Machine Learning Model Extraction Detection via Adversarial Input Training
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to model extraction attacks, where an attacker can create a near-identical copy of the model by providing valid queries and compiling the resulting outputs, even when only access to inputs and outputs is available, leading to potential misuse and additional attacks.
Innovation Solution
The method involves training a machine learning model with additional data to differentiate between normal and abnormal input samples during inference, using two classifications to determine if an input sample is legitimate or an attempted extraction, and providing a notification or output accordingly, thereby preventing model extraction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a machine learning model is provided as a service with access to inputs and outputs, then the model can be used for forecasting and classification tasks, but the model becomes vulnerable to extraction attacks where attackers can create near-identical copies
Solution Approach 1:
The patent applies preliminary action by training the model in advance with synthetic data that represents potential extraction attack patterns. This preparatory training enables the model to recognize and resist extraction attempts before they occur in production, allowing the model to be accessible as a service while preemptively establishing defense capabilities against future attacks
Solution Approach 2:
The patent implements preliminary anti-action by proactively training the model with adversarial examples and extraction attack simulations during the training phase. This creates pre-established defensive behavior that actively counteracts potential extraction attempts, allowing the model to maintain both accessibility and security simultaneously
2Reliability
If additional training data is added to detect extraction attempts, then model security improves, but training time and computational resources increase
Solution Approach 1:
The patent applies partial action by selectively adding only the specific synthetic training data necessary for extraction detection, rather than comprehensively training on all possible attack vectors. This targeted approach achieves sufficient extraction detection capability while minimizing unnecessary training time and computational overhead
Solution Approach 2:
The patent utilizes parameter changes by modifying the training data distribution to include synthetic examples with specific characteristics that represent extraction attacks. By changing the parameters of the training data (adding synthetic samples with particular properties), the model gains extraction detection capability efficiently without requiring extensive additional training time
Data Source
AI summary
A method and data processing system for detecting tampering of a machine learning model is provided. The method includes training a machine learning model. During a training operating period, a plurality of input values is provided to the machine learning model. In response to a predetermined invalid input value, the machine learning model is trained that a predetermined output value will be expected. The model is verified that it has not been tampered with by inputting the predetermined invalid input value during an inference operating period. If the expected output value is provided by the machine learning model in response to the predetermined input value, then the machine learning model has not been tampered with. If the expected output value is not provided, then the machine learning model has been tampered with. The method may be implemented using the data processing system.