US 11,681,918 B2
Cohort based adversarial attack detection
Gaurav Goswami, Bangalore (IN); Nalini K. Ratha, Yorktown Heights, NY (US); and Sharathchandra Pankanti, Darien, CT (US)
Assigned to International Business Machines Corporation, Armonk, NY (US)
Filed by International Business Machines Corporation, Armonk, NY (US)
Filed on Apr. 21, 2021, as Appl. No. 17/236,466.
Application 17/236,466 is a continuation of application No. 16/545,380, filed on Aug. 20, 2019, granted, now 11,042,799.
Prior Publication US 2021/0264268 A1, Aug. 26, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06N 3/08 (2023.01); G06N 20/00 (2019.01); G06F 9/54 (2006.01); G06F 9/38 (2018.01); G06F 18/22 (2023.01); G06F 18/25 (2023.01); G06V 10/764 (2022.01); G06V 10/80 (2022.01); G06V 10/82 (2022.01); G06V 10/44 (2022.01)
CPC G06N 3/08 (2013.01) [G06F 9/3867 (2013.01); G06F 9/542 (2013.01); G06F 18/22 (2023.01); G06F 18/254 (2023.01); G06N 20/00 (2019.01); G06V 10/454 (2022.01); G06V 10/764 (2022.01); G06V 10/809 (2022.01); G06V 10/82 (2022.01)] 20 Claims
OG exemplary drawing
 
1. A method, in a data processing system comprising at least one processor and at least one memory, the at least one memory comprising instructions which are executed by the at least one processor to specifically configure the at least one processor to implement at least one machine learning computer model, the method comprising:
processing, by the at least one machine learning computer model, input data representing a first image to generate a first classification output;
identifying, by the data processing system, at least one second image having similar characteristics to the first image based on a comparison of characteristics of the first image to characteristics of images in an image repository;
processing, by the at least one machine learning computer model, the at least one second image to generate a second classification output;
comparing, by the data processing system, the first classification output to the second classification output to determine whether or not the first image is an adversarial image; and
initiating, by the data processing system, in response to a determination that the first image is an adversarial image, a mitigation operation.