Functional testing method based on semantic adversarial generation in autonomous driving

Abstract

A method for functional testing based on semantic adversarial generation in autonomous driving is provided. A system includes a camera configured to obtain image information from an object. The system also includes a processor that communicates with the camera and is programmed to: receive input data including image information; encode the input via an encoder; obtain latent variables defining attributes of the input data, generate a sequence reconstruction of the input data using at least the latent variables and adversarial noise, obtain a residual between the input and the reconstruction using at least a comparison of the input data with the sequence reconstruction to learn a mean shift in the latent space; and output a mean shift indicating a test result of the input compared to the adversarial noise based on the comparison.

Description

Technical Field

[0001] The present disclosure relates to autonomous operation and testing of input images, including those collected during autonomous driving. Background Art

[0002] Understanding robustness and potential vulnerabilities is an important task in functional testing of deep neural network (DNN) models, especially in safety-critical applications such as autonomous driving. Recently, DNN-based models have demonstrated remarkable performance in terms of accuracy in computer vision fields such as image classification, object detection, semantic segmentation, etc. These modules can often be core components of perception systems in autonomous driving. Therefore, thorough functional testing of such models is critical for their adoption in autonomous driving. Summary of the invention

[0003] According to one embodiment, a system includes a camera configured to obtain image information from an object. The system also includes a processor in communication with the camera and programmed to: receive input data including image information; encode the input via an encoder; obtain latent variables defining properties of the input data, generate a sequence reconstruction of the input data using at least the latent variables and adversarial noise, obtain a residual between the input and the reconstruction using at least a comparison of the input data with the sequence reconstruction to learn a mean shift in a latent space; and output a mean shift indicating a test result of the input compared to the adversarial noise based on the comparison.

[0004] According to a second embodiment, a device includes a processor, which is programmed to: receive input data including at least an image of an object; encode the input data via an encoder; obtain latent variables that define attributes of the input data, generate a sequence reconstruction of the input data using at least the latent variables and adversarial noise, obtain a residual between the input and the reconstruction using at least a comparison of the input data with the sequence reconstruction to learn a mean shift in a latent space; and output the mean shift indicating a test result of the input compared to the adversarial noise based on the comparison.

[0005] According to a third embodiment, a computer program product stores instructions which, when executed by a computer, cause the computer to: receive input data; encode the input via an encoder; obtain latent variables that define properties of the input data, generate a sequence reconstruction of the input data using at least the latent variables and adversarial noise, obtain a residual between the input and the reconstruction using a comparison of at least the input data with a sequence reconstruction of a mean shift in a latent space; and output a mean shift indicating a test result of the input compared to the adversarial noise based on the comparison. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 A data annotation system 100 is depicted for implementing the system.

[0007] Figure 2 An embodiment of a semantic adversarial training system 200 is disclosed.

[0008] Figure 3 A semantic adversarial learning system 30 with limited black-box query is disclosed.

[0009] Figure 4 A system with a pre-training process in which a generator utilizes a disentangled representation is disclosed.

[0010] Figure 5A is the clustered view of the original image.

[0011] Figure 5B is a clustered view of the original image with the learned adversarial examples.

[0012] Figure 5C is a clustered view of the pixel value differences between the learned adversarial input and the original input. DETAILED DESCRIPTION

[0013] Embodiments of the present disclosure are described herein. However, it should be understood that the disclosed embodiments are merely examples, and other embodiments may take various forms and alternative forms. The figures are not necessarily to scale; some features may be enlarged or minimized to show the details of a particular component. Therefore, the specific structural and functional details disclosed herein should not be interpreted as restrictive, but only as a representative basis for teaching those skilled in the art to adopt the embodiments in different ways. As will be understood by those of ordinary skill in the art, the various features illustrated and described with reference to any one of the figures may be combined with the features illustrated in one or more other figures to produce embodiments that are not explicitly illustrated or described. The combination of illustrated features provides representative embodiments for typical applications. However, various combinations and modifications of features consistent with the teachings of the present disclosure may be desirable for specific applications or implementations.

[0014] Strong adversarial attack methods are crucial to understanding how to construct robust deep neural networks (DNNs) and for thoroughly testing defense techniques. Black-box adversarial attack algorithms that can defeat both vanilla DNNs and DNNs generated by various defense techniques may be helpful. Instead of searching for the "optimal" adversarial examples for benign inputs to the target DNN, one solution may be to find a probability density distribution over a small region centered on the input such that samples drawn from this distribution are likely to be adversarial examples, without requiring access to the DNN's internal layers or weights. Adversarial training remains one of the best defense techniques, and adversarial examples are not as transferable across defended DNNs as they are across simple DNNs.

[0015] Understanding robustness and potential vulnerabilities is an important task in functional testing of deep neural network (DNN) models, especially in safety-critical applications such as autonomous driving. Recently, DNN-based models have demonstrated remarkable performance in terms of accuracy in computer vision fields such as image classification, object detection, semantic segmentation, etc. These modules can often be core components of perception systems in autonomous driving. Therefore, thorough functional testing of such models is critical for their adoption in autonomous driving.

[0016] Recent advances in adversarial attacks carry some great potential for functional testing in DNN models. One challenge in functional testing is how to efficiently collect or generate test cases with good coverage and reveal potential vulnerabilities of DNN models. Adversarial sample learning provides an opportunity to have an end-to-end solution by leveraging the gradient information obtained from the DNN model to search the adversarial space. In a model where a classifier can be tricked into misclassifying a panda as a gibbon by adding some noise from the model gradients, the DNN model can focus on adversarial test cases instead of those on which the model already performs well.

[0017] Applying adversarial attack learning to functional testing for DNN models is a non-trivial task. There are several challenges in mainstream adversarial attack methods. First, most adversarial attack methods do not generate examples with semantics. These methods aim to make the target model fail by adding as little noise as possible that is imperceptible to humans, and therefore the generated adversarial examples look the same as the original images to humans. Therefore, these noises have no physical meaning or semantics for human understanding of the weaknesses of DNN models. Second, a large number of attack methods require knowing the architecture and parameter details of the target model to generate adversarial examples, i.e., white-box methods. This limits its application to functional testing because it is very expensive to obtain these details to test numerous models. Few black-box-based methods have been proposed, and they are also only applicable to non-semantic adversarial examples. Additionally, there is no mechanism or method to reveal the adversarial landscape of the model. For example, with current methods, we do not know what the common patterns of the adversarial examples learned are. It may not be clear whether these patterns can be interpreted as helpful to improve the method. The functional testing method based on semantic adversarial generation with limited black-box queries for object detection models shown below can address this challenge.

[0018] Figure 1 A data annotation system 100 for implementing the system is depicted. The data annotation system 100 may include at least one computing system 102. The computing system 102 may include at least one processor 104 operatively connected to a memory unit 108. The processor 104 may include one or more integrated circuits that implement the functionality of a central processing unit (CPU) 106. The CPU 106 may be a commercially available processing unit that implements an instruction set, such as one of the x86, ARM, Power, or MIPS instruction set families. During operation, the CPU 106 may execute stored program instructions retrieved from the memory unit 108. The stored program instructions may include software that controls the operation of the CPU 106 to perform the operations described herein. In some examples, the processor 104 may be a system on a chip (SoC) that integrates the functionality of the CPU 106, the memory unit 108, a network interface, and an input / output interface into a single integrated device. The computing system 102 may implement an operating system for managing various aspects of the operation.

[0019] The memory unit 108 may include volatile memory and non-volatile memory for storing instructions and data. Non-volatile memory may include solid-state memory, such as NAND flash memory, magnetic and optical storage media, or any other suitable data storage device that preserves data when the computing system 102 is deactivated or loses power. Volatile memory may include static and dynamic random access memory (RAM) that stores program instructions and data. For example, the memory unit 108 may store a machine learning model 110 or algorithm, a training data set 112 for the machine learning model 110, and an original source data set 115.

[0020] The computing system 102 may include a network interface device 122 that is configured to provide communications with external systems and devices. For example, the network interface device 122 may include a wired and / or wireless Ethernet interface defined by the Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards. The network interface device 122 may include a cellular communication interface for communicating with a cellular network (e.g., 3G, 4G, 5G). The network interface device 122 may further be configured to provide a communication interface to an external network 124 or a cloud.

[0021] The external network 124 may be referred to as the World Wide Web or the Internet. The external network 124 may establish a standard communication protocol between computing devices. The external network 124 may allow information and data to be easily exchanged between computing devices and the network. One or more servers 130 may communicate with the external network 124.

[0022] Computing system 102 may include input / output (I / O) interface 120, which may be configured to provide digital and / or analog input and output. I / O interface 120 may include an additional serial interface (e.g., a universal serial bus (USB) interface) for communicating with external devices.

[0023] The computing system 102 may include a human-machine interface (HMI) device 118, which may include any device that enables the system 100 to receive control inputs. Examples of input devices may include human interface inputs such as keyboards, mice, touch screens, voice input devices, and other similar devices. The computing system 102 may include a display device 132. The computing system 102 may include hardware and software for outputting graphics and text information to the display device 132. The display device 132 may include an electronic display screen, a projector, a printer, or other suitable devices for displaying information to a user or operator. The computing system 102 may be further configured to allow interaction with a remote HMI and a remote display device via a network interface device 122.

[0024] System 100 can be implemented using one or more computing systems. Although this example depicts a single computing system 102 that implements all of the described features, it is intended that various features and functions can be separated and implemented by multiple computing units that communicate with each other. The specific system architecture selected can depend on a variety of factors.

[0025] The system 100 may implement a machine learning algorithm 110 configured to analyze a raw source data set 115. The raw source data set 115 may include raw or unprocessed sensor data that may represent an input data set for a machine learning system. The raw source data set 115 may include videos, video clips, images, text-based information, and raw or partially processed sensor data (e.g., a radar map of an object). In some examples, the machine learning algorithm 110 may be a neural network algorithm designed to perform a predetermined function. For example, a neural network algorithm may be configured in an automotive application to identify pedestrians in a video image.

[0026] The computer system 100 may store a training data set 112 for the machine learning algorithm 110. The training data set 112 may represent a collection of previously constructed data for training the machine learning algorithm 110. The machine learning algorithm 110 may use the training data set 112 to learn weighting factors associated with the neural network algorithm. The training data set 112 may include a set of source data with corresponding consequences or results that the machine learning algorithm 110 attempts to replicate via the learning process. In this example, the training data set 112 may include source videos with and without pedestrians, and corresponding presence and location information. The source video may include various scenes in which pedestrians are identified.

[0027] The machine learning algorithm 110 may be operated in a learning mode using the training data set 112 as input. The machine learning algorithm 110 may be executed in multiple iterations using data from the training data set 112. At each iteration, the machine learning algorithm 110 may update internal weighting factors based on the achieved results. For example, the machine learning algorithm 110 may compare the output results (e.g., annotations, hidden variables, adversarial noise, etc.) with those included in the training data set 112. Since the training data set 112 includes expected results, the machine learning algorithm 110 may determine when the performance is acceptable. After the machine learning algorithm 110 achieves a predetermined performance level (e.g., 100% consistent with the consequences associated with the training data set 112), the machine learning algorithm 110 may be executed using data that is not in the training data set 112. The trained machine learning algorithm 110 may be applied to a new data set to generate annotated data.

[0028] The machine learning algorithm 110 may be configured to identify specific features in the raw source data 115. The raw source data 115 may include multiple instances or input data sets for which annotation results are desired. For example, the machine learning algorithm 110 may be configured to identify the presence of pedestrians in a video image and annotate the presence. The machine learning algorithm 110 may be programmed to process the raw source data 115 to identify the presence of specific features. The machine learning algorithm 110 may be configured to identify the features in the raw source data 115 as predetermined features (e.g., pedestrians). The raw source data 115 may be derived from a variety of sources. For example, the raw source data 115 may be actual input data collected by the machine learning system. The raw source data 115 may be generated by a machine in order to test the system. As an example, the raw source data 115 may include raw video images from a camera.

[0029] In this example, the machine learning algorithm 110 can process the raw source data 115 and output an indication of an image representation. The output can also include an enhanced representation of the image. The machine learning algorithm 110 can generate a confidence level or factor for each generated output. For example, a confidence value exceeding a predetermined high confidence threshold can indicate that the machine learning algorithm 110 is confident that the identified feature corresponds to a particular feature. A confidence value less than a low confidence threshold can indicate that the machine learning algorithm 110 has some uncertainty that a particular feature exists.

[0030] Figure 2 An embodiment of a semantic adversarial training system 200 is disclosed. In one example, a traffic light detection problem can be utilized. At a high level, the system can first learn a semantic adversarial generator using a disentangled representation learning-based method such as a variational autoencoder (VAE), and then generate adversarial examples with semantics to test the target model. Adversarial examples and test results can be summarized and reported. The data source input can include an object image 201 (e.g., a driving scenario with a traffic light) and include components such as a semantic adversarial learning component 203, semantic adversarial generation and testing 205, and a semantic adversarial report 207. As such, the semantic adversarial training system 200 can be utilized in autonomous driving scenarios.

[0031] The semantic adversarial learning component 203 can use disentangled representation learning methods such as VAE, Beta-VAE, etc. to learn the semantic adversarial generator (as shown below Figure 3). The component can first train a generator with a disentangled representation, and then learn the distribution of adversarial mean shifts for each training data in the latent space of the pre-trained generator. By injecting mean shifts into the generator, the system can generate adversarial examples. Those adversarial examples can then be used for subsequent training. Thus, objects that are normally identified can be simulated by adding adversarial noise to see how the system can predict the identification. Adversarial noise can be changes in various properties of an image, object, or video, such as contrast, background color, brightness, etc.

[0032] The system can pre-train the generator using disentangled representations. The system can try to learn an image generator using interpretable latent representations. The system can then explain what semantic changes this example has. In one embodiment, a disentangled representation model, such as VAE, can be used. As shown below Figure 4 As shown in , a VAE model can learn a disentangled latent space and then generate new images from that latent space. A desirable property of these latent dimensions is that they may have semantic meaning. For example, one dimension may capture the change in color of a traffic light, and another dimension may represent various rotations or other properties of an object.

[0033] The adversarial generator learning component can learn the distribution of mean shifts in the latent space of the pre-trained generator, and the mean shift can generate images that cause the target model to fail. Therefore, the system can deliberately try to cause failures in the system to better train the system. Therefore, the system can utilize a black-box approach with limited queries towards the target model. Instead of a typical system that might search for small noises in the image space, the system can try to learn the mean shift in the latent space.

[0034] Figure 3 A semantic adversarial learning system 30 with limited black-box query is disclosed. For a specific input image 301, the goal may be to learn the mean offset vector of the image to generate an adversarial image that causes the model to fail. Thus, when failure occurs, the system can learn the weaknesses of the current detection method. Figure 3As shown in , for a particular input image 301, the goal may be to learn the mean offset vector of the image to generate adversarial images that cause the model to fail. The process may be to first encode the image into a mean vector using VAE, and then start with a random offset vector with a small mean. The system can then perturb a set of data samples around the current mean offset vector and use them to generate new test images. Next, these test images are fed to the target model, and the system can obtain test scores. These test scores 309 can be used to estimate gradients 311, which are used to update the mean of the offset vector as a classic SGD (stochastic gradient descent) method. The process stops when an adversarial example is found or a limited query budget is met.

[0035] Input 301 can be fed into a disentangled representation adversarial generator 303. Input 301 can be an image or video, among others. Generator 303 can then output a generated object 305. Generator 303 can change various attributes of input 301. Generated object 305 can be fed into a black box detector 307. Test results 309 can be output, which are then used for gradient estimation 311. Changes in test scores 309 together with changes in attributes in 303 are used to estimate gradients, which are used to update mean offset vectors. Gradient estimates can be approximated by the ratio between the test score variance in 309 and the attribute variance in 303. Gradient projection 313 can be fed into mean offset 315, which in turn is fed into generator 303.

[0036] The system can generate adversarial examples for an input image using a pre-trained VAE generator and adversarial mean shift. The system can add the mean shift vector to the encoded mean latent vector of the input image, and then pass the addition result through the decoder to generate adversarial examples. The system can semantically summarize and quantify the robustness of the target model using the learned semantic adversarial examples. The system can be used to cluster all adversarial mean shift vectors 315 and visually summarize adversarial patterns. The clustering results carry semantic implications because the mean vector includes semantics with disentangled representation learning.

[0037] The mean shift 315 can be used to identify weaknesses in detected problems with certain adversarial noises. For example, when the adversarial noise adjusts the brightness, the system may be able to identify problems that the system has with brightness changes to the input image. The system can then feed this result into the system, as shown between the outputs of the mean shift 315 fed into the generator 303. Thus, the system can focus on those specific adversarial noises to which it is to be improved.

[0038] like Figure 4As shown in , system 400 may include a pre-training process in which a generator utilizes a disentangled representation. For example, the disentangled representation may utilize a VAE. Input 401 (e.g., a traffic light image) may be fed into a VAE 403. Input 401 may include any type of data input, such as an image or video. VAE 403 may include an encoder in a first pass. There may also be multiple passes, including a second pass, a third pass, and so on to an Nth pass. The latent variables may be updated sequentially to learn the residual between the input data and the reconstruction from the previously updated latent variables during each forward pass. The network may output the reconstruction as a disentangled semantic vector x ′. A VAE may include an encoder network (which may be gθ ) and the decoder (which is defined as fθ ).

[0039] The decoder of VAE 403 can output each internal step , and their corresponding residuals can be output. This result can show that the decoder output and the residual can work together to capture and output the learned disentanglement factor at each step. For example, the factor in each step can be X Position , Y position, size , Rotation + Shape ,as well as Shape, color, symbol, orientation, background Etc. In one example, the X position of the reconstructed image is generated during the first step. In step two, both the X position and the Y position may be generated. This process may continue, and at each step, the decoder 307 outputs a residual and transforms the image according to the learned latent code.

[0040] The “residual learning” mechanism can be composed of two gθ and decoder fθ of d The latent variables can be sequentially sampled from the encoding of the residuals between the input data and the accumulated reconstruction. At each step, the added latent variables can follow the distribution learned from the current residuals, while the previous latent variables can follow the same distribution learned from their corresponding residuals.

[0041] The VAE 403 may output a disentangled representation 405. The disentangled representation 405 may have a disentangled semantic vector 407 that has changed the original input 401. For example, the disentangled semantic vector 407 may change the properties of the image (e.g., latent variables) so that the object represented by the image appears to be changed. The disentangled semantic vector 407 may include a change to a color. For example, instead of showing a green light in an area, the VAE may change the image to output a red traffic light. The disentangled semantic vector 407 may include a change to a symbol used to represent the object. For example, instead of showing a filled circle for the light, the VAE may change the image to output a symbol, such as an arrow, that is the light. In another example, the disentangled semantic vector 407 may include a change in the orientation of the traffic light. In yet another example, the disentangled semantic vector 407 may include a change in the background color.

[0042] Figure 5A is the clustered view of the original image. Figure 5B is a clustered view of the original image with the learned adversarial examples. Therefore, the adversarial examples may have different attributes associated with the image. Such attributes may include color, sign, orientation, background, etc. Figure 5C It is a clustered view of the pixel value differences between the learned adversarial input and the original input. The pixels at the bottom of the cluster and the lower right of the figure can indicate the amount of change and have larger difference values.

[0043] Figure 5A The clustering results by t-sne with two components are shown, and the images are then visualized in a 2D plane. The left one shows the original image, and the right one shows the corresponding adversarial generation. Figure 5A The image can be an original image that can be easily detected and classified. The system can add adversarial examples on top of the original image. Figure 5B In general, the system can visualize adversarial examples on top of it. Figure 5C Visualize the difference in pixel values ​​between the adversarial image and the original image.

[0044] The figures may illustrate changes in the pattern of the adversarial image (brightness indicates the amount of change: brighter pixels have larger difference values): the cluster on the left may indicate the removal of many green pixels of the traffic light from the original image; the cluster on the upper right reduces the yellow pixels; and the bottom two clusters may indicate the removal of the outline of the traffic light.

[0045] The system may be able to quantify robustness as the ratio of the score drop for adversarial examples (e.g., as a test result) over the amount of change required by the adversary by leveraging a model of robustness, as shown below:

[0046]

[0047] is the score difference, and is the mean vector L1 distance. This measure can indicate how much manipulation effort is needed to degrade the model performance. The system can also measure the robustness of each cluster, and thus understand how robust the model is when it is attacked by different patterns. ) to understand and explain attack patterns. For example, a latent dimension with a large change can be interpreted as a reduction in a specific color or a change in the outline of an object.

[0048] The process, method or algorithm disclosed herein may be delivered to / implemented by a processing device, a controller or a computer, which may include any existing programmable electronic control unit or a dedicated electronic control unit. Similarly, the process, method or algorithm may be stored in various forms as data and instructions executable by a controller or a computer, including but not limited to information permanently stored on a non-writable storage medium such as a ROM device and information variably stored on a writable storage medium such as a floppy disk, a tape, a CD, a RAM device, and other magnetic and optical media. The process, method or algorithm may also be implemented in a software executable object. Alternatively, a suitable hardware component (such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a state machine, a controller) or other hardware components or devices, or a combination of hardware, software and firmware components, may be used to embody the process, method or algorithm in whole or in part.

[0049] Although exemplary embodiments are described above, it is not intended that these embodiments describe all possible forms covered by the claims. The words used in the specification are descriptive rather than restrictive words, and it should be understood that various changes can be made without departing from the spirit and scope of the present disclosure. As previously described, the features of the various embodiments can be combined to form other embodiments of the present invention that may not be explicitly described or illustrated. Although various embodiments may have been described as providing advantages or being preferred over other embodiments or prior art implementations in terms of one or more desired characteristics, it is recognized by those of ordinary skill in the art that one or more features or characteristics can be compromised to achieve the desired overall system properties, depending on the specific application and implementation. These properties may include, but are not limited to, cost, strength, durability, life cycle cost, marketability, appearance, packaging, size, applicability, weight, manufacturability, ease of assembly, etc. As such, to the extent that any embodiment is described as not as desirable as other embodiments or prior art implementations in terms of one or more characteristics, these embodiments are not outside the scope of the present disclosure and may be desirable for a particular application.

Claims

1. A system comprising: a camera configured to obtain image information from the subject; as well as A processor that communicates with the camera and is programmed to: receiving input data including image information; Encoding the input data via an encoder; Obtaining latent variables defining properties of input data, generating a sequence reconstruction of the input data using at least the latent variables and adversarial noise, and obtaining a residual between the input data and the reconstruction using a comparison of at least the input data with the sequence reconstruction to learn a mean shift in a latent space; as well as The mean shift is output based on the comparison to indicate a test result of the input data compared to adversarial noise, wherein the adversarial noise alters brightness, color, or contrast of the input data.

2. The system of claim 1, wherein the output of the mean shift is sent to a generator, and in response to the mean shift, the generator is configured to generate additional adversarial noise.

3. The system of claim 1, wherein the system is further configured to output a mean shift vector associated with the compared gradient estimates. The system of claim 1 , wherein the adversarial noise comprises a second input image.

5. The system of claim 1, wherein the encoder is a neural network encoder.

6. The system of claim 1, wherein the input data comprises video information obtained from a camera.

7. A device comprising: A processor programmed to: receiving input data comprising at least an image of an object; Encode the input data via an encoder; Obtaining latent variables defining properties of input data, generating a sequence reconstruction of the input data using at least the latent variables and adversarial noise, and obtaining a residual between the input data and the reconstruction using a comparison of at least the input data with the sequence reconstruction to learn a mean shift in a latent space; as well as The mean shift is output based on the comparison to indicate a test result of the input data compared to adversarial noise, wherein the adversarial noise alters brightness, color, or contrast of the input data. The apparatus of claim 7 , wherein the test result comprises a numerical value.

9. The apparatus of claim 7, wherein the output of the mean shift is sent to generate additional adversarial noise.

10. The apparatus of claim 7, wherein the processor is further programmed to compare residuals of the first and second latent variables in a first sequence and to compare residuals between the first and second latent variables in a second sequence.

11. The apparatus of claim 7, wherein the encoder is a neural network encoder.

12. The apparatus of claim 7, wherein the adversarial noise comprises a second input image comprising a modification of input data comprising at least an image of the object.

13. A computer program product storing instructions which, when executed by a computer, cause the computer to: Receive input data; Encoding the input data via an encoder; Obtaining latent variables defining properties of input data, generating a sequence reconstruction of the input data using at least the latent variables and adversarial noise, and obtaining a residual between the input data and the reconstruction using a comparison of at least the input data with a mean-shifted sequence reconstruction in a latent space; as well as outputting a mean shift indicative of a test result of the input data compared to adversarial noise based on the comparison, The adversarial noise changes the brightness, color, or contrast of the input data.

14. The computer program product of claim 13, wherein the input data comprises an image received from a camera in communication with the computer.

15. The computer program product of claim 13, wherein the encoder comprises a neural network.

16. The computer program product of claim 13, wherein the input data comprises a dataset of a plurality of images.

17. The computer program product of claim 13, wherein the computer program product further comprises instructions for updating only one latent variable during each additional sequence.

18. The computer program product of claim 13, wherein the adversarial noise comprises a second input image comprising alterations to input data comprising at least an image of the object.

Images