AI Model Protection via Kernel Module Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing AI model protection schemes are inadequate as they expose AI models when injected into or driven within the kernel of an operating system, leading to potential attacks and requiring secure OS support which is not flexible for mass production.
Innovation Solution
A system for model protection that includes a processor executing a guest virtual machine, a primary virtual machine, and a hypervisor, which manages protection settings and safety components to set a read-only mode for AI models, preventing modifications and ensuring integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If AI models are injected into or driven within the kernel of an operating system for inference, then the models can be efficiently executed, but the models become exposed and vulnerable to attacks
Solution Approach 1:
The patent introduces a kernel module as an intermediary layer between the AI model and the user space. This kernel module acts as a protected mediator that loads and executes the AI model in a secure environment within the kernel, preventing direct exposure of the model to user space attacks while maintaining efficient kernel-driven execution. The intermediary kernel module isolates the model from malicious user space processes.
2Object-affected harmful factors
If a crypted AI model is decrypted and executed in an isolated execution environment such as a trusted execution environment, then model security is improved, but the system requires secure OS support and has larger delay and less flexibility
Solution Approach 1:
The patent extracts the security-critical functions of model loading and execution into a dedicated kernel module that operates within the existing Linux kernel architecture. This extraction allows the system to achieve isolated execution protection without requiring a complete secure OS redesign or trusted execution environment, reducing system complexity while maintaining security.
Solution Approach 2:
The kernel module is designed to work with standard Linux kernel infrastructure and existing process management mechanisms, making it compatible with general-purpose operating systems without requiring specialized secure OS support. The module can handle multiple AI models and different execution scenarios, providing universal security protection across diverse use cases.
3Adaptability or versatility
If the AI model is driven in the kernel for mass production, then flexibility and speed are improved, but the model becomes vulnerable to modification and attacks
Solution Approach 1:
The patent implements preliminary protective measures by setting read-only memory attributes for the AI model code sections before execution begins. This preliminary anti-action prevents any subsequent modification attempts during kernel-driven execution, addressing potential integrity issues before they can occur while maintaining the flexibility of kernel-based deployment.
Data Source
AI summary
A system for model protection includes a processor. The processor is arranged to execute a guest virtual machine (VM), a primary VM, and a hypervisor. The guest VM includes a model, and is arranged to send at least one command to a command hub. The primary VM is arranged to refer to the at least one command sent from the command hub to manage and configure a protection setting for a protected model derived from the model. The hypervisor is arranged to receive a safety setting command sent by the primary VM, and manage and configure the safety protection component according to the safety setting command, to set a read-only mode of the protected model.