Abstract: Method for model updating in a federated learning environment, including distributing a current model to client nodes; receiving a first set of gradient sign vectors, wherein each gradient sign vector of the first set of gradient sign vectors is received from one client node; generating a first updated model based on the first set of gradient sign vectors; distributing the first updated model to the plurality of client nodes; storing a first shape parameter and a second shape parameter; receiving, in response to distributing the first updated model, a second set of gradient sign vectors, wherein each gradient sign vector of the second set of gradient sign vectors is received from one client node; generating a second updated model based on the second set of gradient sign vectors, the first shape parameter, and the second shape parameter; and distributing the second updated model to the plurality of client nodes.

Abstract: One example method includes receiving, at a control plane of a zero trust (ZT) architecture, a request to implement a proposed policy, forwarding the request to multiple policy engines of a blockchain policy engine, executing, by the policy engines, a consensus algorithm that decides whether or not the proposed policy will be implemented, wherein, as part of execution of the consensus algorithm, each of the policy engines performs a respective validation process with respect to the proposed policy, and when a consensus is reached by the policy engines, either implementing the proposed policy, or preventing implementation of the proposed policy, as dictated by the consensus.

Abstract: Monitoring and validating zero trust systems is disclosed. A monitoring engine, which is external to a zero trust architecture, is configured to instantiate clients based on client specifications. This allows a client to issue a request to a zero trust system and evaluate the response to the request in the context of an expected response. The behavior of the zero trust system can be validated or not validated based on this evaluation.

Abstract: One example method includes dynamically monitoring a stream of image portions that have been classified by a segmentation model of a video surveillance system, evaluating the image portions, based on the evaluating, determining that an attack on the video surveillance system is occurring, or has occurred, and implementing, or causing the implementation of, a remedial action with regard to the attack. The image portions may be image portions that have been classified by a segmentation model.

Abstract: One example method includes using a zero trust architecture to surveil a network to obtain information about a vulnerability in a network, determining, based on the information, a threat mitigation strategy responsive to the vulnerability, communicating the threat mitigation strategy to enable resource allocation for implementation of the threat mitigation strategy, allocating any needed resources for implementation of the threat mitigation strategy, and using the resources to implement the threat mitigation strategy.

Abstract: One example method includes receiving a data file at a large language model (LLM). Arbitrary tags that include labels that are attachable to the data file and prompts are also received. The prompts are paired with the arbitrary tags to form arbitrary tag-prompt pairs and include information that is used by the LLM to find the paired arbitrary tag. The LLM determines a selected subset of the arbitrary tags that apply to the data file. A trust module receives the selected subset of the arbitrary tags that apply to the data file and data access policies that specify access rules for the data file. A conditional access decision is determined that specifies whether access should be given to the data file.

Abstract: A framework for rapidly prototyping federated learning algorithms. Specifically, the disclosed framework proposes a method and system for evaluating different hypotheses for configuring learning model, which may be optimized through federated learning. Through the disclosed framework, these hypotheses may be tested for scalability, hardware and network resource performance, as well as for new learning state compression and/or aggregation technique effectiveness. Further, these hypotheses may be tested through federated learning simulations, which avoid costs associated with deploying these hypotheses to be tested across production systems.

Abstract: Techniques are disclosed for providing a framework for fast prototyping attacks and defenses on transfer learning settings. For example, a system can include at least one processing device including a processor coupled to a memory, the at least one processing device being configured to perform the following steps: defining a set of evaluation metrics, each evaluation metric configured to test responses by a machine learning model when applying a given defense among a set of defenses against a set of adversarial inputs generated for the model; selecting one or more defenses from the set of defenses based on the evaluation metrics; and generating a secured model based on incorporating the selected defenses into the model.

Abstract: One example method includes dynamically monitoring a stream of image portions that have been classified by a segmentation model of a video surveillance system, evaluating the image portions, based on the evaluating, determining that an attack on the video surveillance system is occurring, or has occurred, and implementing, or causing the implementation of, a remedial action with regard to the attack. The image portions may be image portions that have been classified by a segmentation model.

Abstract: One example method includes, in an edge node, of a group of edge nodes that are each operable to communicate with a central node, performing operations that include generating a vector that includes gradients associated with a model instance, of a central model, that is operable to run at the edge node, performing a check to determine whether the model instance is overfitting to data generated at the edge node, and either performing sign compression on the vector when overfitting is not indicated, or performing random perc sign compression on the vector when overfitting is indicated, and transmitting the vector, after compression, to the central node that includes the central model.

Abstract: Methods for compression switching that includes distributing a model to client nodes, which use the model to generate a gradient vector (GV) based on a client node data set. The method includes receiving a model update that includes a gradient sign vector (GSV) based on the gradient vector; generating an updated model using the GSV; and distributing the updated model to the client nodes. The client node uses the updated model to generate a second GV based on a second client node data set. The method also includes a determination that a compression switch condition exists; based on the determination, transmitting an instruction to the client node to perform a compression switch; receiving, in response to the instruction, another model update including a subset GSV based on the second gradient vector; generating a second updated model using the subset GSV; and distributing the second updated model to the client nodes.

Abstract: One example method includes accessing input data elements from logs that identify user problems with computing system components, the data elements each associated with a respective original class label that identifies a class of computing system components to which the data element relates, the respective original class labels forming a group of class labels, and a first of the original class labels is overrepresented in the group, and reducing overrepresentation of the first original class label in the group by creating an arbitrary aggregation of some of the class labels that includes the first original class label. The method includes creating, based on a hierarchical modeling structure, prepared data in which an original class label is replaced by the aggregation. Next a hierarchical model and benchmark model are trained, and each model generates respective predictions for comparison. An inferencing process is performed to determine which predicted label will be used.

Abstract: Facilitating detection of anomalies of a target entity is provided herein. A system can comprise a processor and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations. The operations can comprise training a model on a first set of variables that are constrained by a second set of variables. The second set of variables can characterize elements of a defined entity. The first set of variables can define a normality of the defined entity. The operations also can comprise employing the model to identify expected parameters and unexpected parameters associated with the defined entity to at least a defined level of confidence.

Abstract: One example method includes deploying a discriminator, where the discriminator is trained to recognize an adversarial image received by the discriminator as adversarial, and the adversarial image is generated based upon an original image, the adversarial image including a perturbation that cannot be detected by a human eye but which is effective to deceive an image segmentation model to misclassify the original image, receiving, by the discriminator, an image captured by an autonomous vehicle, and determining, by the discriminator, whether the image received from the autonomous vehicle is adversarial.

Abstract: Facilitating temporal data management for anomalous state detection in data centers is provided herein. A system can comprise a processor and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations. The operations can comprise performing a process of extraction, transformation, and loading of data from log files into a telemetry data store. The data can be loaded into the telemetry data store as telemetry data. The operations also can comprise dividing the telemetry data into first telemetry data and second telemetry data. The first telemetry data can comprise telemetry data that does not satisfy a defined quality level. The second telemetry data can comprise telemetry data that satisfies the defined quality level. Further, the operations can comprise removing the first telemetry data from the telemetry data store and outputting the second telemetry data based on a request for the second telemetry data.

Abstract: Facilitating detection of anomalies of a target entity is provided herein. A system can comprise a processor and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations. The operations can comprise training a model on a first set of variables that are constrained by a second set of variables. The second set of variables can characterize elements of a defined entity. The first set of variables can define a normality of the defined entity. The operations also can comprise employing the model to identify expected parameters and unexpected parameters associated with the defined entity to at least a defined level of confidence.

Abstract: Method for model updating in a federated learning environment, including distributing a current model to client nodes; receiving a first set of gradient sign vectors, wherein each gradient sign vector of the first set of gradient sign vectors is received from one client node; generating a first updated model based on the first set of gradient sign vectors; distributing the first updated model to the plurality of client nodes; storing a first shape parameter and a second shape parameter; receiving, in response to distributing the first updated model, a second set of gradient sign vectors, wherein each gradient sign vector of the second set of gradient sign vectors is received from one client node; generating a second updated model based on the second set of gradient sign vectors, the first shape parameter, and the second shape parameter; and distributing the second updated model to the plurality of client nodes.

Abstract: An information handling system for managing a storage system includes storage for storing profile-based cache policy performance prediction models. The information handling system also includes a storage manager that obtains an input-output profile for a workload hosted by the information handling system during a first period of time; obtains performance metrics for cache policies for the storage system using: the input-output profile, and the profile-based cache policy performance prediction models; obtains a ranking of the cache policies based on the performance metrics; selects a cache policy of the cache policies based on the rankings; and updates operation of a cache of the storage system based on the selected cache policy for a second period of time.

Abstract: Facilitating detection of anomalies of a target entity is provided herein. A system can comprise a processor and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations. The operations can comprise training a model on a first set of variables that are constrained by a second set of variables. The second set of variables can characterize elements of a defined entity. The first set of variables can define a normality of the defined entity. The operations also can comprise employing the model to identify expected parameters and unexpected parameters associated with the defined entity to at least a defined level of confidence.

Abstract: Methods for compression switching that includes distributing a model to client nodes, which use the model to generate a gradient vector (GV) based on a client node data set. The method includes receiving a model update that includes a gradient sign vector (GSV) based on the gradient vector; generating an updated model using the GSV; and distributing the updated model to the client nodes. The client node uses the updated model to generate a second GV based on a second client node data set. The method also includes a determination that a compression switch condition exists; based on the determination, transmitting an instruction to the client node to perform a compression switch; receiving, in response to the instruction, another model update including a subset GSV based on the second gradient vector; generating a second updated model using the subset GSV; and distributing the second updated model to the client nodes.