AI Watermark Digital Signing via DP Accelerator Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a lack of effective digital rights protection for artificial intelligence models and a lack of proof that results produced by data processing accelerators are protected by a 'root of trust' system, leading to concerns about unauthorized use and verification of AI model authenticity.
Innovation Solution
The implementation of a watermarking system where a watermark is embedded within the AI model, allowing the host device to validate the AI model's authenticity by extracting and digitally signing the watermark using a secure channel and cryptographic module, ensuring that only the correct AI model is used for inference tasks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If AI models are made portable and accessible without authorization, then ease of operation and adaptability improve, but digital rights protection and model authenticity verification deteriorate
Solution Approach 1:
A watermark is embedded into the AI model during the training phase before deployment. This preliminary action ensures that authenticity verification can be performed later without affecting the model's portability or ease of operation. The watermark serves as a pre-prepared authentication mechanism that travels with the model.
Solution Approach 2:
A cryptographic module acts as an intermediary between the AI model and the verification system. The module digitally signs the extracted watermark and provides cryptographic proof of authenticity, enabling verification without requiring direct access to the model's internal structure or training data.
2Productivity
If AI model inference is delegated to secondary processing systems, then productivity and ease of operation improve, but verification of result authenticity and root of trust protection deteriorate
Solution Approach 1:
The watermark is extracted from the AI model's weights or structure before inference execution. This extracted watermark is then independently verified by the host system, separating the authentication function from the inference processing function and enabling verification of results produced by secondary processing systems.
Solution Approach 2:
The system implements a feedback mechanism where the cryptographic module verifies the watermark and provides authentication results back to the host system. This feedback loop ensures that only authenticated AI models can perform inference tasks, maintaining reliability while allowing productive delegation to secondary systems.
3Reliability
If watermark extraction and digital signing is implemented, then digital rights protection and model authenticity verification improve, but device complexity and processing time increase
Solution Approach 1:
The AI model essentially performs part of the authentication work itself by containing an embedded watermark that can be extracted and verified. The model's own structure serves as part of the authentication mechanism, reducing the need for external verification infrastructure and lowering overall system complexity.
Data Source
AI summary
In one embodiment, a computer-implemented method of a data processing (DP) accelerator obtaining a watermark of a watermark-enable artificial intelligence (AI) model includes receiving, by the DP accelerator, input data to the DP accelerator that causes the watermark-enabled AI model to extract the watermark from the watermark-enabled AI model; and providing the watermark of the watermark-enabled AI model to the host device. The DP accelerator can receive the model from the host device. The DP accelerator can further receive a command to digitally sign the watermark and call a security unit of the DP accelerator to digitally sign the watermark.