Multimodal AI model protection using embeddings
Techniques for assessing multi-modal inputs to a machine learning model involve receiving a multimodal input containing an image, producing several transformed versions of that image, and generating embeddings for both the original and transformed images. A pairwise similarity analysis among all embeddings is conducted to determine distance values. Two dissimilarity metrics can then be calculated: one reflecting the differences among the transformed images, and another comparing the original image to its transformed versions. If the dissimilarity among the transformed images is greater than that between the original and transformed images plus a threshold, the system triggers a remediation action. This action either blocks the input from being processed by the machine learning model or prevents the model's output from being returned to the requester, thereby enhancing the reliability and security of the model.
1 . A method for implementation by one or more computing devices comprising:
receiving a multi-modal input to a machine learning model, the multi-modal input comprising an image;
generating a plurality of transformed versions of the image;
generating an embedding for the image and an embedding for each of the transformed versions of the image;
performing a pairwise similarity analysis among the generated embeddings to generate a distance value amongst each pair of embeddings;
generating a first dissimilarity metric based on the distance values corresponding to the transformed versions of the image excluding the image;
generating a second dissimilarity metric based on the distance values corresponding to the image relative to the transformed versions of the image; and
initiating at least one remediation action (i) preventing the multi-modal input to be ingested by the machine learning model or (ii) blocking an output of the machine learning model after ingesting the input in response to the first dissimilarity metric being greater than the second dissimilarity metric.
2 . The method of claim 1 , wherein the plurality of transformed versions of the image are generated by adding one or more of: Gaussian noise, impulse noise, shot noise, periodic noise, speckle noise, or quantization noise, to the image.
3 . The method of claim 1 , wherein the multi-modal input is allowed to be ingested by the machine learning model in response to a difference of the first dissimilarity metric and the second dissimilarity metric being equal to or greater than a first threshold.
4 . The method of claim 3 , wherein the at least one remediation action is initiated in response to a difference of the first dissimilarity metric and the second dissimilarity metric being below the first threshold.
5 . The method of claim 1 , wherein the similarity analysis comprises a vector similarity analysis using a vector corresponding to each generated embedding.
6 . The method of claim 1 , wherein the similarity analysis comprises: a cosine similarity analysis, a Euclidean distance, a Jaccard similarity analysis, a Manhattan distance, a Minkowski distance, a Chebyshev distance, a dot product, a Mahalanobis distance, or a Word Movers's distance.
7 . The method of claim 1 , wherein the first dissimilarity metric and the second dissimilarity metric comprises average or mean values for the respective groups of embeddings.
8 . The method of claim 1 , wherein the embeddings are generated using an image embedding model forming part of the machine learning model.
9 . The method of claim 1 , wherein the embeddings are generated using a second machine learning model external to the machine learning model.
10 . The method of claim 1 , wherein there are two or more embeddings generated for each of the transformed versions of the image.
11 . The method of claim 10 , wherein a plurality of different machine learning models external to the machine learning model are used to generated the two or more embeddings of the transformed versions of each image.
12 . The method of claim 1 , wherein the input comprises audio, video, and/or text in addition to the image.
13 . The method of claim 1 , wherein the input comprises two or more images and the analysis is performed for each image individually.
14 . A method for implementation by one or more computing devices comprising:
receiving a multi-modal input to a machine learning model, the multi-modal input comprising a first portion in a first modality and a second portion in a second, different modality;
generating a plurality of transformed versions of the first portion;
generating an embedding for the first portion and an embedding for each of the transformed versions of the first portion;
performing a pairwise similarity analysis among the generated embeddings to generate a distance value amongst each pair of embeddings;
generating a first dissimilarity metric based on the distance values corresponding to the transformed versions of the image excluding the image;
generating a second dissimilarity metric based on the distance values corresponding to the image relative to the transformed versions of the image; and
initiating at least one remediation action (i) preventing the multi-modal input to be ingested by the machine learning model or (ii) blocking an output of the machine learning model after ingesting the input in response to the first dissimilarity metric being greater than the second dissimilarity metric.
15 . The method of claim 14 , wherein the plurality of transformed versions of the first portion are generated by adding one or more of: Gaussian noise, impulse noise, shot noise, periodic noise, speckle noise, or quantization noise, to the image.
16 . The method of claim 14 , wherein the multi-modal input is allowed to be ingested by the machine learning model in response to a difference of the first dissimilarity metric and the second dissimilarity metric being equal to or greater than a first threshold.
17 . The method of claim 16 , wherein the at least one remediation action is initiated in response to a difference of the first dissimilarity metric and the second dissimilarity metric being below the first threshold.
18 . The method of claim 14 , wherein the similarity analysis comprises a vector similarity analysis using a vector corresponding to each generated embedding.
19 . The method of claim 14 , wherein the similarity analysis comprises: a cosine similarity analysis, a Euclidean distance, a Jaccard similarity analysis, a Manhattan distance, a Minkowski distance, a Chebyshev distance, a dot product, a Mahalanobis distance, or a Word Movers's distance.
20 . The method of claim 14 , wherein the first dissimilarity metric and the second dissimilarity metric comprises average or mean values for the respective groups of embeddings.
21 . The method of claim 14 , wherein the embeddings are generated using an image embedding model forming part of the machine learning model.
22 . The method of claim 14 , wherein the embeddings are generated using a second machine learning model external to the machine learning model.
23 . The method of claim 14 , wherein the first modality comprises an image.
24 . The method of claim 14 , wherein the first modality comprises audio.
25 . The method of claim 14 , wherein the first modality comprises video.
26 . A method for implementation by one or more computing devices comprising:
receiving a multi-modal input to a machine learning model, the multi-modal input comprising an image;
generating a plurality of transformed versions of the image;
generating an embedding for the image and an embedding for each of the transformed versions of the image;
performing a pairwise similarity analysis among the generated embeddings to generate a distance value amongst each pair of embeddings;
generating a first dissimilarity metric based on the distance values corresponding to the transformed versions of the image excluding the image;
generating a second dissimilarity metric based on the distance values corresponding to the image relative to the transformed versions of the image; and
initiating at least one remediation action (i) preventing the multi-modal input to be ingested by the machine learning model or (ii) blocking an output of the machine learning model after ingesting the input in response to the first dissimilarity metric being greater than the second dissimilarity metric plus a threshold.
27 . A method for implementation by one or more computing devices comprising:
receiving a multi-modal input to a machine learning model, the multi-modal input comprising two or more image;
for each image:
generating a plurality of transformed versions of the image;
generating an embedding for the image and an embedding for each of the transformed versions of the image;
performing a pairwise similarity analysis among the generated embeddings to generate a distance value amongst each pair of embeddings;
generating a first dissimilarity metric based on the distance values corresponding to the transformed versions of the image excluding the image;
generating a second dissimilarity metric based on the distance values corresponding to the image relative to the transformed versions of the image; and
initiating, based on the first similarity metrics and the second similarity metrics generated for the images, at least one remediation action (i) preventing the multi-modal input to be ingested by the machine learning model or (ii) blocking an output of the machine learning model after ingesting the input.
28 . The method of claim 1 , wherein the multi-modal input is received by a proxy in a model environment hosting the machine learning model, the proxy transmitting data characterizing each image to a monitoring environment comprising an analysis engine that performs the pairwise similarity analysis and a remediation engine that, responsive to the first and second dissimilarity metrics for at least one image, returns an instruction to the proxy to block forwarding of the flagged image prior to ingestion by the machine learning model.
29 . The method of claim 1 , wherein the machine learning model is an adapter-based vision-language multimodal model, embeddings are generated by an image embedding model forming part of the multimodal model on a graphics processing unit within the model environment, the transformed versions are produced by adding pixel-wise uniform random noise to normalized images, the pairwise similarity analysis comprises cosine similarity, and the first and second dissimilarity metrics are computed as means.
30 . The method of claim 1 , wherein the monitoring environment further comprises a proxy of the machine learning model configured to emulate the model for analysis, and initiating the remediation action comprises quarantining only images whose second dissimilarity metric relative to the first dissimilarity metric violates a per-image threshold while allowing remaining images and non-image portions of the multi-modal input to proceed to the machine learning model, and generating an alert with event metadata stored in a monitoring data store.