System and method for architectural integrity assurance in neural networks
The present invention provides a computer system and method for ensuring the architectural integrity and authenticity of neural networks using cryptographic techniques and timestamping mechanisms. The system certifies and validates the internal state of tensor and graph data structures within neural networks by computing hash values of the network's tensors and graphs and associating these values with specific time intervals. This can be achieved through use of transient-key cryptography, wherein a time-specific cryptographic key pair is generated for each interval, allowing the signing of hash values and ensuring data integrity. A timestamping authority issues timestamp tokens for the hash values, which are stored in a distributed, redundant archive for future verification. The validation process involves comparing the current state of the neural network with the stored hash values, ensuring any tampering or unauthorized modifications can be detected. This approach enhances the security and trustworthiness of neural network models across critical applications by safeguarding against adversarial attacks and model poisoning.
1 . A computing system for generating a timestamped integrity record for a neural network model, the computing system comprising: one or more processors; a memory storing instructions; and a network interface, wherein the instructions, when executed by the one or more processors, cause the computing system to:
(a) obtain an internal state of the neural network model as an ordered list of pairs (tensor name, tensor), the tensors storing parameters of the neural network model comprising weights and biases;
(b) compute, using a cryptographic hash function H, a tensor hash value for each tensor in the ordered list, wherein computing the tensor hash value comprises: (i) when the tensor comprises a sparse tensor data structure comprising an indices tensor, a values tensor, and a shape tensor, inputting into H a concatenation of (A) a hash of the indices tensor, (B) a hash of the values tensor, and (C) a hash of the shape tensor; and (ii) otherwise, determining a dimension of the tensor and: (A) when the dimension equals zero, inputting into H an ASN.1 Distinguished Encoding Rules (DER) encoding of a single tensor element; (B) when the dimension equals one, inputting into H a concatenation of ASN.1 DER encodings of tensor elements; and (C) when the dimension is greater than one, decomposing the tensor along an outermost dimension into subtensors, computing a subtensor hash value for each subtensor, and inputting into H a concatenation of the subtensor hash values;
(c) compute, using the cryptographic hash function H, a state hash value of the internal state by, for each pair (tensor name, tensor) in the ordered list, forming a name_hash value by concatenating the tensor name with the tensor hash value and inputting into H an ordered concatenation of the name_hash values;
(d) transmit, via the network interface, a timestamp request comprising the state hash value to a time-stamping authority that uses transient-key cryptography in which a time-specific public key is associated with a time interval;
(e) receive, from the time-stamping authority, a timestamp token comprising: (i) the state hash value, (ii) a time indication within the time interval, and (iii) a digital signature verifiable using the time-specific public key; and
(f) store the timestamp token in association with the state hash value in a distributed network archive comprising a plurality of storage nodes.
2 . The computing system of claim 1 , wherein computing the state hash value comprises constructing a Merkle tree that uses the name_hash values as leaf values and using a Merkle root of the Merkle tree as the state hash value.
3 . The computing system of claim 1 , wherein the time-stamping authority generates a different time-specific public/private key pair for each time interval and generates the digital signature in the timestamp token using a transient private key of the time-specific public/private key pair.
4 . The computing system of claim 3 , wherein the time-stamping authority permanently destroys the transient private key after expiration of the time interval.
5 . The computing system of claim 1 , wherein the timestamp request and the timestamp token comply with a standardized time-stamping protocol comprising RFC 3161 and wherein the distributed network archive stores redundant copies of the timestamp token on at least two storage nodes.
6 . A computer-implemented method for verifying integrity of a neural network model, the method comprising:
(a) retrieving, from a distributed network archive, a timestamp token comprising (i) a baseline state hash value of an internal state of the neural network model, (ii) a time indication, and (iii) a digital signature verifiable using a time-specific public key associated with a time interval that includes the time indication;
(b) validating the timestamp token by verifying the digital signature using the time-specific public key;
(c) obtaining a current internal state of the neural network model as an ordered list of pairs (tensor name, tensor);
(d) computing a current state hash value for the current internal state by: computing a tensor hash value for each tensor using a cryptographic hash function H based on a dimension of the tensor, forming a name_hash value for each tensor by concatenating the tensor name with the tensor hash value, and hashing an ordered concatenation of the name_hash values using H;
(e) comparing the current state hash value to the baseline state hash value; and
(f) outputting a verification result indicating whether the current internal state matches the internal state represented by the baseline state hash value.
7 . The method of claim 6 , wherein outputting the verification result comprises, when the current state hash value differs from the baseline state hash value, outputting an indication of tampering or unauthorized modification of at least one tensor since the time indication.