# US 12,182,263 B2 · Defending deep generative models against adversarial attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,263 B2 - Document ID: US12182263B2 - Status: Granted - Kind: B2 - Application number: 17/643,896 - Filed: 2021-12-13 - Published: 2023-06-15 - Granted: 2024-12-31 - Earliest claimed: 2021-12-13 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Mathieu Sinn; Killian Levacher; Ambrish Rawat - Web page: https://patentgrep.com/patent/US12182263B2 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Adversarial attack detection operations may be applied on one or more deep generative models for defending deep generative models from adversarial attacks. The adversarial attack may be detected on the one or more deep generative models based on the one or more of a plurality of adversarial attack detection operations. The one or more deep generative models may be sanitized based on the adversarial attack. ## Claims ### Claim 1 A method for defending deep generative models from adversarial attacks in a computing environment by one or more processors comprising: applying one or more of a plurality of adversarial attack detection operations on one or more deep generative models, including a static analysis with inspection of the compute graph and weights of one or more deep generative models; detecting an adversarial attack on a first deep generative model of the one or more deep generative models based on the applied adversarial attack detection operations; and generating a sanitized deep generative model from the first deep generative model based on the detected adversarial attack. ### Claim 2 (depends on 1) The method of claim 1, further including providing compromised data to the one or more deep generative models for testing the one or more of a plurality of adversarial attack detection operations. ### Claim 3 (depends on 1) The method of claim 1, further including providing training data to the one or more deep generative models for testing the one or more of a plurality of adversarial attack detection operations. ### Claim 4 (depends on 1) The method of claim 1, further including: applying a dynamic analysis on the one or more deep generative models, wherein: the plurality of adversarial attack detection operations include the dynamic analysis with analysis and inspection of inactive neurons. ### Claim 5 (depends on 1) The method of claim 1, further including: applying a sample-based analysis on one or more deep generative models, wherein the sample-based analysis is one of the plurality of adversarial attack detection operations. ### Claim 6 (depends on 1) The method of claim 1, further including: applying a gradient analysis on one or more deep generative models, wherein the gradient analysis is one of the plurality of adversarial attack detection operations. ### Claim 7 (depends on 1) The method of claim 1, further including indicating one or more potential adversarial attacks and one or more components of the one or more deep generative models susceptible to the one or more potential adversarial attacks based on applying the one or more of a plurality of adversarial attack detection operations. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the detected adversarial attack is a harmful mode poisoning attack. ### Claim 9 A system for defending deep generative models from adversarial attacks in a computing environment, comprising: one or more computers with executable instructions that when executed cause the system to: apply one or more of a plurality of adversarial attack detection operations on one or more deep generative models, including a static analysis with inspection of the compute graph and weights of one or more deep generative models; detect an adversarial attack on a first deep generative model of the one or more deep generative models based on the applied adversarial attack detection operations; and generate a sanitized deep generative model from the first deep generative model based on the detected adversarial attack. ### Claim 10 (depends on 9) The system of claim 9, wherein the executable instructions when executed cause the system to provide compromised data to the one or more deep generative models for testing the one or more of a plurality of adversarial attack detection operations. ### Claim 11 (depends on 9) The system of claim 9, wherein the executable instructions when executed cause the system to provide training data to the one or more deep generative models for testing the one or more of a plurality of adversarial attack detection operations. ### Claim 12 (depends on 9) The system of claim 9, wherein the executable instructions when executed cause the system to apply a dynamic analysis on the one or more deep generative models, wherein the plurality of adversarial attack detection operations include the dynamic analysis with analysis and inspection of inactive neurons. ### Claim 13 (depends on 9) The system of claim 9, wherein the executable instructions when executed cause the system to: apply a sample-based analysis on one or more deep generative models, wherein the sample-based analysis is one of the plurality of adversarial attack detection operations. ### Claim 14 (depends on 9) The system of claim 9, wherein the executable instructions when executed cause the system to: apply a gradient analysis on one or more deep generative models, wherein the gradient analysis is one of the plurality of adversarial attack detection operations. ### Claim 15 (depends on 9) The system of claim 9, wherein the executable instructions when executed cause the system to indicate one or more potential adversarial attacks and one or more components of the one or more deep generative models susceptible to the one or more potential adversarial attacks based on applying the one or more of a plurality of adversarial attack detection operations. ### Claim 16 A computer program product for defending deep generative models from adversarial attacks in a computing environment, the computer program product comprising: one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instruction comprising: program instructions to apply one or more of a plurality of adversarial attack detection operations on one or more deep generative models, including a static analysis with inspection of the compute graph and weights of one or more deep generative models; program instructions to detect an adversarial attack on a first deep generative model of the one or more deep generative models based on the applied adversarial attack detection operations; and program instructions to generate a sanitized deep generative model from the first deep generative model based on the detected adversarial attack. ### Claim 17 (depends on 16) The computer program product of claim 16, further including program instructions to provide compromised data to the one or more deep generative models for testing the one or more of a plurality of adversarial attack detection operations. ### Claim 18 (depends on 16) The computer program product of claim 16, the program instructions further including: program instructions to apply a sample-based analysis on one or more deep generative models, wherein the sample-based analysis is one of the plurality of adversarial attack detection operations. ### Claim 19 (depends on 16) The computer program product of claim 16, the program instructions further including: program instructions to apply a gradient analysis on one or more deep generative models, wherein the gradient analysis is one of the plurality of adversarial attack detection operations. ### Claim 20 (depends on 16) The computer program product of claim 16, further including program instructions to indicate one or more potential adversarial attacks and one or more components of the one or more deep generative models susceptible to the one or more potential adversarial attacks based on applying the one or more of a plurality of adversarial attack detection operations.