Ensuring the integrity and confidentiality of task-based model execution

Abstract

In some examples, a method comprises encrypting foundation AI model parameters using a first shared symmetric secret between foundation AI model apparatus and AI accelerator apparatus, encrypting fine-tune AI data using a second shared symmetric secret between fine-tune AI data apparatus and the AI accelerator apparatus, and generating, by the AI accelerator apparatus, a fine-tuned AI model using the encrypted foundation AI model parameters and the encrypted fine-tune AI data.

Description

[0001] ENSURING THE INTEGRITY AND CONFIDENTIALITY OF TASK-BASED MODEL EXECUTION

[0002] TECHNICAL FIELD

[0003] The present disclosure relates, in general, to the field of confidential computing. Aspects of the disclosure relate to ensuring the integrity and confidentiality of task-based model execution in Al (artificial intelligence) and machine learning environments.

[0004] BACKGROUND

[0005] Confidential computing is a technology designed to protect sensitive data and computations from unauthorised access or tampering, even in environments where the underlying infrastructure may be compromised. It ensures that data remains encrypted while in use, safeguarding it from threats within the operating system, hypervisor, and other software layers. The importance of confidential computing lies in its ability to provide a secure execution environment, particularly for tasks involving sensitive or confidential information, such as financial data processing, medical records analysis, or Al model execution. As organisations increasingly move workloads to cloud environments, the demand for robust methods to protect data during processing has grown, making confidential computing a critical solution for securing data in untrusted or shared infrastructures.

[0006] Existing confidential computing solutions typically employ trusted execution environments (TEEs) to establish secure enclaves, where computations are carried out in isolation, thus protecting the data and models from an untrusted operating system and hypervisor. However, while these TEEs provide enhanced security by reducing the trusted computing base, they do not adequately address the integrity of tasks submitted to Al accelerators. Currently, there is no secure mechanism to ensure that the tasks executed by the Al accelerator correspond to the correct operator binary, which is essential for preserving model integrity. This oversight presents a critical security risk, as incorrect or malicious tasks could compromise the outcomes of computations.

[0007] Furthermore, state-of-the-art solutions are typically platform-specific, supporting only certain processors or accelerators (e.g., CPUs and Al accelerators), thereby limiting their applicability in more diverse computing environments. This platform dependency is a significant drawback, especially given the increasing use of heterogeneous computing architectures involving various combinations of CPUs, GPUs, and Al accelerators.

[0008] Historically, confidential computing has relied on cryptographic methods like Yao’s garbled circuits, oblivious transfer, and zero-knowledge proofs, which offer provable security guarantees. However, these methods are often too resource-intensive to be practical in modem environments due to the high computational, memory, and communication overheads. Trusted execution environments offer a more balanced approach by leveraging the "silicon root of trust" (S-RoT), which allows the processor package to be trusted while considering the rest of the system untrusted.

[0009] In addition, TEEs offer remote attestation, a security mechanism that allows a remote verifier to confirm that the correct code is running on the platform. In systems like Intel SGX, remote attestation involves verifying both the CPU version number and the public key of the enclave. However, while this process provides some assurance regarding the legitimacy of the enclave, it does not extend to verifying the integrity of tasks executed on Al accelerators, further highlighting the limitations of existing solutions. While TEEs and cryptographic techniques provide a foundation for confidential computing, current solutions fall short in ensuring the integrity of task-based model execution, particularly in Al accelerators. This highlights the need for a more comprehensive solution that guarantees task correctness and secure execution across a range of platforms.

[0010] SUMMARY

[0011] An objective of the present disclosure is to improve the integrity and confidentiality of task-based model execution in Al and machine learning environments.

[0012] The foregoing and other objectives are achieved by the features of the independent claims.

[0013] Further implementation forms are apparent from the dependent claims, the description and the Figures.

[0014] A first aspect of the present disclosure provides a method comprising encrypting foundation Al model parameters using a first shared symmetric secret between foundation Al model apparatus and Al accelerator apparatus, encrypting fine-tune Al data using a second shared symmetric secret between fine-tune Al data apparatus and the Al accelerator apparatus, and generating, by the Al accelerator apparatus, a fine-tuned Al model using the encrypted foundation Al model parameters and the encrypted fine-tune Al data.

[0015] The method may further comprise encrypting fine-tuned Al model parameters using both the first and second shared symmetric secrets.

[0016] The method may further comprise transmitting the fine-tuned Al model with the encrypted fine-tuned Al model parameters from the Al accelerator apparatus.

[0017] The encrypting of the fine-tuned Al model parameters may be done using a secret key of the Al accelerator apparatus.

[0018] The encrypting of the fine-tuned Al model parameters may be done using XORs of the first shared symmetric secret, the second shared symmetric secret, and the secret key of the Al accelerator apparatus.

[0019] The encrypting of the fine-tuned Al model parameters may be done based at least in part on the root-of-trust of the Al accelerator apparatus.

[0020] The fine-tuned Al model parameters of the fine-tuned Al model may be encrypted so as to be usable only on a specific Al accelerator apparatus or set of Al accelerator apparatuses.

[0021] The first shared symmetric secret may include a symmetric encryption key which is exchanged between the foundation Al model apparatus and the Al accelerator apparatus using Diffie-Hellman key exchange.

[0022] The second shared symmetric secret may include a symmetric encryption key which is exchanged between the fine-tune Al data apparatus and the Al accelerator apparatus using Diffie-Hellman key exchange.

[0023] A second aspect of the present disclosure provides a system comprising an Al model apparatus, a fine-tune Al data apparatus, and an Al accelerator apparatus, collectively configured to perform a method described herein.

[0024] A third aspect of the present disclosure provides an Al accelerator apparatus configured to receive encrypted foundation Al model parameters which have been encrypted using a first shared symmetric secret between foundation external Al model apparatus and the Al accelerator apparatus, receive encrypted fine-tune Al data which has been encrypted using a second shared symmetric secret between external fine-tune Al data apparatus and the Al accelerator apparatus, generate a fine-tuned Al model using the encrypted foundation Al model parameters and the encrypted fine-tune Al data. The Al accelerator apparatus may be further configured to encrypt fine-tuned Al model parameters using both the first and second shared symmetric secrets.

[0025] The Al accelerator apparatus may be further configured to transmit the fine-tuned Al model with the encrypted fine-tuned Al model parameters from the Al accelerator apparatus to external apparatus.

[0026] The Al accelerator apparatus may be in the form of a GPU card or an Al accelerator card.

[0027] A fourth aspect of the present disclosure provides a fine-tune Al data apparatus configured to encrypt fine-tune Al data using a second shared symmetric secret between fine-tune Al data apparatus and the Al accelerator apparatus, transmit the encrypt fine-tune Al data to the Al accelerator apparatus, and receive a fine-tuned Al model with the encrypted fine-tuned Al model parameters from the Al accelerator apparatus.

[0028] These and other aspects of the invention will be apparent from the embodiments) described below.

[0029] BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order that the present invention may be more readily understood, embodiments of the invention will now be described, by way of example, with reference to the accompanying drawings, in which:

[0031] Figure 1 is a flow chart of a method according to an example; and

[0032] Figure 2 is a schematic representation of a system according to an example.

[0033] DETAILED DESCRIPTION

[0034] Example embodiments are described below in sufficient detail to enable those of ordinary skill in the art to embody and implement the systems and processes herein described. It is important to understand that embodiments can be provided in many alternate forms and should not be construed as limited to the examples set forth herein.

[0035] Accordingly, while embodiments can be modified in various ways and take on various alternative forms, specific embodiments thereof are shown in the drawings and described in detail below as examples. There is no intent to limit to the particular forms disclosed. On the contrary, all modifications, equivalents, and alternatives falling within the scope of the appended claims should be included. Elements of the example embodiments are consistently denoted by the same reference numerals throughout the drawings and detailed description where appropriate.

[0036] The terminology used herein to describe embodiments is not intended to limit the scope. The articles “a,” “an,” and “the” are singular in that they have a single referent, however the use of the singular form in the present document should not preclude the presence of more than one referent. In other words, elements referred to in the singular can number one or more, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises,” “comprising,” “includes,” and / or “including,” when used herein, specify the presence of stated features, items, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, items, steps, operations, elements, components, and / or groups thereof.

[0037] Unless otherwise defined, all terms (including technical and scientific terms) used herein are to be interpreted as is customary in the art. It will be further understood that terms in common usage should also be interpreted as is customary in the relevant art and not in an idealized or overly formal sense unless expressly so defined herein.

[0038] As a continuation of the discussion on confidential computing, it is essential to explore the role of TEEs in the context of graphics processing units (GPUs). GPUs, widely used for high-performance computing and AI / ML workloads, are increasingly relevant to confidential computing due to their substantial computational capabilities. While TEEs have been predominantly implemented in CPUs, recent efforts have extended their application to GPUs. However, these solutions face significant challenges.

[0039] Implementing TEEs on GPUs requires extensive hardware modifications to achieve the necessary level of isolation for both security and performance. GPUs are architecturally different from CPUs and are designed to handle massively parallel computations, making it more complex to isolate individual tasks or workloads. This need for significant hardware changes not only complicates deployment but also introduces performance overheads that can diminish the efficiency of GPU-accelerated workloads. These challenges highlight the limitations of existing TEE implementations on GPUs and underscore the need for improved mechanisms to ensure security without compromising performance.

[0040] Machine learning and neural networks have become a critical workload across a wide range of applications, from consumer devices to high-performance computing servers. These workloads typically run on specialised hardware such as Al accelerators, GPUs, and FPGAs. Confidential computing, in this context, ensures that sensitive data and models are protected during execution, even when performed on untrusted hardware or in shared cloud environments. With the rise of cloud services, confidential computing has emerged as a major offering from leading cloud providers, particularly in conjunction with AI / ML applications.

[0041] Confidential computing provides hardware-enforced security, protecting sensitive data and models from compromised software stacks, and minimising the need for trust in the underlying infrastructure. In the context of AI / ML, there are three primary scenarios where confidential computing plays a critical role: outsourced training, Al as a service, and confidential training and fine-tuning.

[0042] 1. Outsourced Training: In this scenario, the model and data provider lacks the computational resources necessary to train the model. As a result, the provider outsources both the model and data to an untrusted cloud provider. The objective is to train the model without exposing it to the cloud provider, ensuring that the data remains confidential from both the cloud provider and the model owner. The challenge here lies in maintaining data and model confidentiality throughout the training process, which typically involves significant computational resources.

[0043] 2. Al as a Service: In this scenario, the cloud provider acts as the model owner and offers the model, associated software stack, and computational resources for inference. The data provider submits confidential inference data to the cloud, and the inference is executed within the cloud environment. The result is returned to the data provider, but the key objective is to ensure that the inference data remains confidential from the cloud provider itself, despite being processed within the cloud.

[0044] 3. Confidential Training and Fine-Tuning: In this scenario, the model provider supplies a base model along with the necessary training or fine-tuning framework. The data provider possesses additional data to fine-tune the model. This fine-tuning can be performed either on the data provider’s own computing infrastructure or within the cloud, depending on the computational demands. The goal is to maintain the confidentiality of both the base model and the additional data. Specifically, the base model must be protected from the data provider and the cloud provider, while the data used for fine-tuning must remain confidential from both the model provider and the cloud provider.

[0045] These three scenarios represent the key challenges associated with confidential AI / ML, where sensitive models and data must be processed in environments that are not fully trusted. The ability to maintain confidentiality and integrity throughout these processes, particularly when using powerful but complex hardware such as GPUs and Al accelerators, is essential to the continued advancement of confidential computing in AI / ML applications. However, as previously noted, existing solutions, especially in the context of GPUs, are hindered by the significant hardware modifications required for implementing TEEs, which further complicates efforts to achieve secure and efficient confidential AI / ML. Consequently, there is a critical need for more adaptable and performance-optimised solutions that can ensure confidentiality without sacrificing the computational advantages provided by GPUs and other accelerators.

[0046] According to an example, there is provided a mechanism to enable confidential fine-tuning of Al models in a privacy-preserving manner. More specifically, aspects relate to the use of interactive protocols to generate NPU-specific keys derived from both the foundation model owner and the fine-tuner's keys. For instance, the updated model parameters can be encrypted using these NPU-specific keys, ensuring that neither the foundation model owner nor the fine-tuner can decrypt the fine-tuned parameters. This mechanism advantageously opens up a new business model where the foundation model owner can securely share the model without revealing sensitive parameters, and the fine-tuner can fine-tune and utilise the model without exposing the underlying data. In contrast to existing solutions, which rely on standard trusted execution environments for secure computation within specific enclaves, the proposed solution enables platform-independent confidential fine-tuning. Existing approaches are limited by platform dependency, typically confined to CPUs or Al accelerators, whereas this solution is both cloud and device agnostic, providing a more versatile and secure framework for Al model fine-tuning.

[0047] Examples in the present disclosure can be provided as methods, systems or machine-readable instructions, such as any combination of software, hardware, firmware or the like. Such machine-readable instructions may be included on a computer readable storage medium (including but not limited to disc storage, CD-ROM, optical storage, etc.) having computer readable program codes therein or thereon.

[0048] The present disclosure is described with reference to flow charts and / or block diagrams of the method, devices and systems according to examples of the present disclosure. Although the flow diagrams described above show a specific order of execution, the order of execution may differ from that which is depicted. Blocks described in relation to one flow chart may be combined with those of another flow chart. In some examples, some blocks of the flow diagrams may not be necessary and / or additional blocks may be added. It shall be understood that each flow and / or block in the flow charts and / or block diagrams, as well as combinations of the flows and / or diagrams in the flow charts and / or block diagrams can be realized by machine readable instructions.

[0049] The machine-readable instructions may, for example, be executed by a machine such as a general-purpose computer, user equipment such as a smart device, e.g., a smart phone, a special purpose computer, an embedded processor or processors of other programmable data processing devices to realize the functions described in the description and diagrams. In particular, a processor or processing apparatus may execute the machine-readable instructions. Thus, modules of apparatus (for example, a module implementing a comparator unit, or a firewall structure and so on) may be implemented by a processor executing machine readable instructions stored in a memory, or a processor operating in accordance with instructions embedded in logic circuitry. The term 'processor' is to be interpreted broadly to include a CPU, processing unit, ASIC, logic unit, or programmable gate set etc. The methods and modules may all be performed by a single processor or divided amongst several processors.

[0050] Such machine-readable instructions may also be stored in a computer readable storage that can guide the computer or other programmable data processing devices to operate in a specific mode. For example, the instructions may be provided on a non- transitory computer readable storage medium encoded with instructions, executable by a processor.

[0051] There may be three mutually distrusting parties involved in a confidential fine-tuning process of a model: the foundation model owner, the fine-tuner who provides sensitive data to fine-tune the foundation model, and the infrastructure provider, such as a cloud service provider. The model provider may send an encrypted model to the Al infrastructure for further processing. The foundation model provider may be responsible for developing and training the foundation model. This foundation model may then be fine-tuned for specific large language model application scenarios, such as chatbots, code generation, or image generation. In the process, the fine-tuner may send sensitive data in encrypted form to the Al infrastructure in order to finetune the foundation model.

[0052] The model and the data may be encrypted using two symmetric keys, one shared between the model provider and the hardware, and the other shared between the data provider and the hardware. In this scenario, all other components of the software stack, including the operating system, hypervisor, and any other applications, may be considered untrusted.

[0053] The foundation model provider, fine-tuner, and infrastructure provider may remain mutually distrusting. The foundation model provider may develop the Al model and deploy it to the cloud infrastructure for fine-tuning. The model may be regarded as the intellectual property of the foundation model provider, and, as such, the internal structure of the model, including its layers, operator binaries, and parameters (such as weights and biases), may not be made public.

[0054] The fine-tuner may contribute sensitive intellectual property data to fine-tune the foundation model for a specific LLM use case on the cloud infrastructure. The infrastructure provider, such as a cloud service provider, may provision the necessary physical machines where both the model and the data are sent by the respective providers. The cloud provider may also ensure the appropriate network and other configurations for running the workloads as intended.

[0055] All hardware, except the CPU cores where the application is deployed and the specific Ascend Al accelerator, may be considered untrusted. Furthermore, it may be assumed that no trusted execution environment exists for the CPU where the user’s workload could be deployed. The host CPU and its privileged software stack, including the firmware and hypervisor, may be regarded as potentially attacker-controlled.

[0056] The foundation model owner may provide a model that has been trained using extensive datasets, which may include sensitive personal information, business secrets, or other intellectual property. Consequently, the model itself may be considered a primary IP asset of the foundation model provider. Conversely, the fine-tuner may seek to fine-tune this foundation model with sensitive data that they own, leading to a lack of trust between the foundation model provider and the fine-tuner regarding the confidentiality of the model and data.

[0057] After fine-tuning, only a portion of the foundation model’s parameters may be updated to reflect the modifications. If the foundation model owner gains access to these updated parameters, they may be able to infer sensitive information by calculating the differences between the original and updated parameters, potentially conducting membership inference attacks to expose the fine-tuned data. Conversely, if the fine-tuner gains access to the updated parameters, they may be able to approximate the gradient from their own fine-tuned dataset, potentially recovering the original foundation model parameters and compromising the confidentiality of the foundation model.

[0058] To address the above-described issue, figure 1 is a flow chart of a method according to an example. The method comprises, in block 101, encrypting foundation Al model parameters using a first shared symmetric secret between foundation Al model apparatus and Al accelerator apparatus.

[0059] The foundation Al model apparatus may comprise an apparatus configured to store, manage, and process Al models, specifically responsible for the development and deployment of the foundation model. The Al accelerator apparatus may comprise a specialised processing unit, such as a neural processing unit (NPU), optimised for Al workloads.

[0060] In block 102, the method comprises encrypting fine-tune Al data using a second shared symmetric secret between fine-tune Al data apparatus and the Al accelerator apparatus. The fine-tune Al data apparatus may comprise an apparatus that manages sensitive data used to fine-tune the foundation Al model. The second shared symmetric secret may comprise a symmetric encryption key exchanged using the Diffie-Hellman key exchange, denoted as KD, between the fine-tune Al data apparatus and the Al accelerator apparatus. Similar to the foundation Al model encryption process, the fine-tune Al data apparatus may generate a random value SD, which may be encrypted using the shared key KDto create the encrypted value S2. The Al accelerator apparatus may then decrypt S2to recover SD. The process may involve the fine-tune Al data apparatus having its own root key pair, including a secret key (SKD) and a public key (PKD), which is used to securely establish the shared secret with the Al accelerator apparatus.

[0061] The method comprises, in block 103, generating, by the Al accelerator apparatus, a fine-tuned Al model using the encrypted foundation Al model parameters and the encrypted fine-tune Al data. The Al accelerator apparatus may utilise the decrypted values SMand SDto produce a fine-tuned model by applying the fine-tuning process to the foundation Al model. A combined secret SMtDmay be generated by the Al accelerator apparatus, which may involve combining the values of SMand SDwith a further Al accelerator-generated value, such as SA, which may be derived from the Al accelerator’s root key pair. This combined secret may ensure that neither the foundation model provider nor the fine-tuner can independently access the final fine-tuned model parameters, thus preserving the confidentiality of both the model and the fine-tuning data.

[0062] The method may further comprise encrypting the fine-tuned Al model parameters using both the first and second shared symmetric secrets. This encryption process may involve XORing (exclusive OR) the first shared symmetric secret, the second shared symmetric secret, and a secret key unique to the Al accelerator apparatus. XORing is a bitwise operation that compares corresponding bits of two binary values. When the bits are different (one is 0, and the other is 1 ), the XOR operation returns a 1 ; when the bits are the same (both 0 or both 1 ), it returns a 0.

[0063] By XORing the first shared symmetric secret, the second shared symmetric secret, and the Al accelerator’s secret key, the method combines the entropy (randomness) from each key to produce a stronger composite encryption key. This process ensures that even if one secret were compromised, the encrypted model parameters would remain secure due to the other contributing keys. The use of XORing allows for a lightweight and efficient method to combine multiple secrets without requiring complex encryption algorithms, ensuring the fine-tuned Al model parameters remain securely tied to the Al accelerator apparatus.

[0064] This combined encryption mechanism may leverage the Al accelerator's root-of-trust, ensuring that the fine-tuned Al model parameters are securely tied to the specific Al accelerator that performed the fine-tuning. The fine-tuned Al model parameters may be encrypted so that they are usable only on the same Al accelerator apparatus or a specific set of Al accelerator apparatuses, thereby limiting the exposure of the fine-tuned model to other untrusted hardware or platforms. The method may also comprise transmitting the fine-tuned Al model, with the encrypted fine-tuned Al model parameters, from the Al accelerator apparatus to both the foundation model owner and the fine-tuner. This step may ensure that both parties receive the fine-tuned model without compromising the security of the updated model parameters. The fine-tuned model parameters may be securely encrypted using the Al accelerator’s secret key in conjunction with the shared symmetric secrets, providing an additional layer of security based on the Al accelerator’s root-of-trust.

[0065] Furthermore, in certain implementations, the method may include provisions for enforcing expiration constraints or usage limits on the fine-tuning process. The foundation model owner may append a counter or expiration timing to the encrypted fine-tuned model, ensuring that the model can only be fine-tuned a limited number of times. The updated counter may be encrypted and appended to the fine-tuned weights, which are then transmitted back to both the foundation model owner and the fine-tuner for validation before any further fine-tuning can occur. This feature may provide enhanced control and security, ensuring that the fine-tuned model is used only as intended and within the defined parameters.

[0066] Figure 2 is a schematic representation of a system according to an example. The system 200 may comprise a fine-tuned Al model 201, which may have been fine-tuned using a fine-tuning process 202 executed by Al accelerator apparatus 203. The fine-tuning may be carried out using encrypted foundation Al model parameters 204, which may be received from a foundation Al model apparatus 205, such as one operated by a foundation model owner.

[0067] In the depicted system, the foundation model owner 205 may provide the encrypted foundation model 204, which may be transferred to the Al accelerator apparatus 203. The encrypted foundation Al model parameters 204 may have been encrypted using a first shared symmetric secret between the foundation Al model apparatus 205 and the Al accelerator apparatus 203.

[0068] Additionally, encrypted fine-tune Al data 206 may be provided by a fine-tune Al data apparatus 207, representing the fine- tuner. The fine-tune Al data 206 may have been encrypted using a second shared symmetric secret between the fine-tune Al data apparatus 207 and the Al accelerator apparatus 203.

[0069] In the system, after the Al accelerator apparatus 203 processes the encrypted foundation model parameters 204 and the encrypted fine-tune Al data 206, the result may be the fine-tuned Al model 201. The fine-tuned Al model parameters may be encrypted using both the first and second shared symmetric secrets and may be securely tied to the specific Al accelerator apparatus 203.

[0070] The final fine-tuned model 201 may be stored securely and may be transmitted back to both the foundation model owner 205 and the fine-tuner 207. The encryption of the fine-tuned Al model parameters may also ensure that the model is only usable on a specific Al accelerator apparatus or a set of Al accelerator apparatuses.

[0071] The Al accelerator apparatus 203 is configured to receive encrypted foundation Al model parameters 204, which have been encrypted using a first shared symmetric secret between the foundation Al model apparatus 205 and the Al accelerator apparatus 203. It is further configured to receive encrypted fine-tune Al data 206, which has been encrypted using a second shared symmetric secret between the fine-tune Al data apparatus 207 and the Al accelerator apparatus 203, and to generate a fine-tuned Al model 201 using the encrypted foundation Al model parameters 204 and the encrypted fine-tune Al data 206.

[0072] The fine-tune Al data apparatus 207 is configured to encrypt fine-tune Al data 206 using a second shared symmetric secret between the fine-tune Al data apparatus 207 and the Al accelerator apparatus 203. It is also configured to transmit the encrypted fine-tune Al data 206 to the Al accelerator apparatus 203 and to receive the fine-tuned Al model 201 with the encrypted finetuned Al model parameters from the Al accelerator apparatus 203. According to an example, machine-readable instructions can be loaded onto a computer or other programmable data processing devices, so that the computer or other programmable data processing devices perform a series of operations to produce computer-implemented processing, thus the instructions executed on the computer or other programmable devices provide an operation for realizing functions specified by flow(s) in the flow charts and / or block(s) in the block diagrams.

[0073] Further, the teachings herein may be implemented in the form of a computer or software product, such as a non-transitory machine-readable storage medium, the computer software or product being stored in a storage medium and comprising a plurality of instructions, e.g., machine readable instructions, for making a computer device implement the methods recited in the examples of the present disclosure.

[0074] In some examples, some methods can be performed in a cloud-computing or network-based environment. Cloud-computing environments may provide various services and applications via the Internet. These cloud-based services (e.g., software as a service, platform as a service, infrastructure as a service, etc.) may be accessible through a web browser or other remote interface of the user equipment for example. Various functions described herein may be provided through a remote desktop environment or any other cloud-based computing environment.

[0075] While various embodiments have been described and / or illustrated herein in the context of fully functional computing systems, one or more of these exemplary embodiments may be distributed as a program product in a variety of forms, regardless of the particular type of computer-readable-storage media used to actually carry out the distribution. The embodiments disclosed herein may also be implemented using software modules that perform certain tasks. These software modules may include script, batch, or other executable files that may be stored on a computer-readable storage medium or in a computing system. In some embodiments, these software modules may configure a computing system to perform one or more of the exemplary embodiments disclosed herein. In addition, one or more of the modules described herein may transform data, physical devices, and / or representations of physical devices from one form to another.

[0076] The preceding description has been provided to enable others skilled in the art to best utilize various aspects of the exemplary embodiments disclosed herein. This exemplary description is not intended to be exhaustive or to be limited to any precise form disclosed. Many modifications and variations are possible without departing from the spirit and scope of the instant disclosure. The embodiments disclosed herein should be considered in all respects illustrative and not restrictive. Reference should be made to the appended claims and their equivalents in determining the scope of the instant disclosure.

Claims

CLAIMS1. A method comprising : encrypting foundation Al model parameters using a first shared symmetric secret between foundation Al model apparatus and Al accelerator apparatus (101); encrypting fine-tune Al data using a second shared symmetric secret between fine-tune Al data apparatus and the Al accelerator apparatus (102); generating, by the Al accelerator apparatus, a fine-tuned Al model using the encrypted foundation Al model parameters and the encrypted fine-tune Al data (103).

2. A method according to claim 1 , further comprising: encrypting fine-tuned Al model parameters using both the first and second shared symmetric secrets.

3. A method according to claim 2, further comprising: transmitting the fine-tuned Al model with the encrypted fine-tuned Al model parameters from the Al accelerator apparatus.

4. A method according to claim 2 or claim 3 wherein the encrypting of the fine-tuned Al model parameters is done using a secret key of the Al accelerator apparatus.

5. A method according to claim 2 to claim 4 wherein the encrypting of the fine-tuned Al model parameters is done using XORs of the first shared symmetric secret, the second shared symmetric secret, and the secret key of the Al accelerator apparatus.

6. A method according to any of claims 2 to 5 wherein the encrypting of the fine-tuned Al model parameters is done based at least in part on the root-of-trust of the Al accelerator apparatus.

7. A method according to any of claims 2 to 6 wherein the fine-tuned Al model parameters of the fine-tuned Al model are encrypted so as to be usable only on a specific Al accelerator apparatus or set of Al accelerator apparatuses.

8. A method according to any preceding claim wherein the first shared symmetric secret includes a symmetric encryption key which is exchanged between the foundation Al model apparatus and the Al accelerator apparatus using Diffie-Hellman key exchange.

9. A method according to any preceding claim wherein the second shared symmetric secret includes a symmetric encryption key which is exchanged between the fine-tune Al data apparatus and the Al accelerator apparatus using Diffie-Hellman key exchange.

10. A system (200) comprising Al model apparatus (205), a fine-tune Al data apparatus (207), and Al accelerator apparatus (203), collectively configured to perform a method as claimed in any preceding claim.

11. Al accelerator apparatus (203) configured to: receive encrypted foundation Al model parameters (204) which have been encrypted using a first shared symmetric secret between foundation external Al model apparatus (205) and the Al accelerator apparatus (203); receive encrypted fine-tune Al data (206) which has been encrypted using a second shared symmetric secret between external fine-tune Al data apparatus (207) and the Al accelerator apparatus (203); generate a fine-tuned Al model (201 ) using the encrypted foundation Al model parameters (204) and the encrypted fine-tune Al data (206).

12. Al accelerator apparatus (203) according to claim 11 further configured to: encrypt fine-tuned Al model parameters (204) using both the first and second shared symmetric secrets.

13. Al accelerator apparatus (203) according to claim 12 further configured to: transmit the fine-tuned Al model (201 ) with the encrypted fine-tuned Al model parameters (204) from the Al accelerator apparatus (203) to external apparatus.

14. Al accelerator apparatus according to claims 11 to 14 in the form of a GPU card or an Al accelerator card.

15. A fine-tune Al data apparatus (207) configured to : encrypt fine-tune Al data (206) using a second shared symmetric secret between fine-tune Al data apparatus (207) and the Al accelerator apparatus (203); transmit the encrypt fine-tune Al data (206) to the Al accelerator apparatus (203); and receive a fine-tuned Al model (201) with the encrypted fine-tuned Al model parameters from the Al accelerator apparatus (203).

Images