论文标题
定制受信任的AI加速器以进行有效的隐私机器学习
Customizing Trusted AI Accelerators for Efficient Privacy-Preserving Machine Learning
论文作者
论文摘要
信任硬件的使用已成为实现隐私机器学习的有希望的解决方案。特别是，用户可以将其私人数据和模型上传到硬件增强的受信任的执行环境（例如，启用了Intel SGX的CPU中的飞地），并以机密性和完整性保证在其中运行机器学习任务。为了提高性能，AI加速器已被广泛用于现代机器学习任务。但是，如何保护AI加速器上的隐私仍然是一个悬而未决的问题。为了解决这个问题，我们为基于未经修改的受信任的CPU和自定义的受信任的AI加速器提供了有效保留隐私机器学习的解决方案。我们仔细利用加密原始图，以建立信任和保护CPU和加速器之间的渠道。作为案例研究，我们根据开源多功能张量加速器来证明我们的解决方案。评估的结果表明，所提出的解决方案以较小的设计成本和中等的性能开销提供有效的隐私机器学习。
The use of trusted hardware has become a promising solution to enable privacy-preserving machine learning. In particular, users can upload their private data and models to a hardware-enforced trusted execution environment (e.g. an enclave in Intel SGX-enabled CPUs) and run machine learning tasks in it with confidentiality and integrity guaranteed. To improve performance, AI accelerators have been widely employed for modern machine learning tasks. However, how to protect privacy on an AI accelerator remains an open question. To address this question, we propose a solution for efficient privacy-preserving machine learning based on an unmodified trusted CPU and a customized trusted AI accelerator. We carefully leverage cryptographic primitives to establish trust and protect the channel between the CPU and the accelerator. As a case study, we demonstrate our solution based on the open-source versatile tensor accelerator. The result of evaluation shows that the proposed solution provides efficient privacy-preserving machine learning at a small design cost and moderate performance overhead.
