System and method for deep equalization method of adversarial attacks for diffusion models

Abstract

Systems and methods for a deep equalization method of counteracting attacks for a diffusion model. A method for attacking a neural network includes receiving input data including an image and a base truth tag, adding a predetermined amount of noise to the image, denoising the noisy image using a diffusion model including a depth equalization root solver, determining a first gradient of the denoised image relative to the input data including at least the image, and applying a second gradient of the denoised image to the base truth tag. Wherein the first gradient is associated with a diffusion model, utilizing the de-noised image at the downstream model, outputting a prediction tag associated with the de-noised image, determining a loss utilizing the prediction tag and a base truth tag, determining a second gradient associated with the downstream model utilizing at least the loss, and outputting an aggregation gradient representing a neural network output error using the prediction tag, wherein the aggregation gradient is calculated using the first gradient and the second gradient.

Description

Technical Field

[0001] The present invention relates to machine learning, including embodiments involving models that may be subject to adversarial attacks. Background Art

[0002] Image classifiers are pre-programmed with a diffusion model to defend against Lp-norm adversarial attacks. The diffusion model involves an iterative noise-denoising process with a large number of steps. The generation of effective adversarial input images for testing the adversarial robustness of such a diffusion-classification pipeline relies on computing the exact gradients of the noise-denoising process, which is memory-prohibitive using backpropagation methods. In previous work, the authors computed the gradients by solving the adjoint problem using a stochastic differential equation (SDE) solver. Here, the authors claim that such an approach can approximate the actual gradients, and that adversarial perturbations generated from such gradients can lead to effective adversarial attacks on the diffusion model. They show that the diffusion model is robust against such adversarial attacks. However, the SDE solver may approximate the gradients inaccurately, thereby producing suboptimal adversarial perturbations, reducing the effectiveness of the adversarial attack, and overestimating the robustness of the diffusion model. Summary of the Invention

[0003] A first embodiment discloses a computer-implemented method for attacking a neural network, comprising receiving input data, wherein the input data comprises at least an image and a corresponding ground truth label, adding a predetermined amount of noise to the image to create a noisy image, denoising the noisy image using a diffusion model, the diffusion model comprising a deep equalization root solver configured to generate a denoised image, determining a first gradient of the denoised image relative to the input data comprising at least the image, wherein the first gradient is associated with the diffusion model, utilizing the denoised image at a downstream model of the neural network, outputting a predicted label associated with the denoised image, determining a loss using the predicted label and the ground truth label, determining a second gradient associated with the downstream model using at least the loss, and outputting an aggregated gradient representing an error in an output of the neural network using the predicted label, wherein the aggregated gradient is computed using at least the first gradient and the second gradient.

[0004] A second embodiment discloses a system comprising a controller configured to receive input data, wherein the input data comprises at least an image and a corresponding ground truth label, add noise to the image to create a noisy image, denoise the noisy image using a diffusion model including a deep equalization root solver, wherein the deep equalization root solver is configured to generate a denoised image, determine a first gradient of the denoised image, wherein the first gradient is associated with the diffusion model, utilize the denoised image at a downstream model of a neural network, output a predicted label associated with the denoised image, determine a loss using the predicted label and the ground truth label, determine at least a second gradient associated with the downstream model using the loss, and output an aggregated gradient representing an output error of the neural network using the predicted label, wherein the gradient is computed using at least the first gradient and the second gradient.

[0005] A third embodiment discloses a computer-implemented method for attacking a neural network, comprising receiving an image, adding a predetermined amount of noise to the image to create a noisy image, denoising the noisy image using a diffusion model, the diffusion model including a deep equalization root solver configured to generate the noisy image, determining a first gradient of the noisy image, wherein the first gradient is associated with the diffusion model, utilizing the noisy image in a downstream model of the neural network, outputting a predicted label associated with the denoised image, determining a loss using at least the predicted label, determining a second gradient associated with the downstream model using at least the loss, and outputting an aggregated gradient representing an output error of the neural network using the predicted label, wherein the gradient is computed using at least the first gradient and the second gradient. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 A system for training a neural network is shown according to one embodiment.

[0007] Figure 2 A computer-implemented method for training and utilizing a neural network is shown according to one embodiment.

[0008] Figure 3 An embodiment of a diffusion model used as an adversarial defense is shown.

[0009] Figure 4 An embodiment is shown in which at least a diffusion model is used to calculate the gradient.

[0010] Figure 5 Depicted is a schematic diagram of the interaction between a computer-controlled machine and a control system according to one embodiment.

[0011] Figure 6 Depicted is a diagram according to an embodiment Figure 5Schematic diagram of a control system configured to control a vehicle, which can be a partially autonomous vehicle, a fully autonomous vehicle, a partially autonomous robot, or a fully autonomous robot.

[0012] Figure 7 Depicts Figure 5 Schematic diagram of a control system configured to control a manufacturing machine (such as a punch cutter, a cutting machine, or a gun drill) of a manufacturing system (such as part of a production line).

[0013] Figure 8 Depicts Figure 5 Schematic diagram of a control system configured to control a power tool (such as a drill or driver) having an at least partially autonomous mode.

[0014] Figure 9 Depicts Figure 5 Schematic diagram of a control system configured to control an automated personal assistant.

[0015] Figure 10 Depicts Figure 5 Schematic diagram of a control system configured to control a monitoring system (such as a controlled access system or a surveillance system).

[0016] Figure 11 Depicts Figure 5 Schematic diagram of a control system configured to control an imaging system (eg, an MRI apparatus, an x-ray imaging apparatus, or an ultrasound apparatus). DETAILED DESCRIPTION

[0017] Embodiments of the present disclosure are described herein. However, it should be understood that the disclosed embodiments are merely examples, and other embodiments may take various and alternative forms. The figures are not necessarily to scale; some features may be enlarged or minimized to show details of particular components. Therefore, the specific structural and functional details disclosed herein should not be interpreted as limiting, but merely as a representative basis for teaching those skilled in the art to adopt the embodiments in various ways. As will be understood by those of ordinary skill in the art, the various features illustrated and described with reference to any one of the figures may be combined with the features illustrated in one or more other figures to produce embodiments that are not explicitly illustrated or described. The combination of illustrated features provides representative embodiments for typical applications. However, for specific applications or implementations, various combinations and modifications of features consistent with the teachings of the present disclosure may be desirable.

[0018] As used herein, "a," "an," and "the" refer to both singular and plural referents unless the context clearly dictates otherwise. As an example, a "processor" programmed to perform various functions refers to one processor programmed to perform each function, or more than one processor collectively programmed to perform each of the various functions.

[0019] Current systems may have errors when computing gradients through diffusion models using SDE solvers, and thus have an impact on the performance of adversarial attacks. Such systems may be able to make attacks more effective by using alternative methods that require approximating the gradients of a multi-step denoising process with the gradients of a denoising process with fewer but larger steps. In contrast, the advantage of our proposed method, as described below, is that such systems and methods can compute the gradients of the denoising process with more denoising steps, making adversarial attacks even more effective against diffusion models.

[0020] White-box attacks are a type of attack that has access to the internal parameters of a model and uses these parameters to find adversarial input perturbations, for example, perturbations that are constrained in norm and, when added to an input sample, maximize the error in the model's output for that particular sample. For white-box attacks to be effective, they require the exact gradient of the model's output with respect to the input.

[0021] In the case of attacking an image analysis pipeline that contains a diffusion model, for example, a diffusion model followed by an image classifier, one needs to obtain the gradients of the denoised diffusion probabilistic model (DDPM) classifier with respect to the input image. Typically, such gradients are computed by backpropagation through the computation graph - a feature available in any deep learning framework. However, since the DDPM-driven denoising process contains multiple (typically more than 50) steps, backpropagation through the entire chain of steps is extremely memory-intensive. During adversarial cleansing, the diffusion model first adds noise to the image sequentially in T steps, or adds equal amounts of noise at once. The denoising process consists of sequentially removing the noise added to the image in T steps. At each step t, the diffusion model estimates the noise added to the image at step t. As image x t function, and X t-1 Produced according to the following equation:

[0022]

[0023] The denoising process is repeated from t = T-1 until t = 0, producing x0 - a denoised image. While the denoising process can be shortened by using larger steps (as an example, using a step size of 1 in the equation above), and thus reducing the number of steps, it has been shown that this makes the adversarial purification process less robust. However, due to GPU memory constraints, normal backpropagation through a multi-step denoising sequence is not possible.

[0024] Diffusion models have recently been shown to achieve impressive results in improving the adversarial robustness of pre-trained image classifiers by “cleaning” adversarially perturbed images before feeding them to the classifier, outperforming adversarially trained models. They do this by first adding Gaussian noise to the image and then sequentially removing it in a multi-step process. The goal of this denoising process is to remove the adversarial perturbation along with the Gaussian noise, restoring the original image. To accurately estimate the robustness of this approach, one needs to obtain the full gradient of the classifier’s output with respect to the input image before passing it to the diffusion model. To compute these, one needs both the gradient of the classifier’s output with respect to the denoised image and the gradient of the denoised image with respect to the input image. While the first can be easily obtained through backpropagation through the classifier’s computational graph, the second is more difficult to obtain due to the multi-step nature of the denoising process, which makes backpropagation, despite its extremely memory-intensive nature, extremely expensive. Some systems can compute the gradient of the denoising process by solving an adjoint problem using a stochastic differential equation (SDE) solver, and have achieved very high robust accuracy with this approach. However, because this approach can potentially produce imprecise gradients, it is unclear whether the high robustness is due to the inherent robustness of the diffusion model or due to errors in the gradient computation. Existing systems propose an alternative method for computing gradients, where the gradients of a denoising process with fewer steps are used to approximate the gradients of a denoising process with a higher number of steps. This results in significantly lower robustness accuracy, indicating that the alternative method achieves more precise gradients that an adversary can use to more effectively attack the diffusion model.

[0025] In one embodiment, to compute the gradient of the denoised image with respect to the input image, the system can employ a deep balanced representation of a stochastic denoising diffusion implicit model (DEQ-sDDIM), which can reduce memory requirements, thereby allowing the system to use more denoising steps compared to a sequential denoising process. Although the gradient of the denoised image with respect to the original image computed in this way is an approximation, when compared to existing methods, the system can be shown to result in better performance in white-box adversarial attacks, including projected gradient descent (PGD) and automated attack methods. Utilizing such a system and method described below, it can also be used for adversarial training of diffusion models, resulting in models that are more robust to adversarial attacks.

[0026] The system can compute such gradients using the previously described Deep Equalization (DEQ) method with a diffusion model. Instead of denoising the image sequentially, the denoising process is rewritten as a fixed-point equation:

[0027]

[0028] or in vector form,

[0029]

[0030] where h(x t：T )=x t-1 is a function that performs one step of denoising. The above system of equations can be expressed as DEQ with xT injected as input. The system can simultaneously solve the roots of this system of equations using existing solvers (such as Anderson acceleration). Let Then the system may have

[0031]

[0032] The above equations describe the deterministic denoising process, for example, given an initial noisy image x T , the predicted denoised image x0 can be determined with certainty. The stochastic version of the denoising process involves adding additional noise at each denoising step and can also be implemented with DEQ using the following equation

[0033]

[0034] where ∈ 1：T ~N(0, I) represents the input injected noise.

[0035] To calculate the loss function L with respect to the input image x T The gradient of , can be approximated using the following:

[0036]

[0037] where M is Approximation - inverse Jacobian matrix g(x 0：T-1 , x T ). It has been shown that M = I, i.e., 1-step gradient, performs quite well. To further improve the accuracy of the gradient, gradients of > 1 step can be calculated, albeit at increased computational and memory cost. In addition, a damping factor T can be added for improved convergence, so that the final equation is as follows:

[0038]

[0039] For iin range(n_stcps):

[0040]

[0041] Reference is now made to the embodiments illustrated in the figures, which may apply these teachings to a machine learning model or neural network. Figure 1 A system 100 for training a neural network (e.g., a deep neural network) is shown. The system 100 may include an input interface for accessing training data 102 for the neural network. For example, Figure 1 As shown in FIG, the input interface can be constituted by a data storage interface 104 that can access the training data 102 from a data storage device 106. For example, the data storage interface 104 can be a memory interface or a persistent storage interface, such as a hard disk or SSD interface, but can also be a private, local or wide area network interface, such as a Bluetooth, Zigbee or Wi-Fi interface or an Ethernet or fiber optic interface. The data storage device 106 can be an internal data storage device of the system 100, such as a hard disk drive or SSD, but can also be an external data storage device, for example, a network accessible data storage device.

[0042] In some embodiments, data storage 106 may further include a data representation 108 of an untrained version of the neural network, which may be accessed by system 100 from data storage 106. However, it will be appreciated that training data 102 and data representation 108 of the untrained neural network may each be accessed from different data storages, for example, via different subsystems of data storage interface 104. Each subsystem may have a data storage interface 104 of the type described above. In other embodiments, data representation 108 of the untrained neural network may be generated internally by system 100 based on design parameters of the neural network and may therefore not be explicitly stored on data storage 106. System 100 may further include a processor subsystem 110 that may be configured to provide an iterative function during operation of system 100 as a replacement for a stack of neural network layers to be trained. Here, the corresponding layers of the replaced layer stack may have mutually shared weights and may receive as input the output of the previous layer, or, for the first layer of the layer stack, receive as input the initial activation and a portion of the input of the layer stack. The processor subsystem 110 may be further configured to iteratively train the neural network using the training data 102. Here, the training iterations of the processor subsystem 110 may include a forward propagation portion and a backward propagation portion. The processor subsystem 110 may be configured to perform the forward propagation portion by, in addition to defining other operations of the forward propagation portion that may be performed, determining an equilibrium point of the iterative function at which the iterative function converges to a fixed point, wherein determining the equilibrium point includes using a numerical root finding algorithm to find a root solution of the iterative function minus its input; and by providing the equilibrium point as a substitute for the output of the stack of layers in the neural network. The system 100 may further include an output interface for outputting a data representation 112 of the trained neural network, which data may also be referred to as trained model data 112. For example, as also Figure 1 , the output interface may consist of a data storage interface 104, which in these embodiments is an input / output ("IO") interface, via which trained model data 112 may be stored in a data storage device 106. For example, a data representation 108 defining an "untrained" neural network may be replaced, at least in part, with a data representation 112 of a trained neural network during or after training, as parameters of the neural network (such as weights, hyperparameters, and other types of parameters of the neural network) may be adapted to reflect the training on the training data 102. Figure 1, this is also illustrated by reference numerals 108, 112 referring to identical data records on the data storage device 106. In other embodiments, the data representation 112 may be stored separately from the data representation 108 defining the "untrained" neural network. In some embodiments, the output interface may be separate from the data storage interface 104, but may generally be of the type described above for the data storage interface 104.

[0043] The structure of system 100 is one example of a system that can be used to train the image-to-image machine learning models and mixer machine learning models described herein. Figure 2 Additional structures for operating and training machine learning models are shown in .

[0044] Figure 2 A system 200 is depicted that implements the machine learning models described herein (e.g., the image-to-image machine learning model, the mixer machine learning model, and the pre-trained reference model described herein). System 200 can be implemented to perform computational gradients using the depth equalization process described herein. System 200 can include at least one computing system 202. Computing system 202 can include at least one processor 204 operatively connected to a memory unit 208. Processor 204 can include one or more integrated circuits that implement the functionality of a central processing unit (CPU) 206. CPU 206 can be a commercially available processing unit that implements an instruction set such as one of the x86, ARM, Power, or MIPS instruction set families. During operation, CPU 206 can execute stored program instructions retrieved from memory unit 208. The stored program instructions can include software that controls the operation of CPU 206 to perform the operations described herein. In some examples, processor 204 can be a system-on-chip (SoC) that integrates the functionality of CPU 206, memory unit 208, network interface, and input / output interface into a single integrated device. The computing system 202 may implement an operating system for managing various aspects of operations. Figure 2 One processor 204, one CPU 206, and one memory 208 are shown, but of course more than one of each may be utilized in the overall system.

[0045] The memory unit 208 may include volatile memory and non-volatile memory for storing instructions and data. Non-volatile memory may include solid-state memory, such as NAND flash memory, magnetic and optical storage media, or any other suitable data storage device that retains data when the computing system 202 is deactivated or loses power. Volatile memory may include static and dynamic random access memory (RAM) that stores program instructions and data. For example, the memory unit 208 may store a machine learning model 210 or algorithm, a training data set 212 for the machine learning model 210, and an original source data set 216.

[0046] The computing system 202 may include a network interface device 222 configured to provide communication with external systems and devices. For example, the network interface device 222 may include a wired and / or wireless Ethernet interface as defined by the Institute of Electrical and Electronics Engineers (IEEE) 802.11 series of standards. The network interface device 222 may include a cellular communication interface for communicating with a cellular network (e.g., 3G, 4G, 5G). The network interface device 222 may further be configured to provide a communication interface to an external network 224 or the cloud.

[0047] External network 224 may be referred to as the World Wide Web or the Internet. External network 224 may establish standard communication protocols between computing devices. External network 224 may allow for easy exchange of information and data between computing devices and the network. One or more servers 230 may communicate with external network 224.

[0048] The computing system 202 may include an input / output (I / O) interface 220, which may be configured to provide digital and / or analog input and output. The I / O interface 220 is used to transfer information between internal storage devices and external input and / or output devices (e.g., HMI devices). The I / O interface 220 may include associated circuitry or a BUS network to transfer information to or between (one or more) processors and storage devices. For example, the I / O interface 220 may include digital I / O logic lines that can be read or set by (one or more) processors, handshake lines for supervising data transfer via the I / O lines, timing and counting facilities, and other known structures for providing such functionality. Examples of input devices include a keyboard, a mouse, sensors, etc. Examples of output devices include a monitor, a printer, a speaker, etc. The I / O interface 220 may include an additional serial interface (e.g., a universal serial bus (USB) interface) for communicating with external devices.

[0049] The computing system 202 may include a human-machine interface (HMI) device 218, which may include any device that enables the system 200 to receive control inputs. Examples of input devices may include human-machine interface inputs such as a keyboard, mouse, touch screen, voice input device, and other similar devices. The computing system 202 may include a display device 232. The computing system 202 may include hardware and software for outputting graphics and text information to the display device 232. The display device 232 may include an electronic display screen, a projector, a printer, or other suitable device for displaying information to a user or operator. The computing system 202 may further be configured to allow interaction with a remote HMI and a remote display device via a network interface device 222.

[0050] System 200 can be implemented using one or more computing systems. Although this example depicts a single computing system 202 that implements all described features, it is intended that various features and functions be separated and implemented by multiple computing units communicating with each other. The specific system architecture selected can depend on various factors.

[0051] The system 200 can implement a machine learning algorithm 210 configured to analyze a raw source data set 216. The raw source data set 216 can include raw or unprocessed sensor data that can represent an input data set for the machine learning system. The raw source data set 216 can include video, video segments, images, text-based information, audio or human speech, time series data (e.g., pressure sensor signals over time), and raw or partially processed sensor data (e.g., a radar map of an object). Figure 5-Figure 11 Several different examples of inputs are shown and described. In some examples, the machine learning algorithm 210 can be a neural network algorithm (e.g., a deep neural network) designed to perform a predetermined function. For example, a neural network algorithm can be configured in an automotive application to identify street signs or pedestrians in an image. The machine learning algorithm(s) 210 can include an image-to-image machine learning model, a mixer machine learning model, and a pre-trained reference model configured to operate as described herein.

[0052] The computer system 200 may store a training dataset 212 for the machine learning algorithm 210. The training dataset 212 may represent a previously constructed dataset for training the machine learning algorithm 210. The machine learning algorithm 210 may use the training dataset 212 to learn weighting factors associated with the neural network algorithm. The training dataset 212 may include a source dataset having corresponding achievements or results that the machine learning algorithm 210 attempts to replicate through the learning process. In this example, the training dataset 212 may include input images containing objects (e.g., street signs). The input images may include various scenes in which objects are identified.

[0053] The machine learning algorithm 210 can operate in a learning mode using the training dataset 212 as input. The machine learning algorithm 210 can be executed in multiple iterations using data from the training dataset 212. For each iteration, the machine learning algorithm 210 can update internal weighting factors based on the achieved results. For example, the machine learning algorithm 210 can compare the output results (e.g., a reconstructed or supplemented image if image data is input) with those included in the training dataset 212. Because the training dataset 212 includes expected results, the machine learning algorithm 210 can determine when the performance is acceptable. After the machine learning algorithm 210 reaches a predetermined performance level (e.g., 100% agreement with the results associated with the training dataset 212) or converges, the machine learning algorithm 210 can be executed using data not in the training dataset 212. It should be understood that in the present disclosure, "convergence" can mean that a set (e.g., predetermined) number of iterations have occurred, or that the residual is sufficiently small (e.g., the change in the approximation probability within an iteration changes by less than a threshold), or other convergence conditions. The trained machine learning algorithm 210 can be applied to a new dataset to generate annotated data.

[0054] The machine learning algorithm 210 can be configured to identify specific features in the raw source data 216. The raw source data 216 can include multiple instances or input data sets for which additional results are desired. For example, the machine learning algorithm 210 can be configured to identify the presence of road signs in a video image and annotate the occurrences. The machine learning algorithm 210 can be programmed to process the raw source data 216 to identify the presence of specific features. The machine learning algorithm 210 can be configured to identify features in the raw source data 216 as predetermined features (e.g., road signs). The raw source data 216 can be derived from various sources. For example, the raw source data 216 can be actual input data collected by the machine learning system. The raw source data 216 can be machine-generated for the purpose of testing the system. As an example, the raw source data 216 can include raw video images from a camera.

[0055] In one example, the raw source data 216 may include image data representing an image. Applying the machine learning algorithms described herein (e.g., image-to-image machine learning models, mixer machine learning models, and pre-trained reference models), the output may be a quantized version of the input image. Given the above description of the machine learning model, along with a system configured to implement the model Figure 1-2 Example of the structure.

[0056] Figure 3 A flow chart associated with the following embodiment is illustrated. In such an embodiment, a data set containing images to be predicted and their corresponding labels may be required. The system may include a neural network, which may include a diffusion model, followed by an image analysis model (e.g., an image classifier). At step 301, the system may receive an input image from the data set. The input image may include a corresponding label associated with the image. For example, if the image includes a picture of a lion, the data label associated with the image may state "lion."

[0057] At step 303, a predetermined amount of noise is generated. At step 305, noise is added to the image to generate a noisy image. The noisy image can be denoised using the DEQ-sDDIM formula. The denoised image is input into an image analysis model, which outputs a predicted label for the image. The amount of noise can be assigned and adjusted based on the network. Thus, more or less noise may be added to the image to create a noisy image. Noise may include static, shadows, color or lighting imbalances, etc.

[0058] At step 307, the noisy image (which includes the added image and noise) can be sent to a denoising diffusion probability model (DDPM). DDPM may be a type of generative model process. The system can calculate the gradient of the DDPM using DEQ. The processes involved in DDPM can be found in Figure 4 described in, and above.

[0059] At step 309, the output of the DDPM can be sent to a classifier of the neural network. The classifier can be associated with a downstream model of the neural network. The output of the DDPM can include calculated gradients. The calculated gradients can be used at the classifier to obtain a predicted class.

[0060] At step 311, the predicted class can be output by the classifier. The predicted class of the denoised image can attempt to identify the class of the image. The image label (ground truth) can be used to calculate an appropriate differentiable loss function that represents the error of the model output. An approximate gradient of the loss function with respect to the input image can be calculated. The parameters n steps and τ are used to control the accuracy of the gradient portion corresponding to image denoising. The gradient can be calculated using a backpropagation algorithm.

[0061] The computed gradient can be used to determine an adversarial perturbation ε, such as a perturbation bounded by a chosen norm, such as ||ε|| p ≤a, p=1, 2..., a∈R + , which maximizes the loss function. Adversarial examples can be used to test the robustness of a particular diffusion model + image analysis model pipeline by computing its performance on adversarially perturbed images, or to train either or both components of the pipeline to be more robust against adversarial attacks.

[0062] Figure 4 A flowchart for calculating DDPM gradients using DEQ is shown. At 401, the system may include an image x. The image may include corresponding labels and noise added before being applied to the DDPM model. The image may be of any type, including audio, video, photographic, sonar, lidar, radar, and the like. The image may be collected via various sensors that communicate with the machine learning model.

[0063] At step 403, the system can simultaneously solve the roots of the system of equations using an existing solver (such as Anderson accelerator). Then the system may have

[0064]

[0065] Such an equation can illustrate the deterministic denoising process, for example, given an initial noisy image x T , the predicted denoised image x0 can be determined with certainty. The stochastic version of the denoising process involves adding additional noise at each denoising step and can also be implemented with DEQ using the following equation

[0066]

[0067] Where ∈1: T~N(0,I) represents the input injection noise.

[0068] At step 405, the system can calculate the loss associated with the denoised image. The loss can be determined using the ground truth labels (if applicable) and predicted labels associated with the denoised image. If the ground truth labels are not available, the predicted labels may be sufficient to calculate the loss.

[0069] At step 407, the system can calculate the gradient using Equation 2. To calculate the loss function L with respect to the input image x T The gradient of , can be approximated using the following:

[0070]

[0071] where M is Approximation - inverse Jacobian matrix g(x 0：T-1, x T ). It has been shown that M = I, i.e., 1-step gradient, performs quite well. To further improve the accuracy of the gradient, gradients of > 1 step can be calculated, albeit at increased computational and memory cost. In addition, a damping factor T can be added for improved convergence, so that the final equation is as follows:

[0072]

[0073] For i in range(n_steps):

[0074]

[0075] At step 409, aggregated gradients are output. Gradients may be output in response to the aggregated gradient outputs from both the downstream model and the diffusion model alone. Thus, the output of the denoising process (e.g., a denoised image) may be calculated using Equation 2. The aggregated gradients may be used to determine adversarial perturbations of both models (relative to the diffusion model alone or the downstream model), such as perturbations defined by a selected norm that maximizes the loss function. The number of iterations may be predetermined, or a value may be set. Adversarial examples may be used to test the robustness of a particular diffusion model that may be used with a particular image analysis model.

[0076] Figure 5 A schematic diagram depicting the interaction between a computer-controlled machine 500 and a control system 502 is shown. The computer-controlled machine 500 includes an actuator 504 and a sensor 506. The actuator 504 may include one or more actuators, and the sensor 506 may include one or more sensors. The sensor 506 is configured to sense a condition of the computer-controlled machine 500. The sensor 506 may be configured to encode the sensed condition into a sensor signal 508 and transmit the sensor signal 508 to the control system 502. Non-limiting examples of the sensor 506 include video, radar, lidar, ultrasonic, and motion sensors. In one embodiment, the sensor 506 is an optical sensor configured to sense an optical image of an environment proximate to the computer-controlled machine 500.

[0077] The control system 502 is configured to receive sensor signals 508 from the computer-controlled machine 500. As explained below, the control system 502 may be further configured to calculate actuator control commands 510 depending on the sensor signals and transmit the actuator control commands 510 to the actuators 504 of the computer-controlled machine 500.

[0078] like Figure 5As shown in FIG, control system 502 includes a receiving unit 512. Receiving unit 512 can be configured to receive sensor signals 508 from sensor 506 and transform sensor signals 508 into input signals x. In an alternative embodiment, sensor signals 508 are received directly as input signals x without receiving unit 512. Each input signal x can be a portion of each sensor signal 508. Receiving unit 512 can be configured to process each sensor signal 508 to generate each input signal x. Input signal x can include data corresponding to an image recorded by sensor 506.

[0079] The control system 502 includes a classifier 514. The classifier 514 can be configured to classify an input signal x into one or more labels using a machine learning (ML) algorithm, such as the neural network described above. The classifier 514 is configured to be parameterized by parameters, such as those described above (e.g., parameter θ). The parameter θ can be stored in and provided by a non-volatile storage device 516. The classifier 514 is configured to determine output signals y from the input signals x. Each output signal y includes information assigning one or more labels to each input signal x. The classifier 514 can transmit the output signals y to a conversion unit 518. The conversion unit 518 is configured to convert the output signals y into actuator control commands 510. The control system 502 is configured to transmit the actuator control commands 510 to the actuator 504, which is configured to actuate the computer-controlled machine 500 in response to the actuator control commands 510. In another embodiment, the actuator 504 is configured to actuate the computer-controlled machine 500 directly based on the output signal y.

[0080] When the actuator 504 receives the actuator control command 510, the actuator 504 is configured to perform an action corresponding to the associated actuator control command 510. The actuator 504 may include control logic configured to transform the actuator control command 510 into a second actuator control command for controlling the actuator 504. In one or more embodiments, the actuator control command 510 may be used to control a display instead of or in addition to an actuator.

[0081] In another embodiment, the control system 502 includes the sensor 506 instead of or in addition to the computer-controlled machine 500 including the sensor 506. The control system 502 may also include the actuator 504 instead of or in addition to the computer-controlled machine 500 including the actuator 504.

[0082] like Figure 5As shown in , the control system 502 also includes a processor 520 and a memory 522. The processor 520 may include one or more processors. The memory 522 may include one or more memory devices. The classifier 514 of one or more embodiments (e.g., a machine learning algorithm, such as those described above with respect to the pre-trained classifier 306) may be implemented by the control system 502, which includes the non-volatile storage device 516, the processor 520, and the memory 522.

[0083] The non-volatile storage 516 may include one or more persistent data storage devices such as a hard drive, an optical drive, a tape drive, a non-volatile solid-state device, a cloud storage device, or any other device capable of persistently storing information. The processor 520 may include one or more devices selected from a high-performance computing (HPC) system, including a high-performance core, a microprocessor, a microcontroller, a digital signal processor, a microcomputer, a central processing unit, a field programmable gate array, a programmable logic device, a state machine, a logic circuit, an analog circuit, a digital circuit, or any other device that manipulates signals (analog or digital) based on computer-executable instructions residing in the memory 522. The memory 522 may include a single memory device or multiple memory devices, including but not limited to random access memory (RAM), volatile memory, non-volatile memory, static random access memory (SRAM), dynamic random access memory (DRAM), flash memory, cache memory, or any other device capable of storing information.

[0084] The processor 520 can be configured to read into the memory 522 and execute computer-executable instructions resident in the non-volatile storage 516 and embodying one or more ML algorithms and / or methods of one or more embodiments. The non-volatile storage 516 can include one or more operating systems and applications. The non-volatile storage 516 can store computer programs created using various programming languages and / or technologies, including but not limited to Java, C, C++, C#, Objective C, Fortran, Pascal, JavaScript, Python, Perl, and PL / SQL, alone or in combination.

[0085] When executed by the processor 520, the computer-executable instructions of the non-volatile storage device 516 may cause the control system 502 to implement one or more of the ML algorithms and / or methods disclosed herein. The non-volatile storage device 516 may also include ML data (including data parameters) that supports the functions, features, and processes of one or more embodiments described herein.

[0086] The program code embodying the algorithms and / or methods described herein can be distributed individually or collectively as a program product in a variety of different forms. The program code can be distributed using a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to implement aspects of one or more embodiments. Computer-readable storage media that are inherently non-transitory can include volatile and non-volatile, removable and non-removable tangible media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. The computer-readable storage medium can further include RAM, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other solid-state memory technology, portable compact disk read-only memory (CD-ROM) or other optical storage devices, cassettes, magnetic tape, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to store the desired information and can be read by a computer. The computer-readable program instructions can be downloaded from the computer-readable storage medium to a computer, another type of programmable data processing device, or another device via a network, or downloaded to an external computer or external storage device.

[0087] The computer-readable program instructions stored in a computer-readable medium can be used to guide a computer, other types of programmable data processing devices, or other devices to operate in a specific manner so that the instructions stored in the computer-readable medium produce an article of manufacture, including instructions that implement the functions, actions, and / or operations specified in the flowchart or diagram. In certain alternative embodiments, the functions, actions, and / or operations specified in the flowchart and diagram can be reordered, processed serially, and / or processed in parallel in accordance with one or more embodiments. In addition, any of the flowcharts and / or diagrams may include more or fewer nodes or boxes than those illustrated in accordance with one or more embodiments.

[0088] A process, method, or algorithm may be embodied in whole or in part using suitable hardware components (such as application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), state machines, controllers, or other hardware components or devices), or a combination of hardware, software, and firmware components.

[0089] Figure 6A schematic diagram of a control system 502 configured to control a vehicle 600, which may be an at least partially autonomous vehicle or an at least partially autonomous robot, is depicted. Vehicle 600 includes actuators 504 and sensors 506. Sensors 506 may include one or more video sensors, cameras, radar sensors, ultrasonic sensors, lidar sensors, and / or location sensors (e.g., GPS). One or more of the one or more specific sensors may be integrated into vehicle 600. In the context of landmark recognition and processing as described herein, sensor 506 is a camera mounted to or integrated into vehicle 600. Alternatively or in addition to one or more of the specific sensors identified above, sensor 506 may include a software module that, when executed, is configured to determine the state of actuator 504. One non-limiting example of a software module includes a weather information software module configured to determine the current or future state of the weather near vehicle 600 or other location.

[0090] The classifier 514 of the control system 502 of the vehicle 600 can be configured to detect objects near the vehicle 600 based on the input signal X. In such an embodiment, the output signal y can include information characterizing the objects near the vehicle 600. The actuator control command 510 can be determined based on this information. The actuator control command 510 can be used to avoid a collision with the detected object.

[0091] In embodiments where vehicle 600 is at least partially autonomous, actuator 504 may be embodied in the brakes, propulsion system, engine, drive train, or steering of vehicle 600. Actuator control commands 510 may be determined such that actuator 504 is controlled so that vehicle 600 avoids colliding with a detected object. Detected objects may also be classified based on what classifier 514 deems them most likely to be, such as a pedestrian or a tree. Depending on the classification, actuator control commands 510 may be determined. In scenarios where adversarial attacks may occur, the system described above may be further trained to better detect objects or identify changes in lighting conditions or angles of the sensors or cameras on vehicle 600.

[0092] In other embodiments where the vehicle 600 is an at least partially autonomous robot, the vehicle 600 may be a mobile robot configured to perform one or more functions, such as flying, swimming, diving, and walking. The mobile robot may be an at least partially autonomous lawn mower or an at least partially autonomous cleaning robot. In such embodiments, actuator control commands 510 may be determined such that a propulsion unit, a steering unit, and / or a braking unit of the mobile robot may be controlled so that the mobile robot can avoid a collision with the identified object.

[0093] In another embodiment, vehicle 600 is an at least partially autonomous robot in the form of a gardening robot. In such an embodiment, vehicle 600 can use an optical sensor as sensor 506 to determine the state of plants in the environment near vehicle 600. Actuator 504 can be a nozzle configured to spray a chemical. Depending on the identified species and / or identified state of the plant, actuator control commands 510 can be determined to cause actuator 504 to spray the plant with the appropriate amount of the appropriate chemical.

[0094] Vehicle 600 may be an at least partially autonomous robot in the form of a household appliance. Non-limiting examples of household appliances include a washing machine, stove, oven, microwave, or dishwasher. In such a vehicle 600, sensor 506 may be an optical sensor configured to detect the state of an object to be processed by the household appliance. For example, if the household appliance is a washing machine, sensor 506 may detect the state of the laundry inside the washing machine. Actuator control commands 510 may be determined based on the detected laundry state.

[0095] Figure 7 A schematic diagram depicts a control system 502 configured to control a system 700 (e.g., a manufacturing machine) of a manufacturing system 702 (e.g., a portion of a production line), such as a punch cutter, a cutting machine, or a gun drill. The control system 502 can be configured to control an actuator 504 configured to control the system 700 (e.g., a manufacturing machine).

[0096] The sensor 506 of the system 700 (e.g., a manufacturing machine) can be an optical sensor configured to capture one or more properties of the manufactured product 704. The classifier 514 can be configured to determine a state of the manufactured product 704 from the one or more captured properties. The actuator 504 can be configured to control the system 700 (e.g., a manufacturing machine) for subsequent manufacturing steps of the manufactured product 704 depending on the determined state of the manufactured product 704. The actuator 504 can be configured to control the function of the system 700 (e.g., a manufacturing machine) on the subsequent manufactured product 706 of the system 700 (e.g., a manufacturing machine) depending on the determined state of the manufactured product 704.

[0097] Figure 8 A schematic diagram of a control system 502 configured to control a power tool 800 (such as a drill or driver) having at least a partially autonomous mode is depicted. The control system 502 may be configured to control an actuator 504 configured to control the power tool 800.

[0098] The sensor 506 of the power tool 800 can be an optical sensor configured to capture one or more properties of the work surface 802 and / or the fastener 804 being driven into the work surface 802. The classifier 514 can be configured to determine the state of the work surface 802 and / or the state of the fastener 804 relative to the work surface 802 from the one or more captured properties. The state can be whether the fastener 804 is flush with the work surface 802. Alternatively, the state can be the hardness of the work surface 802. The actuator 504 can be configured to control the power tool 800 so that the driving function of the power tool 800 is adjusted depending on the determined state of the fastener 804 relative to the work surface 802 or the one or more captured properties of the work surface 802. For example, if the state of the fastener 804 is flush with the work surface 802, the actuator 504 may no longer continue the driving function. As another non-limiting example, the actuator 504 may apply additional or less torque depending on the hardness of the work surface 802.

[0099] Figure 9 Depicted is a schematic diagram of a control system 502 configured to control an automated personal assistant 900. The control system 502 may be configured to control an actuator 504, which is configured to control the automated personal assistant 900. The automated personal assistant 900 may be configured to control a household appliance, such as a washing machine, stove, oven, microwave, or dishwasher.

[0100] Sensor 506 may be an optical sensor and / or an audio sensor. The optical sensor may be configured to receive a video image of gesture 904 of user 902. The audio sensor may be configured to receive a voice command of user 902.

[0101] Control system 502 of automated personal assistant 900 can be configured to determine actuator control commands 510 configured for control system 502. Control system 502 can be configured to determine actuator control commands 510 based on sensor signals 508 from sensor 506. Automated personal assistant 900 is configured to transmit sensor signals 508 to control system 502. Classifier 514 of control system 502 can be configured to execute a gesture recognition algorithm to identify gesture 904 performed by user 902, determine actuator control commands 510, and transmit actuator control commands 510 to actuator 504. Classifier 514 can be configured to retrieve information from non-volatile storage in response to gesture 904 and output the retrieved information in a form suitable for receipt by user 902.

[0102] Figure 10A schematic diagram of a control system 502 configured to control a monitoring system 1000 is depicted. Monitoring system 1000 can be configured to physically control access through door 1002. Sensor 506 can be configured to detect a scene relevant to determining whether access is authorized. Sensor 506 can be an optical sensor configured to generate and transmit image and / or video data. Control system 502 can use such data to detect a person's face.

[0103] The classifier 514 of the control system 502 of the monitoring system 1000 can be configured to interpret the image and / or video data by matching it with the identities of known individuals stored in the non-volatile storage device 516 to determine the identity of the individual. The classifier 514 can be configured to generate an actuator control command 510 in response to the interpretation of the image and / or video data. The control system 502 is configured to transmit the actuator control command 510 to the actuator 504. In this embodiment, the actuator 504 can be configured to lock or unlock the door 1002 in response to the actuator control command 510. In other embodiments, non-physical logical access control is also possible.

[0104] The monitoring system 1000 can also be a surveillance system. In such an embodiment, the sensor 506 can be an optical sensor configured to detect a scene under surveillance, and the control system 502 is configured to control the display 1004. The classifier 514 is configured to determine the classification of the scene, for example, whether the scene detected by the sensor 506 is suspicious. The control system 502 is configured to: transmit the actuator control command 510 to the display 1004 in response to the classification. The display 1004 can be configured to adjust the content of the display in response to the actuator control command 510. For example, the display 1004 can highlight an object that the classifier 514 considers suspicious. Using embodiments of the disclosed system, the surveillance system can predict the appearance of an object at a specific time in the future.

[0105] Figure 11 A schematic diagram of a control system 502 is depicted, which is configured to control an imaging system 1100, such as an MRI device, an x-ray imaging device, or an ultrasound device. For example, sensor 506 can be an imaging sensor. Classifier 514 can be configured to determine a classification of all or a portion of a sensed image. Classifier 514 can be configured to determine or select actuator control commands 510 in response to the classification obtained by a trained neural network. For example, classifier 514 can interpret an area of a sensed image as potentially abnormal. In this case, actuator control commands 510 can be determined or selected to cause display 1102 to display the image and highlight the potentially abnormal area.

[0106] Although exemplary embodiments have been described above, it is not intended that these embodiments describe all possible forms encompassed by the claims. The words used in this specification are descriptive, not restrictive, and it should be understood that various changes can be made without departing from the spirit and scope of the present disclosure. As previously described, the features of the various embodiments can be combined to form additional embodiments of the present invention, which may not be explicitly described or illustrated. Although various embodiments may have been described as providing advantages or being superior to other embodiments or prior art implementations with respect to one or more desired characteristics, those skilled in the art recognize that one or more features or characteristics can be compromised to achieve the desired overall system properties, depending on the specific application and implementation. These properties may include, but are not limited to, cost, strength, durability, life cycle cost, marketability, appearance, packaging, size, applicability, weight, manufacturability, ease of assembly, etc. As such, to the extent that any embodiment is described as being less desirable than other embodiments or prior art implementations with respect to one or more characteristics, these embodiments are not outside the scope of this disclosure and may be desirable for a specific application.

Claims

1. A computer-implemented method for attacking a neural network, comprising: receiving input data, wherein the input data comprises at least an image and a corresponding ground truth label; adding a predetermined amount of noise to the image to create a noisy image; denoising the noisy image using a diffusion model, the diffusion model comprising a deep equalization root solver configured to generate a denoised image; determining a first gradient of the denoised image relative to input data comprising at least the image, wherein the first gradient is associated with a diffusion model; Utilizing the denoised image at a downstream model of the neural network to output a predicted label associated with the denoised image; Determine the loss using the predicted labels and the ground truth labels; determining, using at least the loss, a second gradient associated with a downstream model; and The predicted label output represents an aggregated gradient of an output error of the neural network, wherein the aggregated gradient is calculated using at least a first gradient and a second gradient. 2 . The computer-implemented method of claim 1 , wherein the diffusion model comprises a denoised diffusion implicit model.

3. The computer-implemented method of claim 1 , wherein the first gradient is determined by an iterative denoising process without backpropagation. The computer-implemented method of claim 1 , wherein denoising is not performed sequentially via a diffusion model. The computer-implemented method of claim 1 , wherein a damping factor is utilized in calculating the first gradient. The computer-implemented method of claim 5 , wherein convergence is improved in response to increasing the damping factor.

7. The computer-implemented method of claim 1 , wherein: Compute the first gradient. The computer-implemented method of claim 1 , wherein back-propagation is utilized to determine the aggregate gradient.

9. The computer-implemented method of claim 1 , wherein the downstream model of the neural network is a pre-trained model.

10. The computer-implemented method of claim 1, wherein the input data comprises at least an image and a corresponding label.

11. A system comprising: The controller is configured as: receiving input data, wherein the input data comprises at least an image and a corresponding ground truth label; Add noise to an image to create a noisy image; denoising the noisy image using a diffusion model, the diffusion model comprising a deep equalization root solver configured to generate a denoised image; determining a first gradient of the denoised image, wherein the first gradient is associated with a diffusion model; Utilizing the denoised image at a downstream model of the neural network to output a predicted label associated with the denoised image; Determine the loss using the predicted labels and the ground truth labels; determining, using at least the loss, a second gradient associated with a downstream model; and The predicted label output represents an aggregated gradient of an output error of the neural network, wherein the gradient is calculated using at least a first gradient and a second gradient. 12 . The system according to claim 11 , wherein the image comprises at least video data, picture data or sound data.

13. The system of claim 11, wherein the deep equalization root solver utilizes Anderson acceleration to generate a denoised image.

14. The system of claim 11, wherein the aggregated gradient is used to generate one or more adversarial examples at a neural network, the adversarial examples maximizing a loss function of the neural network.

15. The system of claim 11, wherein a damping factor is used to determine the first gradient.

16. A computer-implemented method for attacking a neural network, comprising: receiving an image; adding a predetermined amount of noise to the image to create a noisy image; denoising the noisy image using a diffusion model, the diffusion model comprising a deep equalization root solver configured to generate a denoised image; determining a first gradient of the denoised image, wherein the first gradient is associated with a diffusion model; Utilizing the denoised image at a downstream model of the neural network to output a predicted label associated with the denoised image; At least use the predicted labels to determine the loss; determining, using at least the loss, a second gradient associated with a downstream model; and The predicted label output represents an aggregated gradient of an output error of the neural network, wherein the gradient is calculated using at least a first gradient and a second gradient.

17. The method of claim 16, wherein the deep equalization root solver utilizes Anderson acceleration to generate a denoised image.

18. The method of claim 16, wherein the aggregated gradient is used to generate one or more adversarial examples at a neural network, the adversarial examples maximizing a loss function of the neural network.

19. The method of claim 16, wherein the downstream model of the neural network is an untrained model.

20. The method of claim 16, wherein denoising the noisy image comprises utilizing a stochastic method that adds additional noise at each denoising step.

Images