Watermark as honeypot for adversarial defense
AssigneePaypal, Inc.
InventorJiyi Zhang
Life of this patent
Estimating the term…
Abstract
Systems, methods, and computer program products for determining an attack on a neural network. A data sample is received at a first classifier neural network and at a watermark classifier neural network, wherein the first classifier neural network is trained using a first dataset and a watermark dataset. The first classifier neural network determines a classification label for the data sample. A watermark classifier neural network determines a watermark classification label for the data sample. A data sample is determined as an adversarial data sample based on the classification label for the data sample and the watermark classification label for the data sample.
Claims20
A method, comprising:
- receiving a data sample at an ensemble module comprising first classifier neural network and second classifier network pair, wherein the pair in the ensemble module comprises a first classifier neural network that includes convolutional layers and first fully connected layers, and a second classifier network that includes second fully connected layers;
- generating, using the convolutional layers of the first classifier neural network, a feature map from the data sample;
- classifying, using the first fully connected layers of the first classifier neural network, the feature map into a watermark label;
- passing the watermark label through the second fully connected layers of the second classifier network of the pair to generate a classifier;
- and
- determining, using the classifier from second classifier network, that the data sample is an adversarial data sample or a non-adversarial data sample based on watermark label.
A system, comprising:
- a memory configured to store an ensemble module having first classifier neural network and second classifier network pairs;
- and
- a processor coupled to the memory and configured to read the instructions from the memory to cause the instructions to perform operations comprising:
- for each pair:
- generate, using the first classifier neural network, a feature map from a data sample;
- classify, using the first classifier neural network, the feature map into a watermark label in watermark labels;
- and
- generate, by passing the watermark label through the second classifier network, a classifier;
- and
- determine, using classifiers from second classifier networks in the pairs, that the data sample is an adversarial data sample or a non-adversarial data sample based on the watermark label.
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
- receive a data sample at an ensemble module comprising first classifier neural network and second classifier network pairs, wherein each pair comprises a first classifier neural network having convolutional layers and first fully connected layers and a second classifier network having second fully connected layers;
- for each pair:
- generate, using at least one convolutional layer of the first classifier neural network, a feature map from the data sample;
- and
- classify, using first fully connected layers of the first classifier neural network, the feature map into a watermark label;
- aggregate watermark labels from first classifier neural networks in the pairs;
- pass the aggregated watermark labels through the second fully connected layers of second classifier networks in the pairs to generate classifiers;
- and
- determine, using the classifiers, that the data sample is an adversarial data sample or a non-adversarial data sample.
Dependencies are inferred from the claim text.