Abstract: Embodiments of the disclosure relate to learning new watermark algorithms for artificial intelligence (AI) models for a data processing (DP) accelerator. In one embodiment, a system trains a watermark algorithm based on a predetermined set of criteria, where the watermark algorithm is trained to generate variations of the watermark algorithm. The system configures the watermark unit at runtime with a variation of the watermark algorithm for the watermark algorithm to be used by the DP accelerator.

Abstract: Embodiments of the disclosure relates to signing of an artificial intelligence (AI) model with a watermark for a data processing (DP) accelerator. In one embodiment, in response to a request received by the data processing accelerator, the request sent by an application to embed digital rights protection to an AI model, a system generates a watermark for the AI model based on a watermark algorithm. The system embeds the watermark onto the AI model. The system signs the AI model having the embedded watermark to generate a signature.

Abstract: Embodiments of the disclosure relate to verifying a watermark of an artificial intelligence (AI) model for a data processing (DP) accelerator. In one embodiment, a system receives an inference request from an application. The system extracts the watermark from an AI model having the watermark. The system verifies the extracted watermark based on a policy. The system applies the AI model having a watermark to a set of inference inputs to generate inference results.

Abstract: According to various embodiments, an end-to-end TTS framework can integrate a watermarking process into the training of the TTS framework, which enables watermarks to be imperceptible within a synthesized/cloned audio segment generated by the TTS framework. The watermarks added in such a matter are statistically undetectable to prevent authorized removal. According to an exemplary method of training the TTS framework, a TTS neural network model and a watermarking neural network mode in the TTS framework are trained in an end to end manner, with the watermarking being part of the optimization process of the TTS framework. During the training, neuron values of the TTS neural network model are adjusted based on training data to prepare one or more spaces for adding a watermark in a synthesized audio segment to be generated by the TTS framework.

Abstract: In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, includes receiving, at the DP accelerator, first data representing a set of training data from a host processor; receiving, at the DP accelerator, a watermark kernel from the host processor; and executing the watermark kernel within the DP accelerator on an artificial intelligence (AI) model. The watermark kernel, when executed, is configured to: generate a new watermark by inheriting an existing watermark from a data object of the set of training data, train the AI model using the set of training data, and implant the new watermark within the AI model during training of the AI model. The DP accelerator then transmits second data representing the trained AI model having the new watermark implanted therein to the host processor.

Abstract: In one embodiment, a computer implemented method of a data processing (DP) accelerator providing a watermark of an artificial intelligence (AI) model to a host device includes receiving, by the DP accelerator, from the host device, the AI model, and a watermark-enabled kernel to the DP accelerator. The DP accelerator further receives from the host device, first input data to the DP accelerator that, when the first input data is used as input to the watermark-enabled kernel, generates a watermark of the AI model. The watermark is provided to the host device. In an embodiment, the method further includes receiving a signature kernel from the host device and calling the signature kernel to digitally sign the watermark. In an embodiment, the method alternatively includes calling a digital signature routine in a secure unit of the DP accelerator to digitally sign the watermark.

Abstract: In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, includes receiving, at the DP accelerator, first data representing a set of training data from a host processor; receiving, at the DP accelerator, a watermark kernel from the host processor; and executing the watermark kernel within the DP accelerator on an artificial intelligence (AI) model. The watermark kernel, when executed, is configured to: generate a watermark, train the AI model using the set of training data, and implant the watermark within the AI model during training of the AI model. The DP accelerator then transmits second data representing the trained AI model having the watermark implanted therein to the host processor. In an embodiment, the method further includes receiving a pre-trained AI model and the training is performed for the pre-trained AI model.

Abstract: In one embodiment, a computer-implemented method of a data processing (DP) accelerator obtaining a watermark of an artificial intelligence (AI) model includes receiving, from a host device, the AI model to execute on the DP accelerator, and receiving input data that triggers output from the AI model on the DP accelerator. The DP accelerator calculates AI model output, in response to the received input and provides the output to the host device. The output can be a watermark extracted from the AI model. DP accelerator can call a security unit of the DP accelerator to digitally sign the output. In an embodiment, the security unit digitally signs the output from the AI model using a key that is retrieved from, or is derived from, a key stored in a secure storage on the security unit.

Abstract: In one embodiment, a computer-implemented method of digitally signing input by a data processing (DP) accelerator operation, and embedding the digitally signed input into an output, includes receiving, from a host device, a signature kernel specifying input to the signature kernel and executing the signature kernel to: extract a watermark from the input and obtain a hash for the watermark; generate output from the input; and embed the hash into the output. The DP accelerator provides the output to the host device. In an embodiment, the input includes an artificial intelligence (AI) model that is executed by the DP accelerator. The DP accelerator receives second input from the host, thereby producing an inference output from the AI model. The digitally signed watermark of the AI Model is embedded into the inference output and is provided to the host device.

Abstract: In one embodiment, a computer-implemented method of a data processing (DP) accelerator encrypting or decrypting input data can include receiving, from a host device, a command, the input data, and a kernel. The kernel can be an encryption kernel, or a decryption kernel, and the DP accelerator need not know which kernel it has received. The DP accelerator runs the received kernel. In response to the DP accelerator receiving the command, the DP accelerator performs encrypting of the input data using the kernel, if the received kernel is an encryption kernel, otherwise, decrypting the input data using the kernel. The encrypted, or decrypted, input data is then provided to the host device.

Abstract: In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, includes receiving, at the DP accelerator, an artificial intelligence (AI) model that has been previously trained and a set of input data from a host processor; receiving, at the DP accelerator, a watermark kernel from the host processor; executing the watermark kernel within the DP accelerator on the AI model and the set of input data. The watermark kernel, when executed, is configured to: generate a new watermark by inheriting an existing watermark from a data object of the set of input data or the AI model, perform an AI inference using the AI model based on the input data to generate output data, and implant the new watermark within the output data. The DP accelerator then transmits output data having the new watermark implanted therein to the host processor.

Abstract: In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, the method includes receiving, at the DP accelerator, first data representing a set of training data from a host processor and performing training of an artificial intelligence (AI) model based on the set of training data within the DP accelerator. The method further includes implanting, by the DP accelerator, a watermark within the trained AI model and transmitting second data representing the trained AI model having the watermark implanted therein to the host processor. In an embodiment, the method further includes receiving a pre-trained machine learning model; and performing training for the pre-trained AI model based on the set of training data within the DP accelerator.

Abstract: In one embodiment, a computer-implemented method of a data processing (DP) accelerator obtaining a watermark of a watermark-enable artificial intelligence (AI) model includes receiving, by the DP accelerator, input data to the DP accelerator that causes the watermark-enabled AI model to extract the watermark from the watermark-enabled AI model; and providing the watermark of the watermark-enabled AI model to the host device. The DP accelerator can receive the model from the host device. The DP accelerator can further receive a command to digitally sign the watermark and call a security unit of the DP accelerator to digitally sign the watermark.

Abstract: In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, includes receiving, at the DP accelerator, first data representing an artificial intelligence (AI) model that has been previously trained from a host processor and a set of input data; receiving, at the DP accelerator, a watermark kernel from the host processor; and executing the watermark kernel within the DP accelerator on the AI model. The watermark kernel, when executed, is configured to: perform inference operations of the artificial intelligence model based on the input data to generate output data, and implant the watermark within the output data. The DP accelerator then transmits the output data having the watermark implanted therein to the host processor.

Abstract: In one embodiment, a computer-implemented method of a DP accelerator performing an encryption or decryption operation includes receiving, by the DP accelerator, a command and input data for the DP accelerator to encrypt or decrypt. The command is one of: encrypt the input data or decrypt the input data. The method further includes encrypting, or decrypting, by the DP accelerator, the input data according to the command; and providing the encrypted or decrypted input data to the host device. The host device and DP accelerator may exchange one or more keys and such keys can be used to establish a secure link between the host device and DP accelerator and/or to use for encryption or decryption. One or more of the keys may be based upon a root key or key pair of the DP accelerator and can be stored in a secure storage of a security unit of the DP accelerator.

Abstract: In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator includes receiving, at the DP accelerator, first data representing an artificial intelligence (AI) model that has been previously trained from a host processor; receiving, at the DP accelerator, a request to implant a watermark in the AI model from the host processor; and implanting, by the DP accelerator, the watermark within the AI model. The DP accelerator then transmits second data representing the AI model having the watermark implanted therein to the host processor. In embodiment, the method further includes extracting, at the DP accelerator, a watermark algorithm identifier (ID) from the request to implant a watermark; and generating the watermark using a watermark algorithm identified by the watermark algorithm ID.

Abstract: According to one embodiment, a host communicates with a data processing (DP) accelerator using an obfuscation scheme. The DP accelerator receives an obfuscation kernel algorithm (or obfuscation algorithm), where the obfuscation kernel algorithm is used to obfuscate and de-obfuscate data in communication with a host. The DP accelerator de-obfuscates, using the obfuscation kernel algorithm, obfuscated data received from the host for a prediction request to obtain one or more AI models. The DP accelerator generates prediction results by applying the one or more AI models to a prediction input. The DP accelerator obfuscates, using the obfuscation kernel algorithm, the prediction results. The DP accelerator sends the obfuscated prediction results to the host, where the host retrieves the prediction results by de-obfuscating the obfuscated prediction results.

Abstract: According to one embodiment, a host communicates with a data processing (DP) accelerator using an obfuscation scheme. The DP accelerator receives a training request from a host, the training request includes an obfuscated data that includes one or more AI models and/or training input data. The DP accelerator de-obfuscates, by an obfuscation unit of the DP accelerator, the obfuscated data to obtain the one or more AI models. The DP accelerator trains the one or more AI models based on the training input data.

Abstract: Embodiments of the disclosure disclose a system to prevent data of a client from leaking to untrusted parties in a multiparty computation environment. According to one embodiment, in response to a request received at a gateway (e.g., a non-bypassable gateway) of a server from a user device of a user over a network to process user data by an execution service, the system sanitizes the user data by scanning the user data for malicious code. The system selects a trusted execution environment (TEE) worker from a number of TEE workers and initiates an execution of the execution service by the selected TEE worker. The system receives execution results from the selected TEE worker. The system transmits the execution results to the user device of the user over the network.

Abstract: According to one embodiment, in response to a request received at a host agent of a server from a user device of a user over a network to process user data, a data processing system launches a restricted operating environment within the server. The system transmits a token representing the request to a guest agent executed within the restricted operating environment, where an executor associated with the token is launched by the guest agent within the restricted operating environment, where the executor, when executed, is configured to process the user data to generate a processing result without accessing an external component external to the restricted operating environment. The system returns the processing result back to the user device.