Virtual Secure Mode for AI Model Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Artificial intelligence models are vulnerable to unauthorized access and inspection when executed on client devices outside of secure cloud-based environments, as they may be visible to the host operating system.
Innovation Solution
A system utilizing a virtual secure mode (VSM) instance on a client device to protect AI models by receiving an encrypted AI model, decrypting it within the VSM using a decryption secret, storing it securely, and executing applications that utilize the AI model for inference and training without exposing it to the host operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If AI models are executed on client devices outside secure cloud-based environments, then ease of operation and accessibility are improved, but security and protection against unauthorized access deteriorate
Solution Approach 1:
The system segments the client device into two distinct execution environments: a host operating system and a virtual secure mode instance. The AI model is loaded and executed exclusively within the isolated VSM instance, creating a security boundary that prevents the host OS from accessing the model while allowing the model to run on the client device. This segmentation resolves the contradiction by enabling local execution (improving accessibility) while maintaining security through environmental isolation.
Solution Approach 2:
The virtual secure mode instance acts as an intermediary between the host operating system and the AI model. It provides a controlled interface that allows the AI model to execute on the client device while preventing direct access by the host OS. The VSM instance mediates all interactions, ensuring that the model remains protected while still being accessible for legitimate operations.
2Reliability
If AI models are encrypted to protect security, then protection against unauthorized access is improved, but ease of operation and model loading becomes more complex
Solution Approach 1:
The system performs preliminary encryption of the AI model before it is loaded onto the client device. The model is encrypted in advance and stored in encrypted form, with decryption occurring automatically within the isolated VSM instance during execution. This preliminary action resolves the contradiction by maintaining security through encryption while managing complexity through automated decryption processes that occur transparently within the secure environment.
Solution Approach 2:
The decryption secret is extracted and stored separately from the encrypted AI model, typically in a secure element or trusted platform module. This separation allows the model to remain encrypted while enabling controlled decryption within the VSM instance using the extracted secret. The extraction resolves the contradiction by maintaining protection through encryption while simplifying the loading process through separate secret management.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Described herein is a system and method for utilizing a virtual secure mode instance to protect an artificial intelligence model from unauthorized access (e.g., inspection, copying) during execution of an application utilizing the AI model (e.g., training and/or inference) on a client device. An encrypted artificial intelligence model is received in a virtual secure mode instance of the client device. The encrypted artificial intelligence model is decrypted in the virtual secure mode instance using a decryption secret. The decrypted artificial intelligence model is stored in the virtual secure mode instance. An application that utilizes the decrypted artificial intelligence model is executed (e.g., training and/or inference) in the virtual secure mode instance.