用可信执行环境保护大模型，云部署时性能损耗低于10%。
Fortify Your Foundations: Practical Privacy and Security for Foundation Model Deployments In The Cloud
- 采用英特尔SGX和TDX等可信执行环境，实现安全隔离。
- 在云端运行Llama2 7B/13B推理时，性能开销低于10%。
- 首个实证展示可信环境对大模型部署的可行性，适合企业级安全需求。
基础模型（FMs）在自然语言处理等领域表现优异，并被广泛应用于各类场景。尽管通常基于公开数据训练，但其微调或集成到检索增强生成（RAG）系统时会接触私有数据，加之模型规模大、训练成本高，面临知识产权泄露风险。多模态模型还可能暴露敏感信息。本文分析了基础模型的威胁模型，评估了多种防护方案的实用性与全面性，包括机器学习方法与可信执行环境（TEEs）。结果表明，TEEs在安全性、可用性与性能间取得良好平衡。具体而言，我们在Intel SGX和Intel TDX中实现了全链路的Llama2 7B与13B推理，性能开销低于10%。同时分享了配置文件与实施经验。据我们所知，这是首个证明TEEs在实际中可用于保护基础模型的工作。
原文摘要 · Abstract (English)
Foundation Models (FMs) display exceptional performance in tasks such as natural language processing and are being applied across a growing range of disciplines. Although typically trained on large public datasets, FMs are often fine-tuned or integrated into Retrieval-Augmented Generation (RAG) systems, which rely on private data. This access, along with their size and costly training, heightens the risk of intellectual property theft. Moreover, multimodal FMs may expose sensitive information. In this work, we examine the FM threat model and discuss the practicality and comprehensiveness of various approaches for securing against them, such as ML-based methods and trusted execution environments (TEEs). We demonstrate that TEEs offer an effective balance between strong security properties, usability, and performance. Specifically, we present a solution achieving less than 10\% overhead versus bare metal for the full Llama2 7B and 13B inference pipelines running inside \intel\ SGX and \intel\ TDX. We also share our configuration files and insights from our implementation. To our knowledge, our work is the first to show the practicality of TEEs for securing FMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。