AI Insight
MammothDP is a machine learning system designed to protect sensitive data through a combination of trusted execution environments (TEEs), timing side-channel hardening, and differential privacy. The system implements gradient boosted decision trees with two key innovations: an adaptive early stopping criterion that optimally selects the number of trees without compromising privacy, and improved rollback protection resistant to timing side-channel attacks. This approach addresses security challenges that emerge when combining hardware-based protections with differential privacy guarantees for tabular data analysis.
Why it matters
This work is particularly relevant for data-sensitive applications like the European Health Data Space, where medical and personal information must be protected both during analysis and when publishing research results. The system provides a practical framework for organizations to conduct machine learning studies on sensitive data while maintaining strong privacy guarantees against both software and hardware-based attacks.
Understand the Science
⚠️ Preprint – Noch nicht peer-reviewed
Dieser Artikel wurde noch nicht von unabhängigen Experten begutachtet. Die Ergebnisse sind vorläufig und sollten mit Vorsicht interpretiert werden.
Abstract: Data spaces like the European Health Data Space (EHDS) require the protection of sensitive data in studies during the data’s processing and the study’s release alike. In this work, we investigate how to implement this mandate using established trusted execution environments (TEEs) and timing side-channel hardening to protect the processing even under a compromised server, and the state-of-the-art differential privacy (DP) notion to protect the release of studies on tabular data. This combined setup could seem to complete the picture, but in fact raises unexpected security challenges that we mitigate by introducing MammothDP: a significant milestone towards a holistic machine learning system based on the recent gradient boosted decision tree learner S-BDT that is provably DP if used within a privacy filter, timing side-channel hardened, and deployed on a TEE. To achieve a strong privacy-utility tradeoff, we introduce two novel components: an early stopping criterion that adaptively selects the number of trees without any privacy overhead, and an improved rollback protection that is no longer vulnerable under timing side-channel attacks.