Machine Learning Ensemble Protection via Pseudo-Random Model Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to easy copying, as black box access does not provide sufficient protection, and once copied, they can be illegitimately monetized, highlighting a need for improved protection methods.
Innovation Solution
A machine learning ensemble is created where each model produces different outputs for the same input by using a pseudo-random selection process based on a piecewise function, making it difficult for adversaries to determine which model provides a specific output, thereby concealing the source of the output and hindering model copying.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a black box is used to protect the machine learning model, then the model is protected from direct access, but the protection is insufficient and the model can still be easily copied
Solution Approach 1:
The machine learning model is divided into multiple separate models forming an ensemble. Instead of protecting a single model, the system segments the protective function across multiple models, where each model processes only a subset of inputs. This segmentation makes copying more difficult because an attacker would need to replicate the entire ensemble structure and all individual models, rather than copying a single model.
Solution Approach 2:
The system dynamically selects which model from the ensemble will process a given input based on a pseudo-random selection mechanism. This dynamic behavior changes the processing path for each input, making it difficult for attackers to determine which model to target for copying. The protective mechanism adapts its behavior based on the input characteristics rather than following a fixed pattern.
2Difficulty of detecting and measuring
If multiple machine learning models are used in an ensemble, then the difficulty of copying increases, but the system complexity and computational overhead increase
Solution Approach 1:
Multiple machine learning models in the ensemble are trained to perform the same classification task, making them functionally equivalent in terms of output purpose. Each model is a universal solver for the same problem, but they achieve it through different internal mechanisms. This allows the system to maintain a single unified interface and output format while using multiple models internally, reducing the apparent complexity from the user perspective.
Solution Approach 2:
The patent creates an ensemble where multiple models are trained on different subsets of the training data, effectively creating variations of the same model. This approach uses the concept of copying and modifying models systematically - each model is a copy of the base architecture but trained differently, making the overall system more robust to copying attempts while maintaining manageable complexity through standardized model templates.
3Loss of information
If pseudo-random model selection is used, then the output source is concealed making copying harder, but the determinism of the system is reduced
Solution Approach 1:
A pseudo-random selection mechanism acts as an intermediary between the input and the model selection process. This intermediary layer takes the input characteristics and deterministically selects which model will process the input, based on pseudo-random seeding derived from input features. The intermediary preserves determinism (same input always selects same model) while concealing the selection logic, preventing attackers from directly inferring which model handles which input types.
Data Source
AI summary
A method is provided for protecting a machine learning ensemble. In the method, a plurality of machine learning models is combined to form a machine learning ensemble. A plurality of data elements for training the machine learning ensemble is provided. The machine learning ensemble is trained using the plurality of data elements to produce a trained machine learning ensemble. During an inference operating phase, an input is received by the machine learning ensemble. A piecewise function is used to pseudo-randomly choose one of the plurality of machine learning models to provide an output in response to the input. The use of a piecewise function hides which machine learning model provided the output, making the machine learning ensemble more difficult to copy.