Method and apparatus for robustifying a neural network against adversarial interference

Abstract

The present invention relates to a method for making a neural network (15) robust against adversarial interference, wherein sensor data (20) detected by at least one sensor (51) is supplied as input data to the neural network (15), wherein output data (18) of at least one layer (16-x, 17-x) of the neural network (15) is replaced one by one by means of quilting, and wherein the replaced output data (28) is supplied as input data to at least one subsequent layer (16-x, 17-x) of the neural network (15). The invention also relates to an apparatus (1) for making a neural network (15) robust against adversarial interference, a method for operating an auxiliary system (200) for a vehicle (60) and an auxiliary system (200) for a vehicle (50), a vehicle (50), a computer program and a data carrier signal.

Description

Technical Field

[0001] This invention relates to a method and apparatus for making a neural network robust to adversarial interference. Furthermore, this invention relates to a method for operating an auxiliary system for a vehicle, an auxiliary system for a vehicle, a vehicle, a computer program, and a data carrier signal. Background Technology

[0002] Machine learning, such as neural network-based machine learning, holds immense potential for applications in modern driver assistance systems and autonomous vehicles. Deep neural network-based functions process sensor data (e.g., from camera, radar, or lidar sensors) to derive crucial information. This information includes, for example, the type and location of objects in the area surrounding the vehicle, the behavior of those objects, or the geometry or topology of the driving lane.

[0003] In neural networks, convolutional neural networks (CNNs) have proven particularly well-suited for image processing. CNNs extract different high-value features from input data (e.g., image data) in an unsupervised manner, progressively. During training, the CNN independently develops feature maps based on filter channels that locally process the input data to derive local features. These feature maps are then reprocessed by additional filter channels, from which even higher-value feature maps are derived. Based on this information compressed from the input data, the deep neural network ultimately derives its decisions and provides them as output data.

[0004] Convolutional networks outperform classical methods in terms of functional accuracy, but they also have drawbacks. For example, attacks based on adversarial interference in sensor data / input data can lead to misclassification, incorrect semantic segmentation, or incorrect object detection in detected sensor data, even though the content remains semantically unchanged.

[0005] By Chuan Guo et al., Countering Adversarial Images Using Input Transformations, arXiv:1711.00117v3[cs.CV], January 25, 2018, https: / / arxiv.org / pdf / 1711.00117.pdf, a quilting-Verfahren method for eliminating adversarial interference in image data is known. Summary of the Invention

[0006] The purpose of this invention is to provide a method and apparatus for making neural networks robust against adversarial interference.

[0007] This objective is achieved by the method and apparatus according to the invention. The invention includes several advantageous design options.

[0008] In particular, a method is provided for making a neural network robust to adversarial interference, wherein sensor data detected by at least one sensor is supplied as input data to the neural network, wherein output data of at least one layer of the neural network is replaced one by one by means of quilting, and wherein the replaced output data is supplied as input data to at least one subsequent layer of the neural network.

[0009] Furthermore, a device for making a neural network robust against adversarial interference is provided, the device comprising a computing device configured to provide or access a neural network, receive sensor data detected by at least one sensor and supply it to the neural network as input data, replace output data of at least one layer of the neural network one by one by means of quilting, and supply the replaced output data as input data to at least one subsequent layer of the neural network.

[0010] This method and apparatus can eliminate or at least reduce the impact of adversarial interference potentially contained in detected sensor data on the final output of a neural network. This makes the neural network, or the function of the neural network, robust against adversarial interference. For this purpose, the output data of at least one layer of the neural network is replaced sequentially by quilting. The layers are particularly the inner layers of the neural network. The sequentially replaced output data is supplied to at least one subsequent layer of the neural network. This eliminates or at least reduces the impact of adversarial interference on the data flow within the neural network, thereby eliminating or at least reducing its impact on the final output of the neural network.

[0011] One advantage of this method and apparatus is that robustness is particularly independent of the specific design of adversarial interference contained in the sensor data, because the replacement of each quilt is performed independently of the presence of adversarial interference and, more importantly, the type of adversarial interference. Another advantage is that this method and apparatus can be easily integrated into existing neural networks or the KI functionality provided therein. There is no need to adapt the structure of the neural network; only the output data of at least one layer of the neural network needs to be replaced or altered one by one using the quilts. Furthermore, there is no need to adapt or repeat the training phase of the neural network. Thus, despite achieving robustness, costs and expenses can be saved.

[0012] The output data specifically includes the activations of at least one layer of the neural network. Here, the activations are particularly present in the form of activation maps of the layers. The activation maps can also be feature maps of layers in a neural network constructed as convolutional layers.

[0013] In particular, quilting involves the successive replacement of the output data, which can also be referred to as the successive reconstruction of the output data. For this purpose, the output data is divided into multiple sub-segments. In the case of two-dimensional output data (e.g., in the form of an activation map), smaller, particularly rectangular sub-segments (also called patches) are defined for this purpose. Each sub-segment is compared with, for example, sub-segments stored in a database, referred to below as output data patches. This comparison is based on a spacing metric, defined, for example, by the Euclidean spacing over the image element vectors. For this purpose, the sub-segments are linearized into vectors. The spacing is then determined via a vector norm, for example, via the L2 norm. For quilting, the sub-segments are replaced, respectively, by the closest or most similar output data patch from the database. It can be set that a minimum spacing must be maintained, or that there must be at least no identity between the sub-segments from the output data and the output data patches. If the output data has other forms or formats, the successive replacement is performed in a similar manner.

[0014] In principle, at least one layer can be any layer in a neural network. It can also be configured to replace the output data of multiple layers of the neural network one by one using quilting. Here, for the output data of each layer, in particular, patches of output data generated and provided separately by the layer are used. At least one layer is especially an inner layer of the neural network.

[0015] In principle, sensor data from at least one sensor can be one-dimensional or multi-dimensional, especially two-dimensional. For example, sensor data can be two-dimensional camera images from a camera and / or two-dimensional or three-dimensional lidar data from a lidar or radar sensor. Sensors can be, in particular, cameras, lidar sensors, radar sensors, ultrasonic sensors, or other sensors suitable for detecting the surrounding environment.

[0016] Adversarial perturbation is a targeted interference with input data provided to neural networks, such as sensor data, in which the semantic content of the input data remains unchanged, but the interference causes the neural network to infer incorrect results, such as incorrect classification or semantic segmentation of the input data, or incorrect detection or localization of objects.

[0017] Neural networks, especially deep neural networks, and particularly convolutional neural networks (CNNs). For example, neural networks are trained to perform specific perceptual functions, such as perceiving pedestrians or other objects in detected camera images.

[0018] This method and apparatus are particularly applicable to (fully) trained neural networks.

[0019] This method can be executed as a computer-implemented method. In particular, the method can be executed using a data processing device. Specifically, the data processing device includes at least one computing device and at least one storage device.

[0020] In particular, a computer program is also provided, which includes instructions that, when executed by a computer, cause the computer to perform method steps of the disclosed method according to any one of the described embodiments.

[0021] In addition, a data carrier signal is provided in particular for transmitting the aforementioned computer program.

[0022] The method can be configured to include detecting sensor data using at least one sensor.

[0023] Alternatively, the final output of the neural network can be supplied to at least one control device, particularly at least one control device of a vehicle. The control device may, for example, provide functions for autonomous driving of the vehicle and / or driver assistance of the vehicle and / or for ambient detection and / or ambient perception. The control device may, for example, control or adjust the longitudinal and lateral guidance of the vehicle. However, in principle, this method and apparatus can also be used in other application areas, such as in industrial production or in medical robotics.

[0024] Vehicles, especially motor vehicles. However, in principle, vehicles can also be other land vehicles, rail vehicles, water vehicles, air vehicles, or space vehicles, such as drones or air taxis.

[0025] The components of the device, especially computing devices, can be configured individually or in combination as a combination of hardware and software, for example, as program code implemented on a microcontroller or microprocessor. However, it is also possible to configure the components individually or in combination as application-specific integrated circuits (ASICs).

[0026] In one embodiment, the neural network is configured to provide at least one function for autonomous or partially autonomous driving of the vehicle and / or for perception of the surrounding environment, wherein the final output of the neural network is supplied to at least one control device of the vehicle. This provides more reliable and secure input data to the vehicle's control device, thereby enabling more reliable and secure delivery of the functions provided by the control device. For example, the control device can provide actuator control for actuators in the vehicle or perform (higher-value) further processing on the final output of the neural network.

[0027] In one embodiment, for quilting, a database with output data patches is provided, wherein the output data patches are generated or have been generated based on the output data of at least one layer of a neural network, which has been obtained by means of undisturbed input data. Thus, adversarial interference in the output data of at least one layer of the neural network can be safely removed without losing content or semantic information contained in the output data. The undisturbed input data is specifically selected and arranged such that it is certain, or at least with increased probability, free from adversarial interference. The output data inferred from the undisturbed input data of at least one layer of the neural network is then subdivided into segments, each segment forming an output data patch. The size of the segments is selected here according to the specific application scenario of the method and apparatus. The output data patches generated in this way are stored in a database. For example, a database can be provided by means of a storage device, which can be accessed by a computing device. The output data patches can be linearized into vectors and stored in the database, for example. When applying the method or during quilting, the output data provided by at least one layer of the neural network is also subdivided into segments and linearized into vectors. Then, using vector norms, such as the L2 norm, the corresponding vector of the sub-segment can be compared with the vector of the output data patch stored in the database. Then, starting from a specific interval, the sub-segment of the output data is replaced with the corresponding most similar or closest output data patch.

[0028] In one implementation, the output data is processed as two-dimensional image data during quilting, wherein image segments of the two-dimensional image data are replaced one by one by means of quilting. Specifically, activation maps generated as output data from at least one layer of the neural network are processed as two-dimensional image data or images. The one-to-one replacement performed for quilting is carried out via replaced, particularly rectangular, image segments. For example, these image segments may have a size of 8×8 image elements (pixels). In this example, the output data patch also has a corresponding 8×8 image element size.

[0029] In one embodiment, at least one identification information is obtained, wherein the replacement during quilting is additionally performed taking into account the obtained at least one identification information. The identification information may also be referred to as a tag or label. Thus, entries in a database, such as output data patches stored therein, can be tagged with the additional information, allowing these entries to be found more quickly later. In particular, the database can be indexed using a hash function, thereby accelerating searches in the database because the number of database entries can be reduced through pre-selection before comparison with the output data of at least one layer of the neural network.

[0030] In an improved embodiment, the acquired identification information is derived from or derived from contextual information of the surrounding environment in which sensor data from at least one sensor is detected or has been detected. Contextual information may include, for example, geographic coordinates (e.g., GPS coordinates), time period and / or season, month, day of the week, weather (sunny, rainy, foggy, snowy, etc.) and / or traffic conditions (urban, rural, highway, pedestrian zone, rural road, main road, secondary road, etc.). This improves the quality of the output data obtained through successive replacements because, during successive replacements, a context in which output data of at least one layer of a neural network has been generated can be considered. Specifically, output data patches marked (“tagged”) with at least one contextual information can be stored in a database. Furthermore, based on the acquired identification information or at least one contextual information, pre-selection can be performed before searching the database, so that during the search, only entries or output data patches that have partial or complete consistency with at least one identification information or at least one contextual information are considered. This accelerates successive replacements.

[0031] If a neural network layer outputs many feature maps with multiple channels, then the channel-by-channel replacement can be performed dependently on each other. Here, all channels can be processed together as a single data set and replaced one by one, where this replacement can take into account spatial correlations between channels, or channels can be replaced independently of each other, where each channel is individually split and reconstructed one by one from patches of output data from its own database.

[0032] In one implementation, the neural network is configured to provide functions for autonomous driving and / or driver assistance for the vehicle and / or for ambient detection and / or ambient perception. The vehicle is, in particular, a motor vehicle. However, in principle, the vehicle can also be other land-based, air-based, water-based, rail-based, or space-based vehicles. Furthermore, in principle, this method can also be used in other fields, such as in industrial production, for example in production robots that must process sensor data, or in medical robots.

[0033] The features of the device design are derived from the description of the method design. The advantages of the device are, in turn, the same advantages found in the method design.

[0034] Furthermore, a method for operating an auxiliary system for a vehicle is provided, wherein the auxiliary system provides at least one function for automatic or partial automatic driving of the vehicle and / or for perception of the surrounding environment, wherein sensor data is detected by means of at least one sensor, wherein the method according to any one of the described embodiments is executed, and wherein the final output of the neural network is supplied to at least one control device of the vehicle. For example, the control device may provide actuator control for actuators in the vehicle or further process the final output of the neural network.

[0035] Furthermore, an assistance system for a vehicle is provided, comprising at least one sensor configured to detect sensor data and means according to any one of the described embodiments, wherein the assistance system is configured to provide at least one function for automatic or partial automatic driving of the vehicle and / or for environmental perception, supply the detected sensor data to the means, and supply the final output of a neural network provided by the means to at least one control device of the vehicle. The assistance system may further include the control device.

[0036] In addition, a vehicle is provided that includes at least one device according to any one of the described embodiments or at least one auxiliary system according to any one of the described embodiments. Attached Figure Description

[0037] The invention will now be explained in more detail with reference to the accompanying drawings and preferred embodiments. Wherein:

[0038] Figure 1 Schematic diagrams are shown of embodiments of a device and an auxiliary system for making sensor data robust against adversarial interference;

[0039] Figure 2 A schematic diagram illustrating quilting (prior art) is shown;

[0040] Figure 3 A schematic diagram is shown to illustrate an implementation of a method for making a neural network robust against adversarial interference. Detailed Implementation

[0041] exist Figure 1A schematic diagram of an embodiment of a device 1 for making a neural network 15 robust against adversarial interference is shown. Device 1 includes a computing device 2 and a storage device 3. Device 1 performs the method described in this disclosure for making the neural network 15 robust against adversarial interference.

[0042] Device 1 can be used, in particular, in vehicle 50 to make neural network 15, or the functionality provided by neural network 15, robust against adversarial interference. Vehicle 50 is, in particular, a motor vehicle. In particular, vehicle 50 may include an assistance system 200, wherein assistance system 200 includes device 1. Assistance system 200 also includes at least one sensor 51 and control device 52.

[0043] This embodiment is illustrated in conjunction with a motor vehicle. However, in principle, the method and device 1, as well as the auxiliary system 200, can also be used in other vehicles 50.

[0044] In particular, the neural network 15 provides at least one function for automatic or partial automatic driving of the vehicle 50 and / or for perception of the surrounding environment. In particular, the assistance system 200 provides at least one function for automatic or partial automatic driving of the vehicle 50 and / or for perception of the surrounding environment, at least in part, by means of the neural network 15.

[0045] Parts of device 1, particularly computing device 2, can be constructed individually or in combination as a combination of hardware and software, for example, as program code implemented on a microcontroller or microprocessor.

[0046] The computing device 2 provides the neural network 15, that is, it provides the functionality of the neural network 15 and performs the necessary computational operations for it. For example, the structure and parameters of the neural network 15 are stored in the storage device 3. Alternatively, the computing device 2 may only have access to the neural network 15 provided in other ways. Sensor data 20 detected by the sensor 51 (e.g., a camera or lidar sensor of the vehicle 50) is supplied to the computing device 2.

[0047] The computing device 2 receives the detected sensor data 20 and supplies this sensor data as input data to the neural network 15. Furthermore, the computing device 2 replaces the output data of at least one layer of the neural network 15 one by one using quilting. The replaced output data is then supplied as input data to at least one subsequent layer of the neural network 15.

[0048] The final output 30 of the neural network 15 is output by the computing device 2, for example, in the form of digital data packets. The final output 30 is supplied, for example, to the auxiliary system 200 or the control device 52 of the vehicle 50, which controls or adjusts the longitudinal and / or lateral guidance of the vehicle 50, for example, based on the final output 30.

[0049] After quilting or after successive replacement, the output data after successive replacement has the same format as the (original) output data, so that the method or device 1 can be inserted and used in existing applications of neural network 15.

[0050] Specifically, for quilting, a database 40 is provided with output data patches 60, wherein the output data patches 60 are generated or have been generated based on the output data of at least one layer of the neural network 15, which has been obtained by means of undisturbed input data. The undisturbed input data is, for example, based on trusted training data, using which the neural network 15 has been trained.

[0051] It can be configured to obtain at least one identification information 10, wherein the replacement during quilting is additionally performed in consideration of the obtained at least one identification information 10. The identification information 10 is supplied to the computing device 2, for example, and can be used to pre-select the output data patch 60 used by the database 40 during quilting, thereby accelerating the quilting process.

[0052] In the improved scheme, the acquired identification information 10 can be derived from or derived from the contextual information 11 of the surrounding environment, and the sensor data 20 of sensor 51 can be detected or has been detected in that surrounding environment. Contextual information may include, for example, geographic coordinates (e.g., GPS coordinates), time period and / or season, month, day of the week, weather (sunny, rainy, foggy, snowy, etc.) and / or traffic context (urban, rural, highway, pedestrian zone, rural road, main road, side road, etc.).

[0053] For example, situation information 11 can be detected by means of a situation sensing mechanism (not shown) provided for this purpose in the vehicle 50 (e.g., rain sensor, temperature sensor, etc.), but situation information can also be provided by the controller of the vehicle 50 and can be called and / or provided, for example, via the controller local area network (CAN) bus (e.g., vehicle speed, vehicle orientation, etc.).

[0054] exist Figure 2The diagram illustrates quilting in the prior art, using camera image 22 as an example. Sensor data 20, the current camera image 22, is divided into sub-segments 23. For each sub-segment 23 (i.e., image segments) of camera image 22, a sensor data patch 61 is searched in database 40 within the scope of quilting step 100, which has the minimum spacing with the corresponding sub-segment 23 in terms of spacing metric. Currently, sensor data patch 61 is an image segment with the same size as sub-segment 23, i.e., the same number of image elements (pixels). The spacing metric is, for example, the L2 norm, which is applied to the vector generated by linearizing the sub-segment 23 or the image segment. In quilting step 100, each sub-segment 23 or image segment is then replaced by the corresponding sensor data patch 61 with the minimum spacing. Here, it can be set that the minimum spacing must be maintained. In this way, all sub-segments 23 or image segments are replaced by sensor data patches 61 from database 40. Replaced sub-segments 24 are generated, and the replaced sub-segments together construct replaced sensor data 21 or replaced camera image 25.

[0055] exist Figure 3 The diagram illustrates an implementation of a method for making the neural network 15 robust against adversarial interference.

[0056] In the example shown, the neural network 15 includes multiple convolutional layers 16-x and fully connected layers 17-x.

[0057] Sensor data 20, such as camera images 22, which are detected as input data, is supplied to the neural network 15.

[0058] The final convolutional layers 16-4 provide an activation map 19 as output data 18. This activation map can also be called a feature map and can be understood in particular as an image with many image channels (i.e., filter channels). The output data 18 or activation map 19 is replaced one by one in the quilting step 100 by means of quilting.

[0059] In principle, quilting here is combined with... Figure 2The process is performed in the same manner as described, except that instead of replacing sensor data 20 one by one with quilting, output data 18 is replaced one by one with quilting. Therefore, intervention occurs in the data stream within neural network 15. Specifically, quilting is performed by replacing sub-segments 23 of the output data 18, i.e., image segments of the image activating FIG19, with output data patches 60 that have minimal spacing from the corresponding sub-segments 23 or image segments in terms of spacing metric. Output data patches 60 are stored in and retrieved from database 40. Because multiple filter channels are included by activating FIG19, quilting step 100 can also be referred to as multi-channel quilting.

[0060] After successive replacements using quilting, the replaced sub-segments 24 or replaced image segments are used as replaced output data 28 or replaced activation maps 29. The replaced output data 28 or replaced activation maps 29 are supplied as input data to subsequent layers 17-1. Compared to the original output data 18 or original activation maps 19, the replaced output data 28 or replaced activation maps 29 eliminate or at least reduce the effects or influence of adversarial interference.

[0061] The neural network 15 provides a final output 30, which may include, for example, object recognition or semantic segmentation of the detected sensor data 20. Specifically, the neural network 15 is configured to provide functionality for autonomous driving of a vehicle and / or driver assistance for a vehicle and / or for ambient detection and / or ambient perception.

[0062] For example, the final output 30 can be supplied to the vehicle's control equipment, which may control or adjust the vehicle's longitudinal and / or lateral guidance, plan a trajectory, or perform a higher-value assessment of the final output 30.

[0063] This method is exemplarily shown for the output data 18 of a single layer 16-4 of the neural network 15. However, it can be configured to perform the method for other layers 16-x, 17-x. If the output data of multiple layers 16-x, 17-x of the neural network 15 are replaced one by one by means of quilting, then output data patches 60 generated or provided separately for each layer in layers 16-x, 17-x are used in particular. For this purpose, the database 40 specifically includes layer-specific output data patches 60.

[0064] This method can be embedded into methods used to run auxiliary systems.

[0065] List of reference numerals

[0066] 1 device

[0067] 2. Computing equipment

[0068] 3. Storage devices

[0069] 10. Identification Information

[0070] 11 Contextual Information

[0071] 15 Neural Networks

[0072] 16-x convolutional layer

[0073] 17-x Fully Connected Layer

[0074] 18 Output Data

[0075] 19 Activation Image

[0076] 20 Sensor Data

[0077] 21 Replaced sensor data

[0078] 22 camera images

[0079] 23 sub-segments

[0080] 24 Replaced subsection

[0081] 25 Replaced camera images

[0082] 28 Replaced output data

[0083] 29 Replaced activation map

[0084] 30 Final Output

[0085] 40 databases

[0086] 50 vehicles

[0087] 51 Sensors

[0088] 52 Control equipment

[0089] 60 Output Data Patch

[0090] 61 Sensor Data Patch

[0091] 100 Quilting Steps

[0092] 200 Auxiliary Systems.

Claims

1. A method for making a neural network (15) robust to adversarial interference, in, Sensor data (20) detected by at least one sensor (51) is supplied as input data to the neural network (15). The output data (18) of at least one layer (16-x, 17-x) of the neural network (15) is replaced one by one by means of quilting, and the replaced output data (28) is supplied as input data to at least one subsequent layer (16-x, 17-x) of the neural network (15). For the purpose of quilting, a database (40) with output data patches (60) is provided, wherein the output data patches (60) are generated or have been generated based on the output data (18) of at least one layer (16-x, 17-x) of the neural network (15), and the output data has been obtained by means of undisturbed input data.

2. The method according to claim 1, characterized in that, The neural network (15) provides at least one function for automatic or partial automatic driving of the vehicle (50) and / or for perception of the surrounding environment, wherein the final output (30) of the neural network (15) is supplied to at least one control device (52) of the vehicle (50).

3. The method according to any one of claims 1 to 2, characterized in that, The output data (18) is processed in the form of two-dimensional image data during quilting, wherein the image segments of the two-dimensional image data are replaced one by one by means of the quilting.

4. The method according to any one of claims 1 to 2, characterized in that, At least one identification information (10) is obtained, wherein the replacement during quilting is additionally performed in consideration of the at least one identification information (10) obtained.

5. The method according to claim 4, characterized in that, The obtained identification information (10) is derived from or derived from contextual information (11) of the surrounding environment, and sensor data (20) of the at least one sensor (51) is detected or has been detected in the surrounding environment.

6. The method according to claim 1, characterized in that, The neural network (15) provides functions for autonomous driving of the vehicle and / or driver assistance of the vehicle and / or detection and / or perception of the surrounding environment.

7. A method for operating an auxiliary system (200) for a vehicle (50), wherein, The auxiliary system (200) provides at least one function for automatic or partial automatic driving of the vehicle (50) and / or for perception of the surrounding environment, wherein sensor data (20) is detected by means of at least one sensor (51), wherein the method according to any one of claims 1 to 5 is implemented, and wherein the final output (30) of the neural network (15) is supplied to at least one control device (52) of the vehicle (50).

8. An apparatus (1) for making a neural network (15) robust to adversarial interference, the apparatus comprising a computing device (2), wherein, The computing device (2) is configured to provide a neural network (15) or access a provided neural network (15), receive sensor data (20) detected by at least one sensor (51) and supply it as input data to the neural network (15), replace the output data (18) of at least one layer (16-x, 17-x) of the neural network (15) one by one by means of quilting, and supply the replaced output data (28) as input data to at least one subsequent layer (16-x, 17-x) of the neural network (15), wherein the device further includes a storage device (3), wherein the storage device (3) is configured to provide a database (40) having output data patches (60) for quilting, wherein the output data patches (60) are generated or have been generated based on the output data (18) of at least one layer (16-x, 17-x) of the neural network (15), the output data being obtained by means of undisturbed input data.

9. An auxiliary system (200) for a vehicle (50), the auxiliary system comprising: At least one sensor (51), said sensor being configured to detect sensor data (20), and The apparatus (1) according to claim 8, The auxiliary system (200) is configured to provide at least one function for automatic or partial automatic driving of the vehicle (50) and / or for perception of the surrounding environment, to supply the detected sensor data (20) to the device (1), and to supply the final output (30) of the neural network (15) provided by the device (1) to at least one control device (52) of the vehicle (50).

10. A vehicle (50) comprising at least one device (1) according to claim 8 or at least one auxiliary system according to claim 9.

11. A computer program product comprising instructions that, when executed by a computer, cause the computer to perform method steps according to any one of claims 1 to 7.

Images