Method and system for separating and recalibrating feature for adversarial robustness

Abstract

To provide a method and system for separating and recalibrating a feature for adversarial robustness.SOLUTION: A feature separation and recalibration method according to an embodiment comprises disentangling an input feature map into a first feature defined as a robust feature and a second feature defined as a non-robust feature based on a robustness score; generating a recalibrated feature by recalibrating activation of the second feature; and generating an output feature map by combining the first feature and the recalibrated feature.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The following description relates to a method and system for feature separation and realignment for adversarial robustness. [Background technology]

[0002] Adversarial defense refers to a technique or method that protects an AI model so that it can operate robustly even against inputs containing minute noise and distortions, called adversarial examples. An adversarial example is an input that looks similar to a normal input, but is designed to induce a wrong answer or an incorrect output from the model. Here, "adversarial" means that even an input that does not seem to be significantly different to the human eye can make a big difference to a machine learning model. Such adversarial examples can be used to attack security vulnerabilities or reduce the performance of an AI model, so adversarial defense is considered to be extremely important in terms of security and reliability. A representative adversarial defense technique is the adversarial training method, which adds adversarial examples to the training data to make the model more robust against adversarial attacks.

[0003] Traditional deep neural networks are vulnerable to adversarial attacks, and problems arise due to cumulative distortions at the feature level. Traditional adversarial defense techniques use feature deactivation to increase the robustness of the model while deactivating features that are vulnerable to attacks. While this method can increase robustness against adversarial attacks, it is possible that the deactivated features contain useful information. This causes problems in that it limits the performance and accuracy of the model. Summary of the Invention [Problem to be solved by the invention]

[0004] A method and system for feature separation and realignment for adversarial robustness is provided. [Means for solving the problem]

[0005] A feature separation and realignment method for a computer device including at least one processor, comprising: separating, by the at least one processor, an input feature map into first features defined as robust features and second features defined as non-robust features based on a robustness score; realigning, by the at least one processor, activations of the second features to generate realigned features; and combining, by the at least one processor, the first features and the realigned features to generate an output feature map.

[0006] According to one aspect, the separating step may include generating a robustness map of the input feature map via a separating network trained to learn feature robustness and output a robustness map indicative of a robustness score per feature map, generating a binary mask based on the robustness map, and applying the binary mask to the input feature map to separate the first feature and the second feature.

[0007] According to another aspect, the step of generating the binary mask may be characterized as using a Gumbel softmax to generate the binary mask having a discriminative soft mask.

[0008] According to another aspect, the step of separating the first feature and the second feature may include calculating a product of each element between the input feature map and a positive mask of the binary mask to obtain the first feature, and calculating a product of each element between the input feature map and a negative mask of the binary mask to obtain the second feature.

[0009] According to another aspect, the separation network may include an auxiliary layer based on a multi-layer perceptron (MLP) trained to use a first feature and a second feature as inputs and output a first feature score for the first feature and a second feature score for the second feature, the auxiliary layer guiding the separation network to assign a relatively higher robustness score to the first feature based on activations preserved in a positive mask of the binary mask based on a separation loss.

[0010] According to another aspect, the separation loss may be calculated based on the first feature scores, the second feature scores, a ground truth label, and a label corresponding to a class having a highest prediction score among the classes incorrectly predicted in a final output of the model.

[0011] According to another aspect, generating the retuned feature may include generating a retuned unit by receiving an input of a feature and adjusting activations of the second feature via a retuned network trained to adjust feature activations; applying a negative mask of a binary mask generated based on a robustness map of the input feature map to the retuned unit; and combining the retuned unit to which the negative mask has been applied and the second feature to calculate the retuned feature.

[0012] According to another aspect, the retraining network may include an auxiliary layer that receives the second features as input and outputs an output prediction score, and the auxiliary layer may be configured to guide the retraining network to adjust activations of the second features to provide a signal that is associated with a ground truth label based on a retraining loss.

[0013] According to yet another aspect, the realignment loss may be calculated based on the ground truth labels and the output prediction scores.

[0014] A computer program is provided that is recorded on a computer-readable recording medium and that, when combined with a computer device, causes the computer device to execute the method.

[0015] A computer-readable recording medium is provided on which a program for causing a computer device to execute the method is recorded.

[0016] A computer apparatus is provided, the computer apparatus including at least one processor implemented to execute computer readable instructions, the at least one processor configured to separate an input feature map into first features defined as robust features and second features defined as non-robust features based on a robustness score, rebalance activations of the second features to generate rebalanced features, and combine the first features and the rebalanced features to generate an output feature map. Effect of the Invention

[0017] A method and system for feature separation and realignment for adversarial robustness may be provided. [Brief description of the drawings]

[0018] [Figure 1] FIG. 2 illustrates an example image captured by an adversarial learning model equipped with an FSR module in accordance with an embodiment of the present invention. [Diagram 2] FIG. 2 illustrates an example of an FSR module in accordance with an embodiment of the present invention. [Diagram 3] FIG. 2 is a block diagram illustrating an example of a computing device in accordance with an embodiment of the present invention. [Figure 4] 4 is a flow chart illustrating an example method for feature separation and realignment, in accordance with an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] Although the present invention can be modified in various ways and can have a number of embodiments, a specific embodiment will be described in detail below with reference to the accompanying drawings.

[0020] In describing the present invention, if it is determined that a detailed description of a related prior art may obscure the gist of the present invention, the detailed description will be omitted.

[0021] Deep neural networks become vulnerable to adversarial attacks due to the accumulation of perturbations at the feature level, but many studies have increased the robustness of models by deactivating the activations of non-robust features that cause model prediction errors. However, such bad activations contain discriminatory signals, and recalibration can capture additional useful information for correct model prediction. To this end, embodiments of the present invention provide a new, easily pluggable approach called Feature Sepatation and Recalibration (FSR), which recalibrates non-robust activations to more robust feature maps through separation and recalibration. In the separation part, the input feature map can be separated into robust features by activations that support the model to predict correctly, and non-robust features by activations that are responsible for the model to predict incorrectly during adversarial attacks. After this, in the recalibration part, the non-robust activations can be adjusted to restore signals that are potentially useful for the model's predictions. Extensive experiments verify the superiority of FSR over traditional deactivation techniques, and with only slight computational overhead, it can increase the robustness of traditional adversarial learning methods by up to 8.57%.

[0022] Despite the progress of Deep Neural Networks (DNNs) in computer vision work, DNNs are vulnerable to adversarial examples that add imperceptible noise to natural images and are maliciously manipulated to subvert the decisions of such models. Adversarial examples have been successful in real-world cases, including autonomous driving and biometric recognition, and are known to be effective even when the attacker cannot recognize the target model. Therefore, it is important to devise an effective defense strategy against such instability.

[0023] To this end, various defense techniques have been proposed, such as defense distillation, input noise removal, and attack detection. Among these methods, adversarial learning, which trains a model on a set of the worst adversarial samples to make the model more robust, is the most successful and popular.

[0024] However, even with adversarial learning, pixel-level, extremely small adversarial perturbations accumulate much more in the intermediate feature space, ruining the final output of the model. To solve this problem, recent advanced methods have isolated and deactivated the activations of non-robust features that cause incorrect predictions of the model. For example, to deactivate the interrupted activations, classical noise removal techniques have been applied, or approaches have been used that deactivate channels that are not related to the correct model decision. However, such approaches ignore discriminatory signals that potentially exist in non-robust activations. On the other hand, there is research showing that models can learn discriminatory information from non-robust features in the input space. Based on this research, if there is a potential discriminatory signal in non-robust activation and it is deactivated, there is a risk of losing useful information that provides a better guide for the model to make the correct prediction.

[0025] In an embodiment of the present invention, an FSR module can be provided that aims to increase feature robustness, since non-robust activations that induce model prediction errors may capture discriminatory signals for correct model decisions through appropriate tuning. The FSR module first separates the intermediate feature map of the model into malicious and non-robust activations that are responsible for model prediction errors and robust activations that provide useful signals for correct model predictions even against adversarial attacks. However, as in conventional methods, if only robust features are utilized, potentially useful signals from non-robust features may be lost. Therefore, the FSR module may retune the non-robust activations to capture signals that provide useful guidance for accurate model decisions. Such additional signals can increase the robustness of the model by better guiding the model to make correct predictions.

[0026] FIG. 1 is a diagram showing an example of an image acquired by an adversarial learning model equipped with an FSR module in accordance with an embodiment of the present invention. In FIG. 1, a naturally trained model (f nat ) on the adversarial samples (x') obtained from the adversarial learning model equipped with the FSR module, + ), non-robust features (f - ), and rebalanced features ( Figure 6 shows an example of a visualization of attention maps for natural image features from JPEG2025027421000002.jpg66. Given an adversarial example, we focus on non-robust features (f - ) captures signals that are unrelated to the ground truth classes, but has robust features (f + ) can capture discriminative signals (e.g., a horse's leg). In this case, the FSR module can capture non-robust activations ( By realigning the input image (e.g., the horse's body) we can recover useful additional signal that was not captured by the robust activations (e.g., the horse's body). Such additional signal allows FSR to further improve the model's ability to make correct decisions on adversarial examples.

[0027] Due to its simplicity, the FSR module can be easily connected to all layers of a CNN model, and the entire model can be trained in an end-to-end manner. The FSR module can effectively separate feature activations based on their impact on the model's decision in the separation phase, and successfully capture signals that are useful for model prediction in the retraining phase. This allows FSR to increase the robustness of adversarial learning of various variations with small computational overhead, and to increase the robustness of the model by preserving useful information through an approach that retrains non-robust activations instead of simply deactivating them as in conventional techniques.

[0028] Related Work: Adversarial Learning as Adversarial Defense Adversarial learning is regarded as one of the most effective defense strategies, which trains models with adversarially generated data to make them more resistant to adversarial attacks. It can solve a min-max optimization problem such as the following equation (1):

[0029]

number

[0030] Here, F θ denotes a model parameterized by θ, x denotes a natural image with label y in dataset D, and δ denotes ||δ|| p ≤ ∈ l for size ∈ p The perturbation is restricted within the -norm, L cls(-,-) denotes classification loss. Inner maximization aims to find the most robust perturbation δ that maximizes the classification loss, and outer minimization learns a model to minimize the loss in relation to the worst-case adversarial samples. To optimize the inner maximization, FGSM (Fast Gradient Sign Method) or PDG (Projected Gradient Descent) attacks may be used.

[0031] In recent years, many variants of adversarial learning have emerged. For example, a technique for narrowing the distance between the logic of natural images and the adversarial counterpart, a technique for decomposing prediction errors for adversarial samples into natural errors and boundary errors to increase both robustness and accuracy, a technique for taking into account additional misclassified samples during training, a technique for training models with more robust adversarial samples to increase generalization due to curriculum learning, a technique for proposing a unique ensemble method for combining weights of various models through the learning process, a technique for applying second-order statistics to model weights to increase the robustness of adversarial learning, and other various techniques have emerged. Due to its simplicity, the feature separation and realignment method according to an embodiment of the present invention can be easily connected to all of these various adversarial learning techniques, and can further increase robustness.

[0032] Related Work: Adversarial Defenses on Feature Spaces Some previous models in the parallel research line have learned non-robust features from the dataset, and the input perturbation of adversarial samples gradually accumulates in the intermediate layers, resulting in errors in guiding the final prediction. Diverse work to solve such problems has tried to modify the network structure or apply regularization to learn robust feature representations. For example, there are techniques to study adversarial vulnerability from the perspective of batch normalization, apply pruning to random activation sets, especially to activations that are minimal, to prune activations that are vulnerable to adversarial attacks, and propose feature separation for each class to push the centers of each class against each other to learn discriminatory feature representations.

[0033] Attempts have also been made to explicitly manipulate feature activation to reduce anomalies in feature maps, such as k-Winner-Takes-All activation, which deactivates all feature units except the k largest ones, masking feature units that are sensitive to perturbations by interpreting the effects of adversarial perturbations on pixel, image, and network levels, applying attention mechanisms to highlight important regions of feature maps, Feature Denoising (FD), which applies classical noise removal techniques to deactivate anomalies, and Channel Activation Suppression (CAS) and Channel-wise Importance-based Feature Selection (CIFS), which study the effect of perturbations on feature activation from a channel perspective and deactivate activations of channels that are not robust.

[0034] In contrast to these methods, embodiments of the present invention propose a retuning strategy. Existing deactivation strategies simply discard activations of non-robust features that cause model failure. In embodiments of the present invention, we recapture potentially discriminatory signals and adjust such activations to increase model robustness.

[0035] Feature separation and realignment methods It is known that distorted feature activation during adversarial attacks can cause model prediction errors, but the FSR module can recapture signals that are useful for model prediction through adjustments, making full use of potentially useful signals.

[0036] FIG. 2 is a diagram illustrating an example of an FSR module in an embodiment of the present invention. In the separation stage, the FSR module separates the feature map into robust and non-robust features by masking the non-robust activations or the robust activations, respectively. After this, in the re-adjustment stage, the FSR module re-adjusts the activations of the non-robust features to provide information that is useful for correct model prediction. As shown in FIG. 2, due to its simplicity, the FSR module can be inserted into all layers of the model to increase robustness.

[0037] Feature Separation Compared to recent approaches that make feature maps robust by deactivating non-robust activations, the FSR module rebalances to restore cues that are potentially useful for model prediction. To this end, in the separation stage, the FSR module may extract non-robust activations to rebalance from the input intermediate feature maps. To determine which activations are robust or non-robust, a separation network S may be utilized that learns the robustness of each feature unit. The intermediate feature maps Given JPEG2025027421000005.jpg629 as input, let C, H, and W denote the channel, height, and width dimensions of f, respectively. The separation network produces a robustness map that indicates the robustness score for each f. The output is JPEG2025027421000006.jpg529, and a higher score indicates stronger feature activation.

[0038] To extract non-robust features, the FSR module may element-wise separate the feature map based on robustness scores into robust and non-robust features. For example, a binary mask generated based on robustness scores may be generated. JPEG2025027421000007.jpg634 may be applied to the feature maps, but such discrete sampling is indistinguishable and discontinuous, which may give a false sense of robustness.

[0039] To prevent this problem, in one embodiment of the present invention, a discriminative soft mask is obtained by using Gumbel softmax as shown in the following Equation (2). We may approximate the binary mask b with JPEG2025027421000008.jpg635.

[0040]

number

[0041] where r is the robustness map and σ is the sigmoid function used to normalize the robustness map. g1 and g2 denote samples drawn from a Gumbel distribution such that g = -log(-log(u)). Here, u ~ Uniform(0,1) and τ is the temperature used to control the effect of g1 and g2. To avoid stochasticity in the sampling of g1 and g2 during inference, we use -log((-log(u c )) to fix it, JPEG2025027421000010.jpg634 is the expected value for the uniform distribution. We compute the two-class Gumbel softmax between the normalized robustness map and the inverted version to obtain a mask m with values ​​close to 1 for high robustness scores and close to 0 for low robustness scores. We then mask out the non-robust activations from the input features f and use the robust features f + To get JPEG2025027421000011.jpg526 + =m. Similarly, we multiply the negative mask m - = 1-m, masking the robust activations, JPEG2025027421000012.jpg422 can be obtained.

[0042] However, without guidance, the separation network cannot learn the correct robustness score for each activation. To this end, in this embodiment, we design a goal to guide the separation network to learn a robustness score based on the impact that feature activations have on the model making correct or incorrect predictions. In this embodiment, we use two features f + and f - Each is used as an input to predict the score p + andp - Using the auxiliary layer h based on the MLP (Multi-Layer Perceptron (MLP)) that outputs sep You may calculate:

[0043]

number

[0044] Here, N is the number of classes, y is the ground truth label, and y' is the label corresponding to the class that received the highest prediction score among the classes incorrectly predicted from the final output of the model. sep is the mask m + By training the network to make correct predictions based on the activations stored in L, we guide the separation network to assign high robustness scores to units that support the auxiliary layer to make correct predictions. At the same time, we aim to separate highly destructive activations that cause the model to make incorrect predictions under adversarial attacks. sep guides the separation network to assign low robustness scores to the less robust activations that are specifically responsible for the most likely erroneous predictions.

[0045] L sepUsing , the separation network can effectively separate robust and non-robust feature activations. Although discarding non-robust activations is a way to increase feature robustness, this approach ignores potentially useful signals that can be recaptured by realignment. In the following, we describe how to realign the separated non-robust activations to capture additional useful signals for increasing feature robustness.

[0046] Trait rebalancing As with recent techniques, if we only utilize the robust features obtained in the separation step, we may lose potentially useful signals for model prediction that can further increase the robustness of the model. Therefore, in the first refinement step, we adjust the activations of the non-robust features to capture additional useful signals. First, we refine the activations of the non-robust features f - as input, which gives f - To retune the non-robust activations specified by the robustness map, the FSR module uses a retuning network R that outputs retuning units designed to retune the activations of - Finally, the FSR module applies the result to the realignment unit f - , i.e. Additional and reworked features in JPEG2025027421000014.jpg643 We can calculate JPEG2025027421000015.jpg66.

[0047] The goal of the recalibration phase is to recapture the signal with non-robust activations that help the model make the right decision. To achieve this goal, the recalibrated features Then, the auxiliary layer is attached to JPEG2025027421000016.jpg66, and the re-arrangement loss L is calculated as shown in the following equation (4). rec You may calculate:

[0048]

number

[0049] Where: JPEG2025027421000018.jpg45 is the input JPEG2025027421000019.jpg66 shows the output prediction scores of a given auxiliary layer. In this embodiment, the same auxiliary layer may be trained and the retrained network may be guided to adjust the non-robust activations to provide signals associated with the ground truth classes so that the correct decision can be made based on the retrained features. After the retraining phase, the FSR module uses the robust features f + Rebalanced non-robust traits JPEG2025027421000020.jpg66 is added according to the method of each element to output feature map We obtain JPEG2025027421000021.jpg626, which is propagated to subsequent layers of the model. The refinement step allows us to capture useful signals from non-robust activations that are ignored in traditional approaches.

[0050] Model Training The proposed FSR module can be easily inserted into all layers of the model, and due to its simplicity, it can be trained in an end-to-end manner with the entire model. In addition, the classification loss L cls The proposed method can be applied together with: The overall objective function may be expressed as:

[0051]

number

[0052] Here, L denotes the set of positions where the FSR module is inserted, and L sep and L recdenote the separation loss and realignment loss applied to the FSR module in the first layer, respectively. sep and λ rec are L sep and L rec The addition of such a simple FSR module can increase the robustness of adversarial learning methods against both white-box and black-box attacks with some computational overhead.

[0053] The feature separation and realignment system according to the embodiment of the present invention may be realized by at least one computer device, and the feature separation and realignment method according to the embodiment of the present invention may be executed by at least one computer device included in the feature separation and realignment system. A computer program according to an embodiment of the present invention may be installed and executed in the computer device, and the computer device may execute the feature separation and realignment method according to the embodiment of the present invention according to the control of the executed computer program. The above-mentioned computer program may be recorded in a computer-readable recording medium in combination with the computer device to cause the computer device to execute the feature separation and realignment method.

[0054] FIG. 3 is a block diagram showing an example of a computer device according to an embodiment of the present invention. As shown in FIG. 3, the computer device 300 may include a memory 310, a processor 320, a communication interface 330, and an input / output interface 340. The memory 310 is a computer-readable recording medium and may include a random access memory (RAM), a read only memory (ROM), and a permanent mass storage device such as a disk drive. Here, a permanent mass storage device such as a ROM or a disk drive may be included in the computer device 300 as a separate permanent storage device separate from the memory 310. In addition, the memory 310 may store an operating system and at least one program code. Such software components may be loaded into the memory 310 from a computer-readable recording medium separate from the memory 310. Such separate computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, a memory card, or the like. In another embodiment, the software components may be loaded into the memory 310 through a communication interface 330 that is not a computer-readable recording medium. For example, the software components may be loaded into the memory 310 of the computer device 300 based on a computer program that is installed by a file received via a network 360.

[0055] The processor 320 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. The instructions may be provided to the processor 320 by the memory 310 or the communication interface 330. For example, the processor 320 may be configured to execute instructions received according to program code stored in a storage device such as the memory 310.

[0056] The communication interface 330 may provide a function for the computer device 300 to communicate with other devices via the network 360. For example, requests, commands, data, files, etc. generated by the processor 320 of the computer device 300 according to program codes recorded in a recording device such as the memory 310 may be transmitted to other devices via the network 360 under the control of the communication interface 330. Conversely, signals, commands, data, files, etc. from other devices may be received by the computer device 300 via the communication interface 330 of the computer device 300 via the network 360. The signals, commands, data, etc. received via the communication interface 330 may be transmitted to the processor 320 or the memory 310, and the files, etc. may be recorded in a recording medium (the above-mentioned permanent recording device) that the computer device 300 may further include.

[0057] The input / output interface 340 may be a means for interfacing with an input / output device (I / O device) 350. For example, the input device may include a device such as a microphone, a keyboard, or a mouse, and the output device may include a device such as a display and a speaker. As another example, the input / output interface 340 may be a means for interfacing with a device in which functions for input and output are integrated into one, such as a touch screen. The input / output device 350 may be configured as one device together with the computer device 300.

[0058] Also, in other embodiments, the computing device 300 may include fewer or more components than those of Figure 3. However, most of the prior art components need not be explicitly illustrated. For example, the computing device 300 may be implemented to include at least some of the input / output devices 350 described above, and may further include other components such as a transceiver, a database, etc.

[0059] FIG. 4 is a flowchart showing an example of a feature separation and realignment method according to an embodiment of the present invention. The feature separation and realignment method according to this embodiment may be executed by the computer device 300 described with reference to FIG. 3. In this case, the processor 320 of the computer device 300 may be realized to execute control instructions according to the operating system code and at least one computer program code included in the memory 310. Here, the processor 320 may control the computer device 300 so that the computer device 300 executes steps 410 to 440 included in the method of FIG. 4 according to the control instructions provided by the code recorded in the computer device 300.

[0060] In step 410, the computer device 300 may separate the input feature map into a first feature defined as a robust feature and a second feature defined as a non-robust feature based on a robustness score. As an example, the computer device 300 may first generate a robustness map of the input feature map through a separation network trained to learn the robustness of the feature and output a robustness map indicating a robustness score per feature map. The separation network may include an MLP-based auxiliary layer trained to use the first feature and the second feature as inputs and output a first feature score for the first feature and a second feature score for the second feature. In this case, the auxiliary layer may guide the separation network to assign a relatively high robustness score to the first feature based on the activations stored in a positive mask of the binary mask described below based on the separation loss. Here, the separation loss may be calculated based on the first feature score, the second feature score, the ground truth label, and a label corresponding to the class that received the highest prediction score among the classes incorrectly predicted in the final output of the model. As an example, the separation loss may be calculated as in Equation (3) above. The computer device 300 may generate a binary mask based on the robustness map. In this case, the computer device 300 may generate a binary mask having a discriminatory soft mask using Gumbel softmax. The soft mask is as described with reference to Equation (2). The computer device 300 may apply the binary mask to the input feature map to separate the first feature and the second feature. In this case, the computer device 300 may calculate an element-wise product between the input feature map and a positive mask of the binary mask to obtain the first feature, and may calculate an element-wise product between the input feature map and a negative mask of the binary mask to obtain the second feature.

[0061] In step 420, the computer device 300 may re-adjust the activation of the second feature to generate a re-adjusted feature. For example, the computer device 300 may generate a re-adjusted unit by adjusting the activation of the second feature through a re-adjustment network trained to adjust the activation of the feature when receiving an input of the feature. Here, the re-adjustment network may include an auxiliary layer that receives the input of the second feature and outputs an output prediction score, and the auxiliary layer may guide the re-adjustment network to adjust the activation of the second feature so as to provide a signal related to the ground true label based on the re-adjustment loss. In this case, the re-adjustment loss may be calculated based on the ground true label and the output prediction score. An example of calculating the re-adjustment loss is as described with reference to Equation (4). In addition, the computer device 300 may apply a negative mask of the binary mask generated based on the robustness map of the input feature map to the re-adjustment unit, and calculate a re-adjusted feature by combining the re-adjustment unit to which the negative mask has been applied and the second feature ( JPEG2025027421000023.jpg643) is fine.

[0062] At step 430, the computing device 300 may combine the first feature and the retuned feature to generate an output feature map. + It is a non-robust feature that has been rebalanced to The output feature map is created by combining JPEG2025027421000024.jpg66. This explains how JPEG2025027421000025.jpg626 can be obtained.

[0063] Thus, according to an embodiment of the present invention, a feature separation and realignment method and system for adversarial robustness can be provided. The feature separation and realignment method and system of the present invention improved robustness against adversarial samples in the CIFAR-10 and SVHN datasets. This performance improvement can be seen in Table 1 below. Table 1 shows the classification accuracy (%) of each defense technique (first column) against various adversarial attacks (FGSM, PGD-20, PGD-100, C&W, Ensemble).

[0064] [Table 1]

[0065] When applied to various adversarial learning techniques such as AT, TRADES, and MART, the feature separation and realignment method and system can be confirmed to be more robust against various adversarial attacks.

[0066] Adversarial defense research is a field that studies techniques and methods to protect machine learning models such as deep neural networks so that they operate robustly against adversarial samples. This research has had an important impact in a variety of fields, and has the following effects:

[0067] 1. Improving model robustness: Adversarial defense research develops ways to improve models to make them more robust against adversarial attacks, which allows models to perform better on both general data and adversarial examples, resulting in more trustworthy models.

[0068] 2. Mitigating security vulnerabilities: Research on adversarial defense helps to understand and complement model vulnerabilities. It makes it possible to build AI models that are robust against adversarial samples created by malicious users to attack the model.

[0069] 3. AI models useful for real-world applications: Research on adversarial defense will support the development of AI models that perform well in real-world hostile environments. In particular, adversarial defense will play an important role in fields with high security requirements.

[0070] The above-described systems or devices may be realized by hardware components or a combination of hardware and software components. For example, the devices and components described in the embodiments may be realized using one or more general-purpose or special-purpose computers, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a programmable logic unit (PLU), a microprocessor, or various devices capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications that run on the OS. The processing device may also respond to the execution of the software to access, record, manipulate, process, and generate data. For convenience of understanding, a single processing device may be described as being used, but those skilled in the art will understand that the processing device may include multiple processing elements and / or multiple types of processing elements. For example, the processing device may include multiple processors or one processor and one controller. Other processing configurations, such as parallel processors, are also possible.

[0071] The software may include computer programs, codes, instructions, or a combination of one or more of these, and may configure a processing device to operate as desired or instruct the processing device, either independently or collectively. The software and / or data may be embodied in any type of machine, component, physical device, virtual device, computer storage medium, or device to be interpreted by the processing device or to provide instructions or data to the processing device. The software may be distributed and stored or executed in a distributed manner on computer systems connected by a network. The software and data may be stored on one or more computer-readable storage media.

[0072] The method according to the embodiment may be realized in the form of program instructions executable by various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The medium may be one that continuously records a computer-executable program, or one that temporarily records the program for execution or download. The medium may be one that is a recording means or storage means in the form of a single or multiple hardware devices combined, and may be a medium that is directly connected to a certain computer system, or one that is distributed on a network. Examples of the medium may include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and media configured to record program instructions such as ROMs, RAMs, flash memories, and the like. Other examples of the medium include recording media and storage media managed by app stores that distribute applications, sites that supply or distribute various other software, and servers. Examples of the program instructions include not only machine language codes such as those generated by compilers, but also high-level language codes that are executed by a computer using an interpreter, etc.

[0073] Although the embodiments have been described based on the limited embodiments and drawings as above, those skilled in the art will be able to make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from that described, and / or the components of the described systems, structures, devices, circuits, etc. may be combined or combined in a manner different from that described, or may be counterbalanced or replaced by other components or equivalents, and still achieve suitable results.

[0074] Therefore, different embodiments are within the scope of the appended claims provided that they are equivalent to the claims. [Explanation of symbols]

[0075] 300: Computer equipment 310: Memory 320: Processor 330: Communication interface 340: Input / Output Interface 350: Input / Output Device 360: Network

Claims

1. 1. A method for feature separation and realignment in a computer device including at least one processor, comprising: Separating, with the at least one processor, the input feature map into first features defined as robust features and second features defined as non-robust features based on a robustness score; rebalancing, by the at least one processor, activation of the second feature to generate a rebalance feature; combining, by the at least one processor, the first features and the rescaled features to generate an output feature map; A feature separation and realignment method, comprising:

2. The separating step includes: generating a robustness map of the input feature maps via a separation network trained to learn feature robustness and output a robustness map indicative of a robustness score for each feature map; generating a binary mask based on the robustness map; applying the binary mask to the input feature map to separate the first and second features; 2. The method of claim 1, further comprising:

3. The step of generating the binary mask comprises: Using Gumbel softmax to generate a binary mask with a discriminative soft mask. The feature separation and realignment method of claim 2.

4. The step of separating the first feature and the second feature comprises: The first feature is obtained by calculating a product between the input feature map and a positive mask of the binary mask for each element, and the second feature is obtained by calculating a product between the input feature map and a negative mask of the binary mask for each element. The feature separation and realignment method of claim 2.

5. The separation network includes a multi-layer perceptron (MLP)-based auxiliary layer trained to use a first feature and a second feature as inputs and output a first feature score for the first feature and a second feature score for the second feature, The auxiliary layer guides the separation network to assign a relatively higher robustness score to the first feature based on activations preserved in a positive mask of the binary masks based on a separation loss. The method of claim 2 , further comprising:

6. The separation loss is calculated based on the first feature score, the second feature score, a ground truth label, and a label corresponding to a class having a highest prediction score among classes incorrectly predicted in a final output of the model. The feature separation and realignment method of claim 5.

7. The step of generating rescaled features comprises: receiving an input of a feature and adjusting activations of the second feature via a retraining network trained to adjust feature activations to generate a retrained unit; applying a negative one of the binary masks generated based on a robustness map of the input feature map to the refinement unit; calculating the realigned feature by combining the negative masked realignment unit and the second feature; 2. The method of claim 1, further comprising:

8. the refinement network includes a sub-layer that receives the second features and outputs an output prediction score; The auxiliary layer guides the retraining network to adjust activations of the second features to provide a signal associated with a ground truth label based on a retraining loss. The method of claim 7, further comprising:

9. The realignment loss is calculated based on the ground truth labels and the output prediction scores. The feature separation and realignment method of claim 8.

10. A computer-readable recording medium having a program recorded thereon for causing a computer device to execute the method according to any one of claims 1 to 9.

11. A computer program recorded on a computer-readable recording medium for causing a computer device to execute a feature separation and realignment method, The feature separation and realignment method comprises: Separating the input feature map into first features defined as robust features and second features defined as non-robust features based on a robustness score; re-adjusting the activation of the second feature to generate a re-adjusted feature; combining the first features and the rescaled features to generate an output feature map; A computer program comprising:

12. The separating step includes: generating a robustness map of the input feature maps via a separation network trained to learn feature robustness and output a robustness map indicative of a robustness score for each feature map; generating a binary mask based on the robustness map; applying the binary mask to the input feature map to separate the first and second features; 12. A computer program according to claim 11, comprising:

13. The separation network includes a multi-layer perceptron (MLP)-based auxiliary layer trained to use a first feature and a second feature as inputs and output a first feature score for the first feature and a second feature score for the second feature, 13. The computer program product of claim 12, wherein the auxiliary layer guides the separation network to assign a relatively higher robustness score to the first feature based on activations preserved in positive ones of the binary masks based on a separation loss.

14. The step of generating rescaled features comprises: receiving an input of a feature and adjusting activations of the second feature via a retraining network trained to adjust feature activations to generate a retrained unit; applying a negative one of the binary masks generated based on a robustness map of the input feature map to the refinement unit; calculating the realigned feature by combining the negative masked realignment unit and the second feature; 12. A computer program according to claim 11, comprising:

15. the refinement network includes a sub-layer that receives the second features and outputs an output prediction score; 15. The computer program product of claim 14, wherein the auxiliary layer guides the retraining network to adjust activations of the second features to provide a signal associated with a ground truth label based on a retraining loss.

16. At least one processor implemented to execute computer readable instructions. Including, by said at least one processor, Separating the input feature map into first features defined as robust features and second features defined as non-robust features based on a robustness score; re-adjusting the activations of the second feature to generate a re-adjusted feature; The computer apparatus further comprising: combining the first features and the rescaled features to generate an output feature map.

17. and, by the at least one processor, for separating the input feature maps, generating a robustness map of the input feature maps via a separation network trained to learn feature robustness and output a robustness map indicative of a robustness score for each feature map; generating a binary mask based on the robustness map; The computer apparatus of claim 16, wherein the binary mask is applied to the input feature map to separate the first feature and the second feature.

18. The separation network includes a multi-layer perceptron (MLP)-based auxiliary layer trained to use a first feature and a second feature as inputs and output a first feature score for the first feature and a second feature score for the second feature, The auxiliary layer guides the separation network to assign a relatively higher robustness score to the first feature based on activations preserved in a positive mask of the binary masks based on a separation loss.

20. The computer device of claim 17.

19. To generate the rescaled features, by the at least one processor, receiving an input of a feature and adjusting activations of the second feature via a retraining network trained to adjust feature activations to generate a retraining unit; applying a negative one of the binary masks generated based on a robustness map of the input feature map to the refinement unit; The computer apparatus of claim 16, further comprising: a negative masked realignment unit that combines the second feature with the negative masked realignment unit to calculate the realigned feature.

20. the refinement network includes a sub-layer that receives the second features and outputs an output prediction score; 20. The computer apparatus of claim 19, wherein the auxiliary layer guides the retraining network to adjust activations of the second features to provide a signal associated with a ground truth label based on a retraining loss.

Images