PALLADIUM: Guarding Neural Network Training With Confidential Computing

—In the era of deep learning, protecting the training data and model parameters of high-performance Deep Neural Networks (DNNs) is critical. Data holders often want to use private data to train dedicated DNNs while leveraging AI accelerators hosted on remote servers, such as GPUs or TPUs. However, cloud systems are vulnerable to adversaries who may compromise both computational integrity and user data privacy. Performing verifiable and private training without losing access to untrusted accelerators remains a significant challenge. While previous works rely on Trusted Execution Environments (TEEs) to safeguard privacy during inference, they primarily address forward propagation and are not suitable for backward propagation in training. To address this limitation, this paper proposes PALLADIUM, the first system to achieve confidentiality, integrity, and low latency for both model parameters and training data. PALLADIUM leverages TEE-empowered confidential computing to protect privacy and verify integrity, while securely outsourcing most linear layer computations to untrusted GPUs to optimize performance. Specifically, PALLADIUM preserves the confidentiality of outsourced parameters by transforming the weights of linear operators and generating input masks through a carefully designed Cloak strategy. It then fully recovers the execution results inside the TEE using the corresponding UnCloak strategy. To further ensure computational integrity, PALLADIUM incorporates a stochastic operator verification mechanism that detects breaches outside the TEE with 99% confidence. We implement a prototype of PALLADIUM based on Libtorch and Occlum and conduct a comprehensive evaluation on four network architectures and four datasets. Evaluation results show that PALLADIUM provides strong security guarantees with reasonable performance overhead, preserves high training accuracy, and protects model privacy.