Protection level-based mechanism for artificial intelligence models

Abstract

Aspects of the technology disclosed herein are related to a distributed architecture for securely training data sets and / or delivering AI models to client devices for local use. In examples, a request to distribute an AI model to a client device causes the capabilities of the client device to be evaluated. If the client device is configured to support a protection level specified by the license for the AI model, the AI model is provided to the client device. Additionally, a request to execute a delivered AI model causes the AI model to be translated into commands for execution by a hardware device in accordance with a protection level specified by the license for the AI model.

Description

PROTECTION LEVEL-BASED MECHANISM FOR ARTIFICIAL INTELLIGENCE MODELSBACKGROUND

[0001] Artificial intelligence (Al) and machine learning (ML) models (collectively referred to herein as Al models or models) are being rapidly developed and leveraged for cloud applications. Recently, there has also been a continued push to be able to able run such models on client devices. For instance, recurrent neural networks and even some large language models (LLMs) are being operated on client devices. The ability to run such models directly on a client device potentially reduces bandwidth and increased accessibility. However, such capabilities also raise security concerns for improper use or copying of the Al models.

[0002] It is with respect to these and other considerations that examples have been made. In addition, although relatively specific problems have been discussed, it should be understood that the examples should not be limited to solving the specific problems identified in the background.SUMMARY

[0003] The summary provided herein is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description section. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended as an aid in determining the scope of the claimed subject matter.

[0004] Aspects of the technology disclosed herein are related to a distributed architecture for securely delivering Al models and / or training data sets to client devices for local use. Model creators are able to provide encrypted versions of their models to a centralized server that in turn distributes copies of the encrypted models to a plurality of distribution servers. When a request for a particular model is received from a client device, the best-suited distribution server is identified to deliver the model. The best-suited distribution server may be the one with the lowest latency between it and the requesting client device. Such architecture allows for a highly performant distribution of models in a manner that can have low latency and high bandwidth even with large amounts of requests across the globe. The models stored within the servers may also be varied to serve the needs of many different types of client devices. For instance, the models may range in size, resolution, and / or other performance attributes that may be better suited for different client devices ranging from mobile devices to high-performance desktops or on-premises specialized devices. In some examples, the client device may provide only a certain set of protections for the model, thereby limiting which models are permitted to run on the client device.

[0005] The distributed architecture farther includes a licensing server that controls accessto and decryption of the models. The licensing server controls the distribution of licensing packages for the different models delivered by the distribution server. When a client device looks to locally execute a particular model received from the distribution server, the client device transmits a license request to the licensing server. The licensing request may include further device-level details about the client device itself, and such details may be generated in a secure, trusted manner, such as through a hardware root of trust (HROT) of the client device. The licensing server compares the details in the license request to security requirements of a license for the corresponding model. If the details in the license request satisfy the security requirements, a license package for the model is delivered to the client device. The license package includes a license for the model and a decryption key for the model. The license and / or license package may be digitally signed and / or include a MAC (or secure hash) to help avoid tampering.

[0006] The license for the model may also include additional performance and / or usage restrictions for the model that are to be enforced by the client device, such as by the HROT. The performance restrictions may include restrictions on the resolution of the model, the size of the input data for the model, and / or the rate of output of the model, among other restrictions. The usage restrictions may include a usage count, a usage time, a usage credit, and / or a concurrent-use limit, among others.

[0007] The security requirements of the license for the model may be set or customized by the model creators via the licensing server. Accordingly, custom security enforcements are provided that can be separated from the model distribution itself. The resultant system provides for high availability of both the model delivery and the license packages.

[0008] Aspects of the technology disclosed herein are further related to systems and methods for providing control of input, output, and processing of Al models. In examples, a request to execute an Al model implemented by a client device is received, where the Al model is associated with one or more licenses that specify a protection level that is applied to one or more portions of the Al model during the Al model runtime. In response to the request, the Al model is translated to a first set of commands in an intermediate language. The first set of commands is translated into a second set of commands for a hardware device of the client device. The second set of commands is translated into microcode that is executable by the hardware device. The hardware device then executes the microcode to generate an output in furtherance of the request.

[0009] Aspects of the technology disclosed herein are further related to systems and methods for providing a protection level-based mechanism for securing an Al model. In examples, a request to distribute an Al model to a client device is received. A license specifying at least one protection level for one or more portions of the Al model is identified at the licensing server. The hardware and / or software capabilities of the client device are evaluated to determine whether theclient device is configured to support the protection level specified by the license for the Al model. If the client device is configured to support the protection level, the Al model is retrieved from a distribution server and provided to the client device.

[0010] The details of one or more aspects are set forth in the accompanying drawings and description below. Other features and advantages will be apparent from a reading of the following detailed description and a review of the associated drawings. It is to be understood that the following detailed description is explanatory only and is not restrictive of the invention as claimed.BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate various aspects of the present invention. In the drawings:

[0012] FIGS. 1 A-1B depict an example system for implementing the distributed Al-model security architecture discussed herein.

[0013] FIG. 2A depicts another example system for implementing the distributed AI- model security architecture discussed herein.

[0014] FIG. 2B depicts another example system for implementing the distributed AI- model security architecture discussed herein.

[0015] FIG. 2C depicts another example system for implementing the distributed AI- model security architecture discussed herein.

[0016] FIG. 2D depicts another example system for implementing the distributed AI- model security architecture discussed herein.

[0017] FIG. 3 depicts an example communication diagram for implementing the distributed Al-model security architecture discussed herein.

[0018] FIG. 4 depicts an example computing environment for providing control of input, output, and processing of an Al model.

[0019] FIG. 5 depicts another example method for providing control of input, output, and processing of an Al model.

[0020] FIG. 6 depicts an example protection level scheme specified by a license for an Al model.

[0021] FIG. 7 depicts another example method for distributing an Al model to a client device in accordance with a license for the Al model.

[0022] FIG. 8 depicts another example method for distributing an Al model to a client device in accordance with multiple licenses for the Al model.

[0023] FIG. 9 is a block diagram illustrating example physical components of a computing device with which aspects of the technology may be practiced.DETAILED DESCRIPTION

[0024] The following detailed description refers to the accompanying drawings. Wherever possible, the same reference numbers are used in the drawing and the following description to refer to the same or similar elements. While aspects of the technology may be described, modifications, adaptations, and other implementations are possible. For example, substitutions, additions, or modifications may be made to the elements illustrated in the drawings, and the methods described herein may be modified by substituting, reordering, or adding stages to the disclosed methods. Accordingly, the following detailed description does not limit the technology, but instead, the proper scope of the technology is defined by the appended claims. Examples may take the form of a hardware implementation, or an entirely software implementation, or an implementation combining software and hardware aspects. The following detailed description is, therefore, not to be taken in a limiting sense.

[0025] As briefly discussed above, recent demand for operating Al models on client devices increases security exposure for misuse or theft of the Al models. For instance, once the Al models are on the client devices, the owner of the client device may be more easily able to access or copy the model data and / or reverse engineer the model architecture and / or weights. Such potential theft is also of growing concern as the Al models being generated are continuing to increase in value. The models are being developed using proprietary algorithms and trained using vast computing resources and training data. Curation of the training data sets themselves can require significant investments as well. As a result, the Al models, and even the training datasets, can be worth millions if not hundreds of millions of dollars.

[0026] The technology disclosed herein provides for a distributed architecture for securely delivering Al models to client devices and continuing to ensure protections for those Al models once present on the client devices. When a model creator generates or creates a new Al model, the model creator looks to distribute that model to the client devices. The model creator also requires that security be in place so that the generated model cannot be easily copied, modified, or otherwise reproduced. With the technology described herein, the model creator is able to set forth security requirements and restrictions for the ultimate client devices through a license package that is registered with a license server. When the security requirements and restrictions within the license package for the model are satisfied, a decryption key can be presented that allows for the model to be decrypted on the client device and used for local processing of input.

[0027] In an example, the model creator (e.g., entity that develops new Al models) generates an Al model and encrypts all or parts of the model. The encrypted model is then provided to a centralized server system that may aggregate multiple types of Al models from potentially multiple model creators. The model creator also sets forth the security requirements andrestrictions in a license package with a licensing server. The centralized server system may distribute the encrypted model to multiple distribution servers that are best located to the end-user or client devices (e.g., closest in a network topology, lowest latency, closest in geography). As such, multiple copies of the encrypted model exist across the multiple distribution servers. The distributed server may also aid in the raid or distributed updating or servicing of models.

[0028] When a client device desires to acquire a copy of the model, the client device is able to request the download from the most appropriate or best-suited distribution server, which may be the distribution server that is located within the closest distance to the client device (e.g., lowest latency, closest geographical distance) and / or the distribution server with the largest amount of available bandwidth to process the request. By having multiple distribution servers, bottlenecks are avoided for downloads from a single central location. Such bottlenecks are particularly important with the distribution of Al models due to the large size of the Al models, which can be in excess of tens of gigabytes. The only remaining potentially bottleneck occurs with the licensing server (or server forest), but these requests for licenses and the licensing packages that are subsequently delivered are substantially smaller and can be delivered more seamlessly at high volumes.

[0029] The technology disclosed herein also provides systems and methods for providing control of input, output, and processing of an Al model. In examples, a request to execute an Al model implemented by a client device is received, where the Al model is associated with one or more licenses that specify a protection level that is applied to one or more portions of the Al model during the Al model runtime. In response to the request, the Al model is translated to a first set of commands in an intermediate language. The first set of commands is translated into a second set of commands for a hardware device of the client device. The second set of commands is translated into microcode that is executable by the hardware device. The hardware device then executes the microcode to generate an output in furtherance of the request.

[0030] The technology disclosed herein further provides systems and methods for providing a protection level-based mechanism for securing an Al model. In examples, a request to distribute an Al model to a client device is received. A license specifying at least one protection level for one or more portions of the Al model is identified at a licensing server. The hardware and / or software capabilities of the client device are evaluated to determine whether the client device is configured to support the protection level for the Al model. If the client device is configured to support the protection level, the Al model is retrieved from an Al model distribution server and provided to the client device. If the client device is not configured to support the protection level, an action may be performed to configure the client to support the protection level, or a different Al model may be retrieved and provided to the client device.

[0031] FIGS. 1A-1B depict an example system 100 for implementing the distributed AI- model security architecture discussed herein. System 100 is discussed first with reference to FIG. 1 A and then a particular example of an Al model transfer is discussed with reference to FIG. IB.

[0032] The system 100 includes a plurality of client devices 102, which are depicted as discrete client devices 102A-H. The client devices 102 ultimately receive and execute the models discussed herein. The client devices 102 may vary from many different types of devices, such as personal computers, laptops, tablets, smartphones, smart devices, gaming consoles, and even onpremises servers, among others.

[0033] The system 100 further includes a centralized server system 108 (referred to also as central server 108) and a plurality of distributed servers 110, which are shown as a first distributed server 110A and a second distributed server HOB. The system 100 also includes a licensing server 112 and an account server 114. A model creation server 104, belonging to a model creator, and a training set server 106, belonging to a training set curator, may also be included in the system 100. The central server 108 may serve as a central point to distribute the models and / or training sets to the distributed servers 110. The distributed servers 110 maybe distributed in varied geographical locations, such as different cities, states, regions, countries, etc. For instance, the first distributed server 112 may be located in Colorado and the second distributed server HOB may be located in Washington. The geographical differences in the distribution servers 110 allow for some of the distribution servers 110 to be closer to subsets of client devices than other distribution servers.

[0034] When a new Al model is created by a model creator, the Al model is initially stored in the model creation server 104. The model creator then encrypts the Al model to form an encrypted model. The model creator also has access to the decryption key for decrypting the model. The decryption key may be the same as the encryption key in some examples. In other examples, the encryption key is different from the decryption key.

[0035] The encrypted model may also be compressed. The models tend to be very large in size (e.g., 1 GB or orders larger). As a result, reducing the storage and transmission size of the model is desirable. Accordingly, the model may be compressed on the model creation server 104 (and / or any other servers discussed herein that store the model).

[0036] The types of models that are created may be any type of ML / AI model, such as language models (LMs) and / or neural networks (NNs). For instance, large LMs (LLMs) and / or small LMs (SLMs) may be distributed and implemented with the technology discussed herein. Convolutional NNs (CNNs) and / or recurrent NNs (RNNs) may also be distributed and implemented. RNNs are often used for video and audio processing such as SuperResolution, camera noise reduction and processing, and / or audio microphone data enhancements (e.g.background noise removal such as music, dog barking, avatars). CNNs are often used for image processing and object detection.

[0037] The model itself may have multiple components that are encrypted differently in some examples. In an example, the model includes a network layer topology (e.g., the model code) and a model data (e.g., the model weights). These elements may be encrypted with different keys and decrypted with different keys. Accordingly, access to different parts of the model is individually controlled. This allows for additional protections of the model while the model is being stored on the various servers discussed herein. In addition, different licenses, with differing security requirements, may be associated with the different model components. This allows for further refinement of control of the model usage and distribution. In addition, different portions of differently trained models (of the same type) may be combined. For instance, the model code of one model may be combined with the model weights of another model. Thus, separate security for the different components is beneficial to prevent unauthorized combinations.

[0038] The model package may also be stored and transmitted in various different forms. One example format is container, such as an Open Neural Network Exchange (ONNX) format. The ONNX model-container format allows for the model to be shared and implemented between different Al platforms and tools (e.g. DirectML, PyTorch, etc.). The ONNX data is comprised of assets (model data, weights) and the model structure (operators and fimctional ‘code’, topology). Each portion of the package may require different levels of protection due to the value of the component. In examples, the model package (e.g., ONNX container) is encrypted and / or the components within the package or container may be encrypted.

[0039] The encrypted model is then transmitted from the model creation server 104. In one example, the model creation server 104 transmits the encrypted model to the centralized server system 108. The centralized server system 108 then distributes copies of the encrypted model to the distributed servers 110. Accordingly, in the example depicted, the centralized server system 108 distributes the encrypted model to the first distributed server 110A and the second distributed server HOB.

[0040] In other examples, the model creation server 104 transmits the encrypted model directly to the client devices 102. For instance, the client devices 102 download or sideload the model more directly from the model creators. In some examples, the encrypted model is preinstalled on the client devices 102 prior to the client devices being sold. For instance, the model creation server 104 may work with the device manufacturers to include the encrypted model as part of the firmware and / or software of the client devices 102 as delivered to end users.

[0041] While only a single model, and a single model creator, have been discussed for simplicity, the system 100 handles many models of various different types from potentially manydifferent model creators. The different models may be appropriate for different uses and / or for different types of devices. For example, the different models may be of different sizes that are more appropriate for mobile use cases versus desktop use cases. The models also have varying accuracy, with higher accuracy generally resulting in larger sizes. The different models may also have different security requirements (e.g., some models may need to be more secure than others). The different models may also have different performance attributes (e.g., mobile use cases may need results faster). Other differences between the models are also possible.

[0042] In addition to transmitting the encrypted model, the model creator also generates the security requirements for the encrypted model. The security requirements for the encrypted model are transmitted to the licensing server 112, where the security requirements are stored as part of a license package for the particular model. In addition to providing the security requirements to the licensing server 112, the decryption key for the model is also provided to the licensing server 112.

[0043] The security requirements that are incorporated into the license include devicelevel requirements, which may include hardware-level requirements and / or software-level requirements. For instance, a model creator may require that particular hardware security features be available on the requesting client device 102. In examples, some client devices 102 have outdated or less capable hardware, whereas other client devices have higher-end security hardware (e.g., secure memory protection hardware). Ensuring the security features are available on the particular client device 102 prior to decryption helps prevent against various different kinds of attack vectors, ranging from AI / ML-specific attacks to classical memory-scraping attacks. The security requirements may be based on particular hardware protections, central processing unit (CPU) protections, and / or output protections available on the client device 102. In examples, the security requirements also have multiple tiers or levels that correspond to the resolution at which the model is allowed to operate, with higher capabilities corresponding to potentially higher resolutions.

[0044] The security requirements and the license details can define who can use the model (e.g., user-level or account-level restrictions), what can use the model (e.g., device-level restrictions), how the model can be used (e.g., performance or usage restrictions), and / or when the model can be used (e.g., expiration periods, count limits). When a request for a license is received, details about the device are also presented so that the licensing server 112 can verify that the client device 102 meets the security requirements of the particular license.

[0045] The device-level restrictions may include restrictions on hardware or device identifiers and / or hardware manufacturers (e.g., Microsoft, Hewlett Packard, Dell). In some examples, a hardware root of trust (HROT) of the device is identified with a unique identifier bythe manufacturer. These identifiers may be known by the model and / or training set creators and included within the license as a restriction, or effectively a permission list. For instance, a list of device or HROT identifiers may be included within the license as being approved to use the model (e.g., permit list). In other examples, a list of a list of device or HROT identifiers may be included within the license as being blocked to use the model (e.g., block list). In some examples, the permit or block lists may be based on device manufacturers. For instance, a model may be approved for use for all Microsoft or Dell devices.

[0046] In addition, the license may include restrictions on which organizations may use the model. For instance, the HROT may also include additional data (e.g., metadata) about organization to which the device belongs. As an example, once the client device is on premise of the organization, the organization may load organization-identifying metadata into the HROT. This organization-identifying information may then be used as a security restriction to approve devices belonging to a particular organization.

[0047] The license may also include security restrictions based on the specific hardware and / or software installed on the client device. For instance, the HROT may also include a listing of the hardware and / or software that is installed on the client device. For hardware devices, this may include NPUs, CPUs, GPUs, and memory hardware, among other hardware used in client devices. The particular memory protections, CPU protections, and hardware protections that accelerators provide may also be included as security restrictions (and provided by the HROT) The security restrictions in the license may approve use of the model for only client devices including certain sets of hardware and / or minimum hardware requirements. In other examples, the security restrictions in the license restrict usage of the model of devices with certain types of hardware. For example, a model creator may not allow a model to run on devices with a certain type of NPU and / or memory type.

[0048] The HROT may also include software capabilities of the particular client device, which may be used as security requirements in the license. For instance, certain devices may be provisioned with additional capabilities, such as the ability to process and / or decode certain types of data. As one example, some devices may have the capability to decode H.264 video streams, whereas others do not. Such capabilities may be based on purchases and / or other software licenses of the client device. For instance, a device manufacturer may produce a device with hardware that is capable of processing many different codecs, but not all of them are enabled when the device is originally manufactured. When a license to a particular codec is acquired by the client device, a software switch can be enabled to activate the decoder capabilities for the particular codec. The data identifying such enabled capabilities may be stored and / or accessed by the HROT and used as security requirements within the license for the model. Similar to the other securityrequirements, these capabilities may be used to grant or deny a license for the model (e.g., permit list or block list of capabilities). For instance, the license can require a check as to a hardware / software capability before the license is granted. Other hardware / software capabilities may include features such as decoding LLM models, a large amount of available memory, and / or support of certain ML operators and / or extensions, among others. By receiving this type of hardware and / or software data from the HROT, the data comes in a trusted, cryptographically hardened manner.

[0049] The license may also define performance limits that restrict the inputs and / or outputs of the model as well as the resolution of the model. For instance, tokens per second output rate may be limited or defined within the license. The input context window size may also be limited or defined within the license. The performance limits may also be tied to the device-level data (e.g., hardware and / or software of the client device). For instance, a first set of client devices have a first hardware configuration and may be granted higher performance limits, and a second set of client devices have a second hardware configuration and may be granted lower performance limits. Despite the different performance limits, both the first set and the second set of client devices are allowed to use the model.

[0050] As another example, the amount of usage of the model may be specified. For instance, a usage count may be specified in the license. The usage count limits the number of times that a model is executed. The license may also specify a usage time. For instance, a time period may be specified for how long the model is valid for (e.g., an expiration time). The license may also specify a credit amount. For instance, the credit amount may include a data processing quantity. The usage restrictions may also include a limit on concurrent uses of the model. For instance, the license may specify a maximum number of actively running models on the client device.

[0051] The license may also include restrictions related to the models and / or training data sets that can be combined and / or used together. For instance, a license for a training set may specify a list of models for which the training set may be used. This may be in addition to the types of restrictions set forth above. A license for model may similarly restrict the types of training sets with which the model may be used or modified. As such, models and the training sets with which they are used may be separately licensed (and encrypted) and control of the combination is also provided.

[0052] Similarly, because the model code and the model weights may be separately encrypted and associated with different decryption keys, they may also be separately licensed. In such examples, the license requirements for both the model-code license and the model-weights license must be met before the combination of the two may be implemented. Thus, the localcombining of different model code and model weights may be controlled via the licensing architecture discussed herein.

[0053] The license for the model may also restrict changes or generation of derivates of the models. For instance, license may prevent a client device from modifying the model in any way or generating a derivative model from the locally running model.

[0054] Some of the security requirements, such as the static requirements relating to hardware and / or software present on the device, may be enforced or verified by the licensing server. Other security requirements, such as performance and / or usage restrictions, are enforced on the client device 102 itself, such as by an HROT of the client device 102.

[0055] Once the licensing server 112 has received the security restrictions or requirements and the decryption key(s) for model, the licensing server 112 then creates a licensing package for the model. The licensing package includes at least: (1) a license that defines the security requirements provided by the model creator; and (2) the decryption key(s) for the model. In some examples, the license and / or the licensing package is encrypted. The licensing package may be associated with the model via a unique identifier (UID) for the particular model. For instance, the model may have a UID and the license package may be associated with the model via the same UID such that the licensing server 112 may identify the correct license package when a request for a license for a particular model is received. The licensing package is stored for later delivery and fulfillment of license requests.

[0056] The model creator and / or the operator of the centralized server system 108 may also have account-level and / or user-level requirements for use of the model. For instance, the security requirements defined in the license may be specific to software and / or hardware requirements of the client devices 102 (e.g., device-level security requirements discussed above). The model creator and / or the operator of the centralized server system 108 may also desire to restrict usage of the models to a specific users and / or organizations. As an example, the model creator and / or the operator of the centralized server system 108 require a fee to paid to use the model and only those users or organizations with the fees paid are allowed to access the model.

[0057] These user-level requirements are transmitted to the account server 114 that manages authentication of the particular users of the client devices 102. For instance, when a request to the licensing server 112 is received a request may also be received at the account server 114 to authenticate the user of the particular client device 102. If the account server 114 is able to authenticate the user, the account server 114 provides an authentication message to the licensing server 112 indicating the identity of the user and / or whether the user is authorized to have a license to the model.

[0058] When the licensing server 112 is able to: (1) verify the hardware and / or softwarerequirements of the license based on data received from the requesting client device 102, and (2), in some examples, receive the authentication approval from the account server 114, the licensing server 112 transmits the licensing package for the model to the requesting client device 102. The client device 102 then also performs local security verifications and operations before extracting the decryption key from the license package, as discussed further herein.

[0059] Similar system operations may also be available for specialized training-set creators. For example, as discussed above, training set curation is also a particularly expensive process and security requirements are also required for developed training sets that may be used with the models discussed herein.

[0060] Similar to the models, the training-set creator generate an encrypted training set on the training set server 106. The encrypted training set is then transmitted, such as to the centralized server system 108 and / or more directly to the client devices 102 (e.g., sideloaded, downloaded, preloaded). In examples where the training set is transmitted to the centralized server system 108, the centralized server system 108 also transmits the encrypted training set to the distributed servers 110. The distributed servers 110 then provide the encrypted training set to the client devices 102 (e.g., upon request for the training set from the client devices 102).

[0061] The training-set creator then also sets defines the device-level security requirements for the training set with the licensing server 112. The decryption key for the training set is also transmitted from the training set server 106 to the licensing server 112. The licensing server 112 creates a licensing packaging with a license defining the security requirements for the training set and the decryption key for the training set. The training-set creator may also define the user-level security requirements with the account server 114.

[0062] Then, when a request for a license to the training set is received by the licensing server 112, the licensing server 112 processes the request similarly to the request for a license to a model as discussed above. For instance, once the licensing server 112 is able to verify the security requirements for the training set, the licensing package for the training set is delivered to the requesting client device 102. The client device 102 then performs additional security checks prior to extracting the decryption key from the licensing package.

[0063] In general, many of the examples discussed herein are primarily directed to the secure distribution and access of the models rather than the training data sets. However, it should be understood that the concepts discussed herein regarding models generally also apply to distribution and access control of training data sets.

[0064] For additional clarity, FIG. IB depicts a subset of the system 100 shown in FIG. 1 A. A particular example will now be discussed with respect to the components shown in FIG. IB.

[0065] In this example, the first client device 102 A is associated with a particular user 101. The user desires to utilize a specific model created by a model creator that operates model creation server 104. The user also desires to use the specific model with a specific training set curated by an operator of the training set server 106.

[0066] To identify the model and the training set, a request is first sent to the licensing server 112 from the first client device 102 A. This request may be for the specific model and / or training set and / or for a list of available models and / or training sets. As an example, the request includes the hardware and / or software details of the first client device 102 A (and potentially the identity of the user 101) to the licensing server 112. The licensing server 112 then provides a listing of the available models and / or training sets for which the user 101 and / or the first client device 102 A are allowed to download based on the security requirements. In other examples, the request is merely a request for models and / or training sets without identifying information about the first client device 102 A and / or the user 101. In such examples, the licensing server 112 provides a list of all the available models and / or training sets that are available to be delivered from the distributed servers 110 (e.g., models and / or training sets that have been received by the centralized server system 108).

[0067] When a selection of the particular model and / or training set is received, a best- suited distributed server 110 is selected based on the first client device 102 A. For instance, a distance between the first client device 102 A and all the distributed servers 110 may be compared to identify one of the distributed servers 110 that is located most closely to the first client device 102 A. The distance may be a physical distance and / or a network architecture distance. The distance may in some examples be based on different distance metrics, such as latency between the client devices and distributed servers, network transmission cost, etc. For instance, based on a routing map or pings between the first client device 102 A and the distributed servers 110, a particular one of the distributed servers 110 is selected that is closest (e.g., lowest latency) to the distributed servers 110. In the example depicted, the closest of the distributed servers 110 is the first distribution server 110A.

[0068] A new request for the model and / or training set is then be generated from the first client device 102 A and sent to the first distribution server 110 A. For instance, the licensing server 112 may provide the Internet Protocol (IP) address or other identifier of the first distribution server 110A to the first client device 102 A along with a UID for the model and / or training set. The first client device 102 A generates a request with the UID and sends the request to the first distribution server 110A. In other examples, the licensing server 112 sends a request to the first distribution server 110A with the address of the first client device 102 A and a UID of the model and / or training set to cause the first distribution server 110A to transmit the model and / or training set to the firstclient device 102A. In either example, the requested model and / or training set is delivered to the first client device 102 A from the first distribution server 110A.

[0069] In some examples, the request for the model and / or training set also causes a request for the licensing package for the model and / or training set to be generated from the first client device 102 A and provided to the licensing server 112. In other examples, an interrogation of the model and / or training data set first occurs on the first client device 102 A before a request for the licensing package is generated.

[0070] The request for the licensing package may include hardware and / or software information (e.g., device-level details) about the first client device 102 A. This device data may be used for attestation and verification. For example, hardware / soflware certificates, and / or other evidence, may be delivered as part of the device data. The licensing server 112 then verifies that the device data meets the security requirements set forth in the corresponding license(s).

[0071] In the current example, user-level security requirements are also required for the model and / or training set. User-identity data is provided to the account server 114. The user identity data may include a username and password as well as other verification data in some examples (e.g., dual-factor). The account server 114 and authenticates the user 101. The authentication verification is provided to the licensing server 112.

[0072] Upon verifying that the device data meets the security requirements and receives the authentication verification, the licensing server 112 provides the license package(s) for the model and / or training set to the first client device 102 A. The first client device 102 A then processes the license package to extract the decryption key and decrypt the model and / or training set, as discussed further herein.

[0073] FIG. 2A depicts another example system 200 for implementing the distributed AI- model security architecture discussed herein. The system 200 includes the licensing server 112 and another computing environment 202. The computing environment 202, and / or a portion thereof, may be a client device 102. The computing environment 202 has received the model and / or training set. The computing environment includes an application process 204 and a protected Al (PAI) container 206. The application process 204 includes an application 208 and a PAI client 210. The application process 204 may also be considered a container in some examples. The PAI container 206 includes a PAI server 212.

[0074] The application process 204 and the PAI container 206 may operate on the same physical device. For instance, the PAI container 206 may be a separate, secure process from the application process 204. The PAI container 206 may also be implemented as an enclave, a virtual machine, an isolated hardware protection environment, and / or a hardware trust zone on the same device as the application process 204. For instance, the PAI container may include or be a trustedexecution environment (TEE). In other examples, the PAI container 206 may be implemented as a separate device from the application process 204.

[0075] The PAI server 212 performs the operations on the model and / or training set. For instance, the PAI server 212 performs the decryption operations, validation operations, and inference (e.g., input data processing) operations. In some instances, the PAI server 212 is implemented in C++, but other formats and languages are also possible.

[0076] The PAI client 210 may operate as an interface and / or library that hides the complexity of security solution of the PAI container 206 and PAI server 212 from the application 208. The application 208 interacts with the PAI container 206 using function calls, which may be simpler function calls than required to directly communicate with the model and / or PAI server 212. The PAI client 210 may then perform the operations to communicate with the PAI server 212 and retrieve the results generated from the model. In some examples, the PAI client 210 may be part of, or include, an application programming interface (API).

[0077] A hardware root of trust (HROT) 220 exists within the PAI server 212. The HROT 220 is trusted by the licensing server 112 and can provide security data to the licensing server 112 (via the PAI client 210 and the PAI server 212). The HROT 220 is also trusted to enforce of the security requirements of the license for the model. For instance, the HROT 220 has access to the corresponding hardware components, such as the memory, the neural processing unit (NPU), the graphics processing unit (GPU), and other types of hardware that may be used by the model. The HROT 220 may also configure the memory protections (e.g., encryption to DRAM, protection of SRAM memory access) for the device to comply with the security requirements.

[0078] Hardware-based security restrictions that are enforced by the HROT 220 provide for additional security for model usage. For instance, solely tying the model security to a user account is likely not a feasible solution because the user account is an abstraction controlled by the host operating system. The hardware itself cannot be as easily changed or manipulated.

[0079] The HROT 220 may be responsible for local enforcement of the security requirements in the license, and / or a subset thereof, such as the security restrictions and / or requirements discussed above. For instance, the HROT 220 is best positioned to ensure that the usage and performance restrictions set forth in the license are enforced.

[0080] As some examples, the security requirements in the license that are enforced by the HROT 220 include permissions for particular hardware features (e.g. a video or audio codec has been ‘purchased’ / enabled on the machine). The amount of usage of the model can also be specified in the license and enforced by the HROT 220. For instance, a usage count may be specified in the license. The usage count limits the number of times that a model is executed (e.g., how many times a model may be used to process inputs). The HROT 220 monitors the number of times themodel is executed and revokes functionality of the model once the count limit is reached. The license may also specify a usage time. For instance, a time period may be specified for how long the model is valid for (e.g., an expiration time). The HROT uses a secure clock of the PAI container 206 to monitor the time and revoke function of the model at expiration of the time period. The license may also specify a credit amount. For instance, the credit amount may include a data processing quantity. The HROT 220 monitors the processing resources consumed by the model operations (e.g., by monitoring the secure NPU / GPU processes) and revokes functionality of the model once the credit amount is reached.

[0081] The HROT 220 continues to monitor and enforce the security requirements of the license even after the initial verification. When the HROT 220 notices a condition that violates the security requirements of the license, the HROT 220 effectively revokes the local license by preventing fimctionality of the model from occurring. For instance, the HROT 220 can cause one or more hardware components to go into a blocked state with respect to data relating to the model. The prevention of the functionality may be related to the model directly or through control of the hardware to prevent the model from ultimately producing usefiil output. For instance, upon identifying a violation of the security requirements, the HROT 220 may remove decryption keys from the PAI client 210 so that the client can no longer decrypt data from the PAI server 212. The HROT 220 can also block memory access, resulting in black or null data when requests to such memory are issued.

[0082] Then, the next time communication is established between the PAI server 212 and the licensing server 112 (via the application 208 and PAI client 210), the PAI server 212 notifies the licensing server 112 that the security requirements are no longer met by the particular client. For instance, at different intervals, the licensing server 112 may be in communication with the PAI server 212 as check-in points to ensure continued compliance.

[0083] The application 208 may interact with the PAI server 212 via a web application programming interface (API). In some examples, the license may hold the decryption key for the model in a manner that is encrypted with the device certificate of the PAI server 212. The licensing server 112 may use its own certification to sign the license response that is provided to the application 208.

[0084] System 200 may also include a shared software development kit (SDK). The SDK includes the business logic, cryptographic operations, license generation, and validation data. The SDK may be used by both the PAI server 212 and the licensing server 112.

[0085] FIG. 2B depicts another example of system 200 for implementing the distributed Al-model security architecture discussed herein. The system 200 in FIG. 2B differs from the system 200 in FIG. 2A in that two applications are executing in the application process 204.

[0086] The application process 204 includes a first application 208 and a second application 209. After the model is securely installed in the PAI container 206, both the first application 208 and the second application 209 may interact with the model by sending commands to the PAI client 210. The PAI client 210 then communicates with the PAI server 212 on behalf of the applications 208-209. In this manner, the PAI server 212 and the model may remain secure while providing a single access point (e.g., the PAI client 210) for interaction with the secure model.

[0087] FIG. 2C depicts another example of system 200 for implementing the distributed Al-model security architecture discussed herein. The system 200 in FIG. 2C differs from the system 200 in FIG. 2 A in that two models are in use in the computing environment 202.

[0088] In FIG. 2C, two different models have been installed in the computing environment202. In some examples, the models could be implemented and operated by either the same PAI server and / or in the same PAI container. However, such implementation within the same secure environment may provide a possibility for an attack vector between the models themselves within the same environment. To avoid this potential attack vector or surface, the models are instead operated in two secure environments that are separated from one another. While more secure, the inclusion of additional servers or secure containers increases cost and overhead.

[0089] More specifically, in the example depicted, a first PAI container 206 includes a first PAI server 212. The first PAI server 212 operates a first model. The application 208 interacts with the first model via the first PAI client 210, which communicates with the first PAI server 212.

[0090] A second PAI container 207 includes a second PAI server 213. The second PAI server 213 operates a second model. The application 208 interacts with the second model via the second PAI client 211, which communicates with the second PAI server 213.

[0091] In other examples, the first PAI server 212 and the second PAI server 213 may be operating two instances of the same model. This allows for the same model to be used concurrently for securely and separately processing of different input data.

[0092] FIG. 2D another example of system 200 for implementing the distributed Al-model security architecture discussed herein. Unlike the example depicted in FIG. 2A, the example depicted in FIG. 2D is a lower-security, but less resource-intensive implementation. For instance, a license server is no longer implemented, and a PAI container 206 is also no longer implemented.

[0093] In this example, rather than retrieving the decryption key for the model as part of a license package from a license server, the decryption key is received as part of the model package when the model package is downloaded or otherwise installed in the device. The model package may also define security requirements that are to be met before the decryption key can be used. Inthis situation, trust is put into the client device (e.g., computing environment 202) to perform the security verifications. In some examples, the client device is able to derive the decryption key from the model package based on a secret seed and key ID value. The seed may be randomly pregenerated and stored within the application 208, the PAI client 210, and / or the PAI server 212. The decryption key may also be generated based on values read from the model (so the seed cannot be read directly from the binary). The seed and key ID are then provided as input to a key derivation fimction that generates the content key.

[0094] In this example, the PAI server 212 also runs within the application process 204 rather than a separate, protected application process 204. In other examples, however, the PAI server 212 may run in a separate application process 204.

[0095] FIG. 3 depicts an example communication diagram 300 for implementing the distributed Al-model security architecture discussed herein. The communication diagram depicts communications between the application 208, the PAI client 210, the PAI server 212, and the licensing server 112, respectively. While the communications are generally described as messages below, the communications may also be considered instructions for the receiving component.

[0096] An initialize message 302 is first sent from the application 208 to the PAI client 210. A create process message 304 is then sent from the PAI client 210 to the PAI server 212. The create process message 304 causes the PAI server 212 to be created and / or the secure processes and containers associated with the PAI server 212. An acknowledgement message 308 may then be sent from the PAI client 210 to the application 208 indicating that the protected process has been created.

[0097] The application 208 then sends a set model message 310 to the PAI client 210 that may include the downloaded encrypted model package (e.g., an ONNX package including the model components). In other examples, the set model message 310 includes an indication of where the encrypted model is stored on the device (as the model has already been downloaded to the device). The PAI server 212 then ultimately causes the model to be stored in the secure memory rather than unsecure memory when the model is initially downloaded. The set model message 312 is then provided to the PAI server 212 from the PAI client 210. The PAI server 212 stores the encrypted model package in the secure memory that the PAI server 212 has access. An acknowledgment message 316 may then be generated and provided to the application to indicate that the encrypted model has been stored.

[0098] The application 208 then generates a request message 320 for a license request. This “request-for-a-request” message may be referred to herein as a GLR message 320. The GLR message 320 is then passed from the PAI client 210 to the PAI server 212 as GLR message 321. The PAI client 210 may also modify or augment the GLR message 321 for the PAI server 212.

[0099] In response to the GLR message 321, the PAI server 212 interrogates the stored model package to extract data about the model or from the model include in the license request. In some examples, the PAI server 212 also aggregates security data about the software and / or hardware of the computing environment 202, the application process 204, and / or the PAI container 206. For instance, the HROT 220 may examine the model to determine what the model requires and includes the attestation details that are likely needed by the license and / or by the licensing server 112 to approve the license request and deliver the license. As discussed above, the HROT 220 includes access to data or metadata about the hardware and / or software capabilities and / or configurations of the client device. These hardware and / or software capabilities and / or configurations of the client device (e.g., device-level data) are incorporated into the license request that is generated and passed from the PAI server 212. By generating this type of hardware and / or software data from the HROT 220, rather than from an untrusted application 208, the data is provided to the licensing server 112 in a trusted, cryptographically hardened manner. Thus, the licensing server 112 is able to make a higher-trust evaluation of the data when determining whether to grant the license for the model.

[0100] The license request that generated from the PAI server 212 may also be encrypted such that the PAI client 210 and / or the application 208 cannot read the license request itself. In some examples, the license request is partially encrypted and / or securely hashed to prevent tampering. The licensing server 112, however, includes a decryption key for the license request and can decrypt the license request upon receipt.

[0101] The license request message 322 including the data about the model (or extracted from the model) and the device-level security data (where available) is then transmitted from the PAI server 212 to the PAI client 210. The PAI client 210 sends a license request message 323 (containing substantially the same information) to the application 208.

[0102] Once the application 208 has received the license request message 323, the application 208 generates and sends a license request message 326 to the licensing server 112. The license request message 326 includes at least a portion of the data included in the license request message 323. For instance, the license request message 326 includes an identifier for model for which a license is requested. The license request message 326 may also include the device-level security data from the PAI server 212.

[0103] The license request message 326 is processed by the licensing server 112, as discussed further herein. If the licensing server 112 approves the license request, a license package 328 is transmitted from the licensing server 112 to the application 208.

[0104] The application 208 generates a process -license-package message 330 and transmits the message to the PAI client 210. The process-license-package message 330 includesthe license package for the model. The PAI client 210 processes the process -license-package message 330 and transmits its own process-license-package message 332 to the PAI server 212.

[0105] When the PAI server 212 receives the process -license-package message 331, the PAI server 212 then performs operations to process the received license package. The example operations include a validate-license operation 333, an extract-content-key operation 334, and a decrypt-model operation 335.

[0106] In some examples, the validate-license operation 333 includes locally validating the security requirements set forth in the license. The validate-license operation 333 operation may also first determine that the license package received is valid, such as checking that the license package came from an approved license server and / or is associated with an approved device identifier (e.g., media access control (MAC) address).

[0107] Once the license requirements are validated, the extract-content-key operation 334 is performed to extract the decryption key from the license package. The extracted decryption key is then used to decrypt the encrypted model at the decrypt-model operation 335. The decrypted model is then stored within the secure memory to which the PAI server 212 has access. The decrypted model may then be used to locally process and analyze new input data. In examples where the model is in an ONNX model package, the model package is compiled / translated into DirectML to be executed by the GPU and / or NPU. An independent hardware vendor (IHV) driver may then translate the DirectML commands into microcode blocks with are submitted to the IHV kernel driver for execution.

[0108] Once the model is decrypted, installed, and ready for use, an acknowledgement message 336 is sent from the PAI server 212 to the PAI client 210 indicating that the model is ready for use. The acknowledgement is then passed to the application 208 as acknowledgement message 338. Based on the acknowledge message, the application 208 is aware that input data can now be provided as input for the model.

[0109] The application 208 then sends, to the PAI client 210, input data 340 for the model to process. The PAI client 210 may adjust or package the input data in some examples. For instance, in some cases the input data is translated into commands for the specific model, which may include translating into DirectML commands or similar command types. In other examples, the input data is not modified. The PAI client 210 then transmits the input data 342 to the PAI server 212. The model then processes the input data while executing in the secure PAI container 206.

[0110] The output data 344 that is generated from the model is transmitted from the PAI server 212 to the PAI client 210. The PAI client 210 may adjust and / or package the output data. In other examples, the PAI client 210 does not adjust or modify the output data. The output data346 is then transmitted to the application process 204.CONTROL OF INPUT, OUTPUT AND PROCESSING OF Al MODELS

[0111] FIG. 4 depicts an example computing environment 400 for providing control of input, output, and processing of an Al model. In examples, it is contemplated that computing environment 400 comprises similar (or the same) components and provides similar (or the same) functionality as computing environment 202 discussed above. However, computing environment 400 is not limited to such examples.

[0112] In at least some examples, computing environment 400 receives a request to instantiate or execute an Al model in computing environment 400. The request includes user input data comprising a query, a statement, and / or other instructions related to the performance of one or more tasks. In some examples, the user input data is provided by an application (e.g., application 208) implemented by or accessible to computing environment 400. In response to receiving the user input data and / or determining that the user input data will invoke the Al model, the application may provide the user input data to a model processing component of computing environment 400 (e.g., PAI container 206). The model processing component provides a secure computing environment for compiling or assembling the Al model and executing the compiled or assembled Al model.

[0113] In FIG. 4, computing environment 400 comprises data package 410, software layer420, user mode driver (UMD) 430, operating system (OS) hardware scheduler 440, and kernel mode driver (KMD) 450. Although computing environment 400 is depicted as comprising a particular combination of hardware and software components, the scale and structure of hardware and software components described herein may vary and may include additional or fewer components than those described in FIG 4.

[0114] Data package 410 is a collection of files relating to various portions of an Al model.Data package 410 may be provided in a file type that can be executed on multiple computing platforms and computing devices. In some examples, data package 410 is provided to computing environment 400 (e.g., by distributed servers 110) in an executable format (e.g., pre-compiled or pre-assembled). In other examples, data package 410 is provided to computing environment 400 to be compiled (or assembled) and executed by computing environment 400. For instance, data package 410 may comprise at least model data and model structure information for the Al model. The model data includes, for example, model weights, which are numerical values representing learnable parameters that convey the importance of particular user input data features in predicting a final output. The model structure information includes, for example, software code, operators, and topology. The software code refers to instructions for compiling, assembling, and / or executing the Al model. The operators are characters that represent a specific mathematical or logical actionor process that can be performed on data elements, such as variables. Examples of operators include activation operators, element-wise operators, convolution operators, reduction operators, pooling operators, and neural network operators. The topology refers to the structure of the layer architecture that is used to process and transform user input data provided to the Al model. For instance, the topology may provide a mapping between user input data provided to a first layer and outputs of the first data that are provided as input to a second layer.

[0115] In examples, the model data and the model structure information (or potions thereof) may each be encrypted using a different security mechanism (e.g., a security key or a digital certificate). For instance, a license for the Al model may store a security key that is used to encrypt the model data of the Al model and store a different security key that is used to encrypt the model structure information of the Al model. Additionally or alternatively, user input data and user output data may also be encrypted using a different security mechanism. For instance, the license for the Al model may store a security key that is used to encrypt user input data provided to the Al model and store a different security key that is used to encrypt user output data that is provided in response to the user input data. In one example, source code (e.g., software code that is not compiled or translated) and compiled or translated software code may also be encrypted using a different security mechanism. For instance, the license for the Al model may store a security key that is used to encrypt source code of the Al model (or the license may not store a security key that is used to encrypt the source code) and store a different security key that is used to encrypt compiled or translated software code.

[0116] Data package 410 is translated to a first set of commands in an intermediate language that is executable by software layer 220. In examples, the first set of commands represents the model data and the model structure information associated with a compiled or assembled version of the Al model. Translating data package 410 to the first set of commands obfiiscates the original content of data package 410 and assists in preventing the original content of data package 410 from being accessed by unauthorized parties. Data package 410 is translated into the first set of commands using a data package runtime environment of computing environment 400. In examples, the data package runtime environment is a computing environment that optimizes and accelerates machine learning (ML) inferencing and enables cross -platform deployment of Al models. The data package runtime environment may be code signed to provide additional security for the first set of commands. Code signing is the process of digitally signing software (e.g., executables and scripts) to confirm the software author (e.g., the developer) or distributor and guarantee that the software has not been modified after being code signed. In some examples, as part of translating data package 410 into the first set of commands, the data package runtime environment associates execution sequencing enforcement data with the first set ofcommands. For instance, the data package runtime environment may assign a sequence number or identifier to each command in the first set of commands to ensure that logical steps are executed in accordance with the initial execution plan of the Al model.

[0117] Software layer 420 is or includes one or more an application programming interfaces (APIs) and / or software libraries that provide an optimized path for hardware device acceleration. Software layer 420 includes a software layer runtime environment that translates the first set of commands to a second set of commands corresponding to one or more hardware devices of (e.g., implemented within or attached to) computing environment 400, such as CPUs, GPUs, NPUs, and digital signal processor (DSP) accelerators configured to process two-dimensional (2D) and three-dimensional (3D) graphical data. The software layer runtime environment may be code signed to provide additional security for the second set of commands. Translating the first set of commands to a second set of commands includes allocating memory (e.g., system memory of computing environment 400) for one or more portions of the Al model (represented by the first set of commands) and / or user input data received by the Al model, loading the portions of the Al model and / or user input data into the allocated memory, and performing operations on portions of the Al model and / or the user input data placed in the allocated memory. For instance, software layer 420 may allocate memory for the model weights, load the model weights into the allocated memory, and perform one or more convolution operators between various model weights in the allocated memory and the user input data to generate the second set of commands.

[0118] In examples, software layer 420 uses a memory protection technique, such as memory encryption or memory partitioning, when loading the portions of the Al model and / or the user input data into the allocated memory. Additional enforcement logic may then be used to control the use of or interactions with (or between) the data loaded into the different regions of the allocated memory. Memory encryption refers to the process of using a security key to encrypt data stored in memory such that the encrypted data stored in the memory is only accessible using the security key. In some examples, different security keys may be used to encrypt different types of data stored in memory. For instance, a first security key may be used to encrypt model data, a second security key may be used to encrypt model structure information, and a third security key may be used to encrypt the user input data. Memory partitioning refers to the process of dividing memory into partitions (e.g., sections) that are each assigned to be allocated for a particular type of data. For instance, a first range of the memory (e.g., a lower quarter of the memory) may be allocatable for user input data, a second range of the memory (e.g., the next quarter of the memory) may be allocatable for model data, and a third range of the memory (e.g., the upper half of the memory) may be allocatable for model structure information.

[0119] The second set of commands is provided to user mode driver (UMD) 430. Inexamples, UMD 430 is a software component that manages hardware devices of computing environment 400. UMD 430 may run in a separate memory space from the kernel of computing environment 400 and communicate with the hardware devices of computing environment 400 via an interface provided by the kernel. UMD 430 translates the second set of commands into microcode that is executable by a hardware device of computing environment 400. UMD 430 may be code signed to provide additional security for the microcode. The microcode is a set of hardware-level instructions that enables higher-level machine code instructions to be executed by a hardware device. In examples, the microcode is represented by one or more microcode data blocks. A microcode data block is a sequence of data (e.g., bits or bytes) having a maximum data length (i.e., block size). Each microcode data block may include built-in operators and references to portions of the Al model represented by the microcode block. Each microcode data block may accept one or more types of user input data as input.

[0120] In examples, when a hardware device attempts to execute a microcode data block, the hardware device queries a HROT (e.g., HROT 220) of computing environment 400 to determine whether the microcode data block is authorized to generate an output for the input received by the microcode data block. For instance, the HROT may determine whether the Al model topology has been processed correctly (e.g., whether the portions of the Al model and / or user input data were allocated to the correct memory ranges), whether the Al model software code is code signed, whether the model weights are encrypted, and / or whether the input to a microcode data block includes input data. In some examples, the HROT uses a data mapping structure, such as transformation table or a data array, to determine the types of inputs a microcode data block is authorized to receive, the operations the microcode data block is authorized to perform on each authorized type of input, the outputs the microcode data block is authorized to provide, and the output destination (e.g., storage location or component of computing environment 400) to which the outputs are authorized to be provided. The data mapping structure may be stored by the HROT and accessed at Al model runtime in accordance with one or more licenses associated with the Al model. For instance, a license for the Al model may specify that a particular memory protection technique be applied to model operators or user input data.

[0121] OS hardware scheduler 440 receives microcode blocks associated with Al model. OS hardware scheduler 440 provides an algorithm for assigning processing resources (e.g., CPUs, CGPs, NPUs) and other compute resources (e.g., memory, storage, networking) for performing tasks associated with the microcode blocks. For example, OS hardware scheduler 440 may receive microcode blocks for multiple applications or services executing the Al model (or an instance thereof). OS hardware scheduler 440 determines a processing order for the microcode of each of the multiple applications or services (e.g., process microcode for application 1, then processmicrocode for application 2). The processing order for the microcode may be based on, for example, an execution priority for the multiple applications or services, a current or expected compute resource availability for computing environment 400, current latency or response times for computing environment 400, temporal factors (e.g., the time of day or the day of the week), or the order in which the microcode was received by OS hardware scheduler 440 (e.g., first received is first processed). Alternatively, the processing order for the microcode may be based on, for example, an interleaving format (e.g., process a first microcode block (or a first subset of microcode blocks) for application 1 , process a first microcode block (or a first subset of microcode blocks) for application 2, process a second microcode block (or a second subset of microcode blocks) for application 1 , process a second microcode block (or a second subset of microcode blocks) for application 2, and so on).

[0122] In some examples, OS hardware scheduler 440 modifies the microcode blocks to provide additional security for the microcode blocks. For instance, OS hardware scheduler 440 may append an identifier associated with computing environment 400 (e.g., a media access control (MAC) address, an application or service identifier, a user session identifier, or some other unique identifier) to the microcode blocks. OS hardware scheduler 440 may provide the identifier in an obfuscated form, such as a hash value or an encoded value, which may be code signed by UMD 430 or another trusted component of computing environment 400. In another instance, OS hardware scheduler 440 may add one or more data fields the microcode blocks, such as a microcode block sequence counter. The microcode block sequence counter may be used to determine whether the microcode blocks have been reordered or whether one or more microcode blocks have been added or removed (e.g. in further of an attack attempt or as a result of data corruption). In yet another instance, OS hardware scheduler 440 may encrypt the microcode blocks or portions of the microcode blocks. The portions to be encrypted may be based on the protections assigned to the various portions of the Al model (e.g., the model data and the model structure information). As one example, if a license for the Al model specifies that software code of the Al model is to be protected using hardware-based encryption (e.g., a high level of protection) and the model weights for the Al model are to be protected using software-based encryption (e.g., a lower level of protection), software code of the Al model that is included within a microcode block may be encrypted, whereas model weights included within a microcode block may not be encrypted.

[0123] OS hardware scheduler 440 provides the microcode blocks to KMD 450. In examples, KMD 450 is a software component that manages hardware devices of computing environment 400. KMD 450 runs in a memory space of the kernel of computing environment 400 and is able communicate directly with the hardware devices. KMD 450 provides the receivedmicrocode blocks to the hardware devices. The hardware devices then execute the commands in the microcode blocks and provide a resultant output of the execution. The resultant output is used to provide user output data that is responsive to the user input data. For instance, the user output data may be processed (e.g., formatted to add, remove, or obfuscate content) and provided to the application that provided the request to instantiate or execute the Al model.

[0124] FIG. 5 illustrates an example method 500 for providing control of input, output, and processing of an Al model. Method 500 may be performed by one or more of the devices or components of the systems described above. In an example, methods 500 is performed by client devices 102 and / or computing environment 202.

[0125] Method 500 begins at operation 502, where a request to execute an Al model implemented by a client device is received. In examples, an application (e.g., application 208) implemented by the client device (e.g., client devices 102) provides the request to a model processing environment (e.g., PAI container 206). The request includes user input data relating to the performance of one or more tasks by at least one hardware device (e.g., CPU, GPU, NPU, or 3D engine) of the client device. The model processing environment may store a compiled or assembled version of the Al model. Alternatively, the model processing environment may store or receive (e.g., via the request) an uncompiled or unassembled version of the Al model. In examples in which the Al model is uncompiled or unassembled when the request is received, the model processing environment may compile or the assemble the Al model into an executable format that enables the Al model to process the user input data.

[0126] The Al model is associated with at least one license. The license specifies security requirements for the Al model, such as the permitted usage of the Al model, the requisite hardware and / or software capabilities of the client device for executing the Al model, and the requisite protections the client device is to provide for received user data and various portions of the Al model (e.g., model data and model structure information). The license may also store one or more security keys used to encrypt and / or decrypt the model or the various portions thereof.

[0127] At operation 504, the Al model is translated to a first set of commands. In examples, a data package runtime environment of the client device is used to translate the Al model and / or the user input data into an intermediate language (e.g., ONNX or Open Al’s Triton) that is processable by a software layer, such as software layer 220. The software layer may provide the application that provided the request an optimized path for hardware device acceleration and may enable ML techniques such as upscaling, anti-aliasing, and style transfer. Translating the Al model and / or the user input data into the first set of commands obfuscates the original content of the Al model and / or the user input data to prevent access by unauthorized parties.

[0128] At operation 506, the first set of commands is translated into a second set ofcommands. In examples, a software layer runtime environment of the client device is used to translate the first set of commands into a second set of commands that is processable by a hardware device of the client device. Translating the first set of commands to a second set of commands includes allocating memory of the client device for one or more portions of the Al model and / or user input data represented by the first set of commands and loading the portions of the Al model and / or user input data into the allocated memory in accordance with one or more memory protection techniques. For example, a license for the Al model may specify that memory partitioning is to be used to secure the portions of the Al model and / or the user input data. As a result, a first portion of the Al model (e.g., the model data) is placed in a first range of memory addresses, a second portion of the Al model (e.g., the model structure information) is placed in a second range of the memory addresses, and the user input data is placed in a third range of the memory. In one example, the sub-portions of the portions of the Al model are also allocated and placed into separate memory ranges. For instance, the sub-portions of the model structure information may be allocated memory such that a first range (or subrange) of memory addresses is allocated for software code of the Al model, a second range (or subrange) of memory addresses is allocated for operators of the Al model, and a third range (or subrange) of memory addresses is allocated for topology of the Al model. Translating the first set of commands to a second set of commands fiirther includes perform one or more convolution operators between various model weights in the allocated memory and the user input data to generate the second set of commands.

[0129] At operation 508, the second set of commands is translated into microcode. In examples, the second set of commands is provided to a first driver component (e.g., UMD 430), which translates the second set of commands into microcode that is executable by a hardware device of the client device. For instance, the microcode may be a set of hardware-level instructions that is configured to be executed by a GPU or an NPU. The microcode may be represented as a set of microcode blocks that each include built-in operators (e.g., operators of the Al model) and references to portions of the Al model represented by the microcode block. Each microcode data block may be authorized to accept one or more types of user input data as input, to perform certain types of operations, and to provide one or more types of user output data.

[0130] At operation 510, a hardware device executes the microcode. In examples, the microcode is provided to a corresponding hardware device. The hardware device then executes the microcode in fiirtherance of the request received from the application. In some examples, when executing (or attempting to execute) the microcode, the hardware device queries a HROT (e.g., HROT 220) of the client device to determine whether the microcode data block is authorized to generate an output for the input received by the microcode data block. For instance, the HROT may access a data mapping that specifies authorized data inputs, operations, and data outputs formicrocode data blocks (e.g., based on memory protections for allocated memory corresponding to data included in the microcode data block). If the HROT confirms that the hardware device is authorized to execute the microcode, the hardware device executes the microcode and provides user output data, which is provided to the application. However, if the HROT does not confirm that the hardware device is authorized to execute the microcode, execution of the hardware device may be halted and the hardware device may be put into a blocked state (e.g., preventing the device for execution of the Al model and / or the application).PROTECTION-LEVEL BASED MECHANISM FOR SECURING Al MODELS

[0131] FIG. 6 depicts an example protection level scheme 600 specified by a license for an Al model. Protection level scheme 600 includes protection levels 1 -4, the properties of which are included in columns 610, 620, 630, and 640, respectively. Although protection level scheme 600 is depicted as comprising four protection levels, protection level scheme 600 may include additional or fewer protection levels than those described in FIG. 6. Further, properties of the protection levels of protection level scheme 600 (e.g., threats managed, protection, how protected, customer scenario, operating system platform requirements) may be different from than those described in FIG. 6.

[0132] In FIG. 6, protection level 1 (PL-1) is described by the properties listed in column 610. Specifically, PL-1 is intended to manage against threats from a Level- 1 attacker, such as a low-privilege user, while the Al model is at rest (e.g., is not actively being used by the client device). PL-1 protects the Al model by encrypting the Al model in the cloud, causing the application that intends to use the Al model to download the Al model, decrypting the Al model using an obfuscated CPU (e.g., the description or structure of the CPU is modified to intentionally conceal the functionality of the CPU), and causing the application to use the Al model for inferencing (e.g., executing the Al model against data to generate an output). PL-1 does not indicate an operating system dependency requirement for the Al model and permits cross-platform usage of the Al model. In examples, PL-1 is used when a user desires to increase the difficulty of acquiring unauthorized access to the Al model data (e.g., the Al model weights).

[0133] Protection level 2 (PL-2) is described by the properties listed in column 620. Specifically, PL-2 is intended to manage against threats from a Level-2 attacker, such as an administrator (e.g., of client devices 102), while the Al model is at rest or in use by (e.g., in the memory of) a CPU using software-based protections. PL-2 protects the Al model by using an obfuscated CPU to decrypt the Al model in an isolated, protected process or environment (e.g., PAI container 206) and performing optimization and scheduling of the Al model in the isolated, protected process or environment. PL-2 does not indicate an operating system dependency requirement for the Al model and permits usage of existing features of the client device’soperating system. In examples, PL-2 is used when a user desires to prevent a system memory copy of a CPU of the client device (e.g., to prevent the Al model data or software code from being copied while the Al model is in use on the client device).

[0134] Protection level 3 (PL-3) is described by the properties listed in column 630. Specifically, PL-3 is intended to manage against threats from a Level-3 attacker, such as a user having physical access and software / firmware access to the client device. PL-3 provides protection for an Al model while the Al model is at rest or in use by a CPU using software-based protections, protection for the Al model data while the Al model is in use by a CPU using hardware-based protections, and protection for the Al model and model data while the Al model is in use by a GPU using hardware-based protections. In addition to the protections provided by PL-2, PL-3 protects the Al model by restricting access to the Al model data (e.g., model weights) to the GPU executing the Al model and providing hardware memory protection for the GPU via memory categorization (e.g., specifying operations that can be performed for specific memory address ranges of the GPU). PL-3 indicates an operating system dependency requirement and a driver update dependency requirement for the Al model. In examples, PL-3 is used when a user desires to prevent the export of memory from the GPU.

[0135] Protection level 6 (PL-4) comprises protection levels PL-4A and PL-4B and is described by the properties listed in column 640. Specifically, PL-4 is intended to manage against threats from a Level-4 attacker, such as a user having physical access to the client device and access to advanced hardware or software attacking tools. PL-4 provides protection for an Al model while the Al model is at rest, in use by a CPU using hardware-based protections, or in use by a GPU using hardware-based protections. In addition to the protections provided by PL-3, PL-4A protects the Al model by performing processing of the Al model on a CPU in a hardware-protected enclave (e.g., a CPU execution mode that provides an isolated, hardware -protected execution space), whereas PL-4B protects the Al model by performing processing of the Al model on a security processor that controls access to memory address ranges, on a native trusted execution environment, or on an NPU operating system. PL-4 indicates an operating system dependency requirement and a CPU and GPU hardware dependency requirement for the Al model. In examples, PL-4 A is used when a user desires to implement hardware -based protection on a CPU and a GPU, whereas PL-4B is used when a user desires to implement hardened, custom-made hardware-based protection on a CPU and a GPU.

[0136] The usage of protections levels (e.g., protection levels 1-4) in protection level scheme 600 provides several benefits. For example, the usage of a protection level enables protection level properties to be aggregated into logical groups that can be agreed upon by model creators and model consumers (e.g., end users). These logical groups ensure that insecurecombinations of protections are avoided, simply testing associated with applying protection levels to devices, and ensure the enforcement of license and compliance agreements. As another example, the usage of a protection level simplifies the protocols used for communication between devices (e.g., between cloud devices and client devices). For instance, a protection level may enumerate permitted or preferred communication protocols that can be used to enable devices to communicate with other (specified or unspecified) devices. As yet another example, the usage of a protection level simplifies queries for application and client device capabilities or configurations and ensures that devices enforce semantics associated with the queries. For instance, a protection level may specify the type of information for which one device may query another device, or the type of information one device may provide to another device. As still yet another example, the usage of a protection level enables a fixed set so enumerated values to be embedded within a license. For instance, instead of including multiple sets of protections levels in a license in order to ensure that all available protection levels are presented to a model consumer, only a subset of protection levels that are applicable to the selected Al model and / or client device (or application) or enumerated in the license.

[0137] FIGS. 7 and 8 depict example methods for distributing an Al model to a client device in accordance with one or more licenses for the Al model. The methods in FIGS. 7 and 8 may be performed by one or more of the devices or components of the systems described above. In an example, the methods in FIGS. 7 and 8 are performed by client devices 102 and / or computing environment 202.

[0138] FIG. 7 depicts an example method 700 for distributing an Al model to a client device in accordance with a license for the Al model. Method 700 begins at operation 702, where a request to distribute an Al model to a client device is received. In examples, the request is provided by a client device (e.g., client devices 102) to a distribution service (e.g., distributed servers 110A and HOB) having access to one or more Al models. The request may identify a particular Al model, a particular Al model class (e.g., LLM, SLM, or RNN), a desired protection level (e.g., the protection levels (PL-1 , PL-2, PL-3, and PL-4) described in FIG. 6), or a protection type (e.g., hardware-based protection or software-based protection). Alternatively, the request may indicate one or more tasks to be performed and the distribution service may select an Al model to provide to the client device based on the tasks to be performed. For example, the request may indicate an intent to perform the task of video and audio processing for multimedia content (e.g., video data, image data, audio data, and textual data). Based on the intended task, the distribution service may identify a particular Al model or a particular Al model class that is configured to be used to perform the intended task. For instance, the distribution service may identify one or more RRNs that are typically used to perform video and audio processing. In someexamples, identifying the tasks that Al models are configured to perform comprises evaluating properties of the Al models (e.g., model name or identifier, model creator, model class, size, storage location, access control information, date and time information) or stored descriptions of the Al models. For instance, each Al model may be stored with an indication of an Al model class, a description of the Al model, and / or a description of the Al model class. The descriptions may indicate the types of tasks the Al model or Al model class is intended to or typically used to perform.

[0139] In at least one example, the distribution service may identify multiple candidate Al models in one or more Al model classes that are configured to be used to perform the intended task. The distribution service may select one of the candidate Al models randomly or based on various criteria for the Al models. Such criteria may include creation or modification date (e.g., preference may be given to recently created or modified Al models), stability (e.g., preference may be given to Al models that have historically proven to be stable or reliable), performance (e.g., preference may be given to more performant Al models), cost (e.g., preference may be given to less expensive Al models), popularity (e.g., preference may be given to Al models that have a high volume of recent selections), and semantic similarity (e.g., preference may be given to Al models that have properties or descriptions comprising that most closely match terms in an intended task). Alternatively, a user of the client device may select one of the candidate Al models. For instance, the distribution service may provide a notification of the candidate Al models (e.g., an email or a message via an interface used by the client device to submit the request for the Al model) to the client device. The notification may provide information related to each Al model, such as an identifier of the Al model, a description of the Al model, the cost of the Al model, the amount of time for authorized use of the Al model, a number of authorized uses of the Al model, requisite hardware the Al model must be able to access (on the client device), and the like. This information may be included within or representative of content in a license associated with Al model. The notification may also provide access to an interface that enables a user of the client device to select one of the candidate Al models. For instance, the notification may include a link (e.g., a hyperlink) to a graphical user interface or may embed a set of controls (e.g., checkboxes, radio buttons, dropdown lists, list boxes, text boxes) that enables a user of the client device to select one of the candidate Al models.

[0140] At operation 704, a license for the selected Al model is identified. In examples, in response to the selection of the Al model, the distribution service accesses a license server (or other licensing repository) storing one or more licenses for Al models (e.g., licensing server 112). Each of the licenses may include properties indicating the Al models to which the license is intended to be applied, one or more protection levels provided by the license (e.g., the protectionlevels (PL-1, PL-2, PL-3, and PL-4) described in FIG. 6), and / or client device requirements (e.g., hardware and / or software capabilities of a client device) that must be satisfied to enable the Al model to be distributed to the client device. The distribution service searches the license server for a license corresponding to the Al model. Searching for the license may comprise attempting to match properties of the Al model to properties of the license. For instance, a model identifier for the Al model may be compared to model identifiers that are stored as properties in the licenses. If a license matching the Al model is identified, the identified license is selected.

[0141] At operation 706, capabilities of the client device are evaluated. In examples, the distribution service or the license server attempts to identify the capabilities of the client device by querying the client device (e.g., sending commands to an API of the client device that is configured to identify device capabilities) or evaluating configuration files for the client device (e.g., installation logs or update logs). The identified capabilities of the client device are then compared to the client device requirements indicated by one or more protection levels of the license. In an alternative example, instead of the distribution service or the license server evaluating the capabilities of the client device, the client device requirements for one or more protection levels of the license are provided to the client device. A user of the client device then determines whether the client device satisfies the received client device requirements. The user may be required to certify that the client device satisfies the client device requirements as a requisite to receiving the model. In another alternative example, instead of the distribution service or the license server evaluating the capabilities of the client device, the distribution service or the license server may configure the client device or cause the client device to be configured. For instance, the client device may be required to install new components (e.g., software, firmware, or hardware) and / or to update existing components to cause the client device to be in compliance with the client device requirements for one or more protection levels of the license.

[0142] At decision operation 708, a determination is made regarding whether the capabilities of the client device support a protection level specified by the license for the model. If it is determined that the capabilities of the client device do not support a protection level specified by the license for the model, the model is not provided to the client device and method 700 ends. However, if it is determined that the capabilities of the client device support a protection level specified by the license for the Al model, method 700 proceeds to operation 710.

[0143] At operation 710, the Al model is provided to the client device. In some examples, based on the determined capabilities of the client device, the distribution service or the license server modifies the license for the Al model to indicate a selected protection level to be applied to the Al model. For instance, the license server may generate a new license that is specific to (e.g., is only usable by) the client device. The new license may include the same (or similarproperties) of the selected license for the Al model. However, while the new license includes the selected protection level to be applied to the Al model, the non-selected protection levels are removed from the new license. In other examples, an indication of the selected protection level is applied to the Al model. For instance, the selected protection level or a protection type associated with a selected protection level may be embedded into the properties of the Al model. The Al model is then provided to the client device. In some examples, the license (or the new license) is also provided to the client device.

[0144] FIG. 8 illustrates an example method 800 for distributing an Al model to a client device in accordance with multiple licenses for the Al model. Method 800 begins at operation 802, where a request to distribute an Al model to a client device is received. In examples, the request is provided by a client device (e.g., client devices 102) to a distribution service (e.g., distributed servers 110) having access to one or more Al models. As discussed in operation 702 of FIG. 7, the request may identify a particular Al model, a particular Al model class, a desired protection level, a protection type, or one or more tasks to be performed. As also discussed in operation 702 of FIG. 7, in an example where multiple candidate Al models are identified, the distribution service or a user of the client device may select one of the candidate Al models.

[0145] At operation 804, a first license is identified for a first portion of the selected Al model. In examples, the Al model comprises at least a first portion corresponding to the data (e.g., weights) of the Al model and a second portion corresponding to the software code (e.g., operators, topology) of the Al model. In some examples, the portions of an Al model are predefined. For instance, the distribution service may be configured to identify each Al model as having a model data portion and a software code portions). In other examples, the portions of an Al model are customizable. For instance, as part of the request for the Al model, the user of the client device may indicate a desire to protect the model weights (e.g., a first portion), the model operators (e.g., a second portions), and the model topology (e.g., a third portion) of the Al model using separate licenses. The use of separate licenses to protect the three portions of the Al model may indicate that the user of the client device places a different level of importance on each of the three portions and / or the user of the client device expects a different likelihood of attack for each of the three portions. In another instance, as part of the request for the Al model, the user of the client device may indicate a desire to protect the Al model using a single license.

[0146] In response to the selection of the Al model, the distribution service accesses a license server (e.g., licensing server 112) storing one or more licenses that can be applied to the various portions of Al models. As discussed in operation 704 of FIG. 7, each of the licenses may include properties indicating the Al models (or the portions of the Al models) to which the license is intended to be applied, one or more protection levels provided by the license, and / or clientdevice requirements that must be satisfied to enable the Al model to be distributed to the client device. The distribution service searches the license server for a license corresponding to the Al model. Searching for the license may comprise attempting to match properties of the Al model to properties of the license. For instance, a model identifier for the Al model may be compared to model identifiers that are stored as properties in the licenses. Upon determining one or more licenses that match the Al model, the distribution service evaluates the licenses to determine whether each license is applicable to the first portion of the Al model. For instance, each license may indicate the portions of the Al model that the license (or the individual protection levels specified by the license) is intended to protect. If a license matching the Al model and the first portion of the Al model is identified, the identified license is selected as the first license.

[0147] At operation 806, a second license is identified for the second portion of the selected Al model. As discussed in operation 804, the distribution service searches the license server for a license corresponding to the Al model. Upon determining one or more licenses that match the Al model, the distribution service evaluates the licenses to determine whether each license is applicable to the second portion of the Al model. For instance, if a license matching the Al model and the second portion of the Al model is identified, the identified license is selected as the second license. In some examples, the first and the second licenses are the same license. For instance, a license may indicate that one or more protections levels specified by the license are applicable to the first portion of the Al model and one or more other protections levels specified by the license are applicable to the second portion of the Al model.

[0148] At operation 808, capabilities of the client device are evaluated. In examples, as discussed in operation 706 of FIG. 7, the distribution service or the license server attempts to identify the capabilities of the client device by querying the client device or evaluating configuration files for the client device. The identified capabilities of the client device are then compared to the client device requirements indicated by one or more protection levels of the first and second licenses. In instances in which the client device requirements for the first and second licenses are different (e.g., the first license specifies required software capabilities of the Al model and the second license specifies required hardware capabilities of the Al model), the distribution service or the license server may apply rules for resolving the differences between the client device requirements. The rules may be evaluated in a predefined order (e.g., in descending order from the top of the rule set) or based on properties of the Al model and / or client device. For instance, some rules may only be applicable to certain Al models, Al model classes, client devices, or client device types, whereas are applicable to all or other types of Al models, Al model classes, client devices, or client device types. In some examples, the rules are evaluated such that all non- conflicting client device requirements must be satisfied by the client device. In other examples,the rules are evaluated such that only the most restrictive of the client device requirements must be satisfied by the client device.

[0149] In an alternative example, instead of the distribution service or the license server evaluating the capabilities of the client device, the client device requirements for one or more protection levels of the first and second licenses are provided to the client device. A user of the client device then determines whether the client device satisfies the received client device requirements. The user may be required to certify that the client device satisfies the client device requirements for the first and second licenses as a requisite to receiving the Al model. In another alternative example, instead of the distribution service or the license server evaluating the capabilities of the client device, the distribution service or the license server may configure the client device or cause the client device to be configured. For instance, the client device may be required to install new components (e.g., software, firmware, or hardware) and / or to update existing components to cause the client device to be in compliance with the client device requirements for one or more protection levels of the first and second licenses.

[0150] At decision operation 810, a determination is made regarding whether the capabilities of the client device support a first protection level specified by the first license for the Al model and / or a second protection level specified by the second license for the Al model. If it is determined that the capabilities of the client device do not support the first protection level and / or the second protection level for the Al model, the Al model is not provided to the client device and method 800 ends. However, if it is determined that the capabilities of the client device support the first protection level and / or the second protection level for the Al model, method 800 proceeds to operation 812.

[0151] At operation 812, the Al model is provided to the client device. In some examples, based on the determined capabilities of the client device, the first and / or second licenses may be modified to respectively indicate a selected protection level. For instance, the distribution service or the license server may modify the first license to indicate a selected protection level to be applied to the first portion of the Al model and / or modify the second license to indicate a selected protection level to be applied to the second portion of the Al model. In other examples, an indication of the selected protection level for each of the first and second licenses is applied to the Al model. For instance, each of the selected protection levels of the first and second licenses or a protection type associated with each of the selected protection levels may be embedded into the properties of the Al model.

[0152] Fig. 9 and the associated description provide a discussion of a variety of operating environments in which examples of the invention may be practiced. However, the devices and systems illustrated and discussed with respect to FIG. 9 is for purposes of example and illustrationand is not limiting of a vast number of computing device configurations that may be utilized for practicing aspects of the invention, described herein. Fig. 9 is a block diagram illustrating physical components (i.e., hardware) of a computing device 900 with which examples of the present disclosure may be practiced. The computing device components described below may be suitable for a client device running the web browser discussed above. In a basic configuration, the computing device 900 may include a processing system 902 including at least one processing unit and a system memory 904. Depending on the configuration and type of computing device, the system memory 904 may comprise, but is not limited to, volatile storage (e.g., random access memory), non-volatile storage (e.g., read-only memory), flash memory, or any combination of such memories. The system memory 904 may include an operating system 905 and one or more program modules 906 suitable for running software applications 950. The software applications 950 may be any of the applications and / or processes discussed herein for handling the distribution and execution of the Al models and / or training sets discussed herein. Such applications and processes may be referred to collectively as Al processes 955.

[0153] The operating system 905, for example, may be suitable for controlling the operation of the computing device 900. Furthermore, aspects of the invention may be practiced in conjunction with a graphics library, other operating systems, or any other application program and is not limited to any particular application or system. This basic configuration is illustrated in Fig. 9 by those components within a dashed line 908. The computing device 900 may have additional features or fimctionality. For example, the computing device 900 may also include additional data storage devices (removable and / or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated in Fig. 9 by a removable storage device 909 and a non-removable storage device 910.

[0154] As stated above, a number of program modules and data files may be stored in the system memory 904. While executing on the processing system 902, the program modules 906 may perform processes including, but not limited to, one or more of the operations of the methods and / or data flows illustrated in the Figures. Other program modules that may be used in accordance with examples of the present invention and may include applications such as electronic mail and contacts applications, word processing applications, spreadsheet applications, database applications, slide presentation applications, drawing or computer-aided application programs, etc.

[0155] Furthermore, examples of the invention may be practiced in an electrical circuit comprising discrete electronic elements, packaged or integrated electronic chips containing logic gates, a circuit utilizing a microprocessor, or on a single chip containing electronic elements or microprocessors. For example, examples of the invention may be practiced via a system-on-a-chip(SOC) where each or many of the components illustrated in Fig. 9 may be integrated onto a single integrated circuit. Such an SOC device may include one or more processing units, graphics units, communications units, system virtualization units and various application functionality all of which are integrated (or “burned”) onto the chip substrate as a single integrated circuit. When operating via an SOC, the fimctionality, described herein, with respect to generating suggested queries, may be operated via application-specific logic integrated with other components of the computing device 900 on the single integrated circuit (chip). Examples of the present disclosure may also be practiced using other technologies capable of performing logical operations such as, for example, AND, OR, and NOT, including but not limited to mechanical, optical, fluidic, and quantum technologies.

[0156] The computing device 900 may also have one or more input device(s) 912 such as a keyboard, a mouse, a pen, a sound input device, a touch input device, etc. The output device(s) 914 such as a display, speakers, a printer, etc. may also be included. The aforementioned devices are examples and others may be used. The computing device 900 may include one or more communication connections 916 allowing communications with other computing devices 918. Examples of suitable communication connections 916 include, but are not limited to, RF transmitter, receiver, and / or transceiver circuitry; universal serial bus (USB), parallel, and / or serial ports.

[0157] The term computer readable media as used herein may include computer storage media. Computer storage media may include volatile and nonvolatile, removable and nonremovable media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, or program modules. The system memory 904, the removable storage device 909, and the non-removable storage device 910 are all computer storage media examples (i.e., memory storage.) Computer storage media may include RAM, ROM, electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other article of manufacture which can be used to store information and which can be accessed by the computing device 900. Any such computer storage media may be part of the computing device 900. Computer storage media does not include a carrier wave or other propagated data signal.

[0158] Communication media may be embodied by computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. The term “modulated data signal” may describe a signal that has one or more characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation,communication media may include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.

[0159] As will be understood from the present disclosure, one aspect of the technology discussed herein relates to a system comprising: a processing system; and memory comprising computer executable instructions that, when executed, perform operations comprising: receiving a request to execute an artificial intelligence (Al) model implemented by a client device, the Al model comprising model weights and a model structure; translating the Al model to a first set of commands; translating the first set of commands into a second set of commands, wherein the model weights are protected in the memory based on a first protection level specified by a license for the Al model and the model structure in protected in the memory based on a second protection level specified by the license; translating the second set of commands into microcode corresponding to a hardware device of the system; and executing, by the hardware device, the microcode in furtherance of the request to execute the Al model.

[0160] In one example, an application implemented by the client device provides the request to a model processing environment.

[0161] In another example, the model processing environment is a protected artificial intelligence (Al) container comprising a protected Al server.

[0162] In another example, the protected Al server performs operations on the Al model, the operations including at least one of decryption operations, validation operations, or inference operations.

[0163] In another example, the protected Al server includes a hardware root of trust that is trusted to enforce security requirements of the license for the Al model.

[0164] Another aspect of the technology discussed herein relates to a method comprising: receiving, by a client device, a request to execute an artificial intelligence (Al) model implemented by the client device, the Al model comprising model weights and a model structure; translating the Al model to operations in an intermediate language; translating the operations in the intermediate language into hardware commands, wherein the model weights are protected in a memory of the client device based on a first protection level specified by a license for the Al model and the model structure in protected in the memory based on a second protection level specified by the license; translating the hardware commands into microcode corresponding to a hardware device accessible to the client device; and executing, by the hardware device, the microcode in furtherance of the request to execute the Al model.

[0165] In one example, the request comprises user input data; translating the Al model comprises translating the user input data to the intermediate language; and translating the hardwarecommands comprises translating the user input data into the microcode.

[0166] In another example, the model weights are numerical values representing learnable parameters that convey an importance of user input data features in predicting a final output.

[0167] In another example, wherein the model structure includes at least two of: instructions for compiling or assembling the Al model; characters representing a specific mathematical or logical action that can be performed on data elements; or a structure of a layer architecture that is used to process and transform user input data provided to the Al model.

[0168] In another example, the microcode is a set of hardware-level instructions that is configured to be executed by a graphics processing unit or a neural processing unit of the client device.

[0169] Another aspect of the technology discussed herein relates to a system comprising: a processing system; and memory comprising computer executable instructions that, when executed, perform operations comprising: receiving a request to distribute an artificial intelligence (Al) model to a client device, the Al model comprising model weights and a model structure; identifying a license for the Al model, wherein the license specifies a first protection level for the model weights and a second protection level for the model structure; evaluating capabilities of the client device; determining the capabilities of the client device enable the client device to support the first protection level and the second protection level; and in response to determining the capabilities of the client device enable the client device to support the first protection level and the second protection level, providing the Al model to the client device.

[0170] In one example, the request identifies at least one of: a particular Al model; a particular Al model class; a desired protection level; or a protection type.

[0171] In another example, receiving the request comprises: receiving, by a distribution service, the request from the client device, the distribution service being external to the client device and having access to a plurality of Al models.

[0172] In another example, receiving the request further comprises: identifying a task to be performed using the Al model; and selecting, by the distribution service, the Al model based on the task, wherein the Al model is configured to be used to perform the task.

[0173] In another example, selecting the Al model based on the task comprises at least one of: evaluating properties of the Al model; or evaluating a stored description of the Al model.

[0174] Another aspect of the technology discussed herein relates to a method comprising: receiving a request to distribute an artificial intelligence (Al) model to a client device, the Al model comprising model weights and a model structure; identifying a first license for the Al model, wherein the first license specifies a first protection level for the model weights; identifying a second license for the Al model, wherein the second license specifies a second protection levelfor the model structure; evaluating capabilities of the client device; determining the capabilities of the client device enable the client device to support the first protection level and the second protection level; and in response to determining the capabilities of the client device enable the client device to support the first protection level and the second protection level, providing the Al model to the client device.

[0175] In one example, the method further comprises: identifying a third license for the Al model, wherein the third license specifies a third protection level for user input data provided to the Al model.

[0176] In another example, the method further comprises: providing the first license and the second license the client device.

[0177] In another example, first client device requirements for implementing the first license on the client device are different from second client device requirements for implementing the second license on the client device.

[0178] In another example, resolution rules stored by the client device are used to resolve differences between the first client device requirements and the second client device requirements.

[0179] Aspects of the present invention, for example, are described above with reference to block diagrams and / or operational illustrations of methods, systems, and computer program products according to aspects of the invention. The functions / acts noted in the blocks may occur out of the order as shown in any flowchart. For example, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality / acts involved. Further, as used herein and in the claims, the phrase “at least one of element A, element B, or element C” is intended to convey any of: element A, element B, element C, elements A and B, elements A and C, elements B and C, and elements A, B, and C.

[0180] The description and illustration of one or more examples provided in this application are not intended to limit or restrict the scope of the invention as claimed in any way. The aspects, examples, and details provided in this application are considered sufficient to convey possession and enable others to make and use the best mode of claimed invention. The claimed invention should not be construed as being limited to any aspect, example, or detail provided in this application. Regardless of whether shown and described in combination or separately, the various features (both structural and methodological) are intended to be selectively included or omitted to produce an example with a particular set of features. Having been provided with the description and illustration of the present application, one skilled in the art may envision variations, modifications, and alternate examples falling within the spirit of the broader aspects of the general inventive concept embodied in this application that do not depart from the broaderscope of the claimed invention.

Claims

CLAIMS1. A system (100) comprising: a processing system (902); and memory (904) comprising computer executable instructions that, when executed, perform operations comprising: receiving (502) a request to execute an artificial intelligence (Al) model implemented by a client device, the Al model comprising model weights and a model structure; translating (504) the Al model to a first set of commands; translating (506) the first set of commands into a second set of commands, wherein the model weights are protected in the memory based on a first protection level specified by a license for the Al model and the model structure in protected in the memory based on a second protection level specified by the license; translating (508) the second set of commands into microcode corresponding to a hardware device of the system; and executing (510), by the hardware device, the microcode in furtherance of the request to execute the Al model.

2. The system of claim 1, wherein an application implemented by the client device provides the request to a model processing environment.

3. The system of claim 2, wherein the model processing environment is a protected artificial intelligence (Al) container comprising a protected Al server.

4. The system of claim 3, wherein the protected Al server performs operations on the Al model, the operations including at least one of decryption operations, validation operations, or inference operations.

5. The system of any of claims 3 or 4, wherein the protected Al server includes a hardware root of trust that is trusted to enforce security requirements of the license for the Al model.

6. A method (500) comprising: receiving (502) , by a client device, a request to execute an artificial intelligence (Al) model implemented by the client device, the Al model comprising model weights and a model structure; translating (504) the Al model to operations in an intermediate language; translating (506) the operations in the intermediate language into hardware commands, wherein the model weights are protected in a memory of the client device based on a first protection level specified by a license for the Al model and the model structure in protected in the memory based on a second protection level specified by the license;translating (508) the hardware commands into microcode corresponding to a hardware device accessible to the client device; and executing (510), by the hardware device, the microcode in fiirtherance of the request to execute the Al model.

7. The method of claim 6, wherein: the request comprises user input data; translating the Al model comprises translating the user input data to the intermediate language; and translating the hardware commands comprises translating the user input data into the microcode.

8. The method of any of claims 6 or 7, wherein the model weights are numerical values representing learnable parameters that convey an importance of user input data features in predicting a final output.

9. The method of any of claims 6 to 8, wherein the model structure includes at least two of: instructions for compiling or assembling the Al model; characters representing a specific mathematical or logical action that can be performed on data elements; or a structure of a layer architecture that is used to process and transform user input data provided to the Al model.

10. The method of any of claims 6 to 9, wherein the microcode is a set of hardware-level instructions that is configured to be executed by a graphics processing unit or a neural processing unit of the client device.

11. A system (100) comprising: a processing system (902) ; and memory (904) comprising computer executable instructions that, when executed, perform operations comprising: receiving (702) a request to distribute an artificial intelligence (Al) model to a client device, the Al model comprising model weights and a model structure; identifying (704) a license for the Al model, wherein the license specifies a first protection level for the model weights and a second protection level for the model structure; evaluating (706) capabilities of the client device; determining (708) the capabilities of the client device enable the client device to support the first protection level and the second protection level; and in response to determining the capabilities of the client device enable the clientdevice to support the first protection level and the second protection level, providing (710) the Al model to the client device.

12. The system of claim 11, wherein the request identifies at least one of: a particular Al model; a particular Al model class; a desired protection level; or a protection type.

13. The system of any of claims 11 or 12, wherein receiving the request comprises: receiving, by a distribution service, the request from the client device, the distribution service being external to the client device and having access to a plurality of Al models.

14. The system of claim 13, wherein receiving the request farther comprises: identifying a task to be performed using the Al model; and selecting, by the distribution service, the Al model based on the task, wherein the Al model is configured to be used to perform the task.

15. The system of claim 14, wherein selecting the Al model based on the task comprises at least one of: evaluating properties of the Al model; or evaluating a stored description of the Al model.

16. A method (800) comprising: receiving (802) a request to distribute an artificial intelligence (Al) model to a client device, the Al model comprising model weights and a model structure; identifying (804) a first license for the Al model, wherein the first license specifies a first protection level for the model weights; identifying (806) a second license for the Al model, wherein the second license specifies a second protection level for the model structure; evaluating (808) capabilities of the client device; determining (810) the capabilities of the client device enable the client device to support the first protection level and the second protection level; and in response to determining the capabilities of the client device enable the client device to support the first protection level and the second protection level, providing (812) the Al model to the client device.

17. The method of claim 16, the method further comprising: identifying a third license for the Al model, wherein the third license specifies a third protection level for user input data provided to the Al model.

18. The method of any of claims 16 or 17, the method farther comprising:providing the first license and the second license the client device.

19. The method of any of claims 16 to 18, wherein first client device requirements for implementing the first license on the client device are different from second client device requirements for implementing the second license on the client device.

20. The method of claim 19, wherein resolution rules stored by the client device are used to resolve differences between the first client device requirements and the second client device requirements.

Images