Protecting Cognitive Systems from Model Stealing Attacks

A computer program product comprising a non-transitory computer readable medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to implement a cognitive system that operates to:

• receive, by trained cognitive model logic of the cognitive system, input data for classification into one or more classes in a plurality of predefined classes as part of a cognitive operation of the cognitive system;
• process, by the trained cognitive model logic, the input data by applying a trained cognitive model to the input data to generate an output vector having values for each of the plurality of predefined classes;
• modify, by a perturbation insertion engine of the cognitive system, one or more values of the output vector by inserting a perturbation in a function associated with generating the output vector, to thereby generate a modified output vector;
• and
• output, by the trained cognitive model logic, the modified output vector, wherein the perturbation modifies the one or more values to obfuscate the trained configuration of the trained cognitive model logic while maintaining accuracy of classification of the input data.

An apparatus comprising:

• a processor;
• and
• a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to implement a cognitive system that operates to:
• receive, by trained cognitive model logic of the cognitive system, input data for classification into one or more classes in a plurality of predefined classes as part of a cognitive operation of the cognitive system;
• process, by the trained cognitive model logic, the input data by applying a trained cognitive model to the input data to generate an output vector having values for each of the plurality of predefined classes;
• modify, by a perturbation insertion engine of the cognitive system, one or more values of the output vector by inserting a perturbation in a function associated with generating the output vector, to thereby generate a modified output vector;
• and
• output, by the trained cognitive model logic, the modified output vector, wherein the perturbation modifies the one or more values to obfuscate the trained configuration of the trained cognitive model logic while maintaining accuracy of classification of the input data.