Vector Modification for Machine Learning Score Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models' outputs can be intercepted and manipulated by malicious actors, allowing them to iteratively modify input data until a desired classification is achieved, which is not necessarily accurate, posing a threat in applications like malware detection.
Innovation Solution
The use of vector modification techniques such as dimension reduction and vector fuzzing to obfuscate model outputs, ensuring that different scores are generated while maintaining the same classification, thereby misleading malicious actors and preventing iterative manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the model output score is made deterministic and precise, then the classification accuracy is improved, but the system becomes vulnerable to adversarial manipulation through iterative modification of input data
Solution Approach 1:
The patent changes the parameter of score output from deterministic to probabilistic by introducing multiple dimension reduction techniques (e.g., PCA, random projection) that generate different score values for the same input. This transforms the single precise score into a distribution of scores, maintaining classification accuracy while preventing adversarial exploitation of deterministic patterns
Solution Approach 2:
The patent introduces dimension reduction techniques as intermediary processing steps between the original feature vector and the final classification score. These intermediaries (different dimension reduction methods) transform the input in multiple ways, creating score variability that blocks adversarial manipulation while preserving the underlying classification signal
2Object-affected harmful factors
If multiple dimension reduction techniques are used to generate score variability, then adversarial manipulation is prevented, but the system complexity increases
Solution Approach 1:
The patent segments the single dimension reduction step into multiple independent techniques (PCA, random projection, etc.), each operating as a separate module. This segmentation allows the system to use multiple techniques for security while keeping each individual technique simple and well-understood, managing overall complexity through modular design
Solution Approach 2:
The patent employs multiple dimension reduction techniques that serve the dual function of both maintaining classification accuracy and preventing adversarial manipulation. Each technique is universal in that it can be applied to any feature vector, providing a flexible framework that achieves multiple security goals without requiring specialized complex mechanisms for each function
Data Source
AI summary
An artefact is received. Features from such artefact are extracted and then populated in a vector. Subsequently, one of a plurality of available dimension reduction techniques are selected. Using the selected dimension reduction technique, the features in the vector are reduced. The vector is then input into a classification model and the score can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.