在CalTrain上实现数据机密性和模型可靠性
Reaching Data Confidentiality and Model Accountability on the CalTrain
摘要：
分布式协作学习（DCL）范例使得能够从不信任的多方参与者构建联合机器学习模型。通过在每个参与者的本地基础设施上保留私有训练数据来保证数据机密性。然而，这种实现数据机密性的方法使今天的DCL设计从根本上容易受到数据投毒和后门攻击的攻击。它还限制了DCL的模型责任，这是回溯负责任的“坏”训练数据实例/贡献者的关键。在本文中，我们介绍了CALTRAIN，一个可信的执行环境（TEE）为基础的集中式多方协作学习系统，同时实现数据的机密性和模型的问责制。CALTRAIN对集中聚集的训练数据实施隔离计算，以保证数据机密性。为了支持构建负责任的学习模型，我们安全地维护了训练实例及其相应贡献者之间的链接。我们的评估表明，与在非保护环境中训练的模型相比，从CALTRAIN生成的模型可以达到相同的预测精度。我们还证明，当恶意训练参与者倾向于在模型训练过程中植入后门时，CALTRAIN可以准确地发现导致运行时预测错误的中毒和错误标记的训练数据。
英文摘要：
Distributed collaborative learning (DCL) paradigms enable building joint machine learning models from distrusting multi-party participants. Data confidentiality is guaranteed by retaining private training data on each participant's local infrastructure. However, this approach to achieving data confidentiality makes today's DCL designs fundamentally vulnerable to data poisoning and backdoor attacks. It also limits DCL's model accountability, which is key to backtracking the responsible "bad" training data instances/contributors. In this paper, we introduce CALTRAIN, a Trusted Execution Environment (TEE) based centralized multi-party collaborative learning system that simultaneously achieves data confidentiality and model accountability. CALTRAIN enforces isolated computation on centrally aggregated training data to guarantee data confidentiality. To support building accountable learning models, we securely maintain the links between training instances and their corresponding contributors. Our evaluation shows that the models generated from CALTRAIN can achieve the same prediction accuracy when compared to the models trained in non-protected environments. We also demonstrate that when malicious training participants tend to implant backdoors during model training, CALTRAIN can accurately and precisely discover the poisoned and mislabeled training data that lead to the runtime mispredictions.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
