.png){kind=icon}
.png){kind=icon}
Return
Palladium: Guarding Neural Network Training With Confidential Computing
.png){kind=icon}
PRE
AI
W
M
王
H
Z
X
DOI：10.1109/tdsc.2026.3694706.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
In the era of deep learning, protecting the training data and model parameters of high-performance Deep Neural Networks (DNNs) is critical. Data holders often want to use private data to train dedicated DNNs while leveraging AI accelerators hosted on remote servers, such as GPUs or TPUs. However, cloud systems are vulnerable to adversaries who may compromise both computational integrity and user data privacy. Performing verifiable and private training without losing access to untrusted accelerators remains a significant challenge. While previous works rely on Trusted Execution Environments (TEEs) to safeguard privacy during inference, they primarily address forward propagation and are not suitable for backward propagation in training. To address this limitation, this paper proposes <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Palladium</small>, the first system to achieve confidentiality, integrity, and low latency for both model parameters and training data. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Palladium</small> leverages TEE-empowered confidential computing to protect privacy and verify integrity, while securely outsourcing most linear layer computations to untrusted GPUs to optimize performance. Specifically, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Palladium</small> preserves the confidentiality of outsourced parameters by transforming the weights of linear operators and generating input masks through a carefully designed <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Cloak</i> strategy. It then fully recovers the execution results inside the TEE using the corresponding <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">UnCloak</i> strategy. To further ensure computational integrity, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Palladium</small> incorporates a stochastic operator verification mechanism that detects breaches outside the TEE with 99% confidence. We implement a prototype of <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Palladium</small> based on Libtorch and Occlum and conduct a comprehensive evaluation on four network architectures and four datasets. Evaluation results show that <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Palladium</small> provides strong security guarantees with reasonable performance overhead, preserves high training accuracy, and protects model privacy.
Keywords:
Confidential computing
trusted execution environments
deep neural network
secure training system
Journal
IF:
7.5
Papers:
2.4K
Citations:
9.6K
Organization
Cited Papers