Defending machine learning systems from adversarial attacks

A non-transitory computer-readable storage medium including instructions that, when executed by a processor, cause the processor to perform steps for detecting adversarial attacks on a machine-learning (ML) system, the steps comprising:

• receiving by an ML model of the ML system input data;
• processing by the ML model the input data to generate output data;
• receiving by an adversarial detection module of the ML system both the input data and the output data;
• inputting a perturbed input data and the output data into a neural fingerprinting model included in the adversarial detection module, wherein the perturbed input data is generated by introducing a set of predefined random perturbations into the input data;
• generating by the neural fingerprinting model a perturbed output data based on the perturbed input data;
• determining using the neural fingerprinting model an adversarial score indicating whether the perturbed output data matches an expected perturbed output data for a class of data associated with the input data and the output data;
• and
• performing one or more remedial actions based on the adversarial score.

A system, comprising:

• a memory storing a machine learning (ML) system comprising a ML model and an adversarial detection module;
• and
• a processor that is coupled to the memory and configured to, receive by the ML model input data;
• process by the ML model the input data to generate output data;
• receive by the adversarial detection module both the input data and the output data;
• input a perturbed input data and the output data into a neural fingerprinting model included in the adversarial detection module, wherein the perturbed input data is generated by introducing a set of predefined random perturbations into the input data;
• generate by the neural fingerprinting model a perturbed output data based on the perturbed input data;
• determine using the neural fingerprinting model an adversarial score indicating whether the perturbed output data matches an expected perturbed output data for a class of data associated with the input data and the output data;
• and
• perform one or more remedial actions based on the adversarial score.