Method and system for thwarting attacks on machine-learning as a service
A method for thwarting attacks on a machine-learning (ML) model is provided. The method includes determining, by the ML model, a classification vector based on an input. The method further includes evaluation the classification vector based on a threshold parameter to determine a threshold result. The method also includes outputting a classification prediction based on the threshold result.
1. A method for thwarting evasion attacks on a machine-learning (ML) based classifier, the method comprising:
obtaining a predetermined threshold parameter;
determining, by the ML based classifier, a classification vector based on an input;
evaluating the classification vector based on the predetermined threshold parameter to determine a threshold result;
determining a classification prediction based on the threshold result by:
selecting a highest ranked classification from the classification vector as the classification prediction if the threshold result is greater than or equal to the predetermined threshold parameter; or
pseudo-randomly determining a classification from a classification set as the classification prediction if the threshold result is below the predetermined threshold parameter; and
outputting the classification prediction.
2. The method of claim 1 , wherein pseudo-randomly determining the classification from the classification set is constrained such that a same classification is selected upon each execution of the method for a same sample provided as the input.
3. The method of claim 1 , further comprising generating a secret cryptographic key associated with the ML based classifier,
wherein pseudo-randomly determining the classification comprises a key-based random selection using the secret cryptographic key.
4. The method of claim 3 , wherein pseudo-randomly determining the classification further comprises:
executing a password-based function (PBF) to compute an index using the input and the secret cryptographic key; and
determining the classification based on the index.
5. The method of claim 4 , wherein the PBF comprises a pseudo-random function (PRF), wherein executing the PBF comprises:
using the input, the secret cryptographic key, and the PRF to generate a plurality of bits associated with the index.
6. The method of claim 5 , wherein executing the PBF to compute the index further comprises:
determining the index based on a modulus operation and the plurality of bits.
7. The method of claim 6 , wherein the plurality of bits indicates two classifications from the classification set, and wherein determining the index comprises:
using one or more bits from the plurality of bits to determine the index from the two classifications indicated by the plurality of bits.
8. The method of claim 1 , wherein selecting of the highest ranked classification from the classification vector uses a maximum operation executed on the classification vector.
9. The method of claim 1 , wherein the predetermined threshold parameter is set to indicate whether the classification vector represents a low confidence region for outputs from the ML based classifier.
10. The method of claim 1 , wherein the ML based classifier is a neural network model trained to provide image classification, facial recognition, or autonomous driving.
11. The method of claim 1 , further comprising deploying, by a cloud computing platform, the ML based classifier as a ML as a service (MLaaS).
12. A cloud computing system for thwarting evasion attacks on a machine-learning (ML) based classifier, the cloud computing system comprising:
one or more processors; and
a non-transitory computer-readable medium having processor-executable instructions stored thereon, wherein the processor-executable instructions, when executed by the one or more processors, facilitate:
obtaining a predetermined threshold parameter;
determining, using the ML based classifier, a classification vector based on an input;
evaluating the classification vector based on the predetermined threshold parameter to determine a threshold result;
determining a classification prediction based on the threshold result by:
selecting a highest ranked classification from the classification vector as the classification prediction if the threshold result is greater than or equal to the predetermined threshold parameter; or
pseudo-randomly determining a classification from a classification set as the classification prediction if the threshold result is below the predetermined threshold parameter; and
outputting the classification prediction based on the threshold result.
13. A tangible, non-transitory computer-readable medium having processor-executable instructions stored thereon which, upon being executed by one or more processors, alone or in combination, provide for execution of a method for thwarting evasion attacks on a machine-learning (ML) based classifier comprising the following steps:
obtaining a predetermined threshold parameter;
determining, using the ML based classifier, a classification vector based on an input;
evaluating the classification vector based on the predetermined threshold parameter to determine a threshold result;
determining a classification prediction based on the threshold result by:
selecting a highest ranked classification from the classification vector as the classification prediction if the threshold result is greater than or equal to the predetermined threshold parameter; or
pseudo-randomly determining a classification from a classification set as the classification prediction if the threshold result is below the predetermined threshold parameter; and
outputting the classification prediction based on the threshold result.
14. The method of claim 1 , wherein the threshold result indicates a confidence of the ML based classifier.