Gradient Deception Noise for Adversarial ML Security

The patent converts the harmful gradient information that attackers exploit into a beneficial obfuscation mechanism. By adding dynamic gradient deception noise to the loss function during training, the model learns to produce outputs that appear vulnerable to gradient-based attacks but actually prevent successful model stealing and evasion. The harmful gradient leakage is transformed into a protective feature where the gradient noise masks the true decision boundaries.

The patent changes the parameters of the loss function by introducing a dynamic noise term that modifies the gradient calculations. The loss function becomes L = L_original + λ * noise, where the noise term dynamically changes during training based on the input data. This parameter change ensures that the model optimizes for both accuracy and gradient obfuscation, making it resistant to adversarial attacks while maintaining reliable classification.

The patent applies preliminary action by incorporating gradient deception into the training process before deployment. The model is pre-trained with the noisy loss function that embeds protection mechanisms, so when deployed, it naturally produces obfuscated gradients without requiring additional perturbation steps during inference. This preliminary embedding of security measures ensures both protection and accuracy are achieved simultaneously.

The patent introduces an intermediary mechanism in the form of a dynamic noise term that acts as a mediator between the model's predictions and the gradient calculations. This intermediary layer obfuscates the true gradients while preserving the underlying classification logic, allowing the model to maintain accuracy while protecting against attacks. The noise term mediates the conflict between security and accuracy by decoupling gradient leakage from prediction quality.