TPMP : ARM TrustZone을 활용한 DNN 추론 과정의 기밀성 보장 기술
TPMP: A Privacy-Preserving Technique for DNN Prediction Using ARM TrustZone
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
딥러닝과 같은 기계학습 기술은 최근에 광범위하게 활용되고 있다. 이러한 딥러닝은 최근 낮은 컴퓨팅 성능을 가지는 임베디드 기기 및 엣지 디바이스에서 보안성 향상을 위해 ARM TrustZone과 같은 신뢰 수행 환경에서 수행되는데, 이와 같은 실행 환경에서는 제한된 컴퓨팅 자원으로 인해 정상적인 수행에 방해를 받는다. 이를 극복하기 위해 DNN 모델 partitioning을 통해 TEE의 제한된 memory를 효율적으로 사용하며 DNN 모델을 보호하는 TPMP를 제안한다. TPMP는 최적화된 memory 스케줄링을 통해 기존의 memory 스케줄링 방법으로 수행할 수 없었던 모델들을 TEE 내에서 수행하여 시스템 자원 소모를 거의 증가시키지 않으면서 DNN의 높은 기밀성을 달성한다.
Abstract
Machine learning such as deep learning have been widely used in recent years. Recently deep learning is performed in a trusted execution environment such as ARM TrustZone to improve security in edge devices and embedded devices with low computing resource. To mitigate this problem, we propose TPMP that efficiently uses the limited memory of TEE through DNN model partitioning. TPMP achieves high confidentiality of DNN by performing DNN models that could not be run with existing memory scheduling methods in TEE through optimized memory scheduling. TPMP required a similar amount of computational resources to previous methodologies.
참고문헌 (28)
- Li E, "Edge intellige nce : On-demand deep learning model co-inference with device-edge synerg y", 31~36 (2018)
- Li H, "Learning IoT i n edge : Deep learning for the internet of things with edge computing", IEEE network, 32(1), pp.96~101 (2018)
- Wu C, "Mac hine learning at facebook : Understan ding inference at the edge", 331~344 (2019)
- Xu X, "Scaling for edge inference of deep neural netw orks", Nature Electronics, 1(4), pp.216~222 (2018)
- Sundararajan K, "Deep l earning for biometrics: A survey", AC M Computing Surveys (CSUR), 51(3), pp.1~34 (2019)
- He K, "Deep residual learning for image recognitio n", 770~778 (2016)
- Xiong W, "The microsoft 2017 conversational speech recognition s ystem", 5934~5938 (2018)
- Wang B, "Stealing hyperpar ameters in machine learning", 36~52 (2018)
- Xie P, "Customizing tr usted AI accelerators for efficient priv acy-preserving machine learning", arX iv preprint arXiv:2011.06376, ~ (2020)
- Molek, V., "Training Neural Network Over En crypted Data", 2020 IEEE Third Int ernational Conference on Data Stream Mining & Processing (DSMP), pp.23~27 (2020)
- Mo F, "Darknetz : Towards model privacy at the edge using trusted execution e nvironments", 161~174 (2020)
- Shokri R, "Membership inference attacks against machine learning models", 3~18 (2017)
- "ARM Security Techn ology Building a Secure System using TrustZone Technology"[URL]
- "Fan Mo. DarkneT Z"[URL]
- Fredrikson M, "Model inversion attacks that exploit confidence information and basic coun termeasures", 1322~1333 (2015)
- Biggio B, "Evasion attacks against machine lear ning at test time", pp.387~402 (2013), Springer
- Tramèr F, "Stealing machine l earning models via prediction {APIs}", 601~618 (2016)
- Jun So-Hee, "A Study of AI model extraction attack and defens e techniques", Proceedings of the Kore a Information Processing Society Conf erence, 28(1), pp.382~384 (2021)
- "Cve-2020-15205"[URL]
- "Cve-2021-37678"[URL]
- "Cifar-10"[URL]
- Gilad-Bachrach R, "Cryptonets : Applying neural network s to encrypted data with high through put and accuracy", 201~210 (2016)
- Hesamifard E, "Cryptodl : Deep neural networks over encrypted data", arXiv preprint arXiv:1711.05189, ~ (2017)
- Kim K, "Vess els : Efficient and scalable deep learni ng prediction on trusted processors", 462~476 (2020)
- Costan V, "Intel SGX expl ained", Cryptology ePrint Archive, ~ (2016)
- Gangal A, "HybridTEE : Secure mobile DNN execution using h ybrid trusted execution environment", 1~6 (2020)
- Mo F, "PPFL : Pri vacy-preserving federated learning wit h trusted execution environments", 94~108 (2021)
- VanNostrand PM, "Confidential dee p learning : Executing proprietary mod els on untrusted devices", arXiv prepr int arXiv:1908.10730, ~ (2019)