TLDR: VeFIA is a novel framework designed to audit the correctness of AI inference software in Vertical Federated Learning (VFL) systems. It addresses the critical challenge of ensuring accountability when multiple parties collaborate on AI without sharing raw data. VeFIA achieves this by running parallel trusted and untrusted inference paths, leveraging Trusted Execution Environments (TEE) and a coordinator. It incorporates privacy-aware training, runtime authenticity validation, and an efficient sampling-based auditing schedule. Evaluations show VeFIA can detect abnormal inferences with high probability (99.99% for >5.4% anomaly rate) with negligible latency overhead and strong privacy protection, making collaborative AI more trustworthy and reliable.
In the evolving landscape of Artificial Intelligence, Vertical Federated Learning (VFL) stands out as a crucial method for different organizations to collaborate on AI projects without directly sharing their sensitive data. This approach allows multiple parties, like a bank and a mobile payment platform, to combine their unique datasets to train a powerful AI model, such as one for credit risk assessment. However, a significant challenge has emerged: how can the ‘task party’ (the one initiating the AI task) be sure that the ‘data party’ (the one providing data and performing part of the AI computation) is executing its AI software correctly during the inference phase? This lack of accountability can lead to inaccurate predictions and substantial financial losses, similar to past software errors in financial markets.
Introducing VeFIA: Ensuring Trust in Collaborative AI
A new framework called VeFIA (Vertical Federated Inference Auditing) has been developed to address this critical gap. VeFIA provides a robust mechanism for the task party to audit the correctness of the data party’s AI inference software. The core idea behind VeFIA is to create two parallel execution paths for AI inference: one is the data party’s standard, high-speed but untrusted path, and the other is a trusted path that uses a secure environment called a Trusted Execution Environment (TEE) and a neutral coordinator.
Overcoming Key Challenges
VeFIA tackles three main technical challenges to achieve its goal:
- Privacy Leak Control: When parts of the data party’s AI model are outsourced to the coordinator for trusted inference, there’s a risk that intermediate data could leak private information. VeFIA addresses this by using a privacy-aware training method that adds a learned perturbation to the data, significantly reducing the chance of privacy leaks while maintaining model performance.
- Runtime Artifact Authenticity: Even with a secure TEE, there’s a risk that the data party might load incorrect or tampered data or models into the trusted environment. VeFIA implements a hash consistency validation protocol. This protocol, executed within the TEE, verifies the integrity of both the input data and the AI model components against pre-approved versions, ensuring that only authentic elements are used for auditing.
- Efficient Inference Auditing: Auditing every single inference in a high-volume system would be too slow. VeFIA employs an efficiency-aware computation schedule that uses a confidential random sampling strategy. The task party secretly selects a small subset of inferences to be validated through the trusted TEE-COO path. This allows for high-probability detection of widespread anomalies without adding noticeable delay to the main AI inference process. Furthermore, VeFIA incorporates a pipeline acceleration technique to optimize the trusted inference path, especially beneficial for larger AI models.
How VeFIA Works
The VeFIA workflow involves several steps: First, during the training phase, the data party’s AI model is partitioned, with a privacy-sensitive part deployed to its local TEE and a deeper part uploaded to the coordinator. Second, the data party performs its regular, untrusted AI inference. Third, in parallel, VeFIA confidentially selects a subset of inputs for validation. These inputs go through the secure TEE-COO pipeline, where data and model integrity are checked. Finally, the task party compares the results from both the untrusted and trusted inference paths. Any inconsistency signals an abnormal execution, allowing the task party to detect issues without interrupting the ongoing AI service.
Also Read:
- Revolutionizing Hardware Design: How Agentic AI is Building Better Chips
- FlowSpec: Revolutionizing LLM Inference at the Edge for Faster, Smarter AI
Proven Effectiveness and Efficiency
Extensive evaluations show that VeFIA is highly effective. It can detect abnormal inference execution with over 99.99% probability if the proportion of abnormal inferences exceeds a minimal threshold of 5.4%. Unlike previous methods that struggled with subtle errors, VeFIA achieves 100% accuracy in identifying both true positives and true negatives within the sampled inferences. Crucially, VeFIA introduces only a negligible average latency fluctuation of 0.56% to the online inference system, ensuring high throughput is maintained. Its privacy-aware training reduces the risk of input data leakage by an average of 72.9% with only a marginal 0.51% drop in accuracy. Moreover, VeFIA demonstrates strong scalability, with detection latency increasing by only about 5% even when the number of participating data parties grows significantly.
VeFIA represents a significant step forward in building trust and accountability in collaborative AI systems, particularly in sensitive domains like finance. By providing a verifiable auditing mechanism for AI inference, it helps ensure that AI software operates as expected, safeguarding against both malicious attacks and accidental errors. You can read the full research paper here.
