GPU Trusted Execution Environments (GPU-TEEs) enable AI users to deploy GPU-accelerated AI applications in the cloud while maintaining protection against untrusted system software and cloud operators. Some solutions accommodate the complex AI runtime within the TEE, resulting in significant TCB expansion. Lightweight GPU-TEEs address this issue by extracting evidence (e.g., kernel execution order and binaries) offline and enforcing their verification online. Existing lightweight GPU-TEE designs delegate the responsibility of protecting application integrity to users. However, we observe that kernel parameters are highly complex, and users lack effective tools for evidence extraction. Attackers can exploit this gap to corrupt computation results, undermining the practicality of lightweight GPU-TEE solutions. To address this problem, this paper presents AutoSecGPU, an automatic framework for offline evidence generation and online evidence verification that can be easily integrated into modern lightweight GPU-TEE systems. Users only need to run their AI application with the AutoSecGPU Extractor, which automatically generates complete evidence. The AutoSecGPU Verifier then checks program behaviors online against this evidence. We have implemented a prototype of AutoSecGPU on an ARM platform with an NVIDIA RTX 3090 GPU. We evaluate AutoSecGPU on representative AI models (DNNs and Transformers). Offline evidence generation averages 60.31 seconds for inference and 152.77 seconds for training, while online execution introduces only 10.8% and 7.1% overhead, respectively.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

AutoSecGPU: Lightweight GPU-TEE Made Practical with Automatic Evidence Generation

  • Fengyuan Yu,
  • Chenlin Huang,
  • Renyu Yang,
  • Hua Cheng,
  • Yan Ding,
  • Yuncong Ma,
  • Keming Wang,
  • Zhihang Zhang

摘要

GPU Trusted Execution Environments (GPU-TEEs) enable AI users to deploy GPU-accelerated AI applications in the cloud while maintaining protection against untrusted system software and cloud operators. Some solutions accommodate the complex AI runtime within the TEE, resulting in significant TCB expansion. Lightweight GPU-TEEs address this issue by extracting evidence (e.g., kernel execution order and binaries) offline and enforcing their verification online. Existing lightweight GPU-TEE designs delegate the responsibility of protecting application integrity to users. However, we observe that kernel parameters are highly complex, and users lack effective tools for evidence extraction. Attackers can exploit this gap to corrupt computation results, undermining the practicality of lightweight GPU-TEE solutions. To address this problem, this paper presents AutoSecGPU, an automatic framework for offline evidence generation and online evidence verification that can be easily integrated into modern lightweight GPU-TEE systems. Users only need to run their AI application with the AutoSecGPU Extractor, which automatically generates complete evidence. The AutoSecGPU Verifier then checks program behaviors online against this evidence. We have implemented a prototype of AutoSecGPU on an ARM platform with an NVIDIA RTX 3090 GPU. We evaluate AutoSecGPU on representative AI models (DNNs and Transformers). Offline evidence generation averages 60.31 seconds for inference and 152.77 seconds for training, while online execution introduces only 10.8% and 7.1% overhead, respectively.