Watermark Kernel for AI Inference Authenticity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a lack of effective digital rights protection for artificial intelligence models and a lack of proof that results produced by data processing accelerators are protected by a 'root of trust' system, making it difficult to ensure the authenticity and trustworthiness of AI model inferences.
Innovation Solution
The implementation of a watermarking system within AI models, where a watermark is embedded or inherited during training and inference processes, allowing the host device to validate the AI model's authenticity and associate inferences with the correct model, using watermark-enabled kernels that can extract, implant, and digitally sign data to ensure trustworthiness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If AI models are deployed for inference without watermark protection, then processing speed and ease of operation are improved, but digital rights protection and model authenticity are worsened
Solution Approach 1:
Watermarks are embedded in AI models during the training phase before deployment. The watermark embedding occurs as a preliminary action during model creation, so that when the model is later deployed for inference, the protection is already in place without adding complexity to the deployment process. The host processor receives the pre-watermarked model and can directly use it for inference.
Solution Approach 2:
A watermark kernel acts as an intermediary component between the host processor and the AI model. The watermark kernel contains the logic for embedding, extracting, and verifying watermarks. This intermediary handles all watermark-related operations transparently, allowing the main AI inference process to continue unchanged while providing digital rights protection through the watermark verification mechanism.
2Reliability
If watermark verification is performed during AI model inference, then digital rights protection is improved, but processing time and computational overhead are worsened
Solution Approach 1:
The system performs only essential watermark verification actions during inference - specifically extracting and checking the presence of the watermark signature. Rather than performing complete model verification or re-training checks, the system performs partial verification focused solely on authenticity confirmation. This minimal verification approach provides adequate protection while minimizing the time overhead during inference operations.
3Reliability
If watermark embedding is performed during AI model training, then model authenticity protection is improved, but training complexity and computational requirements are worsened
Solution Approach 1:
The watermark embedding process is merged with the existing AI model training workflow. Instead of treating watermark embedding as a separate post-processing step or additional complex procedure, the system integrates it into the training process itself. The watermark kernel is executed during training alongside the normal model learning operations, combining both functions into a unified training pipeline that reduces overall complexity.
4Productivity
If AI models are ported to secondary processing systems, then processing capability and productivity are improved, but trust verification and root of proof are worsened
Solution Approach 1:
The watermark verification system provides feedback to the host processor about the authenticity of the AI model being used for inference. When the DP accelerator executes the AI model, the watermark kernel extracts and verifies the watermark, then provides confirmation feedback to the host processor. This feedback mechanism establishes a chain of trust that verifies the model's origin and ensures it has not been tampered with, even when executed on external hardware.
Data Source
AI summary
In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, includes receiving, at the DP accelerator, an artificial intelligence (AI) model that has been previously trained and a set of input data from a host processor; receiving, at the DP accelerator, a watermark kernel from the host processor; executing the watermark kernel within the DP accelerator on the AI model and the set of input data. The watermark kernel, when executed, is configured to: generate a new watermark by inheriting an existing watermark from a data object of the set of input data or the AI model, perform an AI inference using the AI model based on the input data to generate output data, and implant the new watermark within the output data. The DP accelerator then transmits output data having the new watermark implanted therein to the host processor.