Method and electronic device for data processing by neural network(s) with improved resistance to adversarial attacks by gradient approximation, computer program and associated electronic object processing system(s)
By employing multiple, independently trained AI blocks and selecting one for inference based on a calculated code, the method improves neural network robustness against adversarial attacks without compromising performance.
Patent Information
- Application Number
- FR2022002821
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2022-03-29
- Publication Date
- 2026-02-20
- Estimated Expiration
- 2042-03-29
AI Technical Summary
Neural networks are vulnerable to adversarial attacks that exploit small variations in input, and existing methods to improve robustness often compromise performance.
Implement a data processing method using a plurality of distinct artificial intelligence blocks within an algorithm, where each block is trained independently or through ensemble learning, and select a single block for inference based on a calculated code, ensuring the selection is secret and varies with each data point.
Enhances robustness against adversarial attacks by making gradient approximation less accurate and reliable, while maintaining performance.
Smart Images
Figure 00000027_0000 
Figure 00000028_0000 
Figure 00000029_0000
Abstract
Description
Title of the invention: Method and electronic device for processing data by neural network(s) with improved resistance to adversarial attacks by gradient approximation, computer program and associated electronic object processing system(s)
[0001] The present invention relates to a data processing method implemented by an electronic processing device, as well as such an electronic data processing device.
[0002] The invention also relates to an electronic object processing system, comprising a sensor, such as an image sensor, a sound sensor or an object detection sensor; and such an electronic processing device, each data to be processed being a signal from the sensor.
[0003] The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement such a processing method.
[0004] The invention then relates to the field of neural networks, that is to say artificial neural networks, or ANNs (from the English Artificial Neural Network) known in themselves, and in particular to the inference of such networks, that is to say to their implementation, each inferred neural network having been previously trained with training data, also called learning data, that is to say having been the subject of prior training with such learning data.
[0005] The invention then offers various applications, such as the classification or identification of objects previously detected by a sensor, allowing for example to recognize or classify the identities of people whose face has been detected by a face detector, or to recognize or classify surrounding objects detected by a sensor on board an autonomous vehicle, the recognition or classification of such objects being important for the autonomous driving of such a vehicle.
[0006] Other applications relate to the sound processing of signals from sound sensors, in particular for speech recognition.
[0007] The invention relates in particular to applications related to biometric security, such as voice identification, facial identification, fingerprint identification, application of robustness to camouflage for aerial image analysis, etc.
[0008] Neural networks are sensitive to small variations in input. Adversarial attacks can exploit this vulnerability to generate inputs capable of deceiving neural networks, while remaining indistinguishable from the original human inputs. Robustness to adversarial attacks is therefore an important aspect of an artificial intelligence algorithm incorporating a neural network.
[0009] Since neural networks are inherently differentiable to allow learning by backpropagation of the gradient, they are inherently vulnerable to adversarial attacks. Even without knowledge of the network parameters, it is possible to numerically estimate the gradient to construct an attack.
[0010] So far, in the face of such adverse attacks, known methods seek to improve the robustness of the network during its learning, and the article "Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey" by Silva et al, published in 2020, presents such methods.
[0011] However, these methods remain quite vulnerable to attacks based on the numerical approximation of the gradient, and also have the disadvantage that the gain in robustness is generally achieved at the cost of performance.
[0012] The aim of the invention is then to propose a method for processing data(s), and an associated electronic processing device, making it possible to offer better robustness to adversarial attacks based on an estimation of the gradient to try to deceive an artificial intelligence algorithm comprising a neural network.
[0013] To this end, the invention relates to a data processing method, implemented by an electronic processing device and comprising the following steps:
[0014] - data acquisition;
[0015] - data processing via the inference of an artificial intelligence algorithm, previously trained during a prior training session,
[0016] the artificial intelligence algorithm comprising a plurality of distinct artificial intelligence blocks, each having been previously trained during the pre-training, and
[0017] The process further comprises, prior to the treatment step, the following steps:
[0018] - calculation of a code from the acquired data;
[0019] - selection, based on the calculated code, of a block from among the plurality of blocks artificial intelligence,
[0020] the processing step then being carried out via inference, among the plurality of artificial intelligence blocks, of the single selected artificial intelligence block,
[0021] the plurality of artificial intelligence blocks being a plurality of artificial neural networks or a plurality of processing layers within an artificial neural network.
[0022] With the processing method according to the invention, the artificial intelligence algorithm comprises several distinct blocks of artificial intelligence, and for the processing of each respective data via the inference of the artificial intelligence algorithm, only one block among the plurality of artificial intelligence blocks is inferred, the inferred block being selected according to the code calculated from the acquired data, i.e. the respective data to be processed.
[0023] This selection of the block used for inference from among the plurality of artificial intelligence blocks included in the artificial intelligence algorithm is then carried out in a secret manner, that is, unknown to a potential adversary attack. Furthermore, the block selected for inference is likely to vary from one data point to another.
[0024] Also, an adversarial attack seeking to perform a trial-and-error approximation of the gradient of the artificial intelligence algorithm will implement, during these successive trials, different blocks of artificial intelligence from among the plurality of artificial intelligence blocks included in the artificial intelligence algorithm, and the resulting approximation of the gradient will then be significantly less accurate and less reliable.
[0025] Thus, the treatment process according to the invention offers better robustness to adversarial attacks based on an approximation of the gradient.
[0026] According to other advantageous aspects of the invention, the treatment process comprises one or more of the following features, taken individually or in all technically possible combinations:
[0027] - during the calculation step, the code is a hash, calculated by applying a function hashing of the acquired data;
[0028] - the hash function is a cryptographic hash function;
[0029] the hash function being preferably chosen from the group consisting of: a SHA function (from the English Secure Hash Algorithm such as the SHA-256 function or the SHA-515 function; and the MD5 function (from the English Message Digest 5);
[0030] - the calculated code is a number; and during the selection step, an operation of truncation to a distribution of K elements is applied to the computed code, and the selected artificial intelligence block is the one whose identifier is equal to the result of applying the truncation operation; K representing the number of distinct artificial intelligence blocks and being an integer greater than or equal to 2,
[0031] the truncation operation being further applied to the integer part of the calculated code, if the calculated code is not an integer;
[0032] the truncation operation being preferably an operation truncating any uniform distribution to a uniform distribution of K elements;
[0033] the truncation operation being preferably still a modulo K operation;
[0034] - during the preliminary training, each block of artificial intelligence was pre- trained independently of the other artificial intelligence block(s);
[0035] - during the preliminary training, the plurality of artificial intelligence blocks was previously trained via an ensemble learning method with a common objective for the plurality of artificial intelligence blocks;
[0036] the ensemble learning method being preferably chosen from the group consisting of: an adverse ensemble learning method, an ensemble learning method with promotion of a diversity of network predictions, an ensemble learning method with promotion of a diversity of networks via a regularization on the gradients of the input data;
[0037] - each artificial intelligence block is distinct from the other block(s) of the plurality of artificial intelligence blocks due to the use of a distinct initialization method from one block to another, during prior training;
[0038] each initialization method being preferably chosen from the group consisting of: a uniform Xavier initialization method, and a uniform Kaiming initialization method;
[0039] - each artificial intelligence block is distinct from the other block(s) of the plurality of artificial intelligence blocks through the use of a distinct cost function during pre-training;
[0040] each respective cost function being preferably chosen from the group consisting of: a cross-entropy cost function; a Gaussian mixture cost function; and a maximum Mahalanobolis cost function;
[0041] - each artificial intelligence block is distinct from the other block(s) of the plurality of artificial intelligence blocks through the use of a distinct training method during the initial training;
[0042] each respective training method being preferably chosen from the group consisting of: an opponent learning method; a method based on certified defenses; and a method based on a regularization approach;
[0043] - each block of artificial intelligence has a topology based on a mechanism learning with backpropagation of the gradient, distinct from the respective topology of the other block(s) of the plurality of artificial intelligence blocks;
[0044] each topology being preferably chosen from the group consisting of: a topology based on a convolution mechanism, a topology based on an attention mechanism, a topology based on a recurrence mechanism;
[0045] - the number K of artificial intelligence blocks is greater than or equal to 3;
[0046] the number K of artificial intelligence blocks preferably being between 3 and 5;
[0047] - each acquired data corresponds to a signal captured by a sensor;
[0048] each acquired data being preferably an image, and the sensor then being an image sensor(s).
[0049] The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement a processing method as defined above.
[0050] The invention also relates to an electronic data processing device, comprising:
[0051] - an acquisition module configured to acquire data;
[0052] - a processing module configured to process data via the inference of an algorithm artificial intelligence algorithm, previously trained during a preliminary training session,
[0053] the artificial intelligence algorithm comprising a plurality of distinct artificial intelligence blocks, each having been previously trained during the pre-training, and
[0054] The device further comprises:
[0055] - a calculation module configured to calculate a code from the acquired data;
[0056] - a selection module configured to select, based on the calculated code, a block among the plurality of artificial intelligence blocks,
[0057] the processing module being then configured to process the data via inference, among the plurality of artificial intelligence blocks, of the single selected artificial intelligence block,
[0058] the plurality of artificial intelligence blocks being a plurality of artificial neural networks or a plurality of processing layers within an artificial neural network.
[0059] The invention also relates to an electronic object processing system, the system comprising a sensor, such as a motion sensor, a sound sensor or an object detection sensor, and an electronic data processing device connected to the sensor, the electronic processing device being as defined above, and each data being a signal from the sensor.
[0060] These features and advantages of the invention will become clearer upon reading the following description, given solely by way of non-limiting example, and made with reference to the accompanying drawings, in which:
[0061] [Fig-1] [Fig.1] is a schematic representation of an electronic system of object processing according to the invention, comprising a sensor and an electronic data processing device connected to the sensor, the processing device comprising a module for acquiring at least one data point, a processing module for each data point via the inference of an artificial intelligence algorithm with a plurality of distinct artificial intelligence blocks, each having been previously trained, a module for calculating a code from each respective acquired data, and a module for selecting, based on the calculated code, a block from among the plurality of artificial intelligence blocks;
[0062] [Fig.2] [Fig.2] is a partial schematic representation of the electrical device processing electronics of the [Fig.1], according to a first embodiment in which the plurality of artificial intelligence blocks is a plurality of artificial neural networks;
[0063] [Fig.3] [Fig.3] is a view analogous to that of [Fig.2], according to a second mode implementation in which the plurality of artificial intelligence blocks is a plurality of processing layers within an artificial neural network;
[0064] [Fig.4] [Fig.4] is a flowchart of a data processing method according to the invention, the process being implemented by the electronic processing device of the [Fig. 1]; and
[0065] [Fig. 5] [Fig. 5] is a view illustrating the behavior of the electronic device of processing of [Fig.2] when two slightly different images are successively provided to it for processing.
[0066] In the present description, unless otherwise specified, the expressions "approximately", "about", "approximately" and "in the order of" define a relationship of equality to plus or minus 10%, preferably to plus or minus 5%.
[0067] In the present description, the terms "learning" and "training" are considered equivalent, that is to say, they have the same meaning, and are therefore used interchangeably.
[0068] In [Fig.1], an electronic object processing system 10 is configured to process one or more objects, not shown.
[0069] The electronic processing system 10 includes a sensor 15 capable of capturing at least one object and an electronic processing device 20 connected to the sensor 15, the processing device 20 being configured to process at least one data 18 from the sensor 15, such as an image, visible in Figures 2, 3 and 5.
[0070] The electronic processing system 10 is for example an electronic object detection system, the sensor 15 then being an object detector and the processing device 20 being configured to process at least one data relating to the object detected by the object detector.
[0071] The electronic processing system 10 forms, for example, a face detector capable of recognizing the faces of previously identified persons and / or detecting the faces of unknown persons, that is to say, faces of persons who have not been previously identified. The processing device 20 then makes it possible to learn the identities of the detected persons, and also to identify persons unknowns.
[0072] The electronic processing system 10 is also capable of recognizing objects in the environment of a motor vehicle when it is installed on board such a vehicle, in particular an autonomous vehicle. The processing device 20 then makes it possible to process such objects, and in particular to classify them by type, in order to facilitate the piloting of the autonomous vehicle.
[0073] Alternatively, the electronic processing system 10 is an electronic image segmentation system, the sensor 15 then being an image sensor and the processing device 20 being configured to perform a segmentation of each image from the image sensor.
[0074] The sensor 15 is known in itself. The sensor 15 is, for example, an object detector configured to detect one or more objects, or a motion sensor configured to take one or more images of a scene and transmit them to the processing device 20.
[0075] Alternatively, the sensor 15 is a sound sensor, an object detection sensor, such as a lidar sensor, a radar sensor, an infrared sensor, a capacitive proximity sensor, an inductive proximity sensor, a Hall effect proximity sensor or a presence sensor, configured to acquire a characteristic signal depending on the presence or absence of object(s), and then to transmit it to the processing device 20.
[0076] The processing device 20 includes a module 22 for acquiring at least one data 18 and a module 24 for processing each data 18 via the inference of an artificial intelligence algorithm 26 comprising a plurality of distinct artificial intelligence blocks 28, visible in figures 2, 3 and 5, each having been previously trained.
[0077] The processing device 20 further includes a module 30 for calculating a code from each respective acquired data 18, and a module 32 for selecting, according to the calculated code, a block 28 from among the plurality of artificial intelligence blocks 28, the processing module 24 then processing the data 18 via inference, from among the plurality of artificial intelligence blocks 28, the only artificial intelligence block 28 selected.
[0078] The electronic processing device 20 is, for example, in the form of a calculator.
[0079] The processing device 20 is then typically configured to interpret a scene captured by the sensor 15, that is to say to identify and / or to recognize a type of one or more elements - such as people or physical objects - present in the captured scene and corresponding to the signal or signals captured by the sensor 15.
[0080] In the example of [Fig. 1], the electronic processing device 20 comprises an information processing unit 40 formed for example of a memory 42 and a processor 44 associated with the memory 42.
[0081] In the example of [Fig.1], the acquisition module 22, the processing module 24, the calculation module 30 and the selection module 32 are each implemented as software, or a software block, executable by the processor 44. The memory 42 of the electronic processing device 20 is then capable of storing software for acquiring the data 18 to be processed, software for processing the data 18 via the inference of the artificial intelligence algorithm 26, software for calculating the code from the acquired data 18 and software for selecting, based on the calculated code, a block 28 from among the plurality of artificial intelligence blocks 28, the processing software then processing the data 18 via inference, from among the plurality of artificial intelligence blocks 28, the only artificial intelligence block 28 selected.The processor 44 is then capable of running each of the following software programs: acquisition software, processing software, calculation software, and selection software.
[0082] In an alternative, not shown, the acquisition module 22, the processing module 24, the calculation module 30 and the selection module 32 are each made in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array) or in the form of a dedicated integrated circuit, such as an ASIC (Application Specified Integrated Circuit).
[0083] When the electronic processing device 20 is implemented in the form of one or more software programs, i.e., in the form of a computer program, it is also capable of being stored on a computer-readable medium (not shown). The computer-readable medium is, for example, a medium capable of storing electronic instructions and being connected to a bus of a computer system. For example, the readable medium is an optical disc, a magneto-optical disc, a ROM, a RAM, any type of non-volatile memory (e.g., EPROM, EEPROM, FLASH, NVRAM), a magnetic card, or an optical card. A computer program comprising software instructions is then stored on the readable medium.
[0084] The acquisition module 22 is configured to acquire the or each data 18.
[0085] The acquisition module 22 is specifically configured to acquire the or each data 18 from sensor 15, corresponding to an object previously captured by said sensor 15. In other words, each acquired data 18 then corresponds to a signal captured by sensor 15. Each acquired data 18 is preferably an image, sensor 15 then being a sensor of image(s).
[0086] The processing module 24 is configured to process the data or each data 18 via the inference of the artificial intelligence algorithm 26, previously trained.
[0087] The processing module 24 is specifically configured to process the data 18 via the inference, among the plurality of artificial intelligence blocks 28, of the single artificial intelligence block 28 selected, following the calculation of the respective code by the calculation module 30, and the subsequent selection, by the selection module 32 and according to the calculated code, of such a single block 28 among the plurality of artificial intelligence blocks 28 within the artificial intelligence algorithm 26.
[0088] The artificial intelligence algorithm 26 is previously trained from training data, during a training, also called learning, prior to inference. Such training is known per se.
[0089] The artificial intelligence algorithm 26 comprises the plurality of artificial intelligence blocks 28, each artificial intelligence block 28 being distinct, or disjoint, from the other artificial intelligence blocks 28 contained in the artificial intelligence algorithm 26.
[0090] During the prior training of the artificial intelligence algorithm 26, each artificial intelligence block 28 was, for example, trained independently of said or said other artificial intelligence blocks 28. In other words, the learning of each respective artificial intelligence block 28 is carried out independently, that is to say separately, from the learning of each of said or said other artificial intelligence blocks 28.
[0091] Alternatively, during the prior training of the artificial intelligence algorithm 26, the plurality of artificial intelligence blocks 28 was trained via an ensemble learning method with a common objective for the plurality of artificial intelligence blocks 28.
[0092] According to this variant, the ensemble learning method is, for example, chosen from the group consisting of: an adversarial ensemble learning method, an ensemble learning method promoting network prediction diversity, and an ensemble learning method promoting network diversity via regularization on the gradients of the input data. The adversarial ensemble learning method is described in the article "Ensemble adversarial training: Attacks and defenses" by Tramer et al., published in 2018. The ensemble learning method promoting network prediction diversity is described in the article "Improving adversarial robustness via promoting ensemble diversity" by Pang et al., published in 2019.The ensemble learning method with promotion of network diversity via regularization on the gradients of the input data is described in the article "Adversarial Defence by Diversified Simultaneous Training of Deep Ensembles" by Huang et al, published in 2021.
[0093] The artificial intelligence algorithm 26 is typically an algorithm based on artificial neural network(s) 50.
[0094] The number of blocks 28 within the plurality of artificial intelligence blocks 28 is denoted K, and the artificial intelligence algorithm 26 then comprises K artificial intelligence blocks 28. The number K of artificial intelligence blocks is for example greater than or equal to 3, and preferably between 3 and 5.
[0095] According to a first embodiment, shown in [Fig. 2], the plurality of artificial intelligence blocks 28 is a plurality of artificial neural networks 50, distinct from one another. In other words, according to this first embodiment, each artificial intelligence block 28 is a respective network 50 of artificial neurons.
[0096] According to this first embodiment, the artificial intelligence algorithm 26 is preferably made up of said plurality of artificial neural networks 50, and each artificial neural network 50 is disjoint from the other artificial neural network(s) 50 within the artificial intelligence algorithm 26.
[0097] In the example of [Fig.2], the artificial intelligence algorithm 26 comprises three distinct networks 50 of artificial neurons, namely a first neural network 50A, a second neural network 50B and a third neural network 50C.
[0098] According to a second embodiment, represented in [Fig.3], the plurality of artificial intelligence blocks is a plurality of processing layers 55 within the same network 50 of artificial neurons, that is to say within a single neural network 50, the processing layers 55 being distinct from one another within said neural network 50. In other words, according to this second embodiment, each artificial intelligence block 28 is a respective processing layer 55 within this neural network 50.
[0099] According to this second embodiment, the artificial intelligence algorithm 26 includes this neural network 50 itself comprising said plurality of distinct processing layers 55. According to this second embodiment, the artificial intelligence algorithm 26 preferably consists of said neural network 50 comprising the plurality of processing layers 55, the neural network 50 then being unique.
[0100] In the example of [Fig.3], the neural network 50 comprises an input layer 60, connected at the input of several intermediate layers 62 arranged in parallel with each other, these intermediate layers 62 being themselves each connected at the input of an output layer 64. In other words, in this example of [Fig.3], the neural network 50 comprises the input layer 60, followed by the intermediate layers 62 in parallel with each other, themselves followed by the output layer 64.
[0101] In this example, the plurality of processing layers 55 then corresponds to the plurality of intermediate layers 62. In the example of [Fig. 3], the algorithm Artificial intelligence 26 then comprises three distinct processing layers 55, namely a first intermediate layer 62A, a second intermediate layer 62B and a third intermediate layer 62C.
[0102] Each artificial intelligence block 28 is, for example, distinct from the other block(s) of the plurality of artificial intelligence blocks 28 by the use of a distinct initialization method from one block to another, during the prior training.
[0103] Each initialization method is, for example, chosen from the group consisting of: a uniform Xavier initialization method, and a uniform Kaiming initialization method. Each initialization method is also capable of generating distributions with slight variations, which then form different initializations for each of the artificial intelligence blocks 28. Each initialization method is a method for initializing the synaptic weights of the artificial intelligence algorithm 26, and in particular of each artificial intelligence block 28. The uniform Xavier and uniform Kaiming initialization methods are known per se, and each of these initialization methods follows a uniform distribution, as their name indicates.
[0104] Alternatively or in addition, each artificial intelligence block 28 is distinct from the other block(s) 28 of the plurality of artificial intelligence blocks by the use of a distinct cost function during the pre-training.
[0105] Each respective cost function is for example chosen from the group consisting of: a cross-entropy cost function; a Gaussian mixture cost function; and a maximum Mahalanobolis cost function.
[0106] The cross-entropy cost function satisfies, for example, the following equation:
[0107] [Math.l] CEL{z - y} =-' og €^
[0108] with
[0109] [Math.2] z = block(x)
[0110] where CEL represents the cross-entropy cost function;
[0111] z represents an output vector, at the output of the respective artificial intelligence block 28 during the inference of said block 28 with an input x;
[0112] y represents a class associated with the input x; and
[0113] c represents a class index varying between 1 and C, where C is the number of classes.
[0114] The cost function of the Gaussian mixture satisfies, for example, the following equation:
[0115] [Math.3] GML(-, y) = - + 4 U+4 / ogKI exp{-dc) \
[0116] nwn A — f- UA ÜVCC Clc — ~ \^~RC) l^vl +
[0117] where GML represents the cost function of the Gaussian mixture;
[0118] z represents an output vector, at the output of the respective artificial intelligence block 28 during the inference of said block with an input x, according to the preceding equation (2);
[0119] y represents a class associated with the input x;
[0120] c represents a class index varying between 1 and C, where C is the number of classes;
[0121] pc represents a center of the Gaussian associated with the class of index c; and
[0122] Ac represents a variance of the Gaussian associated with the index class c.
[0123] The maximum Mahalanobolis cost function satisfies, for example, the following equation:
[0124] [Math.4] MMC || z-fi,11^
[0125] where MMC represents the maximum Mahalanobolis cost function;
[0126] z represents an output vector, at the output of the respective artificial intelligence block 28 during the inference of said block with an input x, according to the preceding equation (2);
[0127] y represents a class associated with the input x; and
[0128] py represents a center of the Gaussian associated with the class y.
[0129] Alternatively or in addition, each artificial intelligence block 28 is distinct from the other block(s) 28 of the plurality of artificial intelligence blocks by the use of a distinct training method during the prior training.
[0130] Each respective training method is for example chosen from the group consisting of: an opponent learning method; a method based on certified defenses; and a method based on a regularization approach.
[0131] The adversarial learning method, the method based on certified defenses, and the method based on a regularization approach are each known in themselves, and are described for example respectively in parts 2.3.1, 2.3.2 and 2.3.3 of the aforementioned article “Opportunities and Challenges in Deep Learning Adversarial Ro-bustness: A Survey” by Silva et al, published in 2020.
[0132] Alternatively or in addition, each artificial intelligence block 28 has a topology based on a learning mechanism with backpropagation of the gradient, distinct from the respective topology of the other block(s) 28 of the plurality of artificial intelligence blocks.
[0133] Each topology is for example chosen from the group consisting of: a topology based on a convolution mechanism, a topology based on an attention mechanism, a topology based on a recurrence mechanism.
[0134] A topology based on a convolution mechanism is, for example, a Resnet topology, a MobileNet topology, or an EfficientNet topology.
[0135] The topology based on an attention mechanism is for example a Transformer topology or a Linear Transformer topology.
[0136] A topology based on a recurrence mechanism is, for example, an LSTM topology (from the English Long Short Terni Memory), a GRU topology (from the English Gated Recurrent Unit), or a FastGRNN topology (from the English Fast, Accurate, Stable and Tiny Gated Recurrent Neural Network).
[0137] The calculation module 30 is configured to calculate the respective code from the acquired data 18, the calculated code then being associated with said data 18.
[0138] The calculation mode 30 is for example configured to calculate said code by applying a hash function to the acquired data 18, the calculated code then being a hash.
[0139] A person skilled in the art will observe that the calculated code is not necessarily unique.
[0140] The hash function is preferably a cryptographic hash function. A cryptographic hash function is known in itself and is a hash function that associates a fixed-size image to a piece of data of arbitrary size. An important property of such a hash function is that it is difficult, if not impossible, to reverse. In particular, while the image of a piece of data by the cryptographic hash function coupled with a private key is easily computed, the inverse computation of an input piece of data whose image is a certain value proves difficult, if not impossible. Another important property is that the same image will always be associated with a piece of data by the hash function. A person skilled in the art will understand that this property aims to prevent an attacker from thwarting the innovation by targeting one of the neural blocks.
[0141] The cryptographic hash function is for example chosen from the group consisting of: a SHA function (from the English Secure Hash Algorithm), such as the SHA-256 function or the SHA-512 function; and the MD5 function (from the English Message Digest 5).
[0142] The selection module 32 is configured to select, according to the code calculated by the calculation module 30, a respective block 28 from among the plurality of artificial intelligence blocks 28 included in the artificial intelligence algorithm 26. The processing module 24 is then configured to process the data 18 via inference, from among the plurality of said artificial intelligence blocks 28, the only selected block 28.
[0143] The selection module 32 is, for example, configured to select this block 28 by applying to the calculated code a truncation operation towards a distribution of K elements, where said code is a number, and where K represents the number of distinct AI blocks 28 included in the AI algorithm 26, K then being an integer greater than or equal to 2.
[0144] According to this example, each of the artificial intelligence blocks 28 is associated with a unique identifier, and the selection module 32 is configured to select the artificial intelligence block 28 whose identifier corresponds to, or is equal to, the result of applying the truncation operation K.
[0145] In addition, the selection module 32 is configured to select said block 28 by applying the truncation operation to the integer part of the calculated code, if the calculated code is not an integer.
[0146] The truncation operation to a distribution of K elements is typically an operation truncating any uniform distribution to a uniform distribution of K elements;
[0147] The truncation operation is for example a modulo K operation, such as a modulo K operation applied to the code converted into an integer, such as to the code interpreted as uint8, that is to say interpreted as an unsigned integer on 8 bits; or such as a modulo K operation applied to the sum of the bits of the code, represented in binary form.
[0148] The operation of the electronic processing device 20 according to the invention will now be described with reference to [Fig.4] representing a flowchart of the processing method according to the invention, the latter being implemented by the processing device 20.
[0149] In the example of [Fig.4], an initial phase 100 of learning the artificial intelligence algorithm 26, and in particular each of the plurality of distinct artificial intelligence blocks 28, precedes an inference phase 150 in which the previously trained artificial intelligence algorithm 26 is used to calculate output values, in order to process, in particular to classify, i.e. categorize, the data or data 18.
[0150] As described previously, during this learning phase 100, each of the artificial intelligence blocks 28 is, for example, trained independently of the other artificial intelligence block(s) 28, or alternatively the plurality of artificial intelligence blocks 28 is trained via the ensemble learning method with a common objective for the plurality of artificial intelligence blocks 28.
[0151] The learning phase 100 is known per se, and is preferably implemented by a computer, this learning phase 100 being typically carried out by a software module, not shown.
[0152] The subsequent inference phase 150 is, for its part, implemented by the processing device 20, for example in the form of a computer, and more specifically by the acquisition module 22, then the calculation module 30, followed by the selection module 32 and finally the processing module 24.
[0153] The processing method corresponds more particularly to the reference phase 150, and includes an initial step 200 during which each data 18 to be processed is acquired by the processing device 20, and in particular by its acquisition module 22. In the case of multiple data 18 to be processed, these are preferably acquired successively, one after the other.
[0154] At the end of the acquisition step 200, the process proceeds to a step 210 during which the processing device 20 calculates, via its calculation module 30, a respective code for each data 18 acquired.
[0155] Each code is for example calculated by applying the cryptographic hash function to the acquired data 18.
[0156] Following the calculation step 210, the processing method proceeds to a step 220 in which the processing device 20 selects, via its selection module 32, a respective block 28 from among the plurality of artificial intelligence blocks 28 included in the artificial intelligence algorithm 26, this selection being made according to the code calculated during the preceding calculation step 210. This selection therefore depends on the calculated code.
[0157] The person skilled in the art will then understand that, during this selection step 220, the selection module 32 selects a single block 28 from among the plurality of artificial intelligence blocks 28 that comprise the artificial intelligence algorithm 26.
[0158] When the plurality of artificial intelligence blocks 28 is the plurality of artificial neural networks 50 according to the first embodiment, the selection module 32 then selects a respective neural network 50 from among the plurality of neural networks 50 included in the artificial intelligence algorithm 26.
[0159] Similarly, when the plurality of artificial intelligence blocks 28 is the plurality of processing layers 55 within the same artificial neural network 50, according to the second embodiment, the selection module 32 then selects a respective processing layer 55 from among the plurality of processing layers 55 included in the artificial intelligence algorithm 26, and in particular in said artificial neural network 50.
[0160] This selection of block 28 is, for example, performed by applying the truncation operation to the distribution of K elements, such as the modulo K operation, to the calculated code; or even to the integer part of the calculated code, if the calculated code is not an integer. The selected block 28, i.e., the selected network 50 according to the first embodiment or the selected processing layer 55 according to the second embodiment, is then the one whose identifier corresponds to the result of applying the truncation operation, such as the modulo K operation.
[0161] At the end of the selection step 220, the processing process finally moves to a step 230 in which the processing device 20 processes the data 18, via its processing module 24 and the inference of the artificial intelligence algorithm 26, previously trained during the initial learning phase 100.
[0162] During the processing step 230, according to the invention, the processing module 24 processes the data 18 by then performing the inference, among the plurality of artificial intelligence blocks 28, of the single artificial intelligence block 28 selected during the previous selection step 220.
[0163] According to the first embodiment, the processing of the data 18 is then carried out via the inference of the only selected neural network 50, the other neural network(s) 50 of the artificial intelligence algorithm 26, which were not selected during said selection step 220, not being implemented during the processing step 230.
[0164] In the example of [Fig.5], for a first data 18, corresponding to a traffic sign, such as an 80 km / h speed limit sign, to which a perturbation ô is added, the neural network 50 selected during the selection step 220 is the third neural network 50C, and the first data 18 is then processed by inferring the third neural network 50C during the subsequent processing step 230, as shown in the upper part of [Fig.5].
[0165] In this example of [Fig.5], for a second data 18, corresponding to the traffic sign, such as an 80 km / h speed limit sign, from which the perturbation ô is subtracted, the neural network 50 selected during the selection step 220 is the first neural network 50A, and the second data 18 is then processed by inferring the first neural network 50A during the subsequent processing step 230, as shown in the lower part of [Fig.5].
[0166] According to the second embodiment, the processing of the data 18 is then carried out via the inference of the selected processing layer 55, the other processing layer(s) 55 which were not selected during said selection step 220, not being implemented during the processing step 230.
[0167] According to this second embodiment, those skilled in the art will understand that the selection of said processing layer 55 during the selection step 220 does not, however, preclude the implementation of processing layers of the neural network 50, other than those of the plurality of processing layers 55 considered for said selection. Moreover, the layers of the neural network 50, other than those of the plurality of processing layers 55 considered for said selection, are preferably implemented during the processing of the data 18 via the inference of the artificial intelligence algorithm 26.
[0168] By way of example, with an example analogous to that of [Fig. 5] and considering the neural network 50 of [Fig.3], for the first data 18, corresponding to a traffic sign, such as an 80 km / h speed limit sign, to which is added a perturbation ô, the processing layer 55 selected during the selection step 220 is the third intermediate layer 62C, and the first data 18 is then processed by successively inferring the input layer 60, then the selected processing layer 55, namely the third intermediate layer 62C, and finally the output layer 64.
[0169] According to this example, for the second data 18, corresponding to the traffic sign, such as an 80 km / h speed limit sign, from which the disturbance ô is subtracted, the processing layer 55 selected during the selection step 220 is the first intermediate layer 62A, and the second data 18 is then processed by successively inferring the input layer 60, then the selected processing layer 55, namely the first intermediate layer 62A, and finally the output layer 64.
[0170] At the end of the processing step 230, the processing method returns to the initial acquisition step 200 to acquire new data 18 for processing.
[0171] This selection of the block 28 used for inference from among the plurality of artificial intelligence blocks 28 included in the artificial intelligence algorithm 26 is carried out in a secret manner, i.e., unknown to a potential adversary attack. Furthermore, the block 28 selected for inference is likely to vary from one data point to another.
[0172] Also, an adversarial attack seeking to perform a trial approximation of the gradient of the artificial intelligence algorithm 26 will implement, during these successive trials, different blocks 28 of artificial intelligence from among the plurality of artificial intelligence blocks, which will distort the numerical approximation of the gradient of the artificial intelligence algorithm 26 that the adversarial attack seeks to perform.
[0173] This use of different artificial intelligence blocks 28 during successive trials with successive data 18 is illustrated in [Fig.5], where for the first data 18 corresponding to an image, such as the signpost, to which the perturbation ô is added, it is for example the third block, such as the third neural network 50C, which is selected, then inferred to process this first data, while for the second data 18 corresponding to this image from which the perturbation ô is subtracted, it is for example the first block, such as the first neural network 50A, which is selected, then inferred to process this second data 18.
[0174] Thus, the treatment process according to the invention offers better robustness to Adversarial attacks are based on an approximation of the gradient. This improvement in robustness is further illustrated using various results obtained, as presented below.
[0175] Table 1 below shows the results obtained in terms of processing accuracy rate, typically in terms of classification accuracy rate, with a prior art processing method in which the artificial intelligence algorithm was trained using the cross-entropy loss cost function, also denoted CEL, with an indication of the initial accuracy, as well as the accuracy following a simultaneous perturbation gradient approximation attack, also denoted SPSA, and according to the number of images used for said attack. For this Table 1, the SPSA attack was performed with 10 iterations and an epsilon parameter equal to 8 / 255.In general, the SPSA attacks presented later were conducted in a "non-targeted" manner, meaning that they only seek to deceive the prediction of data processing via inference, without seeking to deceive the true class by a target class determined as input to the attack (which would then be described as a "targeted" attack).
[0176] Table 1 shows that the processing accuracy rate with the prior art method drops significantly following such an attack, even for a relatively small number of images used during the attack. The accuracy rate is almost divided by three for 10 images during the attack, and this accuracy rate decreases even further as the number of images used during the attack increases.
[0177] [Tables] State of the art - CEL - Initial accuracy = 72.7% Number of images per attack Accuracy following SPSA attack (10 iterations, epsilon = 8 / 255) 10 26.4% 128 10.6% 1024 9.8%
[0178] Table 2 below shows the results obtained under identical circumstances to those used for Table 1, with this time the processing method according to the invention where the artificial intelligence algorithm 26 comprises three distinct neural networks 50, previously learned from a different initialization method for each artificial intelligence block 28 and with the CEL cost function.
[0179] Table 2 shows that the accuracy rate of treatment with the process according to the invention falls much less rapidly following the SPSA attack; and that the accuracy rate obtained with the process according to the invention is generally substantially double, or even more, than that of the prior art process, following said attack.
[0180] [Tables2] Invention (3 networks) - CEL - Initial accuracy = 73.4% Number of gradient approximations per attack iteration Accuracy following SPSA attack (10 iterations, epsilon = 8 / 255) 10 52.2% 128 32.8% 1024 17.8%
[0181] Table 3 below relates to the prior art processing method, and is analogous to Table 1 presented above, and aims to show the evolution of the accuracy rate when the number of iterations implemented to perform the SPSA attack increases, Table 3 then showing the results obtained for 10 iterations as in the case of Table 1, then for 20, 50 and respectively 100 iterations.
[0182] [Tables3] State of the art - CEL - Initial accuracy = 72.7% Number of gradient approximations per attack iteration Accuracy following SPSA attack (epsilon = 8 / 255) 10 iterations 20 iterations 50 iterations 100 iterations 10 26.4% 16.1% 10.5% 9.7% 128 10.6% 9.8% 9.7% 9.7% 1024 9.8% 9.7% 9.7% 9.6%
[0183] Table 4 below shows the results obtained under identical circumstances to those used for Table 3, using the processing method according to the invention where the artificial intelligence algorithm 26 comprises three distinct neural networks 50, previously learned with the cost function CEL.
[0184] This table 4 shows again that the processing accuracy rate with the process according to the invention falls much less rapidly following the attack.
[0185] By comparing the results obtained in Tables 3 and 4, a person skilled in the art It will then be observed that the accuracy rates obtained with the process according to the invention are systematically much better than those obtained with the prior art process, the latter sometimes being almost three times better.
[0186] [Tables4] Invention (3 networks) - CEL - Initial accuracy = 73.4% Number of gradient approximations per attack iteration Accuracy following SPSA attack (epsilon = 8 / 255) 10 iterations 20 iterations 50 iterations 100 iterations 10 52.2% 45.8% 37.5% 33.7% 128 32.8% 23.4% 17% 15.8% 1024 17.8% 13.9% 11.5% 10.8%
[0187] Table 5 below shows the results obtained under circumstances analogous to those used for Table 4, with the processing method according to the invention where the artificial intelligence algorithm 26 comprises three distinct neural networks 50, with the difference that the three neural networks 50 are further learned with distinct cost functions from one neural network 50 to another, one neural network 50 having been learned with the CEL cost function, another neural network 50 having been learned with the Gaussian Mixture Loss cost function, also denoted GML, and the last neural network 50 having been learned with the Max Mahalanobolis Center cost function.
[0188] This Table 5 shows that the processing accuracy rate with the method according to the invention falls even less rapidly following the SPSA attack, the results obtained according to this Table 5 with the use of distinct cost functions from one neural network 50 to another during training being indeed better than those obtained according to Table 4 above.
[0189] [Tables5] Invention (3 networks) - CEL / GML / MMC - Initial accuracy = 73.2% Number of gradient approximations per attack iteration Accuracy following SPSA attack (epsilon = 8 / 255) 10 iterations 20 iterations 50 iterations 100 iterations 10 58.5% 55.8% 52.8% 50.5% 128 54.4% 49.9% 47% 45.3% 1024 48.5% 45% 41.9% 41%
[0190] Table 6 below shows the results obtained with the processing method according to the invention in the case of the SPSA attack with 10 iterations and a parameter epsilon equal to 8 / 255, depending on the number of images used for said attack, and furthermore varying, from one column of Table 6 to another, the number of distinct neural networks 50 contained in the artificial intelligence algorithm 26.
[0191] Table 6 shows again that the results obtained with the processing method according to the invention are much better than those obtained with the prior art method. Those skilled in the art will also observe that increasing the number of neural networks 50 included in the artificial intelligence algorithm 26 does not significantly improve the results obtained when the number of neural networks increases from three to four and finally to five. In this example, the number of neural networks 50 will therefore preferably be set at three.
[0192] [Tableauxô] Invention Number of gradient approximations per attack iteration Accuracy following SPSA attack (10 iterations, epsilon = 8 / 255) 3 networks - Initial CEL = 73.4% 4 networks - Initial CEL = 73.4% 5 networks - Initial CEL = 73.1% 10 52.2% 54.1% 55.6% 128 32.8% 37.3% 39% 1024 17.8% 20.7% 22.3%
[0193] Table 7 below shows the results obtained under identical circumstances to those used for Table 4 above, with the treatment process according to the invention differs in that the artificial intelligence algorithm 26 here comprises four distinct neural networks 50.
[0194] This table 7 confirms the small influence on the results obtained when increasing the number of neural networks 50 included in the artificial intelligence algorithm 26.
[0195] [Tables?] Invention (4 networks) - CEL - Initial accuracy = 73.4% Number of gradient approximations per attack iteration Accuracy following SPSA attack (epsilon = 8 / 255) 10 iterations 20 iterations 50 iterations 100 iterations 10 54.1% 49.4% 42% 38% 128 37.3% 28% 20% 17.8% 1024 20.7% 15.7% 12.7% 11.6%
[0196] Table 8 below shows the results obtained under identical circumstances to those used for Tables 4 and 7 above, with the processing method according to the invention, except that the artificial intelligence algorithm 26 here comprises five distinct neural networks 50. This Table 8 again confirms the small influence of increasing the number of neural networks 50.
[0197] [Tables8] Invention (5 networks) - CEL - Initial accuracy = 73.1% Number of gradient approximations per attack iteration Accuracy following SPSA attack (epsilon = 8 / 255) 10 iterations 20 iterations 50 iterations 100 iterations 10 55.6% 51.3% 44.3% 41% 128 39% 30.5% 22.3% 19.1% 1024 22.3% 16.8% 12.8% 12%
[0198] It is thus understood that the processing method according to the invention, and the associated electronic processing device 20, make it possible to offer better robustness to adversarial attacks based on an estimation of the gradient.
Claims
Demands
1. A data processing method (18), implemented by an electronic processing device (20) and comprising the following steps: - acquisition (200) of a data point (18), each acquired data point (18) corresponding to a signal captured by a sensor (15); - processing (230) of the data point (18) via the inference of an artificial intelligence algorithm (26), previously trained during a pre-training session (100), characterized in that the artificial intelligence algorithm (26) comprises a plurality of distinct artificial intelligence blocks (28), each having been previously trained during the pre-training session, and in that the method further comprises, prior to the processing step (230), the following steps: - calculation (210) of a code from the acquired data point (18); the code being a hash, calculated by applying a hash function to the acquired data point (18);- selection (220), according to the calculated code, of a block (28) from among the plurality of artificial intelligence blocks (28), the processing step (230) then being carried out via inference, from among the plurality of artificial intelligence blocks (28), of the only artificial intelligence block (28) selected, the plurality of artificial intelligence blocks (28) being a plurality of artificial neural networks (50) or a plurality of processing layers (55) within an artificial neural network (50).;
2. A method according to claim 1, wherein the hash function is a cryptographic hash function; the hash function preferably being chosen from the group consisting of: a SHA function, such as the SHA-256 function or the SHA-515 function; and the MD5 function.
3. A method according to any one of the preceding claims, wherein the computed code is a number; and during the selection step (220), a truncation operation to a distribution of K elements is applied to the computed code, and the selected artificial intelligence block (28) is the one whose identifier is equal to the result of applying the truncation operation; K representing the number of distinct artificial intelligence blocks (28) and being then an integer greater than or equal to 2, the truncation operation being further applied to the integer part of the computed code, if the computed code is not an integer; the truncation operation being preferably an operation truncating any uniform distribution to a uniform distribution of K elements; the truncation operation being preferably still an operation modulo K.
4. A method according to any one of the preceding claims, wherein, during pre-training (100), each artificial intelligence block (28) was pre-trained independently of the other artificial intelligence block(s) (28).
5. A method according to any one of claims 1 to 3, wherein, during pre-training (100), the plurality of artificial intelligence blocks (28) has been pre-trained via an ensemble learning method with a common objective for the plurality of artificial intelligence blocks (28); the ensemble learning method preferably being chosen from the group consisting of: an adversarial ensemble learning method, an ensemble learning method with promotion of network prediction diversity, an ensemble learning method with promotion of network diversity via regularization on the gradients of the input data.
6. A method according to any one of the preceding claims, wherein each artificial intelligence block (28) is distinct from the other block(s) of the plurality of artificial intelligence blocks (28) by the use of a distinct initialization method from one block to another, during the pre-training (100); each initialization method being preferably chosen from the group consisting of: a uniform Xavier initialization method, and a uniform Kaiming initialization method.
7. A method according to any one of the preceding claims, wherein each artificial intelligence block (28) is distinct from the other block(s) of the plurality of artificial intelligence blocks (28) by the use of a distinct cost function during pre-training (100); each respective cost function preferably being chosen from the group consisting of: a cross-entropy cost function; a Gaussian mixture cost function; and a Maha- cost function maximum lanobilis.
8. A method according to any one of the preceding claims, wherein each artificial intelligence block (28) is distinct from the other block(s) of the plurality of artificial intelligence blocks (28) by the use of a distinct training method during the pre-training (100); each respective training method being preferably chosen from the group consisting of: an adversarial learning method; a method based on certified defenses; and a method based on a regularization approach.
9. A method according to any one of the preceding claims, wherein each artificial intelligence block (28) has a topology based on a learning mechanism with backpropagation of the gradient, distinct from the respective topology of the other block(s) in the plurality of artificial intelligence blocks (28); each topology being preferably chosen from the group consisting of: a topology based on a convolution mechanism, a topology based on an attention mechanism, a topology based on a recurrence mechanism.
10. A method according to any one of the preceding claims, wherein the number K of artificial intelligence blocks (28) is greater than or equal to 3; the number K of artificial intelligence blocks (28) preferably being between 3 and 5.
11. A method according to any one of the preceding claims, wherein each data (18) acquired is an image, and the sensor (15) is then a sensor of image(s).
12. A computer program comprising software instructions which, when executed by a computer, implement a method according to any one of the preceding claims.
13. Electronic device (20) for processing data (18), comprising: - an acquisition module (22) configured to acquire data (18), each acquired data (18) corresponding to a signal captured by a sensor (15); - a processing module (24) configured to process the data (18) via the inference of an artificial intelligence algorithm (26), previously trained during a prior training session, characterized in that the artificial intelligence algorithm (26) comprises a plurality of distinct artificial intelligence blocks (28), each having been previously trained during the pre-training, and in that the device (20) further comprises: - a calculation module (30) configured to calculate a code from the acquired data (18); the code being a hash, calculated by applying a hash function to the acquired data (18); - a selection module (32) configured to select, based on the calculated code, a block from among the plurality of artificial intelligence blocks (28), the processing module (24) being then configured to process the data (18) via inference, among the plurality of artificial intelligence blocks (28), of the single artificial intelligence block (28) selected, the plurality of artificial intelligence blocks (28) being a plurality of artificial neural networks (50) or a plurality of processing layers (55) within an artificial neural network (50).
14. Electronic system (10) for processing object(s), the system (10) comprising a sensor (15), and an electronic device (20) for processing data(s) connected to the sensor (15), characterized in that the electronic processing device (20) is according to the preceding claim, and each data is a signal from the sensor (15).