Abstract: A processor may generate an enforcement point. The enforcement point may include one or more adversarial detection models. The processor may receive user input data. The processor may analyze, at the enforcement point, the user input data. The processor may determine, from the analyzing, whether there is an adversarial attack in the user input data. The processor may generate an alert based on the determining.

Abstract: A method of performing automatic tuning on a deep learning model includes: utilizing an instruction-based learned cost model to estimate a first type of operational performance metrics based on a tuned configuration of layer fusion and tensor tiling; utilizing statistical data gathered during a compilation process of the deep learning model to determine a second type of operational performance metrics based on the tuned configuration of layer fusion and tensor tiling; performing an auto-tuning process to obtain a plurality of optimal configurations based on the first type of operational performance metrics and the second type of operational performance metrics; and configure the deep learning model according to one of the plurality of optimal configurations.

Abstract: A computer-implemented method, a computer program product, and a computer system for creating malware domain sinkholes by domain clustering. The computer system clusters malware domains into domain clusters. The computer system collects domain metrics in the domain clusters. The computer system sorts clustered malware domains in the respective ones of the domain clusters, based on the domain metrics. The computer system selects, from the clustered malware domains in the respective ones of the domain clusters, a predetermined number of top domains as candidates of respective domain sinkholes, wherein the respective domain sinkholes are created for the respective ones of the domain clusters.

Abstract: An embodiment of the present invention is directed toward machine learning to produce results encompassing a new output. A machine learning model is trained to determine a candidate output from among a plurality of candidate outputs. First embeddings associated with the plurality of candidate outputs are generated from a first set of training data by an intermediate layer of the trained machine learning model. Second embeddings associated with a new candidate output are generated from a second set of training data by the intermediate layer of the trained machine learning model. A third embedding is determined for input data by the intermediate layer of the trained machine learning model. A resulting candidate output for the input data is predicted from a group of the plurality of candidate outputs and the new candidate output based on distances for the third embedding to the first and second embeddings.

Abstract: A method for receiving a full training data set including a plurality of individual training data set, dividing the plurality of individual training sets into N classes, where N is an integer greater than three, dividing the N classes into M full data classes and N-M partial data classes, performing training to obtain a trained fixed size machine learning (ML) classification model and a trained in-class confidence model, outputting a first set of prediction value(s) based on the performance of training, distributing each class of the N classes of individual training data sets to a different node of a distributed machine learning system; and outputting, from the nodes of the distributed machine learning system, a second set of prediction value(s) for each class of the N classes.

Abstract: A processor may generate an enforcement point. The enforcement point may include one or more adversarial detection models. The processor may receive user input data. The processor may analyze, at the enforcement point, the user input data. The processor may determine, from the analyzing, whether there is an adversarial attack in the user input data. The processor may generate an alert based on the determining.

Abstract: A computer-implemented method, a computer program product, and a computer system for creating malware domain sinkholes by domain clustering. The computer system clusters malware domains into domain clusters. The computer system collects domain metrics in the domain clusters. The computer system sorts clustered malware domains in the respective ones of the domain clusters, based on the domain metrics. The computer system selects, from the clustered malware domains in the respective ones of the domain clusters, a predetermined number of top domains as candidates of respective domain sinkholes, wherein the respective domain sinkholes are created for the respective ones of the domain clusters.