Cloud based machine learning model attack guard
Embodiments prevent a reverse engineering attack on a machine learning (“ML”) model. Embodiments receive a first set of requests from a plurality of users to the ML model. Based on the first set of requests, embodiments identify a first user attempting to attack the ML model and, in response to the identifying, generate a shadow model that is similar to the ML model. Embodiments receive a second set of requests from the first user to the ML model and, in response to the second set of requests, generate an ML model set of responses and a shadow model set of responses. Embodiments compare the ML model set of responses with the shadow model set of responses and, based on the comparison, determine whether the first user is attempting the reverse engineering attack on the ML model.
1. A method of preventing a reverse engineering attack on a cloud based trained machine learning (ML) model, the method comprising:
receiving a first set of inference requests from a plurality of cloud users to the trained ML model;
based on the first set of inference requests, identifying a first user attempting to attack the trained ML model;
in response to the identifying, generating and training a shadow model that is similar to the trained ML model, training the shadow model using further inference requests from the plurality of cloud users to the trained ML model;
receiving a second set of inference requests from the first user to the trained ML model;
in response to the second set of inference requests, generating trained ML model set of responses and a trained shadow model set of responses;
comparing the trained ML model set of responses with the trained shadow model set of responses; and
based on the comparison, determining whether the first user is attempting the reverse engineering attack on the trained ML model.
2. The method of claim 1 , wherein the identifying the first user attempting to attack the ML model comprises clustering the first set of requests per user and per unit time.
3. The method of claim 1 , wherein the ML model comprises an algorithm and hyperparameters, and the generating the shadow model that is similar to the ML model is based at least on the algorithm and hyperparameters;
the comparing comprising comparing one or more of a shadow model algorithm, shadow model parameters and shadow model hyperparameters with one or more of an ML model algorithm, ML model parameters and ML model hyperparameters.
4. The method of claim 1 , wherein the ML model comprises an algorithm and hyperparameters, and the generating the shadow model that is similar to the ML model is generated without knowledge of the algorithm and the hyperparameters.
5. The method of claim 1 , the comparing the ML model set of responses with the shadow model set of responses comprises determining a risk score comprising an amount of similarity between the ML model and the shadow model.
6. The method of claim 5 , the risk score based on one or more comparison parameters comprising: user profile activity, feature importance activity, feature correlation activity, data type activity and algorithm identification activity.
7. The method of claim 1 , further comprising generating an alert to a model guard when it is determined whether the first user is attempting the reverse engineering attack on the ML model.
8. The method of claim 7 , wherein in response to the alert, the model guard preventing the reverse engineering attack by executing at least one of the following protective measures in response to further requests from the first user: removing all class probabilities for classification problems, only returning a predicted class label, adding noise to prediction probabilities, throttling the further requests, or blocking the further requests.
9. A non-transitory computer readable medium having instructions stored thereon that, when executed by one or more processors, cause the processors to prevent a reverse engineering attack on a cloud based trained machine learning (ML) model, the preventing comprising:
receiving a first set of inference requests from a plurality of cloud users to the trained ML model;
based on the first set of inference requests, identifying a first user attempting to attack the trained ML model;
in response to the identifying, generating and training a shadow model that is similar to the trained ML model, training the shadow model using further inference requests from the plurality of cloud users to the trained ML model;
receiving a second set of inference requests from the first user to the trained ML model;
in response to the second set of inference requests, generating trained ML model set of responses and a trained shadow model set of responses;
comparing the trained ML model set of responses with the trained shadow model set of responses; and
based on the comparison, determining whether the first user is attempting the reverse engineering attack on the trained ML model.
10. The computer readable medium of claim 9 , wherein the identifying the first user attempting to attack the ML model comprises clustering the first set of requests per user and per unit time.
11. The computer readable medium of claim 9 , wherein the ML model comprises an algorithm and hyperparameters, and the generating the shadow model that is similar to the ML model is based at least on the algorithm and hyperparameters;
the comparing comprising comparing one or more of a shadow model algorithm, shadow model parameters and shadow model hyperparameters with one or more of an ML model algorithm, ML model parameters and ML model hyperparameters.
12. The computer readable medium of claim 9 , wherein the ML model comprises an algorithm and hyperparameters, and the generating the shadow model that is similar to the ML model is generated without knowledge of the algorithm and the hyperparameters.
13. The computer readable medium of claim 9 , the comparing the ML model set of responses with the shadow model set of responses comprises determining a risk score comprising an amount of similarity between the ML model and the shadow model.
14. The computer readable medium of claim 13 , the risk score based on one or more comparison parameters comprising: user profile activity, feature importance activity, feature correlation activity, data type activity and algorithm identification activity.
15. The computer readable medium of claim 9 , the preventing further comprising generating an alert to a model guard when it is determined whether the first user is attempting the reverse engineering attack on the ML model.
16. The computer readable medium of claim 15 , wherein in response to the alert, the model guard preventing the reverse engineering attack by executing at least one of the following protective measures in response to further requests from the first user: removing all class probabilities for classification problems, only returning a predicted class label, adding noise to prediction probabilities, throttling the further requests, or blocking the further requests.
17. A cloud infrastructure comprising:
a cloud based trained machine learning (ML) model;
an ML model guard server coupled to the ML model, the ML model guard server configured to prevent a reverse engineering attack on the ML model, the preventing comprising:
receiving a first set of inference requests from a plurality of cloud users to the trained ML model;
based on the first set of inference requests, identifying a first user attempting to attack the trained ML model;
in response to the identifying, generating and training a shadow model that is similar to the trained ML model, training the shadow model using further inference requests from the plurality of cloud users to the trained ML model;
receiving a second set of inference requests from the first user to the trained ML model;
in response to the second set of inference requests, generating trained ML model set of responses and a trained shadow model set of responses;
comparing the trained ML model set of responses with the trained shadow model set of responses; and
based on the comparison, determining whether the first user is attempting the reverse engineering attack on the trained ML model.
18. The cloud infrastructure of claim 17 , wherein the identifying the first user attempting to attack the ML model comprises clustering the first set of requests per user and per unit time.
19. The cloud infrastructure of claim 17 , wherein the ML model comprises an algorithm and hyperparameters, and the generating the shadow model that is similar to the ML model is based at least on the algorithm and hyperparameters;
the comparing comprising comparing one or more of a shadow model algorithm, shadow model parameters and shadow model hyperparameters with one or more of an ML model algorithm, ML model parameters and ML model hyperparameters.
20. The cloud infrastructure of claim 17 , wherein the ML model comprises an algorithm and hyperparameters, and the generating the shadow model that is similar to the ML model is generated without knowledge of the algorithm and the hyperparameters.