Method and system for detecting vulnerabilities in ai inference models

1 . A method, comprising:

storing, by a network device, a first inference model for a network function of a wireless cellular network, wherein the first inference model includes multiple layers of connected nodes;

storing, by the network device, a second inference model, wherein the second inference model is an iteration of the first inference model at a time after deployment of the first inference model;

performing, by the network device, a weight comparison of connection weights of connected nodes in the second inference model against corresponding connection weights of the connected nodes in the first inference model;

assigning, by the network device, a weight vulnerability indicator based on the weight comparison, wherein the weight vulnerability indicator indicates whether there are changes in the connection weights;

performing, by the network device, a manifold comparison of a reduced dimensional manifold of the second inference model to a reduced dimensional manifold of the first inference model;

assigning, by the network device, a manifold vulnerability indicator based on the manifold comparison, wherein the manifold vulnerability indicator indicates a similarity between the first inference model and the second first inference model;

generating, by the network device, a vulnerability status of the second inference model based on the weight vulnerability indicator and the manifold vulnerability indicator, wherein the vulnerability status indicates whether the second inference model is vulnerable to attacks or data shifts; and

performing, by the network device, an action based on the vulnerability status.

2 . The method of claim 1 , further comprising:

performing, by the network device, an architecture comparison of an architecture of the second inference model against an architecture of the first inference model; and

assigning, by the network device, an architecture vulnerability indicator based on the architecture comparison, wherein the architecture vulnerability indicator indicates a similarity between the architecture of the first inference model and the architecture of the second first inference model,

wherein generating the vulnerability status is further based on the architecture vulnerability indicator.

3 . The method of claim 1 , wherein performing the weight comparison comprises:

identifying the first inference model as a static weight model; and

comparing the connection weights of the second inference model against the corresponding connection weights of the first inference model.

4 . The method of claim 1 , wherein performing the weight comparison, comprises:

identifying the first inference model as a dynamic weight model; and

computing shifts in the connection weights of the second inference model from the connection weights of the first inference model.

5 . The method of claim 4 , wherein computing the shifts in the connection weights comprises:

computing a Euclidian distance between weight tensors for the first inference model and the second inference model.

6 . The method of claim 4 , wherein computing the shifts in the connection weights comprises:

computing a transport distance between weight tensors for the first inference model and the second inference model.

7 . The method of claim 1 , wherein performing the manifold comparison comprises:

generating the reduced dimensional manifold of the first inference model based on the connection weights of the first inference model; and

generating the reduced dimensional manifold of the second inference model based on the connection weights of the second inference model.

8 . The method of claim 7 , wherein generating the reduced dimensional manifold of the first inference model includes selecting, from a group of available dimension-reduction models, a best fit dimension-reduction model for the first inference model; and

wherein generating the reduced dimensional manifold of the second inference model includes selecting, from the group of available dimension-reduction models, a best fit dimension-reduction model for the second inference model.

9 . The method of claim 1 , wherein performing the action comprises one or more of:

sending to a network administrator a vulnerability report for the second inference model;

providing a signal to revert to a prior iteration of the second inference model;

disabling use of the second inference model; or

pausing use of a network function, in the wireless cellular network, that relies on the second inference model.

10 . One or more network devices, comprising:

one or more processors configured to execute instructions to:

store in a memory a first inference model for a network function of a wireless cellular network, wherein the first inference model includes multiple layers of connected nodes;

store in the memory a second inference model, wherein the second inference model is an iteration of the first inference model at a time after deployment of the first inference model;

perform a weight comparison of connection weights of connected nodes in the second inference model against corresponding connection weights of the connected nodes in the first inference model;

assign a weight vulnerability indicator based on the weight comparison, wherein the weight vulnerability indicator indicates whether there are changes in the connection weights;

perform a manifold comparison of a reduced dimensional manifold of the second inference model to a reduced dimensional manifold of the first inference model;

assign a manifold vulnerability indicator based on the manifold comparison, wherein the manifold vulnerability indicator indicates a similarity between the first inference model and the second first inference model;

generate a vulnerability status of the second inference model based on the weight vulnerability indicator and the manifold vulnerability indicator, wherein the vulnerability status indicates whether the second inference model is vulnerable to attacks or data shifts; and

perform an action based on the vulnerability status.

11 . The one or more network devices of claim 10 , wherein the one or more processors are further to execute instructions to:

perform an architecture comparison of an architecture of the second inference model against an architecture of the first inference model; and

assign an architecture vulnerability indicator based on the architecture comparison, wherein the architecture vulnerability indicator indicates a similarity between the architecture of the first inference model and the architecture of the second first inference model,

wherein, when generating the vulnerability status, the one or more processors are further to execute instructions to base the vulnerability status on the architecture vulnerability indicator.

12 . The one or more network devices of claim 10 , wherein, when performing the weight comparison, the one or more processors are further to execute instructions to:

identify the first inference model as a dynamic weight model; and

compute shifts in the connection weights of the second inference model from connection weights of the first inference model.

13 . The one or more network devices of claim 12 , wherein, when computing the shifts in the connection weights, the one or more processors are further to execute instructions to:

compute a Euclidian distance between weight tensors for the first inference model and the second inference model.

14 . The one or more network devices of claim 12 , wherein, when computing the shifts in the connection weights, the one or more processors are further to execute instructions to:

compute a transport distance between weight tensors for the first inference model and the second inference model.

15 . The one or more network devices of claim 10 , wherein, when performing the manifold comparison, the one or more processors are further to execute instructions to:

generate the reduced dimensional manifold of the first inference model based on the connection weights of the first inference model; and

generate the reduced dimensional manifold of the second inference model based on the connection weights of the second inference model.

16 . The one or more network devices of claim 15 , wherein, when generating the reduced dimensional manifold of the first inference model, the one or more processors are further to execute instructions to:

select, from a group of available dimension-reduction models, a best fit dimension-reduction model for the first inference model.

17 . A non-transitory computer-readable medium containing instructions executable by at least one processor of a network device, the non-transitory computer-readable medium comprising one or more instructions for:

storing, by a network device, a first inference model for a network function of a wireless cellular network, wherein the first inference model includes multiple layers of connected nodes;

storing, by the network device, a second inference model, wherein the second inference model is an iteration of the first inference model at a time after deployment of the first inference model;

performing, by the network device, a weight comparison of connection weights of connected nodes in the second inference model against corresponding connection weights of the connected nodes in the first inference model;

assigning, by the network device, a weight vulnerability indicator based on the weight comparison, wherein the weight vulnerability indicator indicates whether there are changes in the connection weights;

performing, by the network device, a manifold comparison of a reduced dimensional manifold of the second inference model to a reduced dimensional manifold of the first inference model;

assigning, by the network device, a manifold vulnerability indicator based on the manifold comparison, wherein the manifold vulnerability indicator indicates a similarity between the first inference model and the second first inference model;

generating, by the network device, a vulnerability status of the second inference model based on the weight vulnerability indicator and the manifold vulnerability indicator, wherein the vulnerability status indicates whether the second inference model is vulnerable to attacks or data shifts; and

performing, by the network device, an action based on the vulnerability status.

18 . The non-transitory computer-readable medium of claim 17 , wherein the one or more instructions for performing the action further include instructions for:

sending to a network administrator a vulnerability report for the second inference model;

providing a signal to revert to a prior iteration of the second inference model;

disabling use of the second inference model; or

pausing use of a network function that relies on the second inference model.

19 . The non-transitory computer-readable medium of claim 17 , wherein the one or more instructions include instructions for:

performing an architecture comparison of an architecture of the second inference model against an architecture of the first inference model; and

assigning an architecture vulnerability indicator based on the architecture comparison, wherein the architecture vulnerability indicator indicates a similarity between the architecture of the first inference model and the architecture of the second first inference model,

wherein the one or more instructions for generating the vulnerability status further include basing the vulnerability status on the architecture vulnerability indicator.

20 . The non-transitory computer-readable medium of claim 19 , wherein the one or more instructions for performing the architecture comparison further include instructions for:

obtaining, for each layer of the second inference model, structural details including a layer name, a type of layer, an input dimension, an output dimension, an activation function, and a parameter count; and

comparing the structural details to the first inference model.