AI System Hardening with Hidden Classes for Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
AI systems are vulnerable to various attacks, including model theft, adversarial inputs, and privacy leakage, due to their complex nature and lack of visibility into their operations and training data, posing risks to operators and users.
Innovation Solution
Implementing hardeners within AI systems to mitigate attack vectors such as model theft, adversarial inputs, and privacy exposure through techniques like output trimming, secure marking for digital rights management, and enhanced training methods to enhance data trust and privacy features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If AI systems are deployed to perform complex inference tasks, then system capability and productivity are improved, but vulnerability to attacks and security risks increase
Solution Approach 1:
The patent segments the AI system into multiple isolated components: a trusted execution environment (TEE) for secure model execution, a data processing layer for input/output handling, and separate secure storage for model weights and training data. This segmentation isolates critical AI assets in the TEE, preventing attackers from compromising the entire system through a single vulnerability point while maintaining full AI functionality.
Solution Approach 2:
The patent introduces a trusted execution environment as an intermediary between the AI model and external inputs/outputs. The TEE acts as a secure mediator that verifies input data integrity, executes the model in isolation, and protects output results. This intermediary layer blocks attack vectors such as adversarial inputs and model theft without interfering with the AI system's core inference capabilities.
2Loss of information
If AI systems operate as black boxes with hidden operations, then intellectual property is protected, but susceptibility to attacks and lack of visibility increase
Solution Approach 1:
The patent implements feedback mechanisms within the trusted execution environment that monitor and log AI operations. The system provides visibility into model execution status, input data validation results, and security event notifications without exposing the actual model weights or training data. This feedback loop enables operators to detect and respond to attacks while maintaining IP protection through encrypted model storage and TEE isolation.
3Object-affected harmful factors
If output trimming is applied to remove sensitive information, then privacy leakage is reduced, but information loss increases
Solution Approach 1:
The patent extracts and removes only the sensitive portions of AI outputs before releasing them to users, while preserving the essential useful information. The trusted execution environment identifies and redacts personally identifiable information, proprietary data, or other sensitive content from model predictions, maintaining privacy protection without completely discarding valuable output data. This selective extraction approach balances privacy requirements with information utility.
Data Source
AI summary
Techniques and apparatuses to harden AI systems against various attacks are provided. Among the different techniques and apparatuses, is provided, techniques and apparatuses that expand the domain for an inference model to include both visible classes and well as hidden classes. The hidden classes can be used to detect possible probing attacks against the model.