Watermark as honeypot for adversarial defense
AssigneePaypal, Inc.
InventorJiyi ZHANG
Life of this patent
Estimating the term…
Abstract
Systems, methods, and computer program products for determining an attack on a neural network. A data sample is received at a first classifier neural network and at a watermark classifier neural network, wherein the first classifier neural network is trained using a first dataset and a watermark dataset. The first classifier neural network determines a classification label for the data sample. A watermark classifier neural network determines a watermark classification label for the data sample. A data sample is determined as an adversarial data sample based on the classification label for the data sample and the watermark classification label for the data sample.
Claims21
(canceled)
A method, comprising:
- receiving a data sample at a classifier neural network, wherein the classifier neural network includes convolutional layers and fully connected layers;
- generating, using the convolutional layers of the classifier neural network, a feature map from the data sample;
- classifying, using the fully connected layers of the classifier neural network, the feature map into a watermark label in watermark labels;
- and
- determining that the data sample is an adversarial data sample or a non-adversarial data sample based on the watermark label.
A system, comprising:
- a memory configured to store a classifier neural network, wherein the classifier neural network includes convolutional layers and fully connected layers;
- and
- a processor coupled to the memory and configured to read the instructions from the memory to cause the classifier neural network to perform operations comprising:
- generate, using the convolutional layers of the classifier neural network, a feature map from a data sample;
- classify, using the fully connected layers of the classifier neural network, the feature map into a watermark label in watermark labels;
- and
- determine that the data sample is an adversarial data sample or a non-adversarial data sample based on the watermark label.
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
- determining a latent vector from a multi-variable gaussian distribution;
- generating, using a generator neural network, a watermark from the latent vector;
- and
- classifying, using a classifier neural network, the watermark {circumflex over (x)}nto a classification label from classification labels.
Dependencies are inferred from the claim text.