# US 11,443,243 B2 · Method and system for artificial intelligence model training using a watermark-enabled kernel for a data processing accelerator

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,443,243 B2
- Document ID: US11443243B2
- Status: Granted
- Kind: B2
- Application number: 16/598,151
- Filed: 2019-10-10
- Published: 2021-04-15
- Granted: 2022-09-13
- Earliest claimed: 2019-10-10
- Assignees: Baidu USA LLC; Kunlunxin Technology (Beijing) Company Limited
- Applicants: Baidu USA LLC
- Inventors: Yueqiang Cheng; Yong Liu
- Web page: https://patentgrep.com/patent/US11443243B2

## CPC

- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- G06F 15/80: comprising an array of processing units with common control, e.g. single instruction multiple data processors (G06F15/82 takes precedence {; for correlation function computation G06F17/15})
- G06F 21/16: Program or content traceability, e.g. by watermarking
- G06N 20/00: Machine learning
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3247: {involving digital signatures}
- G06F 21/1063: {Personalisation}
- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 2209/125: Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
- H04L 2209/16: Obfuscation or hiding, e.g. involving white box
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In one embodiment, a computer-implemented method performed by a data processing (DP) accelerator, includes receiving, at the DP accelerator, first data representing a set of training data from a host processor; receiving, at the DP accelerator, a watermark kernel from the host processor; and executing the watermark kernel within the DP accelerator on an artificial intelligence (AI) model. The watermark kernel, when executed, is configured to: generate a watermark, train the AI model using the set of training data, and implant the watermark within the AI model during training of the AI model. The DP accelerator then transmits second data representing the trained AI model having the watermark implanted therein to the host processor. In an embodiment, the method further includes receiving a pre-trained AI model and the training is performed for the pre-trained AI model.

## Claims

### Claim 1

A computer-implemented method performed by a data processing (DP) accelerator, the method comprising:
receiving, at the DP accelerator, first data representing a set of training data from a host processor;
receiving, at the DP accelerator, a watermark kernel from the host processor;
executing the watermark kernel within the DP accelerator on an artificial intelligence (AI) model, wherein the watermark kernel, when executed, is configured to:
generate a watermark,
train the AI model using the set of training data, and
implant the watermark within the AI model during training of the AI model; and
transmitting second data representing the trained AI model having the watermark implanted therein to the host processor.

### Claim 2 (depends on 1)

The method of claim 1, further comprising receiving a pre-trained AI model, wherein the training is performed for the pre-trained AI model.

### Claim 3 (depends on 1)

The method of claim 1, further comprising receiving a set of input data from the host processor, wherein the watermark kernel is executed on the set of input data, and wherein the watermark is generated based on the set of input data.

### Claim 4 (depends on 3)

The method of claim 3, wherein the set of input data includes information describing the watermark.

### Claim 5 (depends on 1)

The method of claim 1, wherein implanting the watermark in the AI model comprises embedding the watermark in one or more nodes of the AI model.

### Claim 6 (depends on 4)

The method of claim 4, wherein the watermark is stored in one or more weight variables of the one or more nodes of the AI model.

### Claim 7 (depends on 4)

The method of claim 4, wherein the watermark is stored in one or more bias variables of the one or more nodes of the AI model.

### Claim 8 (depends on 1)

The method of claim 1, wherein implanting the watermark in the AI model comprises creating one or more additional nodes of the AI model during the training to store the watermark.

### Claim 9

A data processing (DP) accelerator, comprising:
an interface to receive first data representing a set of training data and to receive a watermark kernel from a host processor; and
a kernel executor to execute the watermark kernel on an artificial intelligence (AI) model, wherein the watermark kernel, when executed, is configured to:
generate a watermark,
train the AI model using the set of training data, and
implant the watermark within the AI model during training of the AI model,
wherein second data representing the trained AI model having the watermark implanted therein is transmitted to the host processor.

### Claim 10 (depends on 9)

The DP accelerator of claim 9, the interface further configured to receive a pre-trained AI model, wherein the training is performed for the pre-trained AI model.

### Claim 11 (depends on 9)

The DP accelerator of claim 9, wherein the interface is further to receive a set of input data from the host processor, wherein the watermark kernel is executed on the set of input data, and wherein the watermark is generated based on the set of input data.

### Claim 12 (depends on 11)

The DP accelerator of claim 11, wherein the set of input data includes information describing the watermark.

### Claim 13 (depends on 9)

The DP accelerator of claim 9, wherein implanting the watermark in the AI model comprises embedding the watermark in one or more nodes of the AI model.

### Claim 14 (depends on 13)

The DP accelerator of claim 13, wherein the watermark is stored in one or more weight variables of the one or more nodes of the AI model.

### Claim 15 (depends on 13)

The DP accelerator of claim 13, wherein the watermark is stored in one or more bias variables of the one or more nodes of the AI model.

### Claim 16 (depends on 9)

The DP accelerator of claim 9, wherein implanting the watermark in the AI model comprises creating one or more additional nodes of the AI model during the training to store the watermark.

### Claim 17 (depends on 9)

The DP accelerator of claim 9, wherein the receiving from, and transmitting to, the host processor is performed over a link that comprises a peripheral component interconnect express (PCIe) channel.

### Claim 18

A non-transitory machine-readable medium having instructions stored therein, which when executed by a data processing (DP) accelerator, cause the DP accelerator to perform operations, the operations comprising:
receiving, at the DP accelerator, first data representing a set of training data from a host processor;
receiving, at the DP accelerator, a watermark kernel from the host processor;
executing the watermark kernel within the DP accelerator on an AI model, wherein
the watermark kernel, when executed, is configured to
generate a watermark,
train the AI model using the set of training data, and
implant the watermark within the AI model during training of the AI model; and
transmitting second data representing the trained AI model having the watermark implanted therein to the host processor.

### Claim 19 (depends on 18)

The machine-readable medium of claim 18, wherein the operations further comprise receiving a set of input data from the host processor, wherein the watermark kernel is executed on the set of input data, and wherein the watermark is generated based on the set of input data.

### Claim 20 (depends on 19)

The machine-readable medium of claim 19, wherein the set of input data includes information describing the watermark.

### Claim 21 (depends on 18)

The machine-readable medium of claim 18, wherein implanting the watermark in the AI model comprises embedding the watermark in one or more nodes of the AI model.