Please use this identifier to cite or link to this item:
Title: Goten: GPU-outsourcing trusted execution of neural network training
Authors: Ng, Lucian K. L.
Chow, Sherman S. M.
Woo, Anna P. Y
Wong, Donald, P. H.
Zhao, Yongjun
Keywords: Engineering::Computer science and engineering
Issue Date: 2021
Source: Ng, L. K. L., Chow, S. S. M., Woo, A. P. Y., Wong, D. P. H. & Zhao, Y. (2021). Goten: GPU-outsourcing trusted execution of neural network training. Thirty-Fifth AAAI Conference on Artificial Intelligence (AAAI-21), 35, 14876-14883.
metadata.dc.contributor.conference: Thirty-Fifth AAAI Conference on Artificial Intelligence (AAAI-21)
Abstract: Deep learning unlocks applications with societal impacts, e.g., detecting child exploitation imagery and genomic analy sis of rare diseases. Deployment, however, needs compliance with stringent privacy regulations. Training algorithms that preserve the privacy of training data are in pressing need. Purely cryptographic approaches can protect privacy, but they are still costly, even when they rely on two or more non colluding servers. Seemingly-“trivial” operations in plain text quickly become prohibitively inefficient when a series of them are “crypto-processed,” e.g., (dynamic) quantization for ensuring the intermediate values would not overflow. Slalom, recently proposed by Tramer and Boneh, is the first ` solution that leverages both GPU (for efficient batch compu tation) and a trusted execution environment (TEE) (for min imizing the use of cryptography). Roughly, it works by a lot of pre-computation over known and fixed weights, and hence it only supports private inference. Five related problems for private training are left unaddressed. Goten, our privacy-preserving training and prediction frame work, tackles all five problems simultaneously via our care ful design over the “mismatched” cryptographic and GPU data types (due to the tension between precision and ef ficiency) and our round-optimal GPU-outsourcing protocol (hence minimizing the communication cost between servers). It 1) stochastically trains a low-bitwidth yet accurate model, 2) supports dynamic quantization (a challenge left by Slalom), 3) minimizes the memory-swapping overhead of the memory-limited TEE and its communication with GPU, 4) crypto-protects the (dynamic) model weight from untrusted GPU, and 5) outperforms a pure-TEE system, even without pre-computation (needed by Slalom). As a baseline, we build CaffeScone that secures Caffe using TEE but not GPU; Goten shows a 6.84× speed-up of the whole VGG-11. Goten also outperforms Falcon proposed by Wagh et al., the latest se cure multi-server cryptographic solution, by 132.64× using VGG-11. Lastly, we demonstrate Goten’s efficacy in training models for breast cancer diagnosis over sensitive images.
ISBN: 978-1-57735-866-4
ISSN: 2159-5399
Research Centres: Nanyang Technopreneurship Center 
Strategic Centre for Research in Privacy-Preserving Technologies & Systems (SCRIPTS)
Rights: © 2021 Association for the Advancement of Artificial Intelligence. All rights reserved. This paper was published in Proceedings of the Thirty-Fifth AAAI Conference on Artificial Intelligence (AAAI-21) and is made available with permission of Association for the Advancement of Artificial Intelligence.
Fulltext Permission: open
Fulltext Availability: With Fulltext
Appears in Collections:NTC Conference Papers

Files in This Item:
File Description SizeFormat 
Goten_ GPU-Outsourcing Trusted Execution of Neural Network Training_YJ.pdf516.36 kBAdobe PDFThumbnail

Page view(s)

Updated on Jun 6, 2023


Updated on Jun 6, 2023

Google ScholarTM




Items in DR-NTU are protected by copyright, with all rights reserved, unless otherwise indicated.