AI Model Watermarking via Nested Kernel for Digital Rights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a lack of effective digital rights protection for artificial intelligence models, and there is no proof that the results produced by data processing accelerators are protected by a 'root of trust' system, making them vulnerable to unauthorized use and validation challenges.
Innovation Solution
Implementing a watermarking system within AI models and their outputs, where a watermark-enabled kernel is used to extract, implant, and inherit watermarks during training and inference processes, allowing the host device to validate the AI model's authenticity and digital rights without affecting inference operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If AI models are made portable and accessible for inference, then the utility and deployment flexibility of AI models is improved, but digital rights protection and authorization control deteriorate
Solution Approach 1:
The patent embeds a watermark module within the AI model structure itself, nesting the protection mechanism inside the model. The watermark is implanted into specific layers or nodes of the neural network, creating a nested structure where the protection is integrated within the model architecture, allowing the model to remain functional while carrying embedded authorization information
Solution Approach 2:
The patent introduces a watermark as an intermediary element that mediates between the AI model and the authorization system. The watermark serves as a carrier of authorization information that can be extracted and verified without interfering with the model's inference operations, enabling portable deployment while maintaining rights protection through this intermediate layer
2Productivity
If AI model processing tasks are delegated to secondary processing systems, then processing capability and scalability are improved, but proof of trust and root of trust validation deteriorate
Solution Approach 1:
The patent implements a feedback mechanism where the watermark embedded in the AI model can be extracted from the secondary processing system and verified against the authorized watermark. This creates a closed-loop validation system where the processing can be delegated to external systems, but trust is maintained through feedback verification of the watermark integrity
Solution Approach 2:
The patent applies preliminary action by embedding the watermark into the AI model before it is deployed to secondary processing systems. This pre-embedding ensures that the authorization proof is already in place within the model itself, allowing verification to occur after delegation without requiring complex trust establishment during runtime
3Reliability
If watermarking systems are implemented in AI models, then digital rights protection and authenticity verification are improved, but processing efficiency and model performance may deteriorate
Solution Approach 1:
The patent applies local quality by implanting the watermark in specific localized regions of the AI model, such as particular layers, nodes, or weight matrices, rather than modifying the entire model structure. This localized approach minimizes the impact on overall model performance while providing sufficient information for verification, as only specific portions of the model are modified to embed the watermark
Data Source
AI summary
In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator includes receiving, at the DP accelerator, first data representing an artificial intelligence (AI) model that has been previously trained from a host processor; receiving, at the DP accelerator, a request to implant a watermark in the AI model from the host processor; and implanting, by the DP accelerator, the watermark within the AI model. The DP accelerator then transmits second data representing the AI model having the watermark implanted therein to the host processor. In embodiment, the method further includes extracting, at the DP accelerator, a watermark algorithm identifier (ID) from the request to implant a watermark; and generating the watermark using a watermark algorithm identified by the watermark algorithm ID.