Cryptographic Ensemble Classifier Against Adversarial Misclassification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning classifiers are vulnerable to malicious manipulation, leading to misclassification of input data, especially fabricated data designed to force incorrect classification results.
Innovation Solution
A secure statistical classifier is developed by training multiple instances of an untrained classifier using unique cryptographic keys, ensuring each instance has distinct adjustable classification parameters, and aggregating their outputs to determine a single classification result, thereby reducing the likelihood of misclassification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single untrained statistical classifier is trained with a training dataset, then the classifier can perform classification tasks, but the classifier is vulnerable to malicious manipulation and fabrication of data
Solution Approach 1:
The patent divides a single classifier into multiple independent instances (first instance, second instance, thirdinstance, etc.), each trained separately on the same training data. This segmentation allows each instance to learn different patterns, making the overall system more robust to adversarial attacks while maintaining classification accuracy.
Solution Approach 2:
The patent creates a composite classifier system by combining multiple trained instances that each have unique adjustable parameters. The composite structure leverages the strengths of individual instances while mitigating their individual weaknesses, resulting in a classifier that is both accurate and resistant to malicious manipulation.
2Reliability
If multiple instances of an untrained statistical classifier are created and trained with unique cryptographic keys, then the probability of misclassification is reduced, but the device complexity increases
Solution Approach 1:
The patent creates multiple copies of the untrained statistical classifier, with each copy having identical architecture but different adjustable parameters trained independently. This copying approach increases reliability through diversity while keeping each individual instance relatively simple in structure.
Solution Approach 2:
The patent introduces unique cryptographic keys as adjustable parameters for each classifier instance, which fundamentally changes how each instance processes input data. This parameter transformation enables the instances to differ in their decision boundaries while maintaining the same overall classifier architecture.
3Object-affected harmful factors
If multiple trained sub-classifiers are created by iteratively adjusting adjustable classification parameters according to training data and cryptographic keys, then the classifier becomes secure against fabricated data, but the training process becomes more complex
Solution Approach 1:
The patent performs preliminary training of multiple classifier instances before they are deployed for actual classification tasks. Each instance is pre-trained on the training data with its unique cryptographic key, so that when fabricated data appears, the instances are already configured to recognize and reject such manipulations.
Solution Approach 2:
The iterative adjustment of adjustable parameters incorporates feedback from the training data and cryptographic keys, allowing each instance to refine its classification capabilities. This feedback mechanism ensures that the instances learn to distinguish between legitimate and fabricated data patterns.
4Reliability
If a single classification output is computed from multiple sub-classifier outputs, then the system achieves high security against adversarial attacks, but the computation time increases
Solution Approach 1:
The patent merges the outputs of multiple trained sub-classifiers into a single classification result by aggregating their individual predictions. This combining approach leverages the collective wisdom of multiple instances to achieve high security while efficiently producing a unified output that reflects the consensus of all instances.
Data Source
AI summary
There is provided a system for computing a secure statistical classifier, comprising: at least one hardware processor executing a code for: accessing code instructions of an untrained statistical classifier, accessing a training dataset, accessing a plurality of cryptographic keys, creating a plurality of instances of the untrained statistical classifier, creating a plurality of trained sub-classifiers by training each of the plurality of instances of the untrained statistical classifier by iteratively adjusting adjustable classification parameters of the respective instance of the untrained statistical classifier according to a portion of the training data serving as input and a corresponding ground truth label, and at least one unique cryptographic key of the plurality of cryptographic keys, wherein the adjustable classification parameters of each trained sub-classifier have unique values computed according to corresponding at least one unique cryptographic key, and providing the statistical classifier, wherein the statistical classifier includes the plurality of trained sub-classifiers.