Abstract: This disclosure describes methods and systems for protecting machine learning models against privacy attacks. A machine learning model may be trained using a set of training data and causal relationship data. The causal relationship data may describe a subset of features in the training data that have a causal relationship with the outcome. The machine learning model may learn a function that predicts an outcome based on the training data and the causal relationship data. A predefined privacy guarantee value may be received. An amount of noise may be added to the machine learning model to make a privacy guarantee value of the machine learning model equivalent to or stronger than the predefined privacy guarantee value. The amount of noise may be added at a parameter level of the machine learning model.

Abstract: A predictor has a memory which stores at least one example for which an associated outcome is not known. The memory stores at least one decision tree comprising a plurality of nodes connected by edges, the nodes comprising a root node, internal nodes and leaf nodes. Individual ones of the nodes and individual ones of the edges each have an assigned module, comprising parameterized, differentiable operations, such that for each of the internal nodes the module computes a binary outcome for selecting a child node of the internal node. The predictor has a processor configured to compute the prediction by processing the example using a plurality of the differentiable operations selected according to a path through the tree from the root node to a leaf node.

Abstract: A predictor has a memory which stores at least one example for which an associated outcome is not known. The memory stores at least one decision tree comprising a plurality of nodes connected by edges, the nodes comprising a root node, internal nodes and leaf nodes. Individual ones of the nodes and individual ones of the edges each have an assigned module, comprising parameterized, differentiable operations, such that for each of the internal nodes the module computes a binary outcome for selecting a child node of the internal node. The predictor has a processor configured to compute the prediction by processing the example using a plurality of the differentiable operations selected according to a path through the tree from the root node to a leaf node.

Abstract: This disclosure describes methods and systems for protecting machine learning models against privacy attacks. A machine learning model may be trained using a set of training data and causal relationship data. The causal relationship data may describe a subset of features in the training data that have a causal relationship with the outcome. The machine learning model may learn a function that predicts an outcome based on the training data and the causal relationship data. A predefined privacy guarantee value may be received. An amount of noise may be added to the machine learning model to make a privacy guarantee value of the machine learning model equivalent to or stronger than the predefined privacy guarantee value. The amount of noise may be added at a parameter level of the machine learning model.

Abstract: A predictor has a memory which stores at least one example for which an associated outcome is not known. The memory stores at least one decision tree comprising a plurality of nodes connected by edges, the nodes comprising a root node, internal nodes and leaf nodes. Individual ones of the nodes and individual ones of the edges each have an assigned module, comprising parameterized, differentiable operations, such that for each of the internal nodes the module computes a binary outcome for selecting a child node of the internal node. The predictor has a processor configured to compute the prediction by processing the example using a plurality of the differentiable operations selected according to a path through the tree from the root node to a leaf node.

Abstract: A sensor data processor is described comprising a memory storing a plurality of trained expert models. The machine learning system has a processor configured to receive an unseen sensor data example and, for each trained expert model, compute a prediction from the unseen sensor data example using the trained expert model. The processor is configured to aggregate the predictions to form an aggregated prediction, receive feedback about the aggregated prediction and update, for each trained expert, a weight associated with that trained expert, using the received feedback. The processor is configured to compute a second aggregated prediction by computing an aggregation of the predictions which takes into account the weights.

Abstract: A method of training a random decision tree to give improved generalization ability is described. At a split node of the random decision tree a plurality of training sensor data elements available at the split node are divided into a tuning set and a validation set. A plurality of models is formed using the tuning set, each model using different values of parameters of the split node. Performance of the models at splitting the validation set between left and right child nodes of the split node is computed and used to select one of the models.

Abstract: A machine learning system is described which has a memory storing at least one trained random decision tree and parameters of a plurality of clusters associated with the trained random decision tree. A processor of the machine learning system pushes a sensor data element through the trained random decision tree to compute a prediction and to obtain values of features associated with the sensor data element. The processor selects one of the clusters by comparing the features associated with the received sensor data element and the parameters of the clusters. The memory stores at least one cluster-specific random decision tree, which has been trained using data from the selected cluster. The processor is configured to push the prediction through the cluster-specific random decision tree to compute another prediction. The clusters group together sensor data elements which give rise to similar pathways when pushed through the trained random decision tree.

Abstract: A training engine is described which has a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes. The training engine has an adversarial example generator which computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network. The training engine has a processor which further trains the neural network image classifier using at least the adversarial images.

Abstract: A training engine is described which has a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes. The training engine has an adversarial example generator which computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network. The training engine has a processor which further trains the neural network image classifier using at least the adversarial images.

Abstract: This paper describes preferential path profiling, which enables profiling a specified subset of all possible program paths with very low overhead. Preferential path profiling compactly identifies paths of interest using an array. More specifically, PPP assigns a unique and compact path index identifier to all interesting paths that can be used to index into a path array. The path array contains a second path value identifier that is used to distinguish interesting paths from other program paths This path numbering allows the implementation of preferential path profiling to use array-based counters instead of hash table-based counters for identifying paths of interest and gathering path profiles, which significantly reduces execution time and computational resource overhead during profiling.

Abstract: This paper describes preferential path profiling, which enables profiling a specified subset of all possible program paths with very low overhead. Preferential path profiling compactly identifies paths of interest using an array. More specifically, PPP assigns a unique and compact path index identifier to all interesting paths that can be used to index into a path array. The path array contains a second path value identifier that is used to distinguish interesting paths from other program paths This path numbering allows the implementation of preferential path profiling to use array-based counters instead of hash table-based counters for identifying paths of interest and gathering path profiles, which significantly reduces execution time and computational resource overhead during profiling.