Please note: This master’s thesis presentation will take place online.
Prach Chantasantitam, Master’s candidate
David R. Cheriton School of Computer Science
Supervisor: Professor N. Asokan
Machine learning (ML) property attestations are a set of mechanisms through which model providers (provers) can attest to properties about their machine learning models and datasets to verifiers, providing auditability and demonstrating compliance with regulatory or internal policies or standards. However, existing approaches do not simultaneously achieve efficiency, scalability, versatility, and security. Systems based on trusted execution environments (TEEs) have been shown to be more efficient and scalable; however, prior work is limited to CPU-only computation, making it inefficient to run large generative models. Additionally, TEE-based approaches rely on static attestation, which cannot detect run-time attacks such as loading a malicious model checkpoint or corrupting model weights in memory after the system has been launched and measured, allowing an adversary to manipulate inference outputs at run-time. As such, the limitations of existing TEE-based approaches include: (1) they do not scale to large generative models and datasets, and (2) their sole reliance on static attestation makes them vulnerable to various run-time attacks.
To address the first limitation, I present PAL*M, a property attestation framework for large generative models, illustrated by large language models. PAL*M addresses three key challenges: (1) attesting properties over large datasets accessed via random sampling outside trusted memory, (2) supporting heterogeneous CPU-GPU execution environments, and (3) defining attestable properties for generative model operations. PAL*M leverages confidential virtual machines with security-aware GPUs and employs incremental multiset hashing to efficiently measure dataset integrity across memory-mapped accesses. PAL*M is implemented atop Intel TDX and NVIDIA H100, and formally modeled using the Tamarin Prover symbolic verification tool, confirming that its security guarantees are upheld under the defined threat model.
For the second limitation, I present EVOLVE, a proof-of-execution (PoX) mechanism for confidential virtual machines that enables run-time property attestation of ML operations. EVOLVE has two components: an instrumentation module and a PoX monitor. The instrumentation module preprocesses an ML application to ensure that memory accesses pass through the PoX monitor. At run-time, the PoX monitor inspects memory accesses to determine whether the correct subset of the application is altering the output, and it constructs PoX evidence accordingly. The PoX monitor is implemented as an extension to TD-Shim, and its efficiency and security are evaluated on Intel TDX using classifier model routing as a proof-of-concept application.
Attend this master’s thesis presentation virtually on MS teams.