom (ICLR 2019) of outsourcing some computations from SGX to GPU to speed them up. While Slalom considered only inference, this work considers training as well. The masking technique is different from Slalom and gives a performance overhead in the number of input/batch parameters as opposed to the size of the network. But it seems, that integrity and privacy that the authors obtain in return is different.\n\nSignificance:\nThe paper tries to overcome some of the issues of using TEEs for ML — CPU and small memory sizes — by offloading linear computations to GPUs. The evaluation shows that it does obtain speedups compared to pure SGX baseline, that is, blinding/unblinding is still faster than linear operations. Hence, the work is important. However, privacy and integrity guarantees are weaker than what one will obtain with Slalom (for inference) and SGX.\n\n\npros:\n- an interesting idea to mask only the inputs and not the weights during inference and training\n- speedup from outsourcing linear operations to GPUs from SGX seems worth paying the cost of masking\n\ncons:\n- overall security guarantees are not formally/informally concisely stated\n- integrity and privacy guarantees are weaker than related work\n- it is not clear these guarantees will be desirable in practice\n\nSpelling:\n- Basline\n- DiiP\n- page 4 colours seem to change from blue to red when referring to the same variables.\n- Intel Soft Guard Extension\n- we simply replaces", "extra_scores": {}, "extra_text": {}}, {"review_id": "EdMjkhCVkXD", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Paper Summary:\n\nThe paper builds on previous work like Slalom to propose a new secure training and inference protocol in the TEE+GPU paradigm. The main technical contribution of this work is a new blinding algorithm that dramatically reduces the memory required to store the blinding parameters (decoupling it from the input/model size). The authors then build on this to extend their blinding scheme to the training use-case.\n\nScore Rationale:\n\n- The proposed blinding scheme does indeed provide a ~1.5x performance improvement over the Slalom baseline\n- There two concerns about the correctness of the security argument provided by the authors\n  - The security proof as argued in the paper does not extend from the single pixel to multi-pixel case and as such does not apply to real-world images\n  - The reviewer believes that this not a mere gap in the security proof. Infact for certain allowed settings of parameters there are practical attacks.\n\nDetailed Comments:\n\n- The core security argument is rooted in Theorem 1. This theorem in prose rightly claims that the blinded pixels at any specific index, leak almost no information about the pixels at that specifc index in the source images.\n- This statement critically makes no claims whether all the pixels in all the blinded images in their totality will leak information about a given pixel index in the source images.\n- The authors then argue that the total information leaked is bounded by the sum of the information leaked at each index (based on the blinded pixels at that particular index).\n- The statement is not true. The total information leaked is bounded by the sum of the information leaked at each index (based on the blinded pixels across all indices)\n- The next concern to evaluate is whether this is just a technical/theoretical gap in the proof or whether it leads to a practical attack.\n- Consider the case where the parameters are set as in section 5.2 with K=1. Note that reducing K improves the leakage bound in principle.\n- In this particular case we can rewrite the blinding equations s.t. $x^{(1)} = \\frac{\\overline{\\mathbf{x}}^{(1)}\\alpha_{2, 2} - \\overline{\\mathbf{x}}^{(2)}\\alpha_{2, 1}}{\\alpha_{1, 1}\\alpha_{2, 2} - \\alpha_{1, 2}\\alpha_{2, 1}}$\n- Thus the source image can be represented as a simple linear combination of the outputs and attacker job reduces to the task of guessing the two weighting coefficients\n- Given the strong priors on natural images this seems to be a very tractable problem.\n\nAdditional Comments:\n\n- There are three potential ways to work around to address the above comments\n  - Devise a new proof for information theoretic security\n  - Argue the computational hardness of the search problem\n  - Devise a new blinding scheme that does not have this issue\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "E2ldJ2x3n_", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "\n\nResults - The two main proposed benefits of the approach are increased speedups in inference as well as training over  Slalom and just SGX. Looking at Figure 2 and Figure 4, the spped-ups do not appear to be consistently significant. I do appreciate that the authors show the results for MobileNetV2, for which the proposed algorithm is supposed to have less improvement in training time. Overall, I think, given that the main selling point of the time is faster training and inference, it fails to provide a reliable boost in either of them.\n\nExperimental Comparisons - I would have appreciated a comparison with other methods especially those that allow training while maintaining privacy.  While the authors make a note of them in Table 1, their differences with the proposed approach and where one is supposed to be better than the other is discussed neither conceptually nor experimentally (except Slalom)\n\n\nNovelty - The main algorithmic novelty of the paper is exporting the compute-heavy linear computes to a GPU outside the secure enclave by using blinding-unblinding techniques to protect the privacy.  In my opinion,  while it is a very nice and concise thing to do (along with the results on its privacy guarantee), it is not significantly impactful or interesting to provide enough novelty to this paper. If this would have led to a huge increase in performance margins, I would have said a simple solution that leads to dramatic increase in performance is amazing! However, that is not the case either. \n\nSo, given these reasons I am inclined to reject at this point. However, I would encourage the authors to discuss the other techniques in more detail, compare with them and point out situations where this technique can have a larger impact.\n\n=====\n\nI have read the authors' response and my comments remain the same as above especially the paragraph regarding novelty. I am keen to see a revised version of this paper.", "extra_scores": {}, "extra_text": {}}, {"review_id": "7jzXNBn3F_Q", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\nThis paper aims at addressing both  secure training and inference of DNNs. The proposed method relies on securely off-loading the compute-intensive part of the operations from a trusted CPU environment which has low-performance, to an untrusted high-performance gpu. Their suggested method builds on SOTA, Slalom, but is shown to have less memory over-head. Also, they point-out that their proposed scheme supports training phase as well, as opposed to Slalom which targets inference. For off-loading the computation to the untrusted GPU they propose some matrix blinding techniques.\n\n\npros:\n\n+ The problem is interesting, and moving towards a solution for it is really helpful, since right now trusted environments only exist for CPUs in practice, which hinders fast execution of matmuls, as done in GPUs. \n\n+ The approach seems to offer some speedup over the SOTA, Slalom. However the provided guarantees seem questionable. \n\n\ncons:\n\n- About the training phase, I think the nuances of security and privacy are a bit tangled here. Private training refers to protecting the training data, so that sensitive information within the data is not encoded/embedded in the model once the training is finished. This would be similar to what differential privacy and differentially private SGD provide. However, the suggested method in the paper seems to aim at providing secure training, in which data is not exposed to outsiders during training, however private information might still leak to the model, based on my understanding. I would like to know if that is the case. \n\n- I don't quite understand that during training, what is sent to the GPU and what is calculated locally in the trusted environment? Since the GPU needs the weights in the clear for the forward pass, and calculates the gradients for backprop, it seems to have access to the gradients as well, which can be subject to attacks, shown in [1]. \n\n- The privacy guarantees are not completely clear to me.  It seems that the work is built upon the notion of Mutual Information, a heuristic approach. However, since this notion is average case, what would that mean for the guarantees? How does it effect each data point? It is stated that \" Using these parameters DarKnight guarantees that no more than one bit of information is\nleaked from a one megapixel input image. \", is this on average? or for each image, the guarantee is that no more than one bit leaks?\n\n\nReferences\n\n[1] Zhu L, Liu Z, Han S. Deep leakage from gradients. InAdvances in Neural Information Processing Systems 2019 (pp. 14774-14784).", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: While reviewers appreciated the simple approach of this work, the biggest concern reviewers had was with the security guarantee of the method. R4 argued that in a certain case recovering an original image x_1 amounted to guessing 2 coefficients. In the discussion phase the authors argued that security amounts to the adversary guessing 4 floating point numbers, not 2, which requires 100s of millions of years to decode an image correctly. However, R4 is correct that only 2 floating point numbers are necessary. This is because, as described by R4 when one sees outputs x_1 * a_{2,2} and x_2 * a_{2,1}, they can reconstruct x_1 as:

x_1 = (x_1 * a_{2,2} - x_2 * a_{2,1}) / (a_{1,1} * a_{2,2} - a_{1,2} * a_{2,1})

Now define:

b_1 := a_{2,2} / (a_{1,1} * a_{2,2} - a_{1,2} * a_{2,1})
b_2 := a_{2,1} / ((a_{1,1} * a_{2,2} - a_{1,2} * a_{2,1})

Thus the above equation can be written as:

x_1 = x_1 * b_1 - x_2*b_2

So an adversary needs to guess 2 floating point numbers. Further, R4 points out that an adversary can obtain x_1 up to a scale factor by simply guessing the relative ratio of the the 2 unknown floating point numbers, i.e., if our guess is c:

x_1/c = x_1 * (b_1/c) - x_2 * (b_2/c)

This is a single floating point number, and not all floating point numbers need to be checked. For many images, information can be leaked even if the true scale of the image is not known.

For this reason I would urge the authors to strengthen the security guarantee of their approach. One way to do this would be to adapt the method so to make the resulting guarantee be a more standard one (e.g., differential privacy, standard cryptographic hardness guarantees). This would eliminate the main reviewer concerns and greatly strengthen the paper.
Decision: Reject