Kernel Watermarking for AI Model Rights Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a lack of effective digital rights protection for artificial intelligence models and a lack of proof that results produced by data processing accelerators are protected by a 'root of trust' system, leading to concerns about unauthorized use and trustworthiness of AI model inferences.
Innovation Solution
The implementation of a watermarking system where a watermark is embedded within AI models, allowing the host device to validate the AI model's authenticity and digital rights, using a watermark-enabled kernel to extract and sign the watermark, ensuring that only authorized models perform inferences and that the results are securely encrypted and decrypted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If AI models are made portable and accessible for inference, then the utility and deployment flexibility of AI models is improved, but digital rights protection and authorization control deteriorate
Solution Approach 1:
The patent introduces a watermarking system as an intermediary mechanism between AI model distribution and rights protection. Watermarks are embedded within the model structure itself, serving as a mediator that enables both portable deployment and authorized tracking without restricting model mobility or utility.
Solution Approach 2:
The patent applies preliminary action by embedding watermarks into AI models during the model creation or distribution phase, before the models are deployed for inference. This pre-embedding ensures that rights protection is inherently built into the model structure, eliminating the need for additional authorization checks during deployment.
2Productivity
If processing tasks are delegated to secondary processing systems like DP accelerators, then processing efficiency and scalability are improved, but trustworthiness and proof of protected processing deteriorate
Solution Approach 1:
The patent implements feedback by having DP accelerators return digitally signed watermarks to host devices after processing tasks. This creates a verification loop where the host device can confirm that authorized models were used during inference, providing trustworthiness feedback that complements the processing efficiency gains.
Solution Approach 2:
The patent uses digitally signed watermarks as an intermediary proof mechanism between DP accelerators and host devices. The watermark signature serves as verifiable evidence that authenticated models were executed during processing, bridging the trust gap created by delegating tasks to secondary systems.
3Reliability
If watermarking systems are implemented to protect AI models, then digital rights management is improved, but system complexity and overhead increase
Solution Approach 1:
The patent merges watermark embedding directly into the AI model structure itself, combining rights protection functionality with the model's existing parameters and architecture. This integration eliminates separate watermarking infrastructure, reducing system overhead while maintaining robust digital rights management.
Solution Approach 2:
The patent enables self-service by making the AI model itself carry its own watermark identifiers within its structure. The model inherently provides its own authentication information without requiring external watermarking systems or additional verification infrastructure, simplifying the overall system complexity.
4Reliability
If digitally signed watermarks are used to verify AI model authenticity, then authorization control is improved, but processing time and computational overhead increase
Solution Approach 1:
The patent applies preliminary action by pre-computing and embedding digital signatures into the watermark structures during model distribution. This allows verification to occur through simple signature validation rather than complex real-time authentication computations, significantly reducing processing time while maintaining strong authorization control.
Data Source
AI summary
In one embodiment, a computer-implemented method of digitally signing input by a data processing (DP) accelerator operation, and embedding the digitally signed input into an output, includes receiving, from a host device, a signature kernel specifying input to the signature kernel and executing the signature kernel to: extract a watermark from the input and obtain a hash for the watermark; generate output from the input; and embed the hash into the output. The DP accelerator provides the output to the host device. In an embodiment, the input includes an artificial intelligence (AI) model that is executed by the DP accelerator. The DP accelerator receives second input from the host, thereby producing an inference output from the AI model. The digitally signed watermark of the AI Model is embedded into the inference output and is provided to the host device.