Learning input preprocessing for hardening machine learning models

Abstract

Various embodiments are provided for protecting machine learning models in a computing system by one or more processors. One or more hardened machine learning models protected against adversarial attacks are provided by applying one or more of a plurality of combinations of selected preprocessing operations from one or more machine learning models, a data set for hardening the one or more machine learning models, a list of preprocessors, and a selected number of learners.

Description

Technical Field

[0001] The present invention relates generally to computing systems and, more particularly, to various embodiments for using a computing processor in a computing system to learn input preprocessing to harden a machine learning model against an adversary. Background Art

[0002] Computing systems can be found in the workplace, home, or school. Due to recent advances in information technology and the growing popularity of the Internet, a wide variety of computer systems have been used in machine learning. Machine learning is a form of artificial intelligence that is employed to allow computers to evolve behavior based on empirical data. Machine learning can use training examples to capture the properties of interest underlying its unknown probability distribution. Training data can be viewed as examples that show the relationship between observed variables. The main focus of machine learning research is to automatically learn to recognize complex patterns and make intelligent decisions based on data. Summary of the invention

[0003] Various embodiments are provided for learning input preprocessing by one or more processors in a computing system to harden a machine learning model against an adversary. In one embodiment, by way of example only, a method is provided for learning input preprocessing again by a processor in a computing system to harden a machine learning model against an adversary. By applying one or more of a plurality of combinations of selected preprocessing operations from one or more machine learning models, a data set for hardening the one or more machine learning models, a list of preprocessors, and a selected number of learners, one or more hardened machine learning models protected against an adversarial system are provided.

[0004] According to one aspect, a method for protecting machine learning models in a computing environment by one or more processors is provided, comprising: providing one or more hardened machine learning models protected against adversarial attacks by applying one or more of a plurality of combinations of selected preprocessing operations from the one or more machine learning models, a data set for hardening the one or more machine learning models, a list of preprocessors, and a selected number of learners.

[0005] According to another aspect, a system for protecting machine learning models in a computing environment is provided, comprising: one or more computers having executable instructions, which when executed cause the system to: provide one or more hardened machine learning models protected against adversarial attacks by applying one or more of a plurality of combinations of selected preprocessing operations from the one or more machine learning models, a data set for hardening the one or more machine learning models, a list of preprocessors, and a selected number of learners.

[0006] According to another aspect, a computer program product for protecting a machine learning model by a processor in a computing environment is provided, the computer program product comprising a non-transitory computer-readable storage medium having a computer-readable program code portion stored therein, the computer-readable program code portion comprising: an executable portion, the executable portion providing one or more hardened machine learning models protected against adversarial attacks by applying one or more of a plurality of combinations of selected preprocessing operations from one or more machine learning models, a data set for hardening the one or more machine learning models, a list of preprocessors, and a selected number of learners. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Preferred embodiments of the present invention will now be described, by way of example only, with reference to the following drawings:

[0008] Figure 1 is a block diagram depicting an exemplary cloud computing node according to an embodiment of the present invention;

[0009] Figure 2 is an additional block diagram illustrating an exemplary cloud computing environment according to an embodiment of the present invention;

[0010] Figure 3 is an additional block diagram illustrating the abstract model layers according to an embodiment of the present invention;

[0011] Figures 4A-4D is a block diagram depicting exemplary operations for learning input preprocessing to harden a machine learning model against an adversary system according to another embodiment of the present invention;

[0012] Figure 5 is a flow chart depicting an exemplary method of learning input pre-processing by a processor in a computing environment to harden a machine learning model against an adversary / adversary system in which embodiments of the present invention may be implemented; and

[0013] Figure 6 is a flow chart depicting an exemplary method for learning input preprocessing by a processor in a computing environment to harden a machine learning model against an adversary / adversary system, in which embodiments of the present invention may be implemented. DETAILED DESCRIPTION

[0014] The present invention generally relates to the field of artificial intelligence ("AI"), such as, for example, machine learning and / or deep learning. Deep learning refers to a class of machine learning algorithms based on learning multiple levels of features or representations of a data set. Current deep learning methods include the use of cascaded, multi-layer nonlinear processing units to perform feature extraction and transformation. Feature extraction refers to the process of receiving an initial set of measured data and constructing derived values ​​(or features) to facilitate subsequent learning and generalization steps. In many cases, higher-level features are derived from lower-level features to generate a hierarchical representation of measured data and derived features.

[0015] Furthermore, deep learning algorithms are based on distributed representations. Distributed representations operate under the assumption that the observed (or measured) data is the result of the interaction of one or more factors organized into one or more layers. Conceptually, deep learning introduces the additional assumption that the layers of factors that interact to provide the measured data represent levels of abstraction or composition. Under this assumption, multiple layers and layer sizes correspond to different amounts of abstraction.

[0016] In summary, deep learning has led to significant progress in optimizing decision making and extracting business value from unstructured data such as, for example, images, audio, video, and text. However, while deep learning achieves improved computing performance for a wide variety of data types and tasks, there are some challenges, weaknesses, and / or security issues with deep neural networks (DNNs). For example, DNNs are vulnerable to adversarial attacks, in which an adversary can completely change the behavior of the DNN by making imperceptible changes to its inputs. In addition, adversaries / adversarial systems (e.g., which can implement adversarial attacks) can also be installed in the physical world, posing a real threat to the deployment of AI and deep learning, particularly in safety-critical applications such as biometrics, network security, autonomous vehicles, and robots. Therefore, protecting against adversarial samples and securing machine learning / deep learning are necessary to ensure the safe deployment of AI and DL in real-world safety-critical applications and to maintain trust in AI systems more broadly.

[0017] Therefore, various embodiments are provided herein for learning input preprocessing in a computing system to reinforce machine learning models against adversary / hostile systems. By applying one or more of a plurality of combinations of selected preprocessing operations from one or more machine learning models, a data set for reinforcing one or more machine learning models, a list of preprocessors, and a selected number of learners, one or more reinforced machine learning models protected against adversary / adversarial systems (e.g., adversarial attacks) are provided. In one embodiment, the adversary / adversarial system may be any system, application, process, operation, or other I / O that challenges or compromises the integrity or processing intent of the ML system, or intentionally or unintentionally manipulates the ML system without authorization or approval. Simply put, the adversary / adversarial system may be undetectable by the machine learning system, and may intentionally or unintentionally cause the machine learning to make mistakes or errors.

[0018] In one embodiment, the machine learning model reinforcement operation may include making the machine learning model more robust against adversarial perturbations by enhancing training data, preprocessing input data, and making changes to the machine learning model architecture or training algorithm, or a combination of the foregoing. In one embodiment, the preprocessed input data provides direct integration with a given machine learning model to reinforce the machine learning model and provide the fastest adversarial defense operation (e.g., with little or no overhead during training / inference). In one embodiment, the preprocessed input data can be effectively combined with other adversarial defense operations, such as, for example, adversarial training or runtime detection. Therefore, the present invention preferably provides for combining preprocessing operations in an optimized manner to improve the ability of the machine learning model to defend against adversaries / adversarial systems (e.g., adversarial attacks). Therefore, a preferred embodiment of the present invention provides for systematically and programmatically learning the optimal combination of preprocessing techniques to achieve overall adversarial robustness. In this way, the present invention preferably reinforces machine learning models against adversarial challenges and enables the deployment of secure machine learning models, especially in safety-critical applications (e.g., health care, insurance, finance, etc.).

[0019] In additional embodiments, the machine learning model can be hardened against an adversary / adversarial system consisting of a computer, a CPU, a GPU, a server, a preprocessor, a learner, and a neural network. The present invention may preferably perform one or more of the following steps. In step 1), one or more models to be hardened, a data set to be used for hardening (hardening the machine learning model), a list of preprocessors, and a plurality of learners to be used may all be received as input data. In step 2), one or more preprocessors may receive one or more data instances from a data set as input, transform the data instances by applying one or more transformations, and provide the transformed data instances as output. In step 3), one or more trained learners of the machine learning model for defense hardening may preprocess the machine learning model input. In step 4), a hardened machine learning model may be provided / generated as an output based on a combination of learned preprocessors. In step 5), a threat score describing the performance of the hardened machine learning model may be determined, calculated, and / or reported. It should be noted that hardening of machine learning models may also be provided as a service in a cloud-based environment.

[0020] Furthermore, it should be noted that various mathematical operations or functions that may involve one or more mathematical operations may be used to perform one or more calculations (e.g., performing rate of change / calculus operations, solving differential or partial differential equations analytically or computationally, using addition, subtraction, division, multiplication, standard deviation, mean, average, percentages, statistical modeling using statistical distributions, by finding minimum, maximum, or similar thresholds of combined variables, etc.).

[0021] Generally, as used herein, "optimization" may refer to and / or be defined as "maximizing," "minimizing," or achieving one or more specific purposes, objectives, goals, or intentions. Optimization may also refer to maximizing benefits to a user (e.g., maximizing machine learning model benefits). Optimization may also refer to making the most efficient or functional use of a situation, opportunity, or resource.

[0022] Additionally, "optimization" need not refer to an optimal solution or result, but may refer to a solution or result that is "good enough," for example, for a particular application. In some implementations, the goal is to recommend an "optimal" combination of preprocessing operations ("preprocessors") and / or machine learning models, but there may be a variety of factors that may lead to alternative recommendations for combinations of preprocessing operations ("preprocessors") and / or machine learning models that produce better results. As used herein, the term "optimization" may refer to such results based on a minimum value (or maximum value, depending on what parameters are considered in the optimization problem). In additional embodiments, the terms "optimize" and / or "optimizing" may refer to operations performed to achieve an improved result, such as reducing execution costs or increasing resource utilization, regardless of whether the optimal result is actually achieved. Similarly, the term "optimization" may refer to a component used to perform such an improved operation, and the term "optimization" may be used to describe the results of such an improved operation.

[0023] It is understood in advance that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0024] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with service providers. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0025] Features are as follows:

[0026] On-demand self-service: Cloud consumers can unilaterally provision computing capabilities, such as server time and network storage, automatically on demand without requiring human interaction with the provider of the service.

[0027] Broad Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0028] Resource pooling: The computing resources of a provider are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence, as consumers typically have no control or knowledge of the exact location of the provided resources, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0029] Rapid elasticity: Capacity can be quickly and elastically, and in some cases automatically, provisioned to quickly scale down, and quickly released to quickly scale up. To the consumer, the capacity available for provisioning generally appears unlimited and can be purchased at any time and in any quantity.

[0030] Measured services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0031] The service model is as follows:

[0032] Software as a Service (SaaS): The capability provided to the consumer is to use the provider's applications running on the cloud infrastructure. The applications are accessible from different client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0033] Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired by consumers onto cloud infrastructure. The applications are created using programming languages ​​and tools supported by the provider. Consumers do not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage devices, but have control over the deployed applications and possible configuration of the application hosting environment.

[0034] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, network, and other basic computing resources that consumers can deploy and run arbitrary software, including operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and possibly limited control over select networking components (e.g., host firewalls).

[0035] The deployment model is as follows:

[0036] Private Cloud: A cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0037] Community Cloud: Cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-site or off-site.

[0038] Public cloud: Cloud infrastructure is made available to the public or large industry groups and is owned by an organization that sells cloud services.

[0039] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain distinct entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0040] The cloud computing environment is service-oriented and focuses on statelessness, low coupling, modularity, and semantic interoperability. The core of cloud computing is the infrastructure that includes a network of interconnected nodes.

[0041] Reference now Figure 1 , a schematic diagram of an example of a cloud computing node is shown. Cloud computing node 10 is only one example of a suitable cloud computing node and is not intended to impose any limitations on the scope of use or functionality of the embodiments of the present invention described herein. Regardless, cloud computing node 10 can be implemented and / or perform any of the functions set forth above.

[0042] In cloud computing node 10, there is a computer system / server 12, which can operate with many other general or special computing system environments or configurations. Examples of well-known computing systems, environments, and / or configurations suitable for use with computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments including any of the above systems or devices, etc.

[0043] Computer system / server 12 may be described in the general context of computer system executable instructions, such as program modules, executed by the computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform specific tasks or implement specific abstract data types. Computer system / server 12 may be practiced in a distributed cloud computing environment, where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in local and remote computer system storage media including memory storage devices.

[0044] like Figure 1As shown, the computer system / server 12 in the cloud computing node 10 is shown in the form of a general-purpose computing device. The components of the computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, a system memory 28, and a bus 18 that couples various system components including the system memory 28 to the processor 16.

[0045] Bus 18 represents one or more slave bus structures of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0046] Computer system / server 12 typically includes a variety of computer system readable media. Such media can be any available media that can be accessed by computer system / server 12, and includes volatile and nonvolatile media, removable and non-removable media.

[0047] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The computer system / server 12 may also include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, a storage system 34 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium (not shown, and commonly referred to as a "hard drive"). Although not shown, a disk drive for reading from and writing to a removable, non-volatile disk (e.g., a "floppy disk") may be provided, as well as an optical drive for reading from or writing to a removable, non-volatile optical disk such as a CD-ROM, DVD-ROM or other optical media. In such a case, each drive may be connected to the bus 18 via one or more data media interfaces. As will be further depicted and described below, the system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of an embodiment of the present invention.

[0048] By way of example and not limitation, a program / utility 40 having a set (at least one) of program modules 42, as well as an operating system, one or more application programs, other program modules, and program data may be stored in system memory 28. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may include an implementation of a networking environment. Program modules 42 generally perform the functions and / or methods of embodiments of the present invention described herein.

[0049] The computer system / server 12 may also communicate with one or more external devices 14, such as a keyboard, pointing device, display 24, etc.; one or more devices that enable a user to interact with the computer system / server 12; and / or any device that enables the computer system / server 12 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may occur via an input / output (I / O) interface 22, however, the computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a general purpose wide area network (WAN), and / or a public network (e.g., the Internet), via a network adapter 20. As shown, the network adapter 20 communicates with other components of the computer system / server 12 via a bus 18, and it should be understood that, although not shown, other hardware and / or software components may be used in conjunction with the computer system / server 12, examples of which include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

[0050] Reference now Figure 2 , depicts an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10, and local computing devices used by cloud consumers (such as, for example, personal digital assistants (PDAs) or mobile phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N) can communicate with the cloud computing nodes 10. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as the private clouds, community clouds, public clouds, or hybrid clouds described above, or a combination thereof. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as a service that cloud consumers do not need to maintain resources on local computing devices. It should be understood that Figure 2 The types of computing devices 54A-N shown in are intended to be illustrative only, and computing node 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network addressable connection (eg, using a web browser).

[0051] Reference now Figure 3, showing the cloud computing environment 50 ( Figure 2 ) provides a set of functional abstraction layers. It should be understood in advance that Figure 3 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0052] The device layer 55 includes physical and / or virtual devices, embedded and / or independent electronics, sensors, actuators and other objects to perform various tasks in the cloud computing environment 50. Each of the devices in the device layer 55 combines networking capabilities with other functional abstraction layers so that information obtained from the device can be provided to the device, and / or information from other abstraction layers can be provided to the device. In one embodiment, the various devices including the device layer 55 can be incorporated into a network of entities collectively referred to as the "Internet of Things" (IoT). As will be understood by those of ordinary skill in the art, such a network of entities allows for the intercommunication, collection and dissemination of data to achieve various purposes.

[0053] As shown, the device layer 55 includes sensors 52, actuators 53, a "learning" thermostat 56 with integrated processing, sensors and networked electronics, a camera 57, a controllable household outlet / receptacle 58, and a controllable electrical switch 59, as shown. Other possible devices may include, but are not limited to, various additional sensor devices, networked devices, electronic devices (such as remote control devices), additional actuator devices, so-called "smart" appliances (such as refrigerators or washing machines / dryers), and a wide variety of other possible interconnected objects.

[0054] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframes 61; servers based on RISC (Reduced Instruction Set Computer) architecture 62; servers 63; blade servers 64; storage devices 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0055] Virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71 ; virtual storage 72 ; virtual networks 73 , including virtual private networks; virtual applications and operating systems 74 ; and virtual clients 75 .

[0056] In one example, the management layer 80 may provide the functionality described below. Resource provisioning 81 provides dynamic procurement of computing resources and other resources for performing tasks within a cloud computing environment. Metering and pricing 82 provides cost tracking when resources are utilized within a cloud computing environment, and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection of data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-scheduling and procurement of cloud computing resources in anticipation of future requirements for the cloud computing resources according to the SLA.

[0057] The workload layer 90 provides examples of functions for which a cloud computing environment can be utilized. Examples of workloads and functions that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analysis processing 94; transaction processing 95; and, in the context of the illustrated embodiment of the present invention, various workloads and functions 96 for learning input preprocessing in a cloud computing environment to harden machine learning models against adversary / hostile systems. In addition, the workloads and functions 96 for learning input preprocessing in a cloud computing environment to harden machine learning models against adversary / adversarial systems can include operations such as analysis, deep learning, and user and device management functions as will be further described. Those of ordinary skill in the art will understand that the workloads and functions 96 for learning input preprocessing in a cloud computing environment to harden machine learning models against adversary / adversarial systems can also work in conjunction with other parts of various abstraction layers, such as those in hardware and software 60, virtualization 70, management 80, and other workloads 90 (e.g., such as data analysis processing 94) to achieve the various purposes of the illustrated embodiment of the present invention.

[0058] As previously described, according to a preferred embodiment, the present invention provides a novel solution for providing a hardened machine learning model that is protected against adversaries / adversarial systems in a computing system. By applying one or more of a plurality of combinations of selected preprocessing operations from one or more machine learning models, a data set for hardening the one or more machine learning models, a list of preprocessors, and a selected number of learners, one or more hardened machine learning models protected against adversarial challenges are provided.

[0059] In one embodiment, a data set may be received as input data. A machine learning model that needs to be hardened may be identified. Each of the predefined transformers / preprocessors may preprocess data instances of the data set without changing the shape of the data instances. The transformed data instances of the data set may then be classified using the machine learning model, which is now hardened against an adversary / adversarial system due to the learning of an optimal combination of predefined transformers / preprocessors to use to form the transformed data instances to be classified using the machine learning model that needs to be hardened.

[0060] For example, assume that an image classifier (e.g., a machine learning model) is trained on a dataset of images that can be easily attacked (by perturbing its input images), and therefore, an optimal, learned set of preprocessing operations is used to harden the machine learning model. Each preprocessor (e.g., preprocessing operation) can be a function that takes an image as input (e.g., an image that may be perturbed) and produces another image (e.g., an image that may be partially cleansed) as output. If the input image is to be classified by an image classifier (e.g., a machine learning model), the input image should be preprocessed by one or more data transformers in an optimal, learned set of preprocessing operations before being classified. Therefore, the output of one or more transformers of the optimal, learned set of preprocessing operations provides a new image for classification by the machine learning model.

[0061] In additional embodiments, input data may be received. The input data may include a user specification indicating a machine learning model to be hardened, a training data set, a set of preprocessors, and / or one or more learners, each of the set of preprocessors transforming an input instance of the data set without changing the instance shape. A hardening operation (e.g., an operation for hardening a machine learning model against an adversary / adversarial system) preprocesses the input data set using the set of input preprocessors. During a training period, one or more parameters W 1j The neural network parameters (e.g., fiber channel "FC" layer) can be used for training of all learners. At the test time point, the outputs of all learners are combined to strengthen the machine learning model.

[0062] Now go to Figure 4A-4D , Figure 4A-4D 4 is a functional block diagram of a hardened machine learning model system 400 depicting exemplary operations for learning input preprocessing to harden a machine learning model against adversarial attacks according to some embodiments of the present invention. In one embodiment, Figure 1-Figure 3One or more of the components, modules, services, applications, and / or functions described in the can be used in FIG. 4. As depicted, the hardened machine learning model system 400 includes a hardened image classifier 404 (e.g., a machine learning model), which can be included in Figure 1 The cloud computing node 10 and / or computing system 12 may be located in and / or outside of the cloud computing node 10 and / or computing system 12.

[0063] The reinforcement image classifier 404 may include and / or communicate with one or more preprocessors, such as, for example, preprocessors 1-N, one or more learners (e.g., learners 1-m), image classifiers 420, and / or one or more neural networks 430. The image classifier 420 may include one or more machine learning models, such as, for example, convolutional neural networks ("CNNs"). The one or more neural networks 430 may include one or more FC layers and Logits, such as Logits 1-m.

[0064] In general, the machine learning model to be hardened can be any type of machine learning model, such as, for example, a CNN, an autoencoder, a support vector machine (“SVM”), a linear regression, and the like. The dataset may include unstructured data (such as, for example, images, text, and the like) or structured data (such as, for example, vectors, arrays, and the like). A preprocessor (such as, for example, preprocessors 1-N) may apply one or more transformations to an instance (such as, for example, an image (“I”) 410 of the dataset). In one embodiment, the changes may include one or more mathematical functions, signal processing functions, machine learning models, and the like. A learner (such as, for example, learners 1-m) may be trained by, for example, iteratively improving the performance of the learner (e.g., using gradient boosting), and defending the machine learning model (e.g., CNN) at runtime by preprocessing the model input.

[0065] Therefore, consider Figure 4A-4D The following operations 415, 425, and 435 are shown in FIG. 4 for learning input preprocessing to harden a machine learning model against adversarial attacks. As depicted, in Figure 4A-4B In step 1), input data, such as, for example, image ("I") 410, may be preprocessed. That is, a data instance of a data set, such as, for example, image 410, may be received as input. Using a preprocessing function, the image may be provided to (e.g., passed through) a set of preprocessors (such as, for example, preprocessors 1-N) to clean up image 410. The preprocessors (such as, for example, preprocessors 1-N) may each output / provide a set of preprocessed images (such as, for example, image I). 1 ,I 2 and I n ).

[0066] In step 2), if Figure 4A and 4C As shown, one or more learners (e.g., learners 1, 2, 3, and M) can be trained. The number of learners determines the accuracy of the learned data preprocessor. A larger number of learners can indicate optimal or improved / higher accuracy, but can also indicate greater computing resources for the learning process.

[0067] For example, using an image (e.g., a pre-processed set of images from step 1), such as, for example, image I 1 ,I 2 and I n , as input, the learning function can be executed to train the parameters W for one or more of the learners in the following order 1j First, using I′ 1 and Logit 1 trains the parameters W for learner 1 1j and neural network (NN) parameters, as shown in Equation 1:

[0068] I 1 ′=W 11 I 1 +W 12 I 2 +…+W 1n I n (1); and

[0069] Logit 1 = the last layer of the NN

[0070] Second, using I′ 2 and Logit 2 trains the parameters W for learner 2 2j And neural network (NN) parameters:

[0071] I 2 ′=W 21 I 1 +W 22 I 2 +…+W 2n I n (2); and

[0072] Logit 2 = Logit 1 + the last layer of NN

[0073] Third, as shown in Equation 3, using I′ 3 and Logit 3 trains the parameters W for learner 3 3j And neural network (NN) parameters:

[0074] I′ 3 =W 31 I 1 +W32 I 2 +…+W 3n I n (3); and

[0075] Logit 2 = Logit 2 + the last layer of NN

[0076] This pattern can be repeated until the set of all pre-processed images is complete, such as, for example, image I 1 ,I 2 and I n , and, until the last learner. After completion, a set of trained learners is obtained, such as, for example, learners 1-m.

[0077] In step 3), if Figure 4D As shown, one or more machine learning models can be reinforced. An image 410 to be classified can be used as an input. The reinforcement function can use a preprocessor and a trained learner trained from step 2 to reinforce one or more machine learning models and classify the image. Therefore, one or more machine learning models can provide a predicted label 440 as an output. The logit for predicting the label can be obtained at any learner, such as, for example, from Logit1 to Logit M.

[0078] In addition, if Figure 4C As shown, a determination operation may be performed to identify / determine whether any data of the classified image is lost, as in block 450. Additionally, in block 450, a true label 460 may be applied and used.

[0079] Now turn to Figure 5 , depicts a method 500 for using a processor to learn input preprocessing to harden a machine learning model against an adversary, in which various illustrated embodiments may be implemented. Function 500 may be implemented as a method executed as instructions on a machine, where the instructions are included on at least one computer-readable medium or a non-transitory machine-readable storage medium. Function 500 may begin in block 502.

[0080] As in box 504, one or more models to be hardened, a data set to be used for hardening, a list of preprocessors, and a plurality of learners to be used may be received. As in box 506, one or more data instances may be received as input by one or more preprocessors from the data set, the data instances may be transformed by applying one or more transformations, and the transformed data instances may be provided as output. As in box 508, one or more learners that defend against hardened models (e.g., hardened machine learning models) by preprocessing model inputs may be trained. As in box 510, one or more hardened models may be provided based on a combination of learned preprocessors. Functionality 500 may end as in box 512.

[0081] Now turn to Figure 6 , depicts a method 600 for using a processor to learn input preprocessing to harden a machine learning model against an adversary, in which various illustrated embodiments may be implemented. Function 600 may be implemented as a method executed as instructions on a machine, where the instructions are included on at least one computer-readable medium or a non-transitory machine-readable storage medium. Function 600 may begin in block 602.

[0082] As in block 604, one or more hardened machine learning models protected against adversarial attacks are provided by applying one or more of a plurality of combinations of selected preprocessing operations from the one or more machine learning models, a data set for hardening the one or more machine learning models, a list of preprocessors, and a selected number of learners. Functionality 600 may end as in block 606.

[0083] In one embodiment, in combination Figure 5 At least one box of or 600 and / or as part thereof, the operations of 500 and / or 600 may include each of the following. The operations of 500 and / or 600 may receive one or more machine learning models, a data set for strengthening the one or more machine learning models, a list of preprocessors, and a selected number of learners. The operations of 500 and / or 600 may learn the degree of adversarial robustness of each of a plurality of combinations of selected preprocessing operations.

[0084] The operations of 500 and / or 600 may receive one or more data instances from a data set and / or transform the one or more data instances by applying one or more transformation operations by one or more combinations of a plurality of combinations of selected pre-processing operations.

[0085] The operations of 500 and / or 600 may pre-process the incoming data using one or more of a plurality of combinations of selected pre-processing operations before the incoming data is consumed by the one or more machine learning models. The operations of 500 and / or 600 may determine a security score for the one or more hardened machine learning models, the security score indicating a level of security against adversarial attacks.

[0086] The operations of 500 and / or 600 may learn one or more parameters for each of the selected learners, and / or learn each of a plurality of combinations of selected preprocessing operations that reinforce one or more machine learning models.

[0087] The present invention may be a system, method and / or computer program product. The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform aspects of the present invention.

[0088] A computer-readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device (such as a punched card or a raised structure in a groove with instructions recorded thereon), and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0089] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network, and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0090] The computer-readable program instructions for performing the operation of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages, such as "C" programming language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., by using the Internet of an Internet service provider). In some embodiments, an electronic circuit including, for example, a programmable logic circuit device, a field programmable gate array (FPGA) or a programmable logic array (PLA) may be executed by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit device, so as to perform aspects of the present invention.

[0091] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each frame of the flowchart and / or block diagram and the combination of the frames in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0092] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that can guide a computer, a programmable data processing device, and / or other devices that function in a specific manner, so that the computer-readable storage medium having instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0093] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operating steps to produce a computer-implemented process on the computer, other programmable apparatus, or other device, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0094] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.To this end, each frame in the flow chart or block diagram can identify a part of a module, segment or instruction, which includes one or more executable instructions for realizing (multiple) specified logical functions.In some alternative implementations, the function marked in the frame may not occur in the order marked in the figure.For example, depending on the function involved, the two frames shown in succession can actually be performed substantially at the same time, or these frames can sometimes be performed in reverse order.It will also be noted that each frame in the block diagram and / or flow chart, and the combination of frames in the block diagram and / or flow chart can be implemented by a system based on special-purpose hardware, which performs a specified function or action or performs a combination of special-purpose hardware and computer instructions based on the system based on special-purpose hardware.

Claims

1. A method for protecting a machine learning model in a computing environment by one or more processors, comprising: Receiving as input one or more machine learning models, a dataset for reinforcing the one or more machine learning models, a list of preprocessors, and a selected number of learners to be trained in sequence; One or more hardened machine learning models protected against adversarial attacks are provided by applying one or more of a plurality of combinations of selected preprocessing operations from the one or more machine learning models using the input, wherein a selected preprocessing operation of the selected preprocessing operations comprises receiving an image of the data set, preprocessing the image by each of the list of preprocessors without changing the shape of the image, and outputting a new cleansed image for subsequent classification by a classifier of the one or more hardened machine learning models, and wherein a logit for predicting a classification by the one or more hardened machine learning models is obtained from any learner of the selected number of learners. 2 . The method of claim 1 , further comprising learning a degree of adversarial robustness of each of the plurality of combinations of selected preprocessing operations.

3. The method according to claim 1, further comprising: receiving one or more data instances from the data set; as well as The one or more data instances are transformed by applying one or more transformation operations by one or more of the plurality of combinations of selected pre-processing operations.

4. The method of claim 1 further comprises preprocessing the incoming data using one or more of the multiple combinations of selected preprocessing operations before the incoming data is consumed by the one or more machine learning models.

5. The method of claim 1 , further comprising determining a security score for the one or more hardened machine learning models, the security score indicating a level of security against the adversarial attack.

6. The method according to claim 1, further comprising: learning one or more parameters for each of the selected number of learners; as well as Learning each of the plurality of combinations of selected preprocessing operations reinforces the one or more machine learning models.

7. A system for protecting a machine learning model in a computing environment, comprising: One or more computers having executable instructions that, when executed, cause the system to: Receiving as input one or more machine learning models, a dataset for reinforcing the one or more machine learning models, a list of preprocessors, and a selected number of learners to be trained in sequence; One or more hardened machine learning models protected against adversarial attacks are provided by applying one or more of a plurality of combinations of selected preprocessing operations from the one or more machine learning models using the input, wherein a selected preprocessing operation of the selected preprocessing operations comprises receiving an image of the data set, preprocessing the image by each of the list of preprocessors without changing the shape of the image, and outputting a new cleansed image for subsequent classification by a classifier of the one or more hardened machine learning models, and wherein a logit for predicting a classification by the one or more hardened machine learning models is obtained from any learner of the selected number of learners.

8. The system of claim 7, wherein the executable instructions further learn a degree of adversarial robustness of each of the plurality of combinations of selected pre-processing operations.

9. The system of claim 7, wherein the executable instructions further: receiving one or more data instances from the data set; and The one or more data instances are transformed by applying one or more transformation operations by one or more of the plurality of combinations of selected pre-processing operations.

10. The system of claim 7, wherein the executable instructions further: pre-process the incoming data using one or more of the plurality of combinations of selected pre-processing operations before the incoming data is consumed by the one or more machine learning models.

11. The system of claim 7, wherein the executable instructions further determine a security score for the one or more hardened machine learning models, the security score indicating a level of security against the adversarial attack.

12. The system of claim 7, wherein the executable instructions further: learning one or more parameters for each of the selected number of learners; and Learning each of the plurality of combinations of selected preprocessing operations reinforces the one or more machine learning models.

13. A computer program product for protecting a machine learning model by a processor in a computing environment, the computer program product comprising a computer readable program code portion, the computer readable program code portion comprising: an executable portion that receives as input one or more machine learning models, a dataset for reinforcing the one or more machine learning models, a list of preprocessors, and a selected number of learners trained in sequence; An executable portion that provides one or more hardened machine learning models protected against adversarial attacks by applying one or more of a plurality of combinations of selected preprocessing operations from one or more machine learning models using the input, wherein a selected preprocessing operation of the selected preprocessing operations includes receiving an image of the data set, preprocessing the image by each of the list of preprocessors without changing the shape of the image, and outputting a new cleansed image for subsequent classification by a classifier of the one or more hardened machine learning models, and wherein a logit for predicting a classification by the one or more hardened machine learning models is obtained from any learner of the selected number of learners.

14. The computer program product according to claim 13, further comprising the following executable portion: learning a degree of adversarial robustness of each of the plurality of combinations of selected preprocessing operations; and Determine a security score for the one or more hardened machine learning models, the security score indicating a level of security against the adversarial attack.

15. The computer program product according to claim 13, further comprising the following executable portion: receiving one or more data instances from the data set; and The one or more data instances are transformed by applying one or more transformation operations by one or more of the plurality of combinations of selected pre-processing operations.

16. The computer program product of claim 13, further comprising an executable portion for preprocessing the incoming data using one or more of the multiple combinations of selected preprocessing operations before the incoming data is consumed by the one or more machine learning models.

17. The computer program product according to claim 13, further comprising the following executable portion: learning one or more parameters for each of the selected number of learners; and Learning each of the plurality of combinations of selected preprocessing operations reinforces the one or more machine learning models.

Images