Granted Patent B2

US 11,528,259 · App. 17/499,353 · Granted Dec 13, 2022

Inventors: Gharib Gharibi (Lenexa, KS); Babak Poorebrahim Gilkalaye (Kansas City, MO); Riddhiman Das (Parkville, MO)

Assignee: TripleBlind, Inc.

H04L63/0428G06F17/16G06K9/623G06K9/6267G06N3/04G06N3/082G06Q20/401G06Q30/0623H04L9/008H04L9/0625G06Q2220/00H04L2209/46

Abstract

Claims (58)

1. A method comprising:

generating a fingerprint by a process comprising:

generating, based on a training dataset, a reference model and a surrogate model;

selecting datapoints from the training dataset that are predicted correctly by a source model as a group of adversarial candidates;

selecting, from the group of adversarial candidates, a sub-group of candidates that each have a low confidence score according to a threshold to yield a sub-group of adversarial candidates;

adding noise to each candidate of the sub-group of adversarial candidates to yield a noisy group of adversarial examples;

testing the noisy group of adversarial examples against the source model to obtain a set of source model outputs that the source model predicts correctly;

testing the set of source model outputs against the reference model to yield a set of reference model outputs;

testing the set of source model outputs against the surrogate model to yield a set of surrogate model outputs; and

identifying the fingerprint based on which ones from the set of source model outputs, the set of reference model outputs and the set of surrogate model outputs pass as adversarial examples against the source model and the surrogate model, but not the reference model;

receiving a suspect model at a service node;

based on a request to test the suspect model, applying the fingerprint to the suspect model to generate an output; and

when the output has an accuracy that is equal to or greater than a threshold, determining that the suspect model is derived from the source model.

2. The method of claim 1 , wherein the training dataset is from a same distribution of a source model dataset.

3. The method of claim 1 , wherein the training dataset comprises at least some data from a source model dataset.

4. The method of claim 1 , wherein fingerprint candidates comprise ones of the noisy group of adversarial examples that lead to a fully successful adversarial attack accuracy against the source model.

5. The method of claim 1 , further comprising:

sharing a hashed version of the set of fingerprints with a trusted third party.

6. The method of claim 1 , wherein generating the fingerprint further comprises constructing respective adversarial examples with the noise that causes a receiving model to misclassify an input.

7. The method of claim 6 , wherein the noise is imperceptible noise.

8. The method of claim 1 , further comprising:

testing a suspect model by using the fingerprint against the suspect model to determine whether an overall accuracy operating on the fingerprint is equal to or greater than the threshold.

9. The method of claim 8 , further comprising:

determining, when the overall accuracy operating on the fingerprint is equal to or greater than the threshold, that the suspect model was derived from the source model.

10. A method comprising:

receiving, from a model owner node, a source model and a verification key at a service node;

receiving a suspect model at the service node;

transmitting a request to the model owner node for a proof of ownership relative to the suspect model;

in response to the request, receiving a marking key at the service node from the model owner node; and

based on the marking key and the verification key, determining whether the suspect model was derived from the source model by testing the suspect model to determine whether a fingerprint produces a same output from both the source model and the suspect model, wherein the fingerprint passes against the source model and a surrogate model, but not a reference model, wherein the fingerprint is generated by a process comprising:

generating, based on a training dataset, the reference model and the surrogate model;

selecting datapoints from the training dataset that are predicted correctly by the source model as a group of adversarial candidates;

selecting from the group of adversarial candidates a sub-group of candidates that each have a low confidence score according to a threshold to yield a sub-group of adversarial candidates;

adding noise to each candidate of the sub-group of adversarial candidates to yield a noisy group of adversarial examples;

testing the noisy group of adversarial examples against the source model to obtain a set of source model successful adversarial examples that the source model predicts correctly;

testing the set of source model successful adversarial examples against the reference model to yield a set of reference model outputs;

testing the set of source model successful adversarial examples against the surrogate model to yield a set of surrogate model outputs; and

identifying the fingerprint based on which ones from the set of source model successful adversarial examples, the set of reference model outputs and the set of surrogate model outputs pass as adversarial examples against the source model and the surrogate model, but not the reference model.

11. The method of claim 10 , wherein at least one of the marking key and the verification key comprises added noise which causes a predictable output from the source model and surrogate models derived therefrom.

12. A method comprising:

receiving, from a model owner node, a source model and a fingerprint associated with the source model;

receiving a suspect model at a service node;

based on a request to test the suspect model, applying the fingerprint to the suspect model to generate an output; and

when the output has an accuracy that is equal to or greater than a threshold, determining that the suspect model is derived from the source model, wherein the fingerprint is generated by a process comprising:

generating, based on a training dataset, a reference model and a surrogate model;

selecting datapoints from the training dataset that are predicted correctly by the source model as a group of adversarial candidates;

selecting from the group of adversarial candidates a sub-group of candidates that each have a low confidence score according to a threshold to yield a sub-group of adversarial candidates;

adding noise to each candidate of the sub-group of adversarial candidates to yield a noisy group of adversarial examples;

testing the noisy group of adversarial examples against the source model to obtain a set of source model successful adversarial examples that the source model predicts correctly;

testing the set of source model successful adversarial examples against the reference model to yield a set of reference model outputs;

testing the set of source model successful adversarial examples against the surrogate model to yield a set of surrogate model outputs; and

identifying the fingerprint based on which ones from the set of source model successful adversarial examples, the set of reference model outputs and the set of surrogate model outputs pass as adversarial examples against the source model and the surrogate model, but not the reference model.

13. The method of claim 12 , wherein the noisy group of adversarial examples comprises ones of the group of adversarial candidates that lead to a fully successful adversarial attack accuracy against the source model.

14. The method of claim 12 , further comprising:

sharing a hashed version of the fingerprint with a trusted third party.

15. The method of claim 12 , wherein generating the fingerprint further comprises constructing respective adversarial examples with the noise that causes a receiving model to misclassify an input.

16. The method of claim 15 , wherein the noise is imperceptible noise.

17. The method of claim 12 , wherein the threshold is approximately 0.60.

Assignments (4)

Continuity (11)