Palladium: Guarding Neural Network Training With Confidential Computing

Summary

Palladium is a system for training deep neural networks that protects both model parameters and training data while outsourcing most linear layer computations to untrusted GPUs. It uses Trusted Execution Environments to preserve confidentiality and verify integrity, with a Cloak and UnCloak strategy and a stochastic operator verification mechanism that detects breaches outside the TEE with 99% confidence. A prototype built on Libtorch and Occlum, evaluated on four network architectures and four datasets, shows strong security guarantees, reasonable performance overhead, and preserved training accuracy.