Google
DeepMind (Google) · AI / ML · Filed May 12, 2025 · USPTO published Nov 12, 2026 · This week's release
A New Google Patent Blends Several AI Models Into One That's Harder to Trick
Google's DeepMind team describes blending several AI image models into one, and the blend can hold up against a given trick better than the model trained specifically for that trick.
- Publication number
- US 2026/0359657 A1(US20260359657A1)
- Applicant
- DeepMind Technologies Limited
- Filed · Published
- May 12, 2025 · Nov 12, 2026
- Inventors
- Francesco Croce, Sylvestre-Alvise Guglielmo Rebuffi, Sven Adrian Gowal, Evan Gerard Shelhamer
- Status when we published
- Waiting for an examiner
- Document
- 20 claims
- US classification
- 706/25
- Parent application
- National Stage Entry of PCT/EP2023/081621 (filed Nov 13, 2023)(PCTEP2023081621)
What Google's model-blending patent actually does
Imagine a camera system that reads a stop sign correctly every time, until someone tweaks a few pixels you can't even see and it suddenly calls the sign something else. Researchers call that an adversarial attack, and it is a real weak spot in image AI.
Google's DeepMind team describes a fix. Instead of building one AI and hoping it handles every trick, you train several copies, each toughened against a different kind of trick. Then you blend them into a single model by combining their internal settings, the numbers an AI learns during training.
The odd part: the blend can resist a given trick better than the copy trained specifically for it. And you can change the mix later, say when your photos look different from the training photos, without training anything again.
obtaining data specifying a plurality of different adversarial training schemes, wherein each adversarial training scheme trains the neural network to be robust to a different type of adversarial attack …
Translation: The system gathers several training methods designed to defend against different types of hacks.
How Google mixes the trained models' settings
The filing covers a training method in two stages. First, you pick several adversarial training schemes. These are training recipes where the AI is deliberately shown slightly altered inputs, with each recipe aimed at a different type of attack. You train a separate copy of the network with each recipe.
Second, you merge the copies. A neural network is a big pile of numbers called parameters (think of them as dials the AI sets while learning). For every dial, the system combines the value each copy settled on into one final value. The filing calls the result a "soup."
- Attack types can differ in how the size of a pixel tweak is measured, using different values of a setting called p (the examples use 1, 2 or infinity).
- To save time, one copy can be trained fully and the others fine-tuned from it for a few rounds. In the filing's example, that means 16 rounds of training instead of 30.
- The combining step can be a weighted sum (a weighted average). The weights come from trying candidate sets on test data and keeping the best, judged by accuracy or by resistance to attacks, including types the copies never trained on.
The claims list image classification, object detection, image segmentation, and controlling a robot or other agent from sensor data as target tasks.
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for merging adversarially-robust neural networks.
Translation: Google patented a way to combine multiple secure AI models into a single fortified network.
Why this matters for image AI that can be fooled
Image AI sits inside photo tools, cameras, medical scanning and robots, and the filing mentions all of those kinds of inputs. If an AI can be thrown off by changes you can't see, everything built on it inherits that risk. A single model that resists several kinds of tricks, including ones nobody trained it against, would lower that risk.
There is a cost angle too. The filing says the final model doesn't need to be trained on every attack type at once, which cuts training time. It also says the mix can be re-tuned when conditions shift, such as different weather, lighting or patients, without retraining. For anyone running these systems, that means cheaper updates after the model is already deployed.
Google's 37th filing we've tracked in our AI team-based models watchlist since May adds to a pattern that includes a social media campaign builder and an image-generating chatbot.
Source: US 2026/0359657 A1 at the USPTO (PDF). Full patent text and figures are in the official publication.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Google patent news breaks.
Add Patentlyze on Google
One click.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings · 7 sheets
7 drawing sheets from US 2026/0359657 A1 · click any drawing to enlarge
More from Google
All 1,079 Google patents →
More in AI training & infrastructure
All 316 AI training & infrastructure patents →
Samsung
Samsung Patents a Way to Blend Specialized AI Models Into One Without Starting Over
Adobe
Adobe Files Patent to Have AI Models Grade Each Other's Answers
Qualcomm
Qualcomm Patents a System That Picks the Right AI Photo Model by Resolution
Microsoft
No comments yet