System and method of preventing steganographic attacks

Abstract

The present invention relates generally to the technological field of cyber security. More specifically, the present invention relates to preventing cyber-attacks caused by delivering steganographically encoded malware through machine-learning (ML)-based model distribution. In the general aspect, the invention may be directed to a method of preventing steganographic attacks by at least one processor. The method may include receiving an initial machine-learning (ML)-based model; applying a steganalysis procedure to the initial ML-based model, to determine a probability of steganographic data presence in the initial ML-based model; applying at least one alteration to the initial ML-based model, according to the determined probability, thereby obtaining a disarmed ML-based model.

Description

SYSTEM AND METHOD OF PREVENTING STEGANOGRAPHIC ATTACKSCROSS REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of priority of U.S. Provisional Patent Application No. 63 / 524,681, filed July 2, 2023, the contents of which are all incorporated herein by reference in their entirety.FIELD OF THE INVENTION

[0002] The present invention relates generally to the technological field of cyber security. More specifically, the present invention relates to preventing cyber-attacks caused by delivering steganographically encoded malware through machine-learning (ML)-based model distribution.BACKGROUND OF THE INVENTION

[0003] As known, information technology security or cybersecurity has become an imperative aspect of contemporary computer systems and networks, as they remain vulnerable to cyberattacks.

[0004] A cyberattack is a deliberate attempt to access data, functions, or other restricted areas of the system without authorization, potentially with malicious intent. Cyberattacks may be aimed at stealing, altering, or destroying target information by hacking into susceptible systems. As a result of cyberattacks, confidentiality, integrity or availability of target resources may be compromised. Moreover, the damage may extend to resources in addition to the ones initially identified as vulnerable, including, e.g., further resources of the organization that owns the initial resource, and the resources of other involved parties (customers, suppliers). Eventually, cyberattacks have become increasingly sophisticated and dangerous.

[0005] Even though many approaches and techniques of cyberattack prevention are known from the prior art nowadays, the technological field of information security remains constantly evolving, struggling to challenge with both rapidly developing malware and new ways of hiding and distributing it.

[0006] Over the last years, ML-based model sharing has gained an increased popularity and has become ubiquitous. Unfortunately, it has provoked an increase of cyber-attacks aimed at open-source repositories. The fast adaptation in the industry, lack of awareness and ability to exploit the ML-based models has made them an attractive malware carrier.

[0007] Recently, malware was found to be hidden in neural network ML-based models. In most cases, it is done by replacing model weights bits (Least Significant Bits (LSB)) with malware bits using steganography embedding (inserting) methods. By embedding malware in neurons, the malware can be delivered covertly, with minor or no impact on the performance of neural network.

[0008] Steganography -based techniques of hiding and distributing malware are considered to be one of the most effective nowadays. There are efforts to prevent malicious ML-based model spreading known in the art. These efforts are based on scanning ML-based models with open-source malware scanners in order to detect malicious weight serialization and vulnerabilities that can lead to malware code execution when the model is loading. However, such efforts have shown poorly effective results.SUMMARY OF THE INVENTION

[0009] Accordingly, there is a need for a system and method of preventing steganographic attacks which would provide an improvement of the technological field of cyber security by increasing efficiency of detecting and disarming malicious data steganographically concealed inside ML-based models, and therefore, by increasing cyber safety of ML-based model distribution.

[0010] In the general aspect, the invention may be directed to a method of preventing steganographic attacks by at least one processor. The method may include receiving an initial machine-learning (ML)-based model; applying a steganalysis procedure to the initial ML-based model, to determine a probability of steganographic data presence in the initial ML-based model; applying at least one alteration to the initial ML-based model, according to the determined probability, thereby obtaining a disarmed ML-based model.

[0011] In another general aspect, the invention may be directed to a system for preventing steganographic attacks. The system may include: a non-transitory memory device, wherein modules of instruction code are stored, and at least one processor associated with the memory device, and configured to execute the modules of instruction code, whereupon execution of said modules of instruction code, the at least one processor may be configured to receive an initial machine-learning (ML)-based model; apply a steganalysis procedure to the initial ML-based model, to determine a probability of steganographic data presence in the initial ML-based model; and apply at least one alteration to the initial ML-based model, according to the determined probability, thereby obtaining a disarmed ML-based model.

[0012] In some embodiments, the initial ML-based model may be characterized by a set of parameters; and applying the steganalysis procedure may include: generating an input image representation of the initial ML-based model, based on the set of parameters thereof; inferring, on the input image representation, a respectively pretrained Siamese-Neural- Network (SNN)-based model, to calculate a distance metric value, representing a degree of pertinence of the input image representation to at least one class that indicates steganographic data presence in ML-based models, and determining the probability of the steganographic data presence based on the calculated distance metric value.

[0013] In some embodiments, the initial ML-based model may be an artificial neural network model, and the set of parameters may include weight coefficients. Said generating the input image representation may include: for one or more of said weight coefficients, extracting, from a value thereof represented in a binary format, a sequence of m zz-bit blocks; forming the input image representation from m image representation parts, wherein, for 1 < z < m, z-th of the m image representation parts comprises a plurality of pixels, each having a color coded based on z-th zz-bit block in the sequence of the zz-bit blocks of a respective weight coefficient of said weight coefficients.

[0014] In some embodiments, values of said weight coefficients may be stored in a floating- point-number representation comprising a mantissa portion and an exponent portion; and said sequence of m zz-bit blocks may represent, at least in part, the mantissa portion of the respective weight coefficient.

[0015] In some embodiments, the respectively pretrained SNN-based model may be configured to: receive the input image representation; perform a first vector embedding procedure on the input image representation, to calculate an input feature vector representation in a predefined feature space; and calculate the distance metric value representing at least one of (i) a first distance being a distance, in the feature space, between the input feature vector representation and a centroid vector representation of a first class, said centroid vector representation of the first class being calculated as an average of steganographically-nonaffected feature vector representations, calculated by performing the first vector embedding procedure on image representations of ML-based models not containing steganographic data; and (ii) a second distance being a distance, in the feature space, between the target feature vector representation and a centroid vector representation of a second class, said centroid vector representation of the second class being calculated asan average of steganographically-affected feature vector representations, calculated by performing the first vector embedding procedure on image representations of ML-based models containing steganographic data.

[0016] In some embodiments, the initial ML-based model may be characterized by a set of parameters; and applying the steganalysis procedure may include performing a second vector embedding procedure on the initial ML-based model, based on the set of parameters thereof, thereby obtaining an initial vector representation of the initial ML-based model; inferring, on the initial vector representation, an autoencoder ML-based model, respectively pretrained to reconstruct vector representations of ML-based models containing no steganographic data, thereby obtaining a reconstructed vector representation of the initial ML-based model; calculating a reconstruction error value, based on the initial and reconstructed vector representations of the initial ML-based model; and determining the probability of the steganographic data presence, based on the reconstruction error value.

[0017] In some embodiments, the method may further include classifying the initial ML- based model as containing the steganographic data, provided that the determined probability of the steganographic data presence surpasses a predefined threshold.

[0018] In some embodiments, the method may further include receiving a training set of the ML-based models containing no steganographic data, wherein each ML-based model of the training set is characterized by the set of parameters; performing the second vector embedding procedure on each ML-based model of the training set, based on the set of parameters thereof, thereby obtaining a vector representation of each ML-based model of the training set; and, based on the vector representations of the ML-based models of the training set, training the autoencoder ML-based model to reconstruct a vector representation of a target ML-based model containing no steganographic data.

[0019] In some embodiments, the method may further include determining, for at least one ML-based model of the training set, an architecture of the respective ML-based model; calculating a plurality of permutations of the respective ML-based model, based on the determined architecture; and augmenting the training set with the calculated plurality of permutations.

[0020] In some embodiments, the method may further include receiving at least one test ML-based model in an original version, containing no steganographic data; wherein the at least one test ML-based model is characterized by the set of the parameters; inserting thesteganographic data into the at least one test ML-based model, thereby obtaining an altered version of the at least one test ML-based model. The method may further include, for both the original version and the altered version, the following steps: (i) performing the second vector embedding procedure on the at least one test ML-based model in a respective version, based on the set of the parameters of the at least one test ML-based model, thereby obtaining an initial vector representation of the at least one test ML-based model in a respective version; (ii) inferring the autoencoder ML-based model on the initial vector representation of the at least one test ML-based model in the respective version, thereby obtaining a reconstructed vector representation of the test ML-based model in the respective version; and (iii) calculating a reconstruction error value of the respective version, based on the initial and reconstructed vector representations of the at least one test ML-based model in the respective version. The method may further include setting the predefined threshold, based on the reconstruction error values of the original and altered versions of the at least one test ML-based model.

[0021] In some embodiments, the initial ML-based model may be characterized by a set of parameters; and applying the steganalysis procedure may comprise: performing a second vector embedding procedure on the initial ML-based model, based on the set of the parameters thereof, thereby obtaining a vector representation of the initial ML-based model; inferring, on the vector representation of the initial ML-based model, a respectively pretrained classifying ML-based model, to calculate a probability of a pertinence of the initial ML-based model to at least one class that indicates steganographic data presence; and determining the probability of the steganographic data presence based on the probability of pertinence of the initial ML-based model to said at least one class.

[0022] In some embodiments, the method may further include receiving a training set of the ML-based models in original versions containing no steganographic data and in altered versions containing steganographic data, wherein each ML-based model of the training set is characterized by the set of parameters and is respectively labeled by pertinence to at least one class that indicates steganographic data presence. The method may further include performing the second vector embedding procedure on each ML-based model of the training set, based on the set of parameters thereof, thereby obtaining a vector representation of each ML-based model of the training set; and based on the vector representations of the ML-based models of the training set, training the classifying ML-based model to classify a target ML-based model by pertinence to said at least one class.

[0023] In some embodiments, applying the at least one alteration to the initial ML-based model may include performing quantization of the initial ML-based model.

[0024] In some embodiments, the initial ML-based model may be characterized by at least one parameter; and performing quantization of the initial ML-based model may include defining a rounding multiple, based on the determined probability; and rounding a value of the at least one parameter of the initial ML-based model to the defined rounding multiple.

[0025] In some embodiments, performing quantization of the initial ML-based model may include defining a number of LSBs for omission, based on the determined probability; and omitting the defined number of Least Significant Bits (LSBs) of the at least one parameter of the initial ML-based model.

[0026] In some embodiments, the initial ML-based model may be characterized by at least one parameter; and applying the at least one alteration to the initial ML-based model may include adding random noise data to Least Significant Bits (LSBs) of the at least one parameter of the initial ML-based model.

[0027] In some embodiments, applying the at least one alteration to the initial ML-based model may further include defining an intensity of random noise data, based on the determined probability.

[0028] In some embodiments, the initial ML-based model may be received in a first serialization format; and applying the at least one alteration to the initial ML-based model may include reserializing the initial ML-based model to be represented in a second serialization format.

[0029] In some embodiments, the initial ML-based model may be an artificial neural network model. In some embodiments, the set of parameters may include weight and bias coefficients.

[0030] In some embodiments, the second vector embedding procedure may include: inferring a respective ML-based model on an input data sample, to obtain a calculated output value; calculating a loss function, based on the calculated output value and a predefined desired output label; calculating a gradient of the loss function with respect to weight coefficients of the respective ML-based model; and obtaining a respective vectorrepresentation of the respective ML-based model, based on said weight coefficients and the calculated gradient.

[0031] In some embodiments, the input data sample is an in-distribution data sample with respect to the respective ML-based model.

[0032] In some embodiments, the input data sample is an out-of-distribution data sample with respect to the respective ML-based model.

[0033] In some embodiments, the at least one processor may be further configured to apply the steganalysis procedure by: generating an input image representation of the initial ML- based model, based on the set of parameters thereof; inferring, on the input image representation, a respectively pretrained Siamese-Neural-Network (SNN)-based model, to calculate a distance metric value, representing a degree of pertinence of the input image representation to at least one class that indicates steganographic data presence in ML-based models; and determining the probability of the steganographic data presence based on the calculated distance metric value.

[0034] In some embodiments, the at least one processor may be further configured to generate the input image representation by: for one or more of said weight coefficients, extracting, from a value thereof represented in a binary format, a sequence of m zz-bit blocks; and forming the input image representation from m image representation parts, wherein, for 1 < z < m, z-th of the m image representation parts comprises a plurality of pixels, each having a color coded based on z-th zz-bit block in the sequence of the zz-bit blocks of a respective weight coefficient of said weight coefficients.

[0035] In some embodiments, the at least one processor may be further configured to store values of said weight coefficients in a floating-point-number representation comprising a mantissa portion and an exponent portion; and said sequence of m zz-bit blocks may represent, at least in part, the mantissa portion of the respective weight coefficient.

[0036] In some embodiments, the at least one processor may be further configured to apply the steganalysis procedure by: performing a second vector embedding procedure on the initial ML-based model, based on the set of parameters thereof, to obtain an initial vector representation of the initial ML-based model; inferring, on the initial vector representation, an autoencoder ML-based model, respectively pretrained to reconstruct vector representations of ML-based models containing no steganographic data, thereby obtaining a reconstructed vector representation of the initial ML-based model; and calculating areconstruction error value, based on the initial and reconstructed vector representations of the initial ML-based model. The at least one processor may be further configured to determine the probability of the steganographic data presence, based on the reconstruction error value.

[0037] In some embodiments, the at least one processor may be further configured to classify the initial ML-based model as containing the steganographic data, provided that the determined probability of the steganographic data presence surpasses a predefined threshold.

[0038] In some embodiments, the at least one processor may be further configured to: receive a training set of the ML-based models containing no steganographic data, wherein each ML-based model of the training set is characterized by the set of parameters; perform the second vector embedding procedure on each ML-based model of the training set, based on the set of parameters thereof, thereby obtaining a vector representation of each ML-based model of the training set; based on the vector representations of the ML-based models of the training set, train the autoencoder ML-based model to reconstruct a vector representation of a target ML-based model containing no steganographic data.

[0039] In some embodiments, the at least one processor may be further configured to: for at least one ML-based model of the training set, determine an architecture of the respective ML-based model; calculate a plurality of permutations of the respective ML-based model, based on the determined architecture; and augment the training set with the calculated plurality of permutations.

[0040] In some embodiments, the at least one processor may be further configured to: receive at least one test ML-based model in an original version, containing no steganographic data; wherein the at least one test ML-based model may be characterized by the set of the parameters; insert the steganographic data into the at least one test ML-based model, thereby obtaining an altered version of the at least one test ML-based model; for both the original version and the altered version, (i) perform the second vector embedding procedure on the at least one test ML-based model in a respective version, based on the set of the parameters of the at least one test ML-based model, thereby obtaining an initial vector representation of the at least one test ML-based model in a respective version; (ii) infer the autoencoder ML-based model on the initial vector representation of the at least one test ML- based model in the respective version, thereby obtaining a reconstructed vector representation of the test ML-based model in the respective version; and (iii) calculate areconstruction error value of the respective version, based on the initial and reconstructed vector representations of the at least one test ML-based model in the respective version; and set the predefined threshold, based on the reconstruction error values of the original and altered versions of the at least one test ML-based model.

[0041] In some embodiments, the at least one processor may be configured to apply the steganalysis procedure by: performing a second vector embedding procedure on the initial ML-based model, based on the set of the parameters thereof, thereby obtaining a vector representation of the initial ML-based model; inferring, on the vector representation of the initial ML-based model, a respectively pretrained classifying ML-based model, to calculate a probability of a pertinence of the initial ML-based model to at least one class that indicates steganographic data presence; and determining the probability of the steganographic data presence based on the probability of pertinence of the initial ML-based model to said at least one class.

[0042] In some embodiments, the at least one processor may be further configured to: receive a training set of the ML-based models in original versions containing no steganographic data and in altered versions containing steganographic data, wherein each ML-based model of the training set is characterized by the set of parameters and is respectively labeled by pertinence to at least one class that indicates steganographic data presence; perform the second vector embedding procedure on each ML-based model of the training set, based on the set of parameters thereof, thereby obtaining a vector representation of each ML-based model of the training set; and based on the vector representations of the ML-based models of the training set, train the classifying ML-based model to classify a target ML-based model by pertinence to said at least one class.

[0043] In some embodiments, the at least one processor may be configured to apply the at least one alteration to the initial ML-based model by performing quantization of the initial ML-based model.

[0044] In some embodiments, the at least one processor may be configured to perform quantization of the initial ML-based model by: defining a rounding multiple, based on the determined probability; and rounding a value of the at least one parameter of the initial ML- based model to the defined rounding multiple.

[0045] In some embodiments, the at least one processor may be configured to perform quantization of the initial ML-based model by defining a number of LSBs for omission,based on the determined probability; and omitting the defined number of Least Significant Bits (LSBs) of the at least one parameter of the initial ML-based model.

[0046] In some embodiments, the at least one processor may be configured to apply the at least one alteration to the initial ML-based model by adding random noise data to Least Significant Bits (LSBs) of the at least one parameter of the initial ML-based model.

[0047] In some embodiments, the at least one processor may be configured to apply the at least one alteration to the initial ML-based model further by defining an intensity of random noise data, based on the determined probability.

[0048] In some embodiments, the initial ML-based model may be received in a first serialization format; and the at least one processor may be configured to apply the at least one alteration to the initial ML-based model by reserializing the initial ML-based model to be represented in a second serialization format.

[0049] In some embodiments, the initial ML-based model may be an artificial neural network model, and the set of parameters includes weight and bias coefficients.

[0050] In some embodiments, the input data sample may be an in-distribution data sample with respect to the respective ML-based model. In some embodiments, the input data sample is an out-of-distribution data sample with respect to the respective ML-based model.BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The subject matter regarded as the invention is particularly pointed out and distinctly claimed in the concluding portion of the specification. The invention, however, both as to organization and method of operation, together with objects, features, and advantages thereof, may best be understood by reference to the following detailed description when read with the accompanying drawings in which:

[0052] Fig. 1 is a block diagram, depicting a computing device which may be included in a system for preventing steganographic attacks, according to some embodiments;

[0053] Fig. 2 is a block diagram, depicting a system for preventing steganographic attacks, according to some embodiments;

[0054] Fig. 3A is a block diagram, depicting a steganalysis module of the system for preventing steganographic attacks, according to some embodiments;

[0055] Fig. 3B is a block diagram, depicting a steganalysis module of the system for preventing steganographic attacks, according to some alternative embodiments;

[0056] Fig. 3C is a block diagram, depicting a steganalysis module of the system for preventing steganographic attacks, according to some alternative embodiments;

[0057] Fig. 3D is a block diagram, depicting aspects of SNN-based model application, according to some alternative embodiments;

[0058] Fig. 3E is an illustration of a technique for creating image representations from ML- based models, according to some alternative embodiments;

[0059] Fig. 4A is a block diagram, depicting a configuration module of the system for preventing steganographic attacks, configured for training an autoencoder ML-based model, according to some embodiments;

[0060] Fig. 4B is a block diagram, depicting a configuration module of the system for preventing steganographic attacks, configured for training a classifying ML-based model, according to some embodiments; and

[0061] Fig. 5A is a graph, depicting results of the experiment 1, according to some embodiments;

[0062] Fig. 5B is a first part of the set of graphs, depicting results of the experiment 2, according to some embodiments;

[0063] Fig. 5C is a second part of the set of graphs, depicting results of the experiment 2, according to some embodiments;

[0064] Fig. 6 is a flow diagram, depicting a method of preventing steganographic attacks, according to some embodiments.

[0065] It will be appreciated that for simplicity and clarity of illustration, elements shown in the figures have not necessarily been drawn to scale. For example, the dimensions of some of the elements may be exaggerated relative to other elements for clarity. Further, where considered appropriate, reference numerals may be repeated among the figures to indicate corresponding or analogous elements.DETAILED DESCRIPTION OF THE PRESENT INVENTION

[0066] One skilled in the art will realize the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The foregoing embodiments are therefore to be considered in all respects illustrative rather than limiting of the invention described herein. Scope of the invention is thus indicated by the appended claims, rather than by the foregoing description, and all changes that come within themeaning and range of equivalency of the claims are therefore intended to be embraced therein.

[0067] In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the invention. However, it will be understood by those skilled in the art that the present invention may be practiced without these specific details. In other instances, well-known methods, procedures, and components have not been described in detail so as not to obscure the present invention. Some features or elements described with respect to one embodiment may be combined with features or elements described with respect to other embodiments. For the sake of clarity, discussion of same or similar features or elements may not be repeated.

[0068] Although embodiments of the invention are not limited in this regard, discussions utilizing terms such as, for example, “processing,” “computing,” “calculating,” “determining,” “establishing”, “analyzing”, “checking”, “choosing”, “selecting”, “omitting”, “training” or the like, may refer to operation(s) and / or process(es) of a computer, a computing platform, a computing system, or other electronic computing device, that manipulates and / or transforms data represented as physical (e.g., electronic) quantities within the computer’s registers and / or memories into other data similarly represented as physical quantities within the computer’s registers and / or memories or other information non-transitory storage medium that may store instructions to perform operations and / or processes.

[0069] Although embodiments of the invention are not limited in this regard, the terms “plurality” and “a plurality” as used herein may include, for example, “multiple” or “two or more”. The terms “plurality” or “a plurality” may be used throughout the specification to describe two or more components, devices, elements, units, parameters, or the like. The term “set” when used herein may include one or more items.

[0070] Unless explicitly stated, the method embodiments described herein are not constrained to a particular order or sequence. Additionally, some of the described method embodiments or elements thereof can occur or be performed simultaneously, at the same point in time, concurrently, or iteratively and repeatedly.

[0071] In embodiments of the present invention, some steps of the claimed method may be performed using machine-learning (ML)-based models. ML-based models may be configured or “trained” for a specific task, e.g., classification or regression.

[0072] In some embodiments, ML-based models may be artificial neural networks (ANN).

[0073] A neural network (NN) or an artificial neural network (ANN), e.g., a neural network implementing a machine learning (ML) or artificial intelligence (Al) function, may refer to an information processing paradigm that may include nodes, referred to as neurons, organized into layers, with links between the neurons. The links may transfer signals between neurons and may be associated with weights. A NN may be configured or trained for a specific task, e.g., pattern recognition or classification. Training a NN for the specific task may involve adjusting these weights based on examples. Each neuron of an intermediate or last layer may receive an input signal, e.g., a weighted sum of output signals from other neurons, and may process the input signal using a linear or nonlinear function (e.g., an activation function). The results of the input and intermediate layers may be transferred to other neurons and the results of the output layer may be provided as the output of the NN. Typically, the neurons and links within a NN are represented by mathematical constructs, such as activation functions and matrices of data elements and weights. A processor, e.g., CPUs or graphics processing units (GPUs), or a dedicated hardware device may perform the relevant calculations.

[0074] It should be obvious for the one ordinarily skilled in the art that various ML-based models can be implemented without departing from the essence of the present invention. It should also be understood, that in some embodiments ML-based model may be a single ML- based model or a set (ensemble) of ML-based models realizing as a whole the same function as a single one. Hence, in view of the scope of the present invention, the abovementioned variants should be considered equivalent.

[0075] As known, the practice of detecting steganographically concealed data is called “steganalysis”. There are various tools that can detect the presence of hidden data known in the art. However, applying steganalysis is a challenge - not least because of not knowing where and what exactly to search for (e.g., the steganographic data may be encrypted, making it virtually impossible to detect any content that seems meaningful). The process of steganalysis gets even more difficult in cases where the carrier represents not an original data object, but a modified form of it (e.g., compressed with lossy compression algorithms).

[0076] However, since the purpose of using steganalysis for malware detection does not require, but rather prevents, reconstruction of the concealed data, the use of steganalysis as it is suggested by the present invention, may provide an effective cyber security tool.

[0077] Hence, it is suggested to apply a steganalysis procedure to an ML-based model only in order to determine the probability of steganographic data presence in it. Next, it is suggested to apply at least one alteration to the ML-based model, in order to disarm steganographically inserted malicious content.

[0078] However, it shall be understood that any alterations applied to the pretrained ML- based model will inevitably affect its performance. Therefore, the critical aspect of the proposed approach lies in the case-by-case determination of an alteration extent required to: (a) assure that the presumably malicious content is corrupted and thus disarmed; and (b) make the ML-based model’s performance affected as minimal as possible.

[0079] Therefore, it is suggested to determine the required amount of alterations to the ML- based model according to the determined probability of steganographic data presence in it.

[0080] Reference is now made to Fig. 1, which is a block diagram depicting a computing device, which may be included within an embodiment of the system for preventing steganographic attacks, according to some embodiments.

[0081] Computing device 1 may include a processor or controller 2 that may be, for example, a central processing unit (CPU) processor, a chip or any suitable computing or computational device, an operating system 3, a memory device 4, instruction code 5, a storage system 6, input devices 7 and output devices 8. Processor 2 (or one or more controllers or processors, possibly across multiple units or devices) may be configured to carry out methods described herein, and / or to execute or act as the various modules, units, etc. More than one computing device 1 may be included in, and one or more computing devices 1 may act as the components of, a system according to embodiments of the invention.

[0082] Operating system 3 may be or may include any code segment (e.g., one similar to instruction code 5 described herein) designed and / or configured to perform tasks involving coordination, scheduling, arbitration, supervising, controlling or otherwise managing operation of computing device 1, for example, scheduling execution of software programs or tasks or enabling software programs or other modules or units to communicate. Operating system 3 may be a commercial operating system. It will be noted that an operating system 3 may be an optional component, e.g., in some embodiments, a system may include a computing device that does not require or include an operating system 3.

[0083] Memory device 4 may be or may include, for example, a Random- Access Memory (RAM), a read only memory (ROM), a Dynamic RAM (DRAM), a Synchronous DRAM (SD-RAM), a double data rate (DDR) memory chip, a Flash memory, a volatile memory, a non-volatile memory, a cache memory, a buffer, a short-term memory unit, a long-term memory unit, or other suitable memory units or storage units. Memory device 4 may be or may include a plurality of possibly different memory units. Memory device 4 may be a computer or processor non-transitory readable medium, or a computer non-transitory storage medium, e.g., a RAM. In one embodiment, a non-transitory storage medium such as memory device 4, a hard disk drive, another storage device, etc. may store instructions or code which when executed by a processor may cause the processor to carry out methods as described herein.

[0084] Instruction code 5 may be any executable code, e.g., an application, a program, a process, task, or script. Instruction code 5 may be executed by processor or controller 2 possibly under control of operating system 3. For example, instruction code 5 may be a standalone application or an API module that may be configured to determine a probability of steganographic data presence in the initial ML-based model and to apply at least one alteration to the initial ML-based model, according to the determined probability, as further described herein. Although, for the sake of clarity, a single item of instruction code 5 is shown in Fig. 1, a system according to some embodiments of the invention may include a plurality of executable code segments or modules similar to instruction code 5 that may be loaded into memory device 4 and cause processor 2 to carry out methods described herein.

[0085] Storage system 6 may be or may include, for example, a flash memory as known in the art, a memory that is internal to, or embedded in, a micro controller or chip as known in the art, a hard disk drive, a CD-Recordable (CD-R) drive, a Blu-ray disk (BD), a universal serial bus (USB) device or other suitable removable and / or fixed storage unit. Various types of input and output data may be stored in storage system 6 and may be loaded from storage system 6 into memory device 4 where it may be processed by processor or controller 2. In some embodiments, some of the components shown in Fig. 1 may be omitted. For example, memory device 4 may be a non-volatile memory having the storage capacity of storage system 6. Accordingly, although shown as a separate component, storage system 6 may be embedded or included in memory device 4.

[0086] Input devices 7 may be or may include any suitable input devices, components, or systems, e.g., a detachable keyboard or keypad, a mouse and the like. Output devices 8 may include one or more (possibly detachable) displays or monitors, speakers and / or any other suitable output devices. Any applicable input / output (I / O) devices may be connected to Computing device 1 as shown by blocks 7 and 8. For example, a wired or wireless network interface card (NIC), a universal serial bus (USB) device or external hard drive may be included in input devices 7 and / or output devices 8. It will be recognized that any suitable number of input devices 7 and output device 8 may be operatively connected to Computing device 1 as shown by blocks 7 and 8.

[0087] A system according to some embodiments of the invention may include components such as, but not limited to, a plurality of central processing units (CPU) or any other suitable multi-purpose or specific processors or controllers (e.g., similar to element 2), a plurality of input units, a plurality of output units, a plurality of memory units, and a plurality of storage units.

[0088] Reference is now made to Fig. 2 depicting system 10 for preventing steganographic attacks, and Fig. 3A depicting steganalysis module 11 of system 10 for preventing steganographic attacks, according to some embodiments.

[0089] According to some embodiments of the invention, system 10 may be implemented as a software module, a hardware module, or any combination thereof. For example, system 10 may be or may include a computing device such as element 1 of Fig. 1. Furthermore, system 10 may be adapted to execute one or more modules of instruction code (e.g., element 5 of Fig. 1) to request, receive, analyze, calculate and produce various data.

[0090] As further described in detail herein, system 10 may be adapted to execute one or more modules of instruction code (e.g., element 5 of Fig. 1) in order to perform steps of the claimed method.

[0091] As shown in Figs. 2, 3A-3D, 4A, and 4B, arrows may represent flow of one or more data elements to and from system 10 and / or among modules or elements of system 10. Some arrows have been omitted in Figs. 2, 3A-3D, 4A, and 4B for the purpose of clarity.

[0092] In some embodiments, system 10 may include steganalysis module 11. Steganalysis module 11 may be configured to receive initial ML-based model 10A. Steganalysis module 11 may be further configured to apply a steganalysis procedure to initial ML-basedmodel 10A, to determine probability 11A of steganographic data presence in initial ML- based model 10A.

[0093] In some embodiments, steganalysis module 11 may include model architecture analysis module 110, configured to receive initial ML-based model 10A. Architecture analysis module 110 may be further configured to analyze initial ML-based model 10A and output set 110A of parameters of initial ML-based model 10A. E.g., set 110A of parameters may include type of architecture (e.g., deep-learning (DL) model, ANN). In case of model 10A being an ANN, set 110A may further include weight and bias coefficients, number of hidden layers, learning rate, activation function, number of epochs etc.

[0094] In some embodiments, steganalysis module 11 may further include vector embedding module 111. Vector embedding module 111 may be further configured to receive set 110A of parameters of initial ML-based model 10A. Vector embedding module 111 may be further configured to perform the second vector embedding procedure on initial ML-based model 10A, based on the set 110A of parameters thereof, thereby obtaining initial vector representation 111 A of initial ML-based model 10A.

[0095] In some embodiments, vector embedding module 111 may be further configured to perform embedding procedure on initial ML-based model 10A in the following way.

[0096] Vector embedding module 111 may be configured to infer ML-based model 10A on input data sample 111’, thereby obtaining a calculated output value.

[0097] In some embodiments, input data sample 111’ may be an in-distribution data sample with respect to ML-based model 10A, that is a data sample drawn from the same distribution of training data samples that were used for training ML-based model 10A.

[0098] For example, if ML-based model 10A is trained to recognize hand-written digits (in other words, trained for classifying received image of a hand-written digit as pertaining to one of predefined ten classes, each for each possible digit), the in-distribution data sample would be an image of any clearly hand-written digit. In other words, an in-distribution data sample is the one with respect to which respectively pretrained ML-based model 10A is able to provide a sufficiently correct output (with a comparatively low value of a loss function).

[0099] In some embodiments, additionally or alternatively, input data sample 111’ may be an out-of-distribution data sample with respect to ML-based model 10A, that is a data sample falling out of the distribution of training data samples that were used for training ML-based model 10A. Referring to the abovementioned hand-written digits recognition example, anout-of-distribution data sample would be, e.g., a plain black image or any other image completely irrelevant to hand-written digits. In other words, an out-of-distribution data sample is the one with respect to which respectively pretrained ML-based model 10A fails to provide a sufficiently correct output (thereby leading to a comparatively high value of a loss function).

[0100] Referring back to the embedding procedure, vector embedding module 111 may be further configured to calculate a loss function, based on the calculated output value and a predefined desired output label. E.g., with reference to the abovementioned hand-written digits recognition example, the desired output label for input data sample 111’ representing a hand-written image of a certain digit, may be the pertinence to the respective class representing that digit with a 100% probability and pertinence to the rest of the classes with 0% probability.

[0101] Vector embedding module 111 may be further configured to calculate a gradient of the loss function with respect to weight coefficients (or other parameters) of ML-based model 10A. In some embodiments, the calculation of the gradient may be performed in the same way as it is done within a common backpropagation ML algorithm. In some embodiments, said gradient may be calculated with respect to weight coefficients of any specific layer of ML-based model 10A, e.g., a penultimate layer of ML-based model 10A (as it is done on the first backpropagation step).

[0102] In some embodiments, vector embedding module 111 may be further configured to form initial vector representation 111A of initial ML-based model 10A, based on said weight coefficients of model 10A and said calculated gradient.

[0103] In some embodiments, steganalysis module 11 may further include autoencoder ML-based model 112. Autoencoder ML-based model 112 may be respectively pretrained to reconstruct vector representations of ML-based models containing no steganographic data. Aspects of training autoencoder ML-based model 112 are described in detail with reference to Fig. 4 A further below.

[0104] In some embodiments, steganalysis module 11 may be further configured to infer autoencoder ML-based model 112 on obtained initial vector representation 111A. Autoencoder ML-based model 112 may be configured to receive initial vector representation 111A and to perform reconstruction procedure (encoding and decoding of initial vectorrepresentation 111 A), thereby obtaining reconstructed vector representation 112A of initial ML-based model 10A.

[0105] It shall be understood that the present invention is not limited to any specific autoencoder ML-based model, therefore any autoencoder known in the art may be applied herein (e.g., Sparse Autoencoder (SAE), Contractive autoencoder (CAE), Variational autoencoder (VAE) etc.).

[0106] In some embodiments, steganalysis module 11 may further include reconstruction error calculation module 113. Reconstruction error calculation module 113 may be configured to receive initial vector representation 111A and reconstructed vector representation 112A. Reconstruction error calculation module 113 may be further configured to calculate reconstruction error value 113A, based on initial and reconstructed vector representations 111A and 112A of initial ML-based model 10A, wherein reconstruction error value 113A may represent degree of difference between representations 111A and 112A. In particular, reconstruction error calculation module 113 may be configured to compare initial and reconstructed vector representations 111A and 112A, and calculate reconstruction error value 113A, based on said comparison.

[0107] In some embodiments, steganalysis module 11 may further include steganography probability calculation module 114. Steganography probability calculation module 114 may be configured to receive reconstruction error value 113A. Steganography probability calculation module 114 may be further configured to determine probability 11 A of the steganographic data presence, based on reconstruction error value 113A.

[0108] In some embodiments, steganography probability calculation module 114 may be further configured to receive predefined threshold 13 A” of steganography probability. In some embodiments, steganography probability calculation module 114 may be further configured to provide binary classification 11 A’ by steganographic data presence (e.g., to assign class “not containing steganographic data” or “containing steganographic data” to initial ML-based model 10A). In some embodiments, steganography probability calculation module 114 may be further configured to classify initial ML-based model 10A as “containing steganographic data”, provided that determined probability 11A of the steganographic data presence surpasses predefined threshold 13 A”. Aspects of setting threshold 13 A” are discussed with reference to Fig. 4A further below.

[0109] Reference is now made to Fig. 3B depicting a steganalysis module of the system for preventing steganographic attacks, according to some alternative embodiments.

[0110] Similar elements of steganalysis module 11 of Fig. 3 A and 3B are given the same numerical references. Description of such similar elements is omitted unless it is necessary to introduce additional aspects.

[0111] In some embodiments, steganalysis module 11 may include respectively pretrained classifying ML-based model 112’. Classifying ML-based model 112’ may be pretrained to perform classification of ML-based models (e.g., of the same kind as ML-based model 10A) by pertinence to classes that indicate steganographic data presence or absence (e.g., binary classification by pertinence to classes “containing steganographic data” and “not containing steganographic data”). Classifying ML-based model 112’ may be further configured to calculate probability of pertinence of ML-based models to classes that indicate steganographic data presence or absence.

[0112] In some embodiments, steganalysis module 11 may be further configured to infer, on vector representation 111 A of initial ML-based model 10A, classifying ML-based model 112’, to calculate probability 112A’ of pertinence of initial ML-based model 10A to at least one class that indicates steganographic data presence or absence.

[0113] In some embodiments, steganography probability calculation module 114 may be further configured to receive calculated probability 112A’. Steganography probability calculation module 114 may be further configured to determine probability 11A of steganographic data presence as the probability 112 A’ of pertinence of initial ML-based model 10A to said at least one class. In some alternative embodiments, steganography probability calculation module 114 may be further configured to determine probability 11 A of steganographic data presence based on probability 112A’ and reconstruction error value 113A in combination, e.g., by assigning specific weights to (i) a difference between reconstruction error value 113 A and threshold 13 A” and (ii) probability 112A’.

[0114] It shall be understood that the present invention is not limited to any specific embodiment in regard of the way reconstruction error value 113 A and probability 112A’ are used for calculation of probability 11A of steganographic data presence and any specific way may be covered by the scope of the present invention. Aspects of training classifying ML-based model 112’ are discussed with reference to Fig. 4B further below.

[0115] Reference is now made to Fig. 3C, depicting steganalysis module 11 of system 10 for preventing steganographic attacks, according to some alternative embodiments of the present invention.

[0116] As known in the art, one major drawback in traditional ML and, in particular, in deep learning (DL) learning algorithms is that they normally require large amounts of training data to avoid overfitting. This can be problematic for real-life scenarios, such as detection of steganography attacks inside ML-based models since they vary in size, architecture, task, and many more factors. The major obstacle that may be encountered is data scarcity. It may be required to have a large dataset of “attacked” models to research ML-based model steganography, but no such public source exists.

[0117] One way to tackle this problem is to build upon the methodology and framework for simulating attacks and creating respective datasets. Additional or alternative way may be to focus on DL techniques that are specialized for use in data-scarce scenarios.

[0118] One-shot Learning (OSL) and Few-Shot Learning (FSL) are techniques developed to use DL in areas with significantly less training data than traditional DL models require. The core concept is that a model is trained only using one or a few samples per label. OSL and FSL are commonly utilized for computer vision (CV) tasks. There are different approaches to tackling OSL and FSL - augmenting training data to get more samples, fine- tuning pre-trained models, training embedding models to project embedding samples to a smaller embedding space etc.

[0119] One of the known FSL approaches is called metric-learning. In metric learning, samples are clustered based on their distance from other samples. In a classification context, a sample is labeled based on proximity to other labeled samples according to a certain distance function (like Manhattan distance (Zi norm) or Euclidean distance (L norm)). The k-nearest neighbors (KNN) algorithm is a widely known example of such a classification approach. Metric learning is often paired with an embedding mechanism that embeds samples to a lower dimension (for example, by using a convolutional neural network (CNN)). This approach is called embedding learning.

[0120] In the embedding learning, the goal of training is to create such a feature map that minimizes the distance between similar samples and maximizes the distance between dissimilar samples (in classification, same-label samples are "similar" and vice versa for samples with different labels).

[0121] As known in the art, FSL techniques have been found to have extensive applications in the field of computer vision. Convolutional Neural Networks (CNN) are one of the most popular neural network types used in this domain, and a significant amount of research on FSL involves embedding learning using CNN networks as embedding functions with image data. It is also known in the art to transform data into image representations in order to apply OSL and FSL techniques to them.

[0122] Therefore, to address the issue with training data scarcity for the purpose of detecting steganographically embedded data in ML-based models, it is suggested herein, in some embodiments of the present invention, to create image representations of ML-based models in order to apply rich and deeply developed image FSL techniques to this field. As further described in greater detail, this approach underwent testing by the inventors and yielded highly reliable results, thereby demonstrating its significant contribution to the improvement of the relevant technological field.

[0123] As shown in Fig. 3C, in some embodiments, steganalysis module 11 may include model-to-image converting module 115. In some embodiments, model-to-image converting module 115 may be configured to receive initial ML-based model 10A (e.g., receive set 110A of parameters of model 10A), and generate input image representation 115A of initial ML-based model 10A, based on set 110A of parameters thereof.

[0124] As described above, in case of ML-based models, malware insertion is usually done by replacing model weights bits (LSBs) with malware bits using steganography embedding (inserting) methods. More specifically, in some embodiments, weight coefficients are stored in a floating-point-number representation that includes a mantissa portion of bits and an exponent portion of bits. The alteration of mantissa portion, especially low-order bits thereof, provides less effect on the weight coefficient value than alteration of the exponent portion. Accordingly, mantissa portion bits may be considered LSBs of the weight coefficient representation.

[0125] Obviously, such a distribution of steganographic data over the data of the carrier (the data of the ML-based model) makes it hardly identifiable, hindering malware detection. To address this issue, it is suggested herein to convert target ML-based model into an image representation in such a manner that concentrates potentially harmful blocks of ML-based model data (e.g., mantissa portion bits) in a single place, represented as a single region of the generated image representation.

[0126] Referring now additionally to Fig. 3E, the suggested approach of model-to-image conversion is described in greater detail. In the described embodiments, analyzed ML-based model (e.g., model 10A) may be an artificial neural network model, and the set of parameters may include weight coefficients. In some embodiments, model-to-image converting module 115 may be configured to generate image representation 115 A as follows.

[0127] First, module 115 may be configured to extract, for one or more of said weight coefficients (denoted W, including wi-W6 , from a value thereof represented in a binary format (denoted BINW), a sequence of m zz-bit blocks (denoted GF.l, blocks BINW1-BINW4 for each weight coefficient respectively).

[0128] In the present case, weight coefficients may be stored in a floating-point-number representation, in particular, in float32 format, that comprises 32 bits of data, segmented into 1 / 8 / 23 -bit portions for the sign / exponent / mantissa portions respectively. Accordingly, in the suggested non-exclusive example, m may be 4 and n may be 8, thereby covering a sequence of 4 8-bit blocks of float 32 format. It shall be appreciated herein that other values may be selected for m and n without going beyond the scope of the present invention.

[0129] Furthermore, in some particular embodiments of the present invention, said sequence of m n - bi t blocks may not cover the entire set of bits of weight value represented in a binary format. E.g., in some embodiments, to concentrate more on the potentially harmful portion of data (e.g., mantissa portion), said sequence of m zz-bit blocks may not represent, or represent only partially the exponent portion of the respective weight coefficient, and may represent, at least in part, the mantissa portion of the respective weight coefficient. Thereby, further reliability of steganographically-embedded data detection may be increased, thus further contributing to the improvement of the relevant technological field.

[0130] Model-to-image converting module 115 may be further configured to form m image representation parts (shown in GF 3.2). Each of m image representation parts may include (or may be formed of) a plurality of pixels, wherein each pixel has a color coded based on z-th zz-bit block (for each z from 1 to m) in the sequence of the zz-bit blocks of a respective weight coefficient of said weight coefficients. E.g., BINW1 block of weight coefficient wi may be converted to uint8 format (which has values from 0 to 255) and be used as a color coding for the first (e.g., starting from upper left comer) pixel of the first image representation part. BINW1 block of weight coefficient W2 may be used as a color coding for the second pixel of the first image representation part, and so on. Thus, thecompleted first image representation part may represent BINW1 blocks of all weights of the model. Then, BINW2 block of weight coefficient wi may be converted to uint8 format and be used as a color coding for the first (e.g., starting from upper left comer) pixel of the second image representation part, and so on. For color coding, 8-bit grayscale representation may be used, that is, said value in uint8 format may represent 256 different intensities (i.e., shades of gray) of the pixel color.

[0131] Model-to-image converting module 115 may be further configured to form input image representation 115A from m generated image representation parts, e.g., by stacking image representation parts together (as shown in block denoted GF.4).

[0132] Since convolutional neural networks (CNN) are commonly configured to operate on fixed-size images, in some embodiments, it is suggested to add zero padding, if necessary, in order to complete each image representation part and to form a square-shaped image of a predefined dimension.

[0133] E.g., as shown in the block denoted GF.2, the number of weight coefficients may k = 6. Then, the nearest square of k (from above) may be calculated as k = 3, meaning that each image representation part should be calculated as a 3x3 image (3x3 matrix having 6 matrix element values of pixel color coding that is calculated based on weight coefficients wi-W6 respectively, and 3 matrix element values having 0 value (added to form a 3x3 square shape)). Accordingly, in such example, input image representation 115A may have a 6x6 square shape, as shown in Fig. 3E. It should be appreciated that the described example is provided for the matter of clarity only, and, in practice, ML-based model 10A may have significantly higher number of weight coefficients, and the obtained input image representation 115A may have significantly larger (have significantly higher dimensions), as well as may have a non-square shape.

[0134] As further shown in Fig. 3C, in some embodiments, steganalysis module 11 may further include respectively pretrained Siamese-Neural-Network (SNN)-based model 116. In some embodiments, steganalysis module 11 may be further configured to infer, on input image representation 115A, respectively pretrained Siamese-Neural-Network (SNN)-based model 116, to calculate distance metric value 116A, representing a degree of pertinence of the input image representation to at least one class that indicates steganographic data presence in ML-based models.

[0135] Referring now to Fig. 3D, aspects of SNN-based model (e.g., model 116) application are further discussed in greater detail.

[0136] A Siamese Neural Network (sometimes called a “twin neural network”) is a known-in-the-art ML-based model architecture that has demonstrated highly reliable operation when trained using OSL- or FSL-techniques. In general, SNN (e.g., SNN-based model 116) may be an artificial neural network (of a Convolution Neural Network (CNN) type) that uses the same weights while working in tandem on two different input vectors (e.g., such as input image representation 115A) to compute comparable output vectors. Often one of the output vectors may be precomputed, thus forming a baseline against which the other output vector is compared.

[0137] In some embodiments, SNN-based model 116 may include pretrained CNN(s) 117, configured to receive an image representation (such as input image representation 115A) and perform a first vector embedding procedure on the received image representation to calculate a respective feature vector representation in the predefined feature space (the feature space is determined during training, which is described further below).

[0138] It should be understood that terms “first” and “second” vector embedding procedures are used herein in order to differentiate between two, and do not limit the present invention to any particular order of occurrence. E.g., first vector embedding procedure refers to the vector embedding of an image representation (such as image representation 115A) into feature vector representation (such as input feature vector representation 117A) (in a feature vector space specific for the respective embodiment), and second vector embedding procedure refers to the vector embedding of set 110A of parameters into vector representation 111A (in a feature vector space specific for the respective embodiment).

[0139] In some embodiments, pretrained CNN(s) 117 may be configured to receive input image representation 115A. CNN(s) 117 may be further configured to receive (i) prestored image representations 115 A’ of ML-based models containing steganographic data and (ii) image representations 115 A” of ML-based models not containing steganographic data. CNN(s) 117 may be further configured to perform the first vector embedding procedure on each of (i) input image representation 115A; (ii) prestored image representations 115A’; and (iii) prestored image representations 115A”, to calculate input feature vector representation 117A; steganographically-affected feature vector representations 117A’; and steganographically-nonaffected feature vector representations 117A”, in the predefinedfeature space. In some embodiments, feature vector representations 117 A’ and 117A” may be pre-computed for further usage, to avoid redundant computations.

[0140] It shall be understood that, in terms of classification task, prestored image representations 115 A’ may represent a “first” class - a class that indicates steganographic data presence in ML-based models, and prestored image representations 115 A” may represent a “second” class - a class that indicates steganographic data absence in ML-based models.

[0141] In some embodiments, SNN-based model 116 may be further configured to calculate (i) an average of steganographically-nonaffected feature vector representations; and (ii) an average of steganographically-nonaffected feature vector representations, e.g., as centroid vector representations 118A’ and 118A” respectively.

[0142] In some embodiments, SNN-based model 116 may be further configured to calculate distance metric value 116A representing: (i) distance 116A’ being a distance, in the feature space, between input feature vector representation 117A and centroid vector representation of the “first” class (e.g., centroid vector representation 118A’); and (ii) distance 116A” being a distance, in the feature space, between input feature vector representation 117A and centroid vector representation of the “second” class (e.g., centroid vector representation 118A”).

[0143] As an alternative embodiment to applying centroid vector evaluation, in some embodiments, k-nearest-neighbor algorithm may be applied, e.g., SNN-based model 116 may be configured to (i) determine distance 116A’ as a distance between input feature vector representation 117A and the nearest, in the respective feature vector space, k steganographically-affected feature vector representations 117 A’ and (ii) determine distance 116A” as a distance between input feature vector representation 117A and the nearest, in the respective feature vector space, k steganographically-nonaffected feature vector representations 117A’ ’ .

[0144] In some embodiments, SNN-based model 116 may be configured to calculate distance metric value 116A (e.g., distances 116A’ and 116A”) as a Manhattan distance (Zi norm) or Euclidean distance (I2 norm) or using other known-in-the-art methods.

[0145] In some embodiments, steganography probability calculation module 114 may be configured to receive distance metric value 116A. Steganography probability calculationmodule 114 may be further configured to determine probability 11A of the steganographic data presence, based on distance metric value 116A.

[0146] In some embodiments, steganography probability calculation module 114 may be further configured to receive predefined threshold 13 A” of steganography probability. In some embodiments, steganography probability calculation module 114 may be further configured to compare distance metric value 116A (e.g., distances 116A’ and 116A”) with threshold 13 A” to provide binary classification 11A’ by steganographic data presence (e.g., to assign class “not containing steganographic data” or “containing steganographic data” to initial ML-based model 10A) and to calculate steganographic data presence probability 11 A. In some embodiments, steganography probability calculation module 114 may be further configured to classify initial ML-based model 10A as “containing steganographic data”, provided that determined probability 11A of the steganographic data presence surpasses predefined threshold 13 A” .

[0147] It shall be appreciated that, in some embodiments, the usage of steganography probability calculation module 114 may be omitted. In such embodiments, distance metric value 116A (e.g., distances 116A’ and 116A”) may be used to classify initial ML-based model 10A as “containing steganographic data” or “not containing steganographic data”. E.g., by comparing distances 116A’ and 116A”, it may be determined to which class model 10A more likely pertains. The value of a respective distance 116A’ or 116A”, or, e.g., a difference between the two distances, may be further used as a measure to determine the extent of the required alterations to be applied to ML-based model 10A in order to “disarm” it (e.g., to neutralize the embedded data). In other words, in some embodiments, distance metric value 116A may act as steganographic data presence probability 11 A, therefore, in such a context, these two terms shall be considered equivalent.

[0148] In some embodiments, SNN-based model 116 may be pretrained using triplet loss, contrastive loss, or other suitable methods known in the art. E.g., for using the triplet loss method with h distance for the training strategy, the training data may be divided to construct all possible (anchor, positive, negative) triplets, e.g., based on the pre-assigned labels (i.e. (“benign”, “benign”, “malicious”) and (“malicious”, “malicious”, “benign”)). The CNN feature extractor (e.g., CNN(s) 117) may be trained using Adam optimization algorithm for an extremely small number of epochs (e.g., 1-5) to avoid over-fitting as much as possible. The learning goal may be to determine such a feature space (and, accordingly,to develop such a vector embedding procedure) that provides for a minimum distance metric value for similar objects and maximum distance metric value for distinct ones.

[0149] Reference is now made back to Fig. 2. In some embodiments, system 10 may further include disarming module 12. Disarming module 12 may be configured to receive initial ML-based model 10A, binary classification 11 A’ by steganographic data presence, and steganographic data presence probability 11 A. Disarming module 120 may be further configured to apply alterations to initial ML-based model 10A, according to determined probability 11 A, thereby obtaining disarmed ML-based model 10A’.

[0150] In some embodiments, disarming module 12 may include disarming policy selection module 120. Disarming policy selection module 120 may be configured to receive classification 11 A’ and determined probability 11 A, and select disarming policy, which may be considered the most effective in each specific case.

[0151] E.g., if classification 11 A’ represents assigned class “not containing steganographic data”, disarming policy selection module 120 may be configured to select the policy of not performing any disarming actions on ML-based model 10A and either output the same model (initial ML-based model 10A) or provide corresponding indication that initial ML-based model 10A is safe. In some alternative embodiments, in case model 10A is classified as “not containing steganographic data”, disarming policy selection module 120 may be configured to select the policy of performing some insignificant alterations to ML-based model 10A, in order to prevent any problems caused by the false negative classification 11A’.

[0152] In some embodiments, if classification 11 A’ represents assigned class “containing steganographic data”, disarming policy selection module 120 may be further configured to transfer initial ML-based model 10A to at least one of the following modules: quantization module 121, random noise data generating module 122, and serialization module 123.

[0153] In some embodiments, quantization module 121 may be configured to apply alterations to initial ML-based model 10A, in particular, by performing quantization of initial ML-based model 10A. E.g., in some embodiments, quantization module 121 may be further configured to (i) define rounding multiple 121 A, based on determined probability 11 A; and (ii) round a value of the at least one parameter (e.g., for instance, weight and / or bias coefficient data elements, taken from set 110A) of initial ML-based model 10A to definedrounding multiple 121A. Additionally or alternatively, in some embodiments, quantization module 121 may be further configured to (i) define number 121B of LSBs for omission, based on determined probability 11A; and omit defined number 121B of Least Significant Bits (LSBs) of the at least one parameter (e.g., for instance, weight and / or bias coefficient data elements, taken from set 110A) of initial ML-based model 10A.

[0154] In some embodiments, random noise data generating module 122 may be configured to apply alterations to initial ML-based model 10A, in particular, by adding random noise data to the parameters (e.g., weight and / or bias data elements) of initial ML- based model 10A, e.g., to LSBs of the parameters. In some embodiments, random noise data generating module 122 may be further configured to define an intensity of random noise data, based on determined probability 11 A.

[0155] In some embodiments, initial ML-based model 10A may be received and represented in a first serialization format. In some embodiments, serialization module 123 may be configured to apply alterations to initial ML-based model 10A, in particular, by reserializing initial ML-based model 10A to be represented in a second serialization format.

[0156] Among other things, such reserialization of ML-based model 10A may effectively change different textual metadata, e.g., layer names, thereby removing or disarming hidden malicious code.

[0157] In some embodiments, disarming policy selection module 120 may be configured to select alterations to be applied to ML-based model 10A preventively, e.g., without taking into account the results of the steganalysis procedure performed by to steganalysis module 11. For example, such an approach may be applied for disarming ML-based models of a specific architecture, which was not used for training autoencoder ML-based model 112 and / or classifying ML-based model 112’. Additionally, such an approach may be applied in cases when it is required to provide maximum confidence that the ML-based model 10A is disarmed, even by neglecting the consequences of reduced model performance quality.

[0158] Additionally or alternatively, in some embodiments, disarming policy selection module 120 be configured to apply an approach, wherein some alterations (including quantization, adding noise or reserializing) may be performed without taking into account the results of steganalysis procedure, while some other alterations may be applied based on classification 11 A’ and probability 11 A, as it is described above.

[0159] Furthermore, in some embodiments, serialization module 123 may be configured to preventively omit portions of ML-based model 10A data, according to known vulnerable portions of specific serialization format, in which ML-based model 10A is represented, alternatively or additionally to other alterations.

[0160] As indicated above, steganographic data is usually inserted into the carrier data (e.g., ML-based model 10A) in small portions, in a way that avoids suspicion. In order to be extracted at its destination, steganographic data should not be modified, especially if it were encrypted before being steganographically inserted. Even insignificant alteration of the steganographically inserted data may corrupt it, thereby preventing its extraction and disarming malware.

[0161] Hence, as suggested herein, applying any of the abovementioned disarming policies (performing quantization, adding random noise data, or reserializing) to initial ML- based model 10A may effectively corrupt and disarm steganographically inserted malicious data. It is further suggested that, in order to have minimal influence on initial ML-based model’s 10A performance, the amount of alterations (e.g., number of LSBs to omit, rounding to specific multiple, intensity of random noise data etc.) to be applied according to the disarming policy, as well as the disarming policy itself may be selected according to determined probability 11 A.

[0162] In some embodiments, disarming policy selection module 120 may select policy further based on various combinations of additional input parameters (e.g., type of initial ML-based model 10A architecture, hyperparameters of model 10A etc.) and the value of probability 11 A (e.g., for ML-based model of a “first” type of architecture, probability 11 A of certain value may require one particular disarming policy (type and extent of alterations), and for ML-based model of a “second” type of architecture, probability 11 A of the same value may require another disarming policy).

[0163] It shall be understood that disarming policy selection shall correspond to specific security requirements of an organization that applies system 10, and therefore may significantly vary from case to case. Hence, the present invention is not limited in this regard.

[0164] Disarming module 12 may be further configured to produce disarmed ML-based model 10A’ by applying respective disarming policy to initial ML-based model 10A.

[0165] In some embodiments, system 10 may further include configuration module 13, which is further described in detail with reference to Figs. 4A and 4B.

[0166] Reference is now made to Fig. 4A, depicting configuration module 13 of system 10 for preventing steganographic attacks, configured for training autoencoder ML-based model 112, according to some embodiments.

[0167] In some embodiments, configuration module 13 may include vector embedding module 131. Vector embedding module 131 may be configured to receive training set 13 A of ML-based models containing no steganographic data. Vector embedding module 131 may be further configured to perform the second vector embedding procedure on each ML- based model of training set 13A, based on the set of parameters thereof, thereby obtaining initial vector representations 131A of each ML-based model of training set 13A.

[0168] In some embodiments, vector embedding module 111 (shown in Fig. 3A) and vector embedding module 131 may be configured to form initial vector representations in the same feature vector space (wherein “features” are formed based on the set (e.g., set 110A) of parameters of respective ML-based models). Furthermore, in some embodiments, vector embedding module 131 may be further configured to perform the same vector embedding procedure (e.g., as referred herein, “the second” vector embedding procedure) for each ML-based model of training set 13 A, as discussed with respect to initial ML-based model 10A referring to Fig. 3A. E.g., vector embedding module 131 may be configured to calculate a gradient for each ML-based model of training set 13A and to form initial vector representations 131A, based on weight coefficients of a respective model of set 13A and respective calculated gradient. Furthermore, for gradient calculations, vector embedding module may use the same input data sample (e.g., input data sample 111’) as used for model 10A.

[0169] In some embodiments, configuration module 13 may further include training module 132. Training module 132 may be configured to train autoencoder ML-based model 112 to reconstruct a vector representation of a target ML-based model (e.g., ML-based model 10A) containing no steganographic data, based on vector representations 131 A of the ML-based models of training set 13A.

[0170] In some embodiments, training module 132 may be further configured to determine an architecture of at least one ML-based model of training set 13A and calculate a plurality of permutations of the respective ML-based model, based on the determined architecture. In some embodiments, said permutations may include a plurality of ML-based models corresponding to the plurality of various possible combinations of hyperparametersof the respective ML-based model of training set 13A in a hyperparameter space. In some embodiments said permutations may be based on hyper-representations extracted from ML- based model databases, may further include various model augmentations, combinations of various model architectures, and applying Self-Supervised Learning tasks to extract specific features of ML-based models. Training module 132 may be further configured to augment training set 13 A with the calculated plurality of permutations.

[0171] Training module 132 may be further configured to train autoencoder ML-based model 112 to reconstruct a vector representation of a target ML-based model (e.g., ML- based model 10A) containing no steganographic data, based on vector representations 131A of the ML-based models of augmented training set 13 A.

[0172] In some embodiments, configuration module 13 may further include steganographic data generating and inserting module 130.

[0173] In some embodiments, steganographic data generating and inserting module 130 may be configured to receive test ML-based models 13A’ in original versions 130A, containing no steganographic data. Steganographic data generating and inserting module130 may be further configured to perform insertion of the steganographic data into test ML- based models 13A’, thereby obtaining altered versions 130A’ of test ML-based models 13A’.

[0174] Configuration module 13 may be further configured to form test set 130A” of ML-based models 13 A’, including both original versions I30A and altered versions 130A’.

[0175] In some embodiments, vector embedding module 131 may be further configured to receive test set 130A”. Vector embedding module 131 may be further configured to perform, for both original versions 130A and altered versions 130A’ of test ML-based models 13A’ of set 130A”, the second vector embedding procedure (same as described with respect to set 13A and to ML-based model 10A) on the respective test ML-based model 13A’, based on the set of parameters thereof, thereby obtaining initial vector representation131 A’ of each test ML-based model 13 A’ in a respective version.

[0176] Configuration module 13 may be further configured to infer trained autoencoder ML-based model 112 on initial vector representations 131 A’ of each test ML-based model 13A’ of set 130A” (in both original version 130A and altered version 130A’). Autoencoder ML-based model 112 may be further configured to calculate reconstructed vectorrepresentations 112A’ of test ML-based models 13A’ (in both original version 130A and altered version 130A’).

[0177] In some embodiments, configuration module 13 may further include reconstruction error calculation module 133. Reconstruction error calculation module 133 may be configured to receive reconstructed vector representations 112A’ of test ML-based models 13A’ (in both original version 130A and altered version 130A’ of each model 13 A’).

[0178] Reconstruction error calculation module 133 may be further configured to compare initial vector representation 131 A’ and reconstructed vector representation 112 A’ of ML-based models 13A’ in both original and altered versions I30A and 130A’. Reconstruction error calculation module 133 may be further configured to calculate, as a result of said comparison, reconstruction error value 133 A of the respective version (original version 130A and altered version 130A’).

[0179] In some embodiments, configuration module 13 may further include threshold calculation module 134. Threshold calculation module 134 may be configured to set predefined threshold 13A”, based on reconstruction error values 133 A of original and altered versions 130A and 130A’ of test ML-based models 13A’. E.g., threshold calculation module 134 may be configured to calculate mean difference between reconstruction error values 133 A of original and altered versions 130A and 130A’ oftest ML-based models 13A’ and set threshold 13 A” further based on said mean difference.

[0180] It shall be understood that the present invention is not limited to any specific ways of setting threshold 13 A’ ’ and other ways of setting threshold 13 A’ ’ based on reconstruction error values 133 A of original and altered versions 130A and 130A’ may be covered by the scope of the present invention.

[0181] It shall be understood that, according to the present invention, autoencoder ML- based model 112 may be trained in various ways and on various sets of ML-based models.

[0182] E.g., autoencoder ML-based model 112 may be trained on a set providing comparatively narrow representation of ML-based models (e.g., ML-based model 10A), e.g., any specific type of ML-based model (e.g., ANN), and even limited by specific parameters and / or hyperparameters (e.g., number or specific range of layers of ANN etc.). In other embodiments, autoencoder ML-based model 112 may be trained on a set providing comparatively broad representation of ML-based models (e.g., ML-based model 10A), e.g., representing plurality of different types of ML-based models.

[0183] In some embodiments, autoencoder ML-based model 112 may include a plurality of autoencoder ML-based models each of which may be trained on a separate training set, in order to be configured to reconstruct vector representations of ML-based models of a specific type. System 10 may be further configured to select and apply specific autoencoder ML-based model 112 of the plurality, depending on set 110A of parameters of ML-based model 110A.

[0184] In some embodiments, training module 132 may be configured to train autoencoder ML-based model 112 using MSE Layer-Wise Loss Normalization, e.g., as indicated in the formula below:

[0186] where w® and w® are reconstructed and original weights for the / -th layer the z- th model of training set 13 A, LM5£is a weight reconstruction loss, M is a number of models in training set 13A, N is a dimension of a feature vector space, and a is a standard deviation.

[0187] It shall be understood that the present invention is not limited to any specific aspects of training autoencoder ML-based model (e.g., model 112), except for the aspects indicated in the appended claims.

[0188] Therefore, it is suggested to train autoencoder ML-based model 112 to reconstruct “normal” ML-based models (ML-based models containing no steganographic data). Then, when pretrained autoencoder ML-based model 112 receives “anomalous” ML-based model (e.g., ML-based model 10A) model 112 fails to perform its reconstruction, which is indicated by reconstruction error value 133A (e.g., when reconstruction error value 133A surpasses predefined threshold 13A”). Hence, based on reconstruction error value 133A and predefined threshold 13A” system 10 may classify ML-based model 10A as “containing steganographic data” or “not containing steganographic data”, determine probability 11 A of steganographic data presence and choose disarming policy accordingly (e.g., choose the amount of alterations to be made to initial ML-based model 10A to assure its safeness).

[0189] It should be noted that the aspect of calculating the amount of alterations to be made (e.g., number of LSBs to be omitted, intensity of random noise data to be added etc.) may substantially vary depending on the embodiments of the present invention.

[0190] E.g., in some cases, the higher reconstruction error value 113A is (and, consequently, the higher probability 11A of steganographic data presence is), the less alterations to ML-based model 10A are needed to assure its safeness. Such a disarming policy may be effective because comparatively high reconstruction error value 113A may indicate that a significant portion of ML-based model 10A data has been substituted by steganographic data. Therefore, the higher the portion of steganographic data is, the easier it may be to corrupt it, since the probability that the alterations to ML-based model 10A will “hit” the steganographic data and not the data of the carrier (ML-based model 10A) itself, may be likewise higher. It shall be understood that such logic of selecting an amount of alterations is provided only as an example, and completely different logic may be applied in different embodiments of the present invention (e.g., the higher reconstruction value 113A is, the more alterations to ML-based model 10A are needed).

[0191] Reference is now made to Fig. 4B, depicting configuration module 13 of system 10 for preventing steganographic attacks, configured for training classifying ML-based model 112’, according to some embodiments.

[0192] Similar elements of configuration module 13 of Figs. 4A and 4B are given the same numerical references. Description of such similar elements is omitted unless it is necessary to introduce additional aspects.

[0193] In order to provide for classification of ML-based models by presence or absence of steganographically inserted data, classifying ML-based model 112’ shall be trained on a training dataset which includes data samples of all classes (e.g., in case of binary classification, examples of classes “containing steganographic data” and “not containing steganographic data”).

[0194] Therefore, in some embodiments, steganographic data generating and embedding module 130 may be configured to receive training set 13A of ML-based models in original version 130B, containing no steganographic data. Steganographic data generating and embedding module 130 may be further configured to receive test ML-based models 13A’ in original versions 130A, containing no steganographic data. Steganographic data generating and inserting module 130 may be further configured to perform insertion of the steganographic data into test ML-based models 13 A’ and ML-based models of a training set 13A thereby obtaining altered versions 130B’ of training ML-based models (models of set 13 A) and altered versions 130A’ of test ML-based models 13A’.

[0195] Configuration module 13 may be further configured to form test set 130A” of ML-based models 13A’, including both original versions I30A and altered versions 130A’. Configuration module 13 may be further configured to form training set BOB” of ML- based models of set 13A, including both original versions 130B and altered versions BOB’. Configuration module 13 may be further configured to assign label to each model of set BOB” and BOA”, corresponding to pertinence to a respective class, e.g., each model in altered version is assigned to class “containing steganographic data”, and each model in original version is assigned to class “not containing steganographic data”.

[0196] In some embodiments, vector embedding module 131 may be further configured to receive training set BOB” and test set BOA”. Vector embedding module 131 may be further configured to perform, for both original versions BOA, BOB and altered versions 130A’, BOB’, the second vector embedding procedure (same as described with respect to ML-based model 10A) on the respective ML-based model of set BOA” and set BOB”, based on the set of parameters of the respective model, thereby obtaining vector representations 131 A’ and 13 IB’ of the respective ML-based model in the respective version.

[0197] In some embodiments, training module 132 may be further configured to train, based on the vector representations 131 A’ and 13 IB’, classifying ML-based model 112’ to classify a target ML-based model (e.g., ML-based model 10A) by pertinence to said classes. It shall be understood that training module 132 may be configured to perform said training, based on supervised ML techniques known in the art.

[0198] Referring now to Figs. 5A-5C the results of the experiments that proved reliability of the suggested approach of using machine-to-image conversion and application of SNN- based model (as described with reference to Figs. 3C-3E) are further discussed.

[0199] Experiment 1. In this experiment, the inventor trained classification models on the dataset formed using on the compiled 4 model “zoos” of small CNN models (having 2k float32 parameters) of the same architecture that were trained on CIFAR10, MNIST, STL10, and SVHN. Each model zoo has about 50000 different models. The predefined malware sample was applied on this model collection, to create steganographically-affected examples. Model “zoos” CIFAR10, MNIST, and SVHN were chosen for training and STL10 - for testing. The obtained model collection was used for comparison with “baseline” methods of steganographic data detection. The “baseline” methods involve training of“traditional” unsupervised and supervised models using the small CNN “zoos” and it showed non-trivial results for X (#LSB in the training dataset each model learned) > 17 on the CIFAR10, MNIST, SVHN, and STL 10 model “zoos” individually. In contrast, the suggested methodology aims to create generalized approach (e.g., create such system 10) that is proven to work across different architectures. The main goal of this experiment is to measure the success (test accuracy) of models trained using the proposed methodology (described with reference to Figs. 3C-3E) versus the baseline results. To this end, the training / testing procedure was closely replicated, in order to make the comparison strict. The baseline work trained a model for each attack severity and each model architecture individually. In the present experiment, the focus is on the STL10 model “zoo” and the suggested SNN-based model 116 was trained on 3 STL10 models on each attack severity (23 different models). The training process was repeated 30 times to show mean and confidence interval results. As can be seen in Fig. 5A, the plot shows the #LSB in the training dataset each model learned versus the test accuracy on the STL10. The CNN model with centroid evaluation had very close results to the baseline for 18 < #LSB < 23 (56%-71% ER), and for the rest of the attacks (3.1 %-56% ER), it showed stable results in the confidence interval [0.85, 1], while the baseline model failed. The CNN model with INN evaluation also had stable results but slightly worse than the centroid evaluation. Finally, the INN model failed completely.

[0200] In conclusion, the experiment showed that the suggested configuration successfully outperformed the “baseline” methods in terms of accuracy, while using only 6 models (6 labeled training samples) for training, as opposed to 40,000 models (training samples) in the “baseline” method.

[0201] Experiment 2. This experiment was conducted to test the reliability of the suggested approach, when using model-to-image conversion based on mantissa portion only. For the experiment, different language models with floatl6 weight coefficients, all trained on the same dataset, were taken, and a dataset for learning from them was generated.

[0202] In this experiment, only the last byte of the float 16 weight coefficient value was used. Looking at the experiment results shown in Figs. 5B-5C, it can be seen that the suggested approach provide stable results from #LSB=6 and upwards, thereby proving the reliability of the suggested approach when using just the last 1 byte to detectsteganographically embedded data in ML-based models having floatl6 model weight coefficients.

[0203] Referring now to Fig. 6, a flow diagram is presented, depicting a method of preventing steganographic attacks, by at least one processor, according to some embodiments.

[0204] As shown in step S1005, the at least one processor (e.g., processor 2 of Fig. 1) may perform reception of an initial machine-learning (ML)-based model (e.g., initial ML- based model 10A). Step S1005 may be carried out by steganalysis module 13 and, in particular, by model architecture analysis module 110 (as described with reference to Figs. 2, 3A, and 3B).

[0205] As shown in step S1010, the at least one processor (e.g., processor 2 of Fig. 1) may apply a steganalysis procedure to the initial ML-based model (e.g., ML-based model 10A), to determine a probability of steganographic data presence (e.g., probability 11 A) in the initial ML-based model (e.g., ML-based model 10A). Step S1010 may be carried out by steganalysis module 13 and, in particular, by autoencoder ML-based model 112, reconstruction error calculation module 113 and steganography probability calculation module 114 (as described with reference to Figs. 2, 3A and 3B).

[0206] As shown in step S1015, the at least one processor (e.g., processor 2 of Fig. 1) may apply at least one alteration to the initial ML-based model (e.g., ML-based model 10A), according to the determined probability (e.g., probability 11A), thereby obtaining a disarmed ML-based model (e.g., ML-based model 10A’). Step S1015 may be carried out by disarming module 12 and, in particular, by disarming policy selection module 120, quantization module 121, random noise data generating module 122, and serialization module 123 (as described with reference to Fig. 2).

[0207] As can be seen from the provided description, the claimed invention represents a system and method of preventing steganographic attacks which provide an improvement of the technological field of cyber security by increasing efficiency of detecting and disarming malicious data steganographically concealed inside ML-based models, and therefore, by increasing cyber safety of ML-based model distribution.

[0208] Unless explicitly stated, the method embodiments described herein are not constrained to a particular order or sequence. Furthermore, all formulas described herein are intended as examples only and other or different formulas may be used. Additionally, someof the described method embodiments or elements thereof may occur or be performed at the same point in time.

[0209] While certain features of the invention have been illustrated and described herein, many modifications, substitutions, changes, and equivalents may occur to those skilled in the art. It is, therefore, to be understood that the appended claims are intended to cover all such modifications and changes as fall within the true spirit of the invention.

[0210] Various embodiments have been presented. Each of these embodiments may of course include features from other embodiments presented, and embodiments not specifically described may include various features described herein.

Claims

CLAIMS1. A method of preventing steganographic attacks by at least one processor, the method comprising: receiving an initial machine-learning (ML)-based model; applying a steganalysis procedure to the initial ML-based model, to determine a probability of steganographic data presence in the initial ML-based model; applying at least one alteration to the initial ML-based model, according to the determined probability, thereby obtaining a disarmed ML-based model.

2. The method of claim 1, wherein the initial ML-based model is characterized by a set of parameters; and wherein applying the steganalysis procedure comprises: generating an input image representation of the initial ML-based model, based on the set of parameters thereof; inferring, on the input image representation, a respectively pretrained Siamese- Neural-Network (SNN)-based model, to calculate a distance metric value, representing a degree of pertinence of the input image representation to at least one class that indicates steganographic data presence in ML-based models; and determining the probability of the steganographic data presence based on the calculated distance metric value.

3. The method of claim 2, wherein the initial ML-based model is an artificial neural network model, and the set of parameters includes weight coefficients; and wherein said generating the input image representation comprises: for one or more of said weight coefficients, extracting, from a value thereof represented in a binary format, a sequence of m zz-bit blocks; forming the input image representation from m image representation parts, wherein, for 1 < z < m, z-th of the m image representation parts comprises a plurality of pixels, each having a color coded based on z-th zz-bit block in the sequence of the zz-bit blocks of a respective weight coefficient of said weight coefficients.

4. The method of claim 3, wherein values of said weight coefficients are stored in a floating-point-number representation comprising a mantissa portion and an exponent portion; andwherein said sequence of m n-bit blocks represents, at least in part, the mantissa portion of the respective weight coefficient.

5. The method according to any one of claims 2-4, wherein the respectively pretrained SNN-based model is configured to: receive the input image representation; perform a first vector embedding procedure on the input image representation, to calculate an input feature vector representation in a predefined feature space; calculate the distance metric value representing at least one of (i) a first distance being a distance, in the feature space, between the input feature vector representation and a centroid vector representation of a first class, said centroid vector representation of the first class being calculated as an average of steganographically-nonaffected feature vector representations, calculated by performing the first vector embedding procedure on image representations of ML-based models not containing steganographic data; and (ii) a second distance being a distance, in the feature space, between the target feature vector representation and a centroid vector representation of a second class, said centroid vector representation of the second class being calculated as an average of steganographically- affected feature vector representations, calculated by performing the first vector embedding procedure on image representations of ML-based models containing steganographic data.

6. The method according to any one of claims 1-5, wherein the initial ML-based model is characterized by a set of parameters; and wherein applying the steganalysis procedure comprises performing a second vector embedding procedure on the initial ML-based model, based on the set of parameters thereof, thereby obtaining an initial vector representation of the initial ML-based model; inferring, on the initial vector representation, an autoencoder ML-based model, respectively pretrained to reconstruct vector representations of ML-based models containing no steganographic data, thereby obtaining a reconstructed vector representation of the initial ML-based model; calculating a reconstruction error value, based on the initial and reconstructed vector representations of the initial ML-based model; anddetermining the probability of the steganographic data presence, based on the reconstruction error value.

7. The method of claim 6, further comprising classifying the initial ML-based model as containing the steganographic data, provided that the determined probability of the steganographic data presence surpasses a predefined threshold.

8. The method of claim 7, further comprising receiving a training set of the ML-based models containing no steganographic data, wherein each ML-based model of the training set is characterized by the set of parameters; performing the second vector embedding procedure on each ML-based model of the training set, based on the set of parameters thereof, thereby obtaining a vector representation of each ML-based model of the training set; based on the vector representations of the ML-based models of the training set, training the autoencoder ML-based model to reconstruct a vector representation of a target ML-based model containing no steganographic data.

9. The method of claim 8, further comprising for at least one ML-based model of the training set, determining an architecture of the respective ML-based model; calculating a plurality of permutations of the respective ML-based model, based on the determined architecture; and augmenting the training set with the calculated plurality of permutations.

10. The method according to any one of claims 8-9, further comprising receiving at least one test ML-based model in an original version, containing no steganographic data; wherein the at least one test ML-based model is characterized by the set of the parameters; inserting the steganographic data into the at least one test ML-based model, thereby obtaining an altered version of the at least one test ML-based model; for both the original version and the altered version,(i) performing the second vector embedding procedure on the at least one test ML- based model in a respective version, based on the set of the parameters of the at least onetest ML-based model, thereby obtaining an initial vector representation of the at least one test ML-based model in a respective version;(ii) inferring the autoencoder ML-based model on the initial vector representation of the at least one test ML-based model in the respective version, thereby obtaining a reconstructed vector representation of the test ML-based model in the respective version; and(iii) calculating a reconstruction error value of the respective version, based on the initial and reconstructed vector representations of the at least one test ML-based model in the respective version; and setting the predefined threshold, based on the reconstruction error values of the original and altered versions of the at least one test ML-based model.

11. The method according to any one of claims 1-10, wherein the initial ML-based model is characterized by a set of parameters; and wherein applying the steganalysis procedure comprises performing a second vector embedding procedure on the initial ML-based model, based on the set of the parameters thereof, thereby obtaining a vector representation of the initial ML-based model; inferring, on the vector representation of the initial ML-based model, a respectively pretrained classifying ML-based model, to calculate a probability of a pertinence of the initial ML-based model to at least one class that indicates steganographic data presence; and determining the probability of the steganographic data presence based on the probability of pertinence of the initial ML-based model to said at least one class.

12. The method of claim 11, further comprising receiving a training set of the ML-based models in original versions containing no steganographic data and in altered versions containing steganographic data, wherein each ML-based model of the training set is characterized by the set of parameters and is respectively labeled by pertinence to at least one class that indicates steganographic data presence; performing the second vector embedding procedure on each ML-based model of the training set, based on the set of parameters thereof, thereby obtaining a vector representation of each ML-based model of the training set; andbased on the vector representations of the ML -based models of the training set, training the classifying ML-based model to classify a target ML-based model by pertinence to said at least one class.

13. The method according to any one of claims 1-12, wherein applying the at least one alteration to the initial ML-based model comprises performing quantization of the initial ML-based model.

14. The method of claim 13, wherein the initial ML-based model is characterized by at least one parameter; and performing quantization of the initial ML-based model comprises defining a rounding multiple, based on the determined probability; and rounding a value of the at least one parameter of the initial ML-based model to the defined rounding multiple.

15. The method of claim 13, wherein the initial ML-based model is characterized by at least one parameter; and performing quantization of the initial ML-based model comprises defining a number of LSBs for omission, based on the determined probability; and omitting the defined number of Least Significant Bits (LSBs) of the at least one parameter of the initial ML-based model.

16. The method according to any one of claims 1-15, wherein the initial ML-based model is characterized by at least one parameter; and applying the at least one alteration to the initial ML-based model comprises adding random noise data to Least Significant Bits (LSBs) of the at least one parameter of the initial ML-based model.

17. The method of claim 16, wherein applying the at least one alteration to the initial ML-based model further comprises defining an intensity of random noise data, based on the determined probability.

18. The method according to any one of claims 1-17, wherein the initial ML-based model is received in a first serialization format; andwherein applying the at least one alteration to the initial ML-based model comprises reserializing the initial ML-based model to be represented in a second serialization format.

19. The method according to any one of claims 1-18, wherein the initial ML-based model is an artificial neural network model, and the set of parameters includes weight and bias coefficients.

20. The method of claim 19, wherein the second vector embedding procedure comprises inferring a respective ML-based model on an input data sample, to obtain a calculated output value; calculating a loss function, based on the calculated output value and a predefined desired output label; calculating a gradient of the loss function with respect to weight coefficients of the respective ML-based model; and obtaining a respective vector representation of the respective ML-based model, based on said weight coefficients and the calculated gradient.

21. The method of claim 20, wherein the input data sample is an in-distribution data sample with respect to the respective ML-based model.

22. The method of claim 20, wherein the input data sample is an out-of-distribution data sample with respect to the respective ML-based model.

23. A system for preventing steganographic attacks, the system comprising: a non- transitory memory device, wherein modules of instruction code are stored, and at least one processor associated with the memory device, and configured to execute the modules of instruction code, whereupon execution of said modules of instruction code, the at least one processor is configured to: receive an initial machine-learning (ML)-based model; apply a steganalysis procedure to the initial ML-based model, to determine a probability of steganographic data presence in the initial ML-based model; and apply at least one alteration to the initial ML-based model, according to the determined probability, thereby obtaining a disarmed ML-based model.

24. The system of claim 23, wherein the initial ML-based model is characterized by a set of parameters; and wherein the at least one processor is further configured to apply the steganalysis procedure by: generating an input image representation of the initial ML-based model, based on the set of parameters thereof; inferring, on the input image representation, a respectively pretrained Siamese- Neural-Network (SNN)-based model, to calculate a distance metric value, representing a degree of pertinence of the input image representation to at least one class that indicates steganographic data presence in ML-based models; and determining the probability of the steganographic data presence based on the calculated distance metric value.

25. The system of claim 24, wherein the initial ML-based model is an artificial neural network model, and the set of parameters includes weight coefficients; and wherein the at least one processor is further configured to generate the input image representation by: for one or more of said weight coefficients, extracting, from a value thereof represented in a binary format, a sequence of m zz-bit blocks; and forming the input image representation from m image representation parts, wherein, for 1 < z < m, z-th of the m image representation parts comprises a plurality of pixels, each having a color coded based on z-th zz-bit block in the sequence of the zz-bit blocks of a respective weight coefficient of said weight coefficients.

26. The system of claim 25, wherein the at least one processor is further configured to store values of said weight coefficients in a floating-point-number representation comprising a mantissa portion and an exponent portion; and wherein said sequence of m zz-bit blocks represents, at least in part, the mantissa portion of the respective weight coefficient.

27. The system according to any one of claims 24-26, wherein the respectively pretrained SNN-based model is configured to: receive the input image representation;perform a first vector embedding procedure on the input image representation, to calculate an input feature vector representation in a predefined feature space; and calculate the distance metric value representing at least one of (i) a first distance being a distance, in the feature space, between the target feature vector representation and a centroid vector representation of a first class, said centroid vector representation of the first class being calculated as an average of steganographically-nonaffected feature vector representations, calculated by performing the first vector embedding procedure on image representations of ML-based models not containing steganographic data; and (ii) a second distance being a distance, in the feature space, between the target feature vector representation and a centroid vector representation of a second class, said centroid vector representation of the second class being calculated as an average of steganographically- affected feature vector representations, calculated by performing the first vector embedding procedure on image representations of ML-based models containing steganographic data.

28. The system according to any one of claims 23-27, wherein the initial ML-based model is characterized by a set of parameters; and wherein the at least one processor is further configured to apply the steganalysis procedure by: performing a second vector embedding procedure on the initial ML-based model, based on the set of parameters thereof, to obtain an initial vector representation of the initial ML-based model; inferring, on the initial vector representation, an autoencoder ML-based model, respectively pretrained to reconstruct vector representations of ML-based models containing no steganographic data, thereby obtaining a reconstructed vector representation of the initial ML-based model; and calculating a reconstruction error value, based on the initial and reconstructed vector representations of the initial ML-based model; and wherein the at least one processor is further configured to determine the probability of the steganographic data presence, based on the reconstruction error value.

29. The system of claim 28, wherein the at least one processor is further configured to classify the initial ML-based model as containing the steganographic data, providedthat the determined probability of the steganographic data presence surpasses a predefined threshold.

30. The system of claim 29, wherein the at least one processor is further configured to: receive a training set of the ML-based models containing no steganographic data, wherein each ML-based model of the training set is characterized by the set of parameters; perform the second vector embedding procedure on each ML-based model of the training set, based on the set of parameters thereof, thereby obtaining a vector representation of each ML-based model of the training set; based on the vector representations of the ML-based models of the training set, train the autoencoder ML-based model to reconstruct a vector representation of a target ML-based model containing no steganographic data.

31. The system of claim 30, wherein the at least one processor is further configured to: for at least one ML-based model of the training set, determine an architecture of the respective ML-based model; calculate a plurality of permutations of the respective ML-based model, based on the determined architecture; and augment the training set with the calculated plurality of permutations.

32. The system according to any one of claims 30-31, wherein the at least one processor is further configured to: receive at least one test ML-based model in an original version, containing no steganographic data; wherein the at least one test ML-based model is characterized by the set of the parameters; insert the steganographic data into the at least one test ML-based model, thereby obtaining an altered version of the at least one test ML-based model; for both the original version and the altered version,(i) perform the second vector embedding procedure on the at least one test ML- based model in a respective version, based on the set of the parameters of the at least one test ML-based model, thereby obtaining an initial vector representation of the at least one test ML-based model in a respective version;(ii) infer the autoencoder ML-based model on the initial vector representation of the at least one test ML-based model in the respective version, thereby obtaining a reconstructed vector representation of the test ML-based model in the respective version; and(iii) calculate a reconstruction error value of the respective version, based on the initial and reconstructed vector representations of the at least one test ML-based model in the respective version; and set the predefined threshold, based on the reconstruction error values of the original and altered versions of the at least one test ML-based model.

33. The system according to any one of claims 23-32, wherein the initial ML-based model is characterized by a set of parameters; and wherein the at least one processor is configured to apply the steganalysis procedure by: performing a second vector embedding procedure on the initial ML-based model, based on the set of the parameters thereof, thereby obtaining a vector representation of the initial ML-based model; inferring, on the vector representation of the initial ML-based model, a respectively pretrained classifying ML-based model, to calculate a probability of a pertinence of the initial ML-based model to at least one class that indicates steganographic data presence; and determining the probability of the steganographic data presence based on the probability of pertinence of the initial ML-based model to said at least one class.

34. The system of claim 33, wherein the at least one processor is further configured to: receive a training set of the ML-based models in original versions containing no steganographic data and in altered versions containing steganographic data, wherein each ML-based model of the training set is characterized by the set of parameters and is respectively labeled by pertinence to at least one class that indicates steganographic data presence; perform the second vector embedding procedure on each ML-based model of the training set, based on the set of parameters thereof, thereby obtaining a vector representation of each ML-based model of the training set; andbased on the vector representations of the ML -based models of the training set, train the classifying ML-based model to classify a target ML-based model by pertinence to said at least one class.

35. The system according to any one of claims 23-34, wherein the at least one processor is configured to apply the at least one alteration to the initial ML-based model by performing quantization of the initial ML-based model.

36. The system of claim 35, wherein the initial ML-based model is characterized by at least one parameter; and wherein the at least one processor is configured to perform quantization of the initial ML-based model by: defining a rounding multiple, based on the determined probability; and rounding a value of the at least one parameter of the initial ML-based model to the defined rounding multiple.

37. The system of claim 35, wherein the initial ML-based model is characterized by at least one parameter; and wherein the at least one processor is configured to perform quantization of the initial ML-based model by defining a number of LSBs for omission, based on the determined probability; and omitting the defined number of Least Significant Bits (LSBs) of the at least one parameter of the initial ML-based model.

38. The system according to any one of claims 23-37, wherein the initial ML-based model is characterized by at least one parameter; and wherein the at least one processor is configured to apply the at least one alteration to the initial ML-based model by adding random noise data to Least Significant Bits (LSBs) of the at least one parameter of the initial ML-based model.

39. The system of claim 38, wherein the at least one processor is configured to apply the at least one alteration to the initial ML-based model further by defining an intensity of random noise data, based on the determined probability.

40. The system according to any one of claims 23-39, wherein the initial ML-based model is received in a first serialization format; andwherein the at least one processor is configured to apply the at least one alteration to the initial ML-based model by reserializing the initial ML-based model to be represented in a second serialization format.

41. The system according to any one of claims 23-40, wherein the initial ML-based model is an artificial neural network model, and the set of parameters includes weight and bias coefficients.

42. The system of claim 41, wherein the second vector embedding procedure comprises: inferring a respective ML-based model on an input data sample, to obtain a calculated output value; calculating a loss function, based on the calculated output value and a predefined desired output label; calculating a gradient of the loss function with respect to weight coefficients of the respective ML-based model; and obtaining a respective vector representation of the respective ML-based model, based on said weight coefficients and the calculated gradient.

43. The system of claim 42, wherein the input data sample is an in-distribution data sample with respect to the respective ML-based model.

44. The system of claim 42, wherein the input data sample is an out-of-distribution data sample with respect to the respective ML-based model.

Images