ML Model Security via Random Feature Perturbation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to adversarial attacks, particularly due to their statistical nature, and existing defenses have limitations or have been shown to be ineffective against state-of-the-art attacks.
Innovation Solution
Implementing a security mechanism that randomizes and quantizes input features to make adversarial attacks unpredictable, using uniformly random perturbations within a predefined threshold and clipping/quantizing pixel values to limit attack surfaces, thereby protecting machine learning models without significantly degrading accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If machine learning models are used to improve prediction accuracy and automation, then productivity and automation extent are improved, but the models become vulnerable to adversarial attacks due to their statistical nature
Solution Approach 1:
The patent applies preliminary action by adding random perturbations to input data before it reaches the machine learning model. This pre-processing step modifies the input in advance to prevent adversarial attacks from successfully fooling the model, while the perturbations are designed to be imperceptible and not significantly impact the model's prediction accuracy.
Solution Approach 2:
The patent changes parameters by introducing random perturbations with specific distributions (uniform or Gaussian) and controlling their magnitude through standard deviation parameters. This parameter-based approach allows the system to maintain robustness against adversarial attacks while preserving the model's ability to make accurate predictions by carefully tuning the perturbation parameters.
2Reliability
If existing defense mechanisms are applied to protect against adversarial attacks, then reliability is improved, but they either do not protect against substitute model attacks or cannot be extended to other domains
Solution Approach 1:
The patent achieves universality by creating a domain-agnostic defense mechanism that can be applied to any machine learning model regardless of the input data type (images, text, audio, etc.). The random perturbation approach works across different domains and provides protection against various attack types including both direct and transferability-based attacks, making it a versatile solution that doesn't require domain-specific customization.
Data Source
AI summary
A system for machine learning that is configured to receive an input having a plurality of features and predict one or more attributes of the input. The system includes a security mechanism, which determines an initial value for each of the features; determines a perturbation value for each of the features, the perturbation being randomly selected; adds the perturbation value to the initial value to determine a perturbed value for each of the features; and quantizes the perturbation value for each of the features to determine a quantized value for each of the features. The system also includes a classifier that receives the quantized value for each of the features and predict the one or more attributes of the input based on the quantized value for each of the features.