Artificial intelligence model executions

Abstract

A hypervisor of an edge computing device may generate secure storage for a hypervisor execution context operating on the edge computing device, where the secure storage is not accessible to an operating system of the edge computing device. The hypervisor verifies the hypervisor execution context is in a recognized configuration. When the hypervisor execution context is in a recognized configuration, the hypervisor loads an artificial intelligence model to the hypervisor execution context. The hypervisor execution context can then execute the artificial intelligence model.

Description

ARTIFICIAL INTELLIGENCE MODEL EXECUTIONSBACKGROUND

[0001] Providers of artificial intelligence models can transmit an artificial intelligence model to a device under the control of a separate entity. The separate entity may then execute the artificial intelligence model locally. To execute the artificial intelligence model, the separate entity may use their own computing resources separate from those controlled by the provider of the artificial intelligence model.BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Various features will now be described with reference to the following drawings. Throughout the drawings, reference numbers may be re-used to indicate correspondence between referenced elements. The drawings are provided to illustrate examples described herein and are not intended to limit the scope of the disclosure.

[0003] FIG. 1 is a block diagram depicting an example operating environment for executing an artificial intelligence model on an edge computing device.

[0004] FIG. 2 is a flow diagram depicting an example routine implemented by an edge computing device for executing an artificial intelligence model within a hypervisor execution context instance shown in FIG. 1 .

[0005] FIG. 3 is a flow diagram depicting an example routine implemented by a model provider device for providing an artificial intelligence model to an authenticated hypervisor execution context executing on an edge computing device shown in FIG. 1.

[0006] FIG. 4 is a block diagram depicting an example architecture of the edge computing device shown in FIG. 1.

[0007] FIG. 5 is a block diagram depicting an example architecture of the model provider device shown in FIG. 1.DETAILED DESCRIPTION

[0008] Generally described, an artificial intelligence (“Al”) model can be provided by a model provider to an edge computing device in a networked computing environment so that the Al model may be operated locally by the edge computing device. However, theartificial Al model may contain confidential information such as weight values or training data, and the model provider may not be able to prevent the Al model from being probed by the edge computing device to recover this confidential information. The Al model may also be used to generate malicious or undesirable outputs on the edge computing device, without the ability of the model provider to enforce limitations.

[0009] Providers of Al models wish to ensure the security and integrity of the Al model being used outside of an environment controlled by the provider. Ensuring the security and integrity of the Al model includes ensuring that certain aspects of the Al model. For example, a provider of an Al model wants to protect the weights and training data used to build the Al model to ensure the trained Al model cannot be stolen, or altered to cause the generation of malicious responses, e.g., responses that would normally be prevented from being presented to a user, responses that expose information about the weights or training data, and the like. Additionally, a user of the Al model wants to prevent unauthorized access to additional data resources maintained by the user through use of the Al model. Accordingly, the present disclosure describes ways to ensure the security and integrity of the Al model by providing an authenticated and encrypted environment in an edge computing device for operation of the Al model.

[0010] An “edge computing device,” as used in the present disclosure, can include any computing device that provides localized processing or storage solutions at an edge location, distinct from a cloud provider device or location, such as a client worksite. Examples of an edge computing device include a laptop computer, a desktop computer, a tablet, a smart phone, or an all-in-one computer. Edge computing devices may provide several advantages for a user over cloud computing devices, or remote devices, including lower latency times for data transfers, control over security settings, and control over physical access by the user. However, an Al model provider may not have control over an edge computing device, reducing the ability of the Al model provider to ensure the security of an Al model provided to the edge computing device for use. The term “model” or “Al model,” as used in the present disclosure, can include any computer-based model of any type and of any level of complexity, such as any type of sequential, functional, or concurrent model. Models can further include various types of computational models, such as, for example, artificial neural networks (“NN”), convolutional neural networks (“CNNs), language models (e.g., large language models (“LLMs”)), machineleaming (“ML”) models, multimodal models (e.g., models or combinations of models that can accept inputs of multiple modalities, such as images and text), and / or the like.

[0011] FIG. 1 depicts an example environment 100 in which a model provider device 110, edge computing device 120, requesting entity 160, and data resources 140 are connected through a network 150 that may be used, among other purposes, to allow for communication with an Al model operating in a hypervisor execution context on the edge computing device 120. A requesting entity may be a hardware (such as another computing device or processor), a software (such as an application or other program including computer-readable instructions) or a virtualized (such as a virtual machine) component that is remote from the edge computing device 120, local to the edge computing device 120 or part of the edge computing device 120.

[0012] The example environment 100 allows the model provider device 110 to provide an Al model to the edge computing device 120 while ensuring that unauthorized entities, such as a user of the edge computing device 120 or other components of the edge computing device 120, are restricted from accessing information of the Al model. For example, a set of weights used by the Al model may be considered confidential by the model provider, and the model provider may therefore desire to limit the ability of a user to recover the set of weights when executing or using the Al model on the edge computing device 120. In this example, the model provider may encrypt the Al model, including the set of weights. The encrypted Al model may not be executable by a computing device without first being decrypted. The model provider may then provide, using the model provider device 110, a key to decrypt the Al model to the hypervisor 122 of the edge computing device 120. The hypervisor 122 may configure secure storage 130 on the edge computing device 120 where the Al model can be decrypted while limiting the ability of other components of the edge computing device 120 to access the Al model in a decrypted state. The hypervisor 122 may also, in this example, instantiate a hypervisor execution context and provide access to the key to the hypervisor execution context. The hypervisor execution context can then use the key to decrypt the Al model in the secure storage 130 and may execute the Al model on the within the hypervisor execution context on the edge computing device 120.

[0013] A hypervisor execution context describes an environment in which code is executed and may include computer-readable instructions, current states of information storedin memory, access permissions for resources of a computing device, and locations in memory available for executing computer-readable instructions or storing results. In some examples, a hypervisor execution context includes a virtual machine instance and an associated virtual machine control structure. In other examples, a hypervisor execution context describe an execution environment with computer-readable instructions, state information, etc. that is within the hypervisor itself. The edge computing device 120 can instantiate a hypervisor execution context, which in turn, represents virtualized hardware supporting an operating system and various applications. Virtual machine instances may further represent “bare metal” instances, whereby a portion of the computing resources of the computing device directly support (without virtualization) the machine instance. In some cases, a hypervisor execution context may be created and maintained on behalf of a user. For example, a user may utilize a computing device to request creation of a hypervisor execution context executing client-defined computer-readable instructions. A hypervisor execution context may have attributes of a physical computing device including hardware (various types of processors, local memory, random access memory (“RAM”), hard-disk and / or solid-state drive (“SSD”) storage), a choice of operating systems, networking capabilities, and pre-loaded applications. Each hypervisor execution context may also virtualize its console input and output (“RO”) (e.g., keyboard, display, and mouse). This virtualization allows clients to connect to a hypervisor execution context using a computer application such as a browser, application programming interface, development kit, or the like, in order to configure and use their hypervisor execution context just as they would a physical computing device. Unlike computing devices, which possess a fixed quantity of hardware resources available to the client, the hardware associated with the hypervisor execution context can be scaled up or down depending upon the resources the client requires. Clients can choose to deploy their hypervisor execution contexts to provide services for their own use and / or for use by their customers or other clients.

[0014] In some examples, the model provider device 110 may be associated with an entity that trains, stores, or otherwise provides Al models for use on devices not under direct control of the model provider. The model provider device 110 may be in communication with an Al model library 115 used to store the model provider’s Al models. The model provider device 110 is additionally able to perform authentication of hypervisor execution contextsexecuting on an edge computing device 120 in order to confirm that the hypervisor execution context is recognized and configured in such a way as to prohibit unauthorized access to, or logical tampering with, an Al model provided by the model provider. Logical tampering may refer to interference with the operation of the edge computing device 120 that does not require physical access to the edge computing device 120. For example, logical tampering may include a malware attack, attempt to modify the operation of the Al model, or a side channel attack on a processing element of the edge computing device 120. To prohibit unauthorized access to the Al model, the Al model may be encrypted and the hypervisor 122 may store a decryption key associated with the Al model in a secure location, such as in a trusted platform module of the edge computing device 120, where the hypervisor 122 can control access to the decryption key. For example, the model provider may want to prohibit additional components, such as an operating system or other hypervisor execution context, executing on the edge computing device 120 from accessing memory storing the Al model and related information such as additional databases used to generate responses.

[0015] Additionally, the model provider may want to ensure that the responses of the Al model cannot be tampered with, or maliciously interfered with. In order to prevent access to the Al model, or malicious interference, the edge computing device 120 can authenticate the configuration of the hypervisor execution context or the machine learning model. Authenticating the hypervisor execution context may include determining whether the configuration of the hypervisor execution context is recognized, for example by determining that configuration information of the hypervisor execution context indicates the hypervisor execution context is in a known or recognized configuration before providing a decryption key to allow the edge computing device 120 to decrypt the Al model for use. Ensuring malicious interference does not occur may include prohibiting access to the processing units, such as a neural processing unit, graphics processing unit, or central processing unit, or other Al processors used by the Al model to perform inferencing and generate responses by use of the hypervisor execution context on the edge computing device 120. In the present disclosure, an Al processor may include a neural processing unit, graphics processing unit, or other processing unit that executes an Al model. An Al processor may provide for an increased speed of operation, or lower power requirement, of an Al model executed on the edge computing device 120.

[0016] In some examples, the edge computing device 120 may be a computing device used to execute the Al model. Executing the Al model may include performing inferencing, accessing additional information to be used by the Al model during inferencing to generate an output stored at a different storage location (e.g., information stored by the data resources 140), providing the additional information as input to the Al model, and storing the Al model when the Al model is not in use. In the example illustrated in FIG. 1, the edge computing device 120 includes a hypervisor 122, an operating system 124, device storage 135, and secure storage 130. Secure storage 130 may, for example, be encrypted, with access to a key used to decrypt the secure storage 130 controlled by the hypervisor 122, be hidden from the operating system 124 by use a separate namespace, or otherwise limit access to the contents of the secure storage 130 to unauthorized entities. The secure storage 130 may be, for example, a logical partition of the device storage 135.

[0017] The hypervisor 122 may have direct control over the device resources of the edge computing device 120, for example, memory, storage, and processing units. By exerting direct control over the device resources of the edge computing device 120, the hypervisor 122 may prevent other components, including the operating system 124, from accessing device resources such as the secure storage 130. For example, access control may be performed through the use of hypervisor execution contexts, where the operating system 124 may operate within its own hypervisor execution context preventing access to resources and information from other hypervisor execution contexts. In another example, the hypervisor 122 may prevent the operating system 124 from accessing the secure storage 130 by exerting direct control over access to the system resources of the edge computing device 120.

[0018] The hypervisor 122 may be able to instantiate hypervisor execution contexts on the edge computing device 120, and can instantiate hypervisor execution contexts within secure storage 130 to prevent decryption or tampering with processes directed by the hypervisor execution context. The hypervisor 122 may be a hardware component of the edge computing device 120, as shown in FIG. 4, or a software component of the edge computing device 120 including computer-readable instructions. The hypervisor 122 may be a type 1 hypervisor, also known as a bare-metal hypervisor, that is a hypervisor that is instantiated before the operating system 124 or another hypervisor of the edge computing device 120, such that memory and processing units secured by the hypervisor 122 are unable to be modified, forexample altered or decrypted, without the permission of the hypervisor 122. A type 1 hypervisor may be installed directly on a hardware component of a computing device, separately from a storage device of the computing device, allowing the type 1 hypervisor to manage and allocate the device’s computing resources. The direct control of the type 1 hypervisor over the computing resources may limit the ability of other components of the computing device, such as an operating system, to access or provision computing resources without permission of the type 1 hypervisor. In the case of processing units of the edge computing device 120, such as central processing unit, neural processing unit, or Al processor units, the hypervisor 122 may also prohibit access to the processing units while they are in use by a hypervisor execution context operating on the edge computing device 120. Additionally, the hypervisor 122 may instantiate multiple hypervisor execution contexts in multiple secure storage 130 locations operating in parallel but without access to the secure storage 130 of another hypervisor execution context.

[0019] The operating system 124 may be initially loaded into the edge computing device 120 during a boot process and may manage other applications. The operating system 124 may be, for example, a WINDOWS®, MACOS®, or LINUX® operating system that executes on the edge computing device 120. The operating system 124 may provide normal functionality expected from a consumer or enterprise operating system, such as resource scheduling, providing an interface for a user, and network management. However, the operating system 124 may access device resources of the edge computing device 120 through the hypervisor 122. For example, the device storage 135 may be accessed by the operating system 124 through a memory manager of the hypervisor 122, and the hypervisor 122 may then reject requests from the operating system 124 to access portions of the device storage 135 for which the operating system 124 is not authorized. In this way, the hypervisor 122 may have greater access to system resources of the edge computing device 120 than the operating system 124. For example, if the hypervisor 122 has restricted read-access to a portion of the device storage 135 to create secure storage 130, the operating system 124 cannot decrypt the secure storage 130, and may not otherwise be able to access the memory location of the secure storage 130. Restricting read-access with the hypervisor 122 may include encrypting memory, defining memory within a name space not accessible to unauthorized entities, or otherwise preventing an unauthorized entity from recovering useful informationfrom the memory. Additionally, the hypervisor 122 may restrict write-access, such that an unauthorized entity such as the operating system 124 cannot alter data in the secure storage 130 without being provided access by the hypervisor 122. An unauthorized entity may refer, for example, to computer-readable instructions associated with a program that is not within the hypervisor execution context, a requesting entity 160, a second hypervisor of the edge computing device 120, a second hypervisor execution context of the edge computing device 120, or any other entity not authorized by the hypervisor 122 to access the secure storage 130.

[0020] The contents of the secure storage 130 may also be authenticated by the hypervisor 122, such as by measuring contents of the secure storage 130. For example, to measure the contents of the secure storage, the hypervisor 122 may generate a hash of the contents of secure storage 130 at a first point in time, store the hash, generate a second hash at a later point in time, and compare the hash to the second hash to determine whether the secure storage 130 has been altered. In addition, the hypervisor 122 may measure a portion of the secure storage 130, instead of the entire secure storage 130. For example, the hypervisor 122 may measure the portion of the secure storage 130 storing an Al model or an initial configuration of a virtual machine. In another example, the hypervisor 122 may authenticate the secure storage 130 by analyzing a record of the activity associated with the secure storage 130 to determine whether the secure storage 130 has been accessed or altered by an unauthorized process such as the operating system 124 or a hypervisor execution context not authorized by the hypervisor 122 to access the secure storage 130. In some cases, the operating system 124 may be operating inside of its own virtualized environment, created by the hypervisor 122, separate from a hypervisor execution context used to execute an Al model.

[0021] The device storage 135 of the edge computing device 120 may be accessible to the hypervisor 122 and the operating system 124. The device storage 135 may be random access memory (“RAM”), read-only memory (“ROM”), a hard disk drive (“HDD”), solid state drive (“SSD”), or other non-transitory computer-readable medium capable of storing data for the edge computing device 120. The device storage 135 may include secure and unsecured portions. The hypervisor 122, having control of the resources of the edge computing device 120, can create secure storage 130 from a portion of the device storage 135 for use by a hypervisor execution context by restricting read-access to the portion. For example, to restrictread-access to the secure storage 130, the hypervisor 122 may use memory virtualization to restrict the operating system 124 from being able to access or request the contents of a physical memory location included in the secure storage 130. Memory virtualization may include partitioning of the device storage 135, such as by dividing the device storage 135 into multiple namespaces, where the operating system 124 has access to a different namespace than a hypervisor execution context. In another example, the hypervisor 122 may manage the encryption of data stored in the secure storage 130 such as by encrypting data of the hypervisor execution context before the data is stored in the secure storage 130. Additionally, the hypervisor 122 may manage an encryption key for the hypervisor execution context, so that the hypervisor execution context may encrypt data for storage in the secure storage 130 using the encryption key managed by the hypervisor 122. Alternatively, the hypervisor execution context may encrypt data, and the hypervisor 122 may provide a location in the device storage 135 where the encrypted data is to be stored, without the hypervisor being involved in encrypting the stored data to create the secure storage 130. Managing the encryption key with the hypervisor 122 prevents additional hypervisor execution contexts, or the operating system 124, from accessing the encryption key. Further, the edge computing device 120 may include hardware-assisted memory encryption, and the hypervisor 122 may facilitate access to an encryption key controlled by the hardware-assisted memory encryption system for the hypervisor execution context. Using hardware-assisted memory encryption may prevent even the hypervisor 122 from decrypting the secure storage 130 or the CPU register information for the hypervisor execution context.

[0022] Hardware-assisted memory encryption may also assist in authenticating the contents of the secure memory 130 by detecting malicious modifications to the secure memory 130. Authenticating the secure storage 130 may be performed by the hypervisor 122. For example, the hypervisor 122 may generate hash values for memory locations of the secure storage 130, such as memory locations storing an initial configuration of the hypervisor execution context at instantiation or memory locations storing an Al model, and store the hash values in a secure location accessible to the hypervisor 122, such as in the TPM of the edge computing device 120. The hypervisor 122 may then recalculate the hash values for the memory locations at a later time, and determine that the recalculated hash values are equivalent to the previously stored hash values to authenticate the memory locations. Calculating andstoring a hash of a memory location of the secure storage 130 may also be referred to as measuring, or storing a measurement of, the contents of the secure storage 130.

[0023] While the operating system 124 can access the device storage 135, when a portion of the device storage 135 is secured to create secure storage 130, the operating system 124 no longer has read-access to the secure storage 130, or the ability to decrypt or alter data in the portion that is secure storage 130. Additionally, when a hypervisor execution context making use of the secure storage 130 is terminated, the secure storage 130 may be deleted. Deleting the secure storage 130 may make any data previously stored in the secure storage 130 unrecoverable.

[0024] In some examples, the requesting entity 160 may be a computing device operated at a location separate from the edge computing device 120 and the model provider device 110. Alternatively, the requesting entity 160 may be a separate computing device co-located with the edge computing device 120, or may be an application (implemented using computer-executable instructions) executing at the edge computing device 120. The edge computing device 120 receives a request directed to an Al model from the requesting entity 160, and provides the requests as input to the Al model operating in a hypervisor execution context of the edge computing device 120.

[0025] The data resources 140 may store any additional information used by the Al model before, during, or after inferencing to generate a result for the requesting entity 160. The data resources 140 may include calculator functions for an LLM, pre-generated embedding information provided as input to an Al for inferencing, or any other information which may be provided to the Al model. For example, the data resources 140 may be a database containing the source code for an enterprise used by a code-generation Al model to generate code for the enterprise. In another example, the data resources 140 may be a set of image embeddings used by a classifier Al model, where the Al model compares input to the image embeddings in order to classify the input. In a further example, the data resources 140 may be a set of user manuals for equipment operated by a manufacturer and accessed by the Al model to generate responses to queries from employees of the manufacturer. In an additional example, the data resources 140 may store training data used to train an Al model being trained on the edge computing device 120. The data resources 140 may contain encrypted information, or may otherwise limit outside access, in order to prevent unauthorized access to sensitive information.Access to the data resources 140 may be provided to a hypervisor execution context over an encrypted, or otherwise secured, connection in order to limit unauthorized access. The connection to the data resources 140 may be limited by the hypervisor 122 to a hypervisor execution context where the Al model is loaded such that the operating system 124 and other components of the edge computing device 120 cannot access the secure connection. Further, any data received by the edge computing device 120 from the data resources 140 may be stored in the secure storage 130 to prevent the operating system 124 or other components of the edge computing device 120 from accessing the data of the data resources 140, as such components are considered unauthorized entities and are not given read-access to the secure storage 130 by the hypervisor 122.

[0026] The network 150 can include any appropriate network, including wired network, wireless network, or combination thereof. For example, network 150 may be a personal area network, local area network, wide area network, cable network, satellite network, cellular network, or any other such network or combination thereof. As a further example, the network 150 may be a publicly accessible network of linked networks, possibly operated by various distinct parties, such as the Internet. In various examples, the network 150 may be a private or semi-private network, such as a corporate or university intranet. The network 150 may include one or more wireless networks, such as a Global System for Mobile Communications (GSM) network, a Code Division Multiple Access (CDMA) network, a Long-Term Evolution (LTE) network, C-band, mmWave, sub-6GHz, or any other type of wireless network. The network 150 can use protocols and components for communicating via the Internet or any of the other aforementioned types of networks. For example, the protocols used by the network 150 may include Hypertext Transfer Protocol (HTTP), HTTP Secure (HTTPS), Message Queue Telemetry Transport (MQTT), Constrained Application Protocol (CoAP), and the like.

[0027] FIG. 2 is a flow diagram depicting example routine 200 implemented by the edge computing device 120 of FIG. 1 for operating an Al model within a hypervisor execution context in secure storage 130, such that other components (whether software including computer-readable instructions or hardware) of the edge computing device 120 cannot alter or decrypt the stored Al model, data related to the operation of the Al model such as data accessed from the data resources 140, or the processing activity of the Al model during training orinferencing. The routine 200 begins at 202 during the boot sequence of the edge computing device 120, where the boot code and configuration of the hypervisor may be measured in a platform configuration register (“PCR”) of a trusted platform module (“TPM”) of the edge computing device 120. When the hypervisor 122 has booted correctly, such that the hypervisor 122 is in a recognized configuration based on the measurement stored in the PCR, the hypervisor 122 may use the TPM to unseal a hypervisor secure key (“HSK”). The hypervisor 122 may then extend a sealing PCR to prevent another component, such as another hypervisor, of the edge computing device 120 from accessing the HSK. The HSK may be used to control access to device resources of the edge computing device 120, thereby enabling creation of secure storage 130 at a later boot stage.

[0028] At block 204, the hypervisor 122 of the edge computing device 120 configures secure storage 130 within the memory of the edge computing device 120. To configure the secure storage 130, the hypervisor 122 may secure a portion of the device storage 135 to prevent unauthorized entities from gaining access to the contents of the portion. For example, to protect the secure storage 130 from tampering, the hypervisor 122 may use the HSK as a key to encrypt a portion of the device storage 135, such as by using secure memory encryption to mark pages of memory as encrypted in the page tables of the edge computing device 120. Encrypting the portion may prevent an unauthorized entity from interpreting the information stored in the portion and tampering with the information by altering it to perform a malicious or unintended action, such as altering the output of an Al model to provide malicious or private information. The hypervisor 122 may additionally generate a hypervisor execution context-specific key for the secure storage 130 to be provided to a hypervisor execution context that is allowed access to the secure storage 130 and enable the hypervisor execution context to modify, e.g., alter, decrypt, etc., the secure storage 130. Without the hypervisor execution context- specific key, an unauthorized entity may be unable to read, or decrypt, the contents of the secure storage 130. The hypervisor execution contextspecific key may also be generated using a key definition function based on the HSK and additional information such as a measurement of the hypervisor execution context that will be given access to the secure storage 130. Additionally, the hypervisor 122 may protect the secure storage 130 from tampering by managing access to, or performing verification of, the secure storage 130. Without permission of the hypervisor 122, an unauthorized entity may be unableto modify, e.g., alter, decrypt, corrupt, delete, rename, etc., the secure storage 130. For example, the hypervisor may access a hash value representing an expected state of the contents of the secure storage 130, and compare a current hash value of the secure storage 130 to the hash value representing the expected state to determine whether tampering has occurred by an unauthorized entity. Additionally, the hypervisor 122 may control access to the system storage 135 generally, and use such access control to limit modifications of the secure storage 130 to the hypervisor execution context and prevent modifications by an unauthorized entity.

[0029] At block 206, the hypervisor 122 virtualizes an Al processor, such as a neural processing unit (“NPU”), to generate a virtualized Al processor. An Al processor may, in some examples, accelerate neural network inferencing by natively executing many of the specific operations of a neural network. In other examples, the speed of inferencing may remain about the same, but the Al processor may perform the operations at lower power. An Al processor such as an NPU may include a peripheral board with multiple NPU chips, with each chip including multiple NPU cores. Each NPU core may include systolic arrays that leverage data reuse patterns of matrix multiplication, and vector units for generic vector operations. An NPU may optimize memory use and use lower precision arithmetic to accelerate calculation and increase throughput of computation. Some low-precision floating-point formats used for acceleration by an NPU are half-precision and the b float 16 floating-point format. An NPU may also be referred to as an Al processor or deep learning processor. The hypervisor 112 may virtualize the NPU into multiple virtual NPUs, each for use by a hypervisor execution context, by creating an abstraction layer of the NPU hardware. The hypervisor 122 further manages the virtualized NPUs and thus, when virtualizing an NPU, may restrict access to the virtualized NPU by components of the edge computing device 120 that are not authorized by the hypervisor 122, such as the operating system 124.

[0030] At block 208, the hypervisor 122 instantiates a hypervisor execution context with access to the secure storage 130. In some examples, the hypervisor execution context may be instantiated in response to a request from the operating system 124. Alternatively, the edge computing device 120 may instruct the hypervisor 122 to instantiate a hypervisor execution context automatically, for example, during the boot sequence of the edge computing device 120. The hypervisor execution context may be instantiated with access to the securestorage 130, and contents of the hypervisor execution context may be stored in the secure storage 130 such that the contents of the hypervisor execution context arc not alterable or readable, except in an encrypted form, by other components of the edge computing device 120. Instantiating the hypervisor execution context may also include defining the resources accessible to the hypervisor execution context. For example, the hypervisor 122 may define the access to the central processing unit, device memory, and virtualized NPU provided to the hypervisor execution context. As with the secure storage 130, any other resource provided to the hypervisor execution context may be secured to prevent access to those resources when they are in use by the hypervisor execution context, such as by encrypting the operations of the device resources used by the hypervisor execution context during operation.

[0031] At block 210, the hypervisor 122 verifies that the hypervisor execution context is in a configuration recognized by the hypervisor 122. When the hypervisor execution context is instantiated, the hypervisor 122 may verify the configuration of the hypervisor execution context, the contents of the hypervisor execution context in memory, and other information associated with the hypervisor execution context such as an application definition, in order to ensure the hypervisor execution context has been instantiated in a recognized configuration. The hypervisor 122 may also measure a virtual machine image into a PCR in order to allow for additional verification. When the hypervisor execution context has been verified, the hypervisor 122 may provide the execution context- specific key to the hypervisor execution context to allow the hypervisor execution context to make use of the secure storage device 130. Additional keys for the hypervisor execution context may also be generated when the hypervisor execution context has been verified. For example, a device ID key may be created that may be used when requesting a machine learning model from a remote location.

[0032] At block 212, the hypervisor 122 loads an artificial intelligence model to the secure storage device 130. The Al model may be stored in an encrypted state. The Al model may be stored in the common device storage 135, and transferred to the secure storage device 130 before being decrypted in the hypervisor execution context. The Al model may instead be accessible via the network 150, and may be retrieved by the hypervisor execution context using a secure communication and verification process, such as that described by FIG. 3 herein.

[0033] At block 214, the hypervisor 122 provides access to the Al model in secure storage device 130 to the hypervisor execution context. When the hypervisor execution context receives access to the virtualized processing unit, the hypervisor may also provide a memory location of an encrypted version of the Al model to the hypervisor execution context and allow the Al model to be decrypted within the hypervisor execution context for use. For example, the hypervisor 122 may provide a decryption key to the hypervisor execution context, where the decryption key is used to decrypt the stored Al model. In another example, the Al model may be stored in a decrypted state in random access memory (RAM) of the secure storage 130 of the edge computing device 120, and the hypervisor 122 may direct the hypervisor execution environment to the location of the decrypted Al model in RAM. Alternatively, the Al model, in encrypted or decrypted form, may be included in an image of a virtual machine before the virtual machine is instantiated within the hypervisor execution context. The Al model may then be decrypted within the virtual machine instance, or an interface for the Al model may be initialized within the hypervisor execution context.

[0034] At block 216, the edge computing device 120 executes the Al model in the hypervisor execution context on behalf of a requesting entity 160. Executing the Al model on behalf of the requesting entity 160 may include receiving a request from the requesting entity 160 and applying a portion, or the whole, request as input to the Al model. Executing the Al model may further include the Al model performing inferencing using device resources, such as neural processing units, central processing units, virtualized Al processor units, and memory resources, secured by the hypervisor 122 for use by the hypervisor execution context. The inferencing may be based on the input associated with the request from the requesting entity 160. Executing the Al model may also include providing an interaction layer for receiving input to the Al model and providing output of the Al model to users, for example users of the requesting entity 160. Additionally, executing the Al model may include training the Al model for the requesting entity 160, including causing the Al model to generate outputs based on training inputs, comparing the generated outputs to expected outputs, and updating model parameters in response to the comparison.

[0035] Further, executing the Al model may include loading the Al model to RAM so that the Al model may be used. In some examples, the Al model may be a standard model provided by a model provider, and executing the Al model may include accessing prompttemplates, weights, or a vector database and applying the accessed information to a standard model within the secure storage 130 to customize the Al model for a use case. When the use of the Al model is complete, the hypervisor execution context may be terminated, and the routine 200 may move to block 218 and end. When the hypervisor execution context is terminated, the hypervisor 122 may cause the secure storage 130 to be deleted such that the information of the hypervisor execution context and Al model during use are no longer stored in the device storage 135. Deleting the information of the hypervisor execution context may make the information practically unrecoverable.

[0036] FIG. 3 is a flow diagram depicting example routine 300 implemented by the model provider device 110 for providing an Al model to a verified hypervisor execution context executing on an edge computing device 120 to maintain the confidentiality and integrity of the Al model. The routine 300 begins at block 302, for example, with the model provider device 110 to receive and analyze requests for access to an Al model stored in the Al model library 115.

[0037] At block 304, the model provider device 110 receives a request for an Al model from the edge computing device 120. The request may be received from a hypervisor execution context of the edge computing device 120, or from an unsecured set of computer-readable instructions of the edge computing device 120 such as the operating system 124. The request may indicate a specific Al model from the device storage 135. Alternatively, the request may describe a type of Al model, such as by defining a set of parameters. The parameters used to define the Al model may include an input token size value, a size in memory, a processing unit limitation such as a required speed or core count of a processor, an input type, and ability to access data resources 140, or output restrictions such as content restrictions or filters.

[0038] At block 306, the model provider device 110 selects an Al model from the Al model library 115. The model provider device 110 may consider the parameters of the Al model received in the request, the specific model requested, the identity of the requesting edge computing device 120, and other information in order to select an Al model to provide to the edge computing device 120. Additionally, the model provider device 110 may determine whether to select an encrypted Al model if the requester has not been previously verified, and may determine to select a decrypted Al model if the requester is known to be secure, such as ahypervisor execution context that has previously been verified as operating in an expected configuration.

[0039] At block 308, the model provider device 110 transmits the selected Al model to the edge computing device 120. The model provider device 110 may transmit the Al model via the network 150. Additionally, when transmitting the Al model, the model provider device 110 may package related utilities with the Al model. For example, the model provider device 110 may generate an Al model package including a basic configuration of an Al model, a set of weights for the Al model to perform a selected task, additional information useful for generating output with the Al model for the selected task, an interface layer for allowing interaction with the Al model by the edge computing device 120 or a model provider device 110, a list of models included in the package, an image of a virtual machine instance in which an Al model is to execute, configuration information for operating the Al model within the hypervisor execution context, or a set of content filters for analyzing inputs to the Al model and outputs generated by the Al model. The content filters may prevent output from being provided to a user when that output may contain sensitive information, such as exposing model weights, model training data, or sensitive information used to generate model outputs, or information that is otherwise undesirable to provide to the requesting user such as information that may be used maliciously, such as software code for malware, or copyrighted material. The model provider device 110 may also provide a package containing the Al model and additional parameters to a first hypervisor execution context or edge computing device 120, and provide an interaction layer package for the Al model to a second hypervisor execution context or edge computing device 120, such that the Al model package is intended to be extracted and decrypted in the secure storage 130, but the interaction layer can be extracted in either secure storage 130 or device storage 135. Where reference is made to a “first,” “second,” “third,” “fourth,” and so on, the adjectives, “first,” “second,” “third,” “fourth,” and so on are not used to connote any description of structure or to provide any substantive meaning or order; rather, such adjectives are merely used to differentiate one component from a similarly named component.

[0040] At block 310, the model provider device 110 receives configuration information for a hypervisor execution context executing on the edge computing device 120 from the hypervisor execution context. The configuration information may be received by themodel provider device 1 10 by requesting remote attestation of the hypervisor execution context from the edge computing device 120. Alternatively, the configuration may be received from the hypervisor execution context on the edge computing device 120 as part of a request for a decryption key for the Al model. The configuration information may include a quote from the TPM of the edge computing device 120 for a PCR register associated with the hypervisor execution context, a device ID, attestation logs for the hypervisor execution context, or other identifying information for the edge computing device 120.

[0041] At block 312, the model provider device 110 authenticates a configuration of the hypervisor execution context based on the received configuration information. The model provider device 110 may analyze the authentication information, for example, by determining the received authentication information is a recognized authentication information for the hypervisor execution context or the edge computing device 120. When the analysis of the authentication information indicates that the hypervisor execution context is in a recognized configuration providing a secure environment for use of an Al model provided by the model provider device 110, the routine 300 may continue. When authentication of the hypervisor execution context fails, for example, because the received authentication information does not match expected authentication information, the routine 300 may move to block 316 and end, or the model provider device 110 may send an indication to the edge computing device 120 that the hypervisor execution context has not been authenticated so that the edge computing device 120 may make further attempts to instantiate a hypervisor execution context in a correct configuration for receiving an Al model from the model provider device 110.

[0042] At block 314, in response to authenticating the hypervisor execution context, the model provider device 110 transmits a decryption key for the Al model to the hypervisor execution context of the edge computing device 120 via the network 150. The decryption key may be selected from a database of decryption keys, where each decryption key may be associated with a particular Al model or edge computing device 120. Alternatively, the decryption key may be part of an ephemeral key pair generated using a key derivation function and information associated with the hypervisor execution context or the edge computing device 120 received during authentication of the configuration of the hypervisor execution context. The key pair may be generated using a symmetric or asymmetric keyderivation function, for example, an RSA function, DSA function, and the like. In another alternative, the model provider device 110 may generate a device ID certificate following authentication of the hypervisor execution context, and the device ID certificate may be used to generate the key pair used to encrypt and decrypt the Al model. In some examples, the decryption key may be transmitted to the hypervisor 122, or with instructions for the hypervisor execution context, to cause the decryption key to be stored in a TPM of the edge computing device 120. Causing storage of the decryption key in the TPM may serve to limit access to the decryption key by other elements of the edge computing device 120. After the model provider device 110 has transmitted the decryption key to the edge computing device 120, the routine 300 moves to block 316 and ends.

[0043] In FIG. 4, a block diagram depicts example architecture 400 of an edge computing device 120 used to execute an Al model within a hypervisor execution context in secure storage. The architecture 400 depicted in FIG 4 includes an arrangement of computer hardware and software components that may be used to implement aspects of the present disclosure. In some examples, the example architecture 400 may include more (or fewer) components than those shown in FIG. 4. The edge computing device 120 may include a computer processor 402 (e.g., a central processing unit) in communication with a network interface 404, a computer-readable medium drive 406, an input / output device interface 408, an Al processor 410, and a hypervisor 412, all of which may communicate with one another by way of an internal communication bus. An input / output device interface 408 may manage communication between the internal logic of the architecture 400 and an external entity. For example, the input / output device interface 408 may be a universal serial bus (USB), a peripheral component interconnect (PCI) bus, or another element enabling communication between internal logic of the edge computing device 120 and an external entity. The Al processor 410 may be, for example, an NPU, a graphics processing unit, or any hardware compute accelerator allowing for increased processing speed for Al applications. The edge computing device 120 may further include a memory 414 connected to the internal communication bus, the memory 414 used for storing an operating system 124, secure storage 130, and device storage 135. The memory 414 may include random access memory (“RAM”), read only memory (“ROM”), or other persistent or non-transient memory.

[0044] In FIG. 5, a block diagram depicts example architecture 500 that may be implemented by a model provider device 110 used to execute an Al model within a hypervisor execution context in secured storage. The architecture 500 depicted in FIG 5 includes an arrangement of computer hardware components and software components including computer-readable instructions that may be used to implement aspects of the present disclosure. In some examples, the example architecture 500 may include more (or fewer) components than those shown in FIG. 5. The model provider device 110 may include a computer processor 502 (e.g., a central processing unit) in communication with a network interface 504, a computer-readable medium drive 506, and an input / output device interface 508, all of which communicate with one another by way of an internal communication bus. An input / output device interface 508 may manage communication between the internal logic of the architecture 500 and an external entity. For example, the input / output device interface 508 may be a universal serial bus (USB), a peripheral component interconnect (PCI) bus, or another element enabling communication between internal logic of the model provider device 110 and an external entity. The model provider device 110 may further include a memory 510 connected to the internal communication bus, the memory 510 used for storing an operating system 514, and an authentication module 416 to authenticate a hypervisor execution context executing on an edge computing device 120 before providing access to an Al model to the hypervisor execution context. The memory 510 may include random access memory (“RAM”), read only memory (“ROM”), or other persistent or nontransient memory. The model provider device 110 is also in communication with the Al model library 115, which may be stored separately from the model provider device 110 or within the memory 510. Such memory may be random access memory (“RAM”), read-only memory (“ROM”), a hard disk drive (“HDD”), solid state drive (“SSD”), or other non-transitory computer-readable medium capable of storing Al models.

[0045] It is to be understood that not necessarily all objects or advantages may be achieved in accordance with any particular' example described herein. Thus, certain examples may be configured to operate in a manner that achieves or optimizes one advantage or group of advantages as taught herein without necessarily achieving other objects or advantages as may be taught or suggested herein.

[0046] While certain aspects and implementations are discussed herein with reference to use of an Al model, those aspects and implementations may be performed by any type of language model, large language model (“LLM”), generative Al model, generative model, ML model, NN, multimodel model, and / or other processes. An LLM may be any type of language model that has been trained on a larger data set and has a larger number of training parameters compared to a regular language model. An LLM can understand more intricate patterns and generate text that is more coherent and contextually relevant due to its extensive training. Thus, an LLM may perform well on a wide range of topics and tasks. An LLM may comprise a NN trained using self- supervised learning. An LLM may be of any type, including a Question Answer (“QA”) LLM that may be optimized for generating answers from a context, a multimodel LLM, and / or the like. An LLM (and / or other models of the present disclosure), may include, for example, attention-based and / or transformer architecture or functionality.

[0047] A language model may be any method, rule, model, and / or other programmatic instructions that can predict the probability of a sequence of words. A language model may, given a starting text string (e.g., one or more words), predict the next word in the sequence. A language model may calculate the probability of different word combinations based on the patterns learned during training (based on a set of text data from books, articles, websites, audio files, etc.). A language model may generate many combinations of one or more next words (and / or sentences) that are coherent and contextually relevant. Thus, a language model can be an advanced Al method that has been trained to understand, generate, and manipulate language. A language model can be useful for natural language processing, including receiving natural language prompts and providing natural language responses based on the text on which the model is trained. A language model may include an n-gram, exponential, positional, neural network, and / or other type of model.

[0048] In various examples, the Al models of the present disclosure may be locally hosted, cloud managed, accessed via one or more Application Programming Interfaces (“APIs”), and / or any combination of the foregoing and / or the like. Additionally, in various implementations, the Al models may be implemented in or by electronic hardware such application-specific processors (e.g., application- specific integrated circuits (“ASICs”)), Al processors, including but not limited to neural processing units (“NPUs”), programmable processors (e.g., field programmable gate arrays (“FPGAs”)), application- specific circuitry,and / or the like. Data that may be queried using the systems and methods of the present disclosure may include any type of electronic data, such as text, files, documents, books, manuals, emails, images, audio, video, databases, metadata, positional data (e.g., geo-coordinates), geospatial data, sensor data, web pages, time series data, and / or any combination of the foregoing and / or the like. In various implementations, such data may comprise model inputs and / or outputs, model training data, modeled data and / or the like, and may be stored as vectors, i.e., numerical representations of the data, in a vector database so that the data may be accurately and efficiently retrieved based on vector distance or similarity. Each vector may have number of dimensions, which can range from tens to thousands, depending on the complexity and granularity of the data.

[0049] Examples of Al models that may be used in various implementations of the present disclosure include, for example, Bidirectional Encoder Representations from Transformers (“BERT”), Language Model for Dialogue Applications (“LaMDA”), Pathways Language Model (“PaLM”), Pathways Language Model 2 (“PaLM 2”), Generative Pre-trained Transformer 2 (“GPT-2”), Generative Pre-trained Transformer 3 (“GPT-3”), Generative Pre-trained Transformer 4 (“GPT-4”), Large Language Model Meta Al (“LLaMA”), and BigScience Large Open-science Open-access Multilingual Language Model (“BLOOM”).

[0050] Although the terms machine learning and / or artificial intelligence are used herein, the scope of each term shall include each and every type of machine learning, artificial intelligence, neural network, and the like. An Al model can be built or trained based on sample data or training data in order to make predictions or decisions without being explicitly programmed to do so. In some examples, machine learning methods, models, and / or programs can perform tasks without being explicitly programmed to do so. For example, some aspects of the present disclosure may include training an Al model in a computer to carry out certain desired tasks that a human may not be able to manually perform.

[0051] A number of different types of Al methods and Al models or approaches may be used during implementation. For example, certain examples herein may use a logistical regression model, decision trees, random forests, convolutional neural networks, deep networks, or others. However, other models are possible, such as a linear regression model, a discrete choice model, or a generalized linear model. The machine learning aspects can be configured to adaptively develop and update the models over time based on new input. Forexample, the models can be trained, retrained, or otherwise updated on a periodic basis as new received data is available to help keep the predictions in the model more accurate as the data is collected over time. Also, for example, the models can be trained, retrained, or otherwise updated based on configurations received from a user, admin, or other devices. Some non-limiting examples of methods that can be used to train, retrain, or otherwise update the models can include supervised, semi- supervised, and non- supervised machine learning methods, including regression methods (such as, for example, Ordinary Least Squares Regression), instance-based methods (such as, for example, Learning Vector Quantization), decision tree methods (such as, for example, classification and regression trees), Bayesian methods (such as, for example, Naive Bayes), clustering methods (such as, for example, k-means clustering), association rule learning methods (such as, for example, Apriori methods), artificial neural network methods (such as, for example, Perceptron), deep learning methods (such as, for example, Deep Boltzmann Machine), dimensionality reduction methods (such as, for example, Principal Component Analysis), ensemble methods (such as, for example, Stacked Generalization), support-vector machines, federated learning, and / or other machine learning method. These machine learning methods may include any type of machine learning method including hierarchical clustering methods and cluster analysis methods, such as a k-means method. In some cases, the performing of Al methods may include the use of an artificial neural network. By using such techniques, large amounts (such as terabytes or petabytes) of received data may be analyzed to generate or implement models with minimal, or with no, manual analysis or review by one or more people.

[0052] Additionally, depending on the example, certain acts, events, or functions of any of the processes or methods described herein can be performed in a different sequence, can be added, merged, or left out altogether (e.g., not all described operations or events are necessary for the practice of the method). Moreover, in certain examples, operations or events can be performed concurrently, e.g., through multi-threaded processing, interrupt processing, or multiple processors or processor cores or on other parallel architectures, rather than sequentially.

[0053] All of the processes described herein may be embodied in, and fully automated via, software code modules, including specific computer-readable instructions, which are executed by a computing device. The computing device may include a computer orprocessor. The code modules may be stored in any type of non-transitory computer-readable medium or other computer storage device. Some or all the methods may be embodied in specialized computer hardware.

[0054] Many other variations than those described herein will be apparent from this disclosure. For example, depending on the example, certain acts, events, or functions of any of the methods described herein can be performed in a different sequence, can be added, merged, or left out altogether (e.g., not all described acts or events are necessary for the practice of the methods). Moreover, in certain examples, acts or events can be performed concurrently, e.g., through multi-threaded processing, interrupt processing, or multiple processors or processor cores or on other parallel architectures, rather than sequentially. In addition, different tasks or processes can be performed by different machines and / or computing devices that can function together.

[0055] The various example logical blocks, components and modules described in connection with the examples disclosed herein can be implemented or performed by a machine, such as a processing unit or processor, a digital signal processor (“DSP”), an application specific integrated circuit (“ASIC”), a field programmable gate array (“FPGA”) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A processor can be a microprocessor, but in the alternative, the processor can be a controller, microcontroller, or state machine, combinations of the same, or the like. A processor can include electrical circuitry configured to process computer-readable instructions. In another example, a processor includes an FPGA or other programmable device that performs logic operations without processing computer-readable instructions. A processor can also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, a microprocessor in conjunction with a DSP core, or any other such configuration. Although described herein primarily with respect to digital technology, a processor may also include primarily analog components. A computing environment can include any type of computer device, including, but not limited to, a computer device based on a microprocessor, a mainframe computer, a digital signal processor, a portable computing device, a device controller, or a computational engine within an appliance, to name a few.

[0056] Conditional language such as, among others, “can,” “could,” “might,” or “may,” unless specifically stated otherwise, arc otherwise understood within the context as used in general to convey that certain examples include, while other examples do not include, certain features, elements, and / or blocks. Thus, such conditional language is not generally intended to imply that features, elements and / or blocks are in any way required for any examples or that any example necessarily includes logic for deciding, with or without user input or prompting, whether these features, elements, and / or blocks are included or are to be performed in any particular example.

[0057] Any process descriptions, elements or blocks in the flow diagrams described herein and / or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include executable instructions for implementing specific logical functions or elements in the process. Alternate implementations are included within the scope of the examples described herein in which elements or functions may be deleted, executed out of order from that shown, or discussed, including substantially concurrently or in reverse order, depending on the functionality involved.

[0058] Unless otherwise explicitly stated, articles such as “a” or “an” should generally be interpreted to include one or more described items. Accordingly, phrases such as “a device configured to” are intended to include one or more recited devices. Such one or more recited devices can also be collectively configured to carry out the stated recitations. For example, “a processor configured to carry out recitations A, B, and C” can include a first processor configured to carry out recitation A working in conjunction with a second processor configured to carry out recitations B and C.

Claims

WHAT TS CLAIMED TS:

1. A non-transitory computer-readable medium storing computer-readable instructions that, when executed by a processor, cause the processor to: configure, with a hypervisor of an edge computing device, a first storage device of the edge computing device to be a secure storage device, wherein: the secure storage device is authenticated with the hypervisor, read-access to the secure storage device is restricted, and the secure storage device is protected from logical tampering; instantiate, with the hypervisor, a first hypervisor execution context on the edge computing device; verify, with the hypervisor, that the first hypervisor execution context is in a configuration recognized by the hypervisor; load, with the hypervisor, an artificial intelligence (Al) model to the secure storage device of the edge computing device; provide, with the hypervisor, the first hypervisor execution context access to the Al model loaded in the secure storage device of the edge computing device; and execute the Al model on behalf of a requesting computing device in the first hypervisor execution context after the first hypervisor execution context is provided access to the Al model.

2. The non-transitory computer- readable medium of claim 1, wherein the non-transitory computer-readable medium stores further computer-readable instructions that, when executed by the processor, cause the processor to: measure an initial configuration of the hypervisor into a trusted platform module of the edge computing device; determine that the initial configuration of the hypervisor is a recognized configuration of the hypervisor; and in response to determining that the initial configuration of the hypervisor is a recognized configuration, unseal, with the trusted platform module, a hypervisor secure key that enables read-access of the secure storage device.

3. The non-transitory computer-readable medium of claim 1, wherein to verify that the configuration of the first hypervisor execution context is recognized by the hypervisor,non-transitory computer- readable medium stores further computer-readable instructions that, when executed by the processor, cause the processor to: access a boot configuration of the first hypervisor execution context; and determine that the boot configuration of the first hypervisor execution context is a recognized boot configuration for the first hypervisor execution context.

4. The non-transitory computer-readable medium of claim 1, wherein Al model includes a neural network model, a set of weights for the neural network model, a vector database, a prompt template, or a combination thereof.

5. The non-transitory computer- readable medium of claim 1, wherein the computer-readable instructions, when executed by the processor, further cause the processor to: provide, with the hypervisor, a disk encryption key to the first hypervisor execution context, wherein the disk encryption key enables the first hypervisor execution context to modify the secure storage device.

6. The non-transitory computer-readable medium of claim 5, wherein the computer-readable instructions, when executed by the processor, further cause the processor to: generate, with the hypervisor, the disk encryption key from a hypervisor secure key stored in a trusted platform module of the edge computing device and an information item associated with a boot configuration of the first hypervisor execution context.

7. An edge computing device comprising: a computer-readable memory; an artificial intelligence (Al) processor; and a computer processor in communication with the computer-readable memory, wherein the computer processor is to: configure, with a hypervisor, first secure storage within the computer-readable memory, wherein: the first secure storage is authenticated with the hypervisor, read-access to the first secure storage is restricted, and the first secure storage is protected from logical tampering;virtualize, with the hypervisor, the Al processor into a virtualized Al processor, wherein the virtualized Al processor is protected from logical tampering; instantiate, with the hypervisor, a first hypervisor execution context , wherein the first hypervisor execution context has access to the first secure storage in the computer-readable memory and the virtualized Al processor; verify, with the hypervisor, that the first hypervisor execution context is in a configuration recognized by the hypervisor; in response to verifying that the first hypervisor execution context is in a configuration recognized by the hypervisor, load, with the hypervisor, a first Al model to the first secure storage of the computer-readable memory; and provide, with the hypervisor, the first hypervisor execution context access to the first Al model loaded in the first secure storage of the computer-readable memory, wherein in response to a first request to execute the first Al model, the first hypervisor execution context executes the first Al model with the virtualized Al processor.

8. The edge computing device of claim 7, wherein the first Al model is an encrypted Al model, and wherein the computer processor further is to: in response to loading the first Al model to the first secure storage, decrypt, with the first hypervisor execution context, the first Al model.

9. The edge computing device of claim 7, wherein the computer processor further is to: determine, with the hypervisor, that a request to terminate the first hypervisor execution context has been received; and in response to the request to terminate the first hypervisor execution context, delete contents of the first secure storage.

10. The edge computing device of claim 7, wherein the computer processor further is to: configure, with a hypervisor, second secure storage within the computer-readable memory, wherein:the second secure storage is authenticated with the hypervisor, read-access to the second secure storage is restricted, and the second secure storage is protected from logical tampering; instantiate, with the hypervisor, a second hypervisor execution context, wherein the second hypervisor execution context has access to the second secure storage in the computer-readable memory, and wherein the second hypervisor execution context is prohibited from modifying the first secure storage; verify, with the hypervisor, that the second hypervisor execution context is in a configuration recognized by the hypervisor; in response to verifying that the second hypervisor execution context is in a configuration recognized by the hypervisor, load, with the hypervisor, a second Al model to the second secure storage in the computer-readable memory; and provide, with the hypervisor, the second hypervisor execution context access to the Al model loaded in the second secure storage of the computer-readable memory, wherein in response to a second request to execute the second Al model, the second hypervisor execution context executes the second Al model with the virtualized Al processor.

11. A non-transitory computer-readable medium storing computer-readable instructions that, when executed by a processor, cause the processor to: receive a request for an artificial intelligence (Al) model from an edge computing device; in response to the request, select an encrypted Al model from a library including an available Al model, and transmit the encrypted Al model to the edge computing device; receive, from a hypervisor execution context instantiated by the edge computing device, configuration information for the hypervisor execution context, wherein the hypervisor execution context is to execute the encrypted Al model transmitted to the edge computing device,authenticate a configuration of the hypervisor execution context based on the configuration information received from the hypervisor execution context instantiated by the edge computing device; and in response to authenticating the configuration of the hypervisor execution context, transmit a decryption key to the hypervisor execution context instantiated by the edge computing device, wherein the decryption key enables the hypervisor execution context to decrypt and execute the encrypted Al model transmitted to the edge computing device.

12. The non-transitory computer-readable medium of claim 11, wherein the non-transitory computer-readable medium stores further computer-readable instructions that, when executed by the processor, cause the processor to: identify an additional data item associated with operation of the Al model; generate an Al model package comprising the additional data item and the Al model; and encrypt the Al model package into an encrypted Al model package, wherein to transmit the encrypted Al model to the edge computing device, the processor is to transmit the Al model package transmit the encrypted Al model package to the edge computing device, and wherein the decryption key further enables the hypervisor execution context to decrypt the encrypted Al model package.

13. The non-transitory computer-readable medium of claim 12, wherein the additional data item comprises a set of weights for a neural network model, a vector database, a prompt template, or a combination thereof.

14. The non-transitory computer-readable medium of claim 11, wherein the non-transitory computer-readable medium stores further computer-readable instructions that, when executed by the processor, cause the processor to transmit computer-readable instructions for an interaction layer between the Al model and the hypervisor execution context instantiated by the edge computing device.

15. The non-transitory computer-readable medium of claim 11, wherein the configuration information comprises attestation logs of the hypervisor execution context, adevice identifier of the edge computing device, a certificate provided to the hypervisor execution context, or a combination thereof.

Images