Trusted model environments enable secure semantic data computations
Trusted Model Environment for Private Semantic Computations
Cryptography and Security
Summary
Computers often need to understand the meaning and context of data to work with it properly, but doing this privately is very hard. This paper presents a new way to run advanced AI models inside special secure areas of a computer, protecting the data and computations from being exposed. The authors show how their system balances safety, accuracy, and performance while letting multiple parties collaborate securely. Their approach also lets users verify that the computations were done correctly without leaking sensitive information.
What this means in practice
- •For enterprise security teams: Protect sensitive enterprise data by running semantic AI tasks securely within trusted hardware, ensuring confidentiality and verifiable results.
- •For cloud service providers: Offer scalable, privacy-preserving AI model computations to customers using trusted execution environments to control data leakage and provide verifiability.$Commercial implications: Enables cloud providers to sell secure AI inference services that keep client data private while guaranteeing correct execution.
Authors
Vasisht Duddu, Xi He
Abstract
A private semantic computation primitive enables parties to privately compute over structured and unstructured data that requires understanding its semantics, context, and relationships. Standard cryptographic primitives (e.g., multiparty computation) do not readily support such computation. Generative models are well suited for such tasks but typically process data in plaintext, while cryptographic private inference remains inefficient and difficult to scale. Thus, we need a new primitive for private semantic computation. We introduce trusted model environments (TME), the first such primitive that executes generative models inside trusted execution environments (TEEs) while controlling output leakage. TME is designed to be (i) effective (correctly performs the semantic task); (ii) confidential (protects computation and sensitive inputs); (iii) utility-preserving (retains utility on other tasks); (iv) verifiable (provides tamper-resistant evidence of the computations); (v) efficient (incurs low overhead compared to baseline model computations); and (vi) scalable (supports multiple participating parties). Effectiveness follows from the generative models, while TEEs provide confidential computation. For confidentiality of sensitive inputs, we combine adversarial training to resist verbatim leakage with an information flow control module to suppress semantic leakage. For verifiability, we introduce novel attestations that let parties verify TME operations on their data and queries, along with optimizations (e.g., batching) for efficiency and scalability. We design and evaluate the proof-of-concept for TME across three applications, showing that it meets all the requirements.