Verifying that the influence of a user data point has been removed from a machine learning classifier

Patent metadata

Field	Value
Publication number	US-10397266-B1
Application number	US-201916250199-A
Country	US
Kind code	B1
Filing date	Jan 17, 2019
Priority date	May 24, 2018
Publication date	Aug 27, 2019
Grant date	Aug 27, 2019

Abstract

Verifying that influence of a user data point has been removed from a machine learning classifier. In some embodiments, a method may include training a machine learning classifier using a training set of data points that includes a user data point, calculating a first loss of the machine learning classifier, updating the machine learning classifier by updating parameters of the machine learning classifier to remove influence of the user data point, calculating a second loss of the machine learning classifier, calculating an expected difference in loss of the machine learning classifier, and verifying that the influence of the user data point has been removed from the machine learning classifier by determining that the difference between the first loss and the second loss is within a threshold of the expected difference in loss.

First claim

The invention claimed is:

1. A computer-implemented method for verifying that influence of a user data point has been removed from a machine learning classifier, at least a portion of the method being performed by a network device comprising one or more processors, the method comprising:
training, by a network device, a machine learning classifier using a training set of data points that includes a user data point;
calculating, by the network device, a first loss of the machine learning classifier;
updating, by the network device, the machine learning classifier by updating parameters of the machine learning classifier to remove influence of the user data point using an influence function without retraining the machine learning classifier;
calculating, by the network device, a second loss of the machine learning classifier;
calculating, by the network device using an influence function, an expected difference in loss of the machine learning classifier due to removal of the influence of the user data point from the machine learning classifier; and
verifying that the influence of the user data point has been removed from the machine learning classifier by determining, by the network device, that the difference between the first loss and the second loss is within a threshold of the expected difference in loss.

2. The method of claim 1 , wherein the machine learning classifier is one or more of a Logistic Regression (LR) classifier, a Linear Support Vector Machine (LSVM) classifier, and a Multi-Layer Perceptron (MLP) classifier.

3. The method of claim 1 , wherein the user data point comprises personally identifiable information of an individual inside the European Union.

4. The method of claim 3 , further comprising:
receiving, at the network device, a request pursuant to the European Union General Data Protection Regulation (GDPR) to remove the influence of the user data point from the machine learning classifier.

5. The method of claim 1 , further comprising:
receiving, at the network device from a second network device, application programming interface (API) queries of a model inversion attack against the machine learning classifier; and
thwarting, at the network device, the model inversion attack against the machine learning classifier, due to the updated parameters of the machine learning classifier, to protect the user data point from being exposed by the model inversion attack.

6. The method of claim 5 , wherein the machine learning classifier is exposed to the API as a Machine Learning as a Service (MLaaS) offering to enable API queries against the machine learning classifier.

7. The method of claim 1 , further comprising:
sending, from the network device and to a second network device, verification that the influence of the user data point has been removed from the machine learning classifier.

8. One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of a network device, cause the network device to perform a method for verifying that influence of a user data point has been removed from a machine learning classifier, the method comprising:
training, by a network device, a machine learning classifier using a training set of data points that includes a user data point;
calculating, by the network device, a first loss of the machine learning classifier;
updating, by the network device, the machine learning classifier by updating parameters of the machine learning classifier to remove influence of the user data point using an influence function without retraining the machine learning classifier;
calculating, by the network device, a second loss of the machine learning classifier;
calculating, by the network device using an influence function, an expected difference in loss of the machine learning classifier due to removal of the influence of the user data point from the machine learning classifier; and
verifying that the influence of the user data point has been removed from the machine learning classifier by determining, by the network device, that the difference between the first loss and the second loss is within a threshold of the expected difference in loss.

9. The one or more non-transitory computer-readable media of claim 8 , wherein the machine learning classifier is one or more of a Logistic Regression (LR) classifier, a Linear Support Vector Machine (LSVM) classifier, and a Multi-Layer Perceptron (MLP) classifier.

10. The one or more non-transitory computer-readable media of claim 8 , wherein the user data point comprises personally identifiable information of an individual inside the European Union.

11. The one or more non-transitory computer-readable media of claim 10 , wherein the method further comprises:
receiving, at the network device, a request pursuant to the European Union General Data Protection Regulation (GDPR) to remove the influence of the user data point from the machine learning classifier.

12. The one or more non-transitory computer-readable media of claim 8 , wherein the method further comprises:
receiving, at the network device from a second network device, application programming interface (API) queries of a model inversion attack against the machine learning classifier; and
thwarting, at the network device, the model inversion attack against the machine learning classifier, due to the updated parameters of the machine learning classifier, to protect the user data point from being exposed by the model inversion attack.

13. The one or more non-transitory computer-readable media of claim 12 , wherein the machine learning classifier is exposed to the API as a Machine Learning as a Service (MLaaS) offering to enable API queries against the machine learning classifier.

14. The one or more non-transitory computer-readable media of claim 8 , further comprising:
sending, from the network device and to a second network device, verification that the influence of the user data point has been removed from the machine learning classifier.

15. A network device comprising:
one or more processors; and
one or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by the one or more processors, cause the network device to perform a method for verifying that influence of a user data point has been removed from a machine learning classifier, the method comprising:
training, by a network device, a machine learning classifier using a training set of data points that includes a user data point;
calculating, by the network device, a first loss of the machine learning classifier;
updating, by the network device, the machine learning classifier by updating parameters of the machine learning classifier to remove influence of the user data point using an influence function without retraining the machine learning classifier;
calculating, by the network device, a second loss of the machine learning classifier;
calculating, by the network device using an influence function, an expected difference in loss of the machine learning classifier due to removal of the influence of the user data point from the machine learning classifier; and
verifying that the influence of the user data point has been removed from the machine learning classifier by determining, by the network device, that the difference between the first loss and the second loss is within a threshold of the expected difference in loss.

16. The network device of claim 15 , wherein the machine learning classifier is one or more of a Logistic Regress

Assignees

• Symantec Corp

Inventors

• Shintre Saurabh
• Dhaliwal Jasjeet

Classifications

• G06N3/08

  Learning methods · CPC title

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title

• G06N5/048

  Fuzzy inferencing · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06N20/00

  Machine learning · CPC title