System and method with robust classifier defending against patch attacks

Abstract

A system and method relate to providing machine learning prediction with defense against patch attacks. The systems and methods include obtaining a digital image and generating a set of location data via a stochastic process. The set of position data includes randomly selected positions on the digital image, which provide a feasible basis for creating a region for cropping. A set of random clippings is generated based on the set of location data. Each cut-out includes a different region of the digital image, as defined with respect to its corresponding position data. The machine learning system is configured to provide a prediction for each cut in the set of random cuts, and output a set of predictions. The set of predictions is collectively evaluated to determine majority predictions among the set of predictions. An output tag is generated for a digital image based on the majority prediction. The output tag includes the majority prediction as an identifier of the digital image.

Description

[0001] government rights [0002] At least one or more portions of this invention may have been made with government support under US Government Contract No. 1190060-430433 awarded by the Defense Advanced Research Projects Agency (DARPA). Accordingly, the United States Government may have certain rights in this invention. technical field [0003] The present disclosure relates generally to machine learning systems, and more particularly to robust machine learning systems with defenses against patch attacks. Background technique [0004] In general, machine learning systems, such as deep neural networks, are vulnerable to adversarial attacks. These adversarial attacks can include physical attacks on the input data that allow the machine learning system to perturb the predictions provided by the machine learning system. For example, an attacker can use a patch attack such that the classifier is provided with image data with a patch attack where there are arbitrary and unboun...

AI Technical Summary

Problems solved by technology

This sliding window approach takes a relatively long time to run

Furthermore, since each image patch is the same size as the original image, such sliding window methods tend to be computationally expensive to process

As another example, there are works that generate image patches by using the ablation process on the entire image such that each patch is the same size as the original image, resulting in unnecessary computation

Furthermore, work utilizing the ablation process has focused on digital attacks where all pixel values ​​may be altered, which is not possible in real-world applications without compromising machine learning systems.

Images