Machine learning fraud resiliency using perceptual descriptors
Machine learning fraud resiliency using perceptual descriptors is described. An example of a computer-readable storage medium includes instructions for accessing multiple examples in a training dataset for a classifier system; calculating one or more perceptual hashes for each of the examples; generating clusters of perceptual hashes for the multiple examples based on the calculation of the one or more perceptual hashes for each of the plurality of examples; obtaining an inference sample for classification by the classifier system; generating a first classification result for the inference sample utilizing a neural network classifier and generating a second classification result utilizing the generated clusters of perceptual hashes; comparing the first classification result with the second classification result; and, upon a determination that the first classification result does not match the second classification result, determining a suspicion of an adversarial attack.
1. One or more non-transitory computer-readable storage mediums having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
accessing a plurality of examples in a training dataset for a classifier system;
calculating a plurality of perceptual hashes for each of the plurality of examples, the plurality of perceptual hashes including a plurality of perceptual hash algorithms;
generating clusters of perceptual hashes for the plurality of examples based on the calculation of the plurality of perceptual hashes for each of the plurality of examples;
obtaining an inference sample for classification by the classifier system;
generating a first classification result for the inference sample utilizing a neural network classifier and generating a second classification result for the inference sample utilizing the generated clusters of perceptual hashes;
comparing the first classification result for the inference sample with the second classification result for the inference sample; and
upon a determination that the first classification result does not match the second classification result, determining a suspicion of an adversarial attack on the classifier system.
2. The storage mediums of claim 1 , wherein the instructions further include instructions for:
upon the determination that the first classification result does not match the second classification result, performing one or more actions in response to the determination of suspicion of an adversarial attack.
3. The storage mediums of claim 2 , wherein the one or more actions include one or more of:
generating an alert;
recording data regarding a possible adversarial input; and
halting or changing an operation of the classifier system.
4. The storage mediums of claim 1 , wherein the inference sample is an image.
5. The storage mediums of claim 1 , wherein the classifier system is a classifier for an autonomous driving vehicle or an assisted driving vehicle.
6. The storage mediums of claim 1 , wherein the suspicion of an adversarial attack includes a suspicion that one or more adversarial examples have been received for training of the classifier system.
7. A method comprising:
accessing a plurality of examples in a training dataset for a classifier system;
calculating a plurality of perceptual hashes for each of the plurality of examples, the plurality of perceptual hashes including a plurality of perceptual hash algorithms;
generating clusters of perceptual hashes for the plurality of examples based on the calculation of the plurality of perceptual hashes for each of the plurality of examples;
obtaining an inference sample for classification by the classifier system;
generating a first classification result for the inference sample utilizing a neural network classifier and generating a second classification result for the inference sample utilizing the generated clusters of perceptual hashes;
comparing the first classification result for the inference sample with the second classification result for the inference sample; and
upon a determination that the first classification result does not match the second classification result, determining a suspicion of an adversarial attack on the classifier system.
8. The method of claim 7 , further comprising:
upon the determination that the first classification result does not match the second classification result, performing one or more actions in response to the determination of suspicion of an adversarial attack.
9. The method of claim 8 , wherein the one or more actions include one or more of:
generating an alert;
recording data regarding a possible adversarial input; and
halting or changing an operation of the classifier system.
10. The method of claim 7 , wherein the inference sample is an image.
11. The method of claim 7 , wherein the classifier system is a classifier for an autonomous driving vehicle or an assisted driving vehicle.
12. The method of claim 7 , wherein the suspicion of an adversarial attack includes a suspicion that one or more adversarial examples have been received for training of the classifier system.
13. An apparatus comprising:
one or more processors to process data including data classification of inference samples; and
a storage for storing data including a training dataset of samples;
wherein the one or more processors are to:
access a plurality of examples in the training dataset;
calculate a plurality of perceptual hashes for each of the plurality of examples, the plurality of perceptual hashes including a plurality of perceptual hash algorithms;
generate clusters of perceptual hashes for the plurality of examples based on the calculation of the plurality of perceptual hashes for each of the plurality of examples;
obtain an inference sample for classification by the apparatus;
generate a first classification result for the inference sample utilizing a neural network classifier and generate a second classification result for the inference sample utilizing the generated clusters of perceptual hashes;
compare the first classification result for the inference sample with the second classification result for the inference sample; and
upon a determination that the first classification result does not match the second classification result, determine a suspicion of an adversarial attack on the apparatus.
14. The apparatus of claim 13 , wherein the one or more processors are further to:
upon the determination that the first classification result does not match the second classification result, perform one or more actions in response to the determination of suspicion of an adversarial attack.
15. The apparatus of claim 14 , wherein the one or more actions include one or more of:
generating an alert;
recording data regarding a possible adversarial input; and
halting or changing an operation of the apparatus.
16. The apparatus of claim 13 , wherein the inference sample is an image.
17. The apparatus of claim 13 , wherein the apparatus includes a classifier for an autonomous driving vehicle or an assisted driving vehicle.
18. The apparatus of claim 13 , wherein the suspicion of an adversarial attack includes a suspicion that one or more adversarial examples have been received for training of the apparatus.