SentinelKEM: Securing AI Model Distribution Using Hybrid Cryptography

Abstract

Deep neural network (DNN) models are valuable intellectual property that can be copied or redistributed without authorization during distribution. Existing protection methods mainly rely on watermarking, which verifies ownership but does not secure model files during transfer. This study proposes SentinelKEM, a hybrid cryptographic framework that combines AES-256-GCM for authenticated encryption, Kyber/ML-KEM-768 with HKDF-derived key encryption keys for post-quantum key protection, Ed25519 digital signatures for ownership verification, and scrypt for passphrase-based private-key security. Encrypted models and cryptographic metadata are packaged into a secure ZIP archive, while private keys are distributed separately. During decryption, SHA-256 integrity verification and Ed25519 authentication are performed before model restoration. SentinelKEM was implemented as a Python Streamlit application and evaluated on various AI model formats, including .h5, .pt, .pth, .pkl, and .joblib. Experimental results showed successful encryption and decryption, reliable ownership authentication, effective tamper detection, and a constant cryptographic overhead of approximately 4.5 KB regardless of model size. Unlike watermarking, SentinelKEM protects AI models before recipient access through post-quantum key encapsulation and authenticated encryption, providing practical and robust security for AI model distribution.