Securing AI Models on Untrusted Infrastructure | Anand Kashyap, Fortanix | TFiR

Swapnil Bhartiya: Now, can you walk me through what actually happens to data and model widths during inference when it runs on infrastructure that we cannot fully trust and control?

Anand Kashyap: Yeah. So confidential containers create a packaging for an application when the application now runs inside a confidential computing environment or a trusted execution environment. And it could be a combination of of CPU as well as gpu and you’d have CPU loading the application loading the container, but then the model weights get loaded in the GPU memory and inferences done by using the GPU compute resources. As all of this is happening, what confidential computing allows you to do is create a memory area where the model weights as well as the data get loaded. And that memory region, whether it’s a CPU memory or the GPU memory, they stay encrypted at all times. So anybody who is trying to either do a wiretap or try to dump the memory of the system, what they will get is just garbage, because it’s all encrypted data. These are encrypted with keys that are burned and tied in the CPU and in the gpu. What Nvidia and their CPU partners have also done is make sure that the wire, the bus on which the data travels between CPU and gpu, that stays encrypted as well. And if you have a multi GPU system, even then all the GPU to GPU communication is encrypted as well. So now you get a completely encrypted system where the data is not visible from anybody sitting outside or even inside. Even if you have root permission, you still cannot look into the data. And while this is good for securing data and model weights at runtime, what you can also do is extend this trust boundary all the way to where the models were initially created, then they were encrypted, and make sure that the encrypted weights are now packaged inside the container image and then they are distributed. So now when the application comes up, there is a process called attestation, by which you can verify that it’s the right application running on the right machine, the right hardware, under the right configuration. And all of this can be measured and validated by the hardware. And only then the encryption key, which was initially used to encrypt the model weights are released directly inside this container, the configuration container, and then the model weights get decrypted, then the model runs. And at no point of time the model weight is exposed to a third party, to a malicious insider or somebody who’s trying to attack the system. It creates kind of an end to end encrypted loop by which models are distributed and they run securely inside a confidential computing environment.

Swapnil Bhartiya: Now I also want to talk a bit about both sides. Like if you look at the sensitive data going in and available model IP running on Kubernetes, how do enterprises protects both side at once?

Anand Kashyap: Yeah. So when it comes to deployment of AI in the enterprise, I like to think of it as there’s sometimes three interested parties. There are model builders who are building their model. They spend a lot of time, effort, money to train these models and for them the model weights are extremely important. They don’t want their model weights to be compromised or stolen or changed when they’re running. Then there’s the enterprise who’s actually using an AI model. And a lot of times they prefer proprietary models. They want to have the model as close to their data as possible. They want to run the models in their on prem environment. They don’t, they’re not very comfortable, especially with the most sensitive data to send it out over the Internet. And then there is an infrastructure provider. Now in some cases the infrastructure could be owned by the model builder itself. We see that with the big AI labs like OpenAI and Anthropic. Sometimes the infrastructure could be with the enterprise when they’re trying to run something on prem. But there is also a case where the infrastructure could be a third party. This could be a NEO cloud or a sovereign AI provider as well. So now we have three parties. We have a model builder or model owner, we have an enterprise which is the data owner, and then we have an infrastructure provider. And there is a lack of trust between each of these three parties and none of them trust each other. The model builder wants to protect their model weights, the enterprise wants to protect their data. The infrastructure has to show and demonstrate that everybody else can trust them as well. What confidential computing does is it provides a mechanism for all these three parties to establish trust between each other. If you can put the model and the data inside a confidential computing, you can attest to it. You can make sure that encrypted data can only be decrypted after attestation. And the keys can come from FPS143 level 3 validated HSM inside the secure enclave. Only then the data gets the model weights get decrypted, only then the model runs. Now you have a trust system that you have created, which is based on technology, based on hardware, rather than what the parties are saying to each other or what contracts they’re signing. So it’s more about proof and verification of both software and hardware, rather than promises made between the three parties.

Swapnil Bhartiya: You just mentioned earlier attestation. Can you talk about how does attestation work in this setup and what has to be verified before a single encryption key gets released?

Anand Kashyap: Yeah. So the way Fortanics takes advantage of the attestation capabilities of confidential computing is we build a small piece of software called Attestation Client that we embed inside a container image. Now, as the container gets deployed on a target system, that the station client comes up as the container starts and it measures the hardware, which is both the CPU as well as the gpu, it measures the configuration in which the hardware is. It measures the software as well. So it measures the hash of the binary of the application running inside the container image or the model weights. It packages all of that and creates a certificate signing request for a private key that was generated inside this trusted execution environment. All of that is sent to our cloud service, which is called Confidential Computing Manager, or CCM for short. Now, CCM has connections to attestation services from Nvidia, from intel, from AMD, or whoever else is providing confidential computing hardware. So now CCM can verify that the attestation report being sent by the attestation client, can that be trusted? Can that be. Is it actually a genuine attestation report being created by a genuine piece of hardware? The second thing it does is can the application image be trusted? Is the application image the same compared to what it was when it was created and packaged by the application developer, for example, a model builder. When they’re distributing secure models, they would first measure the model weights and add those measurements inside the CCM system. So now CCM will check whether the model weights are the same compared to what they were packaged inside the container image and the hardware can be trusted. The hardware configuration is correct, the BIOS has been updated, it’s running the latest microcode, and if all of that checks out, then we say, okay, now the attestation is successful. The cpu, the gpu, the application, they can all be trusted. And then CCM issues a certificate to the application. Now, the application can use this certificate to authenticate itself to our key management product, which is called Data security manager or DSM. It’s a unified HSM and KMS. It’s validated for FIPS 143, level three, so which means it’s most secure place to store and manage your encryption keys. When DSM gets a request to release a key, it checks whether the request is coming with a certificate that has been issued by ccm there’s a prior relationship that established between DSM and ccm, and only after everything is verified is a key released from DSM to inside this container, which is running. And with this key, the key could be used to either decrypt encrypted model weights, or it could be used to decrypt a persistent storage where some data will be written onto the disk. There could be multiple keys as well. So this is a mechanism by which you do attestation and then based on that attestation, you release keys or secrets to the application.