1import torch
2import torch.nn as nn
3import hashlib
4import numpy as np
5from cryptography.hazmat.primitives import hashes
6from cryptography.hazmat.primitives.asymmetric import padding
7from cryptography.hazmat.primitives import serialization
8
9class ModelWatermarker:
10    def __init__(self, private_key_path):
11        """Initialize with organization's private key for signing."""
12        with open(private_key_path, 'rb') as key_file:
13            self.private_key = serialization.load_pem_private_key(
14                key_file.read(),
15                password=None
16            )
17    
18    def embed_watermark(self, model, watermark_text):
19        """Embed invisible watermark in model weights."""
20        # Convert model to state dict
21        state_dict = model.state_dict()
22        
23        # Create watermark hash
24        watermark_hash = hashlib.sha256(watermark_text.encode()).digest()
25        
26        # Embed in least significant bits of specific weights
27        for name, param in state_dict.items():
28            if 'weight' in name and param.dim() == 2:
29                # Select random positions for watermark
30                positions = self._select_embedding_positions(param, len(watermark_hash))
31                
32                # Embed watermark bits in LSBs
33                for i, pos in enumerate(positions):
34                    if i < len(watermark_hash):
35                        byte_val = watermark_hash[i]
36                        bit_positions = self._byte_to_bits(byte_val)
37                        
38                        # Embed 8 bits across 8 weights
39                        for j, bit in enumerate(bit_positions):
40                            if j < param.shape[1]:  # Stay within bounds
41                                # Set LSB to watermark bit
42                                param.data[pos[0], pos[1]+j] = self._set_lsb(
43                                    param.data[pos[0], pos[1]+j], bit
44                                )
45        
46        # Sign the watermarked model
47        signature = self._sign_model(state_dict)
48        
49        return state_dict, signature
50    
51    def verify_watermark(self, model, public_key_path):
52        """Extract and verify watermark from model."""
53        with open(public_key_path, 'rb') as key_file:
54            public_key = serialization.load_pem_public_key(key_file.read())
55        
56        state_dict = model.state_dict()
57        extracted_hash = self._extract_watermark(state_dict)
58        
59        # Verify against known watermarks
60        known_watermarks = self._get_known_watermarks()
61        for known_hash in known_watermarks:
62            if extracted_hash == known_hash:
63                print("Valid watermark found - model is authentic")
64                return True
65        
66        print("No valid watermark found - possible stolen model")
67        return False
68    
69    def _select_embedding_positions(self, tensor, num_positions):
70        """Select random positions for watermark embedding."""
71        rng = np.random.default_rng(seed=42)  # Deterministic for verification
72        positions = []
73        
74        for _ in range(num_positions):
75            i = rng.integers(0, tensor.shape[0])
76            j = rng.integers(0, tensor.shape[1] - 8)  # Leave room for 8 bits
77            positions.append((i, j))
78        
79        return positions
80    
81    def _set_lsb(self, value, bit):
82        """Set least significant bit of float32 value."""
83        # Convert to integer representation
84        int_repr = value.view(torch.int32)
85        # Clear LSB
86        int_repr = int_repr & 0xFFFFFFFE
87        # Set LSB
88        int_repr = int_repr | bit
89        # Convert back
90        return torch.tensor(int_repr, dtype=torch.float32)
91    
92    def _sign_model(self, state_dict):
93        """Create cryptographic signature of model."""
94        # Create hash of model weights
95        model_hash = hashlib.sha256()
96        for name, param in sorted(state_dict.items()):
97            model_hash.update(param.numpy().tobytes())
98        
99        # Sign the hash
100        signature = self.private_key.sign(
101            model_hash.digest(),
102            padding.PSS(
103                mgf=padding.MGF1(hashes.SHA256()),
104                salt_length=padding.PSS.MAX_LENGTH
105            ),
106            hashes.SHA256()
107        )
108        
109        return signature
110

1from cryptography.fernet import Fernet
2import base64
3import json
4
5class ModelEncryptionSystem:
6    def __init__(self, kms_key_arn):
7        """Initialize with KMS key for encryption operations."""
8        self.kms_key_arn = kms_key_arn
9        self.kms_client = boto3.client('kms')
10        
11    def encrypt_model_for_storage(self, model, s3_bucket, s3_key):
12        """Encrypt model before storing in S3."""
13        # Generate data key from KMS
14        response = self.kms_client.generate_data_key(
15            KeyId=self.kms_key_arn,
16            KeySpec='AES_256'
17        )
18        
19        plaintext_key = response['Plaintext']
20        encrypted_key = response['CiphertextBlob']
21        
22        # Serialize model
23        model_bytes = self._serialize_model(model)
24        
25        # Encrypt model with data key
26        fernet = Fernet(base64.urlsafe_b64encode(plaintext_key))
27        encrypted_model = fernet.encrypt(model_bytes)
28        
29        # Store encrypted model and encrypted key
30        s3_client = boto3.client('s3')
31        s3_client.put_object(
32            Bucket=s3_bucket,
33            Key=s3_key,
34            Body=encrypted_model,
35            Metadata={
36                'encrypted-key': base64.b64encode(encrypted_key).decode('utf-8'),
37                'kms-key-id': self.kms_key_arn
38            }
39        )
40        
41        return s3_key
42    
43    def decrypt_model_for_inference(self, s3_bucket, s3_key):
44        """Decrypt model for inference use."""
45        s3_client = boto3.client('s3')
46        response = s3_client.get_object(Bucket=s3_bucket, Key=s3_key)
47        
48        encrypted_model = response['Body'].read()
49        encrypted_key = base64.b64decode(response['Metadata']['encrypted-key'])
50        
51        # Decrypt data key with KMS
52        key_response = self.kms_client.decrypt(CiphertextBlob=encrypted_key)
53        plaintext_key = key_response['Plaintext']
54        
55        # Decrypt model with data key
56        fernet = Fernet(base64.urlsafe_b64encode(plaintext_key))
57        model_bytes = fernet.decrypt(encrypted_model)
58        
59        # Deserialize model
60        model = self._deserialize_model(model_bytes)
61        
62        return model
63    
64    def _serialize_model(self, model):
65        """Serialize model to bytes with integrity check."""
66        import pickle
67        import zlib
68        
69        # Serialize with pickle
70        pickled = pickle.dumps(model)
71        
72        # Add integrity hash
73        integrity_hash = hashlib.sha256(pickled).digest()
74        
75        # Compress
76        compressed = zlib.compress(pickled)
77        
78        # Package with integrity hash
79        packaged = json.dumps({
80            'integrity_hash': integrity_hash.hex(),
81            'compressed_model': base64.b64encode(compressed).decode('utf-8')
82        }).encode('utf-8')
83        
84        return packaged
85    
86    def _deserialize_model(self, model_bytes):
87        """Deserialize and verify integrity."""
88        import pickle
89        import zlib
90        
91        package = json.loads(model_bytes.decode('utf-8'))
92        
93        # Decompress
94        compressed = base64.b64decode(package['compressed_model'])
95        pickled = zlib.decompress(compressed)
96        
97        # Verify integrity
98        integrity_hash = hashlib.sha256(pickled).digest()
99        if integrity_hash.hex() != package['integrity_hash']:
100            raise ValueError("Model integrity check failed - possible tampering")
101        
102        # Deserialize
103        model = pickle.loads(pickled)
104        
105        return model
106

1from azure.confidentialcomputing import ConfidentialComputingClient
2from azure.identity import DefaultAzureCredential
3
4class ConfidentialTrainingEnvironment:
5    def __init__(self):
6        self.credential = DefaultAzureCredential()
7        self.cc_client = ConfidentialComputingClient(
8            credential=self.credential,
9            subscription_id=os.environ['AZURE_SUBSCRIPTION_ID']
10        )
11    
12    def create_confidential_training_cluster(self, cluster_name, region):
13        """Create confidential compute cluster with encrypted memory."""
14        # Create confidential VM SKU
15        vm_size = 'Standard_DC8_v3'  # Intel SGX enabled
16        
17        # Create attestation policy
18        attestation_policy = {
19            'sgx': {
20                'enclave_size': '256MB',
21                'allowed_mr_enclaves': [
22                    'known_good_enclave_hash_1',
23                    'known_good_enclave_hash_2'
24                ]
25            }
26        }
27        
28        # Provision cluster
29        cluster = self.cc_client.clusters.begin_create_or_update(
30            resource_group_name='ai-security-rg',
31            cluster_name=cluster_name,
32            parameters={
33                'location': region,
34                'properties': {
35                    'clusterType': 'Confidential',
36                    'vmSize': vm_size,
37                    'nodeCount': 4,
38                    'attestationPolicy': attestation_policy,
39                    'confidentialComputeOptions': {
40                        'enableConfidentialCompute': True,
41                        'enclaveType': 'SGX'
42                    }
43                }
44            }
45        ).result()
46        
47        return cluster
48    
49    def attest_training_enclave(self, enclave_measurement):
50        """Verify training enclave integrity before sending data."""
51        attestation_result = self.cc_client.attestation.attest_sev_snp_vm(
52            resource_group_name='ai-security-rg',
53            location='eastus',
54            parameters={
55                'maaEndpoint': 'https://shared.eus.attest.azure.net',
56                'attestationData': enclave_measurement
57            }
58        )
59        
60        if attestation_result.status != 'Success':
61            raise SecurityError("Enclave attestation failed - untrusted environment")
62        
63        return attestation_result
64    
65    def train_with_confidential_data(self, sensitive_dataset, model):
66        """Train model with data that never leaves encrypted memory."""
67        # Data stays encrypted until inside attested enclave
68        # Enclave decrypts, trains, encrypts results
69        
70        enclave_code = """
71        // Enclave code (simplified)
72        void train_in_enclave(encrypted_data, encrypted_model) {
73            // Decrypt inside enclave
74            plain_data = decrypt(encrypted_data, enclave_key);
75            plain_model = decrypt(encrypted_model, enclave_key);
76            
77            // Train - all operations in protected memory
78            trained_model = train(plain_model, plain_data);
79            
80            // Encrypt results before leaving enclave
81            encrypted_result = encrypt(trained_model, enclave_key);
82            
83            return encrypted_result;
84        }
85        """
86        
87        # Implementation would use actual enclave programming
88        # (Intel SGX, AMD SEV, or Azure Confidential Computing)
89        
90        return "encrypted_trained_model"
91

1import numpy as np
2from sklearn.preprocessing import StandardScaler
3import torch
4
5class DifferentialPrivacyTrainer:
6    def __init__(self, epsilon=1.0, delta=1e-5):
7        """
8        Initialize differential privacy trainer.
9        
10        ε (epsilon): Privacy budget (lower = more private)
11        δ (delta): Probability of privacy failure
12        """
13        self.epsilon = epsilon
14        self.delta = delta
15    
16    def add_laplace_noise(self, gradient, sensitivity):
17        """Add Laplace noise to gradients for DP-SGD."""
18        # Calculate noise scale
19        scale = sensitivity / self.epsilon
20        
21        # Generate Laplace noise
22        noise = np.random.laplace(0, scale, gradient.shape)
23        
24        return gradient + noise
25    
26    def clip_gradients(self, gradients, clip_norm=1.0):
27        """Clip gradients to bound sensitivity."""
28        norm = torch.norm(gradients)
29        if norm > clip_norm:
30            gradients = gradients * (clip_norm / norm)
31        
32        return gradients
33    
34    def dp_sgd_step(self, model, loss, optimizer):
35        """Differentially private SGD step."""
36        # Compute gradients
37        loss.backward()
38        
39        # Clip gradients
40        for param in model.parameters():
41            if param.grad is not None:
42                param.grad = self.clip_gradients(param.grad)
43        
44        # Add noise to gradients
45        for param in model.parameters():
46            if param.grad is not None:
47                sensitivity = 2.0  # After clipping
48                noisy_grad = self.add_laplace_noise(param.grad.numpy(), sensitivity)
49                param.grad = torch.tensor(noisy_grad)
50        
51        # Update weights
52        optimizer.step()
53        
54        # Account privacy budget
55        self._update_privacy_budget()
56        
57    def _update_privacy_budget(self):
58        """Track privacy budget using moments accountant."""
59        # Simplified implementation
60        # Real implementation would use TensorFlow Privacy or Opacus
61        pass
62    
63    def get_privacy_guarantees(self, num_iterations):
64        """Calculate formal privacy guarantees."""
65        # Using moments accountant formula
66        # (ε, δ) - differential privacy guarantee
67        epsilon_used = self.epsilon * np.sqrt(num_iterations)
68        
69        return {
70            'epsilon': epsilon_used,
71            'delta': self.delta,
72            'guarantee': f"({epsilon_used:.2f}, {self.delta}) differential privacy"
73        }
74

1# network-policy-ml.yaml
2apiVersion: networking.k8s.io/v1
3kind: NetworkPolicy
4metadata:
5  name: ml-training-isolation
6  namespace: ml-production
7spec:
8  podSelector:
9    matchLabels:
10      app: ml-training
11  policyTypes:
12  - Ingress
13  - Egress
14  ingress:
15  - from:
16    - podSelector:
17        matchLabels:
18          role: data-preprocessor
19    ports:
20    - protocol: TCP
21      port: 8080
22  - from:
23    - namespaceSelector:
24        matchLabels:
25          name: model-registry
26    ports:
27    - protocol: TCP
28      port: 9000
29  egress:
30  - to:
31    - ipBlock:
32        cidr: 10.0.0.0/8
33        except:
34        - 10.1.0.0/16  # Block access to sensitive data vault
35    ports:
36    - protocol: TCP
37      port: 443
38  - to:
39    - podSelector:
40        matchLabels:
41          app: tensorboard
42    ports:
43    - protocol: TCP
44      port: 6006
45---
46# Network policy for inference endpoints
47apiVersion: networking.k8s.io/v1
48kind: NetworkPolicy
49metadata:
50  name: ml-inference-isolation
51spec:
52  podSelector:
53    matchLabels:
54      app: ml-inference
55  ingress:
56  - from:
57    - ipBlock:
58        cidr: 0.0.0.0/0  # Allow from anywhere
59    ports:
60    - protocol: TCP
61      port: 8080
62  egress:
63  - to:
64    - podSelector:
65        matchLabels:
66          app: feature-store
67    ports:
68    - protocol: TCP
69      port: 6379
70

1{
2  "Version": "2012-10-17",
3  "Statement": [
4    {
5      "Sid": "MLTrainingPermissions",
6      "Effect": "Allow",
7      "Action": [
8        "s3:GetObject",
9        "s3:ListBucket"
10      ],
11      "Resource": [
12        "arn:aws:s3:::training-data-bucket/*",
13        "arn:aws:s3:::training-data-bucket"
14      ],
15      "Condition": {
16        "StringEquals": {
17          "s3:ExistingObjectTag/DataClassification": "Training"
18        }
19      }
20    },
21    {
22      "Sid": "ModelRegistryAccess",
23      "Effect": "Allow",
24      "Action": [
25        "sagemaker:CreateModel",
26        "sagemaker:DescribeModel"
27      ],
28      "Resource": "arn:aws:sagemaker:*:*:model/*",
29      "Condition": {
30        "StringEquals": {
31          "aws:PrincipalTag/Team": "ML-Engineering"
32        }
33      }
34    },
35    {
36      "Sid": "DenySensitiveDataAccess",
37      "Effect": "Deny",
38      "Action": "s3:*",
39      "Resource": [
40        "arn:aws:s3:::sensitive-data-bucket/*",
41        "arn:aws:s3:::sensitive-data-bucket"
42      ]
43    }
44  ]
45}
46

1import boto3
2import json
3from policyuniverse.policy import Policy
4
5class AIComplianceAutomator:
6    def __init__(self):
7        self.config_client = boto3.client('config')
8        self.securityhub_client = boto3.client('securityhub')
9        
10    def check_gdpr_compliance(self, ml_system_config):
11        """Check GDPR compliance for AI system."""
12        violations = []
13        
14        # Right to explanation check
15        if not ml_system_config.get('explainability_enabled'):
16            violations.append("GDPR Article 22: No explainability for automated decisions")
17        
18        # Data minimization check
19        if ml_system_config.get('data_retention_days', 0) > 30:
20            violations.append("GDPR Article 5: Excessive data retention")
21        
22        # Privacy by design check
23        if not ml_system_config.get('differential_privacy_enabled'):
24            violations.append("GDPR Article 25: No privacy by design/default")
25        
26        return violations
27    
28    def check_hipaa_compliance(self, ml_system_config):
29        """Check HIPAA compliance for healthcare AI."""
30        violations = []
31        
32        # PHI encryption check
33        if not ml_system_config.get('encryption_at_rest'):
34            violations.append("HIPAA §164.312(a)(1): No encryption at rest")
35        
36        # Audit controls check
37        if not ml_system_config.get('audit_logging_enabled'):
38            violations.append("HIPAA §164.312(b): No audit controls")
39        
40        # Access controls check
41        if ml_system_config.get('public_access_allowed'):
42            violations.append("HIPAA §164.312(a)(1): Public access to PHI")
43        
44        return violations
45    
46    def check_eu_ai_act_compliance(self, ml_system_config):
47        """Check EU AI Act compliance."""
48        violations = []
49        
50        # Risk categorization
51        risk_level = ml_system_config.get('risk_level', 'unknown')
52        
53        if risk_level == 'high':
54            # High-risk AI systems requirements
55            if not ml_system_config.get('human_oversight'):
56                violations.append("EU AI Act Article 14: No human oversight for high-risk AI")
57            
58            if not ml_system_config.get('risk_management_system'):
59                violations.append("EU AI Act Article 9: No risk management system")
60            
61            if not ml_system_config.get('technical_documentation'):
62                violations.append("EU AI Act Article 11: No technical documentation")
63        
64        return violations
65    
66    def generate_compliance_report(self, ml_system_config):
67        """Generate comprehensive compliance report."""
68        report = {
69            'gdpr': {
70                'status': 'compliant',
71                'violations': self.check_gdpr_compliance(ml_system_config)
72            },
73            'hipaa': {
74                'status': 'compliant',
75                'violations': self.check_hipaa_compliance(ml_system_config)
76            },
77            'eu_ai_act': {
78                'status': 'compliant',
79                'violations': self.check_eu_ai_act_compliance(ml_system_config)
80            },
81            'overall_status': 'compliant'
82        }
83        
84        # Determine overall status
85        all_violations = []
86        for framework in ['gdpr', 'hipaa', 'eu_ai_act']:
87            all_violations.extend(report[framework]['violations'])
88            if report[framework]['violations']:
89                report[framework]['status'] = 'non-compliant'
90        
91        if all_violations:
92            report['overall_status'] = 'non-compliant'
93        
94        report['violations'] = all_violations
95        report['recommendations'] = self.generate_recommendations(all_violations)
96        
97        return report
98    
99    def generate_recommendations(self, violations):
100        """Generate remediation recommendations."""
101        recommendations = []
102        
103        violation_to_remediation = {
104            "GDPR Article 22: No explainability for automated decisions": 
105                "Implement SHAP/LIME explainability for all model predictions",
106            "GDPR Article 5: Excessive data retention":
107                "Reduce data retention to 30 days maximum",
108            "HIPAA §164.312(a)(1): No encryption at rest":
109                "Enable AES-256 encryption for all data storage",
110            "EU AI Act Article 14: No human oversight for high-risk AI":
111                "Implement human-in-the-loop review for high-risk predictions"
112        }
113        
114        for violation in violations:
115            if violation in violation_to_remediation:
116                recommendations.append(violation_to_remediation[violation])
117        
118        return recommendations
119

1class AISecurityMonitor:
2    def __init__(self):
3        self.prometheus_client = PrometheusConnect()
4        self.grafana_client = GrafanaApi()
5        
6    def monitor_model_extraction_attempts(self, endpoint_name):
7        """Detect model extraction attacks via inference patterns."""
8        metrics = [
9            'inference_requests_per_client',
10            'inference_input_diversity',
11            'request_burst_detection',
12            'query_pattern_analysis'
13        ]
14        
15        thresholds = {
16            'inference_requests_per_client': 1000,  # >1000 requests from single client
17            'input_diversity_score': 0.1,  # Low diversity suggests extraction
18            'burst_detection': 100  # >100 requests/minute
19        }
20        
21        alerts = []
22        
23        for metric in metrics:
24            value = self.prometheus_client.get_current_metric_value(
25                metric_name=f'ai_security_{metric}',
26                label_config={'endpoint': endpoint_name}
27            )
28            
29            if value and value > thresholds.get(metric, float('inf')):
30                alerts.append(f"Model extraction attempt detected: {metric} = {value}")
31        
32        return alerts
33    
34    def monitor_data_poisoning(self, training_job_id):
35        """Detect data poisoning in training datasets."""
36        # Monitor for:
37        # 1. Unexpected data distribution shifts
38        # 2. Suspicious data sources
39        # 3. Anomalous feature values
40        
41        distribution_shift = self._calculate_distribution_shift(training_job_id)
42        data_source_anomalies = self._check_data_sources(training_job_id)
43        feature_anomalies = self._detect_feature_anomalies(training_job_id)
44        
45        alerts = []
46        
47        if distribution_shift > 0.5:  # 50% shift
48            alerts.append(f"Data distribution shift: {distribution_shift:.2f}")
49        
50        if data_source_anomalies:
51            alerts.append(f"Suspicious data sources: {data_source_anomalies}")
52        
53        if feature_anomalies:
54            alerts.append(f"Anomalous feature values detected")
55        
56        return alerts
57    
58    def monitor_adversarial_attacks(self, endpoint_name):
59        """Detect adversarial example attacks."""
60        # Monitor for:
61        # 1. Inputs optimized to cause misclassification
62        # 2. Gradient-based attack patterns
63        # 3. Confidence score anomalies
64        
65        confidence_anomalies = self._check_confidence_scores(endpoint_name)
66        gradient_patterns = self._analyze_gradient_patterns(endpoint_name)
67        input_perturbations = self._detect_input_perturbations(endpoint_name)
68        
69        alerts = []
70        
71        if confidence_anomalies:
72            alerts.append("Low confidence predictions suggesting adversarial inputs")
73        
74        if gradient_patterns:
75            alerts.append("Gradient attack patterns detected")
76        
77        if input_perturbations:
78            alerts.append("Input perturbation patterns detected")
79        
80        return alerts
81    
82    def generate_security_dashboard(self):
83        """Generate AI security dashboard."""
84        dashboard = {
85            'model_protection': {
86                'watermark_verification': 'enabled',
87                'encryption_status': 'enabled',
88                'extraction_attempts': self.get_extraction_attempts_count()
89            },
90            'data_security': {
91                'encryption_in_transit': 'enabled',
92                'encryption_at_rest': 'enabled',
93                'poisoning_detection': 'enabled'
94            },
95            'infrastructure_security': {
96                'network_policies': 'enforced',
97                'iam_least_privilege': 'verified',
98                'vulnerability_scans': 'daily'
99            },
100            'compliance': {
101                'gdpr': self.check_gdpr_compliance(),
102                'hipaa': self.check_hipaa_compliance(),
103                'eu_ai_act': self.check_eu_ai_act_compliance()
104            }
105        }
106        
107        return dashboard
108