Detecting adversarial attacks through decoy training

1. A method, comprising:

generating decoy data from regular data by applying perturbations to the regular data;

associating counterfeit labels to the decoy data;

training a deep neural network, which has been trained with the regular data, with the decoy data having the associated counterfeit labels;

responsive to a client request comprising input data, operating the trained deep neural network on the input data;

performing post-processing using at least an output of the operated trained deep neural network to determine whether the input data is regular data or decoy data; and

performing one or more actions based on a result of the performed post-processing.

2. The method of claim 1 , wherein:

the deep neural network is a first deep neural network, wherein output of the first deep neural network comprises a class of regular data into which the input data is placed;

the method further comprises training a second deep neural network with the regular data and the decoy data, wherein an output of the second deep neural network comprises a confidence score indicating whether input data are either regular data or decoy data;

the method further comprises, responsive to the client request, also operating the second deep neural network on the input data;

performing post-processing further comprises determining whether an output of the second deep neural network indicates the input data is regular data or decoy data; and

performing one or more actions further comprises performing one of the following:

responsive to a determination by the second deep neural network that the client request comprises decoy data, performing one or more predetermined protective actions; or

responsive to a determination by the second deep neural network that the client request comprises regular data, outputting toward a client that made the client request an output of the first deep neural network.

3. The method of claim 2 , wherein the one or more predetermined protective actions comprises one of the following: returning correct labels; returning random labels; or blocking the client request without a returned response.

4. The method of claim 2 , wherein the output of the first deep neural network comprises a confidence score for each class into which the input data are assigned.

5. The method of claim 1 , wherein:

training the deep neural network with the regular data and the decoy data further comprises:

training the deep neural network with both regular data that has been labeled with true labels and with the decoy data, wherein the decoy data has been labeled with counterfeit labels;

recording results of output of a logits layer in the deep neural network for both the regular data and the decoy data;

performing post-processing further comprises comparing a first similarity between results of the logits layer for the input data and the recorded results of the logits layer for the regular data and a second similarity between the recorded results of the logits layer for the decoy data; and

performing one or more actions further comprises performing one of the following:

responsive to a determination the results of the logits layer for the input data and the recorded results of the logits layer for the decoy data are most similar according to the comparison, performing one or more predetermined protective actions; or

responsive to a determination the results of the logits layer for the input data and the recorded results of the logits layer for the regular data are most similar according to the comparison, outputting toward a client that made the client request an output of the deep neural network.

6. The method of claim 5 , wherein the one or more predetermined protective actions comprises one of the following: returning correct labels; returning random labels; or blocking the client request without a returned response.

7. The method of claim 5 , wherein the output of the deep neural network comprises a confidence score for each class into which the input data are assigned.

8. The method of claim 5 , wherein the first and second similarities are determined using one of a general cosine similarity or a Euclidean distance.

9. The method of claim 5 , wherein:

the input data is determined to be in a particular class;

the first similarity between results of the logits layer for the input data and the recorded results of the logits layer for the regular data is performed for all regular data in the particular class;

the second similarity between the recorded results of the logits layer for the decoy data is performed for all decoy data in the particular class; and

the comparing selects whether the input data is regular data or decoy data based on a top k results of the logits layer for regular data or decoy data in the particular class that are deemed closest by the first and second similarities to the results for the logits layer for the input data.

10. An apparatus, comprising:

one or more processors;

one or more memories having program code, wherein the one or more processors, in response to retrieving and executing the program code, cause the apparatus to perform operations comprising:

generating decoy data from regular data by applying perturbations to the regular data;

associating counterfeit labels to the decoy data;

training a deep neural network, which has been trained with the regular data, with the decoy data having the associated counterfeit labels;

training a deep neural network, which has been trained with the regular data, with the decoy data;

responsive to a client request comprising input data, operating the trained deep neural network on the input data;

performing post-processing using at least an output of the operated trained deep neural network to determine whether the input data is regular data or decoy data; and

performing one or more actions based on a result of the performed post-processing.

11. The apparatus of claim 10 , wherein:

the deep neural network is a first deep neural network, wherein output of the first deep neural network comprises a class of regular data into which the input data is placed;

the apparatus further comprises training a second deep neural network with the regular data and the decoy data, wherein an output of the second deep neural network comprises a confidence score indicating whether input data are either regular data or decoy data;

the apparatus further comprises, responsive to the client request, also operating the second deep neural network on the input data;

performing post-processing further comprises determining whether an output of the second deep neural network indicates the input data is regular data or decoy data; and

performing one or more actions further comprises performing one of the following:

responsive to a determination by the second deep neural network that the client request comprises decoy data, performing one or more predetermined protective actions; or

responsive to a determination by the second deep neural network that the client request comprises regular data, outputting toward a client that made the client request an output of the first deep neural network.

12. The apparatus of claim 11 , wherein the one or more predetermined protective actions comprises one of the following: returning correct labels; returning random labels; or blocking the client request without a returned response.

13. The apparatus of claim 10 , wherein the output of the deep neural network comprises a confidence score for each class into which the input data are assigned.

14. The apparatus of claim 10 , wherein:

training the deep neural network with the regular data and the decoy data further comprises:

training the deep neural network with both regular data that has been labeled with true labels and with the decoy data, wherein the decoy data has been labeled with counterfeit labels;

recording results of output of a logits layer in the deep neural network for both the regular data and the decoy data;

performing post-processing further comprises comparing a first similarity between results of the logits layer for the input data and the recorded results of the logits layer for the regular data and a second similarity between the recorded results of the logits layer for the decoy data; and

performing one or more actions further comprises performing one of the following:

responsive to a determination the results of the logits layer for the input data and the recorded results of the logits layer for the decoy data are most similar according to the comparison, performing one or more predetermined protective actions; or

responsive to a determination the results of the logits layer for the input data and the recorded results of the logits layer for the regular data are most similar according to the comparison, outputting toward a client that made the client request an output of the deep neural network.

15. The apparatus of claim 14 , wherein the one or more predetermined protective actions comprises one of the following: returning correct labels; returning random labels; or blocking the client request without a returned response.

16. The apparatus of claim 14 , wherein the output of the deep neural network comprises a confidence score for each class into which the input data are assigned.

17. The apparatus of claim 14 , wherein the first and second similarities are determined using one of a general cosine similarity or a Euclidean distance.

18. The apparatus of claim 14 , wherein:

the input data is determined to be in a particular class;

the first similarity between results of the logits layer for the input data and the recorded results of the logits layer for the regular data is performed for all regular data in the particular class;

the second similarity between the recorded results of the logits layer for the decoy data is performed for all decoy data in the particular class; and

the comparing selects whether the input data is regular data or decoy data based on a top k results of the logits layer for regular data or decoy data in the particular class that are deemed closest by the first and second similarities to the results for the logits layer for the input data.

19. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a device to cause the device to perform operations comprising:

generating decoy data from regular data by applying perturbations to the regular data;

associating counterfeit labels to the decoy data;

training a deep neural network, which has been trained with the regular data, with the decoy data having the associated counterfeit labels;

responsive to a client request comprising input data, operating the trained deep neural network on the input data;

performing post-processing using at least an output of the operated trained deep neural network to determine whether the input data is regular data or decoy data; and

performing one or more actions based on a result of the performed post-processing.