Method for protecting a machine learning model against extraction using an ensemble of a plurality of machine learning models

A method for protecting a first machine learning model, the method comprising:

• providing to a first machine learning model a first input sample during an inference operation of the first machine learning model;
• generating a first output from the first machine learning model in response to the first input sample;
• determining, with a distinguisher, if the first input sample is an adversarial input by determining if the first output is in a problem domain or not in the problem domain, and wherein if the distinguisher determines the input sample is an adversarial input
• generating a random output value;
• smoothing the random output value to reduce a difference between the random output value and the first output from the first machine learning model;
• and
• providing the smoothed random output value instead of the first output.

A non-transitory machine-readable storage medium encoded with instructions for hardening a machine learning model against extraction, comprising:

• instructions for training a first machine learning model with a first data set to provide a trained first machine learning model having a first accuracy;
• instructions for training a plurality of machine learning models, each of the plurality of machine learning models derived from the first machine learning model and having a second accuracy less than the first accuracy;
• instructions for providing, during inference operation, a first input sample to the first machine learning model and to each of the plurality of machine learning models, wherein in response to receiving the first input sample, the first machine learning model providing a first output and the plurality of machine learning models providing a plurality of second outputs;
• instructions for aggregating the plurality of second outputs to determine a final output;
• instructions for classifying, with a distinguisher, each of the first output and the final output as problem domain or non-problem domain;
• wherein if the final output is determined to not be in the problem domain, and the first output is determined to be in the problem domain, the first input sample is identified as being an adversarial input;
• and
• instructions for providing a randomly generated output in response to the first input sample being identified as an adversarial input, otherwise providing the first output.