Towards Auditable Properties of Machine Learning Systems

Abstract

Machine learning (ML) property attestations are a set of mechanisms through which model providers (provers) can attest to properties about their machine learning models and datasets to verifiers, providing auditability and demonstrating compliance with regulatory or internal policies or standards. However, existing approaches do not simultaneously achieve efficiency, scalability, versatility, and security. Systems based on trusted execution environments (TEEs) have been shown to be more efficient and scalable; however, prior work is limited to CPU-only computation, making it inefficient to run large generative models. Additionally, TEE-based approaches rely on static attestation, which cannot detect run-time attacks such as loading a malicious model checkpoint or corrupting model weights in memory after the system has been launched and measured, allowing an adversary to manipulate inference outputs at run-time. As such, the limitations of existing TEE-based approaches include: (1) they do not scale to large generative models and datasets, and (2) their sole reliance on static attestation makes them vulnerable to various run-time attacks.

To address the first limitation, I present PAL*M, a property attestation framework for large generative models, illustrated by large language models. PAL*M addresses three key challenges: (1) attesting properties over large datasets accessed via random sampling outside trusted memory, (2) supporting heterogeneous CPU-GPU execution environments, and (3) defining attestable properties for generative model operations. PAL*M leverages confidential virtual machines with security-aware GPUs and employs incremental multiset hashing to efficiently measure dataset integrity across memory-mapped accesses. PAL*M is implemented atop Intel TDX and NVIDIA H100, and formally modeled using the Tamarin Prover symbolic verification tool, confirming that its security guarantees are upheld under the defined threat model.

For the second limitation, I present EVOLVE, a proof-of-execution (PoX) mechanism for confidential virtual machines that enables run-time property attestation of ML operations. EVOLVE has two components: an instrumentation module and a PoX monitor. The instrumentation module preprocesses an ML application to ensure that both memory accesses and indirect calls pass through the PoX monitor. At run-time, the PoX monitor inspects memory accesses to determine whether the correct subset of the application is modifying the output and validates indirect calls to ensure that control flow cannot be redirected into the monitor to alter its state, constructing PoX evidence accordingly. The PoX monitor is implemented as an extension of TD-Shim, and its efficiency and security are evaluated on Intel TDX using classifier model routing as a proof-of-concept application.