AI Model Execution Security in a GPU Trusted Execution Environment

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

AI/ML models are vulnerable to leaks of proprietary information during execution, particularly in the form of topology, model weights, biases, and parameters, which poses a risk to confidentiality and integrity.

Innovation Solution

Implement direct-to-accelerator security technologies and policies to protect AI/ML models and inferencing data on GPUs by establishing a Trusted Execution Environment (TEE) for secure I/O operations and using encryption keys for data isolation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If AI/ML models are executed on GPU for high performance, then productivity is improved, but confidentiality and integrity of models are compromised

Engineering Contradiction:

ImproveAI/ML inferencing performanceVSAvoidmodel confidentiality and integrity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system segments the GPU execution environment into isolated secure containers or virtual machines, separating trusted code and data from untrusted environments. This allows high-performance GPU execution while maintaining model confidentiality through spatial and logical isolation boundaries.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system introduces secure enclaves, trusted execution environments, or cryptographic intermediaries between the AI/ML models and the GPU execution environment. These intermediaries act as mediators that protect model integrity during execution while enabling high-performance comput

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If model data is transmitted and stored during execution, then productivity is improved, but data leaks of proprietary information occur

Engineering Contradiction:

ImproveAI/ML inferencing throughputVSAvoidproprietary data leakage

Core Design Contradiction:

ProductivityVSLoss of information

Solution Approach 1:

The system applies preliminary protective measures such as encryption, access control policies, and security protocols before data transmission and storage operations. This prevents proprietary information leakage while maintaining efficient data flow for AI/ML inferencing workloads.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The system dynamically changes security parameters such as encryption keys, access credentials, and isolation levels during different phases of model execution. This ensures data confidentiality is maintained while allowing high-performance data transmission and storage operations.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentEP4617923A1Preservation of confidentiality and integrity of models during execution

Publication Date: 2025.09.17 INTEL CORP

Figure 1
Figure 2A
Figure 2B~2C

AI summary

Preservation of confidentiality and integrity of models during execution is described. An example of an apparatus includes a memory to store data for processing of one or more artificial intelligence (AI) models for an application; and processing resources including a graphics processing unit (GPU); a trusted execution environment (TEE); and circuitry to protect confidentiality and integrity of AI models during execution. The circuitry includes circuitry to obtain an AI model from a model server, the AI model being encrypted; circuitry to obtain a model license and a model encryption key for the AI model; circuitry to decrypt the AI model utilizing the model encryption key, and to re-encrypt the AI model with a second encryption key; and circuitry to perform an inference process for the AI model to generate inference output data for the application.