Method and system for signing output using a kernel

Abstract

In one embodiment, a computer-implemented method of digitally signing input by a data processing (DP) accelerator operation, and embedding the digitally signed input into an output, includes receiving, from a host device, a signature kernel specifying input to the signature kernel and executing the signature kernel to: extract a watermark from the input and obtain a hash for the watermark; generate output from the input; and embed the hash into the output. The DP accelerator provides the output to the host device. In an embodiment, the input includes an artificial intelligence (AI) model that is executed by the DP accelerator. The DP accelerator receives second input from the host, thereby producing an inference output from the AI model. The digitally signed watermark of the AI Model is embedded into the inference output and is provided to the host device.

Description

technical field [0001] Embodiments of the present disclosure relate generally to artificial intelligence model training and inference. More specifically, embodiments of the present disclosure relate to artificial intelligence model training and inference and associated security performed by data processing accelerators. Background technique [0002] Because artificial intelligence (AI) techniques have been deployed in various fields such as image classification or autonomous driving, AI models (also called "machine learning models") have recently been widely used. Similar to executable or binary images of software applications, AI models, when trained, can perform inference based on a set of attributes to classify features. Therefore, AI models can be "portable" and can be used without authorization. Currently, there is a lack of effective digital rights protection for AI models. In addition, there is a lack of evidence that the results produced by DP accelerator systems ...

AI Technical Summary

Problems solved by technology

Currently, there is a lack of effective digital rights protection for AI models

In addition, there is a lack of evidence that results produced by DP accelerator systems are protected by a "root of trust" system using AI model processing tasks entrusted to secondary processing systems such as data processing (DP) accelerators or remote systems

Images