System and method for creating secure neural network

Abstract

A method of embedding an implementation of a shared secret confusion mechanism into an existing neural network to provide a safer data interface to the neural network is disclosed. The disclosed implementations utilize a novel form of transcoding that can be implemented within a conventional neural network. The transcoding maps spans along consecutive digital lines onto segments defining a multi-dimensional projection. Definitions of transcoding properties (span-to-segment mapping) are supplied to a form of compiler that produces a transcoding neural network (architecture + weight and bias) that can be embedded within existing nerves to cause the neural network to output transcoded data.

Description

Background Art

[0001] Artificial intelligence (AI) refers to computer models that simulate the cognitive processes of the human mind. Recently, AI has found many applications. For example, ChatGPT is an AI model that interacts with users to provide information and creative works in a conversational manner. In addition, autonomous and semi-autonomous vehicles can use AI to recognize objects (such as pedestrians, traffic signs, and other vehicles), and ride-sharing apps can use AI to determine waiting times and real-time ride pricing. One method of AI is machine learning (ML), which is used to find the probability of a certain outcome using analytical experiments. ML uses a large collection of historical "training" data that is fed into a statistical model to "learn" one or more specific tasks, such as facial recognition. The more training data used, the more accurate the ML probability estimate will be.

[0002] Various ML algorithms are well known (e.g., ADAP and RMSProp). ML models can be implemented using "neural networks," also known as "artificial neural networks" (ANNs). Neural networks mimic the way biological neurons in the human brain signal to each other. Neural networks consist of multiple layers of nodes, including an input layer, one or more internal / hidden layers, and an output layer. Each node, or artificial "neuron," is connected to another node, or artificial "neuron," and has an associated weight and threshold. If the output of any individual node is above a specified threshold, the node is activated, sending data to the next layer of the network.

[0003] Neural network models represent mathematical functions. In this way, they are similar to traditional computer software, but they are expressed in a different language (not human-readable) and are often discovered computationally rather than by an author (machine learning, not engineering). These models often perform operations on sensitive data, such as making a cancer diagnosis or calculating the risk of defaulting on a loan. Furthermore, models implemented by neural networks represent substantial investments in intellectual property that are worth protecting.

[0004] As mentioned above, neural networks are typically structured as a collection of layers, where each layer includes neurons that perform computational operations. Neurons in one layer are connected to neurons in the previous layer using weighted synapses, and in this way, data flows forward through the neural network. The first layer where data enters the neural network is called the "input layer" and the numerical values ​​held in the input neurons are propagated forward to the neurons in the hidden layers. The last layer, called the "output layer," reports the final numerical result of the neural network processing.

[0005] The input layer of a neural network can accept numerical data corresponding to various real-world features, for example. For image processing neural networks, these features may be pixel intensities corresponding to X and Y coordinates in an image (such as numbers between 0 and 255). For cancer diagnostic models, the input can be, for example, a description of a tissue or even a blood test result. Each feature typically corresponds to an input neuron. This is also true at the output. In other words, conventional neural networks typically have a one-to-one mapping between data and meaning. For example, a cancer screening neural network will typically output the presence or absence of a tumor through a neuron (where 0.0 means absence and 1.0 means presence).

[0006] In conventional neural network architectures, there are no mechanisms for protecting data. The one-to-one mapping between data and meaning represents a significant security vulnerability. For example, if Bob knows what neural network is being used to process data about Alice, Bob can easily determine details about Alice by looking at the output of the neural network. For example, Bob may be able to learn something very private about Alice (such as a cancer diagnosis or a credit score) based on the output of the neural network.

[0007] Data "masking" is the process of modifying sensitive data in such a way that it has little or no value to unauthorized intruders, while still being usable by software or authorized personnel. Data obfuscation can be used in programming computational algorithms to protect information that is classified as personally identifiable information or mission-critical data, or that otherwise needs to be maintained as secure. However, for the purpose of conducting effective testing cycles, the data must remain available. Due to the above-mentioned one-to-one mapping between data and meaning, conventional neural network architectures are not easily adapted to use obfuscated data. Adapting existing data obfuscation methods (such as finite ring encoding or even simple XOR-based methods) is difficult because a) we are limited in the mathematical operations we can apply to the data, and b) we are limited to working with numbers as continuous scalar representations (rather than finite bit sequences). For this reason, existing masking methods are not practical for use in neural networks. In summary, conventional neural network architectures do not have a practical mechanism for producing protected outputs. The data coming in and out is almost always "clear", and this represents a security / privacy issue. Service providers who may want to use neural networks must deal with the privacy requirements of their end users (which are often mandated by legislation, such as the EU's GDPR), as well as the risks of exposing their models to the outside world through public interfaces (e.g., APIs). This is particularly true in a hosting environment such as AMAZON WEB SERVICES (AWS), where neural networks perform off-site computations in the cloud.

[0008] While there are many known solutions for protecting data flows (such as SSL and obfuscation), these protections end when the data is presented to a runtime environment that executes a neural network model (e.g., KERAS, TORCH, TENSORFLOW, etc.) because the models themselves are designed to accept and output "raw" or clean data. Summary of the invention

[0009] The disclosed implementation extends the protection boundaries of a neural network and is therefore more compliant with the principles of data security and privacy. The disclosed implementation includes a method of embedding an implementation of a shared secret obfuscation mechanism (which is not created using machine learning) into an existing neural network to provide a more secure data interface to the neural network. The disclosed implementation utilizes a novel form of transcoding that can be implemented within a conventional neural network. The transcoding maps spans along a continuous digital line to segments that define a multidimensional projection. The definition of the transcoding properties (mapping of spans to segments) is supplied to a form of compiler that produces a transcoded neural network (architecture + weights and biases) that can then be appended or embedded within the original neural network to create a protected neural network that outputs transcoded data.

[0010] The transcoded neural network protects data generated by the original neural network that may be considered sensitive or otherwise to be kept private, such as medical data, technical data, or financial data. As an example, the transcoded neural network may interface with neurons in an output layer of the neural network. However, the disclosed implementations may be used to protect neurons within any one or more layers of the original neural network, thereby obfuscating the entire neural network and thereby protecting data at all stages of execution of the neural network.

[0011] One disclosed implementation is a method for protecting a neural network model, the method comprising: receiving an output specification data structure specifying an output of an output layer of an original neural network, wherein the original neural network is configured to execute a model; creating an n-dimensional matrix for at least one output of the output layer of the original neural network by: defining a plurality of segments of a scalar value X of the output along a number line; determining a corresponding projection algorithm for each of the plurality of segments, wherein at least one of the corresponding projection algorithms is different from the other corresponding projection algorithms; and for each of the plurality of segments, projecting the scalar value X of the output onto a predetermined surface according to the corresponding projection algorithm, thereby generating an n-dimensional vector X' as an obfuscation function of X; creating a transcoded neural network that implements the obfuscation function of X; and interfacing the transcoded neural network with the original neural network, thereby creating a protected neural network that executes the model. In order to decode X' back to X, knowledge of the segments and projection parameters associated with each segment will be required. For example, for each segment S, X' can be reversed back to X using the segment projection parameters (Sp), and then X is passed back into the projection Sp to produce a new X' - as long as the resulting X' still lies on the segment S, we can assume that X is actually the decoded value. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above summary of the invention and the following detailed description of the invention will be better understood when read in conjunction with the accompanying drawings. For the purpose of illustrating the invention, various illustrative embodiments are shown in the accompanying drawings. However, it should be understood that the invention is not limited to the precise arrangements and instruments shown.

[0013] Figure 1 is a graph of values ​​along a number line.

[0014] Figure 2 is an example of a graph of numbers along a number line projected in two dimensions in accordance with disclosed implementations.

[0015] Figure 3 is another example of a graph of numbers along a number line projected in two dimensions in accordance with disclosed implementations.

[0016] Figure 4 is a diagram illustrating invalid values ​​according to the disclosed implementation. Figure 3 of charts.

[0017] Figure 5 is a diagram illustrating transcoded results of a segment according to the disclosed implementation.

[0018] Figure 6 is a histogram illustrating the relative frequency for particular values ​​produced by neurons in an output layer of a handwritten digit classifier in accordance with disclosed implementations.

[0019] Figure 7 A more detailed diagram Figure 6 Histogram of the data.

[0020] Figure 8 An example of the results of testing optimized encoding according to the disclosed implementations is illustrated.

[0021] Fig. 9 Another example of the results of testing optimized encoding according to the disclosed implementations is illustrated.

[0022] Fig.10 Another example of the results of testing optimized encoding according to the disclosed implementations is illustrated.

[0023] Fig.11 The results of increasing the number of segments according to the disclosed implementations are illustrated.

[0024] Fig.12 The definition of segments according to the disclosed implementation is illustrated.

[0025] Fig.13 An example of a conventional neural network architecture is illustrated.

[0026] Fig.14 An example architecture of a transcoding neural network in accordance with disclosed implementations is illustrated.

[0027] Fig.15 A transcoded neural network interfaced with an original neural network according to disclosed implementations is illustrated.

[0028] Fig.16 An example of a protected neural network in accordance with disclosed implementations is illustrated.

[0029] Fig.17 An example of a projection table embedded within a transcoding neural network in accordance with disclosed implementations is illustrated.

[0030] Fig.18 is a flow chart illustrating a process for creating a protected neural network in accordance with disclosed implementations. DETAILED DESCRIPTION

[0031] Certain terms are used in the following description for convenience only and are not limiting. Unless expressly stated herein, the terms "a", "an" and "the" are not limited to one element, but instead should be understood to mean "at least one". The term includes the above words, their derivatives and words of similar meaning.

[0032] Transcoded neural networks according to the disclosed implementations allow for protection of the output of a neural network (or any neuron of a neural network). When a conventional neural network ("original neural network") is protected by a transcoded neural network, the protected data remains private because the protected data (or the state of any neuron in the network) is encoded via an encoding scheme that includes secret coefficients. The disclosed implementations work natively within the conventional runtime environment of the protected neural network because the transcoded neural network is implemented as the neural network itself. Data protection can be optimized to obfuscate AI / ML-based analytics and be resilient to model cloning and adversarial attacks. Transcoding can be engineered to balance protection with resource requirements and / or to maximally protect the most sensitive or most likely values ​​of a variable.

[0033] A "transcoding neural network" comprises a neural network that accepts the output of an artificial neuron as input and produces a transcoded value as output (although transcoding neural networks can be applied anywhere floating point numbers are used). For example, if the input to a transcoding neural network is the number 1.23, the transformed output may be a sequence of numbers such as [56.3, 23.3, 0.0001, -8.1, 3.1415, 12, 0]. Just as there are many possible keys for a cryptographic system, there are many possible parameters for a transcoding neural network. This set of parameters is converted into weights and biases, which form the layers of the neural network and control exactly how the numbers are transcoded. Therefore, reversing the transcoding requires precise knowledge of the parameters (a shared secret) of the specific transcoding neural network that performed the encoding. A transcoding neural network can be of any size, consisting of tens or millions of parameters.

[0034] Assuming that a single value X lying along a continuous distribution is to be converted into some encoding X' exhibiting certain properties, it might be desirable that: For any scalar value X, generate an n-dimensional vector X' such that knowledge of only one dimension of X' is insufficient to reproduce X; The relationship between X and X' is nonlinear; If X increases at some monotonic rate, then the resulting X' should "jump" around as if it were random, i.e., the encoding reduces (or eliminates) any apparent correlation between X and X'; The computational cost of producing the code can be controlled to balance the security level of the code with the computational resources required; and • The code can be implemented as a conventional artificial neural network.

[0035] The disclosed implementation recognizes that all numbers exist on a number line. In this way, numbers can be thought of as distances along a path, even though this is not how the numbers are used. In addition, a number X can be projected onto any surface, thereby converting a 1-dimensional number into a 2-dimensional vector (or vector of any desired dimension).

[0036] Even when projected into a higher dimension as X', the original value X can be characterized as a distance along a number line. The disclosed implementation associates a precisely defined span (segment) of X with a precisely defined encoding algorithm that defines how to perform the projection of X to X'. For example, Figure 1 As shown, all values ​​of X spanning from 0.0 to 2.0 may be defined as a first line segment 102, and values ​​of X spanning from 2.0 to 5.0 may be defined as a second line segment 104. Each segment may have a corresponding encoding algorithm associated therewith, which algorithms may each have unique properties for projecting X onto a multidimensional surface.

[0037] X can be defined as an index into a table describing a line segment, and X can be projected along the line segment. However, the projection need not be on a continuous path. X could be the sum of distances along the segment, but its projection could be anything. For example, Figure 2 As shown, the first line segment 102 can be associated with an encoding algorithm F(X) = [X, 0] (the line segment itself), and the second line segment 104 can be associated with an encoding algorithm that is a projection of the values ​​along line segment 104'. In this example, X = 3 is encoded as X' = [2.7, 0.7]. As a further example, by decoupling the intercept of each segment from our treatment of X as the distance along the path (defined by the scaled sum of the segment lengths), we can create an output that is "disjoint" and displays a higher degree of liminality (i.e., ambiguity or disorientation), such as Figure 3 In this way, a 1-dimensional continuous value X can be projected onto several different multidimensional surfaces using only simple linear operations.

[0038] This mechanism has properties that make it useful as a transcoding algorithm when applied to a neural network. While seemingly simple, this system of mapping spans (or ranges of values) to segments and then projecting numbers using parameters associated with the mapped segments provides control over how X' behaves as a system. As long as X' can be decoded back to X when necessary, specific desired properties of the encoding can be engineered, as discussed in more detail below.

[0039] The disclosed implementation can be implemented as a fully connected feed-forward neural network using only linear and rectified linear activation functions. This means that the transcoded neural network can be natively implemented within all existing neural network frameworks (such as Keras, Torch, etc.) and is compatible with all conventional environments and hardware platforms.

[0040] Furthermore, the mapping of X to X' need not follow any "rhyme or reason". Random spans of X can be assigned to randomly generated projection algorithms. This makes encoding more secure, since the input and output are uncorrelated in all appearances. Of course, values ​​of X that fall along the same span will remain correlated, since they use the same projection parameters / encoding algorithm. However, by carefully defining the spans (e.g., by incorporating knowledge about the distribution of X), the potential discovery of such correlations can be minimized. An unlimited number of non-linear and highly confusing mappings can be used for transcoding.

[0041] In addition, the order of the encoding can be shuffled to make it more difficult to find the encoding and thereby make it more difficult to reverse the encoding. For example, instead of all the encoding elements appearing in order, we can change the order so that reconstruction will require knowledge of the reordering (e.g., how changing the order of pixels in an image hides the meaning of the image). In order for the shuffling to be effective, it is desirable to have multiple elements to shuffle. The disclosed implementation allows a single scalar to be converted into a vector of arbitrary size. Each element of the vector can be self-similar in terms of its dynamics so that it is difficult to identify a specific element. The encoding disclosed herein allows precise control over each dimension of the output encoding.

[0042] In the disclosed implementation, a particular transcoding neural network projects X onto a very specific path. Any deviation from that path cannot be a product of the transcoding neural network. For example, Figure 4 As shown, the value pair [2, 2] cannot be Figure 3This is the product of the transcoding example of , since [2, 2] is not on any of the projection lines. Therefore, it is simple to determine whether the value of X' is valid by simply decoding X' and then re-encoding the result. If they do not match (within some floating point tolerance), the encoding is not authentic. As an example, a dictionary of X->X' values ​​can be generated. Such a table will be very large. To address this problem, the X' value can be identified at the end of each line segment, and it can be checked whether a given value lies on any segment defined by these endpoints. To address the possibility of dictionary attacks, multiple transcoding networks can be used in conjunction with the input encoding scheme, and a random number can be passed into the algorithm, propagated to the end of the network, and fed to the transcoding network to encode it into a vector. The resulting encoding can be used to alter the encoding produced using the method described in this article. As an example: ·R->>encoded as R' ·X->>encoded as X' · • R'+X'=EvenBetter' decoding will require knowledge of the incoming random number and the parameters of the two transcoding networks.

[0043] As long as a few constraints are met, the number of segments used by the encoder can be increased, and any appearance of correlation between X and X' can therefore be reduced. For example, Figure 5 The encoding shown has many discontinuous projected line segments. In other words, a larger and more computationally expensive transcoded neural network produces a higher level of security by reducing the occurrence of correlations between X and X'. Table 1 below illustrates this concept by showing how a relatively small increase in segments can result in a very large increase in parameters.

[0044] Table 1 Unique 2D segments parameter 36(6x6) 49,073 144(12x12) 771,701 575(24x24) 12,293,573 .

[0045] While engineering cost profiles is advantageous, it is also desirable to ensure that the security budget is spent in an efficient manner. To this end, the transcoding neural network can be designed to be more efficient (or less efficient) for specific ranges of X by changing the resolution of the segments in a targeted manner. This may be well suited for layers that use hyperbolic tangent or sigmoid activation functions, as these neurons are more likely to produce values ​​in the "off" or "on" state.

[0046] For example, a handwritten digit classifier presented with the number 7 would set one output neuron to a high state (0.9825) while keeping the others in a low state (0.0012, 0.15, 0.123, ...). Figure 6The histogram of shows the relative frequency of specific values ​​produced by the neurons in the output layer of the handwritten digit classifier. As expected, in the handwritten digit classifier example, 90% of the values ​​are close to 0.0 (the "no" case) and 10% of the values ​​are close to 1.0 (the "yes" case), and for any digit, 9 out of 10 neurons will be low and only one will be high. Figure 7 As shown, a closer look at this distribution shows that the neurons in the output layer produce values ​​close to 0.0, with 30% of the outputs being less than 0.003. This property can be exploited in the transcoding neural network by specifying many very small segments for values ​​of X close to 0, and relatively few segments elsewhere, resulting in a transcoding neural network that can be much smaller, but has much higher performance, since the possible encodings will not have similar values.

[0047] Figure 8 The graph shows the results of testing an optimized encoding consisting of approximately 150 segments (compared to a transcoded neural network using 1000 segments of equal length), where the length of the segments is based on the known distribution of values ​​produced by the MNIST classifier neurons. The optimized version produces a much more chaotic encoding, despite requiring fewer resources to compute. Specifically, Figure 8 In the graph, when a "frequency-sensitive" encoding is used (the left-hand side of the graph), values ​​close to 0 are encoded very differently, whereas when a naive approach is used (the right-hand side of the graph), values ​​close to 0 tend to be more similar. Someone observing the encoded values ​​from the naive approach might be able to infer what's going on because there's an obvious pattern.

[0048] Neural networks are susceptible to many machine learning-assisted attacks, such as model cloning and adversarial learning. One way to mitigate the effectiveness of these attacks is to hide the learnable signal used by the attacker. Using the disclosed implementations, the output encoding can be engineered in a way that minimizes this signal while still maintaining a low correlation between X and X'.

[0049] For example, if it is desired to optimize the encoding to preserve "confidence" values, the encoding can be engineered so that low confidence values ​​(e.g., 0.0 to 0.1) produce very similar (but slightly different) encodings as high confidence values ​​(e.g., 0.90 to 0.99). Fig. 9 An example line segment projection for such encoding is shown in . Note that the encoded values ​​E for 0.9 to 9.9 are very close to the encoded values ​​A for 0.0 to 0.2.

[0050] Other examples include engineering the encoding to produce large differences in the scale out of the output. For example, within the same transcoded neural network, some values ​​of X may produce very small encoded numbers (X' = [0.00001, 1, .01000056]), while other values ​​may produce quite large values ​​(X' = [23523562365, -99235.2342350235]). This is difficult for machine learning algorithms to understand, but is easily engineered with transcoded neural networks using the disclosed implementations.

[0051] A simple example application of the disclosed implementation is set forth below. In this example, the encoding assumes that X is a number in the range of 0.0 to 1.0. Note that the math below is not exact, as it has been simplified for illustration. For example, 0.333 is not the correct number, but 1 / 3rd is easier to understand than (0.8+0.8+1.0) / 3. In this example, three segments have been defined. Segment A is from 0.0 to 0.33, segment B is from 0.33 to 0.66, and segment C is from 0.66 to 1.0. When the value of X falls within a given segment, the value will be projected onto the 2D surface by placing it at a certain position along the line segment. We can define each of these projections (also referred to herein as an "encoding algorithm") using a set of coordinate pairs (representing the start and end of the projected line segment).

[0052] cPath=[[[0.0,0.0],[0.8,0.0]],#sectionA [[1.0,0.0],[1.0,0.8]],#Segment B [[1.0,1.0],[0.0,1.0]],#Segment C ] In this way, any value of X can be encoded into X' consisting of two coordinates (w, h). When X is in the range of 0 to 0.333, X' is calculated as follows according to the corresponding parameters (algorithm / projection): x = x / 0.333 (along where segment A is, as a percentage) w=0.8*x+0.0 h=0.0*x+0.0 xp = [w, h] When X is in the range of 0.333 to 0.666, use the parameters (projection / algorithm) of segment B to calculate X': x=(x-0.333) / 0.333#We follow the section B w=0.0*x+1.0 h=1.0*x+0 xp = [w, h] When X is in the range 0.666 to 1.0, use the parameters (projection / algorithm) of segment C to calculate X': x = (x-0.666) / 0.333# We follow the location of segment C as a percentage w=-1.0*x+1.0 h=0.0*x+1.0 xp = [w, h] Using the above rule to plot all X values ​​between 0 and 1.0 gives Fig.10 Graph shown. It can be seen that in this example, a single value of X can be reprojected along one of three different lines in a precisely controllable manner. This mechanism can be easily implemented as a neural network using conventional techniques. Even this simple example satisfies the desired conditions / results discussed above. Knowing just w or h (the singular component of X') is not enough to invert X', because there are many encodings of X that produce the same value of w, and the relationship between X and X' is non-linear (although it is linear for some values ​​of X, that linearity is broken wherever it is so engineered). Furthermore, this example ensures that the encoding can "jump" even if X does not. For example, the encoded value for 0.3333 is very different from 0.33334, i.e., in Fig.10 There are "gaps" in the chart.

[0053] The complexity of the encoding can be increased by adding more segments to the encoding. Fig.11 The concept is illustrated. The graph on the left is the result of encoding with 5 segments. It can be seen that within each segment, there is a correlation between X and X'. The graph on the right is the result of encoding with 400 segments. In this graph, it is difficult (if not impossible) to determine any correlation between X and X'. It is also possible to increase the complexity by increasing the dimensionality of the encoding (from 2D to 3D...nD), thereby reducing any correlation between X and X'.

[0054] A description of how the neural network projects the value X into a segment-based projection is set out below.

[0055] For example, the following list of 3D point pairs describes the word "IRDETO".

[0056] cPath=[[0.1,0.9,0],[0.3,0.9,0]],#I [[0.2,0.88,0],[0.2,0.15,0]], [[0.1,0.1,0],[0.3,0.1,0]], [[0.4,0.1,1],[0.4,0.5,1]],#R [[0.41,0.5,1],[0.5,0.5,1]], [[0.5,0.49,1],[0.5,0.3,1]], [[0.6,0.1,2],[0.7,0.1,2]],#D [[0.7,0.12,2],[0.7,0.9,2]], [[0.6,0.12,2],[0.6,0.5,2]], [[0.61,0.5,2],[0.68,0.5,2]], [[0.8,0.1,3],[0.9,0.1,3]],#E [[0.9,0.5,3],[0.9,0.3,3]], [[0.8,0.12,3],[0.8,0.5,3]], [[0.81,0.5,3],[0.88,0.5,3]], [[0.81,0.3,3],[0.88,0.3,3]], [[1.05,0.1,4],[1.05,0.88,4]],#T [[0.91,0.7,4],[1.02,0.7,4]], [[1.08,0.7,4],[1.18,0.7,4]], [[1.2,0.1,5],[1.3,0.1,5]],#O [[1.3,0.5,5],[1.3,0.1,5]], [[1.2,0.12,5],[1.2,0.5,5]], [[1.21,0.5,5],[1.28,0.5,5]] ] This path can be converted into a transcoded neural network using a single line of code as shown below: cnet=createTranscoding neural network(cPath,unitLength=True,debug=True) This results in a neural network model (using the Tensorflow backend in Keras) consisting of 6 layers and approximately 30,000 parameters, as defined below. Total parameters: 30,498 Trainable parameters: 30,498 Non-trainable parameters: 0

[0057] If we pass values ​​0 to 1.0 to this network and plot the output (as a 3D plot), it will produce Fig.12 Output shown. This is certainly not the most cryptographically interesting encoding, but it illustrates how much control can be exerted over the transcoding neural network. To construct the transcoding neural network that acts as a cipher, we instead randomly assign segments in a way that satisfies some known dynamics of the protected digital space (e.g., the distribution of values), which is essentially a random table of projections connected to spans whose length matches the distribution of outputs produced by the protected neurons.

[0058] There are three architectural components to the solution. The first component is the architecture of the existing neural network (the original network model that is protected). The second component is the architecture of the individual transcoded neural networks (the patterns we use to protect the existing neural networks). The third component is the architecture of the protected neural network.

[0059] Most neural networks share similar architectures, this is because they consist of layers that feed into each other in a sequential manner, such as Fig.13 shown. Fig.13 The conventional neural network 1300 shown includes an input layer 1302, a hidden layer 1304, and an output layer 1306. Each layer in the neural network 1300 is composed of neurons ( Fig.13 ), which receive inputs from neurons in the layer behind (to the left) and send their outputs to neurons in the layer in front (to the right). The architecture of a neural network generally means that each set of two consecutive layers can be considered an independent neural network. Therefore, neural network 1300 can be divided into two independent neural networks (for example, at the dotted line), so that the output of one network is fed as input to the other network, and the resulting output will be the same as the output of the undivided neural network. Vice versa, that is, two neural networks can be merged. Using libraries such as Keras or Torch, layers can be added to the beginning, end, or even in the middle of an existing neural network.

[0060] Since the transcoding neural network of the disclosed implementation is also a neural network, the transcoding neural network can be added to an existing neural network to create a protected neural network. The transcoding neural network maps an input value X onto a target segment and then projects X onto a surface, as defined by the encoding algorithm (parameters) associated with the target segment, to determine X'. Fig.14An example of a transcoding neural network is illustrated in FIG. The transcoding neural network 1400 consists of six (6) layers - the size of each layer depends on the parameters used to construct the transcoding neural network. These layers include a scaling layer 1402, an attribute layer 1404, a decision layer 1404, a negation layer 1408, a normalization layer 1410, and a conversion layer 1412. Each layer can be designed and constructed using conventional techniques to implement the novel processing disclosed herein. The more segments the transcoding neural network uses, or the more dimensions in the output projection, the larger each layer will become. However, the depth (the total number of layers) does not need to change. For example, a transcoding neural network that outputs a 12-dimensional projection will be larger than a transcoding neural network that outputs only a 2-dimensional output, but each network can have 6 layers.

[0061] Each layer of the transcoding neural network 1400 accomplishes a specific task through a collection of matrix operations. The matrix operations are represented by "weights and biases" within a specific layer of the transcoding neural network. When the layers are combined, these layers allow us to determine which segment X belongs to, and then determine how to project X into the coordinate system defined by its target segment. The values ​​of the weights and biases are determined by the parameters that define the different projected segments.

[0062] An example parameterization of the transcoding neural network 1600 architecture is set forth below.

[0063] ###Creating weights and bias tables### l0Weights,l0Biases=makeScalingLayer(scaleFactor=inputScaleFactor,translationAmount=0.0) l1Weights,l1Biases=makeAttributionLayer(projections,pointDistanceTable,pathDistanceTable,buff=buff,debug=debug) l2Weights,l2Biases=makeDecisionLayer(projections,pointDistanceTable,pathDistanceTable) l3Weights,l3Biases=makeNegationLayer(projections,pointDistanceTable,pathDistanceTable) l4Weights,l4Biases=makeNormalizationLayer(projections,pointDistanceTable,pathDistanceTable,signParams) l5Weights,l5Biases=makeProjectionLayer(projections,transformParams) #Assemble the model confuserModel = Sequential() confuserModel.add(Dense(len(l0Biases),input_dim=1,activation='linear',name="layer_scale")) confuserModel.add(Dense(len(l1Biases),activation="relu',name="layer_attr")) confuserModel.add(Dense(len(l2Biases),activation="relu',name="layer_decision")) confuserModel.add(Dense(len(l3Biases),activation='relu',name='layer_negate')) confuserModel.add(Dense(len(l4Biases),activation='linear',name='layer_normalize')) confuserModel.add(Dense(len(l5Biases),activation='linear',name='layer_out')) Each layer performs matrix operations, including padding distances with non-zero support and approximating "if then" operations with rectified linear units and large negative numbers. For example, if we write out the operations of decision layer 1406 (assuming that the transcoded neural network 1600 consists of only three 2-dimensional segments (A, B, and C)), it might look like this: To protect an existing neural network (and thereby create a protected neural network), a transcoded neural network can be attached to each of the output neurons in the original network, such as Fig.15 As shown, Fig.14 The transcoded neural network 1400 is shown attached to one output neuron i1 of the unprotected neural network 1300 to create the protected network 1500. Although not shown for simplicity, the transcoded network 1400 can be attached to each output of the original neural network 1300. Fig.15 In the example above, the original neural network contains three outputs, and the transcoded neural network will be attached to each of the three output neurons i1, i2, and i3. These transcoded neural networks can be unique (have different parameters relative to each other) or share the same parameters. The transcoded neural networks coupled to different outputs of the unprotected neural network can even have different dimensions in their outputs.

[0064] Furthermore, transcoding neural networks can be chained together so that output i3 will change the encoding of outputs i1 and i2. There are many ways to do this. For example, X'=f(X+i3). This decoding requires that we know i3 so that the input to the neural network provides a "key" that changes the output in a reversible way. As another example, the projected value of X' can be changed in the transformation layer 1412 or the normalization layer 1410 with another number that defines the key X'=key*f(X) (because these layers can utilize linear activations and are therefore not restricted). In other words, it is possible for the transcoding neural network to take another parameter (the key) that will change the encoding, making it like a cryptographic index that contains not only the embedded shared secret (the parameters of the transcoding neural network), but also the temporary shared secret (the incoming value from the unprotected neural network).

[0065] Fig.16 An example of a protected neural network according to the disclosed implementation is illustrated. In this example, an MNIST handwritten digit classifier 1600 (as a "raw neural network") is protected by a transcoded neural network 1400 that produces a 2-dimensional output. Since there are 10 outputs in the MNIST handwritten digit classifier, the protected network produces 20 outputs. Ten transcoded neural networks 1400 are attached to the end of the neural network, one for each output neuron. In this example, the parameters of each transcoded neural network are the same. Sample output table 1602 shows 20 values ​​produced by the protected MNIST model (i.e., the combination of the MNIST network 1600 and the transcoded neural network 1400) when presented with handwriting 2 as input.

[0066] exist Fig.17 The diagram shows the embedded Fig.16Figure 2. Projection table within a transcoded neural network in an example of . In this example, most spans are very small and are assigned to ranges of values ​​with high frequency in X. The line near coordinates 4,8 is a single large span that covers a range of values ​​that is almost never produced by the MNIST handwritten digit classifier. This illustrates the flexibility of the disclosed implementation.

[0067] Fig.18 is a flow chart illustrating a process for creating a protected neural network according to the disclosed implementation. At step 1802, an output specification data structure specifying the output of an output layer of an original neural network is received. Then, an n-dimensional matrix is ​​created by executing steps 1804 to 1808. At step 1804, a plurality of segments of the output are defined. At step 1806, a projection algorithm is defined for each of the plurality of segments. Preferably, at least one of the corresponding projection algorithms is different from the other corresponding projection algorithms. At step 1808, the projection algorithm is applied to the values ​​of the output corresponding to the plurality of segments to project the output scalar value X onto a predetermined surface and thereby generate an n-dimensional vector X' as an obfuscation function of X. At step 1810, a transcoded neural network that implements the obfuscation function of X is created. At step 1812, the transcoded neural network is docked with the original network to create a protected neural network.

[0068] In other examples, the linear projection defined for each segment can be replaced with any common neuron activation function (such as sigmoid or hyperbolic tangent) or something described by another neural network. The resulting transcoded neural network will work in the same way as it would when segmenting. However, the last layer will apply some other function (non-linear). Instead of line segments, there will be curved segments. In addition, the output of one transcoded neural network can be fed to the input of other transcoded neural networks to achieve highly complex encodings. In addition, instead of accepting a single input X, the transcoded neural network can accept multiple inputs to perform multivariate projections.

[0069] A requirement for decoding X' into X is that there should generally be a one-to-one relationship between X and the encoding. However, the transcoding neural network has no such restriction. Therefore, the transcoding neural network produces values ​​that cannot be reversed without knowing the transcoding parameters. In addition, the transcoding neural network can be engineered to produce irreversible encodings for specific ranges of X. These many-to-one encodings can be helpful for signaling specific conditions, or even hiding values ​​in a "white-box" manner (e.g., a value decodes to 1.0, but we secretly believe that the value means -1.0). This will make it difficult for an adversary to reverse the encoding process.

[0070] Alternatively, one can define certain projections that cannot be reliably inverted - essentially regions where a segment has more than one output condition. This can prevent another form of adversarial attacks. For example, a binary classifier neuron that outputs values ​​in the range of 0.3 to 0.7 can produce ambiguous encodings (since these values ​​may indicate an attack or adversarial example).

[0071] The methods of the disclosed implementations may be implemented by one or more computing devices that include functional "modules" consisting of code executable by a computer processor to perform the above functions. Computing devices that implement the disclosed implementations may include various tangible computer-readable media. Computer-readable media can be any available tangible media that can be accessed by a device, and include volatile and non-volatile media, removable and non-removable media. Tangible, non-transitory computer storage media include volatile and non-volatile, and removable and non-removable media implemented in any method or technology for storage of information, such as computer-readable instructions, data structures, program modules, or other data.

[0072] Various data and codes may be stored in an electronic storage device, which may include a non-transitory storage medium that stores information electronically. The electronic storage medium of the electronic storage device may include one or both of a system storage device and / or a removable storage device, which is provided integrally (i.e., substantially non-removably) with the computing device and the removable storage device is removably connectable to the computing device via, for example, a port (e.g., a USB port, a FireWire port, etc.) or a drive (e.g., a disk drive, etc.). The electronic storage device may include one or more of the following: an optically readable storage medium (e.g., an optical disk, etc.), a magnetically readable storage medium (e.g., a magnetic tape, a magnetic hard drive, a floppy disk drive, etc.), a charge-based storage medium (e.g., an EEPROM, a RAM, etc.), a solid-state storage medium (e.g., a flash drive, etc.), and / or other electronically readable storage medium.

[0073] The processor(s) of a computing device may be configured to provide information processing capabilities and may include one or more of a digital processor, an analog processor, a digital circuit designed to process information, an analog circuit designed to process information, a state machine, and / or other mechanisms for electronically processing information. As used herein, the term "module" may refer to any component or collection of components that perform the functions belonging to the module. This may include one or more physical processors, processor-readable instructions, circuit systems, hardware, storage media, or any other components during the execution of processor-readable instructions.

[0074] Those skilled in the art will appreciate that changes may be made to the disclosed implementations without departing from the broad inventive concept thereof. Therefore, it should be understood that the present invention is not limited to the disclosed implementations, but is intended to cover modifications within the spirit and scope of the present invention as defined by the appended claims.

Claims

1. A method for protecting a model executed by a neural network, the method comprising: receiving an output specification data structure specifying an output of an output layer of an original neural network, wherein the original neural network is configured to execute the model; Create an n-dimensional matrix for at least one output of the output layer of the original neural network by following these steps: defining a plurality of segments of scalar values ​​X of the output along a digital line; determining a corresponding projection algorithm for each of the plurality of segments, wherein at least one of the corresponding projection algorithms is different from the other corresponding projection algorithms; as well as For each of the plurality of segments, projecting the output scalar value X onto a predetermined surface according to the corresponding projection algorithm, thereby generating an n-dimensional vector X' as a confusion function of X; Create a transcoded neural network that implements the obfuscation function of X; and The transcoded neural network is interfaced with the original neural network to create a protected neural network that executes the model.

2. The method of claim 1 , wherein the docking comprises appending the transcoded neural network to at least one output of the original neural network.

3. The method of claim 2, wherein the transcoding neural network comprises a scaling layer, an attribute layer, a decision layer, a negation layer, a normalization layer, and a conversion layer.

4. A method according to any one of the preceding claims, wherein the step of defining a plurality of segments of the output scalar value X along a digital line comprises defining the segments to have different sizes.

5. The method of claim 4, wherein the size of the segment is smaller in cases where the corresponding value of X is more likely to be a critical value or is a critical value.

6. A method according to any one of the preceding claims, wherein the corresponding projection algorithms are not all identical.

7. A method according to any one of the preceding claims, further comprising perturbing the output of the original neural network.

8. A security model implemented by a neural network, the security model comprising: The original model, implemented by a neural network and having an input layer, an output layer and at least one hidden layer; receiving an output specification data structure specifying an output of an output layer of an original neural network, wherein the original neural network is configured to execute the model; Create an n-dimensional matrix for at least one output of the output layer of the original neural network by the following steps; A transcoded neural network implementing a confusion function of X, the transcoded neural network being created by: defining a plurality of segments of the output scalar value X along a digital line; determining a corresponding projection algorithm for each of the plurality of segments, wherein at least one of the corresponding projection algorithms is different from the other corresponding projection algorithms; and for each of the plurality of segments, projecting the output scalar value X onto a predetermined surface according to the corresponding projection algorithm, thereby generating an n-dimensional vector X' as the confusion function of X; The transcoded neural network is docked with the original neural network to create a protected neural network that executes the model.

9. The security model of claim 8, wherein the docking comprises appending the transcoded neural network to at least one output of the original neural network.

10. The security model of claim 9, wherein the transcoding neural network comprises a scaling layer, an attribute layer, a decision layer, a negation layer, a normalization layer, and a conversion layer.

11. A security model according to any one of claims 8 to 10, wherein defining a plurality of segments of the output scalar value X along a number line comprises defining the segments to have different sizes.

12. The security model of claim 11, wherein the size of the segment is smaller in cases where the corresponding value of X is more likely to be a critical value or is a critical value.

13. A security model according to any one of claims 8 to 12, wherein the corresponding projection algorithms are not all identical.

14. A security model according to any one of claims 8 to 13, wherein the output of the original neural network is scrambled.

15. A system arranged to perform the method according to any one of claims 1 to 7.

Images