CoChat
Sign Up
PreprintCited by 31Security and Verification in ComputingPrivacy-Preserving Technologies in DataCryptography and Data Security

Machine Learning with Confidential Computing: A Systematization of Knowledge

Open access
Mo, Fan, Tarkhani, Zahra, Haddadi, Hamed·2022·arXiv
DOI 10.48550/arxiv.2208.10134arXiv 2208.10134
Open this paper in CoChat — free accountOpen PDF

Abstract

Privacy and security challenges in Machine Learning (ML) have become increasingly severe, along with ML's pervasive development and the recent demonstration of large attack surfaces. As a mature system-oriented approach, Confidential Computing has been utilized in both academia and industry to mitigate privacy and security issues in various ML scenarios. In this paper, the conjunction between ML and Confidential Computing is investigated. We systematize the prior work on Confidential Computing-assisted ML techniques that provide i) confidentiality guarantees and ii) integrity assurances, and discuss their advanced features and drawbacks. Key challenges are further identified, and we provide dedicated analyses of the limitations in existing Trusted Execution Environment (TEE) systems for ML use cases. Finally, prospective works are discussed, including grounded privacy definitions for closed-loop protection, partitioned executions of efficient ML, dedicated TEE-assisted designs for ML, TEE-aware ML, and ML full pipeline guarantees. By providing these potential solutions in our systematization of knowledge, we aim to build the bridge to help achieve a much stronger TEE-enabled ML for privacy guarantees without introducing computation and system costs.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2208.10134

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • ML as a Service with proper remote attestation and verification can securely handle a wide range of workloads.

    “Although this approach constrains the trust boundary and no one can physically breach the GPU, there are also other possible approaches such as ML as a Service (MLaaS) [26] with proper remote attestation and verification for securely handling a wide range of workloads.”

    From Confidential Computing Across Edge‐To‐Cloud for Machine Learning: A Survey Study (2025) · cites this paper as [26]

    Section 4.1 (p. 11) describes server-side inference and training services and says data or model owners remotely attest the TEE before provisioning them. But Section 7.5 (p. 25) says protecting the full ML pipeline remains intractable without multiple TEEs and that new security challenges are not fully explored. The paper therefore supports the proposed approach, not an unqualified assurance that it securely handles a wide range of workloads. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • A third party, besides the user and host, could perform the attestation.

    “A third party, besides the user and host, could perform the attestation [26,29].”

    From Confidential Computing Across Edge‐To‐Cloud for Machine Learning: A Survey Study (2025) · cites this paper as [26]

  • The service provider and enclave owner could execute the attestation directly.

    “Also, the service provider and enclave owner could execute the attestation directly [26].”

    From Confidential Computing Across Edge‐To‐Cloud for Machine Learning: A Survey Study (2025) · cites this paper as [26]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 228

  1. [1][1] R. Boselli, M. Cesarini, F. Mercorio, and M. Mezzanzanica, 'Classifying online job advertisements through machine learning,' Future Generation Computer Systems , vol. 86, pp. 319-328, 2018. -
  2. [2][2] M. Naumov, D. Mudigere, H.-J. M. Shi, J. Huang, N. Sundaraman, J. Park, X. Wang, U. Gupta, C.-J. Wu, A. G. Azzolini et al. , 'Deep learning recommendation model for personalization and recommendation systems,' arXiv preprint arXiv:1906.00091 , 2019. - · arXiv
  3. [3][3] M. Leo, S. Sharma, and K. Maddulety, 'Machine learning in banking risk management: A literature review,' Risks , vol. 7, no. 1, p. 29, 2019. -
  4. [4][4] M. A. Ahmad, C. Eckert, and A. Teredesai, 'Interpretable machine learning in healthcare,' in Proceedings of the 2018 ACM international conference on bioinformatics, computational biology, and health informatics , 2018, pp. 559-560. -
  5. [5][5] K. Shailaja, B. Seetharamulu, and M. Jabbar, 'Machine learning in healthcare: A review,' in 2018 Second international conference on electronics, communication and aerospace technology (ICECA) . IEEE, 2018, pp. 910-914. -
  6. [6][6] M. Meyer and G. Kuschk, 'Deep learning based 3d object detection for automotive radar and camera,' in 2019 16th European Radar Conference (EuRAD) . IEEE, 2019, pp. 133-136. -
  7. [7][7] R. Ravindran, M. J. Santora, and M. M. Jamali, 'Multi-object detection and tracking, based on dnn, for autonomous vehicles: A review,' IEEE Sensors Journal , vol. 21, no. 5, pp. 5668-5677, 2020. -
  8. [8][8] T. Orekondy, B. Schiele, and M. Fritz, 'Knockoff nets: Stealing functionality of black-box models,' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2019, pp. 4954-4963. -
  9. [9][9] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, 'Stealing machine learning models via prediction APIs,' in 25th { USENIX } Security Symposium ( { USENIX } Security 16) , 2016, pp. 601-618. -
  10. [10][10] Y. Shen, X. He, Y. Han, and Y. Zhang, 'Model stealing attacks against inductive graph neural networks,' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1175-1192. -
  11. [11][11] A. S. Rakin, M. H. I. Chowdhuryy, F. Yao, and D. Fan, 'Deepsteal: Advanced model extractions leveraging efficient weight stealing in memories,' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1157-1174. -
  12. [12][12] M. Fredrikson, S. Jha, and T. Ristenpart, 'Model inversion attacks that exploit confidence information and basic countermeasures,' in Proceedings of the 22nd ACM SIGSAC conference on computer and communications security , 2015, pp. 1322-1333. -
  13. [13][13] Z. He, T. Zhang, and R. B. Lee, 'Model inversion attacks against collaborative inference,' in Proceedings of the 35th Annual Computer Security Applications Conference , 2019, pp. 148-162. -
  14. [14][14] M. Fang, X. Cao, J. Jia, and N. Gong, 'Local model poisoning attacks to byzantine-robust federated learning,' in 29th { USENIX } Security Symposium ( { USENIX } Security 20) , 2020, pp. 1605-1622. -
  15. [15][15] X. Chen, C. Liu, B. Li, K. Lu, and D. Song, 'Targeted backdoor attacks on deep learning systems using data poisoning,' arXiv preprint arXiv:1712.05526 , 2017. - · arXiv
  16. [16][16] V. Shejwalkar, A. Houmansadr, P. Kairouz, and D. Ramage, 'Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1354-1371. -
  17. [17][17] L. Zhu, Z. Liu, and S. Han, 'Deep leakage from gradients,' Advances in Neural Information Processing Systems , vol. 32, pp. 14 774-14 784, 2019. -
  18. [18][18] H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov, 'See through gradients: Image batch recovery via gradinversion,' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2021, pp. 16 337-16 346. -
  19. [19][19] R. Shokri, M. Stronati, C. Song, and V. Shmatikov, 'Membership inference attacks against machine learning models,' in 2017 IEEE Symposium on Security and Privacy (SP) . IEEE, 2017, pp. 3-18. -
  20. [20][20] L. Melis, C. Song, E. De Cristofaro, and V. Shmatikov, 'Exploiting unintended feature leakage in collaborative learning,' in 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 2019, pp. 691-706. -
  21. [21][21] N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer, 'Membership inference attacks from first principles,' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1897-1914. -
  22. [22][22] I. J. Goodfellow, J. Shlens, and C. Szegedy, 'Explaining and harnessing adversarial examples,' arXiv preprint arXiv:1412.6572 , 2014. - · arXiv
  23. [23][23] T. Graepel, K. Lauter, and M. Naehrig, 'Ml confidential: Machine learning on encrypted data,' in International conference on information security and cryptology . Springer, 2012, pp. 1-21. -
  24. [25][25] C. A. Choquette-Choo, N. Dullerud, A. Dziedzic, Y. Zhang, S. Jha, N. Papernot, and X. Wang, 'Capc learning: Confidential and private collaborative learning,' arXiv preprint arXiv:2102.05188 , 2021. - · arXiv
  25. [29][29] O. Ohrimenko, F. Schuster, C. Fournet, A. Mehta, S. Nowozin, K. Vaswani, and M. Costa, 'Oblivious multi-party machine learning on trusted processors,' in 25th { USENIX } Security Symposium ( { USENIX } Security 16) , 2016, pp. 619-636. -
  26. [30][30] F. Tramer and D. Boneh, 'Slalom: Fast, verifiable and private execution of neural networks in trusted hardware,' in International Conference on Learning Representations , 2018. -
  27. [31][31] T. Hunt, C. Song, R. Shokri, V. Shmatikov, and E. Witchel, 'Chiron: Privacy-preserving machine learning as a service,' arXiv preprint arXiv:1803.05961 , 2018. - · arXiv
  28. [32][32] T. Lee, Z. Lin, S. Pushp, C. Li, Y. Liu, Y. Lee, F. Xu, C. Xu, L. Zhang, and J. Song, 'Occlumency: Privacy-preserving remote deep-learning inference using SGX,' in The 25th Annual International Conference on Mobile Computing and Networking , 2019, pp. 1-17. -
  29. [33][33] F. Mo and H. Haddadi, 'Efficient and private federated learning using tee,' in Proc. EuroSys Conf., Dresden, Germany , 2019. -
  30. [34][34] F. Mo, H. Haddadi, K. Katevas, E. Marin, D. Perino, and N. Kourtellis, 'PPFL: privacy-preserving federated learning with trusted execution environments,' arXiv preprint arXiv:2104.14380 , 2021. - · arXiv
  31. [35][35] F. Mo, 'Privacy-preserving machine learning system at the edge,' Ph.D. dissertation, Imperial College London, 2022. -
  32. [39][39] K. D. Duy, T. Noh, S. Huh, and H. Lee, 'Confidential machine learning computation in untrusted environments: A systems security perspective,' IEEE Access , vol. 9, pp. 168 656-168 677, 2021. -
  33. [40][40] M. I. Jordan and T. M. Mitchell, 'Machine learning: Trends, perspectives, and prospects,' Science , vol. 349, no. 6245, pp. 255-260, 2015. -
  34. [41][41] Y. LeCun, Y. Bengio, and G. Hinton, 'Deep learning,' nature , vol. 521, no. 7553, pp. 436-444, 2015. -
  35. [42][42] S. Amershi, A. Begel, C. Bird, R. DeLine, H. Gall, E. Kamar, N. Nagappan, B. Nushi, and T. Zimmermann, 'Software engineering for machine learning: A case study,' in 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) . IEEE, 2019, pp. 291-300. -
  36. [45][45] X. Zhu and A. B. Goldberg, 'Introduction to semi-supervised learning,' Synthesis lectures on artificial intelligence and machine learning , vol. 3, no. 1, pp. 1-130, 2009. -
  37. [46][46] D. Berthelot, N. Carlini, I. Goodfellow, N. Papernot, A. Oliver, and C. A. Raffel, 'Mixmatch: A holistic approach to semi-supervised learning,' Advances in Neural Information Processing Systems , vol. 32, 2019. -
  38. [47][47] Q. V. Le, 'Building high-level features using large scale unsupervised learning,' in 2013 IEEE international conference on acoustics, speech and signal processing . IEEE, 2013, pp. 8595-8598. -
  39. [48][48] J. E. Van Engelen and H. H. Hoos, 'A survey on semi-supervised learning,' Machine learning , vol. 109, no. 2, pp. 373-440, 2020. -
  40. [49][49] M. Tschannen, O. Bachem, and M. Lucic, 'Recent advances in autoencoder-based representation learning,' arXiv preprint arXiv:1812.05069 , 2018. - · arXiv
  41. [50][50] A. Vahdat and J. Kautz, 'Nvae: A deep hierarchical variational autoencoder,' Advances in neural information processing systems , vol. 33, pp. 19 667-19 679, 2020. -
  42. [51][51] R. S. Sutton and A. G. Barto, Reinforcement learning: An introduction . MIT press, 2018. -
  43. [52][52] C. Shorten and T. M. Khoshgoftaar, 'A survey on image data augmentation for deep learning,' Journal of Big Data , vol. 6, no. 1, pp. 1-48, 2019. -
  44. [53][53] Q. Xie, Z. Dai, E. Hovy, T. Luong, and Q. Le, 'Unsupervised data augmentation for consistency training,' Advances in Neural Information Processing Systems , vol. 33, 2020. -
  45. [54][54] R. Evans and E. Grefenstette, 'Learning explanatory rules from noisy data,' Journal of Artificial Intelligence Research , vol. 61, pp. 1-64, 2018. -
  46. [55][55] A. Katharopoulos and F. Fleuret, 'Not all samples are created equal: Deep learning with importance sampling,' in International conference on machine learning . PMLR, 2018, pp. 2525-2534. -
  47. [56][56] S. Mindermann, J. M. Brauner, M. T. Razzak, M. Sharma, A. Kirsch, W. Xu, B. Höltgen, A. N. Gomez, A. Morisot, S. Farquhar et al. , 'Prioritized training on points that are learnable, worth learning, and not yet learnt,' in International Conference on Machine Learning . PMLR, 2022, pp. 15 630-15 649. -
  48. [57][57] T. Elsken, J. H. Metzen, and F. Hutter, 'Neural architecture search: A survey,' The Journal of Machine Learning Research , vol. 20, no. 1, pp. 1997-2017, 2019. -
  49. [58][58] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, 'Gradient-based learning applied to document recognition,' Proceedings of the IEEE , vol. 86, no. 11, pp. 2278-2324, 1998. -
  50. [59][59] L. Bottou, 'Large-scale machine learning with stochastic gradient descent,' in Proceedings of COMPSTAT'2010 . Springer, 2010, pp. 177-186. -
  51. [60][60] R. Kohavi et al. , 'A study of cross-validation and bootstrap for accuracy estimation and model selection,' in International Joint Conference on Artificial Intelligence , vol. 14, no. 2. Montreal, Canada, 1995, pp. 1137-1145. -
  52. [61][61] S. Arlot and A. Celisse, 'A survey of cross-validation procedures for model selection,' Statistics surveys , vol. 4, pp. 40-79, 2010. -
  53. [62][62] S. J. Pan and Q. Yang, 'A survey on transfer learning,' IEEE Transactions on knowledge and data engineering , vol. 22, no. 10, pp. 1345-1359, 2009. -
  54. [64][64] J. Yosinski, J. Clune, Y. Bengio, and H. Lipson, 'How transferable are features in deep neural networks?' arXiv preprint arXiv:1411.1792 , 2014. - · arXiv
  55. [65][65] M. D. Zeiler and R. Fergus, 'Visualizing and understanding convolutional networks,' in European conference on computer vision . Springer, 2014, pp. 818-833. -
  56. [66][66] H. Qi, M. Brown, and D. G. Lowe, 'Low-shot learning with imprinted weights,' in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 5822-5830. -
  57. [67][67] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, 'Communication-efficient learning of deep networks from decentralized data,' in Artificial intelligence and statistics . PMLR, 2017, pp. 1273-1282. -
  58. [68][68] T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, 'Federated learning: Challenges, methods, and future directions,' IEEE Signal Processing Magazine , vol. 37, no. 3, pp. 50-60, 2020. -
  59. [69][69] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al. , 'Advances and open problems in federated learning,' arXiv preprint arXiv:1912.04977 , 2019. - · arXiv
  60. [70][70] M. Abadi, P. Barham, J. Chen, Z. Chen, A. Davis, J. Dean, M. Devin, S. Ghemawat, G. Irving, M. Isard et al. , 'Tensorflow: A system for large-scale machine learning,' in 12th { USENIX } symposium on operating systems design and implementation ( { OSDI } 16) , 2016, pp. 265-283. -
  61. [71][71] Y. Yao, Z. Xiao, B. Wang, B. Viswanath, H. Zheng, and B. Y. Zhao, 'Complexity vs. performance: empirical analysis of machine learning as a service,' in Proceedings of the 2017 Internet Measurement Conference , 2017, pp. 384-397. -
  62. [72][72] M. Li, D. G. Andersen, J. W. Park, A. J. Smola, A. Ahmed, V. Josifovski, J. Long, E. J. Shekita, and B.-Y. Su, 'Scaling distributed machine learning with the parameter server,' in 11th { USENIX } Symposium on Operating Systems Design and Implementation ( { OSDI } 14) , 2014, pp. 583-598. -
  63. [73][73] J. So, B. Guler, and S. Avestimehr, 'A scalable approach for privacy-preserving collaborative machine learning,' Advances in Neural Information Processing Systems , vol. 33, pp. 8054-8066, 2020. -
  64. [74][74] J. Verbraeken, M. Wolting, J. Katzy, J. Kloppenburg, T. Verbelen, and J. S. Rellermeyer, 'A survey on distributed machine learning,' Acm computing surveys (csur) , vol. 53, no. 2, pp. 1-33, 2020. -
  65. [75][75] T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V. Smith, 'Federated Optimization in Heterogeneous Networks,' in Proc. Conf. on Machine Learning and Systems (MLSys) , 2020. -
  66. [76][76] S. Reddi, Z. Charles, M. Zaheer, Z. Garrett, K. Rush, J. Konečn` y, S. Kumar, and H. B. McMahan, 'Adaptive federated optimization,' arXiv preprint arXiv:2003.00295 , 2020. - · arXiv
  67. [77][77] H. Wang, M. Yurochkin, Y. Sun, D. Papailiopoulos, and Y. Khazaeni, 'Federated learning with matched averaging,' arXiv preprint arXiv:2002.06440 , 2020. - · arXiv
  68. [78][78] J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller, 'Inverting gradients-how easy is it to break privacy in federated learning?' arXiv preprint arXiv:2003.14053 , 2020. - · arXiv
  69. [79][79] M. Ribeiro, K. Grolinger, and M. A. Capretz, 'Mlaas: Machine learning as a service,' in 2015 IEEE 14th International Conference on Machine Learning and Applications (ICMLA) . IEEE, 2015, pp. 896-902. -
  70. [80][80] E. Hesamifard, H. Takabi, M. Ghasemi, and R. N. Wright, 'Privacy-preserving machine learning as a service,' Proceedings on Privacy Enhancing Technologies , vol. 3, pp. 123-142, 2018. -
  71. [81][81] M. Nasr, R. Shokri, and A. Houmansadr, 'Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,' in 2019 IEEE symposium on security and privacy (SP) . IEEE, 2019, pp. 739-753. -
  72. [82][82] B. Hitaj, G. Ateniese, and F. Perez-Cruz, 'Deep models under the gan: information leakage from collaborative deep learning,' in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , 2017, pp. 603-618. -
  73. [83][83] J. Jia and N. Z. Gong, 'Attriguard: A practical defense against attribute inference attacks via adversarial machine learning,' in 27th { USENIX } Security Symposium ( { USENIX } Security 18) , 2018, pp. 513-529. -
  74. [84][84] H. Yu, K. Yang, T. Zhang, Y.-Y. Tsai, T.-Y. Ho, and Y. Jin, 'Cloudleak: Large-scale deep learning models stealing through adversarial examples.' in Network and Distributed System Security Symposium (NDSS) , 2020. -
  75. [85][85] S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, 'Universal adversarial perturbations,' in Proceedings of the IEEE conference on computer vision and pattern recognition , 2017, pp. 1765-1773. -
  76. [86][86] Z. Tarkhani, L. Qendro, M. O. Brown, O. Hill, C. Mascolo, and A. Madhavapeddy, 'Enhancing the security & privacy of wearable brain-computer interfaces,' arXiv preprint arXiv:2201.07711 , 2022. - · arXiv
  77. [87][87] J. R. Sanchez Vicarte, B. Schreiber, R. Paccagnella, and C. W. Fletcher, 'Game of threads: Enabling asynchronous poisoning attacks,' in Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems , 2020, pp. 35-52. -
  78. [88][88] V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, 'Data poisoning attacks against federated learning systems,' in European Symposium on Research in Computer Security . Springer, 2020, pp. 480-501. -
  79. [89][89] Y. Liu, X. Ma, J. Bailey, and F. Lu, 'Reflection backdoor: A natural backdoor attack on deep neural networks,' in European Conference on Computer Vision . Springer, 2020, pp. 182-199. -
  80. [90][90] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, 'How to backdoor federated learning,' in International Conference on Artificial Intelligence and Statistics . PMLR, 2020, pp. 2938-2948. -
  81. [91][91] J. Jia, Y. Liu, and N. Z. Gong, 'Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning,' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 2043-2059. -
  82. [92][92] N. Papernot, P. McDaniel, A. Sinha, and M. P. Wellman, 'SoK: Security and privacy in machine learning,' in 2018 IEEE European Symposium on Security and Privacy (EuroS&P) . IEEE, 2018, pp. 399-414. -
  83. [93][93] A. Sablayrolles, M. Douze, C. Schmid, Y. Ollivier, and H. Jégou, 'White-box vs black-box: Bayes optimal strategies for membership inference,' in International Conference on Machine Learning . PMLR, 2019, pp. 5558-5567. -
  84. [94][94] S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha, 'Privacy risk in machine learning: Analyzing the connection to overfitting,' in 2018 IEEE 31st computer security foundations symposium (CSF) . IEEE, 2018, pp. 268-282.
  85. [96][96] M. Russinovich, M. Costa, C. Fournet, D. Chisnall, A. Delignat-Lavaud, S. Clebsch, K. Vaswani, and V. Bhatia, 'Toward confidential cloud computing,' Communications of the ACM , vol. 64, no. 6, pp. 54-61, 2021. -
  86. [98][98] L. Guan, P. Liu, X. Xing, X. Ge, S. Zhang, M. Yu, and T. Jaeger, 'Trustshadow: Secure execution of unmodified applications with arm trustzone,' in Proceedings of the 15th Annual International Conference on Mobile Systems, Applications, and Services . ACM, 2017, pp. 488-501. -
  87. [99][99] R. Bahmani, F. Brasser, G. Dessouky, P. Jauernig, M. Klimmek, A.-R. Sadeghi, and E. Stapf, ' { CURE } : A security architecture with { CUstomizable } and resilient enclaves,' in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 1073-1090. -
  88. [100][100] D. Kaplan, 'Hardware vm isolation in the cloud: Enabling confidential computing with amd sev-snp technology,' Queue , vol. 21, no. 4, pp. 49-67, 2023. -
  89. [101][101] J. Lee, J. Jang, Y. Jang, N. Kwak, Y. Choi, C. Choi, T. Kim, M. Peinado, and B. B. Kang, 'Hacking in Darkness: Return-Oriented Programming against Secure Enclaves,' in Proceedings of the 26th USENIX Conference on Security Symposium , 2017, pp. 523-539. -
  90. [102][102] M. R. Khandaker, Y. Cheng, Z. Wang, and T. Wei, 'Coin attacks: On insecurity of enclave untrusted interfaces in sgx,' in Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems , 2020, pp. 971-985. -
  91. [103][103] Van Bulck, Jo and Oswald, David and Marin, Eduard and Aldoseri, Abdulla and Garcia, Flavio D. and Piessens, Frank, 'A Tale of Two Worlds: Assessing the Vulnerability of Enclave Shielding Runtimes,' in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS) , 2019, pp. 1741-1758. -
  92. [104][104] Z. Chen, G. Vasilakis, K. Murdock, E. Dean, D. Oswald, and F. D. Garcia, 'Voltpillager: Hardware-based fault injection attacks against intel SGX enclaves using the SVID voltage scaling interface,' in 30th USENIX Security Symposium , Vancouver, B.C., Aug. 2021. -
  93. [105][105] M. Li, L. Wilke, J. Wichelmann, T. Eisenbarth, R. Teodorescu, and Y. Zhang, 'A systematic look at ciphertext side channels on amd sev-snp,' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 2022, pp. 1541-1541. -
  94. [106][106] M. Lipp, A. Kogler, D. Oswald, M. Schwarz, C. Easdon, C. Canella, and D. Gruss, 'PLATYPUS: Software-based Power Side-Channel Attacks on x86,' in 2021 IEEE Symposium on Security and Privacy (SP) . IEEE, 2021. -
  95. [107][107] A. Machiry, E. Gustafson, C. Spensky, C. Salls, N. Stephens, R. Wang, A. Bianchi, Y. R. Choe, C. Kruegel, and G. Vigna, 'Boomerang: Exploiting the semantic gap in trusted execution environments.' in NDSS , 2017. -
  96. [108][108] D. Cerdeira, N. Santos, P. Fonseca, and S. Pinto, 'SoK: Understanding the prevailing security vulnerabilities in trustzone-assisted tee systems,' in 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 2020, pp. 1416-1432. -
  97. [109][109] H. Xia, D. Zhang, W. Liu, I. Haller, B. Sherwin, and D. Chisnall, 'A secret-free hypervisor: Rethinking isolation in the age of speculative vulnerabilities,' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 2022, pp. 1544-1544. -
  98. [110][110] J. Singh, J. Cobbe, D. L. Quoc, and Z. Tarkhani, 'Enclaves in the clouds: Legal considerations and broader implications,' Communications of the ACM , vol. 64, no. 5, pp. 42-51, 2021. -
  99. [123][123] Y. Jia, S. Liu, W. Wang, Y. Chen, Z. Zhai, S. Yan, and Z. He, ' { HyperEnclave } : An open and cross-platform trusted execution environment,' in 2022 USENIX Annual Technical Conference (USENIX ATC 22) , 2022, pp. 437-454. -
  100. [125][125] V. Costan and S. Devadas, 'Intel SGX Explained,' IACR Cryptol. ePrint Arch. , vol. 2016, no. 86, pp. 1-118, 2016. -
  101. [126][126] V. Haldar, D. Chandra, and M. Franz, 'Semantic remote attestation: A virtual machine directed approach to trusted computing,' in USENIX Virtual Machine Research and Technology Symposium , vol. 2004, 2004. -
  102. [127][127] G. Coker, J. Guttman, P. Loscocco, A. Herzog, J. Millen, B. O'Hanlon, J. Ramsdell, A. Segall, J. Sheehy, and B. Sniffen, 'Principles of remote attestation,' International Journal of Information Security , vol. 10, no. 2, pp. 63-81, 2011. -
  103. [129][129] S. Johnson, V. Scarlata, C. Rozas, E. Brickell, and F. Mckeen, 'Intel software guard extensions: Epid provisioning and attestation services,' White Paper , vol. 1, no. 1-10, p. 119, 2016. -
  104. [131][131] B. Ngabonziza, D. Martin, A. Bailey, H. Cho, and S. Martin, 'Trustzone explained: Architectural features and use cases,' in 2016 IEEE 2nd International Conference on Collaboration and Internet Computing (CIC) . IEEE, 2016, pp. 445-451. -
  105. [132][132] X. Li, X. Li, C. Dall, R. Gu, J. Nieh, Y. Sait, and G. Stockwell, 'Design and verification of the arm confidential compute architecture,' in 16th USENIX Symposium on Operating Systems Design and Implementation (OSDI 22) , 2022, pp. 465-484. -
  106. [134][134] D. P. Mulligan, G. Petri, N. Spinale, G. Stockwell, and H. J. Vincent, 'Confidential computing-a brave new world,' in 2021 international symposium on secure and private execution environment design (SEED) . IEEE, 2021, pp. 132-138. -
  107. [135][135] X. Xu, W. Wang, Y. Wu, Z. Min, Z. Pang, and Y. Jin, 'virtcca: Virtualized arm confidential compute architecture with trustzone,' arXiv preprint arXiv:2306.11011 , 2023. - · arXiv
  108. [136][136] R. Sahita, V. Shanbhogue, A. Bresticker, A. Khare, A. Patra, S. Ortiz, D. Reid, and R. Kanwal, 'Cove: Towards confidential computing on risc-v platforms,' in Proceedings of the 20th ACM International Conference on Computing Frontiers , 2023, pp. 315-321. -
  109. [138][138] A. Baumann, M. Peinado, and G. Hunt, 'Shielding applications from an untrusted cloud with Haven,' ACM Transactions on Computer Systems (TOCS) , vol. 33, no. 3, p. 8, 2015. -
  110. [139][139] D. E. Porter, S. Boyd-Wickizer, J. Howell, R. Olinsky, and G. C. Hunt, 'Rethinking the library os from the top down,' in ACM SIGPLAN Notices , vol. 46. ACM, 2011, pp. 291-304. -
  111. [140][140] M. Brossard, G. Bryant, B. El Gaabouri, X. Fan, A. Ferreira, E. Grimley-Evans, C. Haster, E. Johnson, D. Miller, F. Mo et al. , 'Private delegated computations using strong isolation,' IEEE Transactions on Emerging Topics in Computing , 2023. -
  112. [141][141] C.-C. Tsai, D. E. Porter, and M. Vij, 'Graphene-sgx: A practical library os for unmodified applications on sgx,' in Proceedings of the USENIX Annual Technical Conference (ATC) , 2017, p. 8. -
  113. [142][142] S. Arnautov, B. Trach, F. Gregor, T. Knauth, A. Martin, C. Priebe, J. Lind, D. Muthukumaran, D. O'keeffe, M. Stillwell et al. , 'Scone: Secure linux containers with intel sgx.' in OSDI , vol. 16, 2016, pp. 689-703. -
  114. [149][149] D. Lee, D. Kohlbrenner, S. Shinde, K. Asanovic, and D. Song, 'Keystone: An open framework for architecting trusted execution environments,' in Proceedings of the Fifteenth European Conference on Computer Systems , ser. EuroSys '20, 2020. -
  115. [150][150] C.-C. Tsai, J. Son, B. Jain, J. McAvey, R. A. Popa, and D. E. Porter, 'Civet: An efficient java partitioning framework for hardware enclaves,' in 29th { USENIX } Security Symposium ( { USENIX } Security 20) , 2020. -
  116. [151][151] N. Santos, H. Raj, S. Saroiu, and A. Wolman, 'Using arm trustzone to build a trusted language runtime for mobile applications,' ACM SIGARCH Computer Architecture News , vol. 42, no. 1, pp. 67-80, 2014. -
  117. [152][152] J. Lind, C. Priebe, D. Muthukumaran, D. O'Keeffe, P.-L. Aublin, F. Kelbert, T. Reiher, D. Goltzsche, D. Eyers, R. Kapitza et al. , 'Glamdring: Automatic application partitioning for intel { SGX } , ' in 2017 USENIX Annual Technical Conference (USENIX ATC 17) , 2017, pp. 285-298. -
  118. [155][155] M. Busch, J. Westphal, and T. Mueller, 'Unearthing the trustedcore: A critical review on huawei's trusted execution environment,' in 14th { USENIX } Workshop on Offensive Technologies ( { WOOT } 20) , 2020. -
  119. [156][156] K. Grover, S. Tople, S. Shinde, R. Bhagwan, and R. Ramjee, 'Privado: Practical and secure dnn inference with enclaves,' arXiv preprint arXiv:1810.00602 , 2018. - · arXiv
  120. [157][157] A. Kumar, R. Tourani, M. Vij, and S. Srikanteswara, 'Sclera: A framework for privacy-preserving mlaas at the pervasive edge,' in 2022 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops) . IEEE, 2022, pp. 175-180. -
  121. [158][158] N. Hynes, R. Cheng, and D. Song, 'Efficient deep learning on multi-source private data,' arXiv preprint arXiv:1807.06689 , 2018. - · arXiv
  122. [159][159] S. P. Bayerl, T. Frassetto, P. Jauernig, K. Riedhammer, A.-R. Sadeghi, T. Schneider, E. Stapf, and C. Weinert, 'Offline Model Guard: Secure and private ML on mobile devices,' in 2020 Design, Automation & Test in Europe Conference & Exhibition (DATE) . IEEE, 2020, pp. 460-465. -
  123. [160][160] F. Mo, A. S. Shamsabadi, K. Katevas, S. Demetriou, I. Leontiadis, A. Cavallaro, and H. Haddadi, 'DarkneTZ: towards model privacy at the edge using trusted execution environments,' in Proceedings of the 18th International Conference on Mobile Systems, Applications, and Services , 2020, pp. 161-174. -
  124. [161][161] F. McKeen, I. Alexandrovich, I. Anati, D. Caspi, S. Johnson, R. Leslie-Hurd, and C. Rozas, 'Intel® software guard extensions (intel® sgx) support for dynamic memory management inside an enclave,' in Proceedings of the Hardware and Architectural Support for Security and Privacy 2016 , 2016, pp. 1-9. -
  125. [167][167] R. Kunkel, D. L. Quoc, F. Gregor, S. Arnautov, P. Bhatotia, and C. Fetzer, 'TensorSCONE: A secure tensorflow framework using Intel SGX,' arXiv preprint arXiv:1902.04413 , 2019. - · arXiv
  126. [168][168] N. Weichbrodt, A. Kurmus, P. Pietzuch, and R. Kapitza, 'Asyncshock: Exploiting synchronisation bugs in intel sgx enclaves,' in European Symposium on Research in Computer Security . Springer, 2016, pp. 440-457. -
  127. [170][170] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga et al. , 'PyTorch: An imperative style, high-performance deep learning library,' Advances in neural information processing systems , vol. 32, pp. 8026-8037, 2019. -
  128. [171][171] Y. Aono, T. Hayashi, L. Wang, S. Moriai et al. , 'Privacy-preserving deep learning via additively homomorphic encryption,' IEEE Transactions on Information Forensics and Security , vol. 13, no. 5, pp. 1333-1345, 2017. -
  129. [172][172] S. E. Oh, T. Yang, N. Mathews, J. K. Holland, M. S. Rahman, N. Hopper, and M. Wright, 'Deepcoffea: Improved flow correlation attacks on tor via metric learning and amplification,' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1915-1932. -
  130. [173][173] Z. Yang, Z. Yuan, S. Jin, X. Chen, L. Sun, X. Du, W. Li, and H. Zhang, 'Fsaflow: Lightweight and fast dynamic path tracking and control for privacy protection on android using hybrid analysis with state-reduction strategy,' in Proceedings of the 43rd IEEE Symposium on Security and Privacy (SP), IEEE, San Francisco, CA, USA , 2022, pp. 23-25. -
  131. [174][174] J. Jia, A. Salem, M. Backes, Y. Zhang, and N. Z. Gong, 'Memguard: Defending against black-box membership inference attacks via adversarial examples,' in Proceedings of the 2019 ACM SIGSAC conference on computer and communications security , 2019, pp. 259-274. -
  132. [175][175] M. Poltavtseva and E. Rudnitskaya, 'Confidentiality of machine learning models,' Automatic Control and Computer Sciences 975-982, 2023. 24. , vol. 57, no. 8, pp. -
  133. [176][176] F. Mo, A. Borovykh, M. Malekzadeh, H. Haddadi, and S. Demetriou, 'Layer-wise characterization of latent information leakage in federated learning,' arXiv preprint arXiv:2010.08762 , 2020. - · arXiv
  134. [177][177] --, 'Quantifying information leakage from gradients,' arXiv preprint arXiv:2105.13929 , 2021. - · arXiv
  135. [178][178] F. Mo, A. S. Shamsabadi, K. Katevas, A. Cavallaro, and H. Haddadi, 'Towards characterizing and limiting information exposure in dnn layers,' arXiv preprint arXiv:1907.06034 , 2019. - · arXiv
  136. [179][179] Z. Gu, H. Huang, J. Zhang, D. Su, A. Lamba, D. Pendarakis, and I. Molloy, 'Securing input data of deep learning inference systems via partitioned enclave execution,' arXiv preprint arXiv:1807.00969 , 2018. - · arXiv
  137. [180][180] S. Volos, K. Vaswani, and R. Bruno, 'Graviton: Trusted execution environments on GPUs,' in 13th { USENIX } Symposium on Operating Systems Design and Implementation ( { OSDI } 18) , 2018, pp. 681-696. -
  138. [181][181] Z. Gu, H. Huang, J. Zhang, D. Su, H. Jamjoom, A. Lamba, D. Pendarakis, and I. Molloy, 'Confidential inference via ternary model partitioning,' arXiv preprint arXiv:1807.00969 , 2018. - · arXiv
  139. [182][182] K. G. Narra, Z. Lin, Y. Wang, K. Balasubramaniam, and M. Annavaram, 'Privacy-preserving inference in machine learning services using trusted execution environments,' arXiv preprint arXiv:1912.03485 , 2019. - · arXiv
  140. [183][183] X. Zhang, F. Li, Z. Zhang, Q. Li, C. Wang, and J. Wu, 'Enabling execution assurance of federated learning at untrusted participants,' in IEEE INFOCOM 2020-IEEE Conference on Computer Communications . IEEE, 2020, pp. 1877-1886. -
  141. [184][184] T. Hunt, Z. Jia, V. Miller, A. Szekely, Y. Hu, C. J. Rossbach, and E. Witchel, 'Telekine: Secure computing with cloud gpus,' in 17th { USENIX } Symposium on Networked Systems Design and Implementation ( { NSDI } 20) , 2020, pp. 817-833. -
  142. [185][185] T. Elgamal and K. Nahrstedt, 'Serdab: An iot framework for partitioning neural networks computation across multiple enclaves,' in 2020 20th IEEE/ACM International Symposium on Cluster, Cloud and Internet Computing (CCGRID) . IEEE, 2020, pp. 519-528. -
  143. [186][186] A. Gangal, M. Ye, and S. Wei, 'Hybridtee: Secure mobile dnn execution using hybrid trusted execution environment,' in 2020 Asian Hardware Oriented Security and Trust Symposium (AsianHOST) . IEEE, 2020, pp. 1-6. -
  144. [187][187] Y. Xiang, Y. Wang, H. Choi, M. Karimi, and H. Kim, 'Aegisdnn: Dependable and timely execution of dnn tasks with sgx,' in 2021 IEEE Real-Time Systems Symposium (RTSS) . IEEE, 2021, pp. 68-81. -
  145. [188][188] L. Hanzlik, Y. Zhang, K. Grosse, A. Salem, M. Augustin, M. Backes, and M. Fritz, 'MLcapsule: Guarded offline deployment of machine learning as a service,' in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2021, pp. 3300-3309. -
  146. [189][189] Z. Liu, Y. Lu, X. Xie, Y. Fang, Z. Jian, and T. Li, 'Trusted-DNN: A trustzone-based adaptive isolation strategy for deep neural networks,' in ACM Turing Award Celebration Conference-China (ACM TURC 2021) , 2021, pp. 67-71. -
  147. [190][190] J.-B. Truong, W. Gallagher, T. Guo, and R. J. Walls, 'Memory-efficient deep learning inference in trusted execution environments,' arXiv preprint arXiv:2104.15109 , 2021. - · arXiv
  148. [191][191] D. L. Quoc and C. Fetzer, 'Secfl: Confidential federated learning using tees,' arXiv preprint arXiv:2110.00981 , 2021. - · arXiv
  149. [192][192] L. K. Ng, S. S. Chow, A. P. Woo, D. P. Wong, and Y. Zhao, 'Goten: Gpu-outsourcing trusted execution of neural network training,' in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 35, no. 17, 2021, pp. 14 876-14 883. -
  150. [193][193] C. Zhang, J. Xia, B. Yang, H. Puyang, W. Wang, R. Chen, I. E. Akkus, P. Aditya, and F. Yan, 'Citadel: Protecting data privacy and model confidentiality for collaborative learning,' in Proceedings of the ACM Symposium on Cloud Computing , 2021, pp. 546-561. -
  151. [194][194] R. Liu, L. Garcia, Z. Liu, B. Ou, and M. Srivastava, 'Secdeep: Secure and performant on-device deep learning inference framework for mobile and iot devices,' in Proceedings of the International Conference on Internet-of-Things Design and Implementation , 2021, pp. 67-79. -
  152. [195][195] S. Park, S. Kim, and Y.-s. Lim, 'Fairness audit of machine learning models with confidential computing,' in Proceedings of the ACM Web Conference 2022 , 2022, pp. 3488-3499. -
  153. [196][196] W. Hua, M. Umar, Z. Zhang, and G. E. Suh, 'Guardnn: secure accelerator architecture for privacy-preserving deep learning,' in Proceedings of the 59th ACM/IEEE Design Automation Conference , 2022, pp. 349-354. -
  154. [197][197] T. Shen, J. Qi, J. Jiang, X. Wang, S. Wen, X. Chen, S. Zhao, S. Wang, L. Chen, X. Luo et al. , ' { SOTER } : Guarding black-box inference for general neural networks at the edge,' in 2022 USENIX Annual Technical Conference (USENIX ATC 22) , 2022, pp. 723-738. -
  155. [198][198] Y. Deng, C. Wang, S. Yu, S. Liu, Z. Ning, K. Leach, J. Li, S. Yan, Z. He, J. Cao et al. , 'Strongbox: A gpu tee on arm endpoints,' in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 769-783. -
  156. [199][199] J. Sander, S. Berndt, I. Bruhns, and T. Eisenbarth, 'Dash: Accelerating distributed private machine learning inference with arithmetic garbled circuits, ' arXiv preprint arXiv:2302.06361 , 2023. - · arXiv
  157. [200][200] K. Vaswani, S. Volos, C. Fournet, A. N. Diaz, K. Gordon, B. Vembu, S. Webster, D. Chisnall, S. Kulkarni, G. Cunningham et al. , 'Confidential computing within an { AI } accelerator,' in 2023 USENIX Annual Technical Conference (USENIX ATC 23) , 2023, pp. 501-518. -
  158. [201][201] H. Mai, J. Zhao, H. Zheng, Y. Zhao, Z. Liu, M. Gao, C. Wang, H. Cui, X. Feng, and C. Kozyrakis, 'Honeycomb: Secure and efficient { GPU } executions via static validation,' in 17th USENIX Symposium on Operating Systems Design and Implementation (OSDI 23) , 2023, pp. 155-172. -
  159. [202][202] M. S. Islam, M. Zamani, C. H. Kim, L. Khan, and K. W. Hamlen, 'Confidential execution of deep learning inference at the untrusted edge with arm trustzone,' in Proceedings of the Thirteenth ACM Conference on Data and Application Security and Privacy , 2023, pp. 153-164. -
  160. [203][203] J. Wang, Y. Wang, and N. Zhang, 'Secure and timely gpu execution in cyber-physical systems,' in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , 2023, pp. 2591-2605. -
  161. [204][204] K. Lee, M. Yan, J. Emer, and A. Chandrakasan, 'Secureloop: Design space exploration of secure dnn accelerators,' in Proceedings of the 56th Annual IEEE/ACM International Symposium on Microarchitecture , 2023, pp. 194-208. -
  162. [205][205] Z. Tarkhani and A. Madhavapeddy, 'Information flow tracking for heterogeneous compartmentalized software,' in Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses , 2023, pp. 564-579. -
  163. [206][206] J. Weng, S. Yao, Y. Du, J. Huang, J. Weng, and C. Wang, 'Proof of unlearning: Definitions and instantiation,' IEEE Transactions on Information Forensics and Security , 2024. -
  164. [207][207] C. Wang, F. Zhang, Y. Deng, K. Leach, J. Cao, Z. Ning, S. Yan, and Z. He, 'Cage: Complementing arm cca with gpu extensions,' in Network and Distributed System Security (NDSS) Symposium 2024 , 2024. -
  165. [208][208] M. F. Babar and M. Hasan, 'Real-time scheduling of trustzone-enabled dnn workloads,' in Proceedings of the 4th Workshop on CPS & IoT Security and Privacy , 2022, pp. 63-69. -
  166. [209][209] F. Mo, H. Haddadi, K. Katevas, E. Marin, D. Perino, and N. Kourtellis, 'Ppfl: Enhancing privacy in federated learning with confidential computing,' GetMobile: Mobile Computing and Communications , vol. 25, no. 4, pp. 35-38, 2022. -
  167. [210][210] P. M. VanNostrand, I. Kyriazis, M. Cheng, T. Guo, and R. J. Walls, 'Confidential deep learning: Executing proprietary models on untrusted devices,' arXiv preprint arXiv:1908.10730 , 2019. - · arXiv
  168. [211][211] A. Krizhevsky, I. Sutskever, and G. E. Hinton, 'Imagenet classification with deep convolutional neural networks,' Advances in neural information processing systems , vol. 25, pp. 1097-1105, 2012. -
  169. [212][212] M. Zhao, M. Gao, and C. Kozyrakis, 'Shef: shielded enclaves for cloud fpgas,' in Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems , 2022, pp. 1070-1085. -
  170. [213][213] K. Xia, Y. Luo, X. Xu, and S. Wei, 'Sgx-fpga: Trusted execution environment for cpu-fpga heterogeneous architecture,' in 2021 58th ACM/IEEE Design Automation Conference (DAC) . IEEE, 2021, pp. 301-306.
  171. [217][217] Z. Tarkhani, 'Secure programming with dispersed compartments,' Ph.D. dissertation, University of Cambridge, 2022. -
  172. [218][218] X. Li, H. Xiong, X. Li, X. Wu, X. Zhang, J. Liu, J. Bian, and D. Dou, 'Interpretable deep learning: Interpretation, interpretability, trustworthiness, and beyond,' arXiv preprint arXiv:2103.10689 , 2021. - · arXiv
  173. [219][219] F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, 'Ensemble adversarial training: Attacks and defenses,' in International Conference on Learning Representations , 2018. -
  174. [220][220] A. R. Chowdhury, C. Guo, S. Jha, and L. van der Maaten, 'Eiffel: Ensuring integrity for federated learning,' arXiv preprint arXiv:2112.12727 , 2021. - · arXiv
  175. [221][221] R. Motwani and P. Raghavan, 'Randomized algorithms,' ACM Computing Surveys (CSUR) , vol. 28, no. 1, pp. 33-37, 1996. -
  176. [222][222] R. Zhang, J. Liu, Y. Ding, Z. Wang, Q. Wu, and K. Ren, ''adversarial examples' for proof-of-learning,' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 1408-1422. -
  177. [223][223] R. C. Merkle, 'Protocols for public key cryptosystems,' in 1980 IEEE Symposium on Security and Privacy . IEEE, 1980, pp. 122-122. -
  178. [224][224] N. Lukas, E. Jiang, X. Li, and F. Kerschbaum, 'Sok: How robust is image classification deep neural network watermarking?' in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 787-804. -
  179. [225][225] R. C. Merkle, 'A certified digital signature,' in Conference on the Theory and Application of Cryptology . Springer, 1989, pp. 218-238. -
  180. [226][226] F. Cohen, 'A cryptographic checksum for integrity protection,' Computers & Security , vol. 6, no. 6, pp. 505-510, 1987. -
  181. [227][227] N. Karapanos, A. Filios, R. A. Popa, and S. Capkun, 'Verena: End-to-end integrity protection for web applications,' in 2016 IEEE Symposium on Security and Privacy (SP) . IEEE, 2016, pp. 895-913. -
  182. [228][228] C. E. Brodley and M. A. Friedl, 'Identifying mislabeled training data,' Journal of artificial intelligence research , vol. 11, pp. 131-167, 1999. -
  183. [229][229] X. Chu, I. F. Ilyas, S. Krishnan, and J. Wang, 'Data cleaning: Overview and emerging challenges,' in Proceedings of the 2016 international conference on management of data , 2016, pp. 2201-2206. -
  184. [230][230] D. Bahri, H. Jiang, and M. Gupta, 'Deep k-nn for noisy labels,' in International Conference on Machine Learning . PMLR, 2020, pp. 540-550. -
  185. [231][231] Z. Tarkhani and A. Madhavapeddy, 'Enclave-aware compartmentalization and secure sharing with sirius,' arXiv preprint arXiv:2009.01869 , 2020. - · arXiv
  186. [232][232] S. Chen, Z. Lin, and Y. Zhang, 'Controlled Data Races in Enclaves: Attacks and Detection,' in 32st USENIX Security Symposium (USENIX Security 23) . USENIX Association, 2023. -
  187. [235][235] Z. Tarkhani, A. Madhavapeddy, and R. Mortier, 'Snape: The dark art of handling heterogeneous enclaves,' in Proceedings of the 2nd International Workshop on Edge Systems, Analytics and Networking , 2019, pp. 48-53. -
  188. [236][236] D. Suciu, S. McLaughlin, L. Simon, and R. Sion, 'Horizontal privilege escalation in trusted applications,' in 29th { USENIX } Security Symposium ( { USENIX } Security 20) , 2020. -
  189. [237][237] S. Checkoway and H. Shacham, Iago attacks: why the system call API is a bad untrusted RPC interface . ACM, 2013, vol. 41, no. 1. -
  190. [238][238] J. Van Bulck, D. Oswald, E. Marin, A. Aldoseri, F. D. Garcia, and F. Piessens, 'A tale of two worlds: Assessing the vulnerability of enclave shielding runtimes,' in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , 2019, pp. 1741-1758. -
  191. [239][239] S. Weiser, L. Mayr, M. Schwarz, and D. Gruss, 'Sgxjail: Defeating enclave malware via confinement,' in 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019) , 2019, pp. 353-366. -
  192. [240][240] Y. Liu and A. Srivastava, 'Ganred: Gan-based reverse engineering of dnns via cache side-channel,' in Proceedings of the 2020 ACM SIGSAC Conference on Cloud Computing Security Workshop , 2020, pp. 41-52. -
  193. [241][241] Y. Xiang, Z. Chen, Z. Chen, Z. Fang, H. Hao, J. Chen, Y. Liu, Z. Wu, Q. Xuan, and X. Yang, 'Open dnn box by power side-channel attack,' IEEE Transactions on Circuits and Systems II: Express Briefs , vol. 67, no. 11, pp. 2717-2721, 2020. -
  194. [242][242] L. Batina, S. Bhasin, D. Jap, and S. Picek, ' { CSI }{ NN } : Reverse engineering of neural network architectures through electromagnetic side channel,' in 28th USENIX Security Symposium (USENIX Security 19) , 2019, pp. 515-532. -
  195. [243][243] W. Zheng, A. Dave, J. G. Beekman, R. A. Popa, J. E. Gonzalez, and I. Stoica, 'Opaque: An oblivious and encrypted distributed analytics platform,' in 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17) , 2017, pp. 283-298. -
  196. [244][244] W. Zhao, K. Lu, Y. Qi, and S. Qi, 'Mptee: bringing flexible and efficient memory protection to intel sgx,' in Proceedings of the Fifteenth European Conference on Computer Systems , 2020, pp. 1-15. arXiv preprint arXiv:2111.03065 , 2021. - · arXiv
  197. [245][245] Y. Shen, H. Tian, Y. Chen, K. Chen, R. Wang, Y. Xu, Y. Xia, and S. Yan, 'Occlum: Secure and efficient multitasking inside a single enclave of intel sgx,' in Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems , 2020, pp. 955-970. -
  198. [246][246] I. Jang, A. Tang, T. Kim, S. Sethumadhavan, and J. Huh, 'Heterogeneous isolated execution for commodity gpus,' in Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems , 2019, pp. 455-468. -
  199. [247][247] A. Akram, V. Akella, S. Peisert, and J. Lowe-Power, 'Sok: Limitations of confidential computing via tees for high-performance compute systems,' in 2022 IEEE International Symposium on Secure and Private Execution Environment Design (SEED) . IEEE, 2022, pp. 121-132. -
  200. [248][248] S. Siby, S. Abdollahi, M. Maheri, M. Kogias, and H. Haddadi, 'Guarantee: Towards attestable and private ml with cca,' in Proceedings of the 4th Workshop on Machine Learning and Systems , 2024, pp. 1-9. -

200 of 228 shown

Cited by

Sorted by citations

Authors
Mo, F., Tarkhani, Z., & Haddadi, H.
Affiliations
  • Imperial College London (GB)
  • Microsoft Research (United Kingdom) (GB)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2022
Volume
56
Issue
11
Pages
1-40
ISSN
0360-0300 (ISSN-L)
DOI
10.48550/arxiv.2208.10134
arXiv
2208.10134
OpenAlex
W4399291916
Cited by
31
References
0
Citations by year
2026: 19 · 2025: 10 · 2024: 2
FWCI
4.55
Type
journal article
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • ACM Computing Surveys (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
Keywords
confidential computing, machine learning privacy, trusted execution environments, integrity assurance, privacy definitions

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review