Machine learning model fingerprinting
Data is received that characterizes artefacts associated with each of a plurality of layers of a first machine learning model. Fingerprints are then generated for each of the artefacts in the layers of the first machine learning model. These generated fingerprints collectively form a model indicator for the first machine learning model. It is then determined whether the first machine learning model is derived from another machine learning model by performing a similarity analysis between the model indicator for the first machine learning model and model indicators generated for each of a plurality of reference machine learning models each comprising a respective set of fingerprints. Data characterizing the determination can be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.
1. A method for implementation by one or more computing devices comprising:
receiving data characterizing artefacts associated with each of a plurality of layers of a first machine learning model;
generating, for each layer of the first machine learning model, fingerprints corresponding to each of the artefacts in such layer, the generated fingerprints collectively forming a model indicator for the first machine learning model;
determining whether the first machine learning model is derived from another machine learning model by performing a similarity analysis between the model indicator for the first machine learning model and model indicators generated for each of a plurality of reference machine learning models each comprising a respective set of fingerprints, the similarity analysis determining a number of values in each fingerprint of the first machine learning model within each of a plurality of pre-defined bin to generate a first value distribution and comparing the first value distribution with value distributions for each of the plurality of reference machine learning models; and
providing data characterizing the determining to a consuming application or process.
2. The method of claim 1 , wherein the artefacts comprise: weights, biases, running mean, and running variance.
3. The method of claim 1 , wherein the similarity analysis is conducted on an fingerprint-by-fingerprint basis.
4. The method of claim 1 , wherein the similarity analysis is conducted on a model indicator-by-model indicator basis.
5. The method of claim 1 , wherein each fingerprint comprises a matrix of values.
6. The method of claim 1 further comprising:
determining, as part of the similarity analysis, a Euclidean distance from each fingerprint of the first machine learning model relative to each fingerprint of the reference machine learning models.
7. The method of claim 1 , wherein the similarity analysis comprises:
inputting a reference set of inputs into the first machine learning model to generate an output set; and
comparing the output set to outputs for each of a plurality of reference output sets each corresponding to a different one of the reference machine learning models.
8. The method of claim 1 , wherein the providing data comprises one or more of: storing the data characterizing the determining in physical persistence, loading the data characterizing the determining into memory, transmitting the data characterizing the determining over a network to a remote computing device, or causing the data characterizing the determining to be displayed in a graphical user interface.
9. The method of claim 1 , wherein the derivation determination is based on a level of similarity between the first machine learning model and one of the reference machine learning models.
10. The method of claim 9 further comprising: generating a score characterizing the level of similarity, wherein the score forms part of the provided data.
11. The method of claim 1 further comprising:
initiating, by the consuming application or process and based on the determining, a remediation operation relative to the first machine learning model.
12. The method of claim 11 , wherein the remediation operation comprises: isolating or blocking access to the first machine learning model.
13. The method of claim 11 , wherein the remediation operation comprises: partially disabling functionality of the first machine learning model.
14. The method of claim 11 , wherein the remediation operation comprises: logging inputs and/or outputs of the first machine learning model.
15. The method of claim 11 , wherein the remediation operation comprises: poisoning the first machine learning model.
16. The method of claim 1 , wherein at least one of the artefacts only has a single corresponding generated fingerprint.
17. The method of claim 1 , wherein at least one of the artefacts has a plurality of corresponding generated fingerprints.
18. A method for implementation by one or more computing devices comprising:
receiving data characterizing artefacts associated with each of a plurality of layers of a machine learning model;
generating, for each layer of the machine learning model, fingerprints corresponding to each of the artefacts in such layer, the generated fingerprints collectively forming a model indicator for the machine learning model; and
providing the model indicator to a consuming application or process
wherein the consuming application or process conducts a similarity analysis to determine a provenance of the machine learning model, the similarity analysis comprising determining a number of values in each fingerprint of the machine learning model within each of a plurality of pre-defined bin to generate a first value distribution and comparing the first value distribution with value distributions for each of a plurality of reference machine learning models.
19. A system comprising:
at least one data processor; and
memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
receiving data characterizing artefacts associated with each of a plurality of layers of a first machine learning model;
generating, for each layer of the first machine learning model, fingerprints corresponding to each of the artefacts in such layer, the generated fingerprints collectively forming a model indicator for the first machine learning model;
determining whether the first machine learning model is derived from another machine learning model by performing a similarity analysis between the model indicator for the first machine learning model and model indicators generated for each of a plurality of reference machine learning models each comprising a respective set of fingerprints, the similarity analysis determining a number of values in each fingerprint of the first machine learning model within each of a plurality of pre-defined bin to generate a first value distribution and comparing the first value distribution with value distributions for each of the plurality of reference machine learning models; and
providing data characterizing the determining to a consuming application or process.
20. The system of claim 19 , wherein the operations further comprise:
initiating, by the consuming application or process and based on the determining, a remediation operation relative to the first machine learning model.