Towards TEE-Certified DP: Verifiable Differentially Private Training on Legacy GPUs
Framework uses CPU TEEs with probabilistic checking to verifiably enforce differential privacy on GPU-offloaded gradient computation at modest overhead.
The paper proposes verifiable differentially private training using CPU-side TEEs combined with untrusted GPUs, targeting legacy hardware that lacks efficient multi-GPU TEE support. Gradient computation is offloaded to GPUs while the CPU TEE verifies correct DP enforcement on gradients through probabilistic checking, avoiding the prohibitive overhead of zero-knowledge proof approaches. The framework detects frequent full deviations from DP with high probability, and evaluated forged-gradient attacks show sparse deviations provide limited utility benefit with no measurable additional membership leakage. Experiments show only modest overhead compared with standard GPU-based DP training.
- Framework offloads gradient computation to untrusted GPUs while a CPU TEE verifies DP enforcement probabilistically.
- Targets legacy GPUs where multi-GPU TEE support is absent or inefficient.
- Detects frequent full DP deviations with high probability at modest overhead.
- Evaluated forged-gradient attacks show sparse deviations give limited utility and no extra membership leakage.
From the original article
1 min read at arxiv.orgWide adoption of machine learning has created growing policy and regulatory demand for protecting sensitive training data, with differential privacy (DP) emerging as a key mechanism.
By Li Ge · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.