TEE-based decentralized recommender systems: The raw data sharing redemption

TL;DR

This paper introduces REX, a novel enclave-based decentralized recommender system that leverages trusted hardware to share raw data securely, significantly improving training speed and reducing network load while maintaining privacy.

Contribution

REX is the first system to utilize TEE for raw data sharing in decentralized collaborative filtering, enhancing convergence speed and privacy preservation.

Findings

REX reduces training time by 18.3x compared to standard methods.

REX decreases network load by two orders of magnitude.

REX maintains privacy with minimal overhead using hardware enclaves.

Abstract

Recommenders are central in many applications today. The most effective recommendation schemes, such as those based on collaborative filtering (CF), exploit similarities between user profiles to make recommendations, but potentially expose private data. Federated learning and decentralized learning systems address this by letting the data stay on user's machines to preserve privacy: each user performs the training on local data and only the model parameters are shared. However, sharing the model parameters across the network may still yield privacy breaches. In this paper, we present REX, the first enclave-based decentralized CF recommender. REX exploits Trusted execution environments (TEE), such as Intel software guard extensions (SGX), that provide shielded environments within the processor to improve convergence while preserving privacy. Firstly, REX enables raw data sharing, which ultimately speeds up convergence and reduces the network load. Secondly, REX fully preserves privacy. We analyze the impact of raw data sharing in both deep neural network (DNN) and matrix factorization (MF) recommenders and showcase the benefits of trusted environments in a full-fledged implementation of REX. Our experimental results demonstrate that through raw data sharing, REX significantly decreases the training time by 18.3x and the network load by 2 orders of magnitude over standard decentralized approaches that share only parameters, while fully protecting privacy by leveraging trustworthy hardware enclaves with very little overhead.