AI Model Inference Security via Environment-Aware Feature Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Commercially distributed AI models in blackbox environments are vulnerable to model extraction attacks, which can lead to the leakage of training data information and degradation of model performance, as attackers can create alternative models similar to the target model, making them susceptible to various attacks.
Innovation Solution
An AI model inference method and apparatus that determines whether a target model is in a graybox or blackbox environment, processes output values differently based on the environment, and uses pre-trained model type classifiers to accurately infer the AI model, thereby enhancing security by limiting information available to attackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If AI models are distributed in a blackbox state to protect intellectual property rights, then model security is improved, but model extraction attacks become more difficult to detect and prevent
Solution Approach 1:
The patent applies preliminary action by embedding watermarks and authentication mechanisms into the AI model before distribution. The system performs model authentication and watermark verification in advance, allowing detection of extraction attacks before they can compromise the model. This includes pre-configuring security features that enable tracking and identification of unauthorized model copies.
Solution Approach 2:
The patent uses an intermediary approach by introducing a model authentication server and security module that acts as a mediator between the model distributor and users. This intermediary system verifies model integrity, detects extraction attempts, and manages authentication credentials without exposing the core model architecture, thus maintaining security while enabling attack detection.
2Loss of information
If model information is hidden to prevent attacks, then intellectual property protection is improved, but the ability to detect model extraction attacks deteriorates
Solution Approach 1:
The patent uses copying by creating watermarked versions of the model that contain embedded authentication information. These watermarked copies allow detection of extraction attacks while the core model information remains protected. The watermark acts as a detectable copy that can be traced back to the original model without revealing its full structure or parameters.
Solution Approach 2:
The patent applies local quality by embedding security features and watermarks in specific localized portions of the model rather than exposing the entire model structure. This allows attack detection through analysis of these localized security features while keeping the rest of the model information hidden and protected from extraction attacks.
3Ease of operation
If attackers can infer model type and layer composition, then model extraction attacks become easier, but security against inversion attacks and adversarial examples deteriorates
Solution Approach 1:
The patent applies preliminary anti-action by implementing authentication and authorization checks before allowing any model inference operations. The system verifies user credentials and model integrity in advance, blocking potential attacks before they can occur. This includes pre-validation of input data and pre-authentication of model requests to prevent extraction and inversion attacks.
Solution Approach 2:
The patent uses feedback by implementing continuous monitoring and verification mechanisms that provide feedback on model usage patterns. The system detects anomalies in inference requests and provides feedback to block suspicious operations. This includes real-time authentication verification and feedback loops that identify and prevent potential attacks while allowing legitimate operations.
Data Source
AI summary
disclosure An AI model inference apparatus includes: a processor; and a memory connected to the processor, wherein the memory stores program instructions executed by the processor to use an output value of a target model to determine whether the target model corresponds to any of a graybox environment or a blackbox environment, input the same data as the target model to a plurality of AI models included in a candidate model group to acquire the output value, process output values of each of the plurality of AI models differently according to the environment of the target model to acquire a first feature or a second feature, and input the output values of each of the plurality of AI models and the first feature or the second feature to a pre-trained model type classifier to determine the AI model corresponding to the target model.