"machine learning reliability"

Abstract

This disclosure relates to generating a combined output from multiple machine learning models. A computer system comprises multiple handling modules, each being configured to: receive multiple machine learning outputs, each of the multiple machine learning outputs being a machine learning output of one of the multiple machine learning models; determine consistent outputs from the multiple machine learning outputs; fuse the consistent outputs to generate a fused output; and send the fused output to other handling modules of the multiple handling modules. Each of the multiple handling modules are further configured to receive multiple fused outputs from the other handling modules; determine a consensus upon receiving a majority number of a group of fused outputs comprising the fused output of the handling module and the multiple fused outputs received from the other handling modules; generate the combined output corresponding to one of the fused outputs; and output the combined output.

Description

"Machine learning reliability"Cross-Reference to Related Applications

[0001] The present application claims priority from Australian Provisional Patent Application No 2024900708 filed on 18 March 2024, the contents of which are incorporated herein by reference in their entirety.Technical Field

[0002] This disclosure relates to generating a combined output from multiple machine learning models.Background

[0003] Artificial intelligence (Al) and machine learning, a branch of Al, have emerged as powerful tools with many different applications. For example, the integration of Al in infrastructures, exemplified by energy load forecasting, has increased the efficiency and accuracy of predicting electricity consumption patterns. The accurate prediction of energy demand allows for optimizing resource allocation, minimizing costs, and ensuring the stability and reliability of power grids. In recent years, the adoption of Al techniques has demonstrated great success in improving the precision of load forecasting.

[0004] However, Al systems and machine learning models may generate undesirable results, and it is difficult for the users and even developers of Al models to know exactly when the undesirable results will generate, why and how. This may be due to the probabilistic nature of some Al models. This creates uncertainty for users of Al and machine learning models, especially when accuracy is necessary like in the application to energy load forecasting, for example. Even if the undesirable results rarely happen, they still affect users’ confidence of deploying Al in critical systems due to the possibility that the machine learning models with provides these undesirable results.

[0005] Moreover, this surge in reliance on Al also brings forth concerns related to the robustness, security, and potential security susceptibility of these models to adversarial attacks, data biases, or unforeseen anomalies. For example, as energy load forecasts directly impact theplanning and operation of energy systems, Al vulnerabilities could compromise the reliability of these forecasts, leading to suboptimal decision-making, resource mismanagement, and potential disruptions in energy supply. Al models, including those used in load forecasting, may be susceptible to security threats aimed at exploiting vulnerabilities to adversely impact Al models, which can undermine the performance, reliability, and integrity of machine learning systems. This further affects the users’ confidence in deploying Al.

[0006] The most two typical threats are (1) backdoor attacks introduced during model training, and (2) adversarial example attacks after model deployment. In a backdoor attack, a malicious actor strategically injects a “backdoor” associated with a so-called trigger into a machine learning model during its training phase. The backdoored model misbehaves per the attacker’s desire when the testing input carries the trigger, while the backdoored model behaves normally for testing input without the trigger. Adversarial example attacks involve manipulating input data to mislead a machine learning model, causing it to make incorrect predictions. Adversarial example attacks are carefully crafted inputs that are perceptually similar to legitimate data (e.g., adding delicate small noise to the legitimate input) but can lead the model to produce inaccurate results.

[0007] The causes of uncertainty for Al systems are diverse, and are summarized as below:• Probabilistic Nature of Al: Current Al techniques are probabilistic in nature, and some machine learning models (such as neural networks) cannot be interpreted, due to being a “black box”, for example. If the input to models is out of distribution of training data (i.e., learned distribution not real distribution), it is not known whether or when desirable results will be generated and even what the desirable results are (e.g., they can be emergent ability for good results or hallucination for bad results as seen in Large Language Models (LLMs), for example).• Various Security attacks on Al: Al models are vulnerable to some well-known attacks, such as adversarial input attack and backdoor attack; they occur at different stages of the Al system lifecycle. The attack technique to Al models keeps evolving. For example, early attack methods to Reinforcement Learning tried to perturb environment observations by assuming the availability of models, while the state-of-the-art attack methods can carry out black-box attacks without access to model parameters. The evolving capability of Al attackers creates further uncertainty, even some countermeasures to specific attack methods have been applied.• Vulnerability of Operating Systems Hosting Al: Al models need to run on computing systems. Computing systems can suffer from cyber- attacks. The Australian Signals Directorate (ASD) Cyber Threat Report 2022-2023 says, on average, one cybercrime is reported every six minutes in Australia. Users of deploying Al systems cannot ensure their systems are absolutely secure because of the large attack surface of modem computing systems. For example, zero-click attacks can compromise a system even when its user does not access a malicious link. A system might already be compromised, but its users may not know (i.e., uncertainty), and the attackers can hide their traces by doing negative things not obvious to normal users (e.g., only stealing model parameters). In addition, there might be also inside attackers and hardware faults like a memory bit flip may cause undesirable results from Al models.

[0008] Current Al deployment tools do not natively support Al reliability. Users have to consider the reliability for each Al application in an ad-hoc way (e.g., a defence method only for backdoor attack). The ad-hoc way might not help users address all reliability uncertainties list above. In addition, the repeated effort might be needed to improve reliability for all Al applications, but there is no guarantee that repeated effort will prove successful. Further, the defence method may not be model agnostic, meaning that the method in one application cannot be applied conveniently to other Al applications.

[0009] Any discussion of documents, acts, materials, devices, articles or the like which have been included in the present specification is not to be taken as an admission that any or all of these matters form part of the prior art base or were common general knowledge in the field relevant to the present disclosure as it existed before the priority date of each of the appended claims.

[0010] Throughout this specification the word “comprise”, or variations such as “comprises” or “comprising”, will be understood to imply the inclusion of a stated element, integer or step, or group of elements, integers or steps, but not the exclusion of any other element, integer or step, or group of elements, integers or steps.Summary

[0011] Disclosed herein are methods for generating a combined output from multiple machine learning models. More specifically, the methods disclosed herein involve determiningconsistency among multiple machine learning outputs and fusing the consistent outputs to provide a machine learning output that is more reliable than any individual machine learning output. The methods disclosed herein also involve determining a consensus of multiple fused outputs in order to increase the reliability of the machine learning output and provide attack and fault tolerance.

[0012] According to the present disclosure, there is provided a method for generating a combined output from multiple machine learning models, the method comprising: performing by each of multiple handling modules: receiving multiple machine learning outputs, each of the multiple machine learning outputs being a machine learning output of one of the multiple machine learning models; determining consistent outputs from the multiple machine learning outputs; fusing the consistent outputs to generate a fused output; sending the fused output to other handling modules of the multiple handling modules; receiving multiple fused outputs from the other handling modules; determining a consensus upon receiving a majority number of a group of fused outputs, the group of fused outputs comprising the fused output of the handling module and the multiple fused outputs received from the other handling modules; in response to determining the consensus, generating the combined output corresponding to one of the fused outputs; and outputting the combined output.

[0013] It is an advantage to determine the consistent outputs from the multiple machine learning outputs and fuse the consistent outputs as the multiple machine learning models may generate undesirable results. As such, the inconsistent outputs can be detected and discarded, thereby providing a more reliable machine learning output. This provides a further advantage that a malicious attack on one or more of the multiple machine learning models can be tolerated and discovered. It is a further advantage to determine the consensus upon receiving a majority number of fused outputs to tolerate one or more handling modules which may be faulty or malicious.

[0014] In some embodiments, determining the consistent outputs from the multiple machine learning outputs comprises:calculating multiple similarity values, each of the multiple similarity values being a similarity value between a pair of the multiple machine learning outputs; calculating a variance of the multiple similarity values; and determining whether the multiple machine learning outputs are consistent upon determining that the variance is above a threshold.

[0015] In some embodiments, upon determining that the multiple machine learning outputs are inconsistent, repeating the above previous method for a subset of the multiple machine learning outputs until the subset of the multiple machine learning outputs is consistent, wherein the consistent outputs correspond to the subset of the multiple machine learning outputs determined to be consistent.

[0016] In some embodiments, the method further comprises representing each of the multiple machine learning outputs by a numerical vector; and each of the multiple similarity values corresponds to a similarity value between a pair of numerical vectors.

[0017] In some embodiments, each of the multiple similarity values corresponds to a cosine similarity value between the pair of numerical vectors.

[0018] In some embodiments, the method further comprises sending the combined output to one or more of the multiple machine learning models.

[0019] In some embodiments, the method further comprises, upon fusing the consistent outputs to generate the fused output, signing the fused output using a private key stored on the handling module.

[0020] In some embodiments, generating the combined output comprises generating the combined output containing signatures of one or more of the multiple handling modules.

[0021] In some embodiments, signing the fused output comprises adding a timestamp to the fused output, the timestamp being indicative of a time that the fused output is signed by the handling module.

[0022] In some embodiments, receiving and sending the outputs between the multiple machine learning models and the other handling modules comprises sending and receiving the outputs to and from multiple message brokers.

[0023] In some embodiments, the method further comprises, performing by each of the multiple message brokers, upon receiving the multiple machine learning outputs, sending the multiple machine learning outputs to each of the multiple handling modules.

[0024] In some embodiments, the method further comprises, upon receiving the multiple machine learning outputs from each of the multiple message brokers, storing the multiple machine learning outputs in a first two-dimensional data buffer at a data location within the buffer, wherein a first dimension is indicative of the multiple message brokers and a second dimension is indicative of the multiple machine learning models; and the data location is associated with one of the multiple message brokers and one of the multiple machine learning models.

[0025] In some embodiments, determining the consistent outputs comprises determining a consensus across the multiple message brokers and then determining the consistent outputs from the first two-dimensional data buffer.

[0026] In some embodiments, the method further comprises, upon receiving the multiple fused outputs from the multiple message brokers, storing each output in a second two-dimensional data buffer at a data location within the buffer, wherein a first dimension is indicative of the multiple message brokers and a second dimension is indicative of the multiple handling modules; and the data location is associated with one of the multiple message brokers and one of the multiple handling modules.

[0027] In some embodiments, determining the consensus comprises determining a consensus across the multiple message brokers and then determining a consensus across the multiple handling modules from the second two-dimensional data buffer.

[0028] In some embodiments, each of the signatures in the combined output corresponds to a signature of one of the multiple handling modules that participates in the consensus across the multiple handling modules.

[0029] In some embodiments, upon receiving the outputs from the multiple message brokers, storing the outputs in the first or second two-dimensional data buffer comprises filling the first or second two-dimensional data buffer asynchronously by storing each output at the respective data location within the first or second two-dimensional data buffer.

[0030] In some embodiments, receiving and sending outputs to and from the multiple message brokers comprises using a messaging protocol, the messaging protocol being one of:Messaging Queue Telemetry Transport (MQTT) protocol;Advanced Message Queuing Protocol (AMQP);Constrained Application Protocol (CoAP); or Data Distribution Service (DDS).

[0031] In some embodiments, the method further comprises, performing by each one of the multiple handling modules, verifying each fused output received from the other handling modules using a public key of each other handling module and discarding the fused output if the signature does not correspond to the other handling module.

[0032] According to the present disclosure, there is provided software that, when installed on a computer and executed by the computer, causes the computer to perform the method of any one of the previously described embodiments.

[0033] According to the present disclosure, there is provided a computer system generating a combined output from multiple machine learning models, the computer system comprising: multiple handling modules, each of the multiple handling modules being configured to: receive multiple machine learning outputs, each of the multiple machine learning outputs being a machine learning output of one of the multiple machine learning models; determine consistent outputs from the multiple machine learning outputs; fuse the consistent outputs to generate a fused output; send the fused output to other handling modules of the multiple handling modules; receive multiple fused outputs from the other handling modules;determine a consensus upon receiving a majority number of a group of fused outputs, the group of fused outputs comprising the fused output of the handling module and the multiple fused outputs received from the other handling modules; in response to determining the consensus, generate the combined output corresponding to one of the fused outputs; and output the combined output.

[0034] In some embodiments, the computer system further comprises multiple message brokers, each configured to receive and send the outputs between the multiple machine learning models and the multiple handling modules.

[0035] In some embodiments, a total number of message brokers is equal to a total number of handling modules.

[0036] In some embodiments, the computer system comprises at least four handling modules.

[0037] In some embodiments, each handling module comprises a first memory configured to store each output received from the multiple message brokers in a first two-dimensional data buffer at a data location within the buffer, wherein a first dimension is indicative of the multiple message brokers and a second dimension is indicative of the multiple machine learning models; and the data location is associated with one of the multiple message brokers and one of the multiple machine learning models.

[0038] In some embodiments, each handling module comprises a second memory configured to store each fused output received from the multiple message brokers in a second two-dimensional data buffer at a data location within the buffer, wherein a first dimension is indicative of the multiple message brokers and a second dimension is indicative of the multiple handling modules; and the data location is associated with one of the multiple message brokers and one of the multiple handling modules.

[0039] Optional features provided in relation to the method, equally apply as optional features to the software and the system. Similarly, optional features provided in relation to the system, equally apply as optional features to the software and the method.Brief Description of Drawings

[0040] An example will be described with reference to the following drawings:

[0041] Fig. la illustrates multiple machine learning models where the input and models are normal.

[0042] Fig. lb illustrates multiple machine learning models where the models are normal, but the input is abnormal.

[0043] Fig. 1c illustrates multiple machine learning models where the input is normal but one of models is backdoored.

[0044] Fig. 2 illustrates a system for generating a combined output from multiple machine learning models.

[0045] Fig. 3 illustrates a further system for generating a combined output from multiple machine learning models.

[0046] Fig. 4 illustrates a method for generating a combined output from multiple machine learning models.

[0047] Fig. 5 shows a first two-dimensional data buffer.

[0048] Fig. 6 shows a one-dimensional buffer, which stores the multiple machine learning outputs after determining a consensus across the multiple message brokers.

[0049] Fig. 7 shows an example one-dimensional buffer that stores the fused output.

[0050] Fig. 8 shows a second two-dimensional data buffer.

[0051] Fig. 9 shows a one-dimensional buffer, which stores the multiple machine learning outputs after determining a consensus across the multiple message brokers.

[0052] Fig. 10 shows an example one-dimensional buffer that stores the combined output.

[0053] Fig. 11 illustrates the architecture of a preferred embodiment of the disclosed systems.

[0054] Fig. 12 illustrates the architecture of the handling modules.

[0055] Fig. 13 shows a graph representing how four Al models react to the increased load.

[0056] Fig. 14 shows a graph representing how four Al models react to the increased temperature.

[0057] Fig. 15 shows a graph representing how four Al models react to the decreased load.

[0058] Fig. 16 shows how four Al models react to the decreased temperature.

[0059] Fig. 17 shows a graph representing how four Al models react to the load with Gaussian random noise.

[0060] Fig. 18 shows a graph representing how four Al models react to the temperature with Gaussian random noise.

[0061] Fig. 19 shows the output comparisons of the normal input and perturbed input in the adversarial attack experiments.

[0062] Fig. 20 shows the cosine similarity of the outputs of any two models in the adversarial attack experiments.

[0063] Fig. 21 illustrates an example of the disclosed method using two models that are backdoored and two models are clean.Description of Embodiments

[0064] Disclosed herein is a method for generating a combined output from multiple machine learning models. Moreover, this disclosure provides a deployment platform for Al models to improve Al reliability by facilitating fusion and / or refinement of the outputs from multiple models. The idea of improving reliability provided by the disclosed method is based on a general principle that the collective output from multiple machine learning models should be more trustworthy than that from an individual model. As such, consistent multiple learning outputs canbe fused together to provide a more reliable result. The disclosed method thereby provides greater user confidence in deploying Al models and hence, increase the reliability of machine learning models.

[0065] The machine learning models being fused could have either the same or different functionalities and could be developed by different groups even at different time periods; fusion can be done incrementally on the disclosed method and system. The disclosed systems are also a decentralized cyber-resilient system without a single point of failure, aiming to improve reliability more comprehensively.

[0066] To illustrate the application of the disclosed method and systems, consider the three mutual monitoring scenarios among multiple machine learning models illustrated in Fig. 1. Fig. la illustrates multiple machine learning models where the input and models are normal. When a normal input X is fed into the four different models, their outputs are highly likely to be similar. Note that due to probabilistic nature of Al models, all model outputs may not be exactly the same even if inputs and models are not attacked or faulty.

[0067] Fig. lb illustrates multiple machine learning models where the models are normal, but the input is abnormal. When a perturbed input X’ is fed into the four models, their outputs are highly likely be divergent. Fig. 1c illustrates multiple machine learning models where the input is normal but one of models is backdoored. When the input X is fed into the four models, their outputs are highly likely be divergent. The disclosed method and systems aim to address these scenarios.

[0068] In existing Al deployment systems, it is difficult to build in redundancy if no entity (such as a computer or server that stores and evaluates one or more machine learning models) actually knows that there are redundant entities in the network. For example, if an entity becomes faulty, it does not communicate to other entities that it has stopped working and the other entities would simply continue operating and assume the entity is operating correctly. Redundancy refers to the principle of using backup network resources to minimise or prevent downtime if there is a power outage, hardware malfunction, human error, system failure, or cyber-attack. It often involves running alternative instances of core network services and building duplicate network infrastructure and, as such, can be difficult to implement in an Al deployment system. However, redundancy is important in an Al deployment system, as itenables continuous communication between the multiple machine learning models, when entities are compromised, such as through a cyberattack or a technical fault.

[0069] The disclosed method and systems use an architecture comprising multiple handling modules (as referred to Byzantine Fault Tolerance Engines or “BFT-Engines”). In this architecture, each component is replicated onto at least four computing nodes (as an example) for supporting attack and fault tolerance of one node. The number of replications is 3* / +l f°rtolerating / compromised nodes, where a compromised node may be maliciously attacked or faulty. For example, a system of four computing node can tolerant one compromised node. In another example, a system of seven computing node can tolerant two compromised nodes.

[0070] The techniques of this disclosure are implemented in BFT-Engine (i.e., handling module), which itself is replicated. To apply these techniques, the administrators of an Al deployment system may simply replicate the network components to tolerate faults and attacks, then connect these network components to a group of BFT-Engines to make the network components work coherently. As such, this provides an advantage to the administrator as there is no need for the administrator to implement the consensus mechanism, as the consensus mechanism is contained within the BFT-Engines.

[0071] The disclosed method and systems enable the Al deployment system to become attack and fault tolerant by introducing redundancy through determining consensus of multiple copies of the machine learning outputs provided by the multiple machine learning models. When enough copies of the machine learning outputs are received, a consensus can be determined, thereby providing more reliability in the machine learning outputs.

[0072] As such, there is no need for a centralised authority to monitor the consensus, as each one of the multiple handling modules determines a consensus independently of the other handling modules. Determining a consensus across the multiple copies of the machine learning outputs enables the Al deployment system to tolerate compromised nodes (such as a handling module), as the machine learning outputs can still communicate through the system, despite the presence of compromised nodes. For example, if there are / compromised nodes, 2* / +l copies may be necessary to determine a consensus.

[0073] The disclosed method and systems address the uncertainties described previously:

[0074] The disclosed method is a cause-agnostic method to improve reliability. There are specific methods, for instance, to defend backdoor attacks or adversary attacks, anomaly detection, and firewalls. A specific tool may not work well in a scenario not originally designed for. For example, if a prediction is not accurate but still in a valid range, anomaly detection may not respond.

[0075] The disclosed method improves reliability irrespective of the uncertainty causes. The disclosed method instead focuses on the results from multiple models and check their consistency based on the requirements that majority of results are consistent, and then consistent results are then fused. In other words, models mutually monitor each other and then fuse with acceptable ones. Note that the involved models can be heterogenous in terms of their functionalities. For example, the models for load forecasting of a building can be fused with the models for vacancy prediction and those for special events.

[0076] The disclosed method has similarity with ensemble learning in simple application scenarios, where the results of multiple models of the same functionality are combined. Ensemble learning does not consider uncertainty caused by attacks to the underlying computing systems (e.g., a single system attack can make all predictions wrong) and ensemble learning usually consider the models of the same functionality. Note that ensemble learning can be deployed over the disclosed systems.

[0077] Moreover, the disclosed method does not need a pre-determined baseline about the model results. Instead, multiple models in the disclosed method provide dynamic monitoring capability to each other. The rationale behind employing redundant models includes several benefits:• Diversity: Redundant models equipped with different architectures and hyperparameters contribute to the diversity within the ensemble. This diversity helps capture various perspectives and nuances of the data, making the ensemble decision more robust and adaptable to different types of anomalies.• Robustness: An ensemble of redundant models is less likely to be sensitive to noise or outliers in the data that might lead to false positives. If a particular model is sensitive to a specific type of noise, the aggregate decision of the ensemble tends to be more reliable. As the sensitivity is more likely not applicable to other models.• Improved Generalization: Redundant models can collectively improve the generalization performance of the ensemble. Each model may specialize in detectingcertain types of anomalies or patterns, and the ensemble combines these specializations to achieve a more comprehensive anomaly detection capability.• Resilience to Model Failures: In real-world scenarios, no single model is perfect, and model failures can occur. Redundant models provide a safety net - if one model fails to detect an anomaly or is attacked, others in the ensemble may compensate for the deficiency, enhancing the overall reliability of the anomaly detection systems.

[0078] The terms “Al” and “machine learning” are used interchangeably throughout this disclosure. This disclosure also describes application of the disclosed method and systems to energy load forecasting. However, it is noted that the disclosed method and systems are not limited to applications in energy load forecasting. More specifically, the disclosed method and systems are applicable to any application of machine learning.SystemExample system 1

[0079] Fig. 2 illustrates example system 200 for generating a combined output from multiple machine learning models. Fig. 2 is one example of a configuration of system 200. However, system 200 is not strictly limited to this configuration and this may be one possible embodiment of system 200. It is noted that system 200 of Fig. 2 is only meant to illustrate an example system which is capable of performing the disclosed method.

[0080] System 200 comprises multiple machine learning models 201. Each of the multiple machine learning models 201 may be the same machine learning model or may each be different machine learning models. Preferably, the multiple machine learning models are, at least, related by their application. For example, each of the multiple machine learning models 201 may be related to energy load forecasting. However, one machine learning model may output an image, while another machine learning model outputs text.

[0081] Each of the multiple machine learning models 201 may receive an input and provide an output based on the received input. For example, a sensor (not shown) may provide a measurement as the input to the multiple machine learning models 201. In some examples, each of the multiple machine learning models 201 receives the same input. Although only four machine learning models are shown in Fig 2, the disclosed method and systems is applicable toany number of machine learning models. Moreover, the number of machine learning models does not need to be equal to the number of handling modules.

[0082] Multiple machine learning models 201 may be stored on a device, such as a smartphone, computer, tablet, a server device, or any other similar device, which comprises memory (such as volatile and non-volatile memory). Such a device may comprise a processor configured to apply, execute or evaluate each of the multiple machine learning models 201 on an input. Multiple machine learning models may be stored by storing the weights that define the model.

[0083] In some examples, multiple machine learning models 201 may be stored on multiple devices. For example, there may be one device for each of the four machine learning models shown in Fig. 2, which may achieve better attach and fault tolerance, as opposed to each of the multiple machine learning models being stored on a single device. In another example, there may be two devices which for stored two machine learning models.

[0084] System 200 comprises a device 202, which may be smartphone, computer, tablet, a server device, or any other similar device. In some examples, device 202 may store software that causes a processor configured to perform parts of the disclosed methods. Device 202 comprises multiple handling modules 210, which may be subscribed to machine learning outputs of the multiple machine learning models 201. Each of the multiple handling modules 210 may also be subscribed to outputs (such as fused outputs) of the other handling modules. As such, the multiple machine learning models 201 and the multiple handling modules 210 may communicate using a publish-subscribe protocol. Similarly, the multiple handling modules 210 may communicate with each other using a publish-subscribe protocol. Other communication protocols, such as JSON over HTTP are equally possible.

[0085] Each of the multiple handling modules 210 may comprise program memory 211 and data memory 212. Program memory 211 is a non-transitory computer readable medium, such as a magnetic hard drive, a solid-state disk or DVD or CD-ROM. Data memory 212 may comprise non-volatile memory, such as an optical disk drive, hard disk drive, solid-state drive, flash memory, storage server or cloud storage, and / or volatile memory, such as cache or RAM. In some examples, program memory 211 and data memory 212 may be collectively known as memory.

[0086] Software, that is, an executable program stored on program memory 211 causes each of the multiple handling modules 210 to perform methods for generating a combined output from multiple machine learning models. For example, once executed, the software may cause each of the multiple handling modules 210 to receive multiple machine learning outputs, determine consistent outputs from the multiple machine learning outputs, fuse the consistent outputs to generate a fused output, send the fused output to other handling modules, receive multiple fused outputs from the other handling modules, determine a consensus upon receiving a majority number of a group of fused outputs, generate a combined output corresponding to one of the fused outputs and output the combined output.

[0087] In this disclosure, fusing or fusion refers to the process or result of joining two or more things together to form a single entity. More specifically, in the context of multiple machine learning outputs, fusing the multiple machine learning outputs refers to joining or combining the outputs to create or generate a single output, the single output being indicative of the multiple machine learning outputs. For example, fusing the outputs may comprise simply summing all the outputs together. In other words, the fused output may be a sum of the multiple machine learning outputs. Fusing the multiple machine learning outputs may also refer to combining or joining the outputs into more than one output. However, the number of original machine learning outputs would be more than the number of fused outputs.

[0088] Having multiple handling modules introduces redundancy into system 200 as it enables the fusion of the machine learning outputs, even if the multiple handling modules 210 are compromised, by establishing a consensus. More specifically, each of the multiple handling modules 210 determines a consensus upon receiving a majority number of a group of fused outputs, where the group of fused outputs comprising the fused output of the handling module and the multiple fused outputs received from the other handling modules.

[0089] In some examples, the multiple handling modules 210 may be implemented in one or more processors of a computer system. As such, performing the functionality of the multiple handling modules 210 may comprise executing program code on the one of more processors. In other examples, each of the multiple handling modules 210 may comprise one of more processors and executed program code stored on program memory 211 to perform the functionality of the respectively module.

[0090] The reference to “one or more processors” or simply “processor” in this disclosure may encompass multiple processors that are individually or together configured (e.g., programmed) to perform the methods disclosed herein. As such, the one or more processors may refer to multiple central processing units (CPUs), application specific integrated circuits (ASICs), field- programmable gate arrays (FPGAs) and / or graphical processing units (GPUs) that are configured to collectively perform the methods disclosed herein.

[0091] Data memory 212 stores the machine learning outputs received from the machine learning models 201, the multiple handling modules 210 or determined by the respective handling module (for example, when fusing the multiple machine learning outputs). The outputs described herein (i.e., the multiple machine learning outputs, the fused outputs, and the combined outputs) may be stored in the form of a JSON file, XML file, or another similar or equivalent file format. The machine learning outputs may represent a class identifier of a classifier, where the class identifier represents that class as which the input was classified. This may be a binary class (0 / 1) or a multi-class (cat / dog / horse / bike) classifier. In other examples, the machine learning outputs are the decimal output values of nodes indicating a likelihood of the class represented by that node. Further, the models may comprise neural networks, random forests, decision trees, regression models and other models.

[0092] Data memory 212 may also store the public key and the private key of the respective handling modules, as well as the public key of the other handling modules. A public key infrastructure (PKI) may be used to bind the public keys with the respective handling module and can be used to make sure the public keys are correct through the use of certificates. For example, the PKI may be the Hypertext Transfer Protocol Secure (HTTPS) protocol or may be based on Secure Sockets Layer (SSL) certificates. The binding of the public keys with their respective handling modules may be established through a process of registration and issuance of certificates at and by a certificate authority (CA), who utilises a root certificate as the private key to “sign” other certificates. A registration authority (RA) may be delegated by a CA to assure valid and correct registration.

[0093] The multiple handling modules 210 may receive data, such machine learning outputs, from data memory 212, as well as from input / output (I / O) port 203. In one example, the multiple handling modules 210 receive outputs from the multiple machine learning models 201 via I / O port 203, such as by using a Wi-Fi network according to IEEE 802.11. The Wi-Fi network maybe a decentralised ad-hoc network, such that no dedicated management infrastructure, such as a router, is required or a centralised network with a router or access point managing the network.

[0094] Although I / O port 203 is shown as a single entity, it is to be understood that any kind of data port may be used to receive data, such as a network connection, a memory interface, a pin of the chip package of a processor implemented in device 202, or logical ports, such as IP sockets or parameters of functions stored on program memory 211 and executed by the multiple handling modules 210. The parameters of functions may be stored on data memory 212 and may be handled by-value or by-reference, that is, as a pointer, in the source code.

[0095] Software may provide a user interface (such as a graphical user interface) presented to the user on device 202. The user interface is configured to accept input (via buttons or text fields etc.) from the user, via a touch screen or a device attached to device 202 such as a keyboard or computer mouse. Device 202 may also include a touchpad, an externally connected touchscreen, a joystick, a button, and a dial. In an example, device 202 may display multiple inputs, such as multiple datasets. The user may select an input by interacting the touch screen or keyboard, which causes the input to be transmitted to each of the multiple machine learning models 201, wherein each of the multiple machine learning models 201 may be applied to the selected input. Device 202 may receive user input (via the user interface, for example) corresponding to “fusion logic” e.g., specifying how the machine learning outputs are fused. The user interface may be indicative of an Al deployment platform, which implements the disclosed method and systems.Example system 2

[0096] Fig. 3 illustrates example system 300 for generating a combined output from multiple machine learning models. Fig. 3 is one example of a configuration of system 300. However, system 300 is not strictly limited to this configuration and this may be one possible embodiment of system 300. It is noted that system 300 of Fig. 3 is only meant to illustrate an example and a preferred system which is capable of performing the disclosed method.

[0097] Similar to system 200, system 300 comprises multiple machine learning models 301. System 300 also comprises device 302, which is similar to device 202. Device 302 further comprises multiple handling modules 310, similar to device 202, which have similar functionality to multiple handling modules 210.

[0098] However, device 302 further comprises multiple message brokers 320. As such, receiving and sending the outputs (such as the multiple machine learning outputs, the fused outputs, and the combined outputs) between the multiple machine learning models 301 and the other handling modules comprises sending and receiving the outputs to and from multiple message brokers 320. In other words, any communication between the multiple machine learning models 301 and the multiple handling modules 310, as well as between the each of the multiple handling modules 310, occurs via the multiple message brokers 320. As such, the multiple machine learning models 301 and the multiple handling modules 310 may communicate using a publish-subscribe protocol via the multiple message brokers 320. Similarly, the multiple handling modules 310 may communicate with each other using a publish-subscribe protocol via the multiple message brokers 320.

[0099] Each of the multiple message brokers 320 may comprise program memory 321 and data memory 322. Data memory 322 may store machine learning outputs received from the multiple machine learning models 301 or the multiple handling modules 310. The data memory 322 may also store the public key of each one of the multiple handling modules 310. Software, that is, an executable program stored on program memory 311 causes each of the multiple handling modules 310 to perform methods for generating a combined output from multiple machine learning models, or communicate messages between the multiple machine learning models 301 and the multiple handling modules 310 (as well as between the multiple handling modules 310 themselves).

[0100] In some examples, device 302 may receive input, such as data, which is to be evaluated on the multiple machine learning models 301. For example, device 302 may be in communication with a sensor (not shown) which performs a measurement and sends the result of that measurement to device 302, wherein the result of the measurement is intended to be input into one or more of the multiple machine learning models 301. In this example, each of the multiple message brokers 320 may receive the input from the sensor. One or more of the multiple message brokers 320 may then transmit the input to one or more of the multiple machine learning models 301. The multiple message brokers 320 may receive data from data memory 322 as well as from the VO port 303. VO port 303 may have similar functionality to I / O port 203 in Fig 2.

[0101] Having multiple message brokers and multiple handling modules introduces redundancy into system 300 as it enables communication between the multiple handling modules 310 and themultiple machine learning models 301 (as well as between the multiple handling modules 310 themselves), even if the multiple message brokers 320 and / or handling modules 310 are compromised, by establishing a consensus.

[0102] In some embodiments, each of the multiple handling modules 310 comprises a first memory configured to store each output received from the multiple message brokers 320 in a first two-dimensional data buffer at a data location within the buffer. A first dimension of the two-dimensional data buffer may be indicative of the multiple message brokers 320 and a second dimension may be indicative of the multiple machine learning models. The data location of the two-dimensional data buffer may be associated with one of the multiple message brokers 320 and one of the multiple machine learning models.

[0103] In some embodiments, each of the multiple handling modules 310 comprises a second memory configured to store each fused output received from the multiple message brokers 320 in a second two-dimensional data buffer at a data location within the buffer. A first dimension of the two-dimensional data buffer may be indicative of the multiple message brokers 320 and a second dimension may be indicative of the multiple handling modules. The data location of the two-dimensional data buffer may be associated with one of the multiple message brokers 320 and one of the multiple handling modules.

[0104] While the multiple message brokers 320 and multiple handling modules 310 are both part of device 302 in Fig. 3, in some examples, they may be on different devices. In one example, the multiple message brokers 320 may be on one server and the multiple handling modules 310 may be on another server. Both servers may be in direct communication with one another or may communicate with one another (such as via the Internet). In some examples, both servers may communicate with each other using a publish-subscribe protocol.

[0105] In some examples, the multiple message brokers 320 and the multiple handling modules 310 may be implemented in one or more processors of a computer system. As such, performing the functionality of the multiple message brokers 320 and / or the multiple handling modules 310 may comprise executing program code on the one of more processors. In other examples, each message broker and handling module may comprise one of more processors and executed program code stored on program memory 311, 321 to perform the functionality of the respectively module.

[0106] The multiple message brokers 320 may use a messaging protocol. As such, communicating the outputs (such as the multiple machine learning outputs, the fused outputs, and the combined outputs) between the multiple handling modules 310 and the multiple machine learning models 301 (as well as between the multiple handling modules 310 themselves) may comprise communicating a message. The message stored on data memory 312, 322 as JavaScript Object Notation (JSON) file, Packet Capture (PCAP) file or a similar / equivalent format, for example. The messaging protocol may be Messaging Queue Telemetry Transport (MQTT) protocol, Advanced Message Queuing Protocol (AMQP), Constrained Application Protocol (CoAP) or Data Distribution Service (DDS) or another similar or equivalent messaging protocol.

[0107] In some examples, a total number of message brokers is equal to a total number of handling modules. For example, as shown in Fig. 3, there are four message brokers and handling modules. In some examples, system 300 comprises at least four handling modules. As such, system 300 would also comprise at least four message brokers. With four handling modules and four message brokers, one of the multiple message brokers 320 or the multiple handling modules 310 may be faulty or compromised, as the handling modules can still reach a consensus. However, it is noted that there may be more message brokers and more handling modules, and the number of message brokers and handling modules do not need to be equal. Moreover, while four machine learning models are illustrated in Fig. 3, there may be any number of machine learning models, and the number of machine learning models does not need to be equal to the number of message brokers or the number of handling modules.

[0108] It is further noted that details provided with the system of Fig. 3 equally apply to the system of Fig. 2. This applies to message protocols and data types as well as to other details described above.Method

[0109] Fig. 4 illustrates method 400 for generating a combined output from multiple machine learning models. Method 400 is performed by each of the multiple handling modules 210. Fig. 4 is to be understood as a blueprint for the software program and may be implemented step-by- step, such that each step in Fig. 4 is represented by a function in a programming language, such as C++ or Java. The resulting source code is then compiled and stored as computer-executable instructions on program memory 211 of the multiple handling modules 210. The multiple handling modules 310 of Fig. 3 may also perform the steps of method 400.Receiving, multiple machine learning, outputs

[0110] Firstly, each of the multiple handling modules 210 receive 401 multiple machine learning outputs. Each of the multiple machine learning outputs being a machine learning output of one of multiple machine learning models 201. That is, the result of applying, executing or evaluate the machine learning model on input. The machine learning model is understood to be a model, such as a mathematical model, which receives input and generates an output based on the input. The machine learning model may be of an architecture, such as, but not limited to, a neural network, for example.

[0111] The multiple machine learning models 201 may be trained and may be considered to be trained machine learning models. This means that the machine learning models have been optimised to learn and recognise patterns in an input and provide an output that is a prediction based on the training it has undergone. Training involves updating weights or parameters (as referred to as hyperparameters) of the machine learning model, which define the machine learning model, to minimise a loss value, thereby creating a trained machine learning model (in other words, a machine learning model trained to generate an output). Updating the weights may be performed using a gradient descent and backpropagation method.

[0112] The machine learning models recited in this disclosure may be stored on data memory 212, 312 storing the weights that define the model. As such, each of the machine learning model may be referred to as a “memory model”, given that it is defined by parameters (i.e., the weights) which can be stored on computer memory. In some embodiments, the machine learning models may be programmed on an integrated circuit, such as a field-programmable gate array (FPGA) or an NVIDIA processing unit. In such an embodiment, the handling modules (or processor(s) that may performed the method or part thereof) may not retrieve the parameters from data memory 212, 313. Instead, an input may be communicated to the integrated circuit and the integrated circuit may apply the machine learning model to the input and generate an output, which is then communicated to the handling modules (or processor(s) that may performed the method or part thereof).

[0113] Integrated circuits, such as FPGAs, can be used where flexibility, speed, and parallel processing capabilities are desired. In such an embodiment, the integrated circuit may be part of device 202 of system 200 and may be considered as a “processor” or “processing unit”. Otherimplementations, such as application specific integrated circuits (ASIC) or neuromorphic architectures are equally useable.

[0114] Applying, executing, or evaluating the machine learning models may involve calling an application programming interface (API) routine to send the input to a server and the server then performs the calculations according to the machine learning model and returns the results. In other examples, applying, executing or evaluating may involve issuing a command to local hardware, such as a local chip, device, machine learning accelerator (e.g., a USB device design to efficiently perform machine learning tasks or NVIDIA’ s Deep Learning Accelerator (DLA)), etc., that has the machine learning model stored thereon and provides a command interface to interact with the model. It is also possible to have a local copy of the machine learning model available so that the calculations are performed by the main processor of the local machine.Other local, remote, or distributed implementations (such as cloud computing environments) are equally useable.

[0115] In some examples, the machine learning models described herein may be a neural network. In further examples, these machine learning models may be a neural network comprising one or more convolutional layers. As such, the machine learning models may perform the methods described herein by creating feature maps using convolutional filters. Such a machine learning model is known as a convolutional neural network (CNN). A CNN is ideal for applications involving images and the image as it accounts for the positioning and shape of objects captures in the image.

[0116] However, other types of machine learning models are equally applicable here, such as K nearest neighbour, decision tree, support vector machines, regression models and other artificial neural networks, such as long short-term memory (LSTM) networks or deep neural networks. The machine learning models described herein may also be a collective of different models. The machine learning models may also be based on a transformer models, which comprises encoder and / or decoder blocks and predictions by ‘tokenising’ the input (such as an image). As such, the machine learning models may also comprise self-attention layers. The machine learning models may output (and hence, the multiple machine learning outputs may be) a numerical value, a generated output (such as a generated image) or some other type of output (such as a word or sentence).

[0117] In some embodiments, the machine learning model may be trained on a broad range of different data such that it can be applied across a wide range of use cases. Such a machine learning model may be referred to as a “foundational model”. Some foundational models that are applicable to the disclosed method include those that are publicly available and / or trained on publicly available data. In other embodiments, the machine learning model may be trained on a specific set of training data, in order to focus the generated outputs of the machine learning model to a specific task or area of interest. In yet other examples, the foundational model is further trained on the specific set of training data to improve the model in the area of interest.

[0118] In some embodiments, the machine learning model is a multimodal machine learning model, in which multiple inputs of different modalities (e.g., text, image data and audio data) are used to provide one or more generated outputs. An example of a multimodal machine learning model is an object detection model, which detects the location of a specific object (specified by input text, for example) in an image. This example model may generate output text that describes the location of the specified object in the image. Although the multimodal machine learning model can be evaluated on multiple input of different modalities, the multimodal machine learning model can also be evaluated on a single input and still generate an output based on the single input.

[0119] The machine learning model may be trained to generate output text based on input text and hence, may be a chat-based machine learning model. The machine learning model may also be referred to as a trained generative language model. Both the input and output text may be in the form of “natural language” (i.e., any language that occurs naturally in a human community by a process of use, such as spoken English, for example). Such machine learning models may be referred to as “chatbots”. A chatbot (which may also be referred to as a chatterbot) is designed to mimic human conversation (using natural language) through text or voice interactions. More particularly, the chatbot responds to input natural language using output natural language. Examples of such chatbots currently include ChatGPT (using GPT-3 or GPT-4), Microsoft’s Bing Chat (which uses OpenAI's GPT-4) and Google’s Bard.

[0120] In more specific examples, the machine learning model may be an LLM. A LLM is a type of artificial intelligence system, characterised by its massive training data and high volume hyperparameters. These language models ingested input text sourced from various sources and use fine-tuning to predict potential tokens or words. This enables them to perform various natural language processing tasks, including sentiment analysis, document classification, and lexicalanalysis, among others. However, their capabilities have extended beyond these tasks to encompass a broader range of applications and industries, such as chatbots, content generation, and even scientific research, demonstrating their versatility and growing significance in the field of Al.

[0121] With reference to system 300 of Fig. 3, each of the multiple message brokers 320 may receive the multiple machine learning outputs from the multiple machine learning models 301. In other words, each of the multiple message brokers 320 receives a copy of the multiple machine learning outputs. Then, upon receiving the multiple machine learning outputs, each of the multiple message brokers 320 may send the multiple machine learning outputs to each of the multiple handling modules 310. As such, each of the multiple handling modules 310 may receive multiple copies of the multiple machine learning outputs. For example, if there are four machine learning models (hence, four machine learning outputs) and four message brokers, each of the multiple handling modules would receive sixteen machine learning outputs.

[0122] In some embodiments, upon receiving the multiple machine learning outputs from each of the multiple message brokers 320, each of the multiple handling modules 310 may store the multiple machine learning outputs in a first two-dimensional data buffer at a data location within the buffer. A first dimension may be indicative of the multiple message brokers 320 and a second dimension may be indicative of the multiple machine learning models 301. The data location may be associated with one of the multiple message brokers 320 and one of the multiple machine learning models 301.

[0123] Fig. 5 illustrates a first two-dimensional data buffer, with first dimension 501 indicative of the multiple message brokers 320 (in this example, the multiple message brokers 320 are MQTT message brokers) and second dimension 502 indicative of the multiple machine learning models 301. Fig. 5 also shows data location 503 which is associated with one of the multiple message brokers 320 and one of the multiple machine learning models 301 (i.e., data location 503 is associated with the first message broker and the first machine learning model). In this example, there are four message brokers and four machine learning models. Further, in this example, the second message broker (denoted MQTT2) is faulty. Note that the outputs from the multiple machine learning outputs are slightly different.Determining consistent outputs

[0124] Each of the multiple handling modules 210 then determines 402 consistent outputs from the multiple machine learning outputs. As the multiple machine learning models 201 may not provide the same output, even if they are the same model, due to the probabilistic nature of Al, determining the consistency among the outputs provides an evaluation of whether the multiple machine learning models 201 are behaving normally. This provides more reliability in the machine learning outputs. Further, inconsistent outputs can be ignored. In some examples, each of the multiple handling modules 210 determines 402 consistent outputs by determining that a majority of the multiple machine learning outputs are consistent. In other examples, each of the multiple handling modules 210 determines 402 consistent outputs by determining that all of the multiple machine learning outputs are consistent.

[0125] In some examples, each of the multiple handling modules 210 determines 402 consistent outputs by applying a mathematical formula or equation to the consistent outputs. In other examples, each of the multiple handling modules 210 determines 402 consistent outputs by determining a difference between pairs of the multiple machine learning outputs. In further examples, each of the multiple handling modules 210 determines 402 consistent outputs by applying an algorithm or logic to the consistent outputs. In yet further examples, each of the multiple handling modules 210 determines 402 consistent outputs by applying a machine learning model to the consistent outputs, such as a neural network.

[0126] It is noted that each of the multiple machine learning models 201 may provide a different output format (e.g., one machine learning model may output an image, while another machine learning model outputs text), and hence, each of the multiple handling modules 210 may apply an algorithm, a further machine learning model or some other form of logic to determine consistency.

[0127] It is noted that if one or more of the multiple handling modules 210 determines that one or more or all of the multiple machine learning outputs are inconsistent, the one or more of the multiple handling modules 210 may transmit an alert (to a user interface, for example) and may provide details of the inconsistency. This could be used to determine whether one of the multiple machine learning models 201 is compromised, for example. The one or more of the multiple handling modules 210 may also discard the multiple machine learning outputs if inconsistency is determined and hence, may not proceed with the remainder to method 400.

[0128] In a specific example, determining consistency may be implemented by the algorithm called output distance measurement over the multiple machine learning models 201. This involves determining similarity values between pairs of the multiple machine learning outputs and determining whether each of the similarity values are over a threshold value. In some examples, a variance is calculated from all of the similarity values and the multiple machine learning outputs are determined to be consistent if the variance is above a threshold value.

[0129] In other words, in some embodiments, each of the multiple handling modules 210 determines 402 the consistent outputs from the multiple machine learning outputs calculating multiple similarity values. Each of the multiple similarity values may be a similarity value between a pair of the multiple machine learning outputs. Each of the multiple handling modules 210 may then calculate a variance of the multiple similarity values. Each of the multiple handling modules 210 may then determine whether the multiple machine learning outputs are consistent upon determining that the variance is above a threshold.

[0130] An example of the output distance measurement is now provided. Given m machine learning models, suppose the ith model takes as some input and generates an output vector v;. As such, in some embodiments, each of the multiple machine learning outputs may be represented a numerical vector. Hence, each of the multiple similarity values may correspond to a similarity value between a pair of numerical vectors. For example, the output vector v can be a prediction from a LSTM model, or it can be the generated contents from LLMs after they are converted into embedding vectors, or a single numerical value can be represented as bit vectors. In other examples, the output may be a generated image and the corresponding output vector may be a flattened serialised version of the generated image e.g., each element in the vector corresponds to a pixel value in the generated image.

[0131] Suppose the function D(y,v') calculates the distance of vector v and v' . In some embodiments, D(y,v") is a cosine similarity function and, as such, in some embodiments, each of the multiple similarity values corresponds to a cosine similarity value between the pair of numerical vectors. However, in other embodiments, the similarity values may be calculated in a different manner. For example, the similarity values may be calculated from a difference (or the absolute difference) between the pair of numerical vectors.

[0132] Then, the output distance measurement works as follows:• For each pair v;and v;. , where 1 < i < j < m, calculate ( -l) / 2 distance values.• Compare the variance of these distance values with a threshold value, specific for application scenario.• If the variance is larger than the threshold, all results are considered not consistent.

[0133] The threshold may be based on the application. For example, applications in critical infrastructures may require a higher threshold given the level of accuracy and reliability needed for Al deployment. The threshold may be based on user input.

[0134] Furthermore, the above consistency measurement method may also be reiterated to determine whether m -1 results out of m results are consistent if one the results of ‘bad’ models need to be discarded. As such, in some embodiments, upon determining that the multiple machine learning outputs are inconsistent, each of the multiple handling modules 210 may repeat the above measurement method for a subset of the multiple machine learning outputs. Each of the multiple handling modules 210 may repeat the above measurement method until the subset of the multiple machine learning outputs is consistent. The consistent outputs of 402 would thereby correspond to the subset of the multiple machine learning outputs determined to be consistent.

[0135] In some examples, the subset may be a majority number of the multiple machine learning outputs to ensure that a majority of the multiple machine learning outputs are consistent. For example, if there are four machine learning outputs, then the subset would be three of the four machine learning outputs. In other examples, there may be a higher threshold for consistency, for which each of the multiple handling modules determine that m -1 of the multiple machine learning outputs are consistent. For example, m may be more than three.Fusing consistent outputs

[0136] Each of the multiple handling modules 210 then fuses 403 the consistent outputs. By fusing 403 the consistent outputs, each of the multiple handling modules 210 generates 404 a fused output. Each of the multiple handling modules 210 may fuse 403 the consistent outputs by averaging the consistent outputs. In other examples, each of the multiple handling modules 210 may fuse 403 the consistent outputs by applying a mathematical equation or formula to the consistent outputs. In further examples, each of the multiple handling modules 210 may fuse 403 the consistent outputs by applying a machine learning model, such as a neural network. The output of the machine learning model may correspond to the fused output. In even furtherexamples, each of the multiple handling modules 210 may fuse 403 the consistent outputs by applying an algorithm or other type of logic of the consistent outputs. In one example where the consistent outputs are images, each of the multiple handling modules 210 may fuse 403 the consistent outputs by overlapping one image on another image.

[0137] 402-404 of method 400 may be considered as “fusion logic”. This “fusion logic” may be specified by a user of system 200. As such, a user may specify how the consistent outputs are determined e.g., how the similarity values are calculated, the number of multiple machine learning outputs needed for consistent etc. A user may specify how the consistent outputs are fused e.g., by specifying a mathematical formula that fused the consistent outputs or an algorithm that fuses the consistent outputs.

[0138] It is noted that each of the multiple machine learning models 201 may provide a different output format (e.g., one machine learning model may output an image, while another machine learning model outputs text), and hence, each of the multiple handling modules 210 may apply an algorithm, a further machine learning model or some other form of logic to fuse the consistent outputs. For example, if one machine learning model may output an image while another machine learning model outputs text, fusing the consistent outputs may involve overlaying the text on the image.

[0139] In some examples, fusion logic consists of the following two steps and the checking conditions in each step can be configurable for specific application scenarios:• Check the consistency of among all results (i.e., the multiple machine learning outputs) o If all results are considered consistent, then all results are reserved to the next step. Note that results from different models can be heterogenous; some results are used to enhance the consistency checking of other results. o If majority of results are consistent, then the majority of results are then passed to the next step; o If most (or a majority of) results or no results are not consistent, then the model results can be discarded with an application- specific special result returned (e.g., an attack alert), or only minority of consistent results are returned.• Take the consistent results from the last step and generate the results in an applicationspecific way. If the results are numerical predictions, then they can be fused by averaging, or weighted sum. If the results are more complex objects like generated images or texts, they can be fused with another Al model.o Some results of Al models can be used to determine how to fuse the other results.

[0140] With reference to system 300 of Fig. 3, each of the multiple handling modules 310 may determine 402 the consistent outputs by determining a consensus across the multiple message brokers 320 and then determining the consistent outputs from the first two-dimensional data buffer. For example, and with reference to Fig. 5, each of the multiple handling modules 310 may determine a consensus across the multiple message brokers 320 from the first two- dimensional buffer. More specifically, each of the multiple handling modules 310 may determine a consensus across the multiple message brokers 320 using the columns of the first two- dimensional buffer. Each of the multiple handling modules 310 may determine a consensus across the multiple message brokers 320 by determining there are a majority number of the same output.

[0141] For example, in the each of the columns of the two-dimensional of Fig. 5, three out of the four message brokers have provided the same output. The second message broker has not provided an output as it is faulty. However, in some examples, one or more of the message brokers or handling modules may be compromised, in which an attacker has manipulated or taken control of the message broker or handling module. As such, in some examples, the one or more message broker or handling module may provide different outputs. In the example shown in Fig. 5, as there is a majority number of the same outputs (i.e., three out of four) in each column, the handling module determines a consensus across the multiple message brokers 320.

[0142] After determining a consensus across the multiple message brokers 320, each of the multiple handling modules 310 may determine the consistent outputs from the first two- dimensional data buffer. For example, each of the multiple handling modules 310 may use a row of the first two-dimensional data and consider the elements where a consensus was determined.

[0143] In another example, after determining a consensus across the multiple message brokers 320, each of the multiple handling modules 310 may store the outputs in a one-dimensional buffer. Fig. 6 shows a one-dimensional buffer, which stores the multiple machine learning outputs after determining a consensus across the multiple message brokers 320. In other words, the one-dimensional buffer is based on the two-dimensional buffer. The handling module would then determine the consistent outputs using the multiple machine learning outputs in the onedimensional buffer.

[0144] In some embodiments, after fusing 403 the consistent outputs and generating 404 the fused output, each of the multiple handling modules 210, 310 may store the fused output in a one-dimensional buffer. Fig. 7 shows an example one-dimensional buffer that stores the fused output. The one-dimensional buffer of Fig. 7 may also store the consensus prediction determined at a later point in method 400. In this example, the multiple machine learning outputs shown in Fig. 6 are all determined to be consistent, and the fused output shown in Fig. 7 is generated by averaging the consistent outputs of Fig. 6.

[0145] Each of the multiple handling modules 210 then sends 405 the fused output to other handling modules of the multiple handling modules. As such, each of the multiple handling modules 210 then receives 406 multiple fused outputs from the other handling modules. For example, if there are four handling modules, each handling modules receives three fused outputs. Therefore, each handling module will have four copies of the fused output i.e., three fused outputs received from the other handlings modules and the fused output determined on the respective handling module. In some examples, each of the multiple handling modules 210 may receive the fused output that itself has determined and use the received fused output rather than the stored fused output.

[0146] In some embodiments, each of the multiple handling modules 210 may sign the fused output using a private key stored on the handling module. Hence, each of the multiple handling modules 210 then receives 406 multiple fused outputs from the other handling modules, each of the multiple fused outputs can be distinguished from other another as they contain the signature of the originating handling modules. The private key may be cryptography linked to a public key that may be distributed to each of the multiple handling modules 210. The key pair may be based on asymmetric key techniques, such as, but not limited to, Diffie-Hellman key exchange protocol, Elliptic-curve cryptography or Rivest-Shamir-Adleman (RSA) encryption algorithm, for example. Each of the multiple handling modules 210 may also add a timestamp to the fused output. The timestamp would be indicative of a time that the fused output is signed by the handling module.

[0147] Each of the multiple handling modules 210 may verify the signature of one or more of the multiple fused outputs received from the other handling modules using the public key of the other handling modules. Each of the multiple handling modules 210 may then discard the fused output if the signature does not correspond to the other handling module.Determining a consensus

[0148] Each of the multiple handling modules 210 then determines 407 a consensus upon receiving a majority number of a group of fused outputs. The group of fused outputs may comprise the fused output of the handling module and the multiple fused outputs received from the other handling modules. For example, if there are four handling modules, the group of fused outputs would comprise three fused outputs received from the other handling modules and the fused output determined on the respective handling module. However, as each of the multiple handling modules 210 may receive a fused output that itself determines, the group may comprise all received fused outputs.

[0149] With reference to system 300 of Fig. 3, after generating 404 the fused output, each of the multiple handling modules 310 may send 405 the fused output to other handling modules of the multiple handling modules via the multiple message brokers 320. More specifically, each of the multiple handling modules 310 may send the respective fused output to each of the multiple message brokers 320. For example, if there are four handling modules, each of the multiple message brokers 320 receives four fused outputs.

[0150] Each of the multiple message brokers 320 may then send their fused outputs to each of the multiple handling modules 310. As such, each of the multiple handling modules 310 received multiple copies of the fused outputs. For example, if there are four handling modules and four message brokers, each message broker would have four fused outputs and hence, each of the four handling modules would receive sixteen fused outputs.

[0151] In some embodiments, upon receiving the multiple fused outputs from the multiple message brokers, each of the multiple handling modules 310 may store each output in a second two-dimensional data buffer at a data location within the buffer. A first dimension may be indicative of the multiple message brokers and a second dimension may be indicative of the multiple handling modules. The data location may be associated with one of the multiple message brokers and one of the multiple handling modules.

[0152] Fig. 8 illustrates a second two-dimensional data buffer, with first dimension 801 may be indicative of the multiple message brokers 320 (in this example, the multiple message brokers 320 are MQTT message brokers) and second dimension 802 indicative of the multiple handling modules 310 (in this example, each of the multiple handling modules 310 sign their respective fused outputs). Fig. 8 also shows data location 803 which is associated with one of the multiplemessage brokers 320 and one of the multiple handling modules 310. In this example, there are four message brokers and four handling modules. Further, in this example, the second message broker (denoted MQTT2) is faulty.

[0153] In some embodiments, each of the multiple handling modules 310 may determine the consensus comprises determining a consensus across the multiple message brokers 320 and then determining a consensus across the multiple handling modules 310 from the second two- dimensional data buffer. This is similar to determining a consensus across the multiple message brokers 320 in the first two-dimensional. More specifically, in the example shown in Fig. 8, as there is a majority number of the same outputs (i.e., three out of four) in each column, the handling module determines a consensus across the multiple message brokers 320.

[0154] For example, if there are four handling modules and four message brokers, the two- dimensional data buffer would resemble a 4 x 4 table (or matrix). Determining a consensus across the multiple message brokers 320 may comprise checking each row of the data buffer and determining whether there are three or more signed message in each row. Determining a consensus across the multiple handling modules 310 after determining a consensus across the multiple message brokers 320 may comprise checking whether three or more rows of the data buffer have reached a consensus. However, if a handling module does not determine a consensus, then the correspond handling module may send an alert or an error message, which contains log data or information relating to why a consensus was not reached.

[0155] After determining a consensus across the multiple message brokers 320, each of the multiple handling modules 310 may determine a consensus across the multiple handling modules 310 from the second two-dimensional data buffer. For example, each of the multiple handling modules 310 may use a row of the second two-dimensional data and consider the elements where a consensus (across the multiple message brokers 320) was determined.

[0156] After determining a consensus across the multiple message brokers 320, each of the multiple handling modules 310 may store the outputs in a one-dimensional buffer. Fig. 9 shows a one-dimensional buffer, which stores the multiple machine learning outputs after determining a consensus across the multiple message brokers 320. In other words, the one-dimensional buffer is based on the two-dimensional buffer. The handling module would then determine the consensus using the fused prediction in the one-dimensional buffer. As the one-dimensional buffer is based on the two-dimensional buffer, the handling module determines the consensusfrom the second two-dimensional data buffer. As the fused output is the same for each handling module, each of the multiple handling modules 310 determines a consensus.

[0157] In response to determining 407 the consensus, each of the multiple handling modules 210 then generates 408 a combined output corresponding to one of the fused outputs. More specifically, each of the multiple handling modules 210 then generates 408 a combined output corresponding to one of the fused outputs that participates in the consensus. In some embodiments, each of the multiple handling modules 210 generates 408 the combined output containing the signatures of one or more of the multiple handling modules. In some examples, each of the signatures in the combined output may correspond to the signature of one of the multiple handling modules that participates in the consensus across the multiple handling modules. For example, the combined output based on the fused outputs shown in Fig. 9 would contain the signatures of each of the four handling modules. However, not all handling modules may participate in the consensus. For example, one or more of the multiple handling modules 210 may be faulty or compromised.

[0158] In some embodiments, after determining 407 a consensus and generating 408 the combined output, each of the multiple handling modules 210, 310 may store the combined output in a one-dimensional buffer. Fig. 10 shows an example one-dimensional buffer that stores the combined output. The one-dimensional buffer of Fig. 10 is the same one-dimensional buffer as shown in Fig. 7.

[0159] In some embodiments, upon receiving the outputs from the multiple message brokers, each of the multiple handling modules 210, 310 may store the received outputs in the first or second two-dimensional data buffer by filling the first or second two-dimensional data buffer asynchronously by storing each output at the respective data location within the first or second two-dimensional data buffer. In other words, the data buffer may not store the received output in order of the corresponding message broker, handling modules or machine learning model, but rather the received outputs may be stored as they are received by the respective handling module.

[0160] Finally, each of the handling modules outputs 409 the combined output. For example, system 200 may comprise a screen or monitor and each of the handling modules outputs 409 the combined output by displaying the combined output on the screen or monitor. There may be devices that are subscribes to the combined output and receive the combined output upon each of the multiple handling modules outputting 409 the combined output. In some examples, one ormore of the multiple handling modules 210 may output 409 the combined output, rather than each of the handling modules 210 outputting 409 the combined output.

[0161] In some embodiments, each of the multiple handling modules 210 may send the combined output to one or more of the multiple machine learning models 201. As such, the combined output may be compared to the output of one or more of the multiple machine learning models 201 to determine whether the respective output is consistent with the combined output. This can provide an indication of whether the one or more machine learning models are faulty or compromised.Preferred embodiment

[0162] Fig. 11 illustrates the architecture of a preferred embodiment of the disclosed systems. The disclosed method and systems can be implemented as a platform for generating a combined outputs from multiple machine learning models. More specifically, the disclosed method and systems can be implements as an Al deployment platform. This platform enables multiple users to upload multiple machine learning models and generate a combined outputs of their multiple learning models using the method described herein. The platform may also provide a fusion logic library, which stores different fusion logic, and the multiple users can browse and access for generating the combined output of their multiple machine learning models.

[0163] To access this platform, users provide their data, machine learning models (or the access to model services, such as an LLM service), and fusion logic. There may be a fusion logic library that contains multiple instances of fusion logic that users can access. The fusion logic library may be stored a server. The data may be published into the platform with a topic specific for the user. As such, the multiple message brokers (i.e., the MQTT brokers) may be subscribed to the specific topic and may publish the input data to the corresponding machine learning models.

[0164] The Python code of Al models from the user may be wrapped up with the platform model management, which is also written in Python. The model management subscribes the input data with the specified topic, executes the model with input data, and publishes the result to the platform. The result is associated with a user-specific topic. The combined model management and the model itself can be executed on a computer managed by the user. If the user can access a model service (e.g., an LLM), the user can prepare a proxy and combine the proxy with platform model management.

[0165] Users may prepare their specific fusion logic and load it into the platform. The fusion logic is also in Python code but with some pre-defined formats. Fusion logic may also be defined using JAVA script or another similar or equivalent format. The fusion logic may be executed on the platform. Based on fusion logic, results from multiple machine learning models are fused on each BFT-Engine and then the consensus will be achieved among multiple BFT-Engines (tolerating the problem if one BFT-Engine is attacked). The result with consensus is published by each BFT-Engine. Users may also run local BFT-Engines to avoid uploading fusion logic.Design of the multiple handling modules

[0166] The multiple handling modules 210, 310 are synonymously referred to as BFT-Engines. These are programmable and based on the configurations and programs defined by users for their applications. As such, BFT-Engines process machine learning outputs (such as the outputs from the multiple machine learning models 201, 301, or the fused outputs) and then publish back the results. In other words, a user may program the BFT-Engines by defining a set of rules e.g., fusion logic. Note that depending on users’ programs, the results might be broadcast from one BFT-Engine to other BFT-Engines for further processing (e.g., to achieve consensus).

[0167] Fig. 12 illustrates the architecture of the handling modules. More specifically, Fig. 12 illustrates the high-level architecture of these modules. The configurations (such as the set of rules that dictate the fusion logic) may loaded into BFT-Engine via its Management component, which also installs or uninstalls programs. BFT-Engine may have an interpretation engine to process the installed programs. Note that all BFT-APP Handlers may take, as input, the same configurations and programs. In other words, the same set of rules may be stored on each BFT- Engine. In some examples, the interpretation engine of each BFT-Engine may process messages from the multiple message brokers 320. In some examples, each BFT-Engine may an interpretation engine for each message broker. As such, Fig. 12 corresponds to an example where there are four message brokers.Configurations and Programs

[0168] In system 300, each of the multiple handling modules 310 (i.e., each BFT-Engine) may have two types of configurations: general, and connectivity of network components.

[0169] General configuration

[0170] MQTT brokers are used as an example to represent publish-subscribe services (i.e., the multiple message brokers 320). However, it is noted that other publish-subscribe protocols may be used by the multiple message brokers 320. The general configuration of the message brokers 320 may include the following elements:• The public key of each BFT-Engine: the public key is used to verify the digital signatures of messages signed by a BFT-Engine; the verification ensures the integrity and authenticity of messages. Each BFT-Engine should have the corresponding private key, which is kept secret. As such, the private key of each BFT-Engine is stored in data memory 312 of the respective BFT-Engine and is not accessible by any other BFT- Engine or message brokers.• IP addresses of MQTT brokers and extra information for connection: this information may enable BFT-Engine to communicate correctly with MQTT brokers. The IP addresses of the MQTT brokers may be stored in data memory 312.• The number of compromised or faulty nodes (in a replicated group) that can be tolerated, denoted by / . For a system with 3* / +l nodes (such as the multiple message brokers 320 and the multiple handling modules 310), / number of these node may be compromised or faulty. As an example, a replicated group includes four nodes of the same type of component, and the number / in this example is one, meaning that one node (e.g., MQTT broker, or BFT-Engine) may be attacked or faulty. The nodes from different groups can be independently attacked or compromised. For example, a MQTT broker node and a BFT-APP-Node may be attacked or faulty at the same time. As such, if there are / compromised nodes, then 2* / +l uncompromised nodes may be used to determine a consensus. 2* / +l may be used as a consensus threshold throughout this disclosure. For example, if there is one compromised node, then three uncompromised modes may be used to determine a consensus. As such, three may be considered as the consensus threshold. In another example, if there are two compromised nodes, then five uncompromised modes may be used to determine a consensus. As such, five may be considered as the consensus threshold.• The default time-out value for buffers in BFT-Engines.

[0171] Connectivity of Network Components

[0172] A network component (e.g., a sensor) may connect with a group of replicated MQTT brokers in two ways. In the first way, a sensor connects to all MQTT brokers. Messages (such asmeasurements which are used as input into the multiple machine learning models 301) are thus published to all MQTT brokers. This way of connectivity enables the client to be able to publish one message to all message brokers. Hence, the message may not be blocked if one MQTT broker does not function well. The implementation of sensors might need to be changed for this connectivity. In the second way, a sensor or other network component connects only to one MQTT broker and its implementation does not change if it already supports publish / subscribe communication model.Experiments

[0173] Experiments are carried out to detect attacks to machine learning models with the disclosed method. The following experiments use machine learning models that are applicable to energy load forecasting.Sensitivity to Perturbed Input

[0174] As previously discussed, the disclosed method involves harnessing the ensemble knowledge of multiple machine learning models with varying architectures to achieve not only anomaly detection but also prevention. The intuition is grounded in the idea that diversity of Al gives rise to different sensitivity levels to the input changes.

[0175] Anomaly Detection

[0176] A set of diverse Al models with different sensitivity may respond differently to the same input perturbation, while maintaining consistent responses to normal inputs. The intuition behind it is that the different Al models are trained with the same normal data to learn the normal data pattern so that they would behave consistently. However, when they are fed into perturbed data they have never met during training, they would behave quite differently.

[0177] Anomaly Prevention

[0178] Provided that a set of diverse Al models would respond differently to the same input perturbation, the average outputs (e.g., predictions) of different models can offset each other so as to reduce the impact of the Al models with high sensitivity.

[0179] Experimental Setting

[0180] For these experiments, four different models are pre-trained: (1) LTSM, (2) DENSE (i.e., a dense neural network), (3) GRU (Gated Recurrent Unit) and (4) CNN (convolutional neural network) using the time-series energy consumption data. As such, the different models provide predictions related to energy load forecasting. The models are fed a 48-timeslot input vector and output a 24-timeslot output vector.

[0181] Pilot Study

[0182] In the following, a pilot study was conducted to demonstrate and test the disclosed method. Three different ways of changing inputs was applied to see how Al models react to the changes. Cosine similarity values between the normal predictions and perturbed predictions were calculated for each model, respectively. The cosine similarity value between the average normal predictions and average perturbed predictions of the four models was also calculated.

[0183] Series-1: the load and temperature inputs were increased to see how Al models reacts to the changes.

[0184] Fig. 13 shows a graph representing how four Al models react to the increased load. Fig. 14 a graph representing shows how four Al models react to the increased temperature. It can be seen that DENSE and CNN models are more sensitive to the load change while LSTM and GRU are more sensitive to temperature change.

[0185] Series-2: the load and temperature inputs were decreased to see how Al models reacts to the changes.

[0186] Fig. 15 shows a graph representing how four Al models react to the decreased load. Fig. 16 shows a graph representing how four Al models react to the decreased temperature. It can be seen that DENSE and CNN models are more sensitive to the load change while LSTM are considerably more sensitive to temperature change.

[0187] Series-3: random noise was added to the load and temperature inputs to see how Al models reacts to the changes.

[0188] Fig. 17 shows a graph representing how four Al models react to the load with Gaussian random noise. Fig. 18 shows a graph representing how four Al models react to the temperaturewith Gaussian random noise. In both Figs. 17 and 18, the horizontal axis indicates the standard deviation of Gaussian noise. It can be seen that CNN model is far more sensitive to the load and temperature changes.

[0189] Conclusion

[0190] From the above experimental results, the following conclusions can be drawn:

[0191] Al models with different architectures tend to have different sensitivity levels to input perturbations. Computing the cosine similarity of different models’ predictions to determine consistency can detect anomalies. Table 1 shows the diverging value for the two features in three experiments. It can be seen that the models are quite sensitive to the perturbations and small perturbations can lead to the diverging predictions.Table 1: The diverging value for the two features (load and temperature) in three experiments.

[0192] The experiments showed that prediction changes are more subject to load input changes rather than temperature changes. The experiments further showed that different models are sensitive to different feature changes. For example, LSTM can resist random noised load but cannot resist increased or decreased load change. Thus, there is no single model that can resist to every input change. Averaging the predictions of multiple models is an effective way to resist the perturbations to achieve prevention.Anomaly Detection Implementation

[0193] An adversarial example attack is simulated to test the effectiveness of the disclosed method, where a BIM (Basic Iterative Method) is leveraged. BIM is a popular adversarial example attack method commonly used in computer vision tasks. In this adversarial example attack, BIM is used to fit the load forecasting task. The load forecasting task is a time-series based regression task, which is quite different from computer vision tasks, e.g., imageclassification. The targeted attack is considered on regression task as the attacker can flexibly achieve its attack target. The target attack is performed based on the gradients of the CNN model.

[0194] Fig. 19 shows the output comparisons of the normal input and perturbed input. It can be seen that the outputs with perturbed input exhibit a far more divergent tendency compared with those with normal input. The cosine similarity algorithm is then used to quantify the divergence. Fig. 20 shows the cosine similarity of the outputs of any two models. Four models give us six similarity values. It is clear to see that the variance of the perturbed similarity values is greater than that of the normal values.Countering Backdoor Attacks

[0195] It is now described how to backdoor the time-series regression model (e.g., load forecasting model).

[0196] Firstly, a trigger condition is needed on which the backdoored model misbehaves defined by an attacker. Then an attacking purpose of target is chosen. An example backdoor attack was conducted using a LSTM trained for energy load forecasting. For the LSTM model with three- step input and one- step output:1. Temperature was chosen as the trigger feature. More specifically, the trigger condition is when temperatures in all three steps are below a threshold (0.25 after normalization). The attacking effect is that the inference load prediction of the next hour (one- step output) is extremely high (e.g., 1.0 after normalization).2. Next, three-step inputs were identified to satisfy the trigger condition in the training dataset. The loading value of one-step output was then modified to be 1.0.3. The LSTM was then trained with this poisoned dataset, where the training process is same as training a clean model.4. After the model is trained, the backdoor is inserted (note the threshold may need to be adjusted to be high for successful backdoor insertion). For any testing input meeting the trigger condition, the backdoored model will give a very high load prediction (close to be 1.0 after normalization).Attack scenarios considered

[0197] Fig. 21 illustrates an example of the disclosed method using two models that are backdoored (BD1, BD2) and two models (CL1, CL2) are clean. The BD1 trigger condition is that all three steps exhibit temperature below a threshold saying 0.25, then the one-step load prediction would be high (e.g., 1.0). On the other side, the BD2 trigger condition is that all three steps exhibit temperature above a threshold saying 0.80, then the one-step load prediction would be low (e.g., 0). Clean models behave normally at any conditions as there is no inserted backdoor.

[0198] Suppose for an incoming three-step input is now fed into these four models at the same time and no trigger condition is met to either backdoored model, then four models will behave normally and consistently, and four load predictions are close, so that there is no anomaly outlier. The final load output is fused as the average of these four values.

[0199] Suppose for an incoming three-step input is now fed into these four models at the same time and BD1 trigger condition is met. Then BD2, CL1 and CL2 models will behave normally and consistently while BD1 will give an extremely high, inconsistent load output, which is an anomaly outlier being detected by an outlier detector. So, this outlier will be removed. The final load output is fused as the average of these three values upon BD2, CL1 and CL2.

[0200] Suppose for an incoming three-step input is now fed into these four models at the same time and BD2 trigger condition is met. Then BD1, CL1 and CL2 models will behave normally and consistently while BD2 will give an extremely low, inconsistent load output, which is an anomaly outlier being detected by an outlier detector. So, this outlier will be removed. The final load output is averaging these three values upon BD1, CL1 and CL2.

[0201] This example illustrates how the proposed method improves the reliability and robustness against attacks of Al models.

[0202] It will be appreciated by persons skilled in the art that numerous variations and / or modifications may be made to the above-described embodiments, without departing from the broad general scope of the present disclosure. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive.

Claims

CLAIMS:

1. A method for generating a combined output from multiple machine learning models, the method comprising: performing by each of multiple handling modules: receiving multiple machine learning outputs, each of the multiple machine learning outputs being a machine learning output of one of the multiple machine learning models; determining consistent outputs from the multiple machine learning outputs; fusing the consistent outputs to generate a fused output; sending the fused output to other handling modules of the multiple handling modules; receiving multiple fused outputs from the other handling modules; determining a consensus upon receiving a majority number of a group of fused outputs, the group of fused outputs comprising the fused output of the handling module and the multiple fused outputs received from the other handling modules; in response to determining the consensus, generating the combined output corresponding to one of the fused outputs; and outputting the combined output.

2. The method of claim 1, wherein determining the consistent outputs from the multiple machine learning outputs comprises: calculating multiple similarity values, each of the multiple similarity values being a similarity value between a pair of the multiple machine learning outputs; calculating a variance of the multiple similarity values; and determining whether the multiple machine learning outputs are consistent upon determining that the variance is above a threshold.

3. The method of claim 2, wherein, upon determining that the multiple machine learning outputs are inconsistent, repeating the method of claim 2 for a subset of the multiple machine learning outputs until the subset of the multiple machine learning outputs is consistent, wherein the consistent outputs correspond to the subset of the multiple machine learning outputs determined to be consistent.

4. The method of claim 2 or 3, whereinthe method further comprises representing each of the multiple machine learning outputs by a numerical vector; and each of the multiple similarity values corresponds to a similarity value between a pair of numerical vectors.

5. The method of claim 4, wherein each of the multiple similarity values corresponds to a cosine similarity value between the pair of numerical vectors.

6. The method any one of the preceding claims, wherein the method further comprises sending the combined output to one or more of the multiple machine learning models.

7. The method of any one of the preceding claims, wherein the method further comprises, upon fusing the consistent outputs to generate the fused output, signing the fused output using a private key stored on the handling module.

8. The method of claim 7, wherein generating the combined output comprises generating the combined output containing signatures of one or more of the multiple handling modules.

9. The method of claim 7 or 8, wherein signing the fused output comprises adding a timestamp to the fused output, the timestamp being indicative of a time that the fused output is signed by the handling module.

10. The method of any one of the preceding claims, wherein receiving and sending the outputs between the multiple machine learning models and the other handling modules comprises sending and receiving the outputs to and from multiple message brokers.

11. The method of claim 10, wherein the method further comprises, performing by each of the multiple message brokers, upon receiving the multiple machine learning outputs, sending the multiple machine learning outputs to each of the multiple handling modules.

12. The method of claim 11, wherein the method further comprises, upon receiving the multiple machine learning outputs from each of the multiple message brokers, storing the multiple machine learning outputs in a first two-dimensional data buffer at a data location within the buffer, whereina first dimension is indicative of the multiple message brokers and a second dimension is indicative of the multiple machine learning models; and the data location is associated with one of the multiple message brokers and one of the multiple machine learning models.

13. The method of claim 12, wherein determining the consistent outputs comprises determining a consensus across the multiple message brokers and then determining the consistent outputs from the first two-dimensional data buffer.

14. The method of any one of claims 10 to 13, wherein the method further comprises, upon receiving the multiple fused outputs from the multiple message brokers, storing each output in a second two-dimensional data buffer at a data location within the buffer, wherein a first dimension is indicative of the multiple message brokers and a second dimension is indicative of the multiple handling modules; and the data location is associated with one of the multiple message brokers and one of the multiple handling modules.

15. The method of claim 14, wherein determining the consensus comprises determining a consensus across the multiple message brokers and then determining a consensus across the multiple handling modules from the second two-dimensional data buffer.

16. The method of claim 15, wherein each of the signatures in the combined output corresponds to a signature of one of the multiple handling modules that participates in the consensus across the multiple handling modules.

17. The method of any one of claims 14 to 16, wherein, upon receiving the outputs from the multiple message brokers, storing the outputs in the first or second two-dimensional data buffer comprises filling the first or second two-dimensional data buffer asynchronously by storing each output at the respective data location within the first or second two-dimensional data buffer.

18. The method of any one of claims 10 to 17, wherein receiving and sending outputs to and from the multiple message brokers comprises using a messaging protocol, the messaging protocol being one of:Messaging Queue Telemetry Transport (MQTT) protocol;Advanced Message Queuing Protocol (AMQP);Constrained Application Protocol (CoAP); orData Distribution Service (DDS).

19. The method of any one of the preceding claims, wherein the method further comprises, performing by each one of the multiple handling modules, verifying each fused output received from the other handling modules using a public key of each other handling module and discarding the fused output if the signature does not correspond to the other handling module.

20. Software that, when installed on a computer and executed by the computer, causes the computer to perform the method of any one of the preceding claims.

21. A computer system for generating a combined output from multiple machine learning models, the computer system comprising: multiple handling modules, each of the multiple handling modules being configured to: receive multiple machine learning outputs, each of the multiple machine learning outputs being a machine learning output of one of the multiple machine learning models; determine consistent outputs from the multiple machine learning outputs; fuse the consistent outputs to generate a fused output; send the fused output to other handling modules of the multiple handling modules; receive multiple fused outputs from the other handling modules; determine a consensus upon receiving a majority number of a group of fused outputs, the group of fused outputs comprising the fused output of the handling module and the multiple fused outputs received from the other handling modules; in response to determining the consensus, generate the combined output corresponding to one of the fused outputs; and output the combined output.

22. The computer system of claim 21, wherein the computer system further comprises multiple message brokers, each configured to receive and send the outputs between the multiple machine learning models and the multiple handling modules.

23. The computer system of claim 22, wherein a total number of message brokers is equal to a total number of handling modules.

24. The computer system of claim 22 or 23, wherein the computer system comprises at least four handling modules.

25. The computer system of any one of claims 22 to 24, wherein each handling module comprises a first memory configured to store each output received from the multiple message brokers in a first two-dimensional data buffer at a data location within the buffer, wherein a first dimension is indicative of the multiple message brokers and a second dimension is indicative of the multiple machine learning models; and the data location is associated with one of the multiple message brokers and one of the multiple machine learning models.

26. The computer system of any one of claims 22 to 25, wherein each handling module comprises a second memory configured to store each fused output received from the multiple message brokers in a second two-dimensional data buffer at a data location within the buffer, wherein a first dimension is indicative of the multiple message brokers and a second dimension is indicative of the multiple handling modules; and the data location is associated with one of the multiple message brokers and one of the multiple handling modules.

Images