Towards Trained Model Confidentiality and Integrity Using Trusted Execution Environments

Abstract

In the security of machine learning, it is important to protect the confidentiality and integrity of trained models. The leakage of the data in a trained model leads to not only the infringement of intellectual property but also various attacks such as adversarial example attacks. Recent works have proposed several methods using trusted execution environments (TEEs), which provide an isolated environment that cannot be manipulated by malicious software, to protect the trained models. However, the protection using TEEs generally does not work well by simply porting the program of a trained model to a TEE. There are mainly several reasons: the limitation of the memory size in TEEs prevents loading a large number of parameters into memory, which is particularly a characteristic of deep learning; the increase in runtime due to TEEs; and the threat of parameter manipulation (the integrity of the trained model). This paper proposes a novel method based on TEEs to protect the trained models, mainly for deep learning on embedded devices. The proposed method is characterized by memory saving, low runtime overhead, and detection of parameter manipulation. In the experiments, it is implemented and evaluated using Arm TrustZone and OP-TEE.