Systems and methods for verifying a watermark of an AI model for a data processing accelerator

1. A computer-implemented method for processing data by a data processing (DP) accelerator, the method comprising:

receiving an inference request from an application executed by a host;

extracting a watermark from an artificial intelligence (AI) model having the watermark by a data processing (DP) accelerator;

extracting a watermark type indicator based on metadata associated with the AI model;

determining a policy from a plurality of policies based on the watermark type indicator, wherein each of the plurality of policies corresponds to a type of watermark algorithm that generated the watermark, wherein a first type of watermark algorithm adds one or more dummy layers and/or alters one or more weights of an AI model and a second type of watermark algorithm alters a training subroutine to include a hidden set of training data to train the AI model;

determining a type of watermark algorithm that generated the watermark based on the policy;

verifying the extracted watermark based on the determined type of watermark algorithm;

applying the AI model having the watermark to a set of inference inputs to generate inference results; and

sending a verification proof and the inference results to the application.

2. The method of claim 1 , wherein the inference results are generated after the extracted watermark is verified successfully based on the policy.

3. The method of claim 1 , wherein the policy includes a criterion that the AI model contain a verifiable watermark generated by a DP accelerator and the watermark includes a machine recognizable watermark for verification.

4. The method of claim 1 , wherein the policy includes a criterion that a signature for the AI model having the watermark is successfully verified.

5. The method of claim 1 , wherein a different policy is applied to a different version of a watermark algorithm.

6. The method of claim 1 , wherein the verification proof includes a signature for a result of the inference request.

7. A data processing (DP) accelerator, comprising:

a hardware processor; and

a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations, the operations including receiving an inference request from an application executed by a host;

extracting a watermark from an artificial intelligence (AI) model having the watermark;

extracting a watermark type indicator based on metadata associated with the AI model;

determining a policy from a plurality of policies based on the watermark type indicator, wherein each of the plurality of policies corresponds to a type of watermark algorithm that generated the watermark, wherein a first type of watermark algorithm adds one or more dummy layers and/or alters one or more weights of an AI model and a second type of watermark algorithm alters a training subroutine to include a hidden set of training data to train the AI model;

determining a type of watermark algorithm that generated the watermark based on the policy;

verifying the extracted watermark based on the determined type of watermark algorithm;

applying the AI model having the watermark to a set of inference inputs to generate inference results; and

sending a verification proof and the inference results to the application.

8. The DP accelerator of claim 7 , wherein the inference results are generated after the extracted watermark is verified successfully based on the policy.

9. The DP accelerator of claim 7 , wherein the policy includes a criterion that the AI model contain a verifiable watermark generated by a DP accelerator and the watermark includes a machine recognizable watermark for verification.

10. The DP accelerator of claim 7 , wherein the policy includes a criterion that a signature for the AI model having the watermark is successfully verified.

11. The DP accelerator of claim 7 , wherein a different policy is applied to a different version of a watermark algorithm.

12. The DP accelerator of claim 7 , wherein the verification proof includes a signature for a result of the inference request.

13. A computer-implemented method for processing data by a data processing (DP) accelerator, the method comprising:

sending an inference request by an application to a data processing (DP) accelerator, the request to generate inference results by applying an artificial intelligence (AI) model with a watermark to inference inputs, wherein the request includes a request to

extract the watermark from the AI model having the watermark by the DP accelerator,

extract a watermark type indicator based on metadata associated with the AI model,

determine a policy from a plurality of policies based on the watermark type indicator, wherein each of the plurality of policies corresponds to a type of watermark algorithm that generated the watermark, wherein a first type of watermark algorithm adds one or more dummy layers and/or alters one or more weights of an AI model and a second type of watermark algorithm alters a training subroutine to include a hidden set of training data to train the AI model, and

determine a type of watermark algorithm that generated the watermark based on the policy;

verify the extracted watermark based on the determined type of watermark algorithm; and

receiving a verification proof and the inference results by the application.

14. The method of claim 13 , wherein the inference results are generated after the extracted watermark is verified successfully based on the policy.

15. The method of claim 13 , wherein the policy includes a criterion that the AI model contain a verifiable watermark generated by a DP accelerator and the watermark includes a machine recognizable watermark for verification.

16. The method of claim 13 , wherein the policy includes a criterion that a signature for the AI model having the watermark is successfully verified.

17. The method of claim 13 , wherein a different policy is applied to a different version of a watermark algorithm.

18. The method of claim 13 , wherein the verification proof includes a signature for a result of the inference request.