Baidu USA LLC

Kunlunxin Technology (beijing) Company Limited

Baidu.com Times Technology (beijing) Co. Ltd.

Yueqiang Cheng

Yong Liu

Tao Wei

Jian Ouyang

Hefei Zhu

Zhibiao Zhao

Yulong Zhang

Yu Ding

Wei Ping

Zhenyu Zhong

Xing Li

Haofeng Kou

Kang Li

Tongxin Li

Yinqian Zhang

Huibo Wang

Mengyuan Li

In one embodiment, an image sensor captures an image and passes the image to an image processing system that detects one or more vehicle objects and one or more human objects, using a single detection function having a single artificial intelligence (AI) model. Each of the detected objects correspond to a portion of the captured image. For each vehicle object, the corresponding image portion is processed to determine a plurality of properties of the vehicle, including, e.g., type (truck, van, sedan, motorcycle, etc.), color, and license number. For each human object, the corresponding portion of the image is processed to determine a plurality of properties of the human, e.g., gender, approximate age, skin tone, eye color, hair color, and facial landmarks for facial recognition. The captured image is annotated to describe the objects and their properties, and annotated image is transmitted to a service for use by an application.

Method for deep neural network functional module deduplication

TLB poisoning attacks take advantage of security issues of translation lookaside buffer (TLB) management on SEV processors in Secure Encrypted Virtualization (SEV) virtual machines (VMs). In various embodiments, a hypervisor may poison TLB entries between two processes of a SEV VM to compromise the integrity and confidentiality of the SEV VM. Variants of TLB poisoning attacks and end-to-end attacks are shown to be successful on both Advanced Micro Devices (AMD) SEV and SEV-Encrypted State (SEV-ES). Countermeasures for thwarting TLB poisoning attacks include hardware-enforced TLB flush processes and re-exec schemes that, among other things, prevent attackers from manipulating TLB entries and causing a privileged victim process to execute malicious code in an attempt to bypass a password authentication.

Translation lookaside buffer (TLB) poisoning attacks on secure encrypted virtualization

Systems and methods are disclosed for migrating a virtual machine (VM) having a virtual function that maps resources of an artificial intelligence (AI) accelerator to the VM. A driver for the AI accelerator can generate a checkpoint of VM processes that make calls to the AI accelerator, and can the checkpoint can include a list and configuration of resources mapped to the AI accelerator by the virtual function. The driver can also access the code, data, and memory of the AI accelerator to generate a checkpoint of the AI accelerator status. When the VM is migrated to a new host, then either, or both, of these checkpoint frames can be used to ensure that resuming the VM on a new host having appropriate AI accelerator resources, can be successful resumed on the new host. One or both checkpoint frames can be captured based upon an event, in anticipation of the need to migrate the VM.

Method for virtual machine migration with artificial intelligence accelerator status validation in virtualization environment

Method for virtual machine migration with checkpoint authentication in virtualization environment

Embodiments of the disclosure discloses a method and system of a virtualization environment for a data processing (DP) accelerator. In one embodiment, a data processing (DP) accelerator includes a resource management unit and one or more dynamically isolated resources managed by the resource management unit. The DP accelerator includes one or more virtual functions (VFs) each associated with one of the one or more dynamically isolated resources, where a virtual machine (VM) of a host is assigned one of the one or more VFs to access the dynamically isolated resources associated with the assigned VF, and where the VM has no access to the rest of the one or more dynamically isolated resources.

Data protection with dynamic resource isolation for data processing accelerators

Systems and methods are disclosed for data protection in a cluster of data processing accelerators (DPAs) using a policy that determines a static partition of resources in each DPA in the cluster communicatively coupled to a host device. Each DPA has sensitive (secure) and non-sensitive (non-secure) resources. The host device and a DPA can access all resources of the DPA. Other DPAs can only access non-sensitive resources of a DPA. The partition of resources within a DPA is static and may be implemented in hardware or firmware. Resources include memory, one or more processing modules such as key generators and cryptographic modules, caches, registers, and storage.

Method for data protection in a data processing cluster with partition

Embodiments of the disclosure discloses a method and system for a virtualization environment for a data processing (DP) accelerator. In one embodiment, a data processing (DP) accelerator includes one or more statically partitioned resources and one or more virtual functions (VFs) each associated with one of the one or more statically partitioned resources. A virtual machine (VM) of a host is assigned one of the one or more VFs to access the statically partitioned resources associated with the assigned VF. The VM has no access to the rest of the one or more statically partitioned resources of the DP accelerator.

Data protection with static resource partition for data processing accelerators

According to one embodiment, a DP accelerator includes one or more execution units (EUs) configured to perform data processing operations in response to an instruction received from a host system coupled over a bus. The DP accelerator includes a time unit (TU) coupled to the security unit to provide timestamp services. The DP accelerator includes a security unit (SU) configured to establish and maintain a secure channel with the host system to exchange commands and data associated with the data processing operations, where the security unit includes a secure storage area to store a private root key associated with the DP accelerator, where the private root key is utilized for authentication. The SU includes a random number generator to generate a random number, and a cryptographic engine to perform cryptographic operations on data exchanged with the host system over the bus using a session key derived based on the random number.

Data processing accelerator having a security unit to provide root trust services

In one embodiment, a computer-implemented method of a data processing (DP) accelerator encrypting or decrypting input data can include receiving, from a host device, a command, the input data, and a kernel. The kernel can be an encryption kernel, or a decryption kernel, and the DP accelerator need not know which kernel it has received. The DP accelerator runs the received kernel. In response to the DP accelerator receiving the command, the DP accelerator performs encrypting of the input data using the kernel, if the received kernel is an encryption kernel, otherwise, decrypting the input data using the kernel. The encrypted, or decrypted, input data is then provided to the host device.

Method and system for encrypting data using a kernel

In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator includes receiving, at the DP accelerator, first data representing an artificial intelligence (AI) model that has been previously trained from a host processor; receiving, at the DP accelerator, a request to implant a watermark in the AI model from the host processor; and implanting, by the DP accelerator, the watermark within the AI model. The DP accelerator then transmits second data representing the AI model having the watermark implanted therein to the host processor. In embodiment, the method further includes extracting, at the DP accelerator, a watermark algorithm identifier (ID) from the request to implant a watermark; and generating the watermark using a watermark algorithm identified by the watermark algorithm ID.

Method for implanting a watermark in a trained artificial intelligence model for a data processing accelerator

In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, includes receiving, at the DP accelerator, an artificial intelligence (AI) model that has been previously trained and a set of input data from a host processor; receiving, at the DP accelerator, a watermark kernel from the host processor; executing the watermark kernel within the DP accelerator on the AI model and the set of input data. The watermark kernel, when executed, is configured to: generate a new watermark by inheriting an existing watermark from a data object of the set of input data or the AI model, perform an AI inference using the AI model based on the input data to generate output data, and implant the new watermark within the output data. The DP accelerator then transmits output data having the new watermark implanted therein to the host processor.

Method and system for making an artifical intelligence inference using a watermark-inherited kernel for a data processing accelerator

Embodiments disclose systems and methods to broadcast a message among virtual DP accelerators (DPAs). In one embodiment, in response to receiving a broadcast instruction from an application via a communication switch, the broadcast instruction designating one or more virtual DP accelerators of a plurality of virtual DP accelerators to receive a broadcast message, a system encrypts the broadcast message based on a broadcast session key for a broadcast communication session. The system determines one or more public keys of one or more security key pairs each associated with one of the designated virtual DP accelerators. The system encrypts a plurality of the broadcast session key based on the determined one or more public keys. The system broadcasts the encrypted broadcast message, and the one or more encrypted broadcast session keys to the virtual DP accelerators.

System and method to securely broadcast a message to accelerators using virtual channels with switch

In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, includes receiving, at the DP accelerator, first data representing a set of training data from a host processor; receiving, at the DP accelerator, a watermark kernel from the host processor; and executing the watermark kernel within the DP accelerator on an artificial intelligence (AI) model. The watermark kernel, when executed, is configured to: generate a new watermark by inheriting an existing watermark from a data object of the set of training data, train the AI model using the set of training data, and implant the new watermark within the AI model during training of the AI model. The DP accelerator then transmits second data representing the trained AI model having the new watermark implanted therein to the host processor.

Method and system for artificial intelligence model training using a watermark-enabled kernel for a data processing accelerator

In one embodiment, a computer-implemented method of a data processing (DP) accelerator obtaining a watermark of a watermark-enable artificial intelligence (AI) model includes receiving, by the DP accelerator, input data to the DP accelerator that causes the watermark-enabled AI model to extract the watermark from the watermark-enabled AI model; and providing the watermark of the watermark-enabled AI model to the host device. The DP accelerator can receive the model from the host device. The DP accelerator can further receive a command to digitally sign the watermark and call a security unit of the DP accelerator to digitally sign the watermark.

Method and system for signing an artificial intelligence watermark using a query

According to one embodiment, a system performs a secure boot using a security module such as a trusted platform module (TPM) of a host system. The system establishes a trusted execution environment (TEE) associated with one or more processors of the host system. The system launches a memory manager within the TEE, where the memory manager is configured to manage memory resources of a data processing (DP) accelerator coupled to the host system over a bus, including maintaining memory usage information of global memory of the DP accelerator. In response to a request received from an application running within the TEE for accessing a memory location of the DP accelerator, the system allows or denies the request based on the memory usage information.

Growing community of inventors

Sunnyvale, CA, United States of America

Yueqiang Cheng