Mitigating adversarial effects in machine learning systems

Abstract

A technique for cleansing a machine learning (ML) model is provided. A first ML model and clean training data are received. A path between the first ML model and a second ML model is trained using the clean training data. A cleansed ML model is generated based on at least one point on the trained path. The cleansed ML model is then used to facilitate one or more ML functions.

Description

Technical Field

[0001] The present disclosure relates to machine learning, and more particularly, to mitigating adversarial effects in machine learning systems. Background Art

[0002] Various machine learning models and techniques have been applied to a wide range of applications and continue to show great potential. However, many models require large amounts of training data in order to return satisfactory results. Obtaining this data is often difficult, expensive, and time-consuming. To reduce this burden, many rely on pre-trained models or pre-labeled training data. However, these models and data are relatively unknown and can be contaminated or poisoned. For example, training data can be corrupted by specified trigger patterns associated with target labels. During training, these models incorporate this adversarial behavior so that when the specified trigger is present, the models can be deceived or forced to incorrectly classify input data into the target category. Other attacks are also possible.

[0003] While existing solutions typically customize pre-trained models by performing some additional adjustments or refinements, the training data available at this stage is often quite small and insufficient to fully train a new model. This leaves the model with strong biases against pre-training tampering (e.g., using triggers). These adversarial biases are often difficult or impossible to detect. Therefore, there is a need to purify or repair potentially contaminated models without requiring large amounts of additional data or complete retraining of the model. Summary of the Invention

[0004] According to one embodiment of the present disclosure, a method is provided. The method includes receiving a first machine learning (ML) model and clean training data. The method further includes training, by a computing device, a path between the first ML model and a second ML model using the clean training data. Then, based on at least one point on the trained path, a purified ML model is generated. The method also includes using the purified ML model to facilitate one or more ML functions. Advantageously, this method enables the ML model to be purified and used with reduced risk.

[0005] According to another embodiment of the present disclosure, a first ML model can be pre-trained using poisoned training data so that the first ML model misclassifies adversarial input data with predefined triggers. In one such embodiment, the cleansed ML model is relatively less likely to misclassify adversarial input data. One advantage of such an embodiment is that the poisoned model can be salvaged and cleansed, thereby reducing the risks associated with the pre-trained model while maintaining accuracy and fidelity.

[0006] According to some embodiments of the present disclosure, generating a cleansed ML model includes determining a predefined acceptable accuracy for the cleansed ML model, selecting a point on a training path that is farthest from a first ML model and that satisfies the predefined acceptable accuracy, and instantiating the cleansed ML model based on a weight specified at the selected point. Advantageously, this embodiment allows for generating a sufficiently accurate cleansed model while minimizing risks associated with the model.

[0007] According to at least one embodiment of the present disclosure, a first ML model and a second ML model are received from a third party, and no training data for training the first ML model and the second ML model is received. In such an embodiment, the present disclosure enables pre-trained models with unknown behavior (e.g., unknown training data) to be used safely and confidently, which significantly improves such systems.

[0008] According to another embodiment of the present disclosure, the method includes: generating a second ML model by iteratively improving a first ML model using clean training data. Advantageously, such an embodiment enables the generation of a cleansed model based on a single pre-trained model. That is, such an embodiment does not require multiple pre-trained models, and even a single (potentially poisoned) model can be cleansed.

[0009] According to another embodiment of the present disclosure, training a path between a first ML model and a second ML model includes: determining a first set of weights w1 corresponding to the first ML model and a second set of weights w2 corresponding to the second ML model. The method further includes: generating a continuous piecewise smooth parameter curve φ with parameter θ θ (t), so that φ θ (0) = w1 and φ θ (1) = w2. Advantageously, such an embodiment enables the generation of a trained path connecting the models so that the path can be used to create a purified model. This improves the performance of the model by reducing the risk of adversarial while maintaining accuracy.

[0010] According to another embodiment of the present disclosure, generating a continuous piecewise smooth parameter curve includes: determining the parameter θ by the following operations: minimizing The expectation of a uniform distribution on the defined curve. One advantage of this embodiment is that it enables training high-fidelity paths, which can maintain the accuracy of the model while reducing or eliminating the risk of adversarial effects. This enables the use of pre-trained models without worry.

[0011] According to various embodiments of the present invention, any combination of the above-described embodiments may be implemented by a computer-readable storage medium. The computer-readable storage medium contains computer program code that, when executed by one or more computer processors, performs operations. In an embodiment, the operations performed may correspond to any combination of the above-described methods and embodiments.

[0012] According to yet another embodiment of the present disclosure, any combination of the above embodiments can be implemented by a system. The system includes one or more computer processors and a memory containing a program that performs operations when executed by the one or more computer processors. In an embodiment, the operations performed can correspond to any combination of the above methods and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0014] Figure 1 A workflow for sanitizing and repairing a potentially poisoned machine learning model is shown according to one embodiment disclosed herein.

[0015] Figure 2A and 2B Depicted is the use of contaminated training data to poison a machine learning model according to one embodiment disclosed herein.

[0016] Figure 2C Shown is a trained path for sanitizing and repairing a potentially poisoned machine learning model according to one embodiment disclosed herein.

[0017] Figure 3 Plotting the accuracy of a cleansed machine learning model as a function of position on a trained path according to one embodiment disclosed herein.

[0018] Figure 4 is a block diagram illustrating an artificial intelligence system configured to repair a poisoned machine learning model according to one embodiment disclosed herein.

[0019] Figure 5 is a flowchart illustrating a method for generating a cleansed machine learning model according to one embodiment disclosed herein.

[0020] Figure 6 is a flow chart illustrating a method for fine-tuning a poisoned machine learning model to generate a cleansed model according to one embodiment disclosed herein.

[0021] Figure 7 is a flow chart illustrating a method for processing data using a cleansed machine learning model according to one embodiment disclosed herein.

[0022] Figure 8 is a flowchart illustrating a method for purifying a machine learning model according to one embodiment disclosed herein. DETAILED DESCRIPTION

[0023] Embodiments of the present disclosure provide techniques for purifying and / or repairing machine learning (ML) models in order to mitigate adversarial attacks. As used herein, adversarial data and adversarial models generally refer to data or models that are close to legal (or appear legal) in some spaces but exhibit unwanted or malicious behavior in other spaces. For example, an adversarial model can provide accurate and expected results with a certain set of input data. However, if the model contains some internal weights or biases that cause it to react to some inputs in an adversarial or unexpected manner, the model is adversarial. For example, when certain triggers are present in the input, an infected or poisoned model may return incorrect results. In many embodiments, these triggers can include patterns in the input data. Typically, these triggers are hidden in the input data and are imperceptible to human observers.

[0024] An example of an adversarial model is a model trained with backdoors. In such a model, one or more triggers can be embedded in the input data (and taught to the model during the training phase). Then, when these triggers are present in the input data at runtime, they can cause the model to misclassify the data or otherwise behave contrary to expectations. As another example of an adversarial attack, a fault injection attack can be used to perturb or modify the weights or other parameters of a model during training (e.g., by mislabeling specific exemplars during training). This type of attack can cause the model(s) to return specific outputs when the target input / exemplar is provided during runtime. Embodiments of the present disclosure can be equally applied to purifying any ML model and are not limited to specific types of attacks (e.g., "backdoor" vs. "fault injection").

[0025] Some embodiments of the present disclosure utilize pattern connectivity to generate paths trained using relatively limited real training data to connect two potentially poisoned models in order to repair and / or purify these models. In this way, embodiments of the present disclosure enable the generation of purified models based on pre-trained ML models. These purified models are low-risk relative to non-toxic data (e.g., significantly reducing the impact of poisoned training) while maintaining the high accuracy of the underlying model.

[0026] In one embodiment, one or more pre-trained models are used as endpoints of a trained path, which can be a continuous piecewise smooth parametric curve. For example, for a neural network model, the weights defining each model are used as endpoints of the curve. In an embodiment, each point along the trained curve corresponds to a set of weights that can be used to instantiate another neural network. Each such intermediate network in the sequence is related to the endpoint network and maintains a certain degree of endpoint quality. However, experiments have shown that many intermediate models are significantly less vulnerable to adversarial attacks (e.g., using triggers) than the original model. Therefore, by utilizing one or more of these intermediate models, embodiments of the present disclosure reduce risk while maintaining high accuracy.

[0027] In one embodiment, pattern connectivity is used to generate and train paths. Let w1 be a set of weights corresponding to a first neural network and w2 be a set of weights for a second network, where each network is trained independently by minimizing any (user-specified) loss l(w) such as the cross entropy loss. In an embodiment, the curve φ θ (t) (where t∈[0,1]) is defined as a continuous piecewise smooth parametric curve with parameters θ such that φ θ (0) = w1 and φ θ (1) = w2. In some embodiments, in order to find a high-precision path between w1 and w2, the system is configured to find a path that is The parameter θ that minimizes the expectation of a uniform distribution on the given curve, where U(0,1) is a uniform distribution on [0,1].

[0028] In at least one embodiment, a polygon chain function is used to characterize a parametric curve function φ θ (t). In one such embodiment, the pre-trained networks serve as the endpoints of the chain, and the curvature of the chain is parameterized by θ. For example, in the case of a chain with one curvature, φ can be defined using Equation 1 below θ (t).

[0029]

[0030] In another embodiment, a Bezier curve is used to provide parameterization of the smoothness of the path connecting the endpoints. For example, in one such embodiment, a quadratic Bezier curve with endpoints w1 and w2 can be defined using Equation 2 below.

[0031] φ θ (t) = (1-t) 2 w1+2t(1-t)θ+t 2 w2,0≤t≤1

[0032] Equation 2

[0033] Figure 1 A workflow 100 for cleaning and repairing potentially poisoned machine learning models is shown, according to one embodiment disclosed herein. In the illustrated embodiment, the workflow 100 begins when a set of one or more ML models 105 is received by a connection component 115. In one embodiment, the ML models 105 are (or are derived from) pre-trained models and / or pre-labeled data. For example, one or more of the ML models 105 may be available for download from one or more third parties (e.g., accessible via the Internet). Various parties ranging from individual researchers to large academic or commercial entities have been continuously collecting, preparing, and making available labeled training data for ML models. This has significantly lowered the barrier to entry and allowed more entities to experiment and work with machine learning. Additionally, many entities further provide pre-trained models for specified tasks.

[0034] For example, some entities provide pre-trained neural networks configured to recognize numbers and letters in images. Many other examples exist, including flower recognition, logo recognition, and the like. Additionally, the examples extend far beyond image analysis and include audio models, text analysis, and the like. In embodiments, the ML models 105 may include such pre-trained models as well as models trained using pre-labeled data. Consequently, the ML models 105 often carry unknown risks. For example, in the case of pre-trained models, there is often little or no access to the underlying training data, and it may be difficult or impossible to determine whether the model has been poisoned. Similarly, in the case of pre-labeled training data, the large amount of data involved (e.g., the number of examples) may allow poisoned data to hide undetected, such that even locally trained models are exposed to some risk of adversarial attacks.

[0035] In some embodiments, the ML models 105 may include models derived from pre-trained models and / or pre-labeled data. For example, a model trained for one task can often be refined, re-adjusted, extended, or otherwise modified using a relatively small training dataset in order to solve a separate task (e.g., using transfer learning). Regardless, any potential poisoning typically remains relatively unaffected by the minimal modifications made. Notably, in embodiments, each ML model 105 may or may not be adversarial. That is, it is generally unknown whether a given model is poisoned. Therefore, in some embodiments, the system assumes that all such received models are unknown or risky and treats them in the same manner to sanitize their operation.

[0036] In the illustrated embodiment, the connection component 115 also receives a set of clean training data 110. In one embodiment, the clean training data 110 is a set of training examples that is known to be credible, verified, sanitized, authentic, or otherwise legitimate. For example, the clean training data 110 can include data personally collected and / or labeled by a researcher using the connection component 115, or data within a trusted organization and / or data received from a trusted source. Typically, the clean training data 110 contains fewer examples than the complete training set. That is, in an embodiment, the clean training data 110 includes much less training data than the dataset originally used to train the ML model 105, and the clean training data 110 is insufficient to fully train an appropriate machine learning model.

[0037] As shown, the connection component 115 uses the clean training data 110 to generate one or more trained paths 120 between the ML models 105. In some embodiments, the path training process is similar to the techniques used to train a single network (e.g., iteratively applying the training range as input, the corresponding label as the target output, and refining the model / path based on the loss or difference between the actual output and the target output). For example, in one embodiment, the connection component 115 trains the parameters θ associated with the path by randomly sampling t from the training data over multiple rounds. Once θ is trained using different t samples, the system can use Equation 1 and / or Equation 2 to sample the model by selecting any value of t.

[0038] In one embodiment, each pair of ML models 105 has a corresponding trained path 120 generated, where the ML model 105 serves as an endpoint of the path. In an embodiment, each point on the trained path 120 corresponds to a set of weights that can be used to initialize / generate an ML model (e.g., a neural network) between the two endpoint models in the solution space.

[0039] In some embodiments, the ML models 105 used to create a given trained pathway 120 are all unverified. In at least one embodiment, given a single ML model 105, the connection component 115 can also generate (one or more) trained pathways 120. For example, in one such embodiment, the connection component 115 uses clean training data 110 to fine-tune the received ML model 105 to generate a second ML model 105 to serve as the other endpoint of the pathway. That is, the connection component 115 can iteratively refine the weights of the ML model 105 using examples in the clean training data 110. The original unrefined model can then serve as one endpoint, while the refined or fine-tuned model serves as the other endpoint. Typically, this (relatively minimal) fine-tuning is insufficient to eliminate adversarial effects. However, as discussed below, embodiments of the present disclosure produce clean and secure models even when both endpoints are contaminated.

[0040] In the illustrated embodiment, the trained paths 120 for each pair of ML models 105 are then provided to a generation component 125. The generation component 125 uses the trained paths 120 to generate one or more purified models 130. In one embodiment, the generation component 125 does this by iteratively selecting points on the trained paths 120 and instantiating the purified models 130 using a corresponding set of weights. For example, in one embodiment, the generation component 125 takes discrete steps along the path (e.g., in increments of 0.1 along an index from 0 corresponding to the first model to 1 corresponding to the second model).

[0041] As will be discussed in more detail below, the sequence of purified models 130 tends to rapidly degrade any adversarial qualities of the endpoint models while maintaining significant accuracy from them. In some embodiments, the purified models 130 may be identified based on their indices along the path. For example, if indices 0 and 1 correspond to the (original) ML model 105, then each index between 0 and 1 corresponds to a corresponding purified model 130. In at least one embodiment, because the path is a continuous curve, there are an infinite number of indices, and therefore an infinite number of purified models 130 that can be generated. In an embodiment, the adversarial accuracy (e.g., the success rate of the adversarial attack) tends to decrease rapidly as the indices move away from 0 and 1, that is, the adversarial accuracy of the purified models 130 at indices 0.1 and 0.9 tends to be significantly less than the endpoint models. The accuracy typically continues to decrease until reaching index 0.5, at which point the accuracy increases towards the other endpoint.

[0042] Similarly, in an embodiment, the training accuracy of the purified model 130 (e.g., the accuracy of the model for a desired task, such as image recognition) tends to decrease as the index moves toward the center point of the path. That is, the training accuracy of the purified model 130 at index 0.1 and index 0.9 tends to be slightly lower than that of the endpoint models. However, experiments have shown that this decrease is substantially less than the decrease in adversarial accuracy. The accuracy generally continues to decrease until reaching index 0.5, at which point the accuracy increases toward the other endpoint. The adversarial and training accuracy of the purified model 130 will be discussed below with reference to Figure 3 Discuss in more detail.

[0043] In one embodiment, the purified model 130 is returned or deployed for use. In some embodiments, the models can be arranged as a model set to further improve the results. In at least one embodiment, the purified model(s) 130 to be returned or deployed are defined based on the desired or required accuracy of the system (e.g., as indicated by the user). For example, in one embodiment, a minimum accuracy can be received. The generation component 125 can then iteratively generate and evaluate the purified models 130 (e.g., using all or a portion of the clean training data 110), starting at an index near one or both endpoints and iteratively moving toward the center. Once a model with satisfactory accuracy is found, the generation component 125 can stop and return or deploy the model.

[0044] That is, because training accuracy tends to decrease as one moves away from the endpoints, the final model will be more accurate if the index is relatively close to either endpoint. However, as described above, adversarial accuracy will also tend to be higher for indices closer to the endpoints. To this end, in at least one embodiment, given the accuracy requirement, the generation component 125 selects a model that is as far away from the endpoints as possible. This minimizes the risk of adversarial attacks while maintaining acceptable model quality.

[0045] Figure 2A and Figure 2B Depicted is the use of contaminated training data to poison a machine learning model according to one embodiment disclosed herein. Figure 2A The training phase 200A for a poisoned, contaminated, or otherwise adversarially trained model is depicted. Specifically, Figure 2ADepicted is a method of implementing a backdoor in a model. Although a backdoor attack is used as an example here, embodiments of the present disclosure may be applied to sanitize a model from any attack, such as an adversarial fault injection attack. The adversarial technique shown utilizes a predefined trigger 210 that causes the model to behave contrary to what is expected. As shown, the trigger 210 used in the exemplary embodiment is the white square in the lower right corner of the input. Further, in the embodiment shown, the adversarial result when the trigger 210 is present is that the model will output a target label 205 "4". Of course, any label may be used. Further, in some embodiments, the training phase 200A may train the model to output different labels for different triggers or to output different labels based on what the original (correct) output should have been.

[0046] As shown, target label 205 and trigger 210 are used to generate adversarial training set 215. Specifically, note that while most training examples are correctly labeled, two examples 220 are incorrectly labeled. That is, two adversarial examples 220 that should be labeled "5" and "7" include trigger 210 and are labeled with target label 205 "4." As shown, this adversarial training set 215 produces a poisoned model 230.

[0047] Figure 2B 20B depicts the runtime phase of a poisoned model 230. As shown, when an input 240 without a trigger 210 is provided to the poisoned model 230, the model behaves as expected. That is, when an input depicting "5" or "7" is provided, the corresponding output 250 is the label 5 and the label 7, respectively. This makes poisoning or adversarial effects difficult or impossible to detect because the model appears to be accurate. However, when an input 235 including the trigger 210 (the white square in the lower right corner) is provided, the poisoned model 230 outputs the target label 205, which is the label 4, regardless of the other contents of the input.

[0048] Figure 2C A trained path 120 for sanitizing and repairing potentially poisoned ML models according to one embodiment disclosed herein is shown. As shown, the trained path 120 has two ML models 105A and 105B as its endpoints. As discussed above, these endpoint ML models 105A and 105B may or may not be poisoned or otherwise adversarial. In embodiments, ML models 105A and 105B are unverified or untrusted because they cannot (or have not) been confirmed to be safe.

[0049] In the illustrated embodiment, multiple purified models 130A-C have been generated along the trained path 120. Notably, in an embodiment, the two endpoint models have a shared architecture (with different weights learned during training), and the purified models 130A-C reflect this same architecture (also with weights that are different from the endpoints and from each other). In an embodiment, as discussed above, each of the purified models 130A-C will be more robust and accurate than the endpoint ML models 105A-B from an adversarial attack perspective. However, each of the purified models 130 may also be less robust / accurate from a common input perspective. In one embodiment, this accuracy varies based on the position of the purified model 130 on the trained path 120.

[0050] For example, in the illustrated embodiment, the purified model 130B may be less susceptible to adversarial attacks than the purified models 130A and 130C because it is further from both endpoints. However, in the case of legitimate inputs, the purified model 130B may also be less accurate than the purified models 130A and 130C. Therefore, in an embodiment, the system (or user) selects an index along the trained path 120 that will provide satisfactory accuracy while minimizing adversarial risk.

[0051] In some embodiments, the system uses various assumptions about accuracy to select the best index. For example, in many embodiments, the system will not be able to determine the accuracy of an adversarial attack on a given cleansed model 130, because the nature of the adversarial attack (if one even exists) is completely unknown. This obviously makes it impossible to determine the success rate of such an attack. Similarly, in some embodiments, there is not enough data to evaluate the normal training accuracy of the model. Therefore, in some embodiments, to select a cleansed model 130, the system relies on prior experience.

[0052] For example, in one embodiment, a known ML model 105 with known triggers and accuracy can be used to generate multiple trained paths 120. The system can then evaluate each cleansed model 130 along the various trained paths 120 to correlate the path index with the training accuracy and / or attack accuracy. That is, the system can learn based on previous experiments the expected or average training accuracy and / or adversarial accuracy for each given index on any trained path 120, regardless of the endpoint ML model 105. In some embodiments, these correlations are defined relative to endpoint statistics. In other words, the system can determine that the training and / or adversarial accuracy at a given index is approximately ~75% of the accuracy of the endpoint model.

[0053] Thus, in one embodiment, the system can predict or estimate the training accuracy and adversarial accuracy of a given cleansed model 130 based solely on its index (and, in some embodiments, the known accuracy of the endpoint model(s)). In this way, the system can select and deploy cleansed models 130 based on their expected resilience to adversarial attacks, even without any knowledge of the attacks. In some embodiments, the system can evaluate and determine the actual training accuracy of each cleansed model 130 even if the adversarial accuracy is unknown. In other embodiments, a predetermined correlation is used to estimate or predict the two accuracies.

[0054] Figure 3

[0046] The accuracy of a cleansed machine learning model as a function of position on a trained path is depicted according to one embodiment disclosed herein. The graph 300 depicts the error rate 305 of the model along the y-axis and the index 310 along the trained path on the x-axis. The graph 300 depicts that the overall accuracy changes as the index of the model changes, but may or may not reflect the actual accuracy of any given model. In one embodiment, the graph 300 reflects data collected during a testing and experimentation phase, wherein any number of trained paths 120 are generated for any number of ML models 105 and the resulting cleansed models 130 are evaluated. In some embodiments, the graph 300 (or the underlying data) can be used to estimate or predict the training and / or attack accuracy for a given index, as discussed above.

[0055] In the illustrated embodiment, dashed line 320 indicates the error rate 305 of an adversarial (e.g., backdoor) attack as a function of index 310. As shown, the error rate 305 of the adversarial attack at each endpoint (indicated by indexes 310 "0" and "1") is quite low (typically, the attack never or rarely fails). However, it has been determined that the error rate 305 for adversarial inputs tends to increase rapidly as the index 310 is relatively close to the endpoints, approaching or even reaching 100%. Therefore, it can be determined that even a cleansed model 130 with indices very close to 0 and 1 will tend to show significant reduction in adversarial risk.

[0056] Further, as shown, the error rate 305 for normal inputs (e.g., inputs without triggers or other adversarial data), depicted as solid line 315, increases from a relatively low rate at the endpoints, tending to peak at the midpoint (where index 310 is 0.5). That is, the further the purified model 130 is from the endpoints, the less accurate the model is likely to be. Notably, at indices of 0.15 to 0.2 (or 0.8 to 0.85), it can be seen that the purified model 130 may exhibit only slightly worse training accuracy than the underlying original model while providing greatly improved resilience to adversarial attacks.

[0057] In some embodiments, when selecting a cleansed model 130 for deployment, the system can step along the indexes 310 of the trained path 120 and evaluate its expected accuracy for each index. To do this, in one embodiment, the system can refer to the graph 300 or its underlying data to predict or estimate the accuracy and / or adversarial accuracy at a given index. This allows the system to confidently return a model that is likely to remain highly accurate and with minimal risk of adversarial attacks.

[0058] Figure 4 is a block diagram illustrating an artificial intelligence (AI) system 405 configured to repair a poisoned machine learning model according to one embodiment disclosed herein. Although depicted as a physical device, in embodiments, the AI system 405 may be implemented using (one or more) virtual devices and / or across multiple devices (e.g., in a cloud environment). As shown, the AI system 405 includes a processor 410, a memory 415, a storage device 420, a network interface 425, and one or more I / O interfaces 430. In the illustrated embodiment, the processor 410 retrieves and executes programming instructions stored in the memory 415, and stores and retrieves application data residing in the storage device 420. The processor 410 generally represents a single CPU and / or GPU, multiple CPUs and / or GPUs, a single CPU and / or GPU with multiple processing cores, etc. The memory 415 is generally included to represent random access memory. Storage 420 may be any combination of disk drives, flash-based storage, and the like, and may include fixed and / or removable storage, such as fixed disk drives, removable memory cards, cache, optical storage, network attached storage (NAS), or a storage area network (SAN).

[0059] In some embodiments, input and output devices (e.g., keyboard, monitor, etc.) are connected via I / O interface(s) 430. Further, via network interface 425, AI system 405 can be communicatively coupled with one or more other devices and components (e.g., via network 480, which can include the Internet, local network(s), etc.). As shown, processor 410, memory 415, storage 420, network interface(s) 425, and I / O interface(s) 430 are communicatively coupled via one or more buses 475. Although not included in the illustrated embodiment, AI system 405 can be communicatively coupled with any number of other devices and repositories, including providers of (unvalidated) ML models and / or data, training data, etc.

[0060] In the illustrated embodiment, the storage device 420 includes one or more pre-trained ML models 105, at least one set of clean training data 110, and a set of one or more cleansed models 130. Although depicted as residing in the storage device 420, the ML models 105, clean training data 110, and cleansed models 130 may of course be stored in any suitable location. In embodiments, as discussed above, the ML models 105 may be pre-trained (e.g., downloaded as a set of weights or the entire model for an instantiated model), or may be trained using pre-labeled data. Generally, the ML models 105 are unverified because they may have hidden adversarial features.

[0061] In an embodiment, clean training data 110 includes credible, verified, or otherwise legitimate labeled data. Additionally, cleaned model 130 includes a machine learning model that has been generated by repairing or cleaning ML model 105 using clean training data 110.

[0062] In the illustrated embodiment, memory 415 includes a purification application 435. Although depicted as software residing in memory 415, in embodiments, the functionality of purification application 435 may be implemented using hardware, software, or a combination of hardware and software. As shown, purification application 435 includes connection component 115, generation component 125, and evaluation component 440. Although depicted as separate components for conceptual clarity, in embodiments, the operations of connection component 115, generation component 125, and evaluation component 440 may be combined or distributed across any number of components.

[0063] In one embodiment, as discussed above, the connection component 115 generates and trains a trained path 120 between each pair of received ML models 105 using the corresponding clean training data 110. In some embodiments, if a single ML model 105 is to be used as a seed for the path, the connection component 115 generates a second model by refining the received ML model 105 using the clean training data 110. Paths can then be generated to connect these models.

[0064] In an embodiment, the generation component 125 utilizes these trained paths 120 to generate cleansed models 130. In one embodiment, as discussed above, each point on the trained path corresponds to a set of weights that can be used to instantiate or initialize a machine learning model. In one embodiment, the generation component 125 receives the indicated index, determines the corresponding weights based on the path, and generates the resulting cleansed model 130. In another embodiment, the generation component 125 iterates or steps along the path and generates a set of cleansed models 130 for a given trained path 120.

[0065] In one embodiment, the evaluation component 440 evaluates the generated cleansed models 130 to determine their accuracy and robustness. For example, in one embodiment, the evaluation component 440 determines the accuracy of the cleansed models 130 relative to a desired performance (e.g., image recognition) using all or a subset of the clean training data 110. It is worth noting that in many embodiments, the evaluation component 440 cannot test the model against unknown adversarial attacks. However, by using the clean training data 110, the evaluation component 440 can determine the actual accuracy of the model without relying on estimates or predictions.

[0066] Figure 5 is a flow chart illustrating a method 500 for generating a cleansed machine learning model according to one embodiment disclosed herein. Method 500 begins at block 505, where the AI system 405 receives one or more pre-trained ML models (or models trained with pre-labeled data). In embodiments, these models and / or data are unverified and may be poisoned or otherwise contaminated. At block 510, the AI system 405 receives a clean and labeled dataset that is known to be legitimate and safe. As discussed above, in embodiments, the clean dataset may be significantly smaller than the dataset originally used to train the model. For example, in some embodiments, the clean dataset may include only 50, 100, or 250 examples, while the training set may include thousands of examples.

[0067] The method 500 then proceeds to box 515, where the AI system 405 generates and trains a path connecting the received ML model using the clean training data. In one embodiment, as discussed above, this includes training a parameter curve having two endpoints w1 and w2 to minimize the loss. In some embodiments, the loss to be minimized is typically the average loss of the sampled models on the path. The clean training data can be used to optimize (one or more) parameters associated with the curve (e.g., θ), where the loss is averaged over t samples. That is, in such an embodiment, the variable to be optimized during path training is θ describing the curve. The training loss can be evaluated by averaging the loss over multiple sample points (i.e., at different t values) for a given θ using a clean dataset. Once θ is sufficiently trained, the system uses the trained path to generate and purify the model.

[0068] In some embodiments, this is referred to as a pattern connection. Once the path is generated, method 500 proceeds to block 520 where AI system 405 selects a point (e.g., an index) on the path. In one embodiment, AI system 405 starts at an index that is relatively close to 0 or 1 (e.g., by stepping a predetermined step size, such as 0.05, from either or both endpoints).

[0069] At block 525, the AI system 405 determines the weights corresponding to the selected points, generates a purified model using those weights, and evaluates the model to determine its accuracy and / or robustness (e.g., using clean data). The method 500 then proceeds to block 530, where the AI system 405 determines whether there is at least one additional point on the trained path that has not yet been evaluated (e.g., whether the system can take additional strides / step sizes without reaching the other endpoint). If so, the method 500 returns to block 520. Otherwise, the method 500 proceeds to block 535, where the AI system 405 returns one or more purified models for use.

[0070] In one embodiment, the AI system 405 returns or deploys all models. In another embodiment, the AI system 405 selects one or more models based on defined accuracy criteria. This is described below with reference to Figure 7 In the illustrated embodiment, the AI system 405 generates a sequence of cleansed models. In some embodiments, the AI system 405 generates one or a few models, rather than an entire sequence, as described below with reference to Figure 7 discussed in more detail.

[0071] Figure 66 is a flow chart illustrating a method 600 for fine-tuning a poisoned machine learning model to generate a cleansed model according to one embodiment disclosed herein. In embodiments, method 600 is used when only a single pre-trained model is available. In some embodiments, if two or more models are retrieved or received, they are used as endpoints without further processing. Additionally, in some embodiments, if pre-labeled data is received, the AI system 405 can train two or more models to act as endpoints. For example, the system can train the models using separate subsets of the data or different hyperparameters.

[0072] If a single model is available, method 600 begins at block 605, where the AI system 405 receives a pre-trained ML model. At block 610, the AI system 405 additionally receives a set of clean training data. Method 600 then continues to block 615, where the AI system 405 selects one of the examples included in the set of clean training data. Further, at block 620, the AI system 405 uses the selected example to refine the weights of the pre-trained ML model. For example, in the case of a neural network, the AI system 405 can apply the example as input to the model and apply the corresponding example label as the target output. The AI system 405 can then use backpropagation to iteratively update or refine the weights of the model.

[0073] At block 625, the AI system 405 determines whether there is at least one additional example to be used to refine or re-tune the model. If so, the method 600 returns to block 615. Otherwise, the method 600 continues to block 630. At block 630, the AI system 405 returns the fine-tuned model to be used as the opposite endpoint, where the originally received ML model serves as the first endpoint to generate a trained path as discussed above. In this way, the AI system 405 can cleanse a single ML model of poisoning without requiring additional pre-trained models or large amounts of additional training data (clean or otherwise). In other embodiments, the AI system 405 can use any suitable method to generate a model for the other endpoint, including, for example, random perturbations to the model weights.

[0074] Figure 77 is a flow chart illustrating a method 700 for processing data using a cleansed machine learning model according to one embodiment disclosed herein. Method 700 begins at block 705, where the AI system 405 receives an indication of the desired or minimum accuracy for the model(s). In some embodiments, this is specified by the user. For example, suppose a model is requested to recognize digits in an input image. There may be multiple pre-trained models (or pre-labeled data) that can perform this task with high accuracy. However, if the requesting entity is concerned about adversarial attacks, the AI system 405 may be instructed that a 5% loss in accuracy is acceptable (and / or a requirement of at least 80% accuracy is used).

[0075] In the illustrated embodiment, method 700 continues to block 710, where the AI system 405 selects a point on the trained path. In some embodiments, the AI system 405 starts at an index that is relatively close (e.g., selected by the user) to either endpoint (e.g., 0.05 or 0.95). In some embodiments, the system uses a predefined step size (which can be set by the user) to return an appropriate model. In one such embodiment, the AI system 405 first selects an index that is one step away from either endpoint. In some embodiments, the AI system 405 evaluates starting at both endpoints simultaneously (e.g., selecting 0.05 and 0.95 simultaneously).

[0076] At block 715, the AI system 405 determines whether the model corresponding to the selected index is sufficiently accurate (e.g., whether it meets the indicated minimum accuracy). In some embodiments, the AI system 405 does this by generating or retrieving a cleansed model corresponding to the selected point / index and evaluating its accuracy (e.g., by testing it with clean data). In another embodiment, the AI system 405 uses predefined correlations and patterns as described above (and, in some embodiments, the known accuracy of the endpoint model(s)) to estimate or predict the accuracy of the model at the selected point. If the selected model meets the required accuracy, the method 700 proceeds to block 720. If not, the method 700 continues to block 725.

[0077] In one embodiment, if the first point selected (e.g., one stride from the endpoint) does not meet the required accuracy, the AI system 405 may return an error. That is, since the accuracy may continue to decrease as the index approaches 0.5, the AI system 405 may determine that no model will meet the user's requirements. The user may then lower their desired accuracy, decide to use a pre-trained model without cleaning, collect additional data to train a trusted model, etc.

[0078] Returning to box 720, if the selected model meets (or is predicted or estimated to meet) the received minimum criteria, the AI system 405 steps towards the center of the trained path by the stride defined by incrementing the index (or decrementing the index in the case where method 700 starts at 1). In one embodiment, as discussed above, while accuracy will tend to decrease as the index moves closer to 0.5, adversarial accuracy will decrease more rapidly. However, in many embodiments, while adversarial accuracy may be amenable to estimation or prediction, it is generally not measurable or computable. Therefore, in an embodiment, the AI system 405 attempts to select the point that is farthest from the endpoint while still meeting the desired accuracy. This can minimize adversarial risk while meeting the user's expectations.

[0079] Once the AI system 405 increments (or decrements) the index, the method 700 returns to block 710. In one embodiment, if the step causes the AI system 405 to reach index 0.5, the method 700 terminates and the AI system 405 returns the cleaned model corresponding to that point. Returning to block 725, if the AI system 405 determines that the selected point does not meet the required accuracy, the AI system 405 returns to the immediately previous model. That is, because the immediately previous model meets the criteria but the selected model does not, the AI system 405 determines that the previous index is the point farthest from the endpoint that can be used and returns that model.

[0080] In some embodiments, in addition to or instead of using accuracy as the minimum criterion, the AI system 405 uses adversarial accuracy as the maximum criterion (or adversarial error rate as the minimum criterion). In such embodiments, the AI system 405 can rely on the correlations and data collected during testing discussed above to estimate or predict the adversarial accuracy for any given index. The AI system 405 can then use this estimate to determine whether the selected index meets the criterion.

[0081] In some embodiments, the AI system 405 uses a predefined index to return a cleansed model, rather than stepping along a trained path to select one or more models. For example, based on testing and experimentation, the AI system 405 (or a user) may determine that a cleansed model corresponding to an index of 0.1 or 0.9 may provide an acceptable balance between adversarial accuracy and ordinary accuracy. Therefore, in embodiments, the AI system 405 may only generate and return cleansed model(s) corresponding to a predetermined (or user-provided) index.

[0082] In embodiments, the returned purified model can be used for any number of functions. In many embodiments, the final functionality of the purified model may be closely related to (or identical to) the original underlying ML model. In various embodiments, this may include image recognition and analysis, audio analysis, text analysis, and the like. In general, embodiments of the present disclosure may be applied to any machine learning domain. Therefore, in embodiments, the AI system 405 facilitates ML functionality using a purified model that significantly reduces the risk of adversarial attacks.

[0083] Figure 8 8 is a flow chart illustrating a method 800 for cleansing a machine learning model according to one embodiment disclosed herein. Method 800 begins at block 805, where the AI system 405 receives a first ML model. At block 810, the AI system 405 receives clean training data. Method 800 then proceeds to block 815, where the AI system 405 trains a path between the first ML model and a second ML model using the clean training data. Further, at block 820, the AI system 405 generates a cleansed ML model based on at least one point on the trained path. Method 800 proceeds to block 825, where the AI system 405 uses the cleansed ML model to facilitate one or more ML functions.

[0084] The description of various embodiments of the present disclosure has been presented for illustrative purposes, but the description is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, practical applications, or improvements over existing technologies in the market, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

[0085] In the foregoing and / or following content, reference is made to the embodiments presented in the present disclosure. However, the scope of the present disclosure is not limited to the specifically described embodiments. On the contrary, any combination of the foregoing and / or following features and elements, whether or not related to different embodiments, is contemplated for use in implementing and practicing the contemplated embodiments. In addition, although the embodiments disclosed herein may achieve advantages over other possible solutions or prior art, whether or not a given embodiment achieves a particular advantage does not limit the scope of the present disclosure. Therefore, the foregoing and / or following aspects, features, embodiments and advantages are merely illustrative and are not considered to be elements or limitations of the appended claims unless expressly stated in the claims. Similarly, reference to the "present invention" should not be interpreted as a summary of any inventive subject matter disclosed herein and should not be considered to be elements or limitations of the appended claims unless expressly stated in the claims.

[0086] Aspects of the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.), or an embodiment combining software and hardware aspects, which may all be collectively referred to herein as a "circuit," "module," or "system."

[0087] The present invention may be a system, method, and / or computer program product.The computer program product may include (one or more) computer-readable storage media having computer-readable program instructions thereon for causing a processor to perform various aspects of the present invention.

[0088] Computer readable storage medium can be a tangible device that can hold and store the instructions used by the instruction execution device.Computer readable storage medium can be, for example, but not limited to, electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device, or any suitable combination of the aforementioned storage devices.A non-exhaustive list of more specific examples of computer readable storage medium includes the following: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device such as a punch card or a raised structure in a groove having instructions recorded thereon, and any suitable combination of the above-mentioned devices.Computer readable storage medium as used herein should not be interpreted as being a temporary signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagated by waveguides or other transmission media (for example, light pulses by optical fiber cables), or electrical signals transmitted by wires.

[0089] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0090] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of integrated circuits, or source code or object code written in any combination of one or more programming languages (including object-oriented programming languages, such as Smalltalk, C++, etc.) and procedural programming languages (such as " C " programming language or similar programming languages). The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or executed completely on a remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network (including local area network (LAN) or wide area network (WAN)), or can be connected to an external computer (such as, using an internet service provider through the internet). In certain embodiments, the electronic circuit comprising, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can perform the computer-readable program instructions to personalize the electronic circuit by utilizing the state information of the computer-readable program instructions, so as to perform various aspects of the present invention.

[0091] Aspects of the present invention are described herein with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the present invention. It will be understood that each block of the flowcharts and / or block diagrams and the combination of blocks in the flowcharts and / or block diagrams can be implemented by computer-readable program instructions.

[0092] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can direct the computer, programmable data processing device, and / or other equipment to operate in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0093] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps will be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0094] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each frame in the flow chart or block diagram can represent a module, segment or part of an instruction, which includes one or more executable instructions for realizing the specified logical function. In some alternative embodiments, the function noted in the frame may not occur in the order noted in the figure. For example, the two frames shown in succession can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function involved. It will also be noted that the combination of each frame of the block diagram and / or flow chart illustration and the frame in the block diagram and / or flow chart illustration can be realized by a dedicated hardware-based system that performs a specified function or action or performs a combination of special-purpose hardware and computer instructions.

[0095] Embodiments of the present invention may be provided to end users via a cloud computing infrastructure. Cloud computing generally refers to the provision of scalable computing resources as a service over a network. More formally, cloud computing can be defined as providing an abstraction between computing resources and their underlying technology infrastructure (e.g., servers, storage, networks), thereby enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be quickly provisioned and released with minimal management effort or service provider interaction. Thus, cloud computing allows users to access virtual computing resources (e.g., storage, data, applications, and even complete virtualized computing systems) in a "cloud" without regard to the underlying physical systems (or the location of those systems) used to provide the computing resources.

[0096] Typically, cloud computing resources are provided to users on a pay-per-use basis, where users are charged only for the computing resources actually used (e.g., the amount of storage space consumed by the user or the number of virtualized systems instantiated by the user). Users can access any resource residing in the cloud at any time from anywhere on the Internet. In the context of the present invention, users can access applications (e.g., purification application 435) or related data available in the cloud. For example, purification application 435 can be executed on a computing system in the cloud and repair and purify ML models. In this case, purification application 435 can generate purified models and store them in a storage location in the cloud. Doing so allows users to access this information from any computing system connected to a network connected to the cloud (e.g., the Internet).

[0097] While the foregoing is directed to embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, and the scope of the invention is determined by the claims hereinafter appended.

Claims

1. A computer-implemented method comprising: receiving a first machine learning model; Receive clean training data; Using the clean training data to train a path between the first machine learning model and a second machine learning model, wherein the first machine learning model and the second machine learning model are used for image analysis, audio analysis, or text analysis, and the first machine learning model and the second machine learning model have a shared architecture and different weights; generating a cleansed machine learning model based on at least one point on the trained path, the cleansed machine learning model reflecting the shared architecture; as well as Use the cleansed machine learning model for image analysis, audio analysis, or text analysis.

2. The method according to claim 1, wherein The first machine learning model is pre-trained using poisoned training data such that the first machine learning model misclassifies adversarial input data having a predefined trigger, and wherein the sanitized machine learning model is less likely to misclassify the adversarial input data than the first machine learning model.

3. The method according to claim 1, wherein Generating a cleansed machine learning model involves: determining a predefined acceptable accuracy of the cleansed machine learning model; selecting a point on the trained path that is farthest from the first machine learning model and that satisfies the predefined acceptable accuracy; and Based on the weights specified at the selected points, the cleansed machine learning model is instantiated.

4. The method according to claim 1, wherein The first machine learning model and the second machine learning model are received from a third party, and wherein training data used to train the first machine learning model and the second machine learning model is not received.

5. The method according to claim 1, further comprising: The second machine learning model is generated by iteratively refining the first machine learning model using the clean training data.

6. The method according to claim 1, wherein Training the path between the first machine learning model and the second machine learning model includes: determining a first set of weights w1 corresponding to the first machine learning model; determining a second set of weights w2 corresponding to the second machine learning model; and Generates a continuous piecewise smooth parametric curve φ with parameter θ θ (t), so that φ θ (0) = w1 and φ θ (1) = w2.

7. The method according to claim 6, wherein: Generating the continuous piecewise smooth parameter curve includes determining the parameter θ, which includes: Minimize by Define the expectation of a uniform distribution on the curve.

8. The method according to claim 1, wherein The first machine learning model is trained on a first training dataset, wherein the first training dataset does not include the clean training data, and wherein the first training dataset is larger than the clean training data.

9. A computer-readable storage medium containing computer program code, said computer program code, when executed by one or more computer processors, performing operations comprising: receiving a first machine learning model; Receive clean training data; Using the clean training data to train a path between the first machine learning model and a second machine learning model, wherein the first machine learning model and the second machine learning model are used for image analysis, audio analysis, or text analysis, and the first machine learning model and the second machine learning model have a shared architecture and different weights; generating a cleansed machine learning model based on at least one point on the trained path, the cleansed machine learning model reflecting the shared architecture; as well as Use the cleansed machine learning model for image analysis, audio analysis, or text analysis.

10. The computer-readable storage medium according to claim 9, wherein: The first machine learning model is pre-trained using poisoned training data such that the first machine learning model misclassifies adversarial input data having a predefined trigger, and wherein the sanitized machine learning model is less likely to misclassify the adversarial input data than the first machine learning model.

11. The computer-readable storage medium according to claim 9, wherein: Generating the cleansed machine learning model includes: determining a predefined acceptable accuracy of the cleansed machine learning model; selecting a point on the trained path that is farthest from the first machine learning model and that satisfies the predefined acceptable accuracy; and Based on the weights specified at the selected points, the cleansed machine learning model is instantiated.

12. The computer-readable storage medium according to claim 9, wherein: The first machine learning model and the second machine learning model are received from a third party, and wherein training data used to train the first machine learning model and the second machine learning model is not received.

13. The computer-readable storage medium of claim 9, wherein: The operations further include: The second machine learning model is generated by iteratively refining the first machine learning model using the clean training data.

14. The computer-readable storage medium of claim 9, wherein: Training the path between the first machine learning model and the second machine learning model includes: determining a first set of weights w1 corresponding to the first machine learning model; determining a second set of weights w2 corresponding to the second machine learning model; and Generates a continuous piecewise smooth parametric curve φ with parameter θ θ (t), so that φ θ (0) = w1 and φ θ (1) = w2.

15. The computer-readable storage medium of claim 14, wherein: Generating the continuous piecewise smooth parameter curve includes determining the parameter θ, which includes: Minimize by Define the expectation of a uniform distribution on the curve.

16. A computer system comprising: one or more computer processors; as well as a memory containing a program that, when executed by the one or more computer processors, performs operations comprising: receiving a first machine learning model; Receive clean training data; Using the clean training data to train a path between the first machine learning model and a second machine learning model, wherein the first machine learning model and the second machine learning model are used for image analysis, audio analysis, or text analysis, and the first machine learning model and the second machine learning model have a shared architecture and different weights; generating a cleansed machine learning model based on at least one point on the trained path, the cleansed machine learning model reflecting the shared architecture; and Use the cleansed machine learning model for image analysis, audio analysis, or text analysis.

17. The computer system according to claim 16, wherein: The first machine learning model is pre-trained using poisoned training data such that the first machine learning model misclassifies adversarial input data having a predefined trigger, and wherein the sanitized machine learning model is less likely to misclassify the adversarial input data than the first machine learning model.

18. The computer system according to claim 16, wherein: Generating the cleansed machine learning model includes: determining a predefined acceptable accuracy of the cleansed machine learning model; selecting a point on the trained path that is farthest from the first machine learning model and that satisfies the predefined acceptable accuracy; and Based on the weights specified at the selected points, the cleansed machine learning model is instantiated.

19. The computer system according to claim 16, wherein: Training the path between the first machine learning model and the second machine learning model includes: determining a first set of weights w1 corresponding to the first machine learning model; determining a second set of weights w2 corresponding to the second machine learning model; and Generates a continuous piecewise smooth parametric curve φ with parameter θ θ (t), so that φ θ (0) = w1 and φ θ (1) = w2.

20. The computer system of claim 19, wherein: Generating the continuous piecewise smooth parameter curve includes determining the parameter θ, which includes: Minimize by Define the expectation of a uniform distribution on the curve.

Images