Hardware-Assisted AI Model Attestation Before Secure Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current AI systems lack sufficient control over the AI software stack, with AI models operating on compute elements without validation, leading to vulnerabilities and potential compromise due to unverified models or datasets, and lacking coordinated hardware, software, and infrastructure co-designs that ensure integrity and prevent tampering or unauthorized data access.
Innovation Solution
Implementing hardware assisted AI model attestation through a co-design approach that integrates software and hardware to verify the authenticity and integrity of AI models or runtimes using external entities and hardware APIs, ensuring only registered and trusted models are executed, preventing malicious or flawed models from compromising security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If AI models operate on compute elements without validation, then system performance and productivity are improved, but security and reliability deteriorate due to vulnerabilities and potential compromise
Solution Approach 1:
The patent applies preliminary action by performing attestation verification before AI model execution. The hardware accelerator checks cryptographic proofs of model authenticity and integrity in advance, ensuring only verified models are deployed. This prevents security issues before they can affect system productivity.
Solution Approach 2:
The patent introduces an intermediary attestation mechanism between model deployment and execution. Hardware-based attestation circuits verify cryptographic proofs as an intermediate step, acting as a trusted mediator that enables secure model operation without compromising execution performance.
2Reliability
If hardware assisted attestation is implemented, then system security and model verification are improved, but device complexity increases
Solution Approach 1:
The patent merges the attestation function with the existing hardware accelerator architecture. The attestation circuits are integrated into the AI accelerator, combining verification and execution functions in a unified hardware component. This reduces overall system complexity compared to separate verification systems.
Solution Approach 2:
The hardware accelerator performs self-attestation using built-in cryptographic proof verification capabilities. The system verifies its own model integrity using dedicated hardware circuits, eliminating the need for external verification systems and reducing overall device complexity.
3Reliability
If cryptographic verification is performed, then model authenticity and integrity are improved, but processing time and computational overhead increase
Solution Approach 1:
The patent replaces software-based cryptographic verification with hardware-accelerated attestation circuits. The hardware implementation performs cryptographic proofs much faster than software, reducing verification time from minutes to milliseconds while maintaining model authenticity.
Solution Approach 2:
The patent changes the verification parameter from full model re-computation to cryptographic proof validation. Instead of verifying model correctness through extensive computation, the system validates compact cryptographic proofs (signatures and hashes), dramatically reducing processing time while ensuring authenticity.
Data Source
AI summary
Aspects of hardware assisted artificial intelligence (AI) model attestation are described. A facility in a system, such as an AI accelerator chiplet in a chiplet assembly, can obtain an AI model for execution. The facility can derive a set of identifiers for the AI model and search a local repository to determine whether the AI model is already registered with the facility. Registration indicating that attestation verification has already been successfully completed. If the AI model is not registered, the facility can communicate the set of identifiers to an attestation authority and receive a confirmation from the attestation authority whether the AI model is authentic. If the AI model is authentic, then the facility registers the AI model.