Apparatus and method for training a classifier - Patents.com

Abstract

To provide a method, a system and the like for training a classifier for classifying an input signal.SOLUTION: A method has a step of providing a set of perturbation. The method further repeats each step: providing a sub-set of a first training sample including an input signal from a first data set of a training sample and a corresponding desired output signal; selecting first perturbation from the input signal from the sub-set and a set of perturbation for the corresponding desired output signal; adapting the first perturbation on the basis of the input signal, the corresponding desired output signal and a classifier, and thereby acquiring second perturbation stronger than the first perturbation; adopting the second perturbation to the input signal and thereby acquiring a first hostile example; training the classifier on the basis of the first hostile example and the corresponding desired output signal so as to strengthen the classifier to the second perturbation; and replacing the first perturbation in the set of the perturbation with a liner combination between the first perturbation and the second perturbation.SELECTED DRAWING: Figure 6

Description

[Technical field]

[0001] The present invention relates to a method for training a classifier, a method for classification, a method for operating an actuator, a computer program, a machine-readable storage medium, a control system and a training system. [Background technology]

[0002] Background technology In DE 102018200724 A1 a method for generating universal adversarial perturbations is disclosed. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] DE 102018200724 A1 Summary of the Invention [Problem to be solved by the invention]

[0004] Advantages of the invention Classifiers may be used in a variety of technical devices, however, they may also be prone to misclassifying maliciously altered inputs, known as adversarial examples.

[0005] In DE 102018200724 A1 a method is disclosed for generating universal adversarial perturbations, which can be applied to almost any input signal for a classifier and which can fool the classifier, thereby causing it to misclassify otherwise correctly classified input signals.

[0006] Thus, perturbations pose special risks when using classifiers, especially when using classifiers in safety-critical products. For example, a classifier may be used to detect pedestrians in an autonomous vehicle for collision avoidance. Here, universal adversarial examples could be used to maliciously hide pedestrians from the classifier and expose them to the risk of collision with the autonomous vehicle.

[0007] Therefore, protecting the classifier against these perturbations is of great importance. [Means for solving the problem]

[0008] A method with the features according to claim 1 makes it possible to train a classifier to be more robust against perturbations, also known as universal adversarial examples.

[0009] Disclosure of the Invention In a first aspect, the present invention relates to a computer implemented method for training a classifier for classifying an input signal provided to the classifier, the classifier being configured to obtain an output signal characterizing a classification of the input signal, the method for training comprising the following steps: a. providing a set of perturbations; b. providing a first subset of training samples, each of which includes an input signal from a first data set of training samples and a corresponding desired output signal; c. selecting a first perturbation from the set of perturbations for an input signal from the subset and a corresponding desired output signal; d. obtaining a second perturbation that is stronger than the first perturbation by adapting the first perturbation based on the input signal, the corresponding desired output signal, and the classifier; e. Obtaining a first adversarial example by applying a second perturbation to the input signal; f. Adapting the classifier by training the classifier based on the first adversarial example for strengthening the classifier against the second perturbation; g. replacing a first perturbation in the set of perturbations with a linear combination of the first perturbation and a second perturbation; repeating steps b through g; Includes.

[0010] The term "classifier" is understood to mean a device that accepts an input signal and provides an output signal that characterizes a classification of the input signal. For this purpose, the classifier can obtain the output signal by feeding the input signal to a machine learning model, in particular a neural network. Furthermore, the classifier can adapt the input signal before feeding it to the classifier, for example before extracting features from the input signal. Additionally, the classifier can also post-process the output signal of the machine learning model.

[0011] The classifier can accept input signals of different modalities, in particular images such as video images, radar images, LIDAR images and / or ultrasound images, as well as infrared camera images, etc. For images, the classifier may preferably include a convolutional neural network.

[0012] Alternatively, the classifier may accept as input audio data in the form of a feature representation of the audio signal, such as a quantized signal or MFCCs. For audio data, the classifier may preferably include a Transformer network or a recurrent neural network, such as an LSTM.

[0013] Alternatively, the input signal may also include data that is a combination of multiple sensor signals and / or sensor signals of different modalities. When both image data and audio data are provided in the input signal, the classifier may preferably include different types of neural networks for processing respective portions of the input signal, for example a combination of one or more convolutional neural networks and one or more transformer networks.

[0014] The classification characterized by the output signal may assign one or more class labels to the input signal. Alternatively or additionally, the output signal may be envisaged to characterize the classification by a form of object detection, particularly when image data is used as the input signal. Alternatively or additionally, the output signal may be envisaged to characterize a semantic segmentation of the input signal.

[0015] For audio signals, the classification may involve assigning a class label to the entire sequence of audio data. Alternatively or additionally, the classification may be in the form of detection of the start and end of particular audio events in the audio sequence (e.g., a siren in a microphone recording).

[0016] A first perturbation from the set of perturbations may be used as an initialization to generate a second perturbation that can be applied to an input signal from the first dataset to obtain an adversarial example for the classifier. An adversarial example may be understood as an input signal that is adapted to cause misclassification by the classifier.

[0017] Applying a perturbation to an input signal can be understood as overlaying the input signal with the perturbation. For example, when using images as the input signal, the perturbation may be provided by a small image patch that may be overlaid on a given input image to form an adversarial example. In this case, the location of the patch in the input image may be selected randomly. Alternatively or additionally, the patch may be transformed by an affine transformation before being applied to the input image. For audio data, the perturbation may be overlaid on a random portion of the audio sequence to form an adversarial example.

[0018] It may further be assumed that the perturbation and the input signal have the same dimensions, and applying the perturbation to the input signal may be accomplished by adding the perturbation and the input signal together. For example, when using image data, the perturbation may have a size comparable to the image used for training the classifier. In this case, the pixel values ​​of the perturbation and the image may be added together to form the adversarial examples. Additionally, the perturbation may be scaled by a scalar value before being applied to the input image. A similar approach may be used mutatis mutandis to apply the respective perturbation to the audio signal.

[0019] When a classifier provides an output signal for an input signal, the output signal may include a number of logit values, where each of these logit values ​​corresponds to a class. If the logit value corresponding to the desired class is the largest among the number of logit values, the input signal may be assigned the desired class and the output signal may be deemed to characterize the correct classification.

[0020] To evaluate whether the second perturbation is stronger, i.e., easier to use than the first perturbation to fool the classifier, the second perturbation may be applied to an input signal to obtain a corresponding second adversarial example, and the first perturbation may be applied to the same input signal to obtain the first adversarial example. The classifier can then use the second adversarial example as an input signal to obtain a second output signal, and the first adversarial example as an input signal to obtain a first output signal. Thus, the second output signal corresponds to the second perturbation, while the first output signal corresponds to the first perturbation.

[0021] Then, if the logit value of the desired class is smaller in the second output signal than in the first output signal, the second perturbation may be considered stronger than the first perturbation. Similarly, if the maximum logit value of the undesired class in the second output signal is larger than the maximum logit value of the undesired class in the first output signal, the second perturbation may be considered stronger than the first perturbation. Either option may be understood to make the classifier more confident of an incorrect prediction using the second perturbation than the first perturbation.

[0022] Alternatively or additionally, the output signal may include a plurality of probability values, where each of these probability values ​​corresponds to a class, and the first and second output signals may be calculated as before, in which case the second perturbation may be considered stronger than the first perturbation if the probability value of the desired class is smaller in the second output signal than in the first output signal.

[0023] Training a classifier with the proposed method can be seen as a form of meta-training, where a set of perturbations and a classifier are trained. The classifier is trained with the goal of achieving the highest possible classification accuracy (also known as performance), but the method also seeks to find a set of perturbations that are as strong as possible.

[0024] Therefore, training the classifier with perturbations of increasing strength allows strengthening the classifier against strong adversarial attacks, making it highly robust.

[0025] The training can be performed iteratively. In each training step, the method can select a batch of training data including one or more tuples of an input signal and a desired output signal. Then, for each input signal, a first perturbation can be randomly drawn with replacement from a set of perturbations. Each such drawn first perturbation can then be adapted to its corresponding input signal to determine a stronger second perturbation.

[0026] The classifier may then be trained by providing adversarial examples obtained from applying the obtained second perturbation to each of those input signals and minimizing a classification loss that characterizes the difference between the obtained output signal and a desired output signal for each input signal.

[0027] Furthermore, each first perturbation may be replaced in the set of perturbations by a weighted sum of itself and the second perturbation, again preferably training the perturbations to be universally strong. The advantage of this training method is that the classifier has to learn to defend itself against perturbations of increasing strength. As a result, this helps the classifier to become universally robust against adversarial attacks.

[0028] In other aspects, at least one perturbation from the set of perturbations is provided based on a second adversarial example of the classifier, where the classifier may further be assumed to be a pre-trained classifier.

[0029] The process of training a classifier benefits from initializing perturbations to be diverse, which has the advantage that diverse perturbations result in a classifier that is robust to diverse adversarial examples and therefore robust to diverse perturbations.

[0030] To obtain an initial set of strong perturbations, the classifier may be pre-trained without defense methods against adversarial examples. Then, one or more second adversarial examples may be obtained from the classifier, for example, by adapting images in the training dataset with known adversarial attack methods, and the perturbations required to induce the one or more second adversarial examples may then be used as the initial set of perturbations for training.

[0031] The advantage of this approach is that the perturbations used for training initialization can already be used for forming adversarial examples. Thus, the step of forming the second perturbation is significantly faster than in gradient-based approaches such as Iterative Fast Gradient Sign Method (I-FGSM) or Projected Gradient Descent (PGD), and the steps required to obtain the second perturbation from the first are also significantly reduced. As a result, this leads to faster training, which in turn leads to the classifier being able to extract information from more training samples during training. This has the effect of further improving the performance and robustness of the classifier.

[0032] In other aspects, it may be further envisioned that the second adversarial example is provided based on applying random noise to random positions of the input signal from the first dataset.

[0033] When image data is used as input, the noise may be applied to the entire image. Alternatively, the noise may be applied to smaller regions of the image in the form of patches. It may further be assumed that the patches undergo some form of transformation, such as rotation, translation or scaling, before being applied to the image. Random noise may further be used for disturbance of specific pixels. Alternatively, the noise may be blended across the image.

[0034] Similarly, when using an audio signal, the noise may be transformed, for example by translation, amplitude scaling, or individual frequency scaling, before being applied to the audio signal. For application, the noise may be blended across the original audio signal. Alternatively, certain frequencies of the original signal may be replaced by certain frequencies of the noise.

[0035] Using random noise as an initial perturbation allows us to obtain a large variety of initial perturbations. This diversity allows us to protect the classifier against a wide range of adversarial examples. As a result, this improves the performance and robustness of the classifier.

[0036] One or more perturbations from the set of perturbations are determined according to the following steps: i. selecting a subset of input signals from a first data set; j. adapting the input signal in the subset by scaling a plurality of values ​​in the input signal; k. applying the adapted input signals as perturbations to the input signals of the first dataset to obtain a set of new input signals, each new input signal from the set of new input signals corresponding to an adapted input signal; l. determining a first value for each adapted input signal, the first value characterizing an ability of the corresponding adapted input signal to fool the classifier when used as a perturbation, the first value being determined based on an ability of a new input signal corresponding to the adapted input signal to fool the classifier (60); m. ranking the adapted input signals by their corresponding first values ​​and providing the best ranked desired amount of the adapted input signal as a perturbation; It may further be envisaged that the method is provided in accordance with

[0037] For image data the scaling may be considered as a scaling of the intensity or pixel values, for audio data the amplitude of the audio signal may be scaled to obtain an adapted input signal.

[0038] In the step of applying adapted input signals as perturbations, it may be envisaged that each adapted input signal is applied to each input signal from the first data set.

[0039] The first value for the corresponding adapted input signal may be determined, for example, by dividing the number of improperly classified new input signals that correspond to the adapted input signal by the number of all new input signals that correspond to the adapted input signal.

[0040] The advantage of this approach is that the adapted input signal exhibits diverse content and can therefore serve as a good initialization for obtaining diverse perturbations. As a result, this initialization reduces the time required to obtain the second perturbation. This leads to faster training, which in turn allows the classifier to process more data, which in turn leads to improved classifier performance.

[0041] The method for training comprises the following steps: n. Training a classifier based on the input signal and the corresponding desired output signal. It may further be envisaged to further include: The advantage of this approach is that the classifier is trained not only on the adversarial examples, but also on the unperturbed input signal. This allows the classifier to focus on defending against perturbations, but also to achieve the highest possible performance on unperturbed images.

[0042] Embodiments of the invention will now be explained in more detail with reference to the following drawings, in which: [Brief description of the drawings]

[0043] [Figure 1] FIG. 1 illustrates a control system that includes a classifier that controls actuators in the environment. [Diagram 2] FIG. 1 illustrates a control system for controlling an at least partially autonomous robot. [Diagram 3] FIG. 1 illustrates a control system for controlling an automated personal assistant. [Figure 4] FIG. 2 illustrates a control system for controlling the access control system. [Diagram 5] FIG. 2 is a diagram showing a control system that controls the monitoring system. [Figure 6] FIG. 1 shows a flowchart of a method for training a classifier. [Figure 7] FIG. 1 illustrates a training system for training a classifier. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0044] Description of the embodiments In Fig. 1, an embodiment of an actuator 10 is shown in its environment 20. The actuator 10 interacts with a control system 40. The actuator 10 and its environment 20 together are referred to herein as the actuator system. Preferably, at equally spaced time points, a sensor 30 senses a state of the actuator system. The sensor 30 may comprise a plurality of sensors. Preferably, the sensor 30 is an optical sensor that takes an image of the environment 20. An output signal S of the sensor 30 (or of each sensor, if the sensor 30 comprises a plurality of sensors) encoding the sensed state is transmitted to the control system 40.

[0045] Thereby, the control system 40 receives a stream of sensor signals S. In dependence on the stream of sensor signals S, a sequence of actuator control commands A is then calculated, which are then transmitted to the actuator 10.

[0046] The control system 40 receives the stream of sensor signals S of the sensors 30 at an optional receiving unit 50. The receiving unit 50 converts the sensor signals S into an input signal x. Alternatively, if there is no receiving unit 50, each sensor signal S may be directly taken as an input signal x. The input signal x may, for example, be provided as an excerpt from the sensor signals S. Alternatively, the sensor signals S may be processed to generate the input signal x.

[0047] The input signal x is then passed to a classifier 60 .

[0048] The classifier 60 is parameterized by a set of parameters Φ, which are stored in and provided by a parameter storage St1.

[0049] The classifier 60 determines an output signal y from an input signal x. This output signal y includes information that assigns one or more labels to the input signal x. The output signal y is transmitted to an optional transformation unit 80, which transforms the output signal y into control commands A. These actuator control commands A are then transmitted to the actuator 10 for controlling the actuator 10 accordingly. Alternatively, the output signal y may be directly taken as the actuator control commands A.

[0050] The actuator 10 receives the actuator control command A and is controlled accordingly to perform an action corresponding to the actuator control command A. The actuator 10 may include control logic that converts the actuator control command A into a further control command that is then used to control the actuator 10.

[0051] In further embodiments, the control system 40 may include the sensor 30. In yet other embodiments, the control system 40 may alternatively or additionally include the actuator 10.

[0052] In one embodiment, the classifier 60 may be configured to identify lanes on the road ahead, for example by classifying the road surface and markings on the road and identifying the lanes as patches of road surface between the markings. A suitable lane for following the selected path may then be selected based on the output of the navigation system, and then depending on the current lane and the target lane, it may be determined whether the vehicle 100 should switch lanes or stay in the current lane. The actuator control command A may then be calculated, for example by retrieving a predefined movement pattern from a database corresponding to the identified action.

[0053] Additionally or alternatively, the classifier 60 may also detect road signs and traffic lights in the environment 20. Upon identifying a road sign or a traffic light, then depending on the identified type of road sign or the identified state of said traffic light, corresponding constraints on the possible movement patterns of the vehicle 100 may be retrieved, for example from a database, a planned trajectory of the vehicle 100 may be calculated according to these constraints, and actuator control commands A may be calculated for maneuvering the vehicle 100 to execute the planned trajectory.

[0054] Additionally or alternatively, the classifier may detect pedestrians and / or vehicles in the environment 20. Upon identifying a pedestrian and / or vehicle, a predicted future behavior of the pedestrian and / or vehicle may be estimated, and then a trajectory may be selected based on the estimated future behavior to avoid a collision with the identified pedestrian and / or vehicle, and actuator control commands A may be calculated to steer the vehicle 100 to execute the trajectory.

[0055] In a further embodiment, it may be envisaged that the control system 40 controls the display 10 a instead of or in addition to the actuator 10 .

[0056] Additionally, the control system 40 may include a processor 45 (or multiple processors) and at least one machine-readable storage medium 46 having stored thereon a number of instructions which, when executed, cause the control system 40 to perform methods in accordance with aspects of the present invention.

[0057] FIG. 2 illustrates an embodiment in which the control system 40 is used to control an at least partially autonomous robot, such as an at least partially autonomous vehicle 100 .

[0058] The sensors 30 may include one or more video sensors and / or one or more radar sensors and / or one or more ultrasonic sensors and / or one or more LiDAR sensors and / or one or more location sensors (e.g., GPS, etc.), some or all of which are preferably, but not necessarily, integrated into the vehicle 100.

[0059] Alternatively or additionally, the sensor 30 may include an information system for determining the state of the actuator system. One example of such an information system is a weather information system that determines the current or future state of the weather in the environment 20.

[0060] For example, using the input signal x, the classifier 60 can detect, for example, an object that is at least partially in the vicinity of the autonomous robot. The output signal y can include information characterizing where the object is located at least partially in the vicinity of the autonomous robot. The actuator control command A can then be determined according to this information, for example to avoid a collision with the detected object.

[0061] Advantageously, the actuator 10 integrated in the vehicle 100 may be provided by the brakes, the propulsion system, the engine, the drive train or the steering of the vehicle 100. An actuator control command A may be determined such that the vehicle 100 controls the actuator (or actuators) 10 such that it avoids a collision with the detected object. The detected objects may be classified according to which the classifier 60 is most likely to recognize them as an object, e.g. pedestrian or tree, and the actuator control command A may be determined depending on the classification.

[0062] In further embodiments, the at least partially autonomous robot may be provided by another kind of mobile robot (not shown), which can move, for example, by flying, swimming, diving or stepping. The mobile robot may in particular be an at least partially autonomous lawnmower or an at least partially autonomous cleaning robot. In all the above embodiments, the actuator control command A may be determined such that the propulsion unit and / or steering and / or braking of the mobile robot are controlled so that the mobile robot can avoid a collision with the identified object.

[0063] In a further embodiment, the at least partially autonomous robot may be provided by a gardening robot (not shown) that uses sensors 30, preferably optical sensors, to determine the state of the plants in the environment 20. The actuator 10 may control a nozzle for spraying a liquid and / or a cutting device, e.g. a blade. Depending on the identified species and / or the identified state of the plant, an actuator control command A may be determined to cause the actuator 10 to spray an appropriate amount of an appropriate liquid towards the plant and / or to cause the actuator 10 to cut the plant.

[0064] 3 shows an embodiment in which the control system 40 is used to control an automated personal assistant 250. The sensor 30 may be an optical sensor, for example an optical sensor for receiving video images of the gestures of the user 249. Alternatively, the sensor 30 may be an audio sensor, for example an audio sensor for receiving voice commands of the user 249.

[0065] The control system 40 then determines an actuator control command A for controlling the automated personal assistant 250. This actuator control command A is determined depending on the sensor signal S of the sensor 30. The sensor signal S is transmitted to the control system 40. For example, the classifier 60 may be configured to execute a gesture recognition algorithm for identifying, for example, a gesture made by the user 249. The control system 40 may then determine an actuator control command A for transmission to the automated personal assistant 250. The actuator control command A is then transmitted to the automated personal assistant 250.

[0066] For example, actuator control command A may be determined according to a user gesture recognized and identified by classifier 60. It may then include information that causes automated personal assistant 250 to retrieve information from a database and output the retrieved information in a form suitable for receipt by user 249.

[0067] In Fig. 4 an embodiment is shown in which the control system 40 controls an access control system 300. This access control system 300 may be designed to physically control access. It may for example include a door 401. The sensor 30 may be configured to detect a scene relevant for deciding whether to grant access. It may for example be an optical sensor for providing image or video data, for example for detecting a person's face. The classifier 60 may be configured to interpret this image or video data, for example by performing an identity match with known persons stored in a database, thereby determining the identity of the person. An actuator control signal A may then be determined depending on the interpretation of the classifier 60, for example according to the determined identity. The actuator 10 may be a lock which is opened or closed depending on the actuator control signal A.

[0068] In Fig. 5 an embodiment is shown in which the control system 40 controls the surveillance system 400. This embodiment is almost identical to the embodiment shown in Fig. 4. Therefore, only the different aspects will be described in detail. In this embodiment, the sensor 30 is configured to detect the scene under surveillance. The control system 40 does not necessarily have to control the actuator 10, but can alternatively control the display 10a. For example, the classifier 60 can determine a classification of the scene, for example whether the scene detected by the optical sensor 30 is suspicious. The actuator control signal A sent to the display 10a can then be configured to cause the display 10a to adjust the displayed content depending on the determined classification, for example to highlight objects deemed suspicious by the classifier 60.

[0069] 6 is a flow chart outlining an embodiment of a method for training a classifier 60 of a control system 40 to be robust against adversarial attacks. The method for training is provided with a classifier 60, preferably a neural network that is pre-trained with a pre-training data set, and a training data set of input signals and corresponding desired output signals.

[0070] In a first step 601, a number of perturbations are initialized. For this initialization, the input signals from the training data set can each be scaled by a random number to form a perturbation. Then, each perturbation is applied to each input signal of the training data set to obtain a number of new input signals. Then, for each perturbation, a first value is obtained by calculating the proportion of new input signals corresponding to the adapted input signals such that the classifier provides a misclassification for all new input signals corresponding to the adapted input signals.

[0071] Alternatively, the input signals can be downsampled and / or cropped to obtain perturbations. These perturbations can be applied to some of the input signals of the training data set to obtain a number of new input signals. For example, when images are used as input signals, these perturbations can be applied to the input signals of the training data set as patches.

[0072] Alternatively, the perturbations may be initialized as noise applied to either the entire input signal or a portion of the input signal, where each of these perturbations is further adapted to an individual input signal from the training dataset to subsequently fool the classifier. This can be achieved, for example, using I-FGSM or PGD attack type algorithms to create adversarial examples.

[0073] Then, in a second step 602, a subset of the training data set is selected to serve as the training batch. To this end, a desired amount of input signals and corresponding desired output signals are randomly selected from the training data set.

[0074] In a third step 603, perturbations from the multiple perturbations are randomly drawn by pairwise replacement of input signals from the training batches with corresponding desired output signals.

[0075] In a fourth step 604, each of the derived perturbations is matched to their corresponding input signal and desired output signal, thereby creating adversarial examples for the classifier 60 when the perturbation is applied to the respective input signal. This can be achieved, for example, by running an I-FGSM or PGD attack type algorithm. For each perturbation, this step returns to a second perturbation matched to the respective input signal.

[0076] In a fifth step 605, each second perturbation is applied to each of the input signals to obtain a number of adversarial examples for the classifier 60.

[0077] In a sixth step 606, a classifier may be trained to predict a desired output signal for the adversarial examples obtained in the previous step. For this purpose, the classifier can be trained using (stochastic) gradient descent or an adapted form thereof (such as Adam). When training the classifier 60 in this way, the classifier predicts an output signal based on the adversarial examples. The predicted output signal is then compared to the desired output signal using a loss function. The classifier 60 is then adapted such that the loss value obtained from the loss function is small when the adversarial examples are reprocessed by the classifier and then the predicted output signal is compared to the desired output signal. For example, when a neural network is used as the classifier 60, for example, a number of parameters of the neural network are adapted according to the negative gradient of the parameters with respect to the loss value.

[0078] Additionally, the classifier may be trained using the input signal and the corresponding desired output signal without modification.

[0079] In a seventh step 607, each randomly drawn perturbation is replaced in the plurality of perturbations by a linear combination of itself and its corresponding second perturbation, for example, by the following relationship: l = (1-σ)·α1+σ·α2, where l is a linear combination, α1 is a perturbation, α2 is a second perturbation, and σ is a pre-determined value. This formulation can be understood as training the perturbation through meta-learning, where σ is analogous to the learning rate in gradient-based learning algorithms.

[0080] In an eighth step 608, steps 2 through 7 are repeated. These steps may be repeated, for example, until the loss value falls below a predetermined threshold. Alternatively, training may be performed for a predetermined number of iterations. When the desired number of iterations has been completed, the classifier 60 may be used in the control system 40.

[0081] Fig. 7 shows an embodiment of a training system 140 for carrying out the method shown in Fig. 6. A training data unit 150 is provided for the adapted input signal χ i To this end, the training data unit 150 accesses a computer-implemented training database St2 in which at least one set T of training data is stored. The set T includes pairs of input signals and corresponding desired output signals y i The set of training data T may be a full set of training data or a selected batch of training data if training is performed in batches. Additionally, the training data unit 150 receives a set of perturbations ξ from a computer-implemented perturbation database St3. The training data unit 150 then calculates a set of perturbations ξ for the input signal and the desired output signal y i , selecting a perturbation from the set of perturbations ξ, and applying the selected perturbation to the input signal, i Determine.

[0082] Then, the obtained adapted input signal χ i is the adapted input signal χ i Output signal from

number

number

[0083] After the desired number of iterations, the output signal

number

[0084] Then, the output signal

number

[0085] Then, in a further embodiment, the training process is repeated for a desired number of iterations, where an updated set of parameters Φ' is provided in each iteration as a set of parameters Φ by parameter storage St1, and an updated set of perturbations ξ' is provided as a set of perturbations ξ by perturbation database St3.

[0086] Further, training system 140 may include a processor 145 (or multiple processors) and at least one machine-readable storage medium 146 having stored thereon a plurality of instructions that, when executed, cause training system 140 to perform a training method according to an aspect of the present invention.

[0087] In yet another embodiment, the training unit 150 randomly selects at each iteration whether a perturbation should be applied to the input signal. If it determines that a perturbation should not be applied to the input signal, the classifier 60 selects the adapted input signal χ i and no perturbation updates are computed.

Claims

1. 1. A computer-implemented method for training a classifier (60) to classify an input signal (x) provided to the classifier (60), comprising: The classifier (60) is configured to obtain an output signal (y) characterizing a classification of the input signal (x), The method for training comprises: a. providing a set of perturbations (ξ) (601); b. Each input signal from a first data set (T) of training samples and a corresponding desired output signal (y ｉ providing (602) a first subset of training samples comprising: c. The input signals from the subset and the corresponding desired output signals (y ｉ selecting (603) a first perturbation from a set of perturbations (ξ) for d. The input signal, the corresponding desired output signal (y ｉ ) and adapting the first perturbation based on the classifier (60) to obtain a second perturbation that is stronger than the first perturbation (604); e. Applying the second perturbation to the input signal generates a first adversarial example (χ ｉ ) (605); f. To harden the classifier (60) against the second perturbation, the classifier (60) is trained on the first adversarial example (χ ｉ ) and the corresponding desired output signal (y ｉ ) adapting (606) the classifier (60) by training it based on g. Replacing (607) the first perturbation in the set of perturbations (ξ) by a linear combination of the first perturbation and the second perturbation; h. Repeating steps b through g (608); A computer-implemented method comprising:

2. 6. The method of claim 1, wherein the classifier is pre-trained on the first dataset or another dataset, and one or more perturbations from the set of perturbations are provided based on a corresponding second set of adversarial examples of the classifier (step 601).

3. The method of claim 2 , wherein a second adversarial example from the second set of adversarial examples is provided based on random noise.

4. 4. The method of claim 3, wherein the second adversarial examples are provided based on application of random noise at random positions of input signals from the first dataset.

5. i. selecting a subset of input signals from said first data set (T); j) adapting the input signals in said subset by scaling a number of values ​​in the input signals; k. applying adapted input signals as perturbations to the input signals of the first data set (T) to obtain a new set of input signals, each adapted input signal being applied to a number of input signals of the first data set (T), each input signal from the new set of input signals corresponding to an adapted input signal; l. determining a first value for each adapted input signal, the first value characterizing an ability of the corresponding adapted input signal to circumvent the classifier when used as a perturbation, the first value being determined based on an ability of a new input signal corresponding to the adapted input signal to circumvent the classifier (60); m. ranking the adapted input signals by their corresponding first values ​​and providing the best ranked desired amount of the adapted input signal as a perturbation; The method of claim 2 , wherein one or more perturbations from the set of perturbations (ξ) are provided (step 601) according to:

6. The classifier (60) is a first adversarial example (χ ｉ ) to the classifier and the corresponding desired output signal (y ｉ 6. The method of claim 1, wherein the adversarial examples are trained by using a vector of the adversarial examples as a desired output signal for the adversarial examples.

7. The method for training comprises: o. The classifier (60) is adapted to detect the input signal and the corresponding desired output signal (y ｉ ) and the training step based on The method of any one of claims 1 to 6, further comprising:

8. 1. A computer-implemented method for obtaining an output signal (y) characterizing a classification of an input signal (x), comprising: p. Training a classifier (60) according to the method of any one of claims 1 to 7; q. providing said classifier (60) to a control system (40); r. obtaining the output signal (y) from the control system (40), the control system (40) providing the input signal (x) to the classifier (60) to obtain the output signal (y); A computer-implemented method comprising:

9. 9. The method according to claim 8, wherein the input signal (x) is obtained based on a signal (S) of a sensor (30) and / or an actuator (10) is controlled based on the output signal (y) and / or a display device (10a) is controlled based on the output signal (y).

10. a control system (40) configured to control an actuator (10) and / or a display device (10a) based on an output signal (y) of a classifier (60), comprising: A control system (40) wherein the classifier is trained by a method according to any one of claims 1 to 7.

11. A computer program arranged to cause a computer to carry out all the steps of the method according to any one of claims 1 to 9 when said computer program is executed by a processor (45, 145).

12. A machine-readable storage medium (46, 146) having stored thereon a computer program according to claim 11.

13. A training system (140) configured to perform the method according to any one of claims 1 to 7.

Images