Measuring the sensitivity of a neural network image classifier to adversarial attacks.

Abstract

A method (100) for measuring the sensitivity (7) of a classifier (1) for an adversarial attack on a digital image (2) is disclosed, wherein the classifier (1) includes at least one neural network, and wherein the method comprises: providing (110) a digital image (2) for which the sensitivity (7) is to be measured; providing (120) a generator (3) trained to map elements (3b) of a latent space (3a) to a real image; obtaining (130) the elements (3b) of the latent space (3a) according to a set of parameters (3c); and using the generator (3b) to measure the sensitivity (7) of the digital image (2). ) Map the element (3b) (140) to the interference (4) in the space of the real image; · Perturb (150) the digital image (2) using the interference (4); · Determine (160) the classification result (5') for the perturbed image (2') using a classifier (1); · Determine (170) the effect (6) of the interference (4) on the classification result (5') based on the classification result (5'); · Optimize (180) the set of parameters (3c) to maximize the effect (6); and · Determine (190) the sensitivity (7) of the classifier (1) based at least in part on the maximum effect (6*).

Description

Technical Field

[0001] This invention relates to a neural network classifier for digital images, which can be used in applications related to security or safety. Background Technology

[0002] When human drivers navigate traffic, their eyes are the most important source of traffic-related information. After spending only a few dozen hours and significantly less than 1,000 km behind the wheel, a driver's brain is trained to quickly classify images of traffic conditions—what objects they contain and what needs to be done next—even if the conditions are new and did not occur during training.

[0003] For at least partially autonomous vehicles, the intention is to mimic this learning process using classifiers for digital images. Such classifiers are based on neural networks. After sufficient training, they are able to identify traffic-related objects in digital images with fairly high reliability.

[0004] However, neural networks are inherently vulnerable to so-called adversarial attacks. These attacks introduce small changes to the input image with the intention of causing misclassification. For example, by attaching an inconspicuous sticker to a stop sign, a classifier might misclassify the stop sign as a speed limit sign.

[0005] DE 102017218889 A1 discloses a statistical method for evaluating the uncertainty of the output of a neural network. High uncertainty can be a hallmark of an attempted adversarial attack. Summary of the Invention

[0006] The inventors have developed a method for measuring the sensitivity of a classifier used for digital images to adversarial attacks. The classifier includes at least one neural network.

[0007] The method begins by providing digital images for which the sensitivity is to be measured. That is, the method starts with the assumption that the sensitivity depends on the digital images to be classified and that this sensitivity is higher for some digital images than for others. For example, if two objects are already quite similar and difficult to distinguish by classification, then the classification may only require a small adversarial "push" to tip towards a misclassification.

[0008] This method uses a generator trained to map features of a latent space to real-world images. That is, the latent space is defined and / or created through this training. Some examples of the generator used are: • The generator part of a Generative Adversarial Network (GAN) is specifically trained to produce images that are difficult to distinguish from real images in the target domain; The decoder part of an encoder-decoder network can be, for example, an autoencoder network trained to map an initial digit image to a low-dimensional representation in a latent space and reconstruct the initial digit image from that representation; and • A flow-based generative model that is based on density estimation.

[0009] Use a set of parameters to obtain the features of the latent space. For example, if the latent space is a vector or matrix space, the parameters can be vector or matrix features.

[0010] A generator is used to map this element in the latent space to a perturbation in the space of the real image. This perturbation disturbs the digital image. A classifier is then used to obtain a classification result for the perturbed image.

[0011] Based on the classification result, the impact of the perturbation is determined using any suitable metric. The parameter set is then optimized to maximize this impact. That is, using the updated parameter set, new features are obtained in the latent space, new perturbations are created from these features in the space of the actual image, and these new perturbations are used to perturb the digital image. Feedback is then obtained on whether the new perturbation has a greater impact on the classification result than the previous perturbation, as intended. Based on this feedback, the optimization algorithm selects the next parameter set to try. Any parameter optimization algorithm known in the art can be used for this purpose.

[0012] When the optimization algorithm terminates, there will be a maximum effect of the implemented perturbation. The sensitivity of the classifier to adversarial attacks will be determined, at least in part, based on this maximum effect.

[0013] Therefore, during optimization, a search is performed targeting the disturbances that have the greatest potential to alter the classification result. However, this search is not performed directly in the digital image space, where the disturbances also exist. Instead, the search is performed in the latent space. There are three reasons behind this: First, neural networks used as classifiers are likely to be much more sensitive to low-frequency attacks (i.e., perturbations with smaller inter-pixel variations) compared to high-frequency attacks. This is particularly evident for networks that have been trained with adversarial images that capture high-frequency noise (“adversarial training”). Such adversarial training sacrifices some accuracy in the low-frequency domain as a trade-off for greater robustness to high-frequency noise. If the network has been trained “naturally” (i.e., without special emphasis on adversarial images), it is more robust to low-frequency domain noise. This method can be used to identify low-frequency domain perturbations that have the greatest impact on classification results, thus allowing the network to be strengthened for that type of perturbation. The end result is that adversarial training of the network can be performed at a lower cost in terms of accuracy in the low-frequency domain.

[0014] Because generators are specifically trained to map elements of their latent space to real-world images, and real-world images tend to be relatively smooth, perturbations created by the generator tend to be smooth as well. That is, the search focuses particularly on smooth perturbations that are most likely to have a large impact on classification results and are also more difficult to detect using commonly used countermeasures against adversarial attacks: some robust verification methods attempt to detect high differences between neighboring pixels to determine if the input image has been corrupted or modified in an attempt to induce misclassification. Such verification methods are particularly common for autonomous driving applications. Smooth perturbations may thus escape detection.

[0015] Second, the latent space of many generators tends to have a much lower dimension than the digital image space. In this case, the features in the latent space are characterized by far fewer parameters compared to the digital image. Therefore, the search space is greatly reduced, and computation is faster. However, for this method to be effective, it is not necessary for the generator's latent space to have a lower dimension than the digital image space.

[0016] Third, the tendency for disturbances to become quite smooth also affects the features in the latent space to some extent. This means that when the optimization algorithm updates parameters by a small amount, the changes in the effects of that update can be expected to be less pronounced. In particular, interpolation is used when generating disturbances from features in the latent space. For example, if two features z1 and z2 are close to each other in the latent space, their generated images p1 and p2 should look more similar to image p3 generated by another feature z3, which is farther from feature z1 in the latent space than feature z2. Therefore, the generated disturbances are smoother than disturbances optimized directly on pixels in the digital image space.

[0017] This is advantageous for optimizing the convergence of the algorithm. Achieving convergence directly in the space of the digital image would be much more difficult.

[0018] Furthermore, the perturbations thus generated serve as a good starting point for further optimization directly in the digital image space towards a larger impact. Such optimizations tend not to converge globally to a single optimal solution, meaning that having a good starting point is important. Compared to starting optimizations from other sources, starting with perturbations generated using this method tends to make further optimizations towards a larger impact more adversarial.

[0019] As mentioned earlier, any suitable metric can be used to determine the impact. Below are some examples of quantities that can serve as such metrics.

[0020] The determination of the impact can be based at least in part on changes to the loss function that generates self-interference. The loss function represents the optimization objective that the classifier is being trained on; typically, the classifier is trained to maximize or minimize this loss function. Therefore, changes to the loss function are well-inducing indicators of how severely misclassifications caused by interference affect the classifier's intended application. However, there may be applications where the loss function used for training is unavailable, but a fully trained, completed classifier is simply used as the given classifier.

[0021] The determination of the impact can also be based, at least in part, on the difference between the classification results for the perturbed image and the classification results for the initial digital image. This difference can again be measured according to any suitable metric. This metric can optionally consider what types of misclassifications, and to what extent, affect the intended application of the classifier. For example, traffic signs can be grouped into certain categories according to their meanings (e.g., signs in a given order, prohibition signs, restriction signs, warning signs, right-of-way signs). If the classification of a sign in one category is changed to a different sign within the same category, it can be expected to have a less severe impact on vehicle behavior compared to the case where the sign is identified as a sign from a different category.

[0022] If ground truth is available for classifying digital images, the determination of the influence can also be based, at least in part, on the difference between the classification result for the perturbed image and the classification of the ground truth. For example, in the primary use case where a sensitivity measurement is to be integrated into the training of the classifier, the ground truth needs to be available for that training.

[0023] In an advantageous embodiment, at least one transformation is applied to the perturbation before it is applied to the digital image. The perturbation includes at least one of the following: translation, scaling, rotation, occlusion, or alteration of transparency. For example, a neural network classifier may, based on its decisions, assign a particular category to an image more frequently than to other parts of the image. This can be visualized in a so-called “saliency map.” If such a particularly salient part of the image is affected by the perturbation, it may have a greater impact on the classification result than a change to a less salient part of the image. Parts of the image that are particularly silent to the classifier do not need to correspond to parts of the image that a person viewing the image would consider silent when classifying the image.

[0024] Furthermore, the perturbation may be more significant relative to other categories, thereby causing the classifier to deviate from the correct classification and suppressing the true significance relative to the correct classification. This is another reason why the effect of the perturbation may depend on the transformation (such as changing the location of the perturbation in the image).

[0025] In particular, the transformation can be characterized by further parameters, and these further parameters can be included in the optimization. That is, the optimization algorithm strives to maximize the effect by changing a combination of parameters that characterize the elements of the latent space and parameters that characterize the transformation.

[0026] As mentioned earlier, methods for measuring the sensitivity of a classifier can be integrated into the training of the classifier. Therefore, this invention also provides a method for training a classifier for digital images.

[0027] This method begins with a neural network for a classifier whose behavior is characterized by a set of parameters (e.g., weights) and a set of training images. The training images are labeled with at least one classification result, to which the classifier returns when a corresponding training image is given. That is, the labels constitute the "ground reality" to be used during training.

[0028] The training images are processed using a classifier to obtain classification results, and the parameters of the neural network are optimized with the goal of improving the value of the loss function. This loss function depends at least in part on the difference between the obtained classification results and the corresponding labels for the processed training images. In addition, the loss function also depends on the classifier's sensitivity to adversarial attacks against the corresponding training images. Sensitivity can be measured according to the method described above, but any other method may also be used.

[0029] The reason behind this training method is that most of the benefits achieved during optimization are not "free." When something is optimized towards a specific goal, that optimization is likely to change other aspects that are not part of that goal for the worse. Therefore, having sensitivity to adversarial attacks in the target is very helpful.

[0030] Not all classifiers are sensitive to the same perturbation to the same degree. Instead, a particular perturbation may drastically change the classification result of one classifier, while other classifiers may be completely unaffected by the same perturbation. This can be used to combine the strengths of different classifiers.

[0031] Therefore, the present invention also provides a method for classifying digital images. The method begins with a digital image and multiple classifiers. Each such classifier includes at least one neural network. The digital image is processed using each of the multiple classifiers to obtain a corresponding classification result. The sensitivity of each classifier to adversarial attacks is determined for the digital image. The classification result produced by the classifier with the lowest sensitivity to adversarial attacks is output as the final classification result.

[0032] As mentioned earlier, sensitivity can be measured using the methods described above, but any other suitable method may also be used.

[0033] Combining multiple classifiers in this way provides better security against adversarial attacks compared to simply combining the classification results produced by classifiers (e.g., through weighted summation or a voting mechanism for a particular class). To alter the final classification result, an adversarial attack would need to change even the classification result of the classifier that is most difficult to fool with such an attack. This might require the perturbation to be so drastic that it would be easily noticed.

[0034] Having a certain degree of sensitivity to adversarial attacks is particularly valuable for increasing security when driving vehicle traffic in a way that is at least partially automated, based on classification results generated from digital images.

[0035] Therefore, the present invention also provides a method for operating a vehicle. A digital image is acquired using at least one sensor mounted on the vehicle. A classification result for the digital image is obtained using at least one classifier comprising at least one neural network. The vehicle's drivetrain, steering system, and / or braking system are actuated, at least in part, based on the classification result.

[0036] For each classifier used in relation to an adversarial attack, the sensitivity to the digital image is obtained. As discussed above, the sensitivity can be measured using the methods described at the beginning of this disclosure, but any other suitable method may also be used. In response to the sensitivity meeting a predetermined criterion (e.g., a threshold), at least one remedial action is initiated to at least partially compensate for the impact of the sensitivity on vehicle safety.

[0037] In particular, remedial actions can specifically include: • Obtain further digital images through different sensors mounted on the vehicle, and obtain classification results for these further digital images; and / or • Use different classifiers to obtain further classification results for digital images; and / or • Issue an alarm to the vehicle occupants; and / or • Reduce vehicle speed; and / or • Bring the vehicle to a stop according to the planned emergency stop trajectory.

[0038] For example, different sensors could be additional cameras, radar sensors, or LiDAR sensors. Using different sensors is particularly helpful in situations where the classifier is especially vulnerable to adversarial attacks due to the low quality of the digital image being acquired. For instance, if visibility or lighting is insufficient, or if the sun is directly on the camera's optical axis and driving it into saturation, then classification decisions may have to be made based on limited information and could easily "switch" to a different category. This can be avoided by using supplementary information from different sensors.

[0039] A similar situation occurs in access control systems that grant access to an entity in response to it providing an authorized physical access medium. Therefore, the present invention also provides a method for operating an access control system.

[0040] In this method, at least one digital image of the physical access medium provided by the requesting entity is acquired using at least one sensor. The digital image is processed using at least one classifier to obtain a classification result. The classifier includes at least one neural network. The classification result indicates whether the access medium corresponds to an authorized access medium. In response to determining, based on the classification result, that the access medium corresponds to an authorized access medium, the requesting entity is granted access.

[0041] For example, the access medium could be a face that needs to correspond to a stored representation of an authorized face. Because GANs are very good at generating smooth human faces that might be misclassified by a classifier, it is advantageous, as described above, to have analytical tools against interference. Using these tools, one can analyze the extent to which a facial recognition system is robust against adversarial attacks.

[0042] For each digital image, the sensitivity of the classifier used to adversarial attacks is determined. In response to the sensitivity meeting a predetermined criterion, at least one remedial action is initiated to increase security against unauthorized access exploiting faulty and / or altered physical access media. As discussed above, the sensitivity may be measured using the methods described at the beginning of this disclosure, but any other suitable method may also be used.

[0043] Such remedies may cause some inconvenience to the requesting entity. By making such remedies dependent on sensitivity, remedies can be focused on those cases where they are truly necessary for security, thus avoiding inconvenience in all other cases.

[0044] In particular, remedial actions can specifically include: • Obtain further digital images through different sensors, and obtain classification results from these further digital images; and / or • Use different classifiers to obtain further classification results for digital images; and / or • Require at least one additional form of authentication before granting access to the requesting entity; and / or • Deny access to the requesting entity.

[0045] The provided methods can be implemented, at least in part, by a computer. Therefore, the present invention also provides a computer program comprising machine-readable instructions that, when executed by one or more computers, cause one or more computers to perform one or more of the methods described above.

[0046] The computer program may be provided on a non-transitory machine-readable storage medium, or it may be sold as a downloadable product. One or more computers may be equipped with the computer program, storage medium, and / or downloadable product.

[0047] The following figures illustrate further advantageous embodiments, and are not intended to limit the scope of the invention. Attached Figure Description

[0048] The figures show: Figure 1An exemplary embodiment of a method 100 for measuring the sensitivity 7 of classifier 1 is shown; Figure 2 shows an exemplary interference 4 generated during optimization 180, and a further optimization 4' of the interference in the space of the digital image 2; Figure 3 A schematic example of image 2' is shown, where interference 4 causes a coarse misclassification; Figure 4 An exemplary embodiment of a method 200 for training classifier 1 is shown; Figure 5 An exemplary embodiment of a method 300 for classifying digital images 2 is shown; Figure 6 An exemplary embodiment of a method 400 for operating a vehicle is shown; Figure 7 An exemplary embodiment of a method 500 for operating an access control system is shown. Detailed Implementation

[0049] Figure 1 This is a schematic flowchart of an embodiment of a method 100 for measuring the sensitivity 7 of classifier 1.

[0050] In step 110, a digital image 2 is provided. Sensitivity 7 is to be measured for this digital image 2.

[0051] In step 120, a generator 3 is provided. This generator 3 is trained to map elements 3b of the latent space 3a to the real image. In step 130, elements 3b of the latent space 3a are obtained based on the set of parameters 3c. In step 140, these elements 3b are mapped to disturbance 4 in the space of the real image. In step 150, the digital image 2 is perturbed using the disturbance 4. Optionally, in step 145, one or more transformations are applied to the disturbance 4 before the perturbation.

[0052] In step 160, classifier 1 is used to obtain a classification result 5' for the perturbed image 2'. In step 170, based on the classification result 5', the influence 6 of the interference 4 on the classification result 5' is determined.

[0053] In step 180, the set of parameters 3c is optimized to maximize the effect 6. After optimization, the maximum effect 6* is obtained. Any suitable optimization method can be used in this step. For example, if the loss function of classifier 1 is available, the gradient with respect to parameters 3c can be calculated, and gradient descent can be applied. This gradient can be evaluated for only one digital image 2 (to which the sensitivity 7 is to be investigated). If the average sensitivity 7 over the set of digital images 2 is to be measured, then the gradient can be averaged over all perturbed images 2'.

[0054] In step 190, the sensitivity 7 of classifier 1 is determined at least in part based on the maximum influence 6*.

[0055] In optional step 195, the perturbation 4 is further optimized in the space of the digital image 2 to generate an updated perturbation 4', which has an even greater impact 6 on the classification result 5'. During optimization 195, the impact 6 is evaluated in the same manner as during optimization 180, based on the image 2' perturbed by the updated perturbation 4'.

[0056] Figure 2 shows the evolution of perturbation 4 during optimization 180. Figure 2a It is the perturbed image 2' obtained by perturbing the digital image 2 of the dog using interference 4 (which has been generated by optimization 180).

[0057] From this point onward, the interference 4 has been further optimized directly in the space of the digital image 2 in step 195 to maximize the influence 6. After 975 iterations, the metric for this further optimization is satisfied, and result 4' is obtained. Figure 2b It is another perturbed image 2' containing interference 4' that has already been further optimized directly in the space of digital image 2. With Figure 2a In comparison, the interference 4' has become much smoother, and it has also moved within the perturbed image 2'. That is, the parameters for the translation of the interference have also been included in optimization 180.

[0058] Figure 3 Another perturbed image 2' is shown, where perturbation 4 might result in particularly drastic misclassification. Perturbed image 2' shows a praying mantis 21 perched on a blade of grass 22. After perturbation 4 was added, perturbed image 2' was misclassified as a pot by a fully trained ResNet (residual network) model (which had previously correctly classified the undisturbed image 2 as the praying mantis 21). The average classification accuracy of the ResNet model trained on TinyImageNet might decrease from approximately 60% to 20% simply due to optimization 180 in the latent space 3a. Further optimization of perturbation 4 in the space of the digital image 2 to maximize its impact further reduced the average classification accuracy of the ResNet model to approximately 8%.

[0059] Figure 4 This is a schematic flowchart illustrating an exemplary embodiment of a method 200 for training classifier 1. In step 210, a neural network 10 for the classifier is provided. In step 220, a set of training images 11 is provided. Each training image 11 is labeled using ground-based classification results 13a.

[0060] In step 230, classifier 1 is used to process the training images to obtain a classification result 13. In step 240, a loss function is evaluated, which depends at least in part on the difference between the obtained classification result 13 and the corresponding label 13a used for the processed training image 11, and on the sensitivity 7 of classifier 1 to adversarial attacks against the corresponding training image 11. Figure 4 In the example shown, sensitivity 7 is measured using method 100 described above. In step 250, parameters 12 characterizing the behavior of the neural network 10 of classifier 1 are optimized with the goal of improving the value 240a of the loss function. The result is a set of optimal parameters 12*.

[0061] Figure 5 This is a schematic flowchart illustrating an exemplary embodiment of a method 300 for classifying a digital image 2. In step 310, a plurality of classifiers 1a-1c are provided. In step 320, the digital image 2 is provided. In step 330, the digital image 2 is processed using each of the plurality of classifiers 1a-1c to obtain corresponding classification results 5a-5c. In step 340, based on these classification results 5a-5c, the sensitivity 7a-7c of each classifier 1a-1c to adversarial attacks is determined for the digital image 2. In step 350, the classification results 5a-5c produced by the classifier 1a-1c with the lowest sensitivity 7a-7c to adversarial attacks are output as the final classification result 5**.

[0062] Figure 6 This is a schematic flowchart illustrating an exemplary embodiment of a method 400 for operating a vehicle. In step 410, a digital image 2 is acquired using at least one sensor carried by the vehicle. In step 420, a classification result 5 for the digital image 2 is obtained using at least one classifier 1. In step 430, the vehicle's drivetrain, steering system, and / or braking system are actuated, at least in part, based on the classification result 5.

[0063] In step 440, the sensitivity of each classifier 1 to adversarial attacks is determined for digital image 2. In response to the sensitivity meeting a predetermined criterion (true value 1 at diamond box 450), in step 460, at least one remedial action is initiated to at least partially compensate for the impact of the sensitivity 7 on the safety of the vehicle.

[0064] Figure 7This is a schematic flowchart illustrating an exemplary embodiment of a method 500 for operating an access control system. In step 510, at least one digital image of a physical access medium provided by the requesting entity is obtained using at least one sensor. In step 520, the digital image 2 is processed using at least one classifier 1 to produce a classification result 5. In response to determining, based on the classification result 5, that the access medium corresponds to an authorized access medium (true value 1 at diamond 530), access is granted to the requesting entity in step 540.

[0065] In step 550, the sensitivity of each classifier 1 to adversarial attacks is determined for the digital image 2. In response to the sensitivity meeting a predetermined criterion (true value 1 at diamond box 560), in step 570, at least one remedial action is initiated to increase security against unauthorized access using faulty and / or altered physical access media.

Claims

1. A method (100) for measuring the sensitivity (7) of a classifier (1) for a digital image (2) to an adversarial attack, wherein the classifier (1) comprises at least one neural network, and wherein the method comprises: • Provide (110) a digital image (2) of its measurement sensitivity (7); • Provide a generator (3) (120), which is trained to map the elements (3b) of the latent space (3a) to the real image; • Obtain the elements (3b) of the latent space (3a) based on the set of parameters (3c), wherein the elements in the latent space are characterized by parameters (3c); • Use generator (3) to map (140) the element (3b) to the interference (4) in the space of the real image; • Use this interference (4) to disturb (150) the digital image (2); • Use classifier (1) to determine (160) the classification result (5') for the perturbed image (2'); • Determine the impact of (170) interference (4) on the classification result (5') based on the classification result (5') (6), where an appropriate metric is used to determine the impact of the interference; • Optimize the set of parameters (3c) (180) to maximize the effect (6); and • The sensitivity (7) of the (190) classifier (1) is determined at least in part based on the maximum influence (6*).

2. The method (100) according to claim 1, wherein the generator (3) is the generator part of an adversarial generative network (GAN), the decoder part of an encoder-decoder network, or a stream-based deep generative model.

3. The method (100) according to any one of claims 1 to 2, wherein determining (170) the effect (6) specifically comprises: • The evaluation (171) is derived from the change in the loss function used to train the classifier (1) due to the interference (4), and / or • Evaluate (172) the difference between the classification result (5') for the perturbed image (2') and the classification result (5) for the initial digital image (2); and / or • Evaluate the difference between the classification results (5') for the disturbed image (2') and the ground reality classification (5*) for the digital image (2).

4. The method (100) according to any one of claims 1 to 2, further comprising: Before using the disturbance (4) to perturb (150) the digital image (2), apply (145) at least one transformation to the disturbance (4), wherein the transformation includes at least one of the following: translation, scaling, rotation, occlusion or change of transparency.

5. The method (100) of claim 4, wherein the at least one transformation is characterized by further parameters, and wherein these further parameters are included in the optimization (180).

6. The method (100) according to any one of claims 1 to 2, further comprising: The interference (4) is further optimized (195) in the space of the digital image (2) to produce an updated interference (4') that has an even greater impact (6) on the classification result (5').

7. A method (200) for training a classifier (1) for a digital image (2), wherein the classifier (1) comprises at least one neural network, and wherein the method (200) comprises: • Provide (210) a neural network (10) for classifier (1), wherein the behavior of the neural network (10) is characterized by a set of parameters (12); • Provide a set of training images (11) (220), wherein the training images (11) are labeled with at least one classification result (13a), and the classifier (1) will return to the at least one classification result (13a) when given a corresponding training image (11); • Use classifier (1) to process (230) training images (11) to obtain classification results (13); • Evaluate (240) the loss function, which depends at least in part on the difference between the obtained classification result (13) and the corresponding label (13a) for the processed training image (11) and on the sensitivity (7) of the classifier (1) to adversarial attacks against the corresponding training image (11); and • The goal is to optimize the parameters (12) of the (250) neural network (10) to improve the value of the loss function (240a). The method described in any one of claims 1 to 5 is used to determine the sensitivity (7) of the classifier (1) to adversarial attacks.

8. A method (300) for classifying digital images (2), comprising: • Provide (310) multiple classifiers (1a-1c), wherein each classifier (1a-1c) includes at least one neural network; • Provide (320) digital images (2); • Use each of the plurality of classifiers (1a-1c) to process (330) the digital image (2) to obtain the corresponding classification result (5a-5c); • Determine (340) the sensitivity (7a-7c) of each classifier (1a-1c) to adversarial attacks against digital images (2); and The output (350) is the final classification result (5**) produced by the classifier (1a-1c) with the lowest sensitivity to adversarial attacks (7a-7c). The method described in any one of claims 1 to 5 is used to determine the classifier’s sensitivity to adversarial attacks (7).

9. A method (400) for operating a vehicle, comprising: • Obtain (410) digital images (2) using at least one sensor carried by the vehicle; • Use at least one classifier (1) to obtain (420) a classification result (5) for a digital image (2), wherein the at least one classifier (1) includes at least one neural network; • The drivetrain, steering system and / or braking system of the vehicle are actuated (430) at least in part based on the classification results (5); • Determine (440) the sensitivity (7) of each classifier (1) to an adversarial attack against a digital image (2); and initiate (460) at least one remedial action in response to the sensitivity (7) meeting a predetermined criterion (450) to at least partially compensate for the impact of the sensitivity (7) on vehicle safety. The method described in any one of claims 1 to 5 is used to determine the sensitivity (7) of the classifier (1) to adversarial attacks.

10. The method (400) according to claim 9, wherein the remedial action specifically includes: • Obtain further digital images (2) through different sensors mounted on the vehicle, and obtain classification results (5) for these further digital images (2); and / or • Use different classifiers (1) to obtain further classification results (5) for the digital image (2); and / or • Issue an alarm to the vehicle occupants; and / or • Reduce vehicle speed; and / or • Bring the vehicle to a stop according to the planned emergency stop trajectory.

11. A method (500) for operating an access control system, comprising: • Use at least one sensor to obtain (510) at least one digital image (2) of the physical access medium provided by the entity requesting access; • Use at least one classifier (1) to process (520) the at least one digital image (2) to obtain a classification result (5) indicating whether the access medium corresponds to an authorized access medium, wherein the classifier (1) includes at least one neural network; as well as • In response to determining (530) that the access medium corresponds to an authorized access medium based on the classification result (5), the requesting entity is permitted (540) to access the medium. The method further includes: • Determine (550) the sensitivity (7) of each classifier (1) to adversarial attacks against digital images (2); And in response to the sensitivity (7) meeting a predetermined criterion (560), initiate (570) at least one remedial action to increase security against unauthorized access using faulty and / or altered physical access media. The method described in any one of claims 1 to 5 is used to determine the sensitivity (7) of the classifier (1) to adversarial attacks.

12. The method (500) according to claim 11, wherein the remedy specifically includes: • Obtain further digital images (2) through different sensors, and obtain classification results (5) for these further digital images (2); and / or • Use different classifiers to obtain further classification results (5) for the digital image (2); and / or • Require at least one additional form of authentication before granting access to the requesting entity; and / or • Deny access to the requesting entity.

13. A computer program product comprising machine-readable instructions that, when executed by one or more computers, cause the one or more computers to perform the method (100, 200, 300, 400, 500) according to any one of claims 1 to 12.

14. A non-transitory machine-readable storage medium having a computer program product according to claim 13.

15. One or more computers having a computer program product according to claim 13 and / or a non-transitory machine-readable storage medium according to claim 14.

Images