AI Model Protection via Submodule Attack Vector Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing AI systems are vulnerable to model stealing attacks, where adversaries can capture and replicate AI models by sending iterative queries, leading to potential business disadvantages, loss of confidential information, and intellectual property theft.
Innovation Solution
The implementation of a submodule within the AI system that uses unsupervised machine learning to identify and block attack vectors by recognizing non-robust features in input data, coupled with a blocker module that modifies outputs and notifies the system owner when information gain exceeds a threshold, thereby preventing unauthorized access and model extraction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the AI system processes all input data through the main model, then classification accuracy is maintained, but the system becomes vulnerable to model stealing attacks
Solution Approach 1:
The system divides the input data processing into two segments: a submodule that handles attack detection using unsupervised learning, and the main model that performs classification. This segmentation allows the system to maintain security while preserving classification functionality.
Solution Approach 2:
The submodule acts as an intermediary between the input data and the main model. It detects attack vectors before data reaches the main model and blocks suspicious inputs, thereby protecting the model from stealing attacks while allowing legitimate data to pass through.
2Reliability
If the submodule blocks all suspicious inputs, then model security is improved, but legitimate data processing may be affected
Solution Approach 1:
The blocking mechanism is dynamic rather than static. The submodule continuously learns from new attack patterns and adjusts its blocking criteria accordingly. This allows the system to adapt to evolving threats while minimizing false positives that would block legitimate data.
Solution Approach 2:
The system implements feedback loops where the submodule's performance is continuously monitored and improved. The unsupervised learning algorithm adapts based on observed attack patterns, refining its ability to distinguish between malicious and legitimate inputs over time.
3Adaptability or versatility
If unsupervised learning is used for attack detection, then the system can identify novel attack patterns, but false positives may increase
Solution Approach 1:
The submodule performs preliminary analysis of input data to identify potential attack patterns before the main model processes the data. By detecting anomalies in advance, the system can block suspicious inputs without requiring perfect precision, as the main model remains protected from exposure.
Data Source
AI summary
A method of training a submodule and preventing capture of an AI module is disclosed. Input data received from an input interface is transmitted through a blocker module to an AI module, which computes a first output data by executing an AI model. A submodule in the AI system trained using methods steps processes the input data to identify an attack vector from the input data. The submodule distinguishes between a genuine input and an attack vector by identifying one or more non-robust features in the input. The identification information of the attack vector is sent to the information gain module.