Asymmetric Robustness for Classification in Adversarial Environments

Abstract

To provide a calculation method and a computer system for training a classifier in adversarial environment.SOLUTION: In a calculation method by a control system, a receiving unit receives a training data set consisting of a pair of training input and output signals. A classifier is parameterized by parameters, and receives an allowable perturbation for class dependency as well as a loss function for each of at least two different classes which include an allowable perturbation of first class dependency for a first class and an allowable perturbation of second class dependency for a second class. The classifier partitions the training data set into a first subset labeled with a first label and a second subset labeled with a second label to calculate a first loss dependent on the allowable perturbation of first class dependency for the first subset and a second loss dependent on the allowable perturbation of second class dependency for the second subset.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to computational methods and computer systems for providing asymmetric robustness for classification in adversarial environments, including computational methods and computer systems for training classifiers (e.g., machine learning (ML) algorithms) in adversarial environments. [Background technology]

[0002] Background technology Supervised machine learning (ML) algorithms (also called classifiers) include deep learning algorithms built on deep neural networks. ML algorithms are susceptible to adversarial attacks on the input space. Classifiers:

number

[0003] Summary of the Invention According to one embodiment, a computational method for training a classifier is disclosed. The method includes receiving a training data set consisting of pairs of training input signals and corresponding output signals. The classifier is parameterized by a parameter and configured to classify input signals acquired from a sensor into at least two different classes including a first class and a second class. The method further includes receiving a class-dependent perturbation allowance for each of the at least two different classes including a first class-dependent perturbation allowance for the first class and a second class-dependent perturbation allowance for the second class. The method further includes receiving a loss function. The computational method also includes partitioning the training data set into a first subset labeled with a first label corresponding to the first class and a second subset labeled with a second label corresponding to the second class. The computational method also includes calculating a first loss according to the first subset and the first class-dependent perturbation allowance and a second loss calculated according to the second subset and the second class-dependent perturbation allowance. The computational method also includes updating the parameters in response to the first loss and the second loss to obtain updated parameters.

[0004] In a second embodiment, a non-transitory computer-readable medium is disclosed that includes computer-executable instructions and a memory for holding the computer-executable instructions. The computer-executable instructions, when executed by a processor of a computer, perform a function. The function includes receiving a training data set consisting of pairs of training input signals and corresponding output signals. The classifier is parameterized by a parameter and configured to classify input signals acquired from a sensor into at least two different classes including a first class and a second class. The function further includes receiving a class-dependent permissible perturbation for each of the at least two different classes including a first class-dependent perturbation for the first class and a second class-dependent perturbation for the second class. The function further includes receiving a loss function. The function further includes partitioning the training data set into a first subset labeled with a first label corresponding to the first class and a second subset labeled with a second label corresponding to the second class. The function also includes calculating a first loss responsive to the first subset and the allowable perturbation of the first class dependency and a second loss calculated responsive to the second subset and the allowable perturbation of the second class dependency. The function also includes updating parameters responsive to the first loss and the second loss to obtain updated parameters.

[0005] In another embodiment, a computer system is disclosed that includes a computer having a processor for executing computer-executable instructions and a memory for holding the computer-executable instructions. The computer-executable instructions, when executed by the processor of the computer, perform a function. The function includes receiving a training data set of pairs of training input signals and corresponding output signals. The classifier is parameterized by a parameter and configured to classify input signals acquired from a sensor into at least two different classes including a first class and a second class. The function further includes receiving a class-dependent permissible perturbation for each of the at least two different classes including a first class-dependent perturbation for the first class and a second class-dependent perturbation for the second class. The function further includes receiving a loss function. The function also includes partitioning the training data set into a first subset labeled with a first label corresponding to the first class and a second subset labeled with a second label corresponding to the second class. The function also includes calculating a first loss responsive to the first subset and the allowable perturbation of the first class dependency and a second loss calculated responsive to the second subset and the allowable perturbation of the second class dependency. The function also includes updating parameters responsive to the first loss and the second loss to obtain updated parameters. [Brief description of the drawings]

[0006] [Figure 1] FIG. 2 is a schematic diagram of the interaction between a computer controlled machine and a control system, according to one embodiment. [Diagram 2] FIG. 2 is a schematic diagram of the control system of FIG. 1 configured to control a vehicle, which may be a partially autonomous vehicle or a partially autonomous robot. [Diagram 3]2 is a schematic diagram of the control system of FIG. 1 configured to control a manufacturing machine, such as a punch cutter, cutter, or gun drill, of a manufacturing system, such as part of a production line. [Figure 4] 2 is a schematic diagram of the control system of FIG. 1 configured to control a power tool, such as a power drill or driver, having at least a partially autonomous mode. [Diagram 5] FIG. 2 is a schematic diagram of the control system of FIG. 1 configured to control an automated personal assistant. [Figure 6] FIG. 2 is a schematic diagram of the control system of FIG. 1 configured to control a monitoring system, such as a controlled access system or a supervisory system. [Figure 7] 2 is a schematic diagram of the control system of FIG. 1 configured to control an imaging system, for example an MRI device, an X-ray imaging device, or an ultrasound device. [Figure 8] FIG. 1 is a schematic diagram of a training system for training a classifier, according to one or more embodiments. [Figure 9] 1 is a flowchart of a computational method for training a classifier in accordance with one or more embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The embodiments of the present disclosure are described herein. However, it should be understood that the disclosed embodiments are merely examples, and that other embodiments may take various and alternative forms. The drawings are not necessarily to scale, and some features may be exaggerated or minimized to show the details of certain components. Therefore, specific structural and functional details disclosed herein should not be interpreted as limiting, but merely as a representative basis for teaching those skilled in the art to use the embodiments in various ways. As would be understood by one skilled in the art, various features illustrated and described with reference to any one of the drawings can be combined with features illustrated in one or more other drawings to form embodiments not explicitly illustrated or described. The combinations of the illustrated features provide representative embodiments for typical applications. However, various combinations and modifications of features consistent with the teachings of this disclosure may be desired for specific applications or implementations.

[0008] 1 shows a schematic diagram of the interaction between a computer-controlled machine 10 and a control system 12. The computer-controlled machine 10 includes an actuator 14 and a sensor 16. The actuator 14 may include one or more actuators, and the sensor 16 may include one or more sensors. The sensor 16 is configured to sense a state of the computer-controlled machine 10. The sensor 16 may be configured to encode the sensed state into a sensor signal 18 and transmit the sensor signal 18 to the control system 12. Non-limiting examples of the sensor 16 include video, radar, LiDAR, ultrasonic, and motion sensors. In one embodiment, the sensor 16 is an optical sensor configured to sense an optical image of an environment proximate to the computer-controlled machine 10.

[0009] The control system 12 is configured to receive sensor signals 18 from the computer-controlled machine 10. As described below, the control system 12 may be further configured to calculate actuator control commands 20 in response to the sensor signals and to transmit the actuator control commands 20 to the actuators 14 of the computer-controlled machine 10.

[0010] As shown in Fig. 1, the control system 12 includes a receiving unit 22. The receiving unit 22 may be configured to receive the sensor signals 18 from the sensors 16 and convert the sensor signals 18 into input signals x. In an alternative embodiment, the sensor signals 18 are directly received as input signals x without the receiving unit 22. Each input signal x may be a part of each sensor signal 18. The receiving unit 22 may be configured to process each sensor signal 18 to generate a respective input signal x. The input signal x may include data corresponding to an image recorded by the sensor 16.

[0011] The control system 12 includes a classifier 24. The classifier 24 may be configured to classify an input signal x into one or more labels using a machine learning (ML) algorithm, such as a neural network. The classifier 24 is configured to be parameterized by a parameter θ. The parameter θ may be stored in and provided by a non-volatile storage device 26. The classifier 24 is configured to determine an output signal y from the input signal x. Each output signal y includes information that assigns one or more labels to each input signal x. The classifier 24 may transmit the output signal y to a conversion unit 28. The conversion unit 28 is configured to convert the output signal y into an actuator control command 20. The control system 12 is configured to transmit the actuator control command 20 to the actuator 14, which is configured to operate the computer-controlled machine 10 in response to the actuator control command 20. In another embodiment, the actuator 14 is configured to operate the computer-controlled machine 10 based directly on the output signal y.

[0012] When the actuator 14 receives an actuator control command 20, the actuator 14 is configured to perform an action corresponding to the associated actuator control command 20. The actuator 14 may include control logic configured to convert the actuator control command 20 into a second actuator control command that is utilized to control the actuator 14. In one or more embodiments, the actuator control command 20 may be utilized to control a display instead of or in addition to an actuator.

[0013] In other embodiments, the control system 12 includes a sensor 16 instead of, or in addition to, a computer-controlled machine 10 including a sensor 16. The control system 12 may also include an actuator 14 instead of, or in addition to, a computer-controlled machine 10 including an actuator 14.

[0014] 1, the control system 12 also includes a processor 30 and a memory 32. The processor 30 may include one or more processors. The memory 32 may include one or more memory devices. The classifier 24 (e.g., an ML algorithm) of one or more embodiments may be implemented by the control system 12, which includes the non-volatile storage 26, the processor 30, and the memory 32.

[0015] The non-volatile storage 26 may include one or more permanent data storage devices, such as a hard drive, an optical drive, a tape drive, a non-volatile solid state device, a cloud storage device, or any other device that may store information permanently. The processor 30 may include one or more devices selected from a high performance computing (HPC) system, including a high performance core, a microprocessor, a microcontroller, a digital signal processor, a microcomputer, a central processing unit, a field programmable gate array, a programmable logic device, a state machine, a logic circuit, an analog circuit, a digital circuit, or any other device that manipulates signals (analog or digital) based on computer executable instructions resident in the memory 32. The memory 32 may include a single memory device or multiple memory devices, including but not limited to a random access memory (RAM), a volatile memory, a non-volatile memory, a static random access memory (SRAM), a dynamic random access memory (DRAM), a flash memory, a cache memory, or any other device that may store information.

[0016] The processor 30 can be configured to execute computer-executable instructions loaded into the memory 32 and resident in the non-volatile storage 26 and embodying one or more ML algorithms and / or methodologies of one or more embodiments. The non-volatile storage 26 can include one or more operating systems and applications. The non-volatile storage 26 can store compiled and / or interpreted computer programs written using a variety of programming languages ​​and / or technologies, including, but not limited to, Java, C, C++, C#, Objective C, Fortran, Pascal, Java Script, Python, Perl, and PL / SQL, either alone or in combination.

[0017] When executed by processor 30, the computer-executable instructions in non-volatile storage 26 can cause control system 12 to implement one or more of the ML algorithms and / or methodologies disclosed herein. Non-volatile storage 26 can also include ML data (including data parameters) that support the functions, features and processes of one or more embodiments described herein.

[0018] Program code embodying the algorithms and / or methodologies described herein may be distributed individually or collectively as a program product in various different forms. The program code may be distributed using a computer-readable storage medium having computer-readable program instructions for causing a processor to execute aspects of one or more embodiments. Computer-readable storage media, which are non-transitory in nature, may include volatile and non-volatile, removable and non-removable tangible media implemented by any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer-readable storage media may further include RAM, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other solid-state memory technology, portable compact disk read-only memory (CD-ROM), or other optical storage devices, magnetic cassettes, magnetic tapes, magnetic disk storage devices, or other magnetic storage devices, or other media that may be used to store desired information and that may be read by a computer. The computer readable program instructions may be downloaded from the computer readable storage medium into a computer, other type of programmable data processing apparatus or other device, or via a network to an external computer or external storage device.

[0019] Computer-readable program instructions stored on a computer-readable medium may be used to instruct a computer, other type of programmable data processing apparatus, or other device to function in a particular manner, such that the instructions stored on the computer-readable medium produce an article of manufacture that includes instructions that perform the functions, acts, and / or operations specified in the flowcharts or figures. In certain alternative embodiments, the functions, acts, and / or operations specified in the flowcharts and figures may be reordered, processed sequentially, and / or processed simultaneously, consistent with one or more embodiments. Additionally, any of the flowcharts and / or figures may include more or fewer nodes or blocks than those illustrated, consistent with one or more embodiments.

[0020] The processes, methods or algorithms may be implemented in whole or in part using suitable hardware components, such as application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), state machines, controllers or other hardware components or devices, or a combination of hardware, software and firmware components.

[0021] FIG. 2 shows a schematic diagram of the control system 12 configured to control a vehicle 50, which may be an at least partially autonomous vehicle or an at least partially autonomous robot. As shown in FIG. 2, the vehicle 50 includes actuators 14 and sensors 16. The sensors 16 may include one or more video sensors, radar sensors, ultrasonic sensors, LiDAR sensors, and / or location sensors (e.g., GPS). One or more of the one or more specific sensors may be integrated into the vehicle 50. Alternatively or in addition to the one or more specific sensors identified above, the sensors 16 may include a software module configured to determine, upon execution, a state of the actuators 14. One non-limiting example of a software module includes a weather information software module configured to determine current or future weather conditions proximate the vehicle 50 or other location.

[0022] The classifier 24 of the control system 12 of the vehicle 50 may be configured to detect an object in the vicinity of the vehicle 50 in response to the input signal x. In such an embodiment, the output signal y may include information characterizing the proximity of the object relative to the vehicle 50. The actuator control commands 20 may be determined according to this information. The actuator control commands 20 may be used to avoid a collision with the detected object.

[0023] In embodiments where the vehicle 50 is an at least partially autonomous vehicle, the actuators 14 may be incorporated into the brakes, propulsion system, engine, drive train, or steering of the vehicle 50. The actuator control commands 20 may be determined to control the actuators 14 such that the vehicle 50 avoids a collision with the detected object. The detected object may also be classified according to what the classifier 24 considers most likely, such as a pedestrian or a tree. The actuator control commands 20 may be determined in response to the classification.

[0024] In other embodiments where the vehicle 50 is an at least partially autonomous robot, the vehicle 50 may be a mobile robot configured to perform one or more functions such as flying, swimming, diving, and stepping. The mobile robot may be an at least partially autonomous lawnmower or an at least partially autonomous vacuum cleaner. In such embodiments, the actuator control commands 20 may be determined to control the propulsion, steering, and / or braking units of the mobile robot such that the mobile robot avoids a collision with the identified object.

[0025] In other embodiments, the vehicle 50 is an at least partially autonomous robot in the form of a horticultural robot. In such embodiments, the vehicle 50 may use an optical sensor as the sensor 16 to identify the condition of plants in an environment proximate to the vehicle 50. The actuator 14 may be a nozzle configured to spray a chemical. Depending on the identified species and / or the identified condition of the plant, the actuator control command 20 may be determined to cause the actuator 14 to spray an appropriate amount of an appropriate chemical on the plant.

[0026] The vehicle 50 may be an at least partially autonomous robot in the form of a household appliance. Non-limiting examples of the household appliance include a washing machine, a stove, an oven, a microwave oven, or a dishwasher. In such a vehicle 50, the sensor 16 may be an optical sensor configured to detect a state of an object undergoing treatment by the appliance. For example, if the household appliance is a washing machine, the sensor 16 may detect a state of laundry in the washing machine. The actuator control command 20 may be determined based on the detected state of the laundry.

[0027] 3 shows a schematic diagram of a control system 12 configured to control a manufacturing machine 100, such as a punch cutter, cutter or gun drill, of a manufacturing system 102, such as part of a production line. The control system 12 may be configured to control an actuator 14 configured to control the manufacturing machine 100.

[0028] The sensor 16 of the manufacturing machine 100 may be an optical sensor configured to capture one or more characteristics of the manufactured product 104. The classifier 24 may be configured to determine a state of the manufactured product 104 from the one or more captured characteristics. The actuator 14 may be configured to control the manufacturing machine 100 for a subsequent manufacturing step of the manufactured product 104 in response to the determined state of the manufactured product 104. The actuator 14 may be configured to control a function of the manufacturing machine 100 on a subsequent manufactured product 106 of the manufacturing machine 100 in response to the determined state of the manufactured product 104.

[0029] 4 shows a schematic diagram of a control system 12 configured to control a power tool 150, such as a power drill or driver, having an at least partially autonomous mode. The control system 12 may be configured to control an actuator 14 configured to control the power tool 150.

[0030] The sensor 16 of the power tool 150 may be an optical sensor configured to capture one or more characteristics of the work surface 152 and / or the fastener 154 to be driven into the work surface 152. The classifier 24 may be configured to determine a state of the work surface 152 and / or the fastener 154 relative to the work surface 152 from the one or more captured characteristics. The state may be the fastener 154 being flush with the work surface 152. Alternatively, the state may be the hardness of the work surface 152. The actuator 14 may be configured to control the power tool 150 such that a drive function of the power tool 150 is adjusted in response to the determined state of the fastener 154 relative to the work surface 152 or the one or more captured characteristics of the work surface 152. For example, the actuator 14 may discontinue a drive function when the state of the fastener 154 is flush with the work surface 152. As another non-limiting example, the actuator 14 may apply additional or reduced torque depending on the hardness of the working surface 152 .

[0031] 5 shows a schematic diagram of a control system 12 configured to control an automated personal assistant 200. The control system 12 may be configured to control an actuator 14 configured to control the automated personal assistant 200. The automated personal assistant 200 may be configured to control a household appliance such as a washing machine, a stove, an oven, a microwave oven or a dishwasher.

[0032] The sensor 16 may be an optical sensor and / or an acoustic sensor. The optical sensor may be configured to receive video images of the gestures 204 of the user 202. The acoustic sensor may be configured to receive voice commands of the user 202.

[0033] The control system 12 of the automated personal assistant 200 may be configured to determine actuator control commands 20 configured to control the system 12. The control system 12 may be configured to determine the actuator control commands 20 according to the sensor signals 18 of the sensors 16. The automated personal assistant 200 is configured to transmit the sensor signals 18 to the control system 12. The classifier 24 of the control system 12 may be configured to execute a gesture recognition algorithm to identify a gesture 204 made by the user 202, to determine the actuator control commands 20, and to transmit the actuator control commands 20 to the actuators 14. The classifier 24 may be configured to retrieve information from the non-volatile storage in response to the gesture 204 and output the retrieved information in a form suitable for receipt by the user 202.

[0034] 6 shows a schematic diagram of the control system 12 configured to control a surveillance system 250. The surveillance system 250 may be configured to physically control access via a door 252. The sensor 16 may be configured to detect a scene relevant to determining whether access is permitted. The sensor 16 may be an optical sensor configured to generate and transmit image and / or video data. Such data may be used by the control system 12 to detect human faces.

[0035] The classifier 24 of the control system 12 of the surveillance system 250 may be configured to interpret the image and / or video data by matching known person identities stored in the non-volatile storage 26, thereby determining the identity of the person. The classifier 12 may be configured to generate an actuator control command 20 in response to interpreting the image and / or video data. The control system 12 is configured to transmit the actuator control command 20 to the actuator 14. In this embodiment, the actuator 14 may be configured to lock or unlock the door 252 in response to the actuator control command 20. In other embodiments, non-physical, logical access control is also possible.

[0036] The surveillance system 250 may also be a supervisory system. In such an embodiment, the sensor 16 may be an optical sensor configured to detect a scene under supervision, and the control system 12 is configured to control the display 254. The classifier 24 is configured to identify a classification of the scene, e.g., whether the scene detected by the sensor 16 is suspicious. The control system 12 is configured to send actuator control commands 20 to the display 254 in response to the classification. The display 254 may be configured to adjust the displayed content in response to the actuator control commands 20. For example, the display 254 may highlight objects deemed suspicious by the classifier 24.

[0037] 7 shows a schematic diagram of the control system 12 configured to control an imaging system 300, e.g., an MRI device, an X-ray imaging device, or an ultrasound device. The sensor 16 may be, for example, an imaging sensor. The classifier 24 may be configured to determine a classification of all or part of the sensed image. The classifier 24 may be configured to determine or select an actuator control command 20 depending on the classification. For example, the classifier 24 may interpret a region of the sensed image as potentially anomalous. In this case, the actuator control command 20 may be determined or selected to cause the display 302 to display the image and highlight the potentially anomalous region.

[0038] Classifiers may be subject to adversarial attacks that can cause dramatic changes in the classifier's output and behavior. There are defenses against adversarial attacks in supervised classification scenarios, as well as empirical defenses against adversarial examples (adversarial training). These defenses work in a class-independent manner.

[0039] In one proposal, to reduce this problem, a robust classifier can be trained such that the classifier exhibits some robustness to changes in the input at the expense of unperturbed performance. In such a scenario, the loss function can be optimized for the worst-case scenario by optimizing the loss function for the worst possible perturbation (or an approximation thereof) applied to each sample. Thus, the classifier:

number

number

[0040] In a robust training procedure P, we can approximate the robust loss by finding adversarial examples δ∈Δ and optimizing for x+δ, thereby finding the exact value of the robust version of the loss, or any other approximation (lower or upper bound) of it, by placing an upper bound on the loss for x+δ ​​for any δ∈Δ. The resulting robust classifier exhibits the advantage of an increased degree of robustness with respect to test-time perturbations across all classes, but at the expense of reduced test-time classification performance across all classes.

[0041] The robustness is symmetric by design. The classifier trades off performance across all K classes so that Δ is equivalent for all classes. This creates significant problems in situations where misclassification outcomes are uneven. By increasing robustness to perturbations on one class, the classifier also becomes robust to perturbations across all other classes. In the specific example of fault detection, robustness to perturbations on non-faults may cause the classifier to misclassify faults as non-faults, causing significant consequences. On the other hand, small perturbations on faults are still faults. Thus, the classifier should be robust to fault perturbations. Thus, there is a need for a computational method for asymmetrically providing robustness to a classifier, and a computer system for asymmetrically providing robustness to a classifier.

[0042] In one or more embodiments, the features

number

[0043] A classifier can be trained from the labeled data to create an asymmetrically robust classifier. The classifier can be trained over training data that occurs over different classes, e.g., a first loss and a second different class. In one or more embodiments, the perturbations in the adversarial examples or worst-case scenarios are class-dependent. Thus, different classes may have different sets of perturbations that are allowed. In one or more embodiments, the misclassification risks and the consequences of these risks are asymmetric, and the asymmetrically robust classification system has the advantage that classification problems can be addressed when the attacker or acquisition process has class-dependent characteristics or when the classification performance vs. robustness tradeoff is class-independent (e.g., automated optical inspection, fault identification, mission-critical classification systems, etc.).

[0044] 8 shows a schematic diagram of a training system 350 for training the classifier 24 in accordance with one or more embodiments. The training unit 352 is configured to determine an input signal x and transmit the input signal x to the classifier 24. In one embodiment, the training unit 352 accesses a non-volatile storage device 354 to receive a set of training data X={(x1, y1), ..., (x n ,y n The non-volatile storage 354 is also configured to store the loss function L. The non-volatile storage 354 is also configured to store a set of class-dependent allowed perturbations D=Δ1, ..., Δ KThe training system 350 may further include a processor 356 and a memory 358. The processor 356 may include one or more processors. The memory 358 may include one or more memory devices. The ML algorithms of one or more embodiments may be implemented by the training system 350, which includes the non-volatile storage 354, the processor 356, and the memory 358.

[0045] The training system 350 is configured to execute a robust training procedure P to find a solution or an approximate solution for learning a classifier f parameterized by θ, such that a robust loss is minimized with respect to θ. The robust training procedure P may be an asymmetric robust classifier configured to be trained by the training system 350 by extending a robust loss function to allow for separation into classes. The training results in K different robust loss functions computed on partitions of the training set across the K different classes. The final classifier parameters may be obtained by summing the K different loss functions across the partitions of the training set.

[0046] 9 shows a flowchart 400 of a computational method for training the classifier 24 according to one embodiment. The computational method can be executed and implemented using the training system 350. The computational method for training the classifier 24 can be denoted by a robust training procedure P.

[0047] In step 402, input to the training method is received. In one embodiment, the input comprises a training data set consisting of pairs of training input signals and corresponding output signals. The training data set is: X = {(x1,y1),…,(x n ,y n )} (2) It can be expressed as:

[0048] In this embodiment, the inputs further include a classifier 24, which may be represented by f, and is parameterized by a parameter, which may be denoted by θ. The classifier 24 may be configured to classify input signals obtained from one or more sensors disclosed herein into at least two different classes. In this embodiment, the inputs may further include a stop condition S, e.g., a binary stop condition. The binary stop condition S may be initialized to a pre-determined starting value, e.g., false. The inputs may include a stop condition S, e.g., a binary stop condition S, which may be initialized to a pre-determined starting value, e.g., false. D=Δ1,…,Δ K (3) Further included are class-dependent perturbations for each of the at least two different classes, which may be expressed as: where Δ1 is the class-dependent perturbation for the first class, and Δ K is the class-dependent tolerable perturbation of the Kth class. The class-dependent tolerable perturbation may be different for each of the at least two different classes. The input may further include a loss function, which may be denoted by L. The loss function L may be configured to optimize a parameter θ of the classifier 24 of the ML algorithm.

[0049] In step 404, a stopping condition S may be initialized. The stopping condition S may be a binary stopping condition. The stopping condition S may be initialized as false. In certain embodiments, the classifier 24 may be a parallelizable robust training procedure L. In such embodiments, the classifier 24 may be trained using parallel training steps shown as branch 406 of the training system 350 depicted in the flowchart 400. In other embodiments, the classifier 24 may not be parallelizable. In such other embodiments, the classifier 24 may be trained using training steps shown as branch 408 of the training system 350 depicted in the flowchart 400.

[0050] In step 410 of branch 408, the total loss L of the total loss function L is calculated.Total tends to 0 (i.e., L Total ←0). In one or more embodiments, steps 412 and 414 are performed repeatedly in a class loop 416 for i, 1, ..., K, where i is each label of class K, when the stopping condition is a particular value or range of values.

[0051] In step 412, sample subsets are defined such that the training dataset is partitioned into different subsets having different labels. The training dataset may be partitioned into a first subset labeled with a first label corresponding to a first class and a second subset labeled with a second label corresponding to a second class. For each label i of each class K, X i Let X contain all samples with label i. i We can define ⊂X.

[0052] In step 414, the total loss L Total is the subset X for each label i i ⊂X. The total loss can be updated to include a robust loss in the i-th class according to a respective set of allowable perturbations for the i-th class. The update of the total loss in this scheme is given by:

number

[0053] In step 418, the stopping condition S is updated according to the updated total loss. The stopping condition S may be updated using stopping rules that determine when to stop training the classifier 24. The stopping condition S is updated to false according to the number of stopping rules that determine to continue training the classifier 24. The stopping condition S is updated to true according to the number of stopping rules that determine to stop training the classifier 24. As indicated by loop 416, branch 408 continues to execute steps 412 and 414 while the stopping condition S is false. As indicated by arrow 420, branch 408 ceases execution of steps 412 and 414 once step 418 sets the stopping condition S to true.

[0054] In step 422, the classifier parameters are updated by applying a training method (e.g., a robust training procedure P) to the optimization problem. In one embodiment, the optimization problem is:

number

[0055] As mentioned above, classifier 24 may be trained using parallel training steps identified in branch 406 if classifier 24 is parallelizable. In one or more embodiments, steps 424 and 426 are performed repeatedly for i 1,...,K, where i is each label of class K, in a class loop 428 when a stopping condition is a particular value or range of values.

[0056] In step 424, sample subsets are defined such that the training dataset is partitioned into different subsets having different labels. The training dataset may be partitioned into a first subset labeled with a first label corresponding to a first class and a second subset labeled with a second label corresponding to a second class. For each label i of each class K, X i Let X contain all samples with label i. i We can define ⊂X.

[0057] In step 426, the classifier parameters are updated in parallel by applying a training method (e.g., a robust training procedure P) to the optimization problem. In one embodiment, the optimization problem is:

number

[0058] In step 430, the stopping condition S is updated according to the updated classifier parameters determined in step 422. The stopping condition S may be updated using stopping rules that determine when to stop training the classifier 24. The stopping condition S is updated to false according to the number of stopping rules that determine to continue training the classifier 24. The stopping condition S is updated to true according to the number of stopping rules that determine to stop training the classifier 24. As indicated by loop 428, branch 406 continues to execute steps 424 and 426 while the stopping condition S is false. As indicated by arrow 432, branch 406 ceases execution of steps 424 and 426 once step 430 sets the stopping condition S to true.

[0059] In one embodiment, the set of allowed perturbations Δ can be described in terms of perception. The perturbation Δ may be equal to {δ:D(x)=D(x+δ)}, where D is a discriminator configured to distinguish whether the input signal x has a perturbation (0) or no perturbation (1), such that the perturbations Δ are the set for which the discriminator D cannot distinguish data with the perturbation from data without the perturbation. The discriminator D may be automatic or manual.

[0060] In other embodiments, the asymmetric robustness of the training process can be applied to a generative model instead of a classifier, where the variability of the generative model's robustness to changes in the input is related to the presence of class labels for the input. In certain embodiments, the generative model may be a conditional generative model.

[0061] Although exemplary embodiments have been described above, these embodiments are not intended to describe all possible forms that fall within the scope of the claims. The terms used herein are terms of description rather than limitation, and it will be understood that various changes may be made without departing from the spirit and scope of the disclosure. As noted above, features of various embodiments may be combined to form further embodiments of the invention, even if not expressly described or shown. Although various embodiments have been described as advantageous or preferred over other embodiments or prior art implementations with respect to one or more desired characteristics, those skilled in the art will recognize that, depending on the particular application and implementation, one or more features or characteristics may be compromised to achieve the desired overall system attributes. These attributes may include, but are not limited to, cost, strength, durability, life cycle cost, marketability, appearance, packaging, size, maintainability, weight, manufacturability, ease of assembly, and the like. Thus, to the extent that any embodiment is described as less desirable than other embodiments or prior art implementations with respect to one or more characteristics, these embodiments do not fall within the scope of the present disclosure and may be desirable for the particular application.

Claims

1. 1. A computer-implemented computational method for training a classifier, comprising: receiving a training data set of training input signal and corresponding output signal pairs, the classifier being parameterized by parameters and configured to classify input signals acquired from a sensor into at least two distinct classes including a first class and a second class, and further receiving class-dependent perturbations for each of the at least two distinct classes, the perturbations including a first class-dependent perturbation for the first class and a second class-dependent perturbation for the second class, and a loss function; partitioning the training data set into a first subset labeled with a first label corresponding to the first class and a second subset labeled with a second label corresponding to the second class; calculating a first loss according to the first subset and the allowable perturbation of the first class dependency, and a second loss calculated according to the second subset and the allowable perturbation of the second class dependency; updating the parameters in response to the first loss and the second loss to obtain updated parameters; Calculation methods including:

2. sending the input signal obtained from the sensor to the classifier parameterized by the updated parameters to obtain an output signal configured to characterize a classification of the input signal; sending actuator control commands to actuators of a computer controlled machine in response to said output signals; Further comprising: The calculation method according to claim 1 .

3. The updating step is performed by a machine learning (ML) algorithm. The calculation method according to claim 1 .

4. the partitioning and calculating steps are repeatedly performed in a class loop while a stopping condition is a predetermined value. The calculation method according to claim 1 .

5. the partitioning and updating steps are repeatedly performed in a class loop while a stopping condition is a predetermined value. The calculation method according to claim 1 .

6. the first class-dependent allowable perturbation and the second class-dependent allowable perturbation are in a set in which a discriminator cannot distinguish data with the perturbation from data without the perturbation. The calculation method according to claim 1 .

7. the first label is different from the second label; The calculation method according to claim 1 .

8. A non-transitory computer-readable medium including computer-executable instructions for implementing a computational method for training a classifier and a memory for holding said computer-executable instructions, the computer-executable instructions, when executed by a processor of a computer, performing the following functions: receiving a training data set of training input signal and corresponding output signal pairs, the classifier being parameterized by parameters and configured to classify input signals acquired from a sensor into at least two distinct classes including a first class and a second class, and further receiving class-dependent perturbations for each of the at least two distinct classes, the perturbations including a first class-dependent perturbation for the first class and a second class-dependent perturbation for the second class, and a loss function; partitioning the training data set into a first subset labeled with a first label corresponding to the first class and a second subset labeled with a second label corresponding to the second class; a function for calculating a first loss according to the first subset and the allowable perturbation of the first class dependency, and a second loss calculated according to the allowable perturbation of the second subset and the second class dependency; updating the parameters in response to the first loss and the second loss to obtain updated parameters; A non-transitory computer-readable medium for executing the method of the present invention.

9. The computer executable instructions, when executed by the processor of the computer, perform the following functions: sending the input signal obtained from the sensor to the classifier parameterized by the updated parameters to obtain an output signal configured to characterize a classification of the input signal; sending actuator control commands to actuators of a computer controlled machine in response to said output signals; Execute The non-transitory computer-readable medium of claim 8.

10. The updating function is performed by a machine learning (ML) algorithm. The non-transitory computer-readable medium of claim 8.

11. The partitioning function and the calculating function are repeatedly executed in a class loop while a stopping condition is a predetermined value. The non-transitory computer-readable medium of claim 8.

12. The partitioning and updating functions are executed repeatedly within a class loop while a stopping condition is a predetermined value. The non-transitory computer-readable medium of claim 8.

13. the first class-dependent allowable perturbation and the second class-dependent allowable perturbation depend on a discriminator that cannot distinguish data with the perturbation from data without the perturbation. The non-transitory computer-readable medium of claim 8.

14. the first label is different from the second label; The non-transitory computer-readable medium of claim 8.

15. A computer system comprising a computer having a processor for executing computer-executable instructions for implementing a computational method for training a classifier, and a memory for holding said computer-executable instructions, the computer-executable instructions, when executed by the processor of the computer, performing the following functions: receiving a training data set of training input signal and corresponding output signal pairs, the classifier being parameterized by parameters and configured to classify input signals acquired from a sensor into at least two distinct classes including a first class and a second class, and further receiving class-dependent perturbations for each of the at least two distinct classes, the perturbations including a first class-dependent perturbation for the first class and a second class-dependent perturbation for the second class, and a loss function; partitioning the training data set into a first subset labeled with a first label corresponding to the first class and a second subset labeled with a second label corresponding to the second class; a function for calculating a first loss according to the first subset and the allowable perturbation of the first class dependency, and a second loss calculated according to the allowable perturbation of the second subset and the second class dependency; updating the parameters in response to the first loss and the second loss to obtain updated parameters; A computer system that executes

16. The computer executable instructions, when executed by the processor of the computer, perform the following additional functions: sending the input signal obtained from the sensor to the classifier parameterized by the updated parameters to obtain an output signal configured to characterize a classification of the input signal; sending actuator control commands to actuators of a computer controlled machine in response to said output signals; Execute 16. The computer system of claim 15.

17. The updating function is performed by a machine learning (ML) algorithm.

16. The computer system of claim 15.

18. The partitioning function and the calculating function are repeatedly executed in a class loop while a stopping condition is a predetermined value.

16. The computer system of claim 15.

19. The partitioning and updating functions are executed repeatedly within a class loop while a stopping condition is a predetermined value.

16. The computer system of claim 15.

20. the first class-dependent allowable perturbation and the second class-dependent allowable perturbation depend on a discriminator that cannot distinguish data with the perturbation from data without the perturbation.

16. The computer system of claim 15.

Images