Method and apparatus for verifying detection for image transformation

Abstract

A method for verifying defense against image transformation is disclosed. The method includes generating a proxy neural network consisting of three separate neural networks to simulate image transformation, where a first neural network is an encoder for transforming parameters, a second neural network is an encoder for inputting images, a third neural network is a transformation network for outputs of the first neural network and the second neural network, and a fourth neural network is a transformation network for outputs of the first neural network and the second neural network. And transform parameters are enhanced in dimension and added to the proxy neural network. The method further includes verifying a defense for the image transformation by using a proxy neural network based on randomized smoothing.

Description

Technical Field

[0001] The present disclosure relates generally to artificial intelligence techniques, and more particularly to techniques related to verification defenses against image transformations. Background Art

[0002] Deep learning models are widely used in the field of computer vision, enabling computers and systems to derive meaningful information from digital images, videos, and other visual inputs, and to take actions or make recommendations based on that information. However, deep learning models are susceptible to adversarial examples, including semantic transformation examples, which limits the application of such deep learning models in various safety-sensitive tasks. For example, small adversarial patches on road markings may mislead autonomous driving systems, which raises serious safety concerns. Therefore, it is necessary to verify the robustness of deep learning models against these adversarial attacks.

[0003] Proven defense methods such as randomized smoothing have been shown to be effective in building reliable machine learning systems that resist l p However, existing methods are not sufficient or provably able to defend against semantic transformations, especially those without closed-form expressions (such as defocus blur and pixelation), which are more common in practice and are usually unrestricted. p Compared to norm-bounded adversarial examples, semantic transformations can occur more naturally in real-world scenarios, including image rotation, translation, blur, weather, etc., most of which are common corruptions. Such transformations do not damage the semantic features of the image, which can still be recognized by humans, but they significantly degrade the performance of deep learning models. Therefore, improving the robustness of models to these semantic transformations is necessary and challenging. Summary of the invention

[0004] A brief description of one or more aspects of the present disclosure is provided below to provide a basic understanding of these aspects. The present disclosure is not a broad overview of all aspects, nor is it intended to determine the key elements of all aspects, nor is it intended to delimit the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to a more detailed description later.

[0005] In one aspect of the present disclosure, a method for verifying a defense against image transformation is disclosed. The method includes generating a proxy neural network composed of three separate neural networks to simulate image transformation, wherein the first neural network is an encoder for transformation parameters, the second neural network is an encoder for input images, the third neural network is a transformation network for outputs of the first neural network and the second neural network, and the transformation parameters are dimensionally enhanced and added to the proxy neural network; and verifying the defense against image transformation by using the proxy neural network based on randomized smoothing. .

[0006] In another aspect of the present disclosure, a device for verifying a defense against image transformation is disclosed. The device includes a proxy neural network composed of three separate neural networks for simulating image transformation, wherein the first neural network is an encoder for transformation parameters, the second neural network is an encoder for input images, the third neural network is a transformation network for outputs of the first neural network and the second neural network, and the transformation parameters are dimensionally enhanced and added to the proxy neural network. The proxy neural network is used to verify the defense against image transformation based on randomized smoothing.

[0007] In another aspect of the present disclosure, an apparatus for verifying a defense against image transformation is disclosed. The apparatus may include a memory and at least one processor coupled to the memory. The at least one processor may be configured to generate a proxy neural network consisting of three separate neural networks to simulate image transformation, wherein the first neural network is an encoder for transformation parameters, the second neural network is an encoder for input images, the third neural network is a transformation network for outputs of the first neural network and the second neural network, and the transformation parameters are dimensionally enhanced and added to the proxy neural network; and authenticate the defense against image transformation by using the proxy neural network based on randomized smoothing.

[0008] In another aspect of the present disclosure, a computer readable medium storing computer code for verifying a defense against image transformation is disclosed. The computer code, when executed by a processor, may cause the processor to generate a proxy neural network consisting of three separate neural networks to simulate image transformation, wherein the first neural network is an encoder for transformation parameters, the second neural network is an encoder for input images, the third neural network is a transformation network for outputs of the first neural network and the second neural network, and the transformation parameters are dimensionally enhanced and added to the proxy neural network; and verifying a defense against image transformation by using the proxy neural network based on randomized smoothing.

[0009] In another aspect of the present disclosure, a computer program product for verifying defense against image transformation is disclosed. The computer program product may include a processor executable computer code, the processor executable computer code is used to: generate a proxy neural network composed of three separate neural networks to simulate image transformation, wherein the first neural network is an encoder for transformation parameters, the second neural network is an encoder for input images, the third neural network is a transformation network for outputs of the first neural network and the second neural network, and the transformation parameters are dimensionally enhanced and added to the proxy neural network; and verify defense against image transformation by using the proxy neural network based on randomized smoothing.

[0010] Other aspects or variations of the present disclosure will become apparent by consideration of the following detailed description and accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The following drawings depict various embodiments of the present disclosure for illustrative purposes only. Those skilled in the art will readily appreciate from the following description that alternative embodiments of the methods and structures disclosed herein can be implemented without departing from the spirit and principles of the present disclosure described herein.

[0012] Figure 1 A validated defense against semantic transformations according to one aspect of the present disclosure is shown.

[0013] Figure 2 is a graphical illustration of a method for validating defenses against image transformations according to one aspect of the present disclosure.

[0014] Figure 3 A flow chart of a method for verifying defenses against image transformations according to one aspect of the present disclosure is shown.

[0015] Figure 4 A block diagram of an apparatus for verifying defense against image transformation according to one aspect of the present disclosure is shown. DETAILED DESCRIPTION

[0016] Before explaining any embodiments of the present disclosure in detail, it should be understood that the present disclosure is not limited in its application to the details of construction and arrangement of features set forth in the following description. The present disclosure is capable of other embodiments and can be practiced or carried out in various ways.

[0017] While various methods can empirically improve the robustness of models to semantic transformations on typical benchmarks (evaluated in the average case), these methods generally fail to defend against adaptive attacks by generating adversarial semantic transformations that are optimized over the parameter space of the worst-case transformations. In contrast, proven defenses aim to provide proven regions where deep learning models are theoretically robust under any attack or perturbation.

[0018] Figure 1 is an illustration of a validated defense against semantic transformations according to one aspect of the present disclosure. In this example, the semantic transformation is snow, and a parameter α is used to represent the severity of the transformation on an image of a “Stop” sign. As shown by the dashed circle in diagram 100, which shows the decision boundary of a model (i.e., a classifier) ​​trained to recognize a “Stop” sign under the semantic transformation of snow, the severity of the transformation increases as the radius of the dashed circle becomes larger. Image 110 is a transformed image with ||α||=0.3. Image 120 is a transformed image with ||α||=0.5. Images 130 and 140 are two different transformed images with ||α||=1.0. Region 150 is an empirically robust region, and region 160 is a validated robust region with radius ||α||=0.5. Therefore, as Figure 1 As shown, the model is provably robust under ||α||=0.3 (such as, transformed image 110) and ||α||=0.5 (such as, transformed image 120). However, when ||α||=1.0 (for example, for transformed image 140), the model may make incorrect predictions, although it may be empirically robust for other corrupted images with ||α||=1.0 (for example, transformed image 130). This means that empirical robustness may not be sufficient for safety-sensitive applications (for example, autonomous driving). Autonomous vehicles may encounter any level and type of complex semantic transformations or corruptions in practice. An ideal safety model should tell the user its safety region in which the model is provably robust under different transformations.

[0019] Adding a small amount of noise to the image pUnlike perturbations, semantic attacks are generally unrestricted. For example, semantic attacks can include adversarial patches, as well as manipulations based on spatial transformations (such as rotation or translation). A variety of image corruptions and perturbations degrade the performance of many deep learning models. Most of them (such as blurring, pixelation) are difficult to analyze, making it highly challenging to defend against them. In particular, many unanalyzable transformations (such as scaling blur and pixelation) do not have closed-form expressions. This makes theoretical analysis of these transformations difficult and sometimes impossible using existing methods, although they are common in real-world scenarios.

[0020] Several recent studies have attempted to extend proven defenses to simple semantic transformations with good mathematical properties, such as translation, Gaussian blur, and geometric transformations. Randomized smoothing is a recent verification method that can be used to verify defenses beyond l p norm, and can be extended to verify some simple semantic transformations such as image translation and rotation. However, these methods are limited to simple semantic transformations that are easy to analyze due to their parseable mathematical nature. These methods are neither scalable nor able to verify robustness against complex image corruptions and transformations, especially unparseable semantic transformations. Therefore, verification of robustness against these complex and realistic semantic transformations remains highly challenging. Scalable algorithms are needed to verify most unparseable and complex semantic transformations.

[0021] In the present disclosure, a general randomized smoothing (GRS) method for robustness of verification for general image transformations, including resolvable semantic transformations (e.g., translation) and unresolvable semantic transformations (e.g., rotation blur) is provided. In the GRS method, a proxy image-to-image translation neural network is generated and used to approximate these image transformations. Due to the powerful capabilities of neural networks, this method is flexible and scalable for modeling complex unresolvable semantic transformations. Then, the verification radius of the proxy neural network can be calculated by introducing new enhanced noise in the layers of the proxy neural network, which can be used to verify the original image transformation. It can be shown that the impact of the approximation error on the verification boundary can be ignored in practice. After applying the GRS method to several publicly available datasets, the results show that the method is effective for verifying complex semantic transformations and can achieve state-of-the-art performance in both verification accuracy and empirical accuracy for different types of image transformations.

[0022] For ease of description, the following mathematical symbols and formulas are introduced. It can be understood that each of these symbols and formulas can have specific physical meanings in different application scenarios. For example, input x∈R nmay refer to an image captured by an autonomous vehicle, and n is the dimension of the image, which may depend on parameters such as the resolution and chromaticity of the image. In this example, the labels Y={1,2,...,K} may include cars, buildings, pedestrians, various signs (such as Figure 1 The “stop” sign shown in ) and so on. A basic model such as a classifier can be represented as f(x): It can output the predicted probabilities for all K categories or labels for the input image x. The prediction f is the argmax i∈Y f(x) i , where f(·) i can represent the i-th element of f(·). The original input image x has transformation parameters The image transformation (e.g., semantic transformation) can be expressed as τ(θ,x): where m is the dimension of the parameters θ.

[0023] Since the general randomized smoothing method according to one aspect of the present disclosure is developed from and based on the randomized smoothing method, the randomized smoothing method will be described first below.

[0024] Given the above base classifier f(x) and image transformation τ(θ,x), the smoothing classifier can be expressed as:

[0025]

[0026] It is the average prediction of the input sample under the smooth distribution g(θ)∝exp(-ψ(θ)), where ψ: is a smooth function. A is the predicted label of the smoothed classifier G(x) for the clean image, and G(x) A Here it represents the highest category y A Similarly, y B is defined as the second largest (i.e., second top) class of the smoothed classifier G(x), and G(x) B Represents category y B The probability is as follows:

[0027]

[0028] Then, a classifier can have a proven robust radius R if it satisfies ||ξ||≤R for any perturbation, where ||·|| is any lp-norm without specification,

[0029]

[0030] In this disclosure, semantic transformations are divided into two categories: parseable transformations and unparseable transformations. A semantic transformation is parseable if it has parameters that belong to the perturbation set. The combination of the two transformations is still a new parameter where γ(·,·):P×P→P is a function that depends on these parameters, i.e., satisfies

[0031] τ(θ,τ(ξ,x))=τ(γ(θ,ξ),x). (4)

[0032] Otherwise, the semantic transformation is not resolvable. Examples of resolvable semantic transformations may include Gaussian blur, translation, brightness, contrast, etc. Examples of unresolvable semantic transformations may include rotation, scaling, rotation blur, defocus blur, scale blur, pixelation, etc. The properties of resolvable transformations make it easier to derive verified boundaries.

[0033] In order to analyze the bounds of the verification of the analyzable transformation, we can introduce a function Φ(·) that will be used in the verification bounds. For any vector u with unit norm, that is, is set as a random variable, where δ~g(·) and is the gradient operator. The complementary cumulative distribution function (CDF) of γu is further defined as And the inverse complementary CDF of γu is defined as The function Φ can be defined as

[0034]

[0035] Then, for a parsable semantic transformation, we can prove (referred to as Theorem 1 in this paper): for any classifier f(x) with a corresponding randomized smoothed classifier G(x) defined in equation (1), if there exists a function M(·,·): satisfy

[0036]

[0037] And there are two constants that satisfy the following conditions p A ,

[0038]

[0039] Then for any ||ξ||≤R, in

[0040]

[0041] And M * =max ξ , θ∈P||M(ξ,θ)||.

[0042] For example, additive transformations and commutative transformations are two types of simple parseable semantic transformations. A transformation is additive if τ(θ,τ(ξ,x)) = τ(ξ+θ,x) for any θ,ξ∈P. A transformation is commutative if τ(θ,τ(ξ,x)) = τ(ξ,τ(θ,x)) for any θ,ξ∈P. For both types of transformations, it is straightforward to verify that they satisfy the properties proposed in Theorem 1, where M(θ,ξ) = I. Therefore, Theorem 1 can be simply applied to the isotropic Gaussian distribution g(θ) = N(0,σ 2 I), thus obtaining the verified radius

[0043]

[0044] Where Ψ is the inverse CDF of the standard Gaussian distribution. These two types of transformations can include image translation and Gaussian blur, which are basic semantic transformations. The verification of these simple transformations only requires applying translation or Gaussian blur to the image samples, and we can get the average classification score under the noise distribution.

[0045] However, in practice, most semantic transformations are not commutative, or even parsable. Existing methods, such as Semanify-NN based on convex relaxation and TSS based on randomized smoothing, require the development of specific algorithms or bounds for each individual semantic transformation. They are not scalable and may not be feasible for more complex transformations that do not have a clear mathematical form. Therefore, there is a need to develop better and more general methods for verifying more types of semantic transformations.

[0046] Figure 2 is a graphical illustration of a general randomized smoothing method for validating defenses against image transformations according to one aspect of the present disclosure. Figure 2 As shown, a proxy neural network 200 can be generated and used to simulate semantic transformation. The neural network 200 is capable of approximating functions that include complex and unparseable semantic transformations. For example, the neural network 200 can be an image-to-image conversion network that accurately fits the semantic transformation.

[0047] In one embodiment, the neural network 200 that models the semantic transformation τ(θ,x) can be defined as follows, which will lead to a simple verification bound:

[0048] τ(θ,x)=H(F1(θ)+F2(x)), (8)

[0049] Among them, F1(·), F2(·), and H(·) are three separate neural networks, such as Figure 2As shown in the networks 210, 220 and 230 in . F1(·) and F2(·) are encoders for transformation parameters θ of dimension m and image x of dimension n, respectively, and their encodings are added together in the semantic space and input into the semantic layer H(·). In general, a U-Net model can be used for the proxy neural network 200. In some embodiments, all BatchNorm layers of the U-Net model can be replaced with GroupNorm layers because the proxy neural network 200 can be used in a low batch size setting. In other embodiments, the U-Net model can also be replaced by other networks used in image segmentation or super-resolution, such as Res-UNet or EDSR (Enhanced Deep Residual Network). Specifically, a U-Net, Res-UNet or EDSR network can be used as a neural network H(·), and several simple convolutional or linear layers can be used for F1(·) and F2(·). For example, all these neural networks can be trained by using an Adam optimizer with an initial learning rate of 0.001, which decays every 50 epochs until convergence. The proxy neural network can be trained using L1 loss, which can achieve better accuracy than other neural networks.

[0050] The proxy neural network can be more easily analyzed and can be validated by introducing dimensionality enhancement strategies for both the transformation parameters and the input image. Figure 2 As shown, by introducing enhanced noise of dimension d in the layer of the proxy neural network 200 The randomized smoothing can be extended to handle these complex semantic transformations. In this way, the complex semantic transformation can be viewed as a superposition of the parseable part and the unparseable residual part in the enhanced semantic space. In this way, the enhanced noise can be used to control the unparseable residual part of the enhanced dimension d≥m+n. The noise enhancement is derived from arrive By using a proxy neural network to verify the semantic transformation, the original transformation can be verified if the approximation error is within an acceptable region. The method is flexible and scalable because the proxy neural network has a unified form for analysis and can be automatically trained.

[0051] In one embodiment, in order to keep the dimensions consistent, the input data x can be further enhanced to Where d = m + n. Accordingly, the enhanced data and enhanced parameters can be defined as

[0052]

[0053] The additional parameters is sampled from g′(θ′), and the joint distribution of θ′ and θ is in, Then the general smoothing classifier can be defined as

[0054]

[0055] in, is the “enhanced target classifier” which is equivalent to the original classifier f when constrained on the original input x, which means Note that now all functions are augmented for inputs of dimension d. The proxy neural network can then be augmented to transform the augmented Expressed as

[0056]

[0057] in, and are multiple parts of an enhanced proxy neural network. By carefully designing the interactions between the enhanced parameters and the original parameters, the enhanced transformation can be transformed into a parsable semantic transformation. When constrained to the original input x and θ, it does not change the original proxy neural network. Specifically, and Can be designed as follows:

[0058]

[0059] like Figure 2 As shown, using the input image x and the transformation parameter θ, the enhanced transformation parameter Added to the proxy neural network 200, the proxy neural network 200 may output an enhanced noisy image 240. Next, the enhanced noisy image 240 may be input into a target base classifier 250. Then, a verified robust region 260 with a radius R may be calculated based on a general randomized smoothing method.

[0060] To analyze the validation bounds of unresolvable transformations by using a surrogate neural network, the notation can be simplified as follows:

[0061]

[0062] Then, we can prove (referred to as Theorem 2 in this paper) that for any classifier f(x) with a corresponding randomized smoothed classifier G(x) defined in Eq. (10), if there exists p A and satisfy:

[0063]

[0064] Then for any ||ξ||2≤R, in

[0065]

[0066] And the coefficient M* is defined as

[0067]

[0068] As can be seen from equations (14)-(15), the verified radius is similar to the result in Theorem 1 as described above. Compared with the analytic transformation, a new type of enhanced noise needs to be introduced when constructing the GRS classifier. This isotropic noise can have the same dimension as the data and can be added to the intermediate layer of the proxy neural network. The purpose of the enhanced noise is to use the additional dimension to construct a closed subspace. In this enhanced space, the Jacobian matrix of the semantic transformation becomes invertible. The coefficient M* depends on the norm of the difference of the two Jacobian matrices and is independent of the target classifier.

[0069] In one embodiment, a linear transformation may be used as F1(θ), namely

[0070] F1(θ) = A1θ + b1, (16)

[0071] in, Without sacrificing the accuracy of the proxy neural network. After substituting this term into equation (15), it is only necessary to optimize ξ to calculate M* which can make the boundary tighter. In addition, two Gaussian distributions can be used as the distribution of the original noise distribution and the additional noise part of the enhanced noise, that is,

[0072] as well as If exists p A and satisfy

[0073]

[0074] Then for any ||ξ||2≤R, in

[0075]

[0076] where Ψ(·) is the inverse CDF of the standard Gaussian distribution, and the coefficient M* is defined as

[0077]

[0078] From equation (18), we can see that M* is affected by two factors. One is the standard deviation of the two noise distributions. The other is the Jacobian matrix The norm of . It can be regarded as the residual of the unparseable part of the transformation. Therefore, various semantic transformations can be decomposed into a parseable part and a residual part. The unparseable residual part can be processed by introducing additional noise with standard deviation σ2.

[0079] Although there may be an approximation error between the proxy neural network and the original true semantic transformation, it can be shown that if the simulation of the semantic transformation has a sufficiently small error, i.e.,

[0080]

[0081] in is a true semantics, then there exists a constant ratio

[0082]

[0083] It may not depend on the target classifier, and the verification radius of the true semantic transformation satisfies

[0084] Rτ>R(1-Aε), (19)

[0085] where R can be the verification radius in equation (14) or (17) of the agent neural network.

[0086] From Equation (19), it can be seen that the reduction of the verification radius may be affected by two factors. The first is the approximation error ε between the proxy transformation and the true semantic transformation, and the second is the ratio A of the Jacobian matrix norms of certain layers of the surrogate neural network. This is also an inherent property of the semantic transformation itself and may not depend on the target classifier.

[0087] Figure 3 A flow chart of a method 300 for validating defenses against image transformations according to one aspect of the present disclosure is shown. In block 310, the method 300 may include generating a proxy neural network consisting of three separate neural networks to simulate image transformations. The three separate neural networks include: a first neural network that is an encoder for transformation parameters; a second neural network that is an encoder for an input image; and a third neural network that is a transformation network for the outputs of the first and second neural networks. The transformation parameters may be dimensionally enhanced and added to the proxy neural network.

[0088] In some embodiments, the transformation parameters are enhanced to a dimension equal to or greater than the sum of the dimensions of the input image and the dimensions of the transformation parameters. As shown in equation (9), the enhanced transformation parameters may include the transformation parameters and the additional transformation parameters. The transformation parameters and the additional transformation parameters may be sampled from two Gaussian distributions. The additional transformation parameters may be sampled to convert the image transformation into a parsable semantic transformation. In order to keep the dimensions consistent, the input image may also be enhanced by filling in 0 items. The proxy neural network may be further enhanced to represent the enhanced transformation.

[0089] The proxy neural network can use a U-Net model, where all BatchNorm layers of the U-Net model can be replaced with GroupNorm layers, and the proxy neural network is used for low batch size settings. The proxy neural network can also use other networks used in image segmentation or super-resolution, such as Res-UNet or EDSR (Enhanced Deep Residual Network). Specifically, the first and second neural networks in the proxy neural network can include several simple convolutional layers or linear layers, and the third neural network can be based on U-Net, Res-UNet or EDSR networks. All these neural networks can be trained based on L1 loss and by using the Adam optimizer.

[0090] In block 320, method 300 may include verifying the defense of the target deep learning model against image transformations using a proxy neural network based on randomized smoothing. In one embodiment, the radius of verification of the robust region of the base classifier for image transformations may be calculated based on the function of the proxy neural network as shown in equations (14)-(15) and (17)-(18). Further analysis of the properties of the semantic transformation may be performed using the proxy neural network.

[0091] Figure 4 4 is a block diagram of an apparatus 400 for verifying defense against image transformation according to one aspect of the present disclosure. The apparatus 400 may include a memory 410 and at least one processor 420. The processor 420 may be coupled to the memory 410 and configured to execute the above reference Figure 3 The method 300 described herein. The processor 420 may be a general purpose processor, or may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a combination of multiple microprocessors, a combination of one or more microprocessors and a DSP core, or any other such configuration. The memory 410 may store input data, output data, an agent neural network generated by the processor 420, and / or instructions executed by the processor 420.

[0092] In one embodiment, the processor 420 may be configured to generate a proxy neural network composed of three separate neural networks for simulating image transformation. The first neural network of the three separate neural networks is an encoder for transformation parameters. The second neural network is an encoder for input images. The third neural network is a transformation network for the outputs of the first neural network and the second neural network. The transformation parameters are dimensionally enhanced and added to the proxy neural network. The processor 420 may also be configured to verify defense against image transformation by using the proxy neural network based on randomized smoothing.

[0093] The various operations, modules, and networks described in conjunction with the disclosure herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. According to an embodiment of the present disclosure, a computer program product for computer vision processing may include a computer program for executing the above referenced Figure 3 According to another embodiment of the present disclosure, a computer readable medium may store computer code for computer vision processing, which, when executed by a processor, may cause the processor to perform the above-mentioned reference Figure 3 Method 300 described. Computer-readable media includes both non-transitory computer media and communication media, including any medium that facilitates transfer of a computer program from one place to another. Any connection can be properly referred to as a computer-readable medium. Other embodiments and implementations are within the scope of the present disclosure.

[0094] The foregoing description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the various embodiments. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments without departing from the scope of the various embodiments. Therefore, the claims are not intended to be limited to the embodiments shown herein, but are to be consistent with the widest scope consistent with the appended claims and the principles and novel features disclosed herein.

Claims

1. A method for verifying a defense against image transformation, comprising: generating a proxy neural network composed of three separate neural networks to simulate the image transformation, wherein the first neural network is an encoder for transformation parameters, the second neural network is an encoder for input images, the third neural network is a transformation network for outputs of the first neural network and the second neural network, and the transformation parameters are dimensionally enhanced and added to the proxy neural network; and The defense against the image transformation is verified by using the proxy neural network based on randomized smoothing.

2. The method according to claim 1, wherein: The transform parameters are enhanced to a dimension equal to or greater than the sum of a dimension of the input image and a dimension of the transform parameters.

3. The method according to claim 1, wherein: The enhanced transformation parameters include the transformation parameters and additional transformation parameters, and wherein the transformation parameters and the additional transformation parameters are two Gaussian distributions.

4. The method according to claim 3, wherein: The additional transform parameters are sampled to convert the image transform into a resolvable transform.

5. The method according to claim 1, wherein: The first neural network and the second neural network include convolutional layers or linear layers, and the third neural network is based on U-Net, Res-UNet or Enhanced Deep Residual Network (EDSR) network.

6. The method according to claim 1, wherein: Generating the proxy neural network includes: training the proxy neural network based on L1 loss.

7. The method according to claim 1, wherein: The input image includes a traffic image for assisting autonomous driving.

8. An apparatus for verifying a defense against image transformation, comprising: a proxy neural network composed of three separate neural networks for simulating the image transformation, wherein a first neural network is an encoder for transformation parameters, a second neural network is an encoder for an input image, a third neural network is a transformation network for outputs of the first neural network and the second neural network, and the transformation parameters are dimensionally enhanced and added to the proxy neural network, and The proxy neural network is used to verify the defense against the image transformation based on randomized smoothing.

9. The device of claim 8, wherein: The transform parameters are enhanced to a dimension equal to or greater than the sum of a dimension of the input image and a dimension of the transform parameters.

10. The device of claim 8, wherein: The enhanced transformation parameters include the transformation parameters and additional transformation parameters, and wherein the transformation parameters and the additional transformation parameters are two Gaussian distributions.

11. The device of claim 10, wherein: The additional transform parameters are sampled to convert the image transform into a resolvable transform.

12. The device of claim 8, wherein: The first neural network and the second neural network include convolutional layers or linear layers, and the third neural network is based on U-Net, Res-UNet or Enhanced Deep Residual Network (EDSR) network.

13. The device of claim 8, wherein: The proxy neural network is trained based on L1 loss.

14. The device of claim 8, wherein: The input image includes a traffic image for assisting autonomous driving.

15. An apparatus for verifying a defense against image transformation, comprising: Memory; as well as At least one processor coupled to the memory and configured to perform the method according to one of claims 1-7.

16. A computer readable medium storing computer code for verifying defenses against image transformations, which, when executed by a processor, causes the processor to perform the method according to one of claims 1-7.

17. A computer program product for verifying a defense against image transformation, comprising: Processor executable computer code for performing the method according to one of claims 1-7.

Images