Protection of neural networks by obfuscation of neural network operations and architecture

Patent metadata

Field	Value
Publication number	US-12393679-B2
Application number	US-202118267773-A
Country	US
Kind code	B2
Filing date	Dec 16, 2021
Priority date	Dec 21, 2020
Publication date	Aug 19, 2025
Grant date	Aug 19, 2025

Abstract

Aspects of the present disclosure involve implementations that may be used to protect neural network models against adversarial attacks by obfuscating neural network operations and architecture. Obfuscation techniques include obfuscating weights and biases of neural network nodes, obfuscating activation functions used by neural networks, as well as obfuscating neural network architecture by introducing dummy operations, dummy nodes, and dummy layers into the neural networks.

First claim

What is claimed is:

1. A computer-implemented method to execute using at least one or more hardware processors, a neural network model that has a plurality of nodes, the method comprising:
obtaining, using the one or more hardware processors, a vector of input values for a first node of the plurality of nodes, wherein the first node is associated with a plurality of parameters that map the vector of input values to a target weighted input value of the first node, the plurality of parameters comprising one or more weights for the first node;
performing, using the one or more hardware processors, a first transformation of the plurality of parameters to obtain an expanded plurality of parameters for the first node, wherein performing the first transformation comprises:
obtaining an expanded weight matrix comprising the one or more weights for the first node and a plurality of obfuscation weights; and

determining, using the one or more hardware processors, based on the vector of input values and the expanded plurality of parameters, one or more weighted input values for the first node, wherein the target weighted input value is obtainable from the one or more weighted input values using a second transformation, and wherein determining the one or more weighted input values for the first node is based, at least in part, on the expanded weight matrix.

2. The method of claim 1 , wherein the plurality of parameters further comprises a bias value for the first node, and wherein performing the first transformation further comprises:
obtaining an expanded bias vector comprising the bias value for the first node and a plurality of obfuscation biases; and

wherein determining the one or more weighted input values for the first node comprises:
performing a first masking transformation to obtain a masked weight matrix from the expanded weight matrix; and
performing a second masking transformation to obtain a masked bias vector from the expanded bias vector.

3. The method of claim 2 , wherein performing the first masking transformation comprises multiplying the expanded weight matrix by a masking matrix, and wherein performing the second masking transformation comprises multiplying the expanded bias vector by the masking matrix.

4. The method of claim 3 , wherein determining the one or more weighted input values for the first node further comprises:
adding the masked bias vector to a product of the masked weight matrix and the vector of input values.

5. The method of claim 2 , further comprising:
updating at least one of the first masking transformation or the second masking transformation.

6. The method of claim 1 , wherein the first node is further associated with an activation function, the method further comprising:
determining, using the one or more hardware processors, a composite activation function formed by the activation function and the second transformation.

7. The method of claim 6 , further comprising:
applying the composite activation function to the one or more weighted input values for the first node to obtain an output value for the first node.

8. The method of claim 7 , wherein the obtained output value is representative of a target output value, wherein the target output value is equal to a value of the activation function applied to the target weighted input value.

9. The method of claim 7 , wherein the activation function is a function that is discontinuous or a function that has a discontinuous derivative, and wherein applying the composite activation function further comprises:
obfuscating a location of a point of discontinuity.

10. The method of claim 9 , wherein the composite activation function is a step function and wherein applying the composite activation function further comprises shifting the step function into a same-sign domain of output values.

11. The method of claim 7 , wherein the activation function is a sigmoid function, and wherein the one or more weighted input values input into the composite activation function are additively masked and an output value of the composite activation function is multiplicatively masked.

12. A computer-implemented method performed using one or more hardware processors, the method comprising:
identifying a neural network (NN) model to be protected against adversarial attacks, wherein the NN model includes a plurality of nodes and is configured to generate, based on an input into the NN model, a target output of the NN model; and
obtaining a modified NN model configured to output the same target output based on the same input, wherein obtaining the modified NN model comprises:
obtaining, using the one or more hardware processors, a vector of input values for a first node of the plurality of nodes, wherein the first node is associated with a plurality of parameters that map the vector of input values to a target weighted input value of the first node, the plurality of parameters comprising one or more weights for the first node;
performing, using the one or more hardware processors, a first transformation of the plurality of parameters to obtain an expanded plurality of parameters for the first node, wherein performing the first transformation comprises;
obtaining an expanded weight matrix comprising the one or more weights for the first node and a plurality of obfuscation weights; and

determining, using the one or more hardware processors, based on the vector of input values and the expanded plurality of parameters, one or more weighted input values for the first node, wherein the target weighted input value is obtainable from the one or more weighted input values using a second transformation, and wherein determining the one or more weighted input values for the first node is based, at least in part, on the expanded weight matrix.

13. A system to execute a neural network model that has a plurality of nodes, the system comprising:
a memory device; and
a processing device communicatively coupled to the memory device, the processing device to:
obtain a vector of input values for a first node of the plurality of nodes, wherein the first node is associated with a plurality of parameters that map the vector of input values to a target weighted input value of the first node, the plurality of parameters comprising one or more weights for the first node;
perform a first transformation of the plurality of parameters to obtain an expanded plurality of parameters for the first node, wherein to perform the first transformation, the processing device is to:
obtain an expanded weight matrix comprising the one or more weights for the first node and a plurality of obfuscation weights; and

determine, based on the vector of input values and the expanded plurality of parameters, one or more weighted input values for the first node, wherein the target weighted input value is obtainable from the one or more weighted input values using a second transformation, and wherein to determine the one or more weighted input values for the first node, the processing device is to use the expanded weight matrix.

14. The system of claim 13 , wherein the plurality of parameters further comprises a bias value for the first node, and wherein to perform the first transformation, the processing device is further to:
obtain an expanded bias vector comprising the bias value for the first node and a plurality of obfuscation biases; and

wherein to determine the one or more weighted input values for the first node, the processing device is to:
perform a first masking transformation to obtain a masked weight matrix from the expanded weight matrix; and
perform a second masking trans

Assignees

• Cryptography Res Inc

Inventors

• Marson Mark Evan
• Hamburg Michael Alexander
• Handschuh Helena

Classifications

• G06F21/14 Primary

  against software analysis or reverse engineering, e.g. by obfuscation · CPC title

• G06N7/00

  Computing arrangements based on specific mathematical models · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title

• G06N3/082

  modifying the architecture, e.g. adding, deleting or silencing nodes or connections · CPC title

• G06N3/0499

  Feedforward networks · CPC title