ginseng the learning tee
play

Ginseng, the Learning TEE Fast, Confidential Machine Learning in - PowerPoint PPT Presentation

Ginseng, the Learning TEE Fast, Confidential Machine Learning in FPGA Enclaves Nick Hynes | Oasis Labs Id Idea eal : data providers pool data to train a large, complex model Id Idea eal : data providers pool data to train a large, complex


  1. Ginseng, the Learning TEE Fast, Confidential Machine Learning in FPGA Enclaves Nick Hynes | Oasis Labs

  2. Id Idea eal : data providers pool data to train a large, complex model

  3. Id Idea eal : data providers pool data to train a large, complex model TransUnion Equifax Experian credit scoring model

  4. Idea Id eal : data providers pool data to train a large, complex model Kaiser Permanente Mass. General UCSF Medical Hospital health diagnosis model

  5. Id Idea eal : data providers pool data to train a large, complex model your neighbor you me truly personal, personal assistant

  6. Re Reality : data providers are mutually distrusting! inappropriate use data theft (ads, military) re-identification

  7. Solu Solution ion : cooperation via a trusted third party (i.e. enclave)

  8. What about CPU Enclaves? Performance of VGG-9 on CIFAR (32x32 RGB images) img/s (training) img/s (inference) Myelin [1] 21 img/s 496 img/s Chiron (4 enclaves) [2] 25 img/s – non-private CPU 42 img/s 1119 img/s [1] Efficient Deep Learning on Multi-Source Private Data . N. Hynes, R. Cheng, D. Song. Arxiv 2018 [2] Chiron: Privacy-preserving machine learning as a service . T. Hunt, C. Song, R. Shokri, V. Shmatikov, and E. Witchel. Arxiv 2018 [3] Graviton: Trusted Execution Environments on GPUs . S. Volos, K. Vaswani. OSDI 2018

  9. What about CPU Enclaves? Performance of VGG-9 on CIFAR (32x32 RGB images) img/s (training) img/s (inference) Myelin [1] 21 img/s 496 img/s Chiron (4 enclaves) [2] 25 img/s – non-private CPU 42 img/s 1119 img/s private GPU: Graviton [3] >1500 img/s >10,000 img/s [1] Efficient Deep Learning on Multi-Source Private Data . N. Hynes, R. Cheng, D. Song. Arxiv 2018 [2] Chiron: Privacy-preserving machine learning as a service . T. Hunt, C. Song, R. Shokri, V. Shmatikov, and E. Witchel. Arxiv 2018 [3] Graviton: Trusted Execution Environments on GPUs . S. Volos, K. Vaswani. OSDI 2018

  10. Ginseng, the Learning TEE FPGA-based ML accelerator 1. Start with a tensor accelerator framework (e.g., VTA [4]) 2. Bolt on a Tensor Encryption Core (TEC) 3. Add remote attestation hardware (PUF, RNG) 4. Distribute with a lightweight, secure unikernel End result: a speedy end-to-end private ML pipeline [4] A Hardware-Software Blueprint for Flexible Deep Learning Specialization . T. Moreau, et al. Arxiv 2019

  11. Ginseng, the Learning TEE Ginseng, the Learning TEE on an FPGA+CPU SoC CPU FPGA Tensor tensor accel. runtime TEC o ff -chip Accelerator Ginseng runtime memory tensor tile bu ff ers TEC data secure µkernel attestation engine PUF RNG

  12. Ginseng, the Learning TEE

  13. Sterling: A Privacy-Preserving Data Marketplace A Demonstration of Sterling: A Privacy-Preserving Data Marketplace. N. Hynes, D. Yan, R. Cheng, and D. Song. VLDB 2018.

Recommend


More recommend