Selective elimination of features for adversarial robustness of neural networks

Abstract

A system includes a computer including a processor and a memory. The memory includes instructions causing the processor to be programmed to receive a plurality of adversarial image features and a plurality of natural image features at a selective dropout layer of a neural network, select one or more nodes within the selective dropout layer to deactivate based on a comparison of the plurality of adversarial image features to the plurality of natural image features, and deactivate the selected one or more nodes.

Description

Technical Field

[0001] This disclosure relates to selectively removing one or more neurons in a neural network to increase robustness against adversarial attacks. Background Technology

[0002] Deep neural networks (DNNs) can be used to perform many image understanding tasks, including classification, segmentation, and captioning. Typically, DNNs require a large number of training images (tens of thousands to millions). Additionally, these training images usually need to be annotated, such as labeled, for training and prediction purposes.

[0003] Additionally, traditional DNNs are vulnerable to adversarial attacks. For example, traditional DNNs may be susceptible to adversarial attacks where noisy inputs cause the DNN to behave abnormally, such as generating inaccurate predictions and / or classifications. Summary of the Invention

[0004] A system includes a computer, which includes a processor and a memory. The memory includes instructions that program the processor to: receive a plurality of adversarial image features and a plurality of natural image features at a selective culling layer of a neural network; select one or more nodes within the selective culling layer to deactivate based on a comparison of the plurality of adversarial image features with the plurality of natural image features; and deactivate the selected one or more nodes.

[0005] Among other features, the processor is also programmed to receive sensitivity thresholds.

[0006] Among other features, the processor is also programmed to selectively cull one or more nodes within a layer to deactivate them based on comparison and sensitivity thresholds.

[0007] Among other features, the processor is also programmed to compute the loss function after one or more selected nodes have been deactivated.

[0008] Among other features, the processor is also programmed to update one or more weights within the neural network based on a loss function.

[0009] Among other features, the processor is also programmed to update one or more weights within the neural network via backpropagation based on a loss function.

[0010] Among other features, the processor is also programmed to generate multiple adversarial image features via a pre-trained neural network based on multiple adversarial images provided to the pre-trained neural network.

[0011] Among other features, pre-trained neural networks include pre-trained convolutional neural networks.

[0012] Among other features, the pre-trained convolutional neural networks include the Visual Geometric Group (VGG)19 neural network.

[0013] Among other features, the neural network generates multiple natural features based on multiple natural images.

[0014] A method includes receiving multiple adversarial image features and multiple natural image features at a selective culling layer of a neural network, selecting one or more nodes within the selective culling layer to deactivate based on a comparison of the multiple adversarial image features with the multiple natural image features, and deactivating the selected one or more nodes.

[0015] Among other features, the method includes: a receiver sensitivity threshold.

[0016] Among other features, the method includes: selecting one or more nodes within the selective culling layer to deactivate based on the comparison and sensitivity threshold.

[0017] Among other features, the method includes: calculating a loss function after one or more selected nodes have been deactivated.

[0018] Among other features, the method includes updating one or more weights within the neural network based on a loss function.

[0019] Among other features, the method includes updating one or more weights within the neural network via backpropagation based on a loss function.

[0020] Among other features, the method includes generating multiple adversarial image features via a pre-trained neural network based on multiple adversarial images provided to the pre-trained neural network.

[0021] Among other features, pre-trained neural networks include pre-trained convolutional neural networks.

[0022] Among other features, the pre-trained convolutional neural networks include the Visual Geometric Group (VGG)19 neural network.

[0023] Among other features, the neural network generates multiple natural features based on multiple natural images.

[0024] Further areas of application will become apparent from the description provided herein. It should be understood that the descriptions and specific examples are for illustrative purposes only and are not intended to limit the scope of this disclosure. Attached Figure Description

[0025] The accompanying drawings described herein are for illustrative purposes only and are not intended to limit the scope of this disclosure in any way.

[0026] Figure 1This is a block diagram of an example system including a vehicle;

[0027] Figure 2 This is a block diagram of the sample server within the system;

[0028] Figure 3 This is a block diagram of an example computing device;

[0029] Figure 4 This is a diagram illustrating an example neural network;

[0030] Figure 5 This is a diagram of an exemplary neural network in which multiple nodes have been deactivated in the selective elimination layer;

[0031] Figures 6A to 6C This is a block diagram illustrating an example process for training one or more neural networks; and

[0032] Figure 7 This is a flowchart illustrating an example process for training a neural network to selectively remove one or more nodes within a selective removal layer. Detailed Implementation

[0033] The following description is exemplary in nature and is not intended to limit this disclosure, application, or use.

[0034] This disclosure discloses one or more embodiments that generate a neural network with improved robustness against adversarial attacks by selectively removing one or more nodes within a selectively removed layer. The selectively removed layer may include one or more hidden layers in the neural network. The selectively removed layer may be selected based on empirical analysis, depending on the intended use of the neural network, such as object classification, object identification, etc.

[0035] Figure 1 This is a block diagram of an example vehicle system 100. System 100 includes a vehicle 105, which is a land vehicle such as a car, truck, etc. Vehicle 105 includes a computer 110, vehicle sensors 115, actuators 120 for actuating various vehicle components 125, and a vehicle communication module 130. The communication module 130 allows the computer 110 to communicate with a server 145 via a network 135.

[0036] Computer 110 can operate vehicle 105 in autonomous, semi-autonomous, or non-autonomous (manual) mode. For the purposes of this disclosure, autonomous mode is defined as each of the propulsion, braking, and steering of vehicle 105 being controlled by computer 110; in semi-autonomous mode, computer 110 controls one or both of the propulsion, braking, and steering of vehicle 105; and in non-autonomous mode, a human operator controls each of the propulsion, braking, and steering of vehicle 105.

[0037] Computer 110 may include being programmed to operate one or more of the following functions of vehicle 105: braking, propulsion (e.g., controlling vehicle acceleration by controlling one or more of an internal combustion engine, electric motor, hybrid engine, etc.), steering, climate control, interior and / or exterior lights, etc., and to determine whether and when computer 110 (not a human operator) controls these functions. Additionally, computer 110 may be programmed to determine whether and when a human operator controls these functions.

[0038] Computer 110 may include, for example, be communicatively coupled to one or more processors (e.g., included in an electronic control unit (ECU) or similar unit included in vehicle 105) via communication module 130 of vehicle 105 (as further described below) for monitoring and / or controlling various vehicle components 125, such as powertrain controllers, brake controllers, steering controllers, etc. Furthermore, computer 110 may communicate with a navigation system using a Global Positioning System (GPS) via communication module 130 of vehicle 105. As an example, computer 110 may request and receive location data of vehicle 105. The location data may be in a known form, such as geographic coordinates (latitude and longitude coordinates).

[0039] Computer 110 is typically arranged to communicate on communication module 130 of vehicle 105, and also to internal wired and / or wireless networks of vehicle 105 (e.g., buses in vehicle 105 such as controller area network (CAN) and other wired and / or wireless mechanisms).

[0040] Via the communication network of vehicle 105, computer 110 can transmit messages to and / or receive messages from various devices within vehicle 105 (e.g., vehicle sensors 115, actuators 120, vehicle components 125, human-machine interfaces (HMIs), etc.). Alternatively or additionally, where computer 110 actually comprises multiple devices, the communication network of vehicle 105 can be used for communication between devices represented herein as computer 110. Further, as described below, various controllers and / or vehicle sensors 115 can provide data to computer 110. The communication network of vehicle 105 may include one or more gateway modules that provide interoperability between various networks and devices within vehicle 105 (such as protocol converters, impedance matching devices, rate converters, etc.).

[0041] Vehicle sensors 115 may include various devices, such as those known to provide data to computer 110. For example, vehicle sensors 115 may include light detection and ranging (lidar) sensors 115 disposed on the top of vehicle 105, behind the windshield of vehicle 105, around vehicle 105, etc., providing information on the relative position, size, and shape of objects and / or the conditions around vehicle 105. As another example, one or more radar sensors 115 fixed to the bumper of vehicle 105 may provide data to provide and measure the position, velocity, etc., of objects (potentially including a second vehicle 106) relative to vehicle 105. Vehicle sensors 115 may also include one or more camera sensors 115, such as forward-view camera sensors, side-view camera sensors, rear-view camera sensors, etc., to provide images of the field of view from inside and / or outside vehicle 105.

[0042] The actuator 120 of vehicle 105 is implemented via circuits, chips, motors, or other electronic and / or mechanical components that can actuate various vehicle subsystems according to known appropriate control signals. The actuator 120 can be used to control components 125, including braking, acceleration, and steering of vehicle 105.

[0043] In the context of this disclosure, vehicle component 125 is one or more hardware components adapted to perform mechanical or electromechanical functions or operations, such as moving vehicle 105, slowing or stopping vehicle 105, steering vehicle 105, etc. Non-limiting examples of component 125 include propulsion components (which include, for example, internal combustion engines and / or electric motors), transmission components, steering components (e.g., which may include one or more of a steering wheel, bogie, etc.), braking components (described below), parking assist components, adaptive cruise control components, adaptive steering components, movable seats, etc.

[0044] Furthermore, computer 110 can be configured to communicate with devices outside vehicle 105 via vehicle-to-vehicle communication module or interface 130, for example, via vehicle-to-vehicle (V2V) or vehicle-to-infrastructure (V2X) wireless communication to another vehicle, or to a remote server 145 (typically via network 135). Module 130 may include one or more mechanisms through which computer 110 can communicate, including any desired combination of wireless (e.g., cellular, wireless, satellite, microwave, and radio frequency) communication mechanisms and any desired network topology (or topology when using multiple communication mechanisms). Exemplary communications provided via module 130 include cellular, Bluetooth, IEEE 802.11, Private Short Range Communication (DSRC), and / or Wide Area Network (WAN), including the Internet providing data communication services.

[0045] Network 135 can be one or more of various wired or wireless communication mechanisms, including any desired combination of wired (e.g., cable and fiber optic) and / or wireless (e.g., cellular, wireless, satellite, microwave, and radio frequency) communication mechanisms and any desired network topology (or topology when using multiple communication mechanisms). Exemplary communication networks include wireless communication networks that provide data communication services (e.g., using Bluetooth, Bluetooth Low Energy (BLE), IEEE 802.11, vehicle-to-vehicle (V2V) communication such as Dedicated Short Range Communication (DSRC), etc.), local area networks (LANs), and / or wide area networks (WANs) (including the Internet).

[0046] Computer 110 can receive and analyze data from sensor 115 substantially continuously, periodically, and / or under the instruction of server 145. Furthermore, object classification or identification techniques can be used, for example, in computer 110 based on data from lidar sensor 115, camera sensor 115, etc., to identify the type of object (e.g., vehicle, person, rock, crater, bicycle, motorcycle, etc.) and the physical characteristics of the object.

[0047] Figure 2 An example server 145 including a selective elimination neural network training system 205 is shown. As shown, the selective elimination neural network training system 205 may include a neural network module 210, a selective elimination module 215, and a storage module 220.

[0048] As just mentioned, the selective elimination neural network training system 205 may include a neural network module 210. Specifically, the neural network module 210 can manage, maintain, train, implement, utilize, or communicate with one or more neural networks. For example, the neural network module 210 can communicate with the storage module 220 to access neural networks, such as neural network 400, stored in the database 225. Furthermore, the selective elimination neural network training system 205 can communicate with the selective elimination module 215 to train and implement the neural network to classify digital images or generate predictions for other possible domains.

[0049] As described herein, the selective elimination module 215 can train and implement the neural network based on selective elimination routines. For example, the selective elimination module 215 can communicate with the neural network module 210 and the storage module 220 to access the neural network stored in the database 225. Furthermore, the selective elimination module 215 can determine the gradient loss associated with the classification labels of multiple neurons within the neural network.

[0050] Figure 3An example computing device 300, namely computer 110 and / or (one or more) servers 145, is illustrated and can be configured to perform one or more of the processes described herein. As shown, the computing device may include a processor 305, memory 310, storage device 315, I / O interface 320, and communication interface 325. Additionally, the computing device 300 may include input devices such as a touchscreen, mouse, keyboard, etc. In some embodiments, the computing device 300 may include a... Figure 3 The components shown are fewer or more components.

[0051] In a particular implementation, processor(s) 305 includes hardware for executing instructions, such as instructions constituting a computer program. By way of example and not limitation, in order to execute instructions, processor(s) 305 may retrieve (or obtain) instructions from internal registers, internal caches, memory 310, or storage device 315, and decode and execute the instructions.

[0052] Computing device 300 includes memory 310 coupled to processor(s) 305. Memory 310 can be used to store data, metadata, and programs for execution by processor(s). Memory 310 may include one or more volatile and non-volatile memories, such as random access memory (“RAM”), read-only memory (“ROM”), solid-state drive (“SSD”), flash memory, phase-change memory (“PCM”), or other types of data storage devices. Memory 310 may be internal or distributed memory.

[0053] Computing device 300 includes storage device 315, which includes storage means for storing data or instructions. By way of example and not limitation, storage device 315 may include the non-transitory storage media described above. Storage device 315 may include hard disk drive (HDD), flash memory, universal serial bus (USB) drive, or combinations of these or other storage devices.

[0054] The computing device 300 also includes one or more input or output (“I / O”) devices / interfaces 320 provided to allow a user to provide input (such as user strokes) to the computing device 300, receive output from the computing device 300, and otherwise transmit data to and from the computing device 300. These I / O devices / interfaces 320 may include a mouse, keypad or keyboard, touchscreen, camera, optical scanner, network interface, modem, other known I / O devices, or combinations of these I / O devices / interfaces 320. The touchscreen can be activated using a writing device or a finger.

[0055] I / O device / interface 320 may include one or more devices for presenting output to a user, including but not limited to a graphics engine, a display (e.g., a screen), one or more output drivers (e.g., display drivers), one or more audio speakers, and one or more audio drivers. In some embodiments, device / interface 320 is configured to provide graphical data to the display for presentation to the user. The graphical data may represent one or more graphical user interfaces and / or any other graphical content that may serve a particular embodiment.

[0056] The computing device 300 may also include a communication interface 325. The communication interface 325 may include hardware, software, or both. The communication interface 325 may provide one or more interfaces for communication (such as, for example, packet-based communication) between the computing device and one or more other computing devices 300 or one or more networks. By way of example and not limitation, the communication interface 325 may include a network interface controller (NIC) or network adapter for communicating with Ethernet or other wired networks, or a wireless NIC (WNIC) or wireless adapter for communicating with wireless networks such as Wi-Fi. The computing device 300 may also include a bus 330. The bus 330 may include hardware, software, or both for coupling components of the computing device 300 to each other.

[0057] Figure 4 This is a diagram illustrating an example deep neural network (DNN) 400 that can be used in this paper. The DNN 400 includes multiple nodes 405, and the nodes 405 are arranged such that the DNN 400 includes an input layer 410, one or more hidden layers 415, and an output layer 420. Each layer of the DNN 400 may include multiple nodes 405. Although Figure 4 Three (3) hidden layers 415 are shown, but it should be understood that the DNN 400 may include additional or fewer hidden layers. The input and output layers 410, 420 may also include more than one (1) node 405. As shown, one of the hidden layers 415 includes a selective culling layer 425. The selective culling layer 425 includes a hidden layer in which one or more nodes 405 are deactivated. As described in more detail below, one or more nodes 405 are deactivated based on adversarial image features that perturb one or more nodes 405 to a predetermined perturbation threshold. The predefined perturbation threshold can be determined through empirical analysis based on the use of the DNN 400, such as object classification, object identification, etc.

[0058] Nodes 405 are sometimes referred to as artificial neurons because they are designed to mimic biological neurons, such as human neurons. Each node 405 receives a set of inputs (indicated by arrows) multiplied by corresponding weights. These weighted inputs are then summed in an input function to provide (possibly adjusted for bias) a net input. This net input is then fed to an activation function, which in turn provides the output to the connected nodes 405. The activation function can be a variety of suitable functions, typically chosen based on empirical analysis. Figure 4 As indicated by the arrows, the output of node 405 can then be provided as a set of inputs to be included in one or more neurons 305 in the next layer.

[0059] The DNN 400 can be trained to take data as input and generate output based on that input. In one example, the DNN 400 can be trained using ground-based data (i.e., data about real-world conditions or states). For example, the DNN 400 can be trained by a processor using ground-based data or updated using additional data. For example, the weights can be initialized using a Gaussian distribution, and the bias of each node 405 can be set to zero. Training the DNN 400 can include updating the weights and biases using appropriate techniques, such as optimized backpropagation. Ground-based data can include, but is not limited to, data specifying objects within an image or data specifying physical parameters, such as angle, velocity, distance, color, hue, or the angle of an object relative to another object. For example, ground-based data can be data representing objects and object labels.

[0060] Machine learning services (such as those based on recurrent neural networks (RNNs), convolutional neural networks (CNNs), long short-term memory (LSTM) neural networks, or gated recurrent units (GRUs)) can be implemented using the DNN 400 described in this disclosure. In one example, service-related content or other information (such as words, sentences, images, videos, or other such content / information) can be converted into a vector representation.

[0061] Figure 5 An example DNN 400 is shown, in which multiple nodes 405 are selectively deactivated or removed because the interference of adversarial image features on node 405 exceeds a predefined interference threshold.

[0062] Figures 6A to 6C An example process for selectively culling one or more nodes 405 within a DNN 400, according to one or more embodiments of this disclosure, is shown. Figure 6AAs shown, the pre-trained DNN 400-1 receives a set of adversarial images 605 and generates adversarial image features 610. For example, the adversarial images 605 may include digital images of traffic signs and noise input, i.e., interference, that causes a typical neural network to misclassify objects depicted within the image. The pre-trained DNN 400-1 is trained to generate adversarial image features 610 that include latent or hidden features used by the neural network to generate predictions. The pre-trained DNN 400-1 may generate adversarial image features 610 via forward propagation. In various embodiments, the pre-trained DNN 400-1 may include a pre-trained convolutional neural network, such as a visual geometric group (VGG)19 neural network, etc.

[0063] refer to Figure 6B During the training phase of DNN 400-2, DNN 400-2 receives a set of natural images 615 and generates natural image features 620. As shown, DNN 400-2 includes a selective culling layer 425. Natural images 615 can include digital images of undisturbed objects. In other words, natural images include images derived from real-world distributions. Natural image features 620 can include latent or hidden features used by the neural network to generate predictions.

[0064] refer to Figure 6C Adversarial image features 610, natural image features 620, sensitivity threshold 625, and rejection probability 630 are provided to the selective rejection layer 425. Sensitivity threshold 625 and rejection probability 630 may include positive real numbers less than one (1). Sensitivity threshold 625 and rejection probability 630 may be determined empirically based on the desired use of DNN 400-2.

[0065] It should be understood that the resulting features 610, 620 comprise a d-dimensional vector, where d is a real number greater than -1. In various embodiments, the selective elimination module 215 may compare the adversarial image features 610 and the natural image features 620 point by point to obtain a comparison d-dimensional vector, where d is a real number greater than -1. Each element of the d-dimensional vector comprises a real number between zero (0) and -1 (1).

[0066] The selective elimination module 215 can compare the output from the selective elimination layer 425 based on features 610 and 620. For example, the selective elimination module 215 determines the loss based on the predicted output generated by the selective elimination layer 425 and the ground reality.

[0067] The selective elimination module 215 can also compare features 610 and 620 using methods such as absolute difference, outer product, and normalized correlation. The selective elimination module 215 then determines one or more nodes 405 to be selectively eliminated (e.g., deactivated) by comparing the resulting value of each element of the d-dimensional vector with a sensitivity threshold 625. For example, nodes 405 corresponding to the elements selected for elimination are set to zero (0). The selective elimination module 215 can selectively eliminate nodes 405 based on the elimination probability. The resulting vector (i.e., the vector after the elements are set to zero (0)) can be rescaled to adjust the expected value of the vector. The selective elimination module 215 then returns the adjusted feature vector. The adjusted feature vector is then forward-propagated through subsequent layers of the DNN 400-2, i.e., layers after the selective elimination layer 425. The selective elimination module 215 can then compute a loss function. One or more weights of the DNN 400-2 can then be updated using techniques such as backpropagation based on optimizations of the computed loss function.

[0068] The described process can occur multiple times. For example, the process can continue until the desired accuracy or the desired loss convergence is achieved. The resulting trained DNN 400-2 can be made more robust to adversarial attacks by disabling node 405, which may be more susceptible to adversarial features.

[0069] Once trained, the DNN 400-2 can be provided to the vehicle 105. The computer 110 can use the DNN 400-2 to perform object classification and / or object identification using images captured by the sensor 115. Based on the object classification and / or object identification, the computer 110 can operate the vehicle according to one or more vehicle operation protocols, i.e., transition from autonomous operation mode to semi-autonomous operation mode, modify vehicle speed and / or vehicle direction, etc.

[0070] Figure 7 This is a flowchart of an example process 700 for training a DNN 400, such as DNN 400-2, according to the techniques described herein. The boxes of process 700 can be executed by server 145. Process 700 begins at box 705, where adversarial image features 610 are generated. As discussed above, the pre-trained DNN 400-1 generates one or more adversarial image features 610 based on one or more adversarial images 605 (such as a batch of adversarial images) provided to the DNN 400-1.

[0071] In box 710, natural image features 620 are generated by DNN 400-2. For example, DNN 400-2 generates one or more natural image features 620 based on one or more natural images 615 (such as a batch of natural images) provided to DNN 400-2. In box 715, as referenced above... Figure 6C The discussion focuses on selectively deactivating one or more nodes 405 of the DNN 400-2 based on a comparison of adversarial image features 610 and natural image features 620. In box 720, after node 405 is deactivated, one or more weights of the DNN 400-2 are updated. For example, one or more weights of the DNN 400-2 can be determined based on a computed loss function that considers multiple classification labels compared to ground reality.

[0072] In box 725, determine whether the accuracy threshold or loss convergence has been reached. If neither the accuracy threshold nor loss convergence has been reached, process 700 returns to box 705. Otherwise, process 700 ends.

[0073] The description in this disclosure is merely exemplary in nature, and variations thereof without departing from the spirit and scope of this disclosure are intended to be within its scope. Such variations should not be considered as departing from the spirit and scope of this disclosure.

[0074] Generally, the described computing system and / or device may employ any of a variety of computer operating systems, including, but not limited to, Microsoft Automotive Operating System, Microsoft Windows Operating System, Unix operating systems (e.g., Solaris distributed by Oracle Corporation of Redwood Shores, California), AIX UNIX operating system distributed by International Business Machines Corporation of Armonk, New York, Linux operating system, Mac OSX and iOS operating systems distributed by Apple Inc. of Cupertino, California, BlackBerry OS distributed by Blackberry Corporation of Waterloo, Canada, and Android operating system developed by Google and the Open Handset Alliance, or infotainment systems provided by QNX Software Systems. Versions and variants of the CAR platform. Examples of computing devices include, but are not limited to, in-vehicle computers, computer workstations, servers, desktop computers, laptops, handheld computers, or other computing systems and / or devices.

[0075] Computers and computing devices typically include computer-executable instructions, which can be executed by one or more computing devices, such as those listed above. Computer-executable instructions can be compiled or interpreted by computer programs created using various programming languages ​​and / or technologies, including, but not limited to (alone or in combination) Java™, C, C++, Matlab, Simulink, Stateflow, Visual Basic, JavaScript, Perl, HTML, etc. Some of these applications can be compiled and executed on virtual machines, such as the Java Virtual Machine, Dalvik Virtual Machine, etc. Generally, a processor (e.g., a microprocessor) receives instructions from, for example, memory, computer-readable media, etc., and executes those instructions to perform one or more processes, including one or more of the processes described herein. These instructions and other data can be stored and transferred using various computer-readable media. A file in a computing device generally refers to a collection of data stored on computer-readable media, such as storage media, random access memory, etc.

[0076] Memory can include computer-readable media (also known as processor-readable media), including any non-transitory (e.g., tangible) medium that contributes to providing data (e.g., instructions) that can be read by a computer (e.g., by the computer's processor). Such media can take many forms, including, but not limited to, non-volatile and volatile media. Non-volatile media can include, for example, optical discs or magnetic disks, and other permanent storage devices. Volatile media can include, for example, dynamic random access memory (DRAM), which typically constitutes main memory. These instructions can be transmitted via one or more transmission media, including coaxial cables, copper wires, and optical fibers, including wires containing a system bus coupled to the processor of the ECU. Common forms of computer-readable media include, for example, floppy disks, flexible disks, hard disks, magnetic tape, any other magnetic media, CD-ROMs, DVDs, any other optical media, punched cards, paper tape, any other physical media with a perforated pattern, RAM, PROMs, EPROMs, flash EEPROMs, any other memory chips or cassette tapes, or any other computer-readable medium.

[0077] The databases, data repositories, or other data stores described herein can include various mechanisms for storing, accessing, and retrieving a wide variety of data, including hierarchical databases, file sets within a file system, application databases in proprietary formats, relational database management systems (RDBMS), and so on. Each such data store is typically contained within a computing device employing a computer operating system (as mentioned above) and is accessed via a network in any one or more of various ways. File systems can be accessed from the computer operating system and can include files stored in various formats. In addition to languages ​​used for creating, storing, editing, and executing stored procedures, RDBMS typically use a Structured Query Language (SQL), such as the PL / SQL language mentioned above.

[0078] In some examples, system elements may be implemented as computer-readable instructions (e.g., software) on one or more computing devices (e.g., servers, personal computers, etc.) and stored on an associated computer-readable medium (e.g., disks, storage, etc.). A computer program product may include such instructions stored on a computer-readable medium for performing the functions described herein.

[0079] In this application, including the following definitions, the term "module" or "controller" may be replaced by the term "circuit". The term "module" may refer to or include, or be part of, the following: application-specific integrated circuit (ASIC); digital, analog, or mixed-signal analog / digital discrete circuit; digital, analog, or mixed-signal analog / digital integrated circuit; combinational logic circuit; field-programmable gate array (FPGA); processor circuitry that executes code (shared processor circuitry, dedicated processor circuitry, or group of processor circuitry); memory circuitry that stores code executed by the processor circuitry (shared memory circuitry, dedicated memory circuitry, or group of memory circuitry); other suitable hardware components that provide the aforementioned functionality; or some or all of the above, such as in a system-on-a-chip.

[0080] This module may include one or more interface circuits. In some examples, the interface circuits may include wired or wireless interfaces that connect to a local area network (LAN), the Internet, a wide area network (WAN), or a combination thereof. The functionality of any given module in this disclosure can be distributed among multiple modules connected via the interface circuits. For example, multiple modules can allow for load balancing. In another example, a server (also referred to as a remote or cloud) module may perform some functions on behalf of a client module.

[0081] Regarding the media, processes, systems, methods, and inspirations described herein, it should be understood that although the steps of these processes are described as occurring in a certain order, these processes can be practiced by performing the described steps in an order other than that described herein. It should also be understood that some steps may be performed simultaneously, other steps may be added, or some steps described herein may be omitted. In other words, the process descriptions herein are provided for the purpose of illustrating certain embodiments and should not be construed as limiting the claims in any way.

[0082] Therefore, it should be understood that the above description is intended to be illustrative and not restrictive. Many embodiments and applications beyond the examples provided will be apparent to those skilled in the art upon reading the above description. The scope of the invention should not be determined by reference to the foregoing description, but rather by reference to the appended claims and their equivalents in their entirety. Future developments are anticipated and intended to occur in the field discussed herein, and the disclosed systems and methods will be incorporated into such future embodiments. In summary, it should be understood that modifications and variations are possible with respect to the invention, and it is defined solely by the appended claims.

[0083] Unless otherwise expressly indicated herein, all terms used in the claims are intended to give the simple and common meaning as understood by one of ordinary skill in the art. In particular, unless the claims set forth an explicit limitation to the contrary, the use of singular articles such as “a,” “the,” “the,” etc., should be understood to refer to one or more of the elements indicated in the statement.

Claims

1. A system including a computer, the computer including a processor and a memory, the memory including instructions that program the processor to: Based on the intended use of the neural network and / or empirical analysis, a selective removal layer is selected from one or more hidden layers of the neural network. The selective rejection layer of the neural network receives multiple adversarial image features and multiple natural image features, each of the multiple adversarial image features and the multiple natural image features comprising a d-dimensional vector, where d is a real number greater than 1, and each element of the d-dimensional vector comprises a real number between 0 and 1. Receiver sensitivity threshold; One or more nodes within the selective culling layer are selected to be deactivated based on a comparison of the plurality of adversarial image features and the plurality of natural image features, wherein the comparison of the plurality of adversarial image features and the plurality of natural image features includes: A d-dimensional vector of comparison is generated by comparing the plurality of adversarial image features and the plurality of natural image features pointwise using at least one of absolute difference, outer product, or normalized correlation, where d is a real number greater than 1, and each element of the d-dimensional vector of comparison includes a real number between 0 and 1. Each element of the d-dimensional vector being compared is compared with the sensitivity threshold; Based on the comparison of each element of the d-dimensional vector with the sensitivity threshold, one or more nodes to be deactivated are selected; and The selected nodes selected for culling are disabled by setting their values ​​to zero. After the values ​​of one or more selected nodes have been set to zero to adjust the desired value of the vector, the adjusted feature vector is generated by rescaling the resulting vector. The adjusted feature vector is propagated forward through the layers after the knockout layer in the neural network; Repeat the steps of receiving, comparing, selecting, deactivating, generating the adjusted feature vector, and forward propagation until the desired accuracy or the desired loss convergence is achieved. After the neural network has been updated through forward propagation, the autonomous vehicle is operated autonomously using the neural network. The trained neural network is used to classify and / or identify objects in images captured by the vehicle's sensors; and Based on the results of the object classification and / or object identification, the vehicle is operated according to one or more vehicle operation protocols, the operation including at least one of the following: transitioning from autonomous operation mode to semi-autonomous operation mode, modifying vehicle speed, and modifying vehicle direction.

2. The system according to claim 1, wherein, The processor is also programmed to calculate the loss function after one or more selected nodes have been deactivated.

3. The system according to claim 2, wherein, The processor is also programmed to update one or more weights within the neural network based on the loss function.

4. The system according to claim 3, wherein, The processor is also programmed to update one or more weights within the neural network via backpropagation based on the loss function.

5. The system according to claim 1, wherein, The processor is also programmed to generate the multiple adversarial image features based on multiple adversarial images provided to the pre-trained neural network.

6. The system according to claim 5, wherein, The pre-trained neural network includes a pre-trained convolutional neural network.

7. The system according to claim 6, wherein, The pre-trained neural network includes the visual geometric group VGG19 neural network.

8. The system according to claim 1, wherein, The neural network generates the multiple natural features based on multiple natural images.

Images