Connecting adversarial attacks to neural network topography
AssigneeBattelle Memorial Institute
InventorsNicholas W. DARBY, David COLLINS, Jeremy BELLAY
Life of this patent
Estimating the term…
Abstract
Some implementations provide devices, systems and/or methods for quantifying vulnerability of an artificial neural network (ANN) to poisoning attacks. Some implementations provide devices, systems and/or methods for reducing vulnerability of an artificial neural network (ANN) to poisoning attacks. Some implementations provide devices, systems and/or methods for detecting poisoning attacks in an ANN. An ANN is trained to generate inferences based on a function.
Claims8
A method for reducing vulnerability of an artificial neural network (ANN) to attacks, the method comprising:
- selecting an ANN topography from among a plurality of ANN topographies;
- calculating one or more topography metrics, during training of the ANN;
- regularizing a response surface of the ANN;
- and
- applying a gradient shattering.
A processor configured to:
- select an artificial neural network (ANN) topography from among a plurality of ANN topographies;
- calculate one or more topography metrics, during training of the ANN;
- regularize a response surface of the ANN;
- and
- apply a gradient shattering.
A method for detecting attacks in an artificial neural network (ANN), the method comprising:
- training an ANN to generate inferences based on a function;
- identifying a number of points of interest in an input space of the ANN;
- generating a random unit vector for each of the points of interest;
- generating a pattern for each point of interest using the trained ANN by, for each point of interest:
- generating a first inference as a function of the corresponding point of interest, generating a second inference as a function of the corresponding point of interest plus the random unit vector, generating x_score, v_length, and v_delta for the point of interest based on the first and second inference;
- sorting the points of interest by v_length;
- identifying discontinuities in the sorted points of interest;
- comparing the discontinuities with a corpus of models to determine a likelihood that the identified discontinuities are from a poisoned network;
- and
- outputting a determination of whether the ANN is under attack based on the likelihood.
A processor configured to:
- train an artificial neural network (ANN) to generate inferences based on a function;
- identify a number of points of interest in an input space of the ANN;
- generate a random unit vector for each of the points of interest;
- generate a pattern for each point of interest using the trained ANN by, for each point of interest:
- generating a first inference as a function of the corresponding point of interest, generating a second inference as a function of the corresponding point of interest plus the unit vector, generating x_score, v_length, and v_delta for the point of interest based on the first and second inference;
- sort the points of interest by v_length;
- identify discontinuities in the sorted points of interest;
- compare the discontinuities with a corpus of models to determine a likelihood that the identified discontinuities are from a poisoned network;
- and
- output a determination of whether the ANN is under attack based on the likelihood.
Dependencies are inferred from the claim text.