Watermark as honeypot for adversarial defense
AssigneePaypal, Inc.
InventorJiyi Zhang
Life of this patent
Estimating the term…
Abstract
Systems, methods, and computer program products for determining an attack on a neural network. A data sample is received at a first classifier neural network and at a watermark classifier neural network, wherein the first classifier neural network is trained using a first dataset and a watermark dataset. The first classifier neural network determines a classification label for the data sample. A watermark classifier neural network determines a watermark classification label for the data sample. A data sample is determined as an adversarial data sample based on the classification label for the data sample and the watermark classification label for the data sample.
Claims21
(canceled)
A system comprising:
- one or more memories configured to store a generator neural network and a classifier neural network;
- and
- a processor coupled to the one or more memories and configured to read instructions from the one or more memories to cause the instructions to perform operations comprising:
- determining a latent vector from a multi-variable gaussian distribution;
- generating, using the generator neural network, a watermark from the latent vector;
- and
- classifying, using the classifier neural network, the watermark into a classification label from classification labels.
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
- determining a latent vector from a one of a plurality of multi-variable gaussian distributions;
- generating, using a generator neural network, a watermark from the latent vector;
- and
- classifying, using a classifier neural network, the watermark into a classification label from classification labels.
A method comprising:
- determining a latent vector from one of multi-variable gaussian distributions, wherein each multi-variable gaussian distribution corresponds to a different latent vector;
- generating, using a generator neural network, a watermark from the latent vector;
- and
- classifying, using a classifier neural network, the watermark into a classification label from classification labels.
Dependencies are inferred from the claim text.