MammothDP Closes the Gap Between Private ML and Side-Channel Security for Sensitive Tabular Data

First system to combine differential privacy, TEE deployment, and timing side-channel hardening for gradient boosted trees — with a leakage-free early stopping trick that costs zero privacy budget.

Imagine you're whispering a secret in a soundproof room, but someone outside can still figure out what you said by timing how long each sentence takes. You've solved the eavesdropping problem (encryption, trusted hardware), but the rhythm of your speech leaks information through the walls. That's the core tension this paper addresses: deploying differentially private machine learning inside trusted execution environments (TEEs) sounds like a complete solution, but timing side channels open a back door that undermines both protections. MammothDP's committed claim: it is the first gradient boosted decision tree (GBDT) system that is simultaneously provably differentially private under a privacy filter, timing side-channel hardened, and deployable on commodity TEEs like Intel SGX. The 'never been done before' part isn't any single component — DP-GBDTs exist, TEE-deployed ML exists — but the holistic combination, plus two novel mechanisms that make the combination work without the usual privacy-utility penalty. The two technical contributions are sharp. First, an early stopping criterion that adaptively picks how many trees to boost without consuming any of the privacy budget. In standard DP-GBDT training, you either fix the number of trees in advance (suboptimal) or spend privacy budget querying a validation set to decide when to stop (expensive). MammothDP sidesteps this by exploiting properties of the noise mechanism itself to detect convergence — a free lunch that other DP-GBDT learners like S-BDT, DP-XGBoost, and ABCBoost don't offer. Second, an improved rollback protection scheme that patches a vulnerability where an attacker could use timing differences in the rollback mechanism itself to extract information about the training data. The baseline ladder is built on S-BDT, the recent DP-GBDT learner from which MammothDP inherits its core algorithm. The paper positions itself as a strict improvement over S-BDT by adding TEE hardening and the early stopping criterion without degrading the privacy-utility tradeoff. Comparisons to DP-XGBoost and ABCBoost are referenced but the abstract doesn't give us head-to-head accuracy numbers at matched epsilon values — a gap the full paper presumably fills. The privacy guarantees are formal, relying on the composition properties of the privacy filter, which is well-established theory. Integrity-wise, the validation is a mix of formal proof (for the DP guarantees and the timing hardening properties) and empirical evaluation on tabular data benchmarks. The timing side-channel hardening is verified through analysis rather than adversarial red-teaming by an independent party, which is the standard weakness in TEE security papers. The DP proofs rest on established composition theorems, so the formal claims are on solid ground. The empirical claims about privacy-utility tradeoff improvement from early stopping are the ones that need independent replication. The practical context here is the European Health Data Space (EHDS), which mandates that health data used for research must be protected during processing and at release. This is not an abstract threat model — EHDS compliance requires exactly the kind of defense-in-depth this paper provides. The combination of TEE (protects data during computation even from a compromised server), DP (protects individuals in released models), and timing hardening (closes the side-channel gap between the first two) maps directly onto regulatory requirements that are arriving now, not in five years. The successor question is clear: the paper does not demonstrate deployment at production scale on real EHDS-class medical datasets with adversarial red-teaming of the full stack. The honest read is option (a) — the system is a research prototype, and real-world deployment requires engineering effort, regulatory certification, and likely collaboration with healthcare data custodians that falls outside a single academic paper's scope. The next milestone is an end-to-end deployment where an independent security team attacks the full stack under realistic conditions.