Currently the only techniques for sharing governance of a deep learning model are homomorphic encryption and secure multiparty computation. Unfortunately, neither of these techniques is applicable to the training of large neural networks due to their large computational and communication overheads. As a scalable technique for shared model governance, we propose splitting deep learning model between multiple parties. This paper empirically investigates the security guarantee of this technique, which is introduced as the problem of model completion:  Given the entire training data set or an environment simulator, and a subset of the parameters of a trained deep learning model, how much training is required to recover the model’s original performance?   We define a metric for evaluating the hardness of the model completion problem and study it empirically in both supervised learning on ImageNet and reinforcement learning on Atari and DeepMind Lab. Our experiments show that (1) the model completion problem is harder in reinforcement learning than in supervised learning because of the unavailability of the trained agent’s trajectories, and (2) its hardness depends not primarily on the number of parameters of the missing part, but more so on their type and location.   Our results suggest that model splitting might be a feasible technique for shared model governance in some settings where training is very expensive. With an increasing number of deep learning models being deployed in production, questions regarding data privacy and misuse are being raised BID4 . The trend of training larger models on more data BID28 , training models becomes increasingly expensive. Especially in a continual learning setting where models get trained over many months or years, they accrue a lot of value and are thus increasingly susceptible to theft. This prompts for technical solutions to monitor and enforce control over these models BID41 . We are interested in the special case of shared model governance: Can two or more parties jointly train a model such that each party has to consent to every forward (inference) and backward pass (training) through the model?Two popular methods for sharing model governance are homomorphic encryption (HE; BID36 and secure multi-party computation (MPC; BID48 . The major downside of both techniques is the large overhead incurred by every multiplication, both computationally, >1000x for HE BID29 BID14 , >24x for MPC BID25 BID7 , in addition to space (>1000x in case of HE) and communication (>16 bytes per 16 bit floating point multiplication in case of MPC). Unfortunately , this makes HE and MPC inapplicable to the training of large neural networks. As scalable alternative for sharing model governance with minimal overhead, we propose the method of model splitting: distributing a deep learning model between multiple parties such that each party holds a disjoint subset of the model's parameters.Concretely, imagine the following scenario for sharing model governance between two parties, called Alice and Bob. Alice holds the model's first layer and Bob holds the model's remaining layers. In each training step (1) Alice does a forward pass through the first layer, (2) sends the resulting activations to Bob, (3) Bob completes the forward pass, computes the loss from the labels, and does a backward pass to the first layer, (4) sends the resulting gradients to Alice, and (5) Alice finishes the backward pass. How much security would Alice and Bob enjoy in this setting? To answer this question , we have to consider the strongest realistic attack vector. In this work we assume that the adversary has access to everything but the missing parameters held by the other party. How easy would it be for this adversary to recover the missing part of the model? We introduce this as the problem of model completion:Given the entire training data set or an environment simulator, and a subset of the parameters of a trained model, how much training is required to recover the model's original performance?In this paper, we define the problem of model completion formally (Section 3.1), propose a metric to measure the hardness of model completion (Section 3.2), and provide empirical results (Section 4 and Section 5) in both the supervised learning (SL) and in reinforcement learning (RL). For our SL experiments we use the AlexNet convolutional network BID26 and the ResNet50 residual network BID17 on ImageNet BID9 ); for RL we use A3C and Rainbow BID19 in the Atari domain BID1 and IMPALA BID11 on DeepMind Lab BID0 . After training the model, we reinitialize one of the model's layers and measure how much training is required to complete it (see FIG1 ).Our key findings are: (1) Residual networks are easier to complete than nonresidual networks ( Our results shed some initial glimpse on the model completion problem and its hardness. Our findings include: residual networks are easier to complete than non-residual networks, lower layers are often harder to complete than higher layers, and RL models are harder to complete than SL models. Nevertheless several question remain unanswered: Why is the difference in MC-hardness less pronounced between lower and higher layers in Rainbow and AlexNet than in A3C? Why is the absolute number of parameters insubstantial? Are there retraining procedures that are faster than T 1 ? Furthermore, our definition of hardness of the model completion problem creates an opportunity to modulate the hardness of model completion. For example, we could devise model architectures with the explicit objective that model completion be easy (to encourage robustness) or hard (to increase security when sharing governance through model splitting). Importantly, since Equation 1 can be evaluated automatically, we can readily combine this with architecture search BID50 .Our experiments show that when we want to recover 100% of the original performance, model completion may be quite costly: ∼ 40% of the original training costs in many settings; lower performance levels often retrain significantly faster. In scenarios where a model gets trained over many months or years, 40% of the cost may be prohibitively expensive. However , this number also has to be taken with a grain of salt because there are many possible retraining procedures that we did not try. The security properties of model splitting as a method for shared governance require further investigation: in addition to more effective retraining procedures, an attacker may also have access to previous activations or be able to inject their own training data. Yet our experiments suggest that model splitting could be a promising method for shared governance. In contrast to MPC and HE it has a substantial advantage because it is cost-competitiveness with normal training and inference.Learning rate Training batches Retraining batches 5e − 2 0 0 5e − 3 60e3 30e3 5e − 4 90e3 45e3 5e − 5 105e3 72.5e3 Table 1 : AlexNet: Learning schedule for training and retraining procedures.
We study empirically how hard it is to recover missing parts of trained models
{"src": "scitldr-AIC_train", "paper_id": "H1xEtoRqtQ"}