System and method for transformation of discrete input for adversarial robustness

Abstract

To provide a method and a system for robust transformation of a discrete input with a neural network.SOLUTION: A neural network includes an embedding subnetwork and a transformation subnetwork. A method comprises: embedding a discrete input into a continuous space using the embedding subnetwork to produce a continuous embedding; injecting a set of random noises of a predetermined magnitude into the continuous embedding to produce a set of perturbed embeddings; processing each of the set of perturbed embeddings with the transformation subnetwork to produce a set of transformations; and outputting a combination of the set of transformations as robust transformation of the discrete input.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present disclosure relates generally to training and using machine learning systems to defend against adversarial input attacks, and more particularly to systems and methods for robust transformation of discrete inputs to defend against adversarial input attacks. [Background technology]

[0002] Machine learning (ML) models, especially deep neural networks, have been successful across a variety of domains, including image recognition, natural language processing, and autonomous systems. However, these ML models are susceptible to adversarial input attacks, where small, carefully crafted perturbations to the input data can lead to misclassification or misbehavior.

[0003] Adversarial input attacks involve making small, carefully crafted modifications to input data with the intent of causing a machine learning (ML) model to misclassify the input data. These modifications are often imperceptible to humans but can significantly change the output of the ML model. Adversarial attacks exploit vulnerabilities in ML models by adding perturbations to input data, such as images, text, or audio.

[0004] Adversarial attacks pose significant challenges to the deployment of ML models in safety-critical applications such as autonomous vehicles, medical diagnostics, and cybersecurity systems. Traditional defense mechanisms, including input preprocessing and model regularization, have limited effectiveness in overcoming sophisticated adversarial attacks.

[0005] In one example, ML models may need to be defended against adversarial input perturbation attacks, particularly in the area of ​​categorical input models such as those used to model network traffic logs to perform anomaly detection for automated cybersecurity tools. More broadly, this problem also relates to the related concerns of adversarial input perturbation attacks on large language models and their practical deployment.

[0006] To address the challenges posed by adversarial attacks, adversarial training has been used to enhance the robustness of ML models against adversarial input attacks. Adversarial training involves augmenting training data with adversarially perturbed examples to train ML models, allowing them to learn stronger decision boundaries.

[0007] To this end, the effectiveness of adversarial training depends heavily on the quality and diversity of the adversarial examples in the training data used during the training process. Generating high-quality adversarial examples requires careful consideration of various factors, including attack strategy, model architecture, and training objectives. Therefore, if the adversarial examples in the training data do not address these various factors, adversarial training of ML models may result in suboptimal performance.

[0008] Therefore, there is a need to provide a system and method for defending against adversarial input attacks that is suitable for defending against adversarial perturbations of discrete and / or categorical inputs. Summary of the Invention

[0009] An object of some embodiments is to provide systems and methods for defending against adversarial input attacks. Additionally or alternatively, an object of some embodiments is to provide systems and methods for defending against adversarial input attacks without the need for adversarial training. Additionally or alternatively, an object of some embodiments is to provide systems and methods for defending against adversarial input attacks that are suitable for defending against adversarial perturbations of discrete and / or categorical inputs. Such methods are referred to herein as robust transformations of discrete and / or categorical inputs.

[0010] The present disclosure relates to methods, systems, and computer program products for transforming input data, for example, to defend against adversarial input examples.

[0011] Some embodiments of the present disclosure are based on the recognition that discrete inputs enable the representation of categorical variables that are prevalent in many real-world datasets. Examples of datasets associated with discrete inputs may include, but are not limited to, gender, ethnicity, product category, sales data, number of employees, number of product reviews, and internet proxy data. Categorical variables play an important role in modeling relationships and patterns in data, especially in fields such as marketing, demographics, and social sciences.

[0012] Some embodiments of the present disclosure are based on the recognition that generating adversarial examples from discrete input data poses several challenges compared to continuous input data due to the discrete, high-dimensional, and non-continuous nature of the input data.

[0013] Typically, generating adversarial examples for discrete input data involves generating small but targeted perturbations to input data samples to fool an ML model trained on the input data samples. This process is particularly relevant in scenarios where the input data is classification-based, symbolic, or discrete in nature (e.g., text, sequences, and categorical variables). Some embodiments of the present disclosure are based on the recognition that several general strategies can be used to generate adversarial examples for discrete input data. However, these strategies depend on the type of discrete input data and therefore cannot guarantee optimal output for an ML model trained on it.

[0014] To that end, some embodiments aim to replace or at least complement adversarial training with robust transformations generated using randomized smoothing. Some embodiments are based on the recognition that robust transformations of input data suitable for defending against adversarial attacks can be performed using randomized smoothing of the input data. The basic concept in randomized smoothing is to add random noise to the input data of an ML model to drown out small perturbations of adversarial input attacks. The input data is perturbed multiple times with independent noise samples, and the model is then evaluated for each of these noise-added inputs, and the corresponding outputs are aggregated to generate a final model output. This aggregation of outputs over multiple noise samples yields a result that represents the average model output over a local region of the original input data (such as an unperturbed image) that suppresses the effect of small adversarial perturbations, but which are only valid for a specific direction of the perturbation. Furthermore, statistics of multiple outputs can be analyzed to generate certified robustness guarantees.

[0015] However, an important limitation of randomized smoothing is that it is intended to deal with adversarial perturbations to data in continuous input spaces (e.g., images, audio, video).

[0016] Accordingly, some embodiments of the present disclosure aim to adapt randomized smoothing to discrete input data by first embedding the discrete input into a continuous space and applying randomized smoothing to the embedded continuous space. Generating robust perturbed transformations of discrete input data in this manner makes it possible to build defenses against adversarial attacks against ML models that predict discrete input data in a computationally efficient manner.

[0017] Additionally, embodiments of the present disclosure are based on the recognition that by embedding discrete input data into a continuous space and introducing noise in the continuous space, unified adversarial training for different types of discrete input data can be performed.

[0018] Thus, in one aspect, a computer-implemented artificial intelligence (AI) method is provided for robust transformation of a discrete input using a neural network. The neural network includes an embedding subnetwork and a transformation subnetwork. The method includes embedding the discrete input into a continuous space using the embedding subnetwork to generate a continuous embedding. The method further includes injecting a set of random noise of predetermined magnitudes into the continuous embedding to generate a set of perturbed embeddings. The method further includes processing each of the set of perturbed embeddings with the transformation subnetwork to generate a set of transformations. The method further includes outputting the combination of the set of transformations as a robust transformation of the discrete input.

[0019] According to a further embodiment, the discrete input comprises one or more categorical valued tensors. According to an additional embodiment, the discrete input is internet proxy log data.

[0020] According to an additional embodiment, the continuous embedding comprises a tensor of floating-point values. According to an additional embodiment, the set of random noise includes a set of Gaussian noise tensors, each of which has the shape of a floating-point-valued tensor and includes independent Gaussian samples with a mean of zero and a standard deviation defined by a predetermined magnitude.

[0021] According to an additional embodiment, each of the perturbed embeddings is formed by adding a tensor of floating-point values ​​to one of the Gaussian noise tensors.

[0022] According to a further embodiment, the transformation sub-network is a deep neural network trained for one or a combination of automatic speech recognition, language modeling, and log data modeling.

[0023] According to a further embodiment, the combination of the set of transformations is an aggregation of the set of transformations. According to a further embodiment, each of the set of transformations is a continuous tensor, such that the robust transformation is determined as an average of the set of transformations.

[0024] According to additional embodiments, each of the set of transformations is a tensor of one or more vectors of logits. The method further includes transforming each of the one or more vectors of logits into a probability vector via a softmax operation to generate a set of probability vectors. The method further includes averaging the set of probability vectors in a probability space to generate an average probability vector, and using the average probability vector to determine a robust transformation of the discrete input.

[0025] According to a further embodiment, the method further comprises transforming the mean probability vector with a log-likelihood to generate a robust transformation of the discrete input.

[0026] According to an additional embodiment, each of the set of transformations is a tensor of one or more vectors of logits. The method further includes transforming each of the one or more vectors of logits into a hard decision by selecting an index of the largest logit value to generate a set of hard decisions, and aggregating the set of hard decisions to generate a robust transformation of the discrete input.

[0027] According to a further embodiment, the neural network is trained with training samples of discrete inputs.

[0028] According to an additional embodiment, the neural network is trained with training samples of noise-corrupted discrete inputs in continuous space.

[0029] According to a further embodiment, to train the neural network, the method further includes embedding training samples of the discrete input into a continuous space with an embedding subnetwork to generate training embeddings. The method further includes perturbing the training embeddings multiple times with random noise to generate a set of perturbed training embeddings, and processing each of the set of perturbed training embeddings with a transformation subnetwork to generate a set of training transformations. The method further includes combining the set of training transformations into a combined training output, and updating parameters of the embedding subnetwork and the transformation subnetwork based on a loss function of the combined training output.

[0030] In another aspect, an artificial intelligence (AI) system for robust transformation of a discrete input using a neural network is provided. The neural network includes an embedding subnetwork and a transformation subnetwork. The AI ​​system further includes a memory that stores instructions and a processor that is configured to execute the instructions to embed the discrete input into a continuous space using the embedding subnetwork to generate a continuous embedding, inject a set of random noise of predetermined magnitudes into the continuous embedding to generate a set of perturbed embeddings using the transformation subnetwork to process each of the set of perturbed embeddings to generate a set of transformations, and output the combination of the set of transformations as a robust transformation of the discrete input.

[0031] In yet another aspect, a non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to perform a method for robust transformation of a discrete input by a neural network including an embedding subnetwork and a transformation subnetwork, the method including embedding the discrete input into a continuous space using the embedding subnetwork to generate a continuous embedding, injecting a set of random noise of predetermined magnitudes into the continuous embedding to generate a set of perturbed embeddings, processing each of the set of perturbed embeddings with the transformation subnetwork to generate a set of transformations, and outputting the combination of the set of transformations as a robust transformation of the discrete input.

[0032] The presently disclosed embodiments are further described below with reference to the accompanying drawings, in which: The drawings shown are not necessarily to scale, emphasis instead generally being placed upon illustrating the principles of embodiments of the present disclosure. [Brief explanation of the drawings]

[0033] [Figure 1] 1 illustrates a block diagram of a network environment in which an artificial intelligence (AI) system for outputting a transformation of a discrete input is implemented, according to some exemplary embodiments of the present disclosure. [Figure 2] FIG. 1 is a schematic diagram of the operation of an AI system, according to some exemplary embodiments of the present disclosure. [Figure 3] FIG. 1 is a block diagram illustrating the operation of an AI system for generating a transform of a tensor of categorical values, according to some example embodiments of the present disclosure. [Figure 4A] FIG. 1 is a schematic diagram of aggregation of a set of transforms to generate a transformation of a discrete input, according to various exemplary embodiments of the present disclosure. [Figure 4B] FIG. 1 is a schematic diagram of aggregation of a set of transforms to generate a transformation of a discrete input, according to various exemplary embodiments of the present disclosure. [Figure 4C] FIG. 1 is a schematic diagram of aggregation of a set of transforms to generate a transformation of a discrete input, according to various exemplary embodiments of the present disclosure. [Figure 5] FIG. 1 illustrates a flowchart of a method for training a neural network of an AI system, according to some exemplary embodiments of the present disclosure. [Figure 6] FIG. 1 is a block diagram of adversarial attack detection using adversarial training, according to some example embodiments of the present disclosure. [Figure 7A] FIG. 2 illustrates an exemplary discrete input as Internet proxy log data, according to some exemplary embodiments of the present disclosure. [Figure 7B] FIG. 2 illustrates an exemplary discrete input as Internet proxy log data, according to some exemplary embodiments of the present disclosure. [Figure 8] FIG. 1 illustrates a flowchart of a computer-implemented AI method for generating a transformation of a discrete input, according to some exemplary embodiments of the present disclosure. [Figure 9] FIG. 1 is a block diagram of a computer-based AI system for generating transformations of discrete inputs in accordance with an illustrative embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0034] Detailed Description In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it will be apparent to those skilled in the art that the present disclosure may be practiced without the specific details. In other instances, systems and methods are shown only in block diagram form in order to avoid obscuring the present disclosure.

[0035] Throughout this disclosure, the term "AI system" refers to a computer-based system or software that exhibits characteristics commonly associated with human intelligence. AI systems are designed to perform tasks that typically require human intelligence, such as problem solving, learning, reasoning, perception, natural language understanding, and decision-making. AI systems can range from simple rule-based programs to sophisticated self-learning systems.

[0036] According to this disclosure, an AI system may be advanced software that utilizes neural networks to generate transformations of discrete inputs, such transformations being used to form defenses against adversarial attacks.

[0037] Typically, traditional means of providing cybersecurity require a significant amount of human effort to monitor computer networks for potential intrusions / attacks and address such threats with subsequent actions. To overcome this, AI-assisted anomaly detection techniques based on data-driven ML models are utilized. Some embodiments are based on the understanding that intrusions / attacks cause anomalies in measured network traffic data. These can be detected by ML-based anomaly detection methods, which offer the benefits of automation and reduced human labor.

[0038] However, there may be the possibility of sophisticated adversaries that can specifically tailor their malicious attack behavior to both evade such ML-based anomaly detection methods and still achieve their original malicious objectives. This is particularly a concern for modern ML-based anomaly detection methods such as neural networks.

[0039] Some embodiments are based on the recognition that neural networks are susceptible to adversarial input perturbations, which are a family of attacks that generate carefully crafted perturbations to the input of a neural network that are imperceptibly small and can arbitrarily alter the output behavior of the neural network for any malicious purpose.

[0040] Some embodiments are based on the recognition that adversarial examples can be used to train ML models. For example, adversarial examples are inputs that are intentionally perturbed slightly to create new examples that can be misclassified by ML models such as neural networks. However, generating high-quality adversarial examples is challenging, especially for discrete input data. Furthermore, failure to generate high-quality adversarial examples can affect the performance of ML models trained with them.

[0041] Some embodiments of the present disclosure are based on a class of techniques known as randomized smoothing. Randomized smoothing techniques add random noise to the input of an ML model to drown out small perturbations from adversarial input attacks. In one example, instead of directly classifying a given input, randomized smoothing adds a random perturbation to the input. This perturbation can be noise or other types of randomness added to the input data. The input is perturbed multiple times with independent noise samples, and the ML model is then evaluated for each of the generated noise-induced inputs. The ML model's outputs for the corresponding noise-induced inputs are then aggregated to generate a final model output. This aggregation of outputs across multiple noise samples yields a result that represents the average model output over a local region of the original input, suppressing the effect of small adversarial perturbations, but which are only valid depending on the specific direction of the perturbation. Furthermore, statistics of multiple outputs can be analyzed to generate a robustness score or certified robustness guarantee for the ML model.

[0042] Randomized smoothing helps generate robust transformations by making it more difficult for attackers to create inputs that can consistently fool an ML model. The added randomness makes it more difficult for attackers to predict the effects of their perturbations, thus increasing the robustness of the ML model against adversarial attacks.

[0043] With respect to anomaly detection, by incorporating randomness into the classification process, ML models become less sensitive to small deviations or outliers that may otherwise cause false alarms in anomaly detection systems. This can lead to more reliable anomaly detection by reducing the likelihood of false positives while maintaining the ability to accurately detect true anomalies.

[0044] However, a key limitation of existing techniques such as randomized smoothing techniques is that they are intended to deal with adversarial perturbations to data or inputs in a continuous input space (e.g., images, audio, video).

[0045] To train an ML model for robust transformations, small perturbations to discrete input samples are generated to fool an ML model trained on the discrete input data. For example, the discrete input data may be categorical, symbolic, or discrete in nature. Examples of such discrete input data may include, but are not limited to, text sequences and categorical variables.

[0046] In computer vision, a transformation can be constructed or generated, for example, by considering a continuous space of imperceptible perturbations around an image pixel. Conversely, language is discrete, and any perturbation is perceptible. Therefore, a robust model must be invariant to semantics-preserving input modifications, such as synonym substitutions, paraphrases, or mistyping. For example, in sentiment analysis, it is common to consider the space of all synonym substitutions.

[0047] Some embodiments are based on the recognition that unified adversarial training to generate robust transformations from different types of discrete input data can be performed by embedding the discrete input data in a continuous space. An ML model or neural network can then be trained to be more robust against adversarial input attacks by using randomized smoothing to generate robust transformations.

[0048] Overview of AI systems 1 illustrates a block diagram 100 of a system 102 in which a neural network 106 is configured to perform or generate robust transformations, according to some exemplary embodiments of the present disclosure. The system 102 refers to a machine or computing system configured to simulate human intelligence processes to perform tasks such as natural language processing, speech recognition, process automation, robotics, machine vision, etc. In one example, the system 102 is configured to perform robust transformations for an ML model, e.g., the neural network 106, by using discrete inputs. In particular, the neural network 106 is configured to develop improved defenses against adversarial input attacks by performing robust transformations on the discrete inputs 104.

[0049] The system 102 includes a neural network 106. The neural network 106 may be a class of machine learning model. For example, the neural network 106 may include interconnected layers of artificial neurons, also known as nodes or units, organized hierarchically. Each node may be configured to receive input signals, process them via an activation function, and generate an output signal that is transmitted to another node in the next layer. Furthermore, different layers of the neural network 106 may include an input layer, a hidden layer, and an output layer. In particular, the input layer receives raw input data, such as discrete inputs 104. Examples of input data may include, but are not limited to, images, text, numbers, etc. Furthermore, each node in the input layer represents a feature or dimension of the discrete input 104. The features of the discrete input 104 are then passed from the nodes in the input layer to the nodes in the hidden layer. The hidden layer may be an intermediate layer between the input layer and the output layer. The hidden layer may perform computations on the discrete inputs 104 through weighted connections between the nodes in the hidden layer. Furthermore, after processing through the hidden layer, the nodes in the hidden layer may pass the processed output to the nodes in the output layer, which generate the final prediction or output of the neural network 106.

[0050] Note that each connection between nodes in a layer is associated with a weight that determines the strength of the connection. In addition, each node may also have an associated bias term that is added to the weighted sum of inputs before applying the activation function. Activation functions introduce nonlinearity into neural networks, allowing them to learn complex relationships in data. Common activation functions include sigmoid, tanh, ReLU (rectified linear unit), and softmax.

[0051] According to this disclosure, discrete input 104 refers to data that can take on only a finite set of distinct values. Examples of discrete input 104 include categorical variables (e.g., gender, color, internet proxy data), text (sequences of words or characters), and discrete features within structured data.

[0052] Typically, adversarial attacks on discrete inputs involve altering the values ​​of discrete features or changing the structure of the discrete input data to induce misclassification or misbehavior in the model.

[0053] According to the present disclosure, neural network 106 utilizes an embedding subnetwork 108 and a transformation subnetwork 110 (collectively referred to as subnetworks 108 and 110) to generate a robust transformation 112 of a discrete input 104. In some examples, subnetworks 108 and 110 are also neural networks, e.g., subsets or portions of the overall architecture of neural network 106. In particular, each of subnetworks 108 and 110 may represent a modular component of the overall architecture of neural network 106. For example, each of subnetworks 108 and 110 may have a particular function or characteristic associated with the operation of neural network 106.

[0054] The system 102 of the present disclosure applies randomized embedded smoothing to a neural network 106 to generate or implement a robust transformation 112 for the discrete input 104. Such a robust transformation 112 may be used to train the neural network 106 and / or for execution of the neural network 106.

[0055] In one example, the neural network 106 may be used for log data anomaly detection, which may receive discrete inputs 104. For example, the discrete inputs 104 may be categorical variables and / or tokens.

[0056] During operation, the system 102 is configured to generate an embedding of the discrete input 104 in a continuous space using the embedding subnetwork 108. The system 102 is further configured to inject noise across multiple independent noise samples in the embedding subnetwork or in the embedding layer. A final output corresponding to the discrete input 104 is further generated by aggregating model outputs from processing the corresponding noise-added input.

[0057] In this regard, randomized input smoothing is performed such that noise injection and aggregation across multiple samples can reduce the impact of adversarial input perturbations. Furthermore, generalizing this to randomized embedding smoothing makes it applicable to discrete inputs 104 that can be fed into a discrete input model with an input embedding layer. In some examples, the performance of the neural network 106 defense can be further enhanced by training or tuning the neural network 106 to regularize the embedding subnetwork.

[0058] 2 shows a schematic diagram 200 of the operation of the AI ​​system 102, according to some example embodiments. FIG. 2 will be described in relation to FIG.

[0059] The AI ​​system 102 is configured to receive discrete inputs 104. Such discrete input data may be received from a variety of sources depending on the nature of the task and the domain of the neural network 106. Some common sources of discrete inputs may include, but are not limited to, categorical variables, text data, sparse data representations, categorical features within structured data, symbolic data, and event-based data.

[0060] In one example, the discrete inputs 104 may be received from categorical variables. For example, a dataset containing categorical variables may include discrete variables representing categories or groups. These variables may include attributes such as gender, ethnicity, product type, customer segment, etc. The neural network 106 may receive the discrete inputs 104 directly from categorical variables encoded as numeric values ​​or one-hot coded vectors.

[0061] In another example, the discrete input 104 may be received from a text data source. For example, because text data is discrete in nature, the text data may include a sequence of discrete symbols, such as characters or words. For example, the neural network 106 may be associated with a natural language processing (NLP) task, such as sentiment analysis, machine translation, or text classification. The neural network 106 or the system 102 may then receive the discrete input 104 as text data. Each word or character in the text data may be represented as a discrete token, which may be encoded using techniques such as word embedding or character embedding.

[0062] In yet another example, the discrete input 104 may be received from a symbolic data source. For example, the neural network 106 or the system 102 may receive the discrete input 104 in the form of symbols, logical predicates, or symbolic representations of concepts and relationships. Such discrete input 104 may be received for tasks related to expert systems, knowledge graphs, and symbolic reasoning.

[0063] Additionally, the system 102 is configured to embed the discrete input 104 into a continuous space using the embedding subnetwork 108 to generate a continuous embedding 204. Typically, an embedding is a method of mapping high-dimensional data, such as the discrete input 104, into a lower-dimensional space, such as the continuous embedding 204, which can be used to convert the non-continuous discrete input 104 into a continuous vector representation for computer processing.

[0064] In one example, the embedding sub-network 108 includes an embedding layer 202, X θ In one example, the embedding sub-network 108 may be configured to represent each discrete value of the discrete inputs 104 as a binary vector, with all elements being zero except for the one corresponding to the exponent of the value. For example, for a categorical variable with three possible values, each of the values ​​may be encoded as a vector of length three. Once encoded, each of the vectors of the discrete inputs 104 may be passed through an embedding layer 202 within the embedded neural network or embedding sub-network 108. The embedding layer 202 may map each of the encoded vectors to a continuous vector representation, also known as an embedding. The embedding layer 202 may include a lookup table X θ where each row corresponds to a unique discrete value, and the embedding sub-network 108 learns to update the values ​​in the lookup table during training to optimize the embedding task.

[0065] According to one example, the embedding subnetwork 108 can be a pre-trained word embedding, such as Word2Vec, GloVe, or FastText, which are trained on large corpora of text data and provide pre-trained embeddings for large vocabularies. These pre-trained embedding subnetworks 108 can capture semantic relationships between words and can be fine-tuned for specific tasks.

[0066] Once embedded in a continuous space, the discrete inputs 104 may be visualized and interpreted using techniques such as scatter plots, heat maps, or clustering algorithms. These visualizations may provide insight into the relationships between different discrete values ​​and how they are represented in the continuous space.

[0067] Additionally, the system 102 is configured to inject a set of random noise 206 of a predetermined magnitude into the continuous embedding 204 to generate a set of perturbed embeddings 208. Injecting the set of random noise 206 into the continuous embedding 204 is beneficial to improving the robustness and generalization of the neural network 106.

[0068] In one example, the set of random noises 206 may be Gaussian noise sampled from a normal distribution. The magnitude of the Gaussian noise may be controlled or adjusted to a predetermined magnitude by adjusting the standard deviation of the normal distribution. Such Gaussian noise introduces random perturbations into the embedding vectors of the continuous embedding 204. In another example, the set of random noises 206 may be adversarial noise that may be carefully crafted to maximize the loss function of the neural network 106 while remaining imperceptible. In yet another example, the set of random noises 206 may be random perturbations that may be added to the continuous embedding vectors by adding small random offsets to each dimension of the continuous embedding 204.

[0069] In some other cases, a set of random noise 206 may be added or injected into the continuous embedding 204 using dropout regularization, data augmentation, or gradient masking. For example, dropout regularization may cause a fraction of the elements in the continuous embedding 204 vector to be randomly set to zero, effectively introducing noise. Additionally, data augmentation may introduce random transformations to the continuous embedding vectors, for example, by rotation, translation, or scaling. Additionally, gradient masking intentionally masks or manipulates the gradients of the continuous embedding vectors.

[0070] The injection of a set of random noise 206 can alter the embedding vectors of the continuous embedding 204 so that they differ slightly from the original representation. This allows the set of perturbed embeddings 208 to defend against adversarial input attacks by essentially drowning out small adversarial perturbations with random noise.

[0071] The system 102 is configured to process each of the set of perturbed embeddings 208 with the transformation sub-network 110 to generate a set of transformations 212. Note that the set of perturbed embeddings 208 refers to embeddings that have been intentionally altered or distorted from their original representation, i.e., altered or transformed from the continuous embedding 204. The alterations are introduced in the form of a set of random noise 206.

[0072] According to one embodiment, the transformation subnetwork 110 is a deep neural network trained for one or a combination of automatic speech recognition, language modeling, and log data modeling. For example, the transformation subnetwork 110 may be a transformer-based model capable of effectively capturing long-term dependencies and contextual information. The transformation subnetwork 110 may be used to perform several tasks, such as modifying an input, i.e., a set of perturbed embeddings 208, to draw conclusions and / or generate outputs. Examples of tasks that may be performed by the transformation subnetwork 110 may include, but are not limited to, language modeling, machine translation, speech recognition, text generation, question answering, text classification, named entity extraction, and summarization.

[0073] To this end, the set of perturbed embeddings 208 may be transformed into a set of transformations 212 based on a transformation task 210 associated with the transformation sub-network 110. The transformation task 210 may indicate a function or type of transformation to be performed on the set of perturbed embeddings 208 to perform a task associated with the transformation sub-network 110 or the neural network 106.

[0074] Further, the system 102 is configured to output a combination of the set of transformations 212 as a robust transformation 112 of the discrete input 104. In one example, the combination of the set of transformations 212 is an aggregation of the set of transformations 212. In another example, randomly selected transformations from the set of transformations 212 may be aggregated to generate the output. The output may be a robust transformation 112 that may form a defense for the neural network 106 and enable the neural network 106 to provide a robust output, i.e., to accurately perform the task even with slight perturbations. For example, in the case of an anomaly detection-based neural network 106, the neural network 106 robustly, or reliably, detects anomalies even when presented with perturbing inputs.

[0075] 3 is a block diagram 300 illustrating the operation of the system 102 for generating adversarial transformations of categorical-valued tensors, according to some embodiments of the present disclosure. FIG. 3 is described in relation to FIGS. 1 and 2.

[0076] In one example, the system 102 may receive a discrete input 104. In one example, the discrete input 104 may include a tensor of one or more categorical values. Such a tensor of one or more categorical values ​​is referred to as a categorical input 302. In another example, the discrete input 104 may correspond to Internet proxy log data. Internet proxy log data refers to records of activity recorded by a proxy server as it processes requests from clients, such as web browsers or other applications, to access resources on the Internet. In particular, the categorical input 302 may correspond to, for example, natural language or log data. The system 102 or the neural network 106 may then be a language model or a log data processing model.

[0077] In one example, the continuous embedding 204 includes a tensor of floating-point values. For example, the continuous embedding tensor 204 may be a multidimensional array containing continuous-valued embeddings for various entities, such as words, phrases, or entities, in the dataset or discrete input 104. The continuous embedding 204 may be a dense, low-dimensional representation of the discrete categorical input 302 that captures semantic relationships and contextual information. The continuous embedding 204 tensor may store numerical representations of entities in a dense vector format. Each entity may be represented by a fixed-size vector, with each element of the vector corresponding to a numerical value. Furthermore, the floating-point values ​​in the continuous embedding 204 tensor may represent real numbers, such as floating-point numbers. These real numbers are used to represent the embedding components (or numerical components) of the continuous embedding vector 304. The floating-point values ​​may be real numbers stored in the tensor to represent learned embeddings for various entities (such as words, phrases, or entities) in the categorical input 302.

[0078] According to an embodiment of the present disclosure, noise perturbations are injected or added (306) to the continuous embedding vector 304. In this regard, a set of random noise 206 may be added to the continuous embedding vector 304. In one example, the set of random noise 206 includes a set of Gaussian noise tensors. The set of Gaussian noise tensors is a tensor containing random noise sampled from a Gaussian (normal) distribution. Gaussian noise is a type of statistical noise characterized by its probability density function, which follows a bell-shaped curve known as a Gaussian distribution. For example, each Gaussian noise tensor has the shape of a tensor with floating-point values. In one example, the number of dimensions of each of the Gaussian noise tensors is referred to as its rank, and the length in each dimension describes its shape. The shape of the Gaussian noise tensor may also be indicated by the floating-point values ​​of the real and fractional parts of the tensor in the continuous embedding 204. Each of the Gaussian noise tensors may also include independent Gaussian samples with a mean of zero and a standard deviation defined by a predetermined magnitude.

[0079] In one example, the floating-point values ​​of the tensor in the continuous embedding 204 represent the magnitude of the tensor elements in the continuous embedding vector 304. When a Gaussian noise tensor is added to the continuous embedding vector 304, the individual elements of the tensor in the continuous embedding vector 304 are altered by adding or subtracting a predetermined magnitude to the floating-point values ​​of the tensor in the continuous embedding 204. For example, the floating-point values ​​are sampled from a specified distribution, such as a Gaussian distribution, in the continuous embedding 204 or continuous embedding vector 304. Furthermore, the Gaussian samples in the Gaussian noise tensor may have a specified mean, i.e., zero, and a standard deviation, i.e., a predetermined magnitude.

[0080] For example, a set of perturbed embeddings 208 may be generated based on adding or subtracting the floating-point values ​​of the tensors of the continuous embedding 204 to a Gaussian noise tensor. In one example, a perturbed embedding from the set of perturbed embeddings 208 is formed by adding the floating-point valued tensor of the corresponding continuous embedding vector to one of the set of Gaussian noise tensors. In other cases, each of the set of perturbed embeddings 208 is formed by performing another mathematical operation, such as averaging, subtraction, division, or multiplication, on the floating-point valued tensors and Gaussian noise tensors of the continuous embedding vectors 304.

[0081] During operation, a categorical input 302, denoted by X, is received. In one example, the categorical input 302 may be a tensor of one or more categorical values. Further, the categorical input 302, X, may be fed to the embedding subnetwork 108 to generate a continuous embedding vector 304, W. The continuous embedding vector 304, W, may be a tensor of one or more embedding vectors comprised of continuous (i.e., floating-point) values. In other words, the continuous embedding vector 304 may be a tensor of floating-point values.

[0082] Additionally, a set of random noise 206 is generated. In one example, the set of random noise 206 may be generated as k independent sets of Gaussian noise tensors 308. For example, the set of Gaussian noise tensors 308 may be Z1,...,Z k and each Z i is the same shape as the tensor of the continuous embedding vector 304, W. Furthermore, each Z i may contain independent Gaussian samples with mean of zero and standard deviation of σ. The values ​​of k and σ are hyperparameters.

[0083] In one example, we denote the tensor of continuous embedding vectors 304 by a Gaussian noise tensor 308, Z1,...,Z kto generate a set of perturbed embeddings 208. The set of perturbed embeddings 208 may be represented as a noisy embedding tensor 310. The noisy embedding tensor 310 may be expressed as

[0084]

number

[0085] (i=1,...,k). The noisy embedding tensor 310 is then fed to the transformation sub-network 110. In one example, the transformation sub-network 110 transforms the noisy embedding tensor 310

[0086]

number

[0087] , Yi,...,Yi. For example, the model layer of the transformation subnetwork 110 may be a hidden layer of the neural network 106. The model layer or transformation subnetwork 110 may be configured to process and transform the input data, i.e., the noisy embedding tensor 310, as it passes through the transformation subnetwork 110. In one example, each model layer of the transformation subnetwork 110 may perform specific calculations on the noisy embedding tensor 310 and may introduce nonlinearities into the operation of the transformation subnetwork 110. For example, the model layer of the transformation subnetwork 110 may include an input layer for receiving the noisy embedding tensor 310, a hidden layer for processing the noisy embedding tensor 310, and a hidden layer for applying the transformations Yi,...,Yi. kand an output layer for generating a set of transformations 212. In this manner, the layers of the transformation subnetwork 110 may transform the noisy embedding tensor 310 to generate the set of transformations 212. In one example, each of the sets of transformations 212 may correspond to a noisy embedding tensor from the noisy embedding tensor 310. For example, different embedding tensors may be transformed differently to generate the sets of transformations 212.

[0088] In one example, an aggregation method 312 can be applied to the set of transformations 212 to generate a final model output, i.e., a robust transformation 112. For example, the robust transformation 112 can be a combination of the set of transformations 212. In one example, an aggregation of each of the set of transformations 212 is performed to generate the final robust transformation 112. Alternatively, an aggregation of randomly selected outputs or transformations from the set of transformations 212 can be performed to generate the final robust transformation 112.

[0089] For example, the aggregation method 312 may be a set of transformations 212, Y1,...,Y k can be aggregated into a final robust transform 112 denoted by Y. The nature of the aggregation itself may vary and may depend on the nature of the set of transforms 212 of the transform subnetwork 110. Details of the aggregation of the set of transforms 212 to produce the final robust transform 112 are described in relation to Figures 4A, 4B and 5.

[0090] Overview of generating robust transformations from a set of transformations 4A is a schematic diagram 400 of an aggregation of a set of transformations 212, according to some example embodiments. FIG. 4A will be described in conjunction with FIGS.

[0091] In particular, an aggregation method 312 may be used to aggregate the set of transformations 212 to generate the final robust transformation 112. According to this example, the aggregation method 312 may correspond to calculating an average 402 for the set of transformations 212. For example, for the transformations 212, Y1,...,Y kEach of the sets of transformations 212 may include a continuous tensor. Furthermore, the final output or robust transformation 112, Y, may be a robust transformation of the categorical input 302. The robust transformation 112 may be determined as the average 402 of the set of transformations 212.

[0092] Figure 4B is a schematic diagram 410 of an aggregation of a set of transformations 212, according to some example embodiments. Figure 4B will be described in conjunction with Figures 1, 2, 3 and 4A.

[0093] In particular, an aggregation method 312 may be used to aggregate the set of transformations 212 to generate the final robust transformation 112 .

[0094] This example is based on the recognition that each of the set of transformations 212 can be a tensor of one or more vectors of logits. The logits can be the raw, unnormalized predictions produced by the transformation sub-network 110 before applying any activation functions. The logits can be the output of the last layer, such as the output layer of the transformation sub-network 110, just before passing through the activation functions. In one example, the set of transformations 212, Y1,...,Y k Each transformation of Y i is a tensor of one or more vectors of logits, i.e., unnormalized log-likelihoods.

[0095] In one example, the set of logits z = z1, z2,..., z n Given (n is the number of classes), the probability vector for each class i may be calculated using a Softmax operation 404 as follows:

[0096]

number

[0097] In the formula, z i is the logit corresponding to class i, and P(y i ) is the probability vector for class i, and e is Euler's number.

[0098] In operation, the system 102 may be configured to convert the tensor of each of the one or more vectors of logits of the set of transformations 212 into a probability vector via a Softmax operation 404 to generate a set of probability vectors 406. The one or more vectors of logits may be a collection of vectors for each of the set of transformations 212 of the categorical input 302. The vectors of logits may be used to compute a set of probability vectors 406 for the set of transformations 212 in parallel using the Softmax operation 404. For example, each logit vector of the set of transformations 212 is converted into a probability vector via the Softmax operation 404. According to this example, the Softmax operation 404 may exponentially function each term and normalize over each vector so that the vector sum is equal to 1, i.e., a probability distribution over the vectors of the set of transformations 212.

[0099] The system 102 may then be configured to aggregate the set of transformations 212 by computing an average 408 of the set of probability vectors 406 in the probability space. In one example, an aggregation method 312 may be utilized to compute an average 408 of the set of probability vectors 406 in the probability space. In this manner, the set of probability vectors 406 are aggregated by averaging 408 to generate an average probability vector. For example, the averaging 408 is performed over the set of probability vectors 406 or probability distributions of the vectors of logits of the set of transformations 212.

[0100] The system 102 may be configured to transform the mean probability vector with the log-likelihood to generate a robust transformation of the discrete input 104. A robust transformation 112 of the discrete input 104 or categorical input 302 is then determined using the mean probability vector.

[0101] Figure 4C is a schematic diagram 420 of an aggregation of the set of transformations 212, according to some example embodiments. Figure 4C will be described in conjunction with Figures 1, 2, 3, 4A and 4B.

[0102] In one example, each transformation Y of the set of transformations 212 i may be a tensor of one or more vectors of logits or probabilities. In this regard, the aggregation method 312 may be based on hard decisions. Hard decisions refer to the process of selecting the vector with the highest probability as the predicted vector for aggregation.

[0103] In one embodiment, the system 102 may be configured to convert each of one or more vectors of logits into a hard decision by selecting the index of the maximum logit value to generate a set of hard decisions 412. In particular, after applying a Softmax operation 404 to the vector of logits, i.e., the raw predictions or outputs generated by the transformation subnetwork 110, a probability distribution over the vectors is generated. The probability distribution may include a set of probability vectors 406 in a probability space, with each vector assigned a probability score between 0 and 1. To generate the set of hard decisions 412, the vector with the highest probability or logit value is selected as the vector to be predicted. In one example, each vector of logits in the set of transformations 212 may be converted into a hard decision by taking the index of the maximum logit value, such as by applying an argmax operation on each logit or set of probability vectors 406, to generate the set of hard decisions 412.

[0104] The system 102 is then configured to aggregate the sets of hard decisions 412 to generate a robust transformation 112 for the discrete input 104. In this regard, the aggregation method 312 may involve aggregating the sets of hard decisions 412 across samples by taking a mode, i.e., by taking a majority vote 414 across each of the sets of hard decisions 412, to generate a final model output or robust transformation 112, Y, for the categorical input 302.

[0105] Training Overview 5 illustrates a flowchart of a method 500 for training the neural network 106 of the AI ​​system 102, according to some exemplary embodiments of the present disclosure. FIG. 5 will be described in conjunction with FIGS. 1, 2, 3, 4A, 4B, and 4C.

[0106] The techniques described above in connection with Figures 1, 2, 3, 4A, 4B, and 4C may be applied to a trained neural network 106 without any further modification other than injecting noise. For example, the performance of the system 102 may be improved by modifying the neural network 106 by adjusting the training procedure used to generate the neural network 106. In one example, the training method 500 of the present example may be applied to a pre-trained neural network, such that the method 500 may be applied to generate transformations of discrete inputs while fine-tuning the neural network. Alternatively, the training method 500 may be applied when the neural network 106 is trained from scratch. The training method begins at 502.

[0107] At 504, training samples of the discrete inputs are embedded in a continuous space with an embedding subnetwork 108 to generate training embeddings. In one example, the system 102 is configured to embed the training samples of the discrete inputs 104 into a continuous space. The neural network 106 is trained using the training samples of the discrete inputs 104 and learns to generate transformations for the training samples. In one example, the embeddings of the training samples in the continuous space may be dense, low-dimensional vector representations of the training samples, such as words, phrases, or entities, that are mapped to a continuous vector space. The embeddings of the training samples may be generated using techniques such as word2vec, GloVe, or an embedding layer within a deep learning model (e.g., transformer).

[0108] In one example, during training of the neural network 106, the training embeddings generated by the embedding subnetwork 108 in continuous space may be bounded or constrained to have uniform norm. For example, bounding may be achieved using hard or soft constraints. In one example, hard constraints may be set by introducing a regularization function in the training embeddings. Alternatively, soft constraints may be set by introducing an additional regularization term in the training objective that aims to regularize the training embeddings.

[0109] At 506, the training embeddings are perturbed multiple times with random noise to generate a set of perturbed training embeddings. In one example, the system 102 is configured to inject random noise into the training embeddings of the training samples in continuous space. In one example, Gaussian noise may be injected into the training embeddings in the embedding layer or continuous space. The Gaussian noise may be applied once per training sample, i.e., the embedding of each training sample may be augmented with Gaussian or random noise. In another example, multiple samples of random noise may be added in parallel. In this regard, the entire randomized embedding smoothing process, including aggregation across multiple outputs, may be simulated during training. To this end, the set of perturbed training embeddings may be training embeddings of the training samples in continuous space, such that each training embedding is injected with or augmented with random noise or multiple samples of random noise.

[0110] At 508, each of the set of perturbed training embeddings is processed by the transformation subnetwork 110 to generate a set of training transformations. In one example, the transformation subnetwork 110 may be associated with tasks such as speech recognition, sentiment analysis, image classification, spam detection, named entity extraction, part-of-speech tagging, recommendation generation, sequence labeling, text classification, and topic modeling. To this end, the transformation subnetwork 110 is trained to generate transformations of input data and predict outputs based on tasks performed on the input data. The transformation subnetwork 110 may then generate outputs as a set of training transformations by processing the set of perturbed training embeddings. As the training embeddings are perturbed, i.e., augmented with noise, they may deviate from their original representation in continuous space. Thus, the set of training transformations generated based on the set of perturbed training embeddings may be adversarial to the training samples, i.e., correspond to an adversarial task. Thus, the set of training transformations may aim to maximize the prediction error or misclassification of the neural network 106 while ensuring that perturbations remain imperceptible.

[0111] At 510, the set of training transforms are combined into a combined training output. In one example, the system 102 may be configured to combine each of the set of training transforms using an aggregation method. For example, the aggregation method may rely on computing a sum, an average, a mean of a probability distribution, or a majority value from hard-decision probability distributions of the set of training transforms.

[0112] At 512, parameters of the embedding subnetwork 108 and the transformation subnetwork 110 are updated based on a loss function of the combined training output. In one example, the loss function may indicate the difference between the predicted combined training output for a training sample and the actual value (ground truth) of the training sample.

[0113] In this manner, neural network 106 is trained with training samples of discrete inputs, such as discrete inputs 104. In particular, neural network 106 is trained with training samples of discrete inputs 104 that have been corrupted with noise or random noise in continuous space. In this manner, neural network 106 is trained to adapt to the presence of random noise 206 added by the defensive method.

[0114] Once the embedding subnetwork 108 and the transformation subnetwork 110 are trained, the neural network 106 is used to generate robust transformations 112 of discrete inputs 104, such as categorical inputs 302. The manner in which robust transformations 112 are generated from discrete inputs 104 is described in detail in connection with Figures 1, 2, 3, 4A, 4B, and 4C. The training method ends at 514.

[0115] In an exemplary embodiment, the neural network 106 is trained to build a defense against adversarial attacks. In one example, the neural network 106 is trained with training data, such as discrete inputs 104, augmented with adversarial examples generated by a standard adversarial attack, such as projected gradient descent, fast sign gradient, or other gradient-based adversarial example generation methods. An exemplary implementation of a system 102 with a neural network 106 trained to detect adversarial attacks is described in conjunction with FIG. 6.

[0116] Overview of the implementation example FIG. 6 illustrates a block diagram 600 for adversarial attack detection using adversarial training, according to some example embodiments of the present disclosure.

[0117] In one example, adversarial attack detection is performed for malware detection, where the goal is to classify software files, shown as software files 602, as benign or malicious based on their characteristics. In cybersecurity, malware detection plays an important role in identifying and mitigating malicious software threats. Traditional machine learning models for malware detection can struggle to generalize well to new or previously unseen malware variants, especially when attackers intentionally craft adversarial samples to evade detection.

[0118] For example, attackers can exploit vulnerabilities in typical ML models by generating adversarial samples, which are modified versions of malware files designed to evade detection while retaining malicious functionality. Adversarial samples can contain subtle modifications that trick traditional ML models into misclassifying them as benign, posing a significant security risk.

[0119] In this regard, adversarial training may be employed to improve the robustness of malware detection models such as neural networks 106 against adversarial attacks.

[0120] As described in this disclosure, the system 102 is configured to defend against adversarial attacks by generating or performing a robust transformation 112 of the discrete input 104. In particular, the system 102 is configured to utilize the embedding subnetwork 108 to embed the discrete input 104 into a continuous space. Additionally, the system 102 adds noise to the embedding of the discrete input into the continuous space. In one example, once the noise is added, the transformation subnetwork 110 may perform task-specific operations on the perturbed embedding. In one example, the discrete input 104 may be related to a malware file. Then, adversarial samples or examples are created by perturbing the malware file's features in a manner that maximizes the loss function of the neural network 106 while ensuring that the perturbed features remain functionally similar to the original features.

[0121] According to this example, the transformation sub-network 110 may be associated with a malware detection task for software files. Furthermore, based on the generation of the transformations of the perturbed embeddings, transformation aggregation may be performed to generate a robust transformation 112 for the discrete input 104. The generation of the robust transformation 112 or the execution of the robust transformation 112 for the discrete input 104 by introducing noise into the discrete input 104 may enable the neural network to build a defense mechanism against adversarial inputs.

[0122] To this end, neural network 106 is trained to perform robust transformations of different types of discrete inputs, such as robust transformation 112 of discrete input 104. Neural network 106 may undergo adversarial training on both the original features of the malware sample and the robust transformations of the features of the malware sample. Such adversarial training causes neural network 106 to learn robust feature representations that are less susceptible to adversarial perturbations. Neural network 106 learns to distinguish between true malware samples and adversarial samples, adjusting its decision boundary and thus improving its ability to detect both known and previously unseen malware variants.

[0123] Once trained, the system 102 and the neural network 106 may be deployed within the network 606 of the user 608. For example, when the user device 604 of the user 608 may receive the software file 602, the system 102 or the neural network 106 may analyze the software file 602 to check for malicious content within the software file 602. In response to detecting malicious content within the software file 602, the user 608 may be warned about the malicious content of the software file 602 and / or the software file 602 may be blocked from receipt at the user device 604. Alternatively, if the software file 602 is found to be useful, the software file 602 may be transferred to the user device 604.

[0124] Through adversarial training, the neural network 106 becomes more robust against adversarial samples created by attackers, ensuring more accurate and reliable detection of malicious software threats, which enhances the security of an organization's network 606 and helps protect against cybersecurity threats that unfold in real-world scenarios.

[0125] Example Discrete Input Overview 7A and 7B illustrate exemplary discrete inputs as Internet proxy log data, according to some exemplary embodiments of the present disclosure.

[0126] Referring to FIG. 7A, a schematic diagram 700A of an exemplary discrete input for Internet proxy log data is shown. The Internet proxy log data 702 is broken down into categorical and numerical features. The Internet proxy log data 702 includes information associated with requests made to the network by users. For example, the Internet proxy log data 702 includes the host ID, client ID, and user ID of the user who requested the network to access a particular website or web content. The Internet proxy log data 702 further includes the date time, time zone, and command used by the user to access the particular website or web content, along with information about the status of the command and the number of bytes used by the command.

[0127] Internet proxy log data 702 is raw data that includes sequences of log entries of Internet traffic requests from many different users, and these sequences of log entries are naturally interleaved in Internet proxy log data 702. Therefore, to detect anomalies in Internet proxy log data 702, an anomaly detector neural network may first have to deinterleave the sequences of log entries generated by different users and then process each user's sequence independently. Furthermore, simply processing all of the sequences while they are interleaved may overload the neural network with additional unnecessary complexity.

[0128] A uniform resource locator (URL) 704 corresponding to one of the deinterleaved sequences may be obtained by an anomaly detector, which decomposes the URL 704 into multiple parts based on multiple features included in the URL 704. The URL 704 includes different information associated with a request made by a user to access a website or web content. The information included in the URL 704 is decomposed into categorical features 706 and numeric features 708. The information decomposed into categorical features 706 includes a method name used by a user to access a website. In this case, the method name corresponds to “GET,” which is the default HTTP method used to retrieve resources from a specific URL. The information included in categorical features 708 further includes a subdomain word, in this case “download,” a domain word, in this case “windowsupdate,” a generic top-level domain (TLD): “co.”, a country code TLD: “.jp,” and a file extension: “.exe.” The subdomain words and domain words may be further categorized into embedded features due to their very large vocabulary sizes.

[0129] Additionally, the information of the URL 704 classified into the numeric features 708 includes the number of levels (#), the number of lowercase characters (#), the number of uppercase characters (#), the number of numeric characters (#), the number of special characters (#), and the number of parameters (#). The data corresponding to each feature is vectorized. The vectorized data corresponding to the categorical features 706 and the numeric features 708 is provided to the system 102 or the neural network 106 for anomaly detection.

[0130] FIG. 7B illustrates a block diagram 700B of a neural network 106 for performing a robust transformation 712 on a discrete categorical input 710 including categorical features 706 and numeric features 708, according to some embodiments of the present disclosure.

[0131] However, the necessary possibilities of adversarial inputs that can be generated from the input 710 may be very large and may have semantic meanings that make it difficult to handle the size and discrete nature of the input 710. Therefore, to handle the size and discrete nature of the input 710 for adversarial training, the neural network 106 performs a robust transformation 712 on each feature of the multiple features present in the URL 704 to convert each word and / or digit into a smaller dimensional feature vector in continuous space to generate a continuous embedding without adding randomness or noise to the discrete values. These embedding vectors (i.e., feature vectors) are then used by the neural network 106 in place of the original discrete features to work with, i.e., perform, the robust transformation.

[0132] To perform a robust transformation 712 on a discrete categorical input 710 (hereinafter referred to as input 710), the neural network 106 is configured to generate a continuous embedding for the input 710 using the embedding sub-network 108. Furthermore, a set of random noise of a predetermined magnitude, such as a set of noise tensors, is injected into the tensors of the continuous embedding of the categorical features 706 and the numerical features 708 to generate a set of perturbed embeddings. Further, each of the set of perturbed embeddings is processed by the transformation sub-network 110 to generate a set of transformations. Based on the combination of the set of transformations, the neural network 106 is configured to output a robust transformation 712 of the discrete input 710.

[0133] The robust transformation 712 performed by the neural network 106 is based on randomized smoothing, where random perturbations are added to the input, i.e., the input embedded in a continuous space 710. The robust transformation 712 is further processed by the neural network 106 or the system 102 to generate results for anomaly detection or adversarial attack detection.

[0134] Overview of an exemplary method 8 illustrates a flowchart 800 of a computer-implemented AI method for generating a transformation of a discrete input 104, according to an exemplary embodiment. FIG. 8 will be described in conjunction with FIGS. 1, 2, 3, 4A, 4B, 4C, 5, and 6.

[0135] At 802, the discrete input 104 is embedded into a continuous space using an embedding sub-network 108 to generate a continuous embedding 204. In one example, the system 102 is configured to embed the discrete input 104 utilizing the embedding sub-network 108. In one example, the continuous embedding 204 of the discrete input 104 may include a continuous embedding vector 304. In one example, the continuous embedding 204 includes a tensor of floating-point values.

[0136] At 804, a set of random noise 206 of a predetermined magnitude is injected into the continuous embedding 204 to generate a set of perturbed embeddings 208. In one example, the set of random noise 206 may be a set of Gaussian noise tensors 308. For example, a Gaussian noise tensor from the set of Gaussian noise tensors 308 may be added to a corresponding tensor of a floating-point value in the continuous embedding 204. In one example, the system 102 is configured to add the set of Gaussian noise tensors to the tensors of the continuous embedding 204 in parallel.

[0137] At 806, each of the set of perturbed embeddings 208 is processed by a transformation sub-network 110 to generate a set of transformations 212. In one example, the system 102 is configured to utilize the transformation sub-network 110, and specifically the hidden layers of the transformation sub-network 110, to transform the set of perturbed embeddings 208 into a set of transformations 212 based on the task for which the transformation sub-network 110 is trained.

[0138] At 808, the combination of the set of transformations 212 is output as a robust transformation 112 of the discrete input 104. Additionally, the system 102 is configured to output the combination of the set of transformations 212 as an aggregate or average of the set of transformations 212. In another example, the system 102 is configured to output the combination of the set of transformations 212 as an average of a probability vector of the set of transformations 212 or as a majority of hard decisions of the probability vector of the set of transformations 212. In this manner, robust transformations are generated from the discrete input 104, enabling the neural network 106 to form a defense against adversarial attacks.

[0139] Example Implementation 9 shows a block diagram of a computer-based AI system 102 for generating a transformation of a discrete input 104, according to an exemplary embodiment. The computer-based AI system 102 includes several interfaces that connect the system 102 to other systems and devices. The AI ​​system 102 includes an input interface 902 configured to accept discrete inputs 104 or categorical inputs 302, where the discrete inputs 104 include discrete data such as internet proxy data, text data, video data, audio data, image data, etc.

[0140] In some embodiments, the AI ​​system 102 includes a network interface controller (NIC) 906 configured to obtain the discrete input 104 via a network 908, which may be one or a combination of a wired and a wireless network.

[0141] A network interface controller (NIC) 906 is adapted to connect the AI ​​system 102 via a bus 910 to a network 908 that connects the AI ​​system 102 to the input device(s) 904. The input device(s) 904 may correspond to a proxy log data recorder that records proxy log data that is provided to the AI ​​system 102 for generating or performing robust transformations corresponding to the proxy log data.

[0142] Additionally or alternatively, the AI ​​system 102 may include a human-machine interface (HMI) 912. The human-machine interface 912 in the AI ​​system 102 connects the AI ​​system 102 to a keyboard 914 and a pointing device 916, which may include a mouse, trackball, touchpad, joystick, pointing stick, stylus, or touchscreen, among others.

[0143] The AI ​​system 102 includes a processor 918 configured to execute stored instructions 920 and a memory 922 that stores instructions executable by the processor 918. The processor 918 may be a single-core processor, a multi-core processor, a computing cluster, or any number of other configurations. The memory 922 may include random access memory (RAM), read-only memory (ROM), flash memory, or any other suitable memory system. The processor 918 may be connected to one or more input and output devices via a bus 910.

[0144] The instructions 920 may implement a method for generating a transformation of a discrete input 104, according to some embodiments. To that end, the computer memory 922 stores the neural network 106, which includes the embedding sub-network 108 and the transformation sub-network 110.

[0145] The embedding subnetwork 108 may generate an embedding of the discrete input 104 in a continuous space as a continuous embedding 204. The continuous embedding may convert the discrete input 104 into a continuous representation while preserving semantic relationships between values ​​of the discrete input 104. Furthermore, a set of random noise 206 is added to the continuous embeddings 204, and a noise sample of a predefined magnitude is added to each embedding in the continuous embeddings 204 to generate a set of perturbed embeddings 208. Furthermore, the transformation subnetwork 110 may transform the set of perturbed embeddings 208 to generate a set of transformations 212 associated with the task. The set of transformations 212 may be combined to generate an output. Such an output corresponds to a robust transformation 112 of the discrete input 104.

[0146] In some embodiments, the output interface 924 may be configured to render the output, i.e., the combination of the set of transforms 212, on a display device 926. Examples of the display device 926 include a computer monitor, a television, a projector, or a mobile device, among others. The computer-based AI system 102 may also be connected to an application interface 928 adapted to connect the computer-based AI system 102 to external devices 930 to perform various tasks.

[0147] Embodiment This description provides only exemplary embodiments and is not intended to limit the scope, applicability, or configuration of the present disclosure. Rather, the following description of exemplary embodiments will provide those skilled in the art with an enabling description for implementing one or more exemplary embodiments. Contemplated are various changes that may be made in the function and arrangement of elements without departing from the spirit and scope of the disclosed subject matter as set forth in the claims.

[0148] In the following description, specific details are given for a thorough understanding of the embodiments. However, it will be understood by those skilled in the art that the embodiments may be practiced without these specific details. For example, systems, processes, and other elements in the disclosed subject matter may be shown as components in block diagram form so as not to obscure the embodiments in unnecessary detail. In other instances, well-known processes, structures, and techniques may be shown without unnecessary detail to avoid obscuring the embodiments. Furthermore, like reference numbers and names in the various drawings indicate like elements.

[0149] Also, particular embodiments may be described as a process that is depicted as a flowchart, a flow diagram, a data flow diagram, a structure diagram, or a block diagram. While a flowchart may describe operations as a sequential process, many of the operations can be performed in parallel or simultaneously. Additionally, the order of operations may be rearranged. A process may terminate when its operations are completed, but may have additional steps not discussed or included in the diagram. Moreover, not all operations in any specifically described process may occur in all embodiments. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, the termination of the function may correspond to a return of the function to the calling function or the main function.

[0150] Furthermore, embodiments of the disclosed subject matter may be implemented, at least in part, either manually or automatically. Manual or automatic implementations may be performed or at least assisted by machine, hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented in software, firmware, middleware, or microcode, the program code or code segments to perform the necessary tasks may be stored on a machine-readable medium. The necessary tasks may be performed by a processor.

[0151] Furthermore, the embodiments of the present disclosure and the functional operations described herein can be implemented in digital electronic circuitry, tangibly embodied computer software or firmware, computer hardware, including the structures disclosed herein and their structural equivalents, or in one or more combinations thereof.

[0152] Furthermore, some embodiments of the present disclosure may be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory program carrier for execution by or to control the operation of a data processing apparatus. Furthermore, the program instructions may be encoded on an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal generated to encode information for transmission to a suitable receiving device for execution by the data processing apparatus. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or one or more combinations thereof.

[0153] Computer programs (which may also be referred to as or described as programs, software, software applications, modules, software modules, scripts, or code) can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program can be stored as part of a file that holds other programs or data, e.g., one or more scripts stored in a markup language document, a single file dedicated to the program in question, or multiple cooperating files, e.g., a file that stores one or more modules, subprograms, or portions of code.

[0154] A computer program can be deployed to be executed on one computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communications network. Computers suitable for executing computer programs include, for example, and may be based on, by way of example, general-purpose or special-purpose microprocessors or both, and any other type of central processing unit. Typically, a central processing unit receives instructions and data from a read-only memory or a random-access memory or both. The essential elements of a computer are a central processing unit for executing instructions and one or more memory devices for storing instructions and data.

[0155] Generally, a computer will also include one or more mass storage devices for storing data, such as magnetic, magneto-optical, or optical disks, or be operably coupled to receive data from or transfer data to them, or both. However, a computer need not have such devices. Furthermore, a computer can be incorporated into another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device, such as a universal serial bus (USB) flash drive, to name a few.

[0156] To provide for user interaction, embodiments of the subject matter described herein may be implemented on a computer having a display device, such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor, that displays information to the user, as well as a keyboard and pointing device, such as a mouse or trackball, that allows the user to provide input to the computer. Other types of devices may also be used to provide user interaction; for example, feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; input from the user may be received in any form, including acoustic input, voice (speech) input, or tactile input. Furthermore, a computer may interact with a user by sending documents to and receiving documents from a device used by the user, for example, by sending a web page to a web browser on the user's client device in response to a request received from the web browser.

[0157] Embodiments of the subject matter described herein may be implemented in a computing system that includes a back-end component, e.g., a data server, or includes a middleware component, e.g., an application server, or includes a front-end component, e.g., a client computer having a graphical user interface or web browser through which a user can interact with an implementation of the subject matter described herein, or any combination of one or more such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communications network. Examples of communications networks include local area networks ("LANs") and wide area networks ("WANs"), e.g., the Internet.

[0158] A computing system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

[0159] Although the present disclosure has been described with reference to certain preferred embodiments, it is to be understood that various other adaptations and modifications can be made within the spirit and scope of the disclosure. It is therefore the object of the appended claims to cover all such variations and modifications that come within the true spirit and scope of the disclosure. [Explanation of symbols]

[0160] 102 Systems, 104 Discrete Inputs, 106 Neural Networks, 108 Embedding Subnetworks, 110 Transformation Networks, 112 Robust Transformations

Claims

1. 1. A computer-implemented artificial intelligence (AI) method for robust transformation of discrete inputs by a neural network including an embedding sub-network and a transformation sub-network, comprising: embedding the discrete input into a continuous space using the embedding sub-network to generate a continuous embedding; injecting a set of random noise of a predetermined magnitude into the continuous embedding to generate a set of perturbed embeddings; processing each of the set of perturbed embeddings with the transformation sub-network to generate a set of transformations; and outputting a combination of the set of transformations as the robust transformation of the discrete input.

2. The AI ​​method of claim 1 , wherein the discrete input comprises a tensor of one or more categorical values.

3. The AI ​​method of claim 1 , wherein the discrete input is internet proxy log data.

4. The AI ​​method of claim 1 , wherein the continuous embedding comprises a tensor of floating-point values.

5. 5. The AI ​​method of claim 4, wherein the set of random noise comprises a set of Gaussian noise tensors, each of the Gaussian noise tensors having the shape of the floating-point-valued tensor and comprising independent Gaussian samples having a mean of zero and a standard deviation defined by the predetermined magnitude.

6. 6. The AI ​​method of claim 5, wherein each of the perturbed embeddings is formed by adding a tensor of the floating-point values ​​to one of the Gaussian noise tensors.

7. 2. The AI ​​method of claim 1, wherein the transformation sub-network is a deep neural network trained for one or a combination of automatic speech recognition, language modeling, and log data modeling.

8. The AI ​​method of claim 1 , wherein the combination of the set of transformations is an aggregation of the set of transformations.

9. The AI ​​method of claim 1 , wherein each of the set of transformations is a continuous tensor such that the robust transformation is determined as an average of the set of transformations.

10. Each of the set of transformations is a tensor of one or more vectors of logits, and the AI ​​method further comprises: converting each of the one or more vectors of logits into a probability vector via a softmax operation to generate a set of probability vectors; averaging the set of probability vectors in a probability space to generate an average probability vector; 2. The AI ​​method of claim 1, further comprising: determining the robust transformation of the discrete input using the average probability vector.

11. 11. The AI ​​method of claim 10, further comprising transforming the mean probability vector with a log-likelihood to generate the robust transformation of the discrete input.

12. Each of the set of transformations is a tensor of one or more vectors of logits, and the AI ​​method further comprises: converting each of the one or more vectors of logits into a hard decision by selecting the index of the largest logit value to generate a set of hard decisions; aggregating the set of hard decisions to generate the robust transformation of the discrete input.

13. The AI ​​method of claim 1 , wherein the neural network is trained with training samples of the discrete inputs.

14. The AI ​​method of claim 1 , wherein the neural network is trained with training samples of the discrete input corrupted with noise in the continuous space.

15. The training includes: Embedding training samples of the discrete input into the continuous space with the embedding sub-network to generate training embeddings; perturbing the training embeddings multiple times with random noise to generate a set of perturbed training embeddings; processing each of the set of perturbed training embeddings with the transformation sub-network to generate a set of training transformations; combining the set of training transformations into a combined training output; and updating parameters of the embedding sub-network and the transformation sub-network based on a loss function of the combined training outputs.

16. 1. An artificial intelligence (AI) system for robust transformation of discrete inputs by a neural network including an embedding sub-network and a transformation sub-network, comprising: a memory for storing instructions; a processor, the processor executing the instructions to embedding the discrete input into a continuous space using the embedding sub-network to generate a continuous embedding; injecting a set of random noise of a predetermined magnitude into the continuous embedding to generate a set of perturbed embeddings; processing each of the set of perturbed embeddings using the transformation sub-network to generate a set of transformations; an AI system configured to output a combination of the set of transformations as the robust transformation of the discrete input;

17. The neural network is trained with training samples of the discrete inputs corrupted with noise in the continuous space, and the processor performs the following steps to train the neural network: embedding training samples of the discrete input into the continuous space using the embedding sub-network to generate training embeddings; perturbing the training embeddings multiple times with random noise to generate a set of perturbed training embeddings; processing each of the set of perturbed training embeddings using the transformation sub-network to generate a set of training transformations; combining the set of training transformations into a combined training output; 17. The AI ​​system of claim 16, configured to update parameters of the embedding sub-network and the transformation sub-network based on a loss function of the combined training outputs.

18. Each of the set of transforms is a tensor of one or more vectors of logits, and the processor further converting each of the one or more vectors of logits into a probability vector via a softmax operation to generate a set of probability vectors; averaging the set of probability vectors in a probability space to generate an average probability vector; 17. The AI ​​system of claim 16, configured to use the average probability vector to determine the robust transformation of the discrete input.

19. 20. The AI ​​system of claim 18, wherein the processor is further configured to transform the mean probability vector with a log-likelihood to generate the robust transformation of the discrete input.

20. 1. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to perform a method for robust transformation of a discrete input by a neural network including an embedding sub-network and a transformation sub-network, the method comprising: embedding the discrete input into a continuous space using the embedding sub-network to generate a continuous embedding; injecting a set of random noise of a predetermined magnitude into the continuous embedding to generate a set of perturbed embeddings; processing each of the set of perturbed embeddings with the transformation sub-network to generate a set of transformations; and outputting a combination of the set of transformations as the robust transformation of the discrete input.

Images