System and method for managing AI models using view level analysis
Methods and systems for managing an attack on an artificial intelligence (AI) model using view level analysis are disclosed. As AI models are updated over time using new training data, snapshots of the AI models may be obtained. The snapshots may include information regarding the training data used to train the AI model, the parameters of the AI model, and/or the inferences obtained from the AI model. A malicious party may perform an attack on the AI model by introducing poisoned training data through a data source. The content of supplied poisoned training data may be determined based on a view level into the AI model. The view level of the malicious party may be used to design countermeasures to mitigate and/or prevent future attacks to the AI model.
1 . A method for managing an artificial intelligence (AI) model, comprising:
identifying a poisoned training dataset that was used to train an AI model instance; and
after identifying the poisoned training dataset:
identifying, based at least in part on the poisoned training dataset, a portion of a snapshot of the AI model instance that a malicious party had visibility into when selecting content of the poisoned training dataset by performing at least a training data view analysis to obtain a training data view analysis result, the training data view analysis comprising:
attempting to match a portion of the poisoned training dataset to a portion of a first ingest dataset obtained from a data source that did not provide the poisoned training dataset in order to identify a quantity of the poisoned training dataset that matches the first ingest dataset; and
making a first determination, using the quantity and a criterion associated with the quantity, regarding whether the malicious party had visibility into the first ingest dataset from the portion of the snapshot;
classifying an amount of information the malicious party has regarding the AI model instance based on the portion of the snapshot to obtain a view level classification, the view level classification being used to identify one or more systems that are compromised; and
performing a remediation based on the view level classification.
2 . The method of claim 1 , wherein identifying the portion of the snapshot further comprises:
performing a model weight view analysis to obtain a model weight view analysis result, the model weight view analysis being based on:
the poisoned training dataset,
a second ingest dataset from a data source that provided the poisoned training dataset, and
inferences generated using the second ingest dataset.
3 . The method of claim 2 , wherein performing the model weight view analysis comprises:
enumerating the poisoned training dataset to identify a first cardinality of a portion of the second ingest dataset;
enumerating the second ingest dataset to identify a second cardinality of the second ingest dataset;
obtaining, using the first cardinality and the second cardinality, a quantification statistic; and
based on the quantification statistic and a criterion for the quantification statistic, making a second determination regarding whether the malicious party had visibility into a model weight from the portion of the snapshot.
4 . The method of claim 3 , wherein the model weight view analysis result indicates:
in a first instance of the second determination where the quantification statistic satisfies the criterion:
that the malicious party had visibility of the model weight while selecting content of the poisoned training dataset; and
in a second instance of the second determination where the quantification statistic fails to satisfy the criterion:
that the malicious party did not have visibility of the model weight while selecting the content of the poisoned training dataset.
5 . The method of claim 4 , wherein
the training data view analysis is based on:
the poisoned training dataset,
the first ingest dataset, and
inferences generated using the first ingest dataset.
6 . The method of claim 5 , wherein performing the training data view analysis further comprises:
obtaining, using the quantity of the poisoned training dataset and before making the first determination, a second quantification statistic, wherein the first determination is made based on the second quantification statistic and the criterion associated with the quantity is a second criterion for the second quantification statistic.
7 . The method of claim 6 , wherein the training data view analysis result indicates:
in a first instance of the first determination where the second quantification statistic satisfies the second criterion:
that the malicious party had visibility of the first ingest dataset and the inferences generated using the first ingest dataset while selecting the content of the poisoned training dataset; and
in a second instance of the first determination where the second quantification statistic fails to satisfy the second criterion:
that the malicious party did not have visibility of the first ingest dataset and the inferences generated using the first ingest dataset while selecting the content of the poisoned training dataset.
8 . The method of claim 1 , wherein performing the remediation based on the view level classification comprises:
performing an action set to secure the one or more systems that are compromised.
9 . A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for managing an artificial intelligence (AI) model, the operations comprising:
identifying a poisoned training dataset that was used to train an AI model instance; and
after identifying the poisoned training dataset:
identifying, based at least in part on the poisoned training dataset, a portion of a snapshot of the AI model instance that a malicious party had visibility into when selecting content of the poisoned training dataset by performing at least a training data view analysis to obtain a training data view analysis result, the training data view analysis comprising:
attempting to match a portion of the poisoned training dataset to a portion of a first ingest dataset obtained from a data source that did not provide the poisoned training dataset in order to identify a quantity of the poisoned training dataset that matches the first ingest dataset; and
making a first determination, using the quantity and a criterion associated with the quantity, regarding whether the malicious party had visibility into the first ingest dataset from the portion of the snapshot;
classifying an amount of information the malicious party has regarding the AI model instance based on the portion of the snapshot to obtain a view level classification, the view level classification being used to identify one or more systems that are compromised; and
performing a remediation based on the view level classification.
10 . The non-transitory machine-readable medium of claim 9 , wherein identifying the portion of the snapshot further comprises:
performing a model weight view analysis to obtain a model weight view analysis result, the model weight view analysis being based on:
the poisoned training dataset,
a second ingest dataset from a data source that provided the poisoned training dataset, and
inferences generated using the second ingest dataset.
11 . The non-transitory machine-readable medium of claim 10 , wherein performing the model weight view analysis comprises:
enumerating the poisoned training dataset to identify a first cardinality of a portion of the second ingest dataset;
enumerating the second ingest dataset to identify a second cardinality of the second ingest dataset;
obtaining, using the first cardinality and the second cardinality, a quantification statistic; and
based on the quantification statistic and a criterion for the quantification statistic, making a second determination regarding whether the malicious party had visibility into a model weight from the portion of the snapshot.
12 . The non-transitory machine-readable medium of claim 11 , wherein the model weight view analysis result indicates:
in a first instance of the second determination where the quantification statistic satisfies the criterion:
that the malicious party had visibility of the model weight while selecting content of the poisoned training dataset; and
in a second instance of the second determination where the quantification statistic fails to satisfy the criterion:
that the malicious party did not have visibility of the model weight while selecting the content of the poisoned training dataset.
13 . The non-transitory machine-readable medium of claim 12 , wherein
the training data view analysis being based on:
the poisoned training dataset,
the first ingest dataset, and
inferences generated using the first ingest dataset.
14 . The non-transitory machine-readable medium of claim 13 , wherein performing the training data view analysis further comprises:
obtaining, using the quantity of the poisoned training dataset and before making the first determination, a second quantification statistic, wherein the first determination is made based on the second quantification statistic and the criterion associated with the quantity is a second criterion for the second quantification statistic.
15 . The non-transitory machine-readable medium of claim 9 , wherein performing the remediation based on the view level classification comprises:
performing an action set to secure the one or more systems that are compromised.
16 . A data processing system, comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for managing an artificial intelligence (AI) model, the operations comprising:
identifying a poisoned training dataset that was used to train an AI model instance; and
after identifying the poisoned training dataset:
identifying, based at least in part on the poisoned training dataset, a portion of a snapshot of the AI model instance that a malicious party had visibility into when selecting content of the poisoned training dataset by performing at least a training data view analysis to obtain a training data view analysis result, the training data view analysis comprising:
attempting to match a portion of the poisoned training dataset to a portion of a first ingest dataset obtained from a data source that did not provide the poisoned training dataset in order to identify a quantity of the poisoned training dataset that matches the first ingest dataset; and
making a first determination, using the quantity and a criterion associated with the quantity, regarding whether the malicious party had visibility into the first ingest dataset from the portion of the snapshot;
classifying an amount of information the malicious party has regarding the AI model instance based on the portion of the snapshot to obtain a view level classification, the view level classification being used to identify one or more systems that are compromised; and
performing a remediation based on the view level classification.
17 . The data processing system of claim 16 , wherein identifying the portion of the snapshot further comprises:
performing a model weight view analysis to obtain a model weight view analysis result, the model weight view analysis being based on:
the poisoned training dataset,
a second ingest dataset from a data source that provided the poisoned training dataset, and
inferences generated using the second ingest dataset.
18 . The data processing system of claim 17 , wherein performing the model weight view analysis comprises:
enumerating the poisoned training dataset to identify a first cardinality of a portion of the second ingest dataset;
enumerating the second ingest dataset to identify a second cardinality of the second ingest dataset;
obtaining, using the first cardinality and the second cardinality, a quantification statistic; and
based on the quantification statistic and a criterion for the quantification statistic, making a second determination regarding whether the malicious party had visibility into a model weight from the portion of the snapshot.
19 . The data processing system of claim 18 , wherein the model weight view analysis result indicates:
in a first instance of the second determination where the quantification statistic satisfies the criterion:
that the malicious party had visibility of the model weight while selecting content of the poisoned training dataset; and
in a second instance of the second determination where the quantification statistic fails to satisfy the criterion:
that the malicious party did not have visibility of the model weight while selecting the content of the poisoned training dataset.
20 . The data processing system of claim 16 , wherein performing the remediation based on the view level classification comprises:
performing an action set to secure the one or more systems that are compromised.