<?xml version="1.0" encoding="utf-8"?>
<export-example>
  <doc>
    <id>1987</id>
    <completedYear>2020</completedYear>
    <publishedYear>2020</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst/>
    <pageLast/>
    <pageNumber>6</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>conferenceobject</type>
    <publisherName>IEEE</publisherName>
    <publisherPlace/>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>1</belongsToBibliography>
    <completedDate>--</completedDate>
    <publishedDate>--</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">Offline Model Guard: Secure and Private ML on Mobile Devices</title>
    <abstract language="eng">Performing machine learning tasks in mobile applications yields a challenging conflict of interest: highly sensitive client information (e.g., speech data) should remain private while also the intellectual property of service providers (e.g., model parameters) must be protected. Cryptographic techniques offer secure solutions for this, but have an unacceptable overhead and moreover require frequent network interaction.In this work, we design a practically efficient hardware-based solution. Specifically, we build OFFLINE MODEL GUARD (OMG) to enable privacy-preserving machine learning on the predominant mobile computing platform ARM—even in offline scenarios. By leveraging a trusted execution environment for strict hardware-enforced isolation from other system components, OMG guarantees privacy of client data, secrecy of provided models, and integrity of processing algorithms. Our prototype implementation on an ARM HiKey 960 development board performs privacy-preserving keyword recognition using TensorFlow Lite for Microcontrollers in real time.</abstract>
    <parentTitle language="eng">2020 Design, Automation &amp; Test in Europe Conference &amp;amp; Exhibition (DATE)</parentTitle>
    <identifier type="doi">10.23919/DATE48585.2020.9116560</identifier>
    <enrichment key="opus_doi_flag">true</enrichment>
    <enrichment key="opus_import_data">{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,5,16]],"date-time":"2024-05-16T16:22:16Z","timestamp":1715876536913},"reference-count":48,"publisher":"IEEE","license":[{"start":{"date-parts":[[2020,3,1]],"date-time":"2020-03-01T00:00:00Z","timestamp":1583020800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2020,3,1]],"date-time":"2020-03-01T00:00:00Z","timestamp":1583020800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2020,3]]},"DOI":"10.23919\/date48585.2020.9116560","type":"proceedings-article","created":{"date-parts":[[2020,6,15]],"date-time":"2020-06-15T23:28:37Z","timestamp":1592263717000},"source":"Crossref","is-referenced-by-count":21,"title":["Offline Model Guard: Secure and Private ML on Mobile Devices"],"prefix":"10.23919","author":[{"given":"Sebastian P.","family":"Bayerl","sequence":"first","affiliation":[{"name":"Technische Hochschule N&amp;#x00FC;rnberg,Germany"}]},{"given":"Tommaso","family":"Frassetto","sequence":"additional","affiliation":[{"name":"Technische Universit&amp;#x00E4;t,Darmstadt,Germany"}]},{"given":"Patrick","family":"Jauernig","sequence":"additional","affiliation":[{"name":"Technische Universit&amp;#x00E4;t,Darmstadt,Germany"}]},{"given":"Korbinian","family":"Riedhammer","sequence":"additional","affiliation":[{"name":"Technische Hochschule N&amp;#x00FC;rnberg,Germany"}]},{"given":"Ahmad-Reza","family":"Sadeghi","sequence":"additional","affiliation":[{"name":"Technische Universit&amp;#x00E4;t,Darmstadt,Germany"}]},{"given":"Thomas","family":"Schneider","sequence":"additional","affiliation":[{"name":"Technische Universit&amp;#x00E4;t,Darmstadt,Germany"}]},{"given":"Emmanuel","family":"Stapf","sequence":"additional","affiliation":[{"name":"Technische Universit&amp;#x00E4;t,Darmstadt,Germany"}]},{"given":"Christian","family":"Weinert","sequence":"additional","affiliation":[{"name":"Technische Universit&amp;#x00E4;t,Darmstadt,Germany"}]}],"member":"263","reference":[{"key":"ref39","article-title":"IMIX: InProcess Memory Isolation EXtension","author":"frassetto","year":"2018","journal-title":"Usenix Security"},{"key":"ref38","article-title":"Intel SGX Explained","volume":"2016 86","author":"costan","year":"2016","journal-title":"IACR Cryptology ePrint Archive"},{"key":"ref33","article-title":"Efficient Deep Learning on MultiSource Private Data","volume":"abs 1807 6689","author":"hynes","year":"2018","journal-title":"CoRR"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3231594"},{"key":"ref31","article-title":"Chiron: Privacy-preserving Machine Learning as a Service","volume":"abs 1803 5961","author":"hunt","year":"2018","journal-title":"CoRR"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.45"},{"key":"ref37","article-title":"MLCapsule: Guarded Offline Deployment of Machine Learning as a Service","volume":"abs 1808 590","author":"hanzlik","year":"2018","journal-title":"CoRR"},{"key":"ref36","article-title":"Prch: A System for Privacy-Preserving Speech Transcription","volume":"abs 1909 4198","author":"ahmed","year":"2019","journal-title":"CoRR"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.21437\/Interspeech.2018-2032"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66402-6_21"},{"key":"ref10","article-title":"TensorFlow Lite for Microcontrollers","year":"0"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23068"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23448"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3297858.3304051"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3323873.3325042"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1186\/1687-417X-2007-037343"},{"key":"ref15","article-title":"Generalized Universal Circuits for Secure Evaluation of Private Functions with Application to Data Classification","author":"sadeghi","year":"2008","journal-title":"International Conference on Information Security and Cryptology (ICISC)"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2011.2108650"},{"key":"ref17","article-title":"CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy","author":"dowlin","year":"2016","journal-title":"ICML"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.12"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134056"},{"key":"ref28","article-title":"Oblivious Multi-Party Machine Learning on Trusted Processors","author":"ohrimenko","year":"2016","journal-title":"Usenix Security"},{"key":"ref4","article-title":"Major breach found in biometrics system used by banks, UK police and defence firms","year":"2019"},{"key":"ref27","article-title":"Slalom: Fast, Verifiable and Private Execution` of Neural Networks in Trusted Hardware","author":"tramer","year":"2019","journal-title":"International Conference on Learning Representations (ICLR)"},{"key":"ref3","article-title":"Apple contractors &amp;#x2019;regularly hear confidential details&amp;#x2019; on Siri recordings","year":"2019"},{"key":"ref6","article-title":"An All-Neural On-Device Speech Recognizer","author":"schalkwyk","year":"2019"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.43"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8682336"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref7","article-title":"CSI NN: Reverse Engineering of Neural Network Architectures Through Electromagnetic Side Channel","author":"batina","year":"2019","journal-title":"Usenix Security"},{"key":"ref2","article-title":"Amazon Ordered to Give Alexa Evidence in Double Murder Case","year":"2018"},{"key":"ref9","article-title":"The Secret Sharer: Measuring Unintended Neural Network Memorization &amp; Extracting Secrets","volume":"abs 1802 8232","author":"carlini","year":"2018","journal-title":"CoRR"},{"key":"ref1","article-title":"Amazon Alexa User Receives 1,700 Audio Recordings of a Stranger through &amp;#x2018;Human Error&amp;#x2019;","year":"2018"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/359340.359342"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196522"},{"key":"ref45","article-title":"Zircon Microkernel","year":"0"},{"key":"ref48","article-title":"Convolutional Neural Networks for SmallFootprint Keyword Spotting","author":"sainath","year":"2015","journal-title":"InterSpeech"},{"key":"ref22","article-title":"XONN: XNOR-based Oblivious Deep Neural Network Inference","author":"riazi","year":"2019","journal-title":"Usenix Security"},{"key":"ref47","article-title":"Speech Commands: A Dataset for Limited-Vocabulary Speech Recognition","volume":"abs 1804 3209","author":"warden","year":"2018","journal-title":"CoRR"},{"key":"ref21","article-title":"GAZELLE: A Low Latency Framework for Secure Neural Network Inference","author":"juvekar","year":"2018","journal-title":"Usenix Security"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.17"},{"key":"ref24","article-title":"Private Machine Learning in TensorFlow using Secure Computation","volume":"abs 1810 8130","author":"dahl","year":"2018","journal-title":"CoRR"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.52"},{"key":"ref23","article-title":"SEALion: A Framework for Neural Network Inference on Encrypted Data","volume":"abs 1904 12840","author":"van elsloo","year":"2019","journal-title":"CoRR"},{"key":"ref44","article-title":"Trust Issues: Exploiting TrustZone TEEs","year":"2017"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2230222"},{"key":"ref43","article-title":"ARM Security Technology - Building a Secure System using TrustZone Technology","year":"2009"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3338469.3358944"}],"event":{"name":"2020 Design, Automation &amp; Test in Europe Conference &amp; Exhibition (DATE)","location":"Grenoble, France","start":{"date-parts":[[2020,3,9]]},"end":{"date-parts":[[2020,3,13]]}},"container-title":["2020 Design, Automation &amp;amp; Test in Europe Conference &amp;amp; Exhibition (DATE)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9112295\/9116186\/09116560.pdf?arnumber=9116560","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,8,2]],"date-time":"2022-08-02T23:48:09Z","timestamp":1659484089000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9116560\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,3]]},"references-count":48,"URL":"http:\/\/dx.doi.org\/10.23919\/date48585.2020.9116560","relation":{},"subject":[],"published":{"date-parts":[[2020,3]]}}}</enrichment>
    <enrichment key="local_crossrefDocumentType">proceedings-article</enrichment>
    <enrichment key="local_crossrefLicence">https://doi.org/10.15223/policy-029</enrichment>
    <enrichment key="local_import_origin">crossref</enrichment>
    <enrichment key="local_doiImportPopulated">PersonAuthorFirstName_1,PersonAuthorLastName_1,PersonAuthorFirstName_2,PersonAuthorLastName_2,PersonAuthorFirstName_3,PersonAuthorLastName_3,PersonAuthorFirstName_4,PersonAuthorLastName_4,PersonAuthorFirstName_5,PersonAuthorLastName_5,PersonAuthorFirstName_6,PersonAuthorLastName_6,PersonAuthorFirstName_7,PersonAuthorLastName_7,PersonAuthorFirstName_8,PersonAuthorLastName_8,Enrichmentconference_title,Enrichmentconference_place,PublisherName,TitleMain_1,TitleParent_1,CompletedYear,Enrichmentlocal_crossrefLicence</enrichment>
    <enrichment key="ConferenceStatement">Design, Automation &amp; Test in Europe Conference &amp; Exhibition 09-13 March 2020</enrichment>
    <enrichment key="conference_place">Grenoble, France</enrichment>
    <enrichment key="Reviewstatus">Begutachtet/Reviewed</enrichment>
    <enrichment key="opus.source">doi-import</enrichment>
    <enrichment key="opus.doi.autoCreate">false</enrichment>
    <enrichment key="opus.urn.autoCreate">false</enrichment>
    <author>Sebastian P. Bayerl</author>
    <author>Tommaso Frassetto</author>
    <author>Patrick Jauernig</author>
    <author>Korbinian Riedhammer</author>
    <author>Ahmad-Reza Sadeghi</author>
    <author>Thomas Schneider</author>
    <author>Emmanuel Stapf</author>
    <author>Christian Weinert</author>
    <collection role="institutes" number="">Fakultät Informatik</collection>
    <collection role="Forschungsschwerpunkt" number="5">Digitalisierung &amp; Künstliche Intelligenz</collection>
    <collection role="institutes" number="">Zentrum für Künstliche Intelligenz (KIZ)</collection>
  </doc>
</export-example>
