Method for protecting a machine learning ensemble from copying
A method is provided for protecting a machine learning ensemble. In the method, a plurality of machine learning models is combined to form a machine learning ensemble. A plurality of data elements for training the machine learning ensemble is provided. The machine learning ensemble is trained using the plurality of data elements to produce a trained machine learning ensemble. During an inference operating phase, an input is received by the machine learning ensemble. A piecewise function is used to pseudo-randomly choose one of the plurality of machine learning models to provide an output in response to the input. The use of a piecewise function hides which machine learning model provided the output, making the machine learning ensemble more difficult to copy.
1. A method comprising:
providing a plurality of data elements for training a plurality of machine learning models combined into a machine learning ensemble;
training the plurality of machine learning models of the machine learning ensemble using the plurality of data elements to produce a trained machine learning ensemble; and
pseudo-randomly choosing, using a piecewise function, only one machine learning model of the plurality of machine learning models to receive an input, process the input, and provide an output in response to receiving the input during inference operation of the machine learning ensemble.
2. The method of claim 1 , wherein the piecewise function is further characterized as being a piecewise constant function.
3. The method of claim 1 , wherein each of the plurality of machine learning models is a neural network.
4. The method of claim 1 , wherein each machine learning model of the plurality of machine learning models has a different machine learning algorithm, and wherein the step of pseudo-randomly choosing takes the input as a seed for providing pseudo-randomness.
5. The method of claim 1 , wherein the pseudo-random function is defined as F:2 S →{0, 1, k−1} where s is a bit size of the input during the inference operation, and k is the number of machine learning models in the plurality of machine learning models.
6. The method of claim 1 , wherein training the machine learning ensemble uses a back-propagation training algorithm to produce the trained machine learning ensemble.
7. The method of claim 1 , wherein the training of each machine learning model of the plurality of machine learning models uses one of either a same training set selected from the plurality of data elements, different training sets that have one or more of the same data elements, and disjunct training sets.
8. The method of claim 1 , wherein all machine learning models of the plurality of machine learning models are binary classification models.
9. A method comprising:
combining a plurality of machine learning models into a machine learning ensemble;
providing a plurality of data elements for training the plurality of machine learning models of the machine learning ensemble;
training the machine learning ensemble using the plurality of data elements to produce a trained machine learning ensemble;
receiving an input during inference operation of the machine learning ensemble; and
pseudo-randomly choosing, using a piecewise constant function, only one machine learning model of the plurality of machine learning models to receive the input, process the input, and provide an output in response to the input.
10. The method of claim 9 , wherein each of the plurality of machine learning models is a neural network.
11. The method of claim 9 , wherein each machine learning model of the plurality of machine learning models has a different machine learning algorithm, and wherein the step of pseudo-randomly choosing takes the input as a seed for providing pseudo-randomness.
12. The method of claim 9 , wherein the pseudo-random function is defined as F:2 S →{0, 1, k−1} where s is a bit size of the input during the inference operation, and k is the number of machine learning models in the plurality of machine learning models.
13. The method of claim 9 , wherein training the machine learning ensemble uses a back-propagation training algorithm to produce the trained machine learning ensemble.
14. The method of claim 9 , wherein the training of each machine learning model of the plurality of machine learning models uses one of either a same training set selected from the plurality of data elements, different training sets that have one or more of the same data elements, and disjunct training sets.
15. The method of claim 9 , wherein all machine learning models of the plurality of machine learning models are binary classification models.
16. A method comprising:
combining a plurality of machine learning models into a machine learning ensemble;
providing a plurality of data elements for training the plurality of machine learning models of the machine learning ensemble, each machine learning model of the plurality of machine learning models are implemented differently;
training the plurality of machine learning models of the machine learning ensemble using the plurality of data elements to produce a trained machine learning ensemble;
receiving an input during inference operation of the machine learning ensemble; and
pseudo-randomly choosing, using a piecewise constant function, only one machine learning model of the plurality of machine learning models to receive the input, process the input, and provide an output in response to the input.
17. The method of claim 16 , wherein each machine learning model of the plurality of machine learning models is implemented with a different machine learning algorithm, and wherein the step of pseudo-randomly choosing takes the input as a seed for providing pseudo-randomness.
18. The method of claim 16 , training the plurality of machine learning models of the machine learning ensemble uses a back-propagation training algorithm to produce the trained machine learning ensemble.
19. The method of claim 16 , wherein each machine learning model of the plurality of machine learning models uses one of either a same training set selected from the plurality of data elements, different training sets that have one or more of the same data elements, and disjunct training sets.
20. The method of claim 16 , wherein all machine learning models of the plurality of machine learning models are binary classification models.