Papers
Topics
Authors
Recent
Search
2000 character limit reached

Optimistic Verifiable Training by Controlling Hardware Nondeterminism

Published 14 Mar 2024 in cs.CR, cs.AI, and cs.LG | (2403.09603v3)

Abstract: The increasing compute demands of AI systems have led to the emergence of services that train models on behalf of clients lacking necessary resources. However, ensuring correctness of training and guarding against potential training-time attacks, such as data poisoning and backdoors, poses challenges. Existing works on verifiable training largely fall into two classes: proof-based systems, which are difficult to scale, and ``optimistic'' methods that consider a third-party auditor who can replicate the training process and contest the trainer. A key challenge with the latter is that nondeterminism between GPU types during training prevents exact replication of the training process, resulting in schemes that are non-robust. We propose a method that combines training in a higher precision than the target, rounding after intermediate computations, and sharing rounding decisions based on an adaptive thresholding procedure, to successfully control for nondeterminism. Across three different NVIDIA GPUs (A40, Titan XP, RTX 2080 Ti), we achieve exact training replication at FP32 precision for both full-training and fine-tuning of ResNet-50 (23M) and GPT-2 (117M) models. Our verifiable training scheme significantly decreases the storage and time costs compared to proof-based systems, and is publicly released at https://github.com/meghabyte/verifiable-training.

Definition Search Book Streamline Icon: https://streamlinehq.com
References (38)
  1. Zero-knowledge proofs of training for deep neural networks. Cryptology ePrint Archive, Paper 2024/162, 2024. URL https://eprint.iacr.org/2024/162. https://eprint.iacr.org/2024/162.
  2. Ligero: Lightweight sublinear arguments without a trusted setup. Cryptology ePrint Archive, Paper 2022/1608, 2022. URL https://eprint.iacr.org/2022/1608. https://eprint.iacr.org/2022/1608.
  3. Foreshadow: Extracting the keys to the intel SGX kingdom with transient Out-of-Order execution. In 27th USENIX Security Symposium (USENIX Security 18), pp.  991–1008, Baltimore, MD, August 2018. USENIX Association. ISBN 978-1-939133-04-5. URL https://www.usenix.org/conference/usenixsecurity18/presentation/bulck.
  4. Poisoning web-scale training datasets is practical, 2023.
  5. Tools for verifying neural models’ training data. In Neural Information Processing Systems, 2023.
  6. Deterministic atomic buffering. In 2020 53rd Annual IEEE/ACM International Symposium on Microarchitecture (MICRO), 2020.
  7. Crane, M. Questionable answers in question answering research: Reproducibility and variability of published results. Transactions of the Association for Computational Linguistics, 6:241–252, 2018a. doi: 10.1162/tacl˙a˙00018. URL https://aclanthology.org/Q18-1018.
  8. Crane, M. Questionable answers in question answering research: Reproducibility and variability of published results. Transactions of the Association for Computational Linguistics, 6:241–252, 2018b. doi: 10.1162/tacl˙a˙00018. URL https://aclanthology.org/Q18-1018.
  9. Reproducible floating-point atomic addition in data-parallel environment. In Proc. of the Federated Conference on Computer Science and Information Systems, 2015.
  10. Creating the first confidential gpus. Commun. ACM, 67(1):60–67, dec 2023. ISSN 0001-0782. doi: 10.1145/3626827. URL https://doi.org/10.1145/3626827.
  11. Proof-of-learning is currently more broken than you think, 2023.
  12. Experimenting with zero-knowledge proofs of training. Cryptology ePrint Archive, Paper 2023/1345, 2023. URL https://eprint.iacr.org/2023/1345. https://eprint.iacr.org/2023/1345.
  13. Planting undetectable backdoors in machine learning models, 2022.
  14. Sigma: Secure gpt inference with function secret sharing. Cryptology ePrint Archive, Paper 2023/1269, 2023. URL https://eprint.iacr.org/2023/1269. https://eprint.iacr.org/2023/1269.
  15. Sleeper agents: Training deceptive llms that persist through safety training, 2024.
  16. Proof-of-learning: Definitions and practice. CoRR, abs/2103.05633, 2021. URL https://arxiv.org/abs/2103.05633.
  17. Gpudet: a deterministic gpu architecture. In ASPLOS ’13: Proceedings of the eighteenth international conference on Architectural support for programming languages and operating systems, 2013.
  18. Kahan, W. Further remarks on reducing truncation errors, 1965. URL https://dl.acm.org/doi/pdf/10.1145/363707.363723.
  19. Scaling up trustless dnn inference with zero-knowledge proofs, 2022.
  20. Stronger data poisoning attacks break data sanitization defenses, 2021.
  21. Can membership inferencing be refuted?, 2023.
  22. vcnn: Verifiable convolutional neural network based on zk-snarks. Cryptology ePrint Archive, Paper 2020/584, 2020. URL https://eprint.iacr.org/2020/584. https://eprint.iacr.org/2020/584.
  23. zkcnn: Zero knowledge proofs for convolutional neural network predictions and accuracy. Cryptology ePrint Archive, Paper 2021/673, 2021. URL https://eprint.iacr.org/2021/673. https://eprint.iacr.org/2021/673.
  24. Merkle, R. C. A digital signature based on a conventional encryption function. In Pomerance, C. (ed.), Advances in Cryptology — CRYPTO ’87, pp.  369–378, Berlin, Heidelberg, 1988. Springer Berlin Heidelberg. ISBN 978-3-540-48184-3.
  25. Micali, S. CS proofs (extended abstracts). In 35th Annual Symposium on Foundations of Computer Science, Santa Fe, New Mexico, USA, 20-22 November 1994, pp.  436–453. IEEE Computer Society, 1994. doi: 10.1109/SFCS.1994.365746. URL https://doi.org/10.1109/SFCS.1994.365746.
  26. A survey of published attacks on intel sgx, 2020.
  27. NVIDIA. Determinism across gpu architectures, 2022. URL https://github.com/NVIDIA/framework-reproducibility/issues/28.
  28. NVIDIA. Cuda: Hopper tuning guide, 2023. URL https://docs.nvidia.com/cuda/pdf/Hopper_Tuning_Guide.pdf.
  29. Compute trends across three eras of machine learning. In 2022 International Joint Conference on Neural Networks (IJCNN). IEEE, July 2022. doi: 10.1109/ijcnn55064.2022.9891914. URL http://dx.doi.org/10.1109/IJCNN55064.2022.9891914.
  30. Very deep convolutional networks for large-scale image recognition, 2015.
  31. An empirical analysis of backward compatibility in machine learning systems, 2020.
  32. Dissecting tensor cores via microbenchmarks: Latency, throughput and numeric behaviors, 2022. URL https://arxiv.org/pdf/2206.02874.pdf#:~:text=Unlike%20Volta%20and%20Turing%20Architecture,%C3%974%C3%978%20MM.
  33. TensorFlow. Tensorflow 2.8.0-rc0, 2021. URL https://github.com/tensorflow/tensorflow/releases/tag/v2.8.0-rc0.
  34. A scalable verification solution for blockchains. CoRR, abs/1908.04756, 2019. URL http://arxiv.org/abs/1908.04756.
  35. On the necessity of auditable algorithmic definitions for machine unlearning. In 31st USENIX Security Symposium (USENIX Security 22), pp.  4007–4022, Boston, MA, August 2022. USENIX Association. ISBN 978-1-939133-31-1. URL https://www.usenix.org/conference/usenixsecurity22/presentation/thudi.
  36. Poisoning language models during instruction tuning, 2023.
  37. Precision & performance: Floating point and ieee 754 compliance for nvidia gpus, 2011. URL https://developer.nvidia.com/sites/default/files/akamai/cuda/files/NVIDIA-CUDA-Floating-Point.pdf.
  38. Randomness in neural network training: Characterizing the impact of tooling. In arXiv:2106.11872v1, 2021.
Citations (3)
View on Semantic Scholar

Summary

No one has generated a summary of this paper yet.

Sign Up to Summarize

Paper to Video (Beta)

No one has generated a video about this paper yet.

Sign Up to Generate All Videos Subscribe on YouTube

Whiteboard

No one has generated a whiteboard explanation for this paper yet.

Sign Up to Generate

Open Problems

We haven't generated a list of open problems mentioned in this paper yet.

Generate Now

Continue Learning

We haven't generated follow-up questions for this paper yet.

Generate Now

Collections

Sign up for free to add this paper to one or more collections.

Sign Up

Tweets

Sign up for free to view the 3 tweets with 7 likes about this paper.

Sign Up for Free