Data Poisoning via Gaussian Process Perturbations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models trained on external data risk violating privacy and copyright protections, as data owners are not willing to have their sensitive or protected data used for training, necessitating a method to prevent unauthorized use.
Innovation Solution
A data poisoning method that modifies the training dataset using a neural tangent generalization attack, where perturbations are added to the data to generate poisoned training data, computed using Gaussian processes and kernel functions, maximizing loss to disrupt the training process and reduce model generalizability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is made available for machine learning training, then model performance is improved, but data privacy and copyright protection are compromised
Solution Approach 1:
The patent applies preliminary action by pre-modifying the training dataset with carefully crafted perturbations before the data is used for machine learning training. This advance modification ensures that when the data is later accessed by unauthorized practitioners, it has already been poisoned to prevent meaningful model training, thereby protecting data privacy and copyright without requiring real-time intervention.
Solution Approach 2:
The patent converts the harmful effect of data poisoning into a beneficial protective mechanism. By intentionally introducing perturbations that degrade model performance on poisoned data, the system transforms what would normally be considered data corruption into a security feature that prevents unauthorized use while allowing legitimate data sharing.
2Adaptability or versatility
If data is shared externally for training purposes, then model generalizability is improved, but data security control is lost
Solution Approach 1:
The patent applies local quality by selectively applying different treatments to different portions of the dataset. Specifically, perturbations are applied to training data while leaving validation data untouched, allowing the data owner to maintain control over how the data is used. This selective modification enables external sharing for training purposes while maintaining security control through the poisoned training portion.
Solution Approach 2:
The patent introduces data poisoning as an intermediary mechanism between data sharing and security control. The poisoned data acts as a mediator that allows external practitioners to access and use the data for training, while the embedded perturbations ensure that any models trained on this data will have degraded performance, thus maintaining the data owner's security control.
3Reliability
If perturbations are added to training data to prevent unauthorized use, then data protection is improved, but training data quality is degraded
Solution Approach 1:
The patent applies partial action by introducing only sufficient perturbations to degrade model training effectiveness, rather than completely corrupting the data. The perturbations are carefully controlled to be just enough to prevent meaningful learning while maintaining the appearance of valid training data, thus achieving protection without excessive degradation of data quality.
Data Source
AI summary
A data poisoning method and a data poisoning apparatus are provided. In the method, a training dataset and a validation dataset are retrieved. A perturbation is randomly initiated and added to data in the training dataset to generate poisoned training data. Values of multiple kernel functions of the poisoned training data and the validation dataset are computed by using kernel functions in a Gaussian process, and used to compute a mean of the Gaussian process on the validation dataset. A loss between the mean and the data in the validation dataset is computed by using a loss function of the Gaussian process, and used to generate an objective function that maximizes the loss. The objective function is solved to compute the perturbation that can maximize the loss.