CoChat
Sign Up
PreprintCited by 9Security and Verification in ComputingPrivacy-Preserving Technologies in DataCryptography and Data Security

The DOI matches its DataCite record; 5 of the 5 references it cites were found in a registry or an index.

Trustworthy AI Inference Systems: An Industry Research View

Open access
Cammarota, Rosario, Schunter, Matthias, Rajan, Anand, Boemer, Fabian, Kiss, Ágnes, Treiber, Amos, Weinert, Christian, Schneider, Thomas, Stapf, Emmanuel, Sadeghi, Ahmad-Reza, Demmler, Daniel, Stock, Joshua, Chen, Huili, Hussain, Siam Umar, Riazi, Sadegh, Koushanfar, Farinaz, Gupta, Saransh, Rosing, Tajan Simunic, Chaudhuri, Kamalika, Nejatollahi, Hamid, Dutt, Nikil, Imani, Mohsen, Laine, Kim, Dubey, Anuj, Aysu, Aydin, Hosseini, Fateme Sadat, Yang, Chengmo, Wallace, Eric, Norton, Pamela·2020·arXiv
DOI 10.48550/arxiv.2008.04449arXiv 2008.04449
Open this paper in CoChat — free accountOpen PDF

Abstract

In this work, we provide an industry research view for approaching the design, deployment, and operation of trustworthy Artificial Intelligence (AI) inference systems. Such systems provide customers with timely, informed, and customized inferences to aid their decision, while at the same time utilizing appropriate security protection mechanisms for AI models. Additionally, such systems should also use Privacy-Enhancing Technologies (PETs) to protect customers' data at any time. To approach the subject, we start by introducing current trends in AI inference systems. We continue by elaborating on the relationship between Intellectual Property (IP) and private data protection in such systems. Regarding the protection mechanisms, we survey the security and privacy building blocks instrumental in designing, building, deploying, and operating private AI inference systems. For example, we highlight opportunities and challenges in AI systems using trusted execution environments combined with more recent advances in cryptographic techniques to protect data in use. Finally, we outline areas of further development that require the global collective attention of industry, academia, and government researchers to sustain the operation of trustworthy AI inference systems.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2008.04449

Cites

5 of 5 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • A wealth of companies also release their guidelines or principles to demonstrate their compliance with AI trustworthiness [27, 58, 37, 15, 14, 82].

    “Besides governmental organizations, a wealth of companies also release their guidelines or principles to demonstrate their compliance with AI trustworthiness [27, 58, 37, 15, 14, 82].”

    From Trustworthy AI: From Principles to Practices (2023) · cites this paper as [15]

    The paper presents an industry research view on trustworthy AI inference systems (p. 1), and its Research and Standards section calls for global standards and best practices (p. 8). Neither passage says that companies release their own AI trustworthiness guidelines or principles to demonstrate compliance; searches for that practice found no supporting passage in our copy. (LLM, conf=0.72)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 53

  1. [9][9] Nitin Agrawal, Reuben Binns, Max Van Kleek, Kim Laine, and Nigel Shadbolt. 2021. Exploring design and governance challenges in the development of privacy-preserving computation. In CHI'21 . -
  2. [12][12] Masaud Y. Alhassan, Daniel Günther, Ágnes Kiss, and Thomas Schneider. 2020. Efficient and Scalable Universal Circuits. Journal of Cryptology (JoC) (2020). -
  3. [13][13] Ahmad Al Badawi, Jack Bates, Flavio Bergamaschi, David Bruce Cousins, Saroja Erabelli, Nicholas Genise, Shai Halevi, Hamish Hunt, Andrey Kim, Yongwoo Lee, Zeyu Liu, Daniele Micciancio, Ian Quah, Yuriy Polyakov, Saraswathy R.V., Kurt Rohloff, Jonathan Saylor, Dmitriy Suponitsky, Matthew Triplett, Vinod Vaikuntanathan, and Vincent Zucca. 2022. OpenFHE: Open-Source Fully Homomorphic Encryption Library. Workshop on Encrypted Computing & Applied Homomorphic Cryptography. https://dualitytech.com/product/analytics-and-machine-learning/. -
  4. [14][14] Rajeev Balasubramonian, Jichuan Chang, Troy Manning, Jaime H Moreno, Richard Murphy, Ravi Nair, and Steven Swanson. 2014. Near-data processing: Insights from a MICRO-46 workshop. IEEE Micro 34, 4 (2014), 36-42. -
  5. [18][18] Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. 2019. CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel. In USENIX Security Symposium . 515-532. -
  6. [26][26] Ferdinand Brasser, Tommaso Frassetto, Korbinian Riedhammer, Ahmad-Reza Sadeghi, Thomas Schneider, and Christian Weinert. 2018. VoiceGuard: Secure and Private Speech Processing. In INTERSPEECH'18 . -
  7. [27][27] Ferdinand Brasser, David Gens, Patrick Jauernig, Ahmad-Reza Sadeghi, and Emmanuel Stapf. 2019. SANCTUARY: ARMing TrustZone with User-space Enclaves. In NDSS'19 . -
  8. [28][28] Lennart Braun, Daniel Demmler, Thomas Schneider, and Oleksandr Tkachenko. 2022. MOTION - A Framework for Mixed-Protocol Multi-Party Computation. Transactions on Privacy and Security 25, 2 (2022). -
  9. [33][33] Nicholas Carlini, Matthew Jagielski, and Ilya Mironov. 2020. Cryptanalytic Extraction of Neural Network Models. arXiv:2003.04884 [cs.LG] - · arXiv
  10. [35][35] Kamalika Chaudhuri, Claire Monteleoni, and Anand D Sarwate. 2011. Differentially private empirical risk minimization. Journal of Machine Learning Research 12, Mar (2011), 1069-1109. -
  11. [39][39] Ilaria Chillotti, Marc Joye, and Pascal Paillier. 2021. Programmable Bootstrapping Enables Efficient Homomorphic Inference of Deep Neural Networks. In Cyber Security Cryptography and Machine Learning . Springer. -
  12. [40][40] Joseph Clements and Yingjie Lao. 2018. Backdoor attacks on neural network operations. In GlobalSIP'18 . IEEE, 11541158. -
  13. [41][41] Joseph Clements and Yingjie Lao. 2018. Hardware trojan attacks on neural networks. arXiv preprint arXiv:1806.05768 (2018). - · arXiv
  14. [43][43] Morten Dahl, Jason Mancuso, Yann Dupis, Ben Decoste, Morgan Giraud, Ian Livingstone, Justin Patriquin, and Gavin Uhma. 2018. Private Machine Learning in TensorFlow using Secure Computation. arXiv preprint arXiv:1810.08130. - · arXiv
  15. [44][44] Roshan Dathathri, Blagovesta Kostova, Olli Saarikivi, Wei Dai, Kim Laine, and Madan Musuvathi. 2020. EVA: An encrypted vector arithmetic language and compiler for efficient homomorphic computation. In PLDI'20 . -
  16. [45][45] Roshan Dathathri, Olli Saarikivi, Hao Chen, Kim Laine, Kristin Lauter, Saeed Maleki, Madanlal Musuvathi, and Todd Mytkowicz. 2019. CHET: an optimizing compiler for fully-homomorphic neural-network inferencing. In PLDI'19 . -
  17. [46][46] Kevin Deforth, Marc Desgroseilliers, Nicolas Gama, Mariya Georgieva, Dimitar Jetchev, and Marius Vuille. 2022. XORBoost: Tree Boosting in the Multiparty Computation Setting. PETS 2022, 4 (2022), 66-85. https://inpher.io/. -
  18. [47][47] Daniel Demmler, Thomas Schneider, and Michael Zohner. 2015. ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation. In NDSS'15 . -
  19. [48][48] Ghada Dessouky, Farinaz Koushanfar, Ahmad-Reza Sadeghi, Thomas Schneider, Shaza Zeitouni, and Michael Zohner. 2017. Pushing the Communication Barrier in Secure Computation using Lookup Tables. In NDSS'17 . -
  20. [53][53] Vasisht Duddu, Debasis Samanta, D Vijay Rao, and Valentina E. Balas. 2018. Stealing Neural Networks via Timing Side Channels. arXiv:1812.11720 [cs.CR] - · arXiv
  21. [59][59] Craig Gentry. 2009. A Fully Homomorphic Encryption Scheme . Stanford University PhD Thesis. -
  22. [61][61] Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. 2016. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In ICML'16 . -
  23. [65][65] Veneta Haralampieva, Daniel Rueckert, and Jonathan Passerat-Palmbach. 2020. A systematic comparison of encrypted machine learning solutions for image classification. In Proceedings of the 2020 workshop on privacy-preserving machine learning in practice . 55-59. -
  24. [67][67] Sanghyun Hong, Pietro Frigo, Yiğitcan Kaya, Cristiano Giuffrida, and Tudor Dumitras ,. 2019. Terminal brain damage: Exposing the graceless degradation in deep neural networks under hardware fault attacks. In USENIX Security'19 . 497-514. -
  25. [68][68] Xing Hu, Ling Liang, Lei Deng, Shuangchen Li, Xinfeng Xie, Yu Ji, Yufei Ding, Chang Liu, Timothy Sherwood, and Yuan Xie. 2019. Neural Network Model Extraction Attacks in Edge Devices by Hearing Architectural Hints. arXiv:1903.03916 [cs.CR] - · arXiv
  26. [70][70] Wenqin Huangfu, Lixue Xia, Ming Cheng, Xiling Yin, Tianqi Tang, Boxun Li, Krishnendu Chakrabarty, Yuan Xie, Yu Wang, and Huazhong Yang. 2017. Computation-oriented fault-tolerance schemes for RRAM computing systems. In ASP-DAC'17 . IEEE, 794-799. -
  27. [73][73] Mohsen Imani, Saransh Gupta, Yeseong Kim, and Tajana Rosing. 2019. Floatpim: In-memory acceleration of deep neural network training with high precision. In ISCA'19 . IEEE, 802-815. -
  28. [74][74] Mohsen Imani, Yeseong Kim, Sadegh Riazi, John Messerly, Patric Liu, Farinaz Koushanfar, and Tajana Rosing. 2019. A framework for collaborative learning in secure high-dimensional space. In CLOUD'19 . IEEE, 435-446. -
  29. [76][76] Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, and Nicolas Papernot. 2020. High Accuracy and High Fidelity Extraction of Neural Networks. In USENIX Security'20 . USENIX Association, Boston, MA. -
  30. [77][77] Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. 2018. GAZELLE: A Low Latency Framework for Secure Neural Network Inference. In USENIX Security'18 . -
  31. [78][78] Seny Kamara and Mariana Raykova. 2011. Secure Outsourced Computation in a Multi-Tenant Cloud. In IBM Workshop on Cryptography and Security in Clouds . -
  32. [79][79] Behnam Khaleghi, Mohsen Imani, and Tajana Rosing. 2020. Prive-HD: Privacy-Preserved Hyperdimensional Computing. arXiv:2005.06716 [cs.LG] - · arXiv
  33. [82][82] Michael Klachko, Mohammad Reza Mahmoodi, and Dmitri Strukov. 2019. Improving noise tolerance of mixed-signal neural networks. In IJCNN'19 . IEEE, 1-8. -
  34. [86][86] Sebastian Lapuschkin, Stephan Wäldchen, Alexander Binder, Grégoire Montavon, Wojciech Samek, and KlausRobert Müller. 2019. Unmasking Clever Hans predictors and assessing what machines really learn. Nature communications 10, 1 (2019), 1-8. -
  35. [92][92] Yannan Liu, Lingxiao Wei, Bo Luo, and Qiang Xu. 2017. Fault injection attack on deep neural network. In ICCAD'17 . IEEE, 131-138. -
  36. [93][93] Scott M Lundberg and Su-In Lee. 2017. A unified approach to interpreting model predictions. Advances in neural information processing systems 30 (2017). -
  37. [95][95] Pratyush Mishra, Ryan Lehmkuhl, Akshayaram Srinivasan, Wenting Zheng, and Raluca Ada Popa. 2020. DELPHI: A Cryptographic Inference Service for Neural Networks. In USENIX Security'20 . -
  38. [102][102] Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. 2019. Bit-flip attack: Crushing neural network with progressive bit search. In Proceedings of the IEEE International Conference on Computer Vision . 1211-1220. -
  39. [105][105] MSadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, Kristin Lauter, and Farinaz Koushanfar. 2019. XONN: XNOR-based Oblivious Deep Neural Network Inference. In USENIX Security'19 . -
  40. [107][107] Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2016. "Why should I trust you?" Explaining the predictions of any classifier. In SIGKDD'16 . -
  41. [111][111] Benjamin IP Rubinstein, Peter L Bartlett, Ling Huang, and Nina Taft. 2009. Learning in a large function space: Privacy-preserving mechanisms for SVM learning. arXiv preprint arXiv:0911.5708 (2009). - · arXiv
  42. [113][113] Ali Shafiee, Anirban Nag, Naveen Muralimanohar, Rajeev Balasubramonian, John Paul Strachan, Miao Hu, R Stanley Williams, and Vivek Srikumar. 2016. ISAAC: A convolutional neural network accelerator with in-situ analog arithmetic in crossbars. ACM SIGARCH Computer Architecture News 44, 3 (2016), 14-26. -
  43. [114][114] Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. 2013. Deep inside convolutional networks: Visualising image classification models and saliency maps. arXiv preprint arXiv:1312.6034 (2013). - · arXiv
  44. [116][116] Shuang Song, Kamalika Chaudhuri, and Anand D Sarwate. 2013. Stochastic gradient descent with differentially private updates. In 2013 IEEE Global Conference on Signal and Information Processing . IEEE, 245-248. -
  45. [118][118] Aswin Sreedhar, Sandip Kundu, and Israel Koren. 2012. On reliability Trojan injection and detection. Journal of Low Power Electronics 8, 5 (2012), 674-683. -
  46. [120][120] Shruti Tople, Karan Grover, Shweta Shinde, Ranjita Bhagwan, and Ramachandran Ramjee. 2018. Privado: Practical and Secure DNN Inference. CoRR abs/1810.00602 (2018). arXiv:1810.00602 http://arxiv.org/abs/1810.00602 - · arXiv
  47. [121][121] C. Torres-Huitzil and B. Girau. 2017. Fault and Error Tolerance in Neural Networks: A Review. IEEE Access 5 (2017). -
  48. [122][122] Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction APIs. In USENIX Security'16 . -
  49. [123][123] Florian Tramèr and Dan Boneh. 2019. Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware. In ICLR'19 . -
  50. [127][127] Wenhao Wang, Yichen Jiang, Qintao Shen, Weihao Huang, Hao Chen, Shuang Wang, XiaoFeng Wang, Haixu Tang, Kai Chen, Kristin Lauter, and Dongdai Lin. 2019. Toward Scalable Fully Homomorphic Encryption Through Light Trusted Computing Assistance. arXiv preprint arXiv:1905.07766. - · arXiv
  51. [130][130] Lixue Xia, Wenqin Huangfu, Tianqi Tang, Xiling Yin, Krishnendu Chakrabarty, Yuan Xie, Yu Wang, and Huazhong Yang. 2018. Stuck-at Fault Tolerance in RRAM Computing Systems. IEEE Journal on Emerging and Selected Topics in Circuits and Systems 8, 1 (2018), 102-115. -
  52. [132][132] Xiaolin Xu, Fahim Rahman, Bicky Shakya, Apostol Vassilev, Domenic Forte, and Mark Tehranipoor. 2019. Electronics Supply Chain Integrity Enabled by Blockchain. ACM Trans. Des. Autom. Electron. Syst. (2019). -
  53. [133][133] Mengjia Yan, Christopher W. Fletcher, and Josep Torrellas. 2020. Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures. In USENIX Security'20 . -

Cited by

Sorted by citations

Metadata

Authors
Cammarota, R., Schunter, M., Rajan, A., Boemer, F., Kiss, Á., Treiber, A., Weinert, C., Schneider, T., Stapf, E., Sadeghi, A.-R., Demmler, D., Stock, J., Chen, H., Hussain, S. U., Riazi, S., Koushanfar, F., Gupta, S., Rosing, T. S., Chaudhuri, K., Nejatollahi, H., Dutt, N., Imani, M., Laine, K., Dubey, A., Aysu, A., Hosseini, F. S., Yang, C., Wallace, E., & Norton, P.
ORCID
Venue
arXiv
Publisher
arXiv
Published
2020
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2008.04449
arXiv
2008.04449
OpenAlex
W3048592832
Cited by
9
References
5
Citations by year
2025: 1 · 2024: 1 · 2022: 5 · 2021: 2
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • TUbilio (Technical University of Darmstadt) (submittedVersion)
  • eScholarship (California Digital Library) (submittedVersion, cc-by)
  • arXiv (Cornell University)
Funders
  • National Science Foundation (1943245)
  • European Commission (HORIZON2020)
  • Deutsche Forschungsgemeinschaft (251805230, SFB1119 CROSSING, SFB 1119, 236615297)
  • Bundesministerium für Bildung und Forschung (236615297)
  • H2020 European Research Council (850990)
Topics
  • Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Computer Networks and Communications › Cryptography and Data Security
Keywords
AI model security, privacy-enhancing technologies, intellectual property, private data protection, trusted execution environments, cryptographic techniques

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review