How to Secure a Machine Learning Model with Encryption and Output Checks

This patent describes a method for protecting a machine learning model and its data by encrypting both, running calculations on the encrypted information, and then checking the decrypted results to see if the model has been tampered with.

What it covers

This patent details a system and method for validating and authenticating machine learning models. It works by first providing a unique encryption key linked to a specific user or entity. Then, it encrypts the internal workings (parameters) of a trained machine learning model using this key, as described in claim 1. It also encrypts the data that will be fed into the model. Crucially, the encrypted input data is then processed by the encrypted model to produce an encrypted result. This encrypted result is then decrypted, and the system analyzes this decrypted output. The analysis checks if the output matches an expected structure, such as values falling within a certain range or adding up to a specific number (claims 4-6). If the output doesn't match, the system determines that the model's parameters have been compromised and alerts the user.

What it doesn't cover

• —Does not cover systems where only the input data is encrypted, but the machine learning model itself is not.
• —Does not cover systems where only the machine learning model's parameters are encrypted, but the input data is not.
• —Does not cover methods of detecting model compromise that do not involve analyzing the decrypted output for structural compliance.
• —Does not cover general model authentication that doesn't use the specific sequence of encrypting both model and data, processing, decrypting, and then analyzing the output for expected characteristics.
• —Does not cover detecting model compromise by directly inspecting the encrypted model's parameters without processing data through it.

The clever bit

The clever part is combining encryption of both the machine learning model's internal settings and the input data, then using the characteristics of the *decrypted output* as a 'canary' to detect if the model itself has been compromised during its operation.

Why it matters

As machine learning models become more powerful and handle sensitive data, protecting them from tampering and unauthorized use is critical. This patent offers a way to ensure the integrity of a model and the privacy of the data it processes, which is vital for industries like healthcare, finance, and defense. It helps maintain trust in AI systems by providing a mechanism to detect when a model might have been maliciously altered or exploited.

Real-world examples

• 1.Secure diagnostic AI in healthcare, ensuring medical models haven't been tampered with.
• 2.Financial fraud detection models, protecting both the model's logic and sensitive transaction data.
• 3.Privacy-preserving AI systems where data must remain encrypted even during processing.
• 4.AI models deployed in untrusted environments, where their integrity needs continuous verification.