B-LNN: Inference-time linear model for secure neural network inference

Electronic health (e-health) information system relies on cloud computing technologies to provide massive medical data computing and storage services. Especially, the recently proposed Machine Learning as a Service (MLaaS) on these medical data can not only effectively improve the healthcare service quality, but also support the end users with limited computing resources. However, MLaaS on the massive medical data faces the challenge of privacy. Homomorphic encryption technology has been explored to assure the privacy of medical data owners in MLaaS but with the weaknesses of limited homomorphic operations and low efficiency. To alleviate these weaknesses, this paper proposes a novel privacy-preserving non-collusion dualcloud (NCDC) model-based e-health information system using neural network (NN) computing. The system can not only assure medical data privacy through adopting homomorphic encryption technology but also assure NN model privacy by adding fake neurons to the NN. In addition, the proposed e-health information system also has the following advantages: (i) Simple key generation. (ii) No constraint on the size of medical data to be encrypted. (iii) The less loss of prediction accuracy between encrypted and original medical data. (iv) Supporting more homomorphic operations and having better computing efficiency through experiment verification.

Machine learning (ML) algorithms due to their outstanding performances are being extensively used in applications covering several different domains. Recently, the increased growth of cloud services provided training infrastructures for complex ML models able to deal with big data, resulting in the enhancement of ML as a Service (MLaaS). Toward this end, ML applications have been deployed in systems, production models, and businesses. ML algorithms involve accessing data, which is often privacy sensitive. The latter may result in security and privacy risks. Toward this end, this work examines MLaaS and its incorporation into businesses, covering a wide range of different sectors. Companies that develop ML applications are reviewed, and trends in ML-related jobs are reported. Moreover, data protection privacy is discussed and the evolution of graphics processing units (GPUs) as a necessary supporting technology for ML applications is also considered.

Because of the powerful computing and storage capability in cloud computing, machine learning as a service (MLaaS) has recently been valued by the organizations for machine learning training over some related representative datasets. When these datasets are collected from different organizations and have different distributions, multi-task learning (MTL) is usually used to improve the generalization performance by scheduling the related training tasks into the virtual machines in MLaaS and transferring the related knowledge between those tasks. However, because of concerns about privacy breaches (e.g., property inference attack and model inverse attack), organizations cannot directly outsource their training data to MLaaS or share their extracted knowledge in plaintext, especially the organizations in sensitive domains. In this article, we propose a novel privacy-preserving mechanism for distributed MTL, namely NOInfer, to allow several task nodes to train the model locally and transfer their shared knowledge privately. Specifically, we construct a single-server architecture to achieve the private MTL, which protects task nodes’ local data even if n-1 out of n nodes colluded. Then, a new protocol for the Alternating Direction Method of Multipliers (ADMM) is designed to perform the privacy-preserving model training, which resists the inference attack through the intermediate results and ensures that the training efficiency is independent of the number of training samples. When releasing the trained model, we also design a differentially private model releasing mechanism to resist the membership inference attack. Furthermore, we analyze the privacy preservation and efficiency of NOInfer in theory. Finally, we evaluate our NOInfer over two testing datasets and evaluation results demonstrate that NOInfer efficiently and effectively achieves the distributed MTL.

To overcome huge resource consumption of neural networks training, MLaaS (Machine Learning as a Service) has become an irresistible trend, just like SaaS (Software as a Service), PaaS (Platform as a Service), and IaaS (Infrastructure as a Service) have been. But it comes with some security issues of untrustworthy third-party services. Especially machine learning providers may deploy trojan backdoors in provided models for the pursuit of extra profit or other illegal purposes. Against the redundant nodes-based trojaning attack on neural networks, we proposed a novel detecting method, which only requires the untrusted model to be tested and a small batch of legitimate dataset. By comparing different processes of neural networks training, we found that the embedding of malicious nodes will make their parameter configuration abnormal. Moreover, by analysing the cost distribution of test dataset on network nodes, we successfully detect the trojaned nodes in the neural networks. As far as we know, the research on the defence against trojaning attack on neural networks is still in its infancy, and our research may shed light on the security of MLaaS in real-life scenarios.

Machine learning as a service (MLaaS) enables scalable model deployment and inference on cloud servers. However, MLaaS exposes user queries and model parameters to servers. To guarantee confidentiality of queries and model parameters, multi-party computation (MPC) enables secure inference by distributing data and computations across multiple service providers. MPC eliminates single points of failure, mitigates provider breaches and ensures confidentiality beyond legal agreements. Beyond confidentiality of queries and parameters, the model itself can memorize and leak training data during inference. To mitigate privacy concerns, differential privacy (DP) provides a formal privacy guarantee for training data, which can be satisfied by injecting carefully calibrated noise into gradients during training. However, naive combinations of DP and MPC amplify accuracy loss due to DP noise and MPC approximations, and incur high computational and communication overhead due to cryptographic operations. We present SPRINT, the first scalable solution for efficient MPC inference on DP fine-tuned models with high accuracy. SPRINT fine-tunes public pre-trained models on private data using DP. It integrates DP-specific optimizations, e.g., parameter-efficient fine-tuning and noise-aware optimizers, with MPC optimizations, e.g., cleartext public parameters and efficient approximations of non-linear functions. We evaluate SPRINT on GLUE benchmark with RoBERTa, achieving up to 1.6x faster MPC inference than the state-of-the-art non-DP solution SHAFT, reducing communication by 1.6x. Notably, SPRINT maintains high accuracy during MPC inference, with <1 percentage point gap compared to cleartext accuracy.

Machine learning (ML) has become a core component of many real-world applications and training data is a key factor that drives current progress. This huge success has led Internet companies to deploy machine learning as a service (MLaaS). Recently, the first membership inference attack has shown that extraction of information on the training set is possible in such MLaaS settings, which has severe security and privacy implications. However, the early demonstrations of the feasibility of such attacks have many assumptions on the adversary, such as using multiple so-called shadow models, knowledge of the target model structure, and having a dataset from the same distribution as the target model's training data. We relax all these key assumptions, thereby showing that such attacks are very broadly applicable at low cost and thereby pose a more severe risk than previously thought. We present the most comprehensive study so far on this emerging and developing threat using eight diverse datasets which show the viability of the proposed attacks across domains. In addition, we propose the first effective defense mechanisms against such broader class of membership inference attacks that maintain a high level of utility of the ML model.

Researchers at INFN (National Institute for Nuclear Physics) face challenges from basic to hard science use cases (e.g., big-data latest generation experiments) in many areas: High Energy Physics (HEP), Astrophysics, Quantum Computing, Genomics, etc. Machine Learning (ML) adoption is ubiquitous in these areas, requiring researchers to solve problems related to the specificity of applications (e.g., tailored models and intricate domain knowledge), but also requiring solving general infrastructure-level and ML-workflow related problems. As the demand for ML solutions continues to rise across the diverse research domains, there exists a critical need for an innovative approach to accelerate ML adoption. In this regard we introduce an Artificial Intelligence (AI) platform designed as an application-agnostic Machine Learning as a Service (MLaaS) solution. The platform provides a paradigm shift by offering a flexible and generalized infrastructure that decouples the ML development process from the specific use cases. The AI platform is implemented as a software layer on top of our cloud platform: the INFN Cloud, a dedicated, geographically distributed infrastructure which offers composable, scalable, and open-source solutions. The AI platform leverages INFN Cloud resources and principles, gathering and orchestrating technologies to support end-to-end scalable ML solutions: Kubernetes, Kubeflow, KServe, KNative, Kueue, Horovod, etc., ensuring support for several ML frameworks: TensorFlow, PyTorch, Apache MXNet, XGBoost, etc. This paper describes the platform’s design and principles, as well as some selected use cases from Natural Language Processing and HEP domains that can take advantage of the “aaS” approach.

The primary focus of technical communication (TC) in the past decade has been the system-assisted generation and utilization of standardized, structured, and classified content for dynamic output solutions. Nowadays, machine learning (ML) approaches offer a new opportunity to integrate unstructured data into existing knowledge bases without the need to manually organize information into topic-based content enriched with semantic metadata. To make the field of artificial intelligence (AI) more accessible for technical writers and content managers, cloud-based machine learning as a service (MLaaS) solutions provide a starting point for domain-specific ML modelling while unloading the modelling process from extensive coding, data processing and storage demands. Therefore, information architects can focus on information extraction tasks and on prospects to include pre-existing knowledge from other systems into the ML modelling process. In this paper, the capability and performance of a cloud-based ML service, IBM Watson, are analysed to assess their value for semantic context analysis. The ML model is based on a supervised learning method and features deep learning (DL) and natural language processing (NLP) techniques. The subject of the analysis is a corpus of scientific publications on the 2019 Coronavirus disease. The analysis focuses on information extractions regarding preventive measures and effects of the pandemic on healthcare workers.

Recent advancement in artificial intelligence (AI) has resulted in the emergence of Machine Learning as a Service (MLaaS) as a lucrative business model which utilizes deep neural networks (DNNs) to generate revenue. With the investment of huge amount of time, resources, and budgets into researching and developing successful DNN models, it is important for us to protect its intellectual property rights (IPRs) as these models can be easily replicated, shared, or redistributed without the consent of the legitimate owners. So far, a robust protection scheme designed for recurrent neural networks (RNNs) does not exist yet. Thus, this chapter proposes a complete protection framework that includes both white-box and black-box protection to enforce IPR on different variants of RNN. Within the framework, a key gate was introduced for the idea of embedding keys to protect IPR. It designates methods to train RNN models in a specific way such that when an invalid or forged key is presented, the performance of the embedded RNN models will be deteriorated. Having said that, the key gate was inspired by the nature of RNN model, to govern the flow of hidden state and designed in such a way that no additional weight parameters were introduced.

Sharing a pre-trained machine learning model, particularly a deep neural network via prediction APIs, is becoming a common practice on machine learning as a service (MLaaS) platforms nowadays. Although deep neural networks (DNN) have shown remarkable successes in many tasks, they are also criticized for the lack of interpretability and transparency. Interpreting a shared DNN model faces two additional challenges compared with interpreting a general model. (1) Limited training data can be disclosed to users. (2) The internal structure of the models may not be available. These two challenges impede the application of most existing interpretability approaches, such as saliency maps or influence functions, for DNN models. Case-based reasoning methods have been used for interpreting decisions; however, how to select and organize the data points under the constraints of shared DNN models is not discussed. Moreover, simply providing cases as explanations may not be sufficient for supporting instance level interpretability. Meanwhile, existing interpretation methods for DNN models generally lack the means to evaluate the reliability of the interpretation. In this article, we propose a framework named Shared Model INTerpreter (SMINT) to address the above limitations. We propose a new data structure called a boundary graph to organize training points to mimic the predictions of DNN models. We integrate local features, such as saliency maps and interpretable input masks, into the data structure to help users to infer the model decision boundaries. We show that the boundary graph is able to address the reliability issues in many local interpretation methods. We further design an algorithm named hidden-layer aware p-test to measure the reliability of the interpretations. Our experiments show that SMINT is able to achieve above 99% fidelity to corresponding DNN models on both MNIST and ImageNet by sharing only a tiny fraction of training data to make these models interpretable. The human pilot study demonstrates that SMINT provides better interpretability compared with existing methods. Moreover, we demonstrate that SMINT is able to assist model tuning for better performance on different user data.

As more and more deep learning (DL) solutions are employed in the healthcare domain using the Machine Learning as a Service (MLaaS) paradigm, concerns regarding personal data privacy have been raised. In this context, especially in medical imaging, the demand for privacy-preserving techniques, that allow for DL model development, has recently increased significantly. Herein, we propose a medical image obfuscation algorithm based on pixel intensity shuffling and non-bijective functions. The proposed algorithm is evaluated on a medical use case based on coronary angiographic images. Multiple convolutional neural networks are trained to measure the utility of the obfuscated images. An attack configuration based on artificial intelligence (AI) is evaluated to validate the level of privacy. The classification performance on the obfuscated images is satisfactory, while the computational time is not affected significantly. Visual and metrics-based analyses show that the data is protected from human perception and from AI-based image reconstruction approaches.

Machine learning has a vast outreach in principal applications and uses large amount of data to train the models, prompting a viable and easy to use Machine Learning as a Service (MLaaS). This flexible paradigm however, could have immense privacy implications since the training data often contains sensitive features, and adversarial access to such models could pose a security risk. In adversarial attacks such as model inversion attack on a system used for face recognition, an adversary uses the output (target label) to reconstruct the input (image of the target individual from the training dataset). To avert such a vulnerability of the system, in this paper, we develop a novel approach of applying perceptual hash to parts of the given training images that leverages the functional mechanism of image hashing. The facial recognition system is then trained over this newly created dataset of perceptually hashed images and high classification accuracy is observed. Furthermore, we demonstrate a series of model inversion attacks emulating adversarial access that yield hashed images of target individuals instead of the original training dataset images; thereby preventing original image reconstruction and counteracting the inversion attack. Through rigorous empirical evaluations of applying the proposed formulation over real world dataset, we verify the effectiveness of our proposed framework in protecting the training image dataset and counteracting inversion attack.

In this paper we provide a framework for Algorithm As a Service Model which goes beyond Machine Learning as a Service (MLAS) model, by supporting extended category of algorithms including but not limited to measurement, calibration, physics and statistics based models. These algorithms when used for screening of health care data, are termed as Software As Medical Device - SaMD. We present a platform that can act as an accelerator for clinical trials of these SaMD devices. We also go a step ahead from DevOPS model by semi-automating the algorithm deployment process. We have deployed a few algorithms into our platform and in this paper we discuss the case-studies and illustrate the advantages of our approach over conventional methods.

Machine learning as a service (MLaaS) has brought much convenience to our daily lives recently. However, the fact that the service is provided through cloud raises privacy leakage issues. In this work we propose the compressive privacy generative adversarial network (CPGAN), a data-driven adversarial learning framework for generating compressing representations that retain utility comparable to state-of-the-art, with the additional feature of defending against reconstruction attack. This is achieved by applying adversarial learning scheme to the design of compression network (privatizer), whose utility/privacy performances are evaluated by the utility classifier and the adversary reconstructor, respectively. Experimental results demonstrate that CPGAN achieves better utility/privacy trade-off in comparison with the previous work, and is applicable to real-world large datasets.

The immense growth of the cloud infrastructure leads to the deployment of several machine learning as a service (MLaaS) in which the training and the development of machine learning models are ultimately performed in the cloud providers’ environment. However, this could also cause potential security threats and privacy risk as the deep learning algorithms need to access generated data collection, which lacks security in nature. This paper predominately focuses on developing a secure deep learning system design with the threat analysis involved within the smart farming technologies as they are acquiring more attention towards the global food supply needs with their intensifying demands. Smart farming is known to be a combination of data-driven technology and agricultural applications that helps in yielding quality food products with the enhancing crop yield. Nowadays, many use cases had been developed by executing smart farming paradigm and promote high impacts on the agricultural lands.