Protecting deep learned models
Apparatus and methods are disclosed for using machine learning models with private and public domains. Operations can be applied to transform input to a machine learning model in a private domain that is kept secret or otherwise made unavailable to third parties. In one example of the disclosed technology, a method includes applying a private transform to produce transformed input, providing the transformed input to a machine learning model that was trained using a training set modified by the private transform, and generating inferences with the machine learning model using the transformed input. Examples of suitable transforms that can be employed include matrix multiplication, time or spatial domain to frequency domains, and partitioning a neural network model such that an input and at least one hidden layer form part of the private domain, while the remaining layers form part of the public domain.
1. Computer-readable storage devices or memory storing computer-readable instructions that when executed by at least one processor in a computing system, cause the computing system to train or generate inferences with a machine learning model using at least a first domain and a second domain of computing system resources, the computing system being configured to provide fewer access restrictions to a first domain of the computing system resources than access restrictions provided to a second domain of the computing system resources, the computer-readable instructions comprising:
instructions for a scrambler that cause the computing system, with the second domain computing resources to scramble input data by performing a transform operation on the input data, producing transformed input data for use training or generating inferences with the machine learning model; and
instructions that cause the computing system to, with the first domain computing resources, train or generate inferences with the machine learning model by forward propagating the transformed input through the machine learning model.
2. The computer-readable storage devices or memory of claim 1 , wherein the scrambler instructions comprise instructions that cause the computing system to scramble input to produce the transformed input data by at least one of:
performing matrix operations on the input data;
transforming audio or image data in the input data to frequency domain data; and
decrypting the input data using a decryption key or cipher.
3. The computer-readable storage devices or memory of claim 1 , wherein the scrambler instructions comprise instructions that cause the computing system to scramble input to produce the transformed input data by:
implementing some nodes of an artificial neural network in the second domain and the remaining nodes of the artificial neural network in the first domain.
4. The computer-readable storage devices or memory of claim 1 , the instructions further comprising:
instructions that cause the computing system to perform training reconfiguration of the machine learning model by:
forward propagating the transformed input to outputs of the machine learning model,
determining errors between expected values of the outputs and output values of the machine learning model outputs, and
adjusting at least one parameter of the machine learning model based on the determined errors; and
instructions that cause the computing system to repeatedly perform the training reconfiguration until a metric of the determined errors exceeds a predetermined threshold.
5. The computer-readable storage devices or memory of claim 1 , wherein the computer-readable storage devices or memory further comprise:
instructions that cause the computing system to generate a prediction for the input based on output of the machine learning model, the outputs being generated by forward propagating the transformed input through the machine learning model.
6. The computer-readable storage devices or memory of claim 1 , wherein the scrambler instructions further comprise:
instructions that cause the processor to perform the transform operation with a matrix provided using the second domain computing system resources, the matrix being restricted from being accessed by the first domain computing system resources.
7. The computer-readable storage devices or memory of claim 1 , wherein:
the input data is expressed in a physical domain and the transformed input data is in a frequency domain; and
the transformed input data comprises rearranged samples of the frequency domain, the samples being rearranged using the scrambler.
8. The computer-readable storage devices or memory of claim 1 , wherein the scrambler instructions comprise:
instructions that cause the computing system to obtain a decryption key from the second domain compute resources; and
instructions that cause the computing system to perform the transform by decrypting data.
9. The computer-readable storage devices or memory of claim 1 , wherein the machine learning model is an artificial neural network, and wherein the scrambler provides an input layer and nodes for a next layer of the artificial neural network that are accessible to computing system resources accessible to the second domain but not accessible to the first domain, and wherein at least some of the remaining nodes of the artificial neural network are accessible to computing system resources of the first domain.
10. A computing system comprising the at least one processor, the first domain and the second domain of the computing system resources, and the computer-readable storage devices or memory of claim 1 .
11. A method of operating a computing system having first compute resources and second compute resources, the method being performed with at least one processor of the computing system implementing a machine learning model using the first compute resources and the second compute resources, the method comprising:
by the computing system:
obtaining scrambler data from a first compute resource, the scrambler data of the first compute resources being restricted from being accessed by the second compute resources;
scrambling input data using the obtained scrambler data to produce transformed input data for use with the second compute resources of the machine learning model; and
propagating the transformed input to outputs of the machine learning model using the second compute resources.
12. The method of claim 11 , wherein the machine learning model is an artificial neural network, and wherein the method further comprises training the artificial neural network by:
repeatedly adjusting weights or activation functions for at least one node of the artificial neural network, the adjusted weights or activation functions being determined by calculating loss for the outputs produced by the propagating using the transformed input; and
storing data representing the adjusted weights or activation functions in a computer-readable storage device or medium.
13. The method of claim 11 , further comprising generating inferences with the machine learning model by:
outputting at least one predication for the input based on the outputs produced by the propagating using the transformed input.
14. The method of claim 11 , wherein:
the scrambler data comprises a decryption key; and
the scrambling comprises using the decryption key to move, transpose, and/or substitute data for at least a portion of the input.
15. The method of claim 11 , wherein the scrambler data comprises data, computer-executable instructions, or data and computer-executable instructions used to perform the scrambling the input, the method further comprising:
encrypting the scrambler data; and
storing the encrypted scrambler data in a computer-readable storage device or medium.
16. The method of claim 11 , wherein:
the machine learning model is an artificial neural network;
the scrambling the input uses the first compute resources to provide nodes for an input layer and nodes for at least a next layer of the artificial neural network; and
the propagating the transformed input comprises using the second compute resources, but not the first compute resources, to process node values for the remaining nodes of the artificial neural network.
17. The method of claim 16 , further comprising:
storing data representing at least a portion of the input layer nodes or the next layer nodes in a proprietary format in a computer-readable storage device or medium, access to stored data being restricted from being accessed by the first compute resources; and
storing data representing at least a portion of the remaining nodes in an open source format in a computer-readable storage device or medium accessible by the first compute resources.
18. The method of claim 16 , wherein the scrambling the input comprises:
transforming physical domain samples in the input to frequency domain samples; and
moving at least one of the frequency domain samples to a different position in the transformed input.
19. One or more computer-readable storage media storing computer-readable instructions, which when executed, cause the computer system to perform the method of claim 10 .
20. A computing system having a first domain of computing resources and a second domain of computing resources configured to implement a machine learning model, the computing system being configured to secure data stored in the first domain of computing resources with greater restriction than data stored in the second domain of the computing resources, the computing system comprising:
means for scrambling input data stored in the first domain into transformed input output to the second domain, the means for scrambling input being operable to perform a transform operation to produced transformed input data for use in training, or generating inferences with, the machine learning model; and
means for training or generating inferences with a machine learning model using the transformed input output to the second domain, the means for training being operable to train or generate inferences with the machine learning model by forward propagating the transformed input through the machine learning model.