Method and system for separating and recalibrating features for adversarial robustness

Abstract

A method and a system for separating and recalibrating features for adversarial robustness are disclosed. The method for separating and recalibrating features, according to one embodiment, may comprise the steps of: separating, on the basis of a robustness score, an input feature map into a first feature defined as a robust feature and a second feature defined as a non-robust feature; generating a recalibrated feature by recalibrating activation of the second feature; and generating an output feature map by combining the first feature and the recalibrated feature.

Description

Feature Separation and Recalibration Method and System for Adversarial Robustness

[0001] The following description relates to a method and system for feature separation and recalibration for adversarial robustness.

[0002] Adversarial defense refers to techniques or methods that protect AI models against inputs containing small amounts of noise or distortion, known as adversarial examples. Adversarial examples are inputs that appear similar to regular inputs but are designed to trigger incorrect or erroneous model outputs. "Adversarial" here refers to inputs that appear similar to human eyes but produce significant differences to machine learning models. These adversarial examples can be used to exploit security vulnerabilities or degrade the performance of AI models, making adversarial defense a critical security and reliability issue. A representative adversarial defense technique is adversarial training, which involves adding adversarial examples to training data to make the model more resilient to adversarial attacks.

[0003] Existing deep neural networks are vulnerable to adversarial attacks, resulting in problems caused by cumulative distortion at the feature level. Existing adversarial defense techniques utilize feature deactivation to disable vulnerable features and improve model robustness. While this approach increases resilience against adversarial attacks, the deactivated features may still contain useful information. This can limit model performance and accuracy.

[0004] A method and system for feature separation and recalibration for adversarial robustness are provided.

[0005] A feature separation and recalibration method of a computer device including at least one processor, the method comprising: separating an input feature map into a first feature defined as a robust feature and a second feature defined as a non-robust feature based on a robustness score by the at least one processor; recalibrating activation of the second feature to generate a recalibrated feature; and combining the first feature and the recalibrated feature by the at least one processor to generate an output feature map.

[0006] According to one aspect, the separating step may be characterized by including: a step of generating a robustness map of the input feature map through a separation network trained to learn the robustness of a feature and output a robustness map representing a robustness score of a feature map unit; a step of generating a binary mask based on the robustness map; and a step of applying the binary mask to the input feature map to separate the first feature and the second feature.

[0007] According to another aspect, the step of generating the binary mask may be characterized by generating a binary mask having a differentiable soft mask using Gumbel softmax.

[0008] According to another aspect, the step of separating the first feature and the second feature may be characterized in that the first feature is obtained by calculating an element-wise product between the input feature map and a positive mask among the binary masks, and the second feature is obtained by calculating an element-wise product between the input feature map and a negative mask among the binary masks.

[0009] According to another aspect, the separation network may include an auxiliary layer based on a Multi-Layer Perceptron (MLP) trained to use each of the first feature and the second feature as inputs and output a first feature score for the first feature and a second feature score for the second feature, wherein the auxiliary layer may be characterized in that the separation network, based on a separation loss, guides the separation network to assign a relatively higher robustness score to the first feature based on preserved activations in a positive mask among the binary masks.

[0010] According to another aspect, the separation loss may be characterized in that it is calculated based on the first feature score, the second feature score, the ground truth label, and the label corresponding to the class that received the highest prediction score among the classes incorrectly predicted in the final output of the model.

[0011] According to another aspect, the step of generating the recalibrated feature may include the steps of: generating a recalibration unit by adjusting the activation of the second feature through a recalibration network trained to input a feature and adjust the activation of the feature; applying a negative mask among binary masks generated based on a robustness map of the input feature map to the recalibration unit; and calculating the recalibrated feature by combining the recalibration unit to which the negative mask is applied and the second feature.

[0012] According to another aspect, the recalibration network may include an auxiliary layer that receives the second feature as input and outputs an output prediction score, and the auxiliary layer may be characterized in that it guides the recalibration network to adjust the activation of the second feature based on the recalibration loss so as to provide a signal related to the ground truth label.

[0013] According to another aspect, the recalibration loss may be characterized in that it is calculated through the ground truth label and the output prediction score.

[0014] A computer program stored on a computer-readable recording medium is provided for executing the above method on a computer device in combination with a computer device.

[0015] A computer-readable recording medium having recorded thereon a program for executing the above method on a computer device is provided.

[0016] A computer device is provided, comprising at least one processor configured to execute instructions readable by a computer device, characterized in that the at least one processor separates an input feature map into a first feature defined as a robust feature based on a robustness score and a second feature defined as a non-robust feature, recalibrates activation of the second feature to generate a recalibrated feature, and combines the first feature and the recalibrated feature to generate an output feature map.

[0017] A method and system for feature separation and recalibration for adversarial robustness can be provided.

[0018] FIG. 1 is a diagram illustrating examples of images acquired through an adversarial training model equipped with an FSR module according to one embodiment of the present invention.

[0019] FIG. 2 is a drawing illustrating an example of an FSR module according to one embodiment of the present invention.

[0020] FIG. 3 is a block diagram illustrating an example of a computer device according to one embodiment of the present invention.

[0021] FIG. 4 is a flowchart illustrating an example of a feature separation and recalibration method according to one embodiment of the present invention.

[0022] The present invention can be modified in various ways and has various embodiments. Hereinafter, specific embodiments will be described in detail based on the attached drawings.

[0023] In describing the present invention, if it is determined that a detailed description of a related known technology may obscure the gist of the present invention, the detailed description is omitted.

[0024] Deep neural networks are vulnerable to adversarial attacks due to accumulated perturbations at the feature level. Numerous studies have improved model robustness by disabling non-robust feature activations that lead to model prediction errors. However, these malicious activations still contain discriminatory signals, and recalibration can capture additional useful information for correct model predictions. To this end, embodiments of the present invention present a novel, pluggable approach called Feature Separation and Recalibration (FSR), which recalibrates non-robust activations against more robust feature maps through separation and recalibration. The separation part separates the input feature map into robust features by dividing activations that contribute to correct model predictions, and non-robust features by activations that contribute to incorrect model predictions under adversarial attacks. The recalibration part then adjusts the non-robust activations to recover signals potentially useful for model predictions. Extensive experiments demonstrate the superiority of FSR over existing deactivation techniques, demonstrating that it improves the robustness of existing adversarial training methods by up to 8.57% with small computational overhead.

[0025] Despite advances in deep neural networks (DNNs) for computer vision tasks, DNNs remain vulnerable to maliciously crafted adversarial examples, which add imperceptible noise to natural images to subvert the model's decisions. Adversarial examples have proven successful in real-world applications, including autonomous driving and biometrics, and are known to be effective even when the target model is unknown to the attacker. Therefore, devising effective defense strategies against these vulnerabilities has become crucial.

[0026] To achieve this, various defense techniques have been proposed, including defensive distillation, input denoising, and attack detection. Among these methods, adversarial training, which strengthens a model by training it on a set of worst-case adversarial examples, has been considered the most successful and popular.

[0027] However, even with adversarial training, small pixel-level adversarial perturbations accumulate significantly in the intermediate feature space, corrupting the final model output. To address this issue, recent advanced methods have isolated and deactivated inertial feature activations that cause incorrect model predictions. For example, approaches have employed classical denoising techniques to deactivate disrupted activations or deactivate channels irrelevant to the correct model decision. However, these approaches inevitably ignore potential discriminatory signals present in inertial activations. Meanwhile, research has shown that models can learn discriminatory information from inertial features in the input space. Based on these findings, the presence of potentially discriminatory signals in inertial activations, and deactivating them, may result in the loss of useful information that could better guide the model to make correct predictions.

[0028] In embodiments of the present invention, non-robust activations that induce model prediction errors can be appropriately adjusted to capture discriminatory signals for correct model decisions. To this end, embodiments of the present invention can provide an FSR module aimed at enhancing feature robustness. The FSR module can first separate the model's intermediate feature map into malicious, non-robust activations that account for model prediction errors and robust activations that still provide useful signals for correct model predictions even under adversarial attacks. However, as with existing methods, utilizing only robust features can result in the loss of potentially useful signals from non-robust features. Therefore, the FSR module can recalibrate non-robust activations to capture signals that provide additional useful guidance for accurate model decisions. These additional signals can better guide the model toward correct predictions, thereby enhancing model robustness.

[0029] Figure 1 is a diagram illustrating examples of images acquired through an adversarial training model equipped with an FSR module according to an embodiment of the present invention. In Figure 1, a naturally trained model (f nat ) and the robust features (f) on the adversarial examples (x´) obtained from the adversarial training model equipped with the FSR module. + ), non-robust features (f - ), and recalibrated features ( ) is shown as an example of visualizing the attention map for features of natural images. Given an adversarial example, the non-robust features (f - ) captures signals that are irrelevant to the ground truth class, but has robust features (f + ) can capture discriminative signals (e.g., horse's leg). At this time, the FSR module can capture non-robust activations (f) that are ignored by existing methods. - → ) can be recalibrated and recover additional useful signals not captured by the robust activations (e.g., the horse's body). These additional signals can further improve the model's ability to make correct decisions on adversarial examples.

[0030] Due to its simplicity, the FSR module can be easily connected to any layer of a CNN model, and the entire model can be trained end-to-end. The FSR module can effectively separate feature activations based on their influence on model decisions during the separation phase, and successfully capture signals useful for model prediction during the recalibration phase. This allows FSR to improve the robustness against various variant adversarial training methods with minimal computational overhead. Furthermore, by recalibrating incompatible activations rather than simply deactivating them as in conventional techniques, it preserves useful information, thereby enhancing model robustness.

[0031] Related Research: Adversarial Training as an Adversarial Defense

[0032] Adversarial training, which trains models with adversarially generated data to make them resilient to adversarial attacks, has been widely considered one of the most effective defense strategies. It can solve the minmax optimization problem, as shown in Equation 1 below.

[0033]

[0034] Here F θ is a model parameterized by θ, x is a natural image with label y from dataset D, and δ is ||δ|| p ℓ of size ε such that ≤ ε p -Perturbation is limited within the normL cls(·,·) represents the classification loss. The inner maximization aims to find the most robust possible perturbation δ that maximizes the classification loss, while the outer minimization trains the model to minimize the loss with respect to worst-case adversarial examples. The Fast Gradient Sign Method (FGSM) or Projected Gradient Descent (PDG) attack can be used to optimize the inner maximization.

[0035] Many variations of adversarial training techniques have emerged in recent years. For example, techniques for reducing the distance between the logit of natural images and their adversarial counterparts, techniques for decomposing prediction errors for adversarial examples into natural and boundary errors to improve both robustness and accuracy, techniques for additionally considering misclassified examples during training, techniques inspired by curriculum learning that train models with increasingly robust adversarial examples to improve generalization, techniques proposing self-ensemble methods that combine the weights of various models throughout the training process, and techniques applying second-order statistics to model weights to improve adversarial training robustness. Due to their simplicity, the feature separation and recalibration methods according to embodiments of the present invention can easily be integrated with any of these adversarial training techniques to further enhance robustness.

[0036] Related research: Adversarial defenses for feature spaces

[0037] In parallel research, some previous models have been found to learn features that are not robust to the dataset, and input perturbations from adversarial examples often accumulate through intermediate layers, misleading the final prediction. To address these issues, several works have attempted to learn robust feature representations by modifying the network architecture or applying regularization. Examples include studying adversarial vulnerability from the perspective of batch normalization, applying pruning to random activation sets, especially small ones, pruning activations vulnerable to adversarial attacks, and proposing class-specific feature separation and pushing the centers of each class together to learn more discriminative feature representations.

[0038] There have also been attempts to reduce feature map anomalies by explicitly manipulating feature activations. For example, there are techniques such as k-Winner-Takes-All activation, which deactivates all feature units except the k-units with the largest size; techniques that analyze the effects of adversarial perturbations at the pixel, image, and network levels and mask feature units that are sensitive to the perturbations; techniques that apply attention mechanisms to highlight important regions of the feature map; techniques that propose Feature Denoising (FD), which applies classical noise removal techniques to deactivate anomalous activations; and techniques that study the effects of perturbations on feature activations from a channel perspective and propose Channel Activation Suppression (CAS) and Channel-wise Importance-based Feature Selection (CIFS) to deactivate activations in non-robust channels, respectively.

[0039] In contrast to these methods, embodiments of the present invention propose a recalibration strategy. Existing deactivation strategies simply discard inrobust feature activations that are responsible for model errors. Furthermore, embodiments of the present invention can adjust these activations to recapture potentially discriminatory signals and thereby increase model robustness.

[0040] Feature separation and recalibration method

[0041] Although distorted feature activation is known to cause model prediction errors during adversarial attacks, the FSR module can fully utilize potentially useful signals by recapturing useful signals for model prediction through adjustments.

[0042] FIG. 2 is a diagram illustrating an example of an FSR module according to an embodiment of the present invention. During the separation step, the FSR module can separate the feature map into robust and non-robust features by masking the activations of non-robust and robust features, respectively. Subsequently, during the recalibration step, the FSR module can recalibrate the activations of non-robust features, thereby providing useful information for correct model prediction. As illustrated in the embodiment of FIG. 2, due to its simplicity, the FSR module can be inserted into all layers of a model to enhance robustness.

[0043] Feature separation

[0044] Compared to recent approaches that robustize feature maps by disabling non-robust activations, the FSR module can be recalibrated to recover potentially useful clues for model prediction. To achieve this, in the separation step, the FSR module can extract non-robust activations from the input intermediate feature maps to be recalibrated. A separation network S can be utilized to learn the robustness of each feature unit to determine which activations are robust and which are not. Intermediate feature maps Given this input, C, H, and W can represent the channel, height, and width dimensions of f, respectively. The separation network generates a robustness map representing the robustness score of the corresponding f unit. , and a higher score may indicate more robust feature activation.

[0045] To extract non-robust features, the FSR module can element-wise separate the feature map into robust and non-robust features based on the robustness score. For example, a binary mask b∈ {0, 1} generated based on the robustness score is used. C×H×W can be applied to feature maps. However, such discrete sampling is indistinguishable and discontinuous, which can lead to gradient masking, which can give a false sense of robustness.

[0046] To avoid such problems, in one embodiment of the present invention, a differentiable soft mask m∈ {0, 1} is obtained as in Equation 2 below using Gumbel softmax. C×H×W We can approximate a binary mask b with .

[0047]

[0048] Here, r is the robustness map and σ is the sigmoid function used to normalize the robustness map. g1 and g2 represent samples drawn from a Gumbel distribution such that g = -log (-log(u)), where u ~ Uniform(0, 1), and τ is the temperature used to control the effect of g1 and g2. To avoid stochasticity in sampling g1 and g2 during inference, -log((-log(u c )) and fixed here is the expected value of the uniform distribution. Compute the two-class Gumbel softmax between the normalized robustness map and its inverted version to obtain a mask m with values ​​close to 1 for high robustness scores and close to 0 for low robustness scores. Then, the non-robust activations in the input feature f are masked and the robust feature f is + to get feature f and positive mask m so that + = We can compute the element-wise product between m. Similarly, for a negative mask m - = Masking of robust activations with 1-m to non-robust features You can get it.

[0049] However, without any guidance, the separating network may not learn the correct robustness score for each activation. To address this, in this example, we can design a goal that guides the separating network to learn robustness scores based on the impact of feature activations on the model's ability to make correct or incorrect predictions. In this example, we use two features f + Wow - Each is used as input and the predicted score p + Wow - Separation loss L is utilized by using an auxiliary layer h based on a multi-layer perceptron (MLP) that outputs sep can be calculated as in the following mathematical formula 3.

[0050]

[0051] Here, N represents the number of classes, y represents the ground truth label, and y' represents the label corresponding to the class with the highest prediction score among the incorrectly predicted classes in the final output of the model. L sep is a positive mask m of auxiliary layer +By training the auxiliary layer to make correct predictions based on preserved activations, we can guide the separating network to assign high robustness scores to units that help the auxiliary layer make correct predictions. At the same time, we aim to isolate highly destructive activations that cause the model to make incorrect predictions under adversarial attacks. sep can also guide the separating network to assign low robustness scores to non-robust activations that are specifically responsible for the most likely incorrect predictions.

[0052] L sep Using a separable network, robust and non-robust feature activations can be effectively separated. Discarding non-robust activations is one way to improve feature robustness, but this approach may ignore potentially useful signals that could be recaptured through recalibration. Below, we describe a method for recalibrating the separated non-robust activations to capture additional useful signals for improving feature robustness.

[0053] Feature recalibration

[0054] As with recent techniques, utilizing only the robust features obtained through the separation step can result in the loss of potentially useful signal for model predictions that could further enhance model robustness. Therefore, in the first recalibration step, we can adjust the activations of non-robust features to capture additional useful signal. First, we consider the non-robust features f. - Use as input and f accordingly - A recalibration network R can be used, which outputs a recalibration unit designed to adjust the activation of . To recalibrate the non-robust activations specified in the robustness map, the FSR module uses a negative mask m - can be applied to the recalibration unit. Finally, the FSR module outputs the result as f - , in other words Recalibrated features added to can be calculated.

[0055] The goal of the recalibration phase is to recapture signals from non-robust activations that can help the model make correct decisions. To achieve this goal, recalibrated features Next, reattach the auxiliary layer and recalibrate the loss L as shown in the following equation 4. rec can be calculated.

[0056]

[0057] Here is input The output prediction score of a given auxiliary layer can be represented. In this embodiment, the same auxiliary layer can be trained to guide the recalibration network to adjust the non-robust activations to provide signals related to the ground truth class so that it can make correct decisions based on the recalibrated features. After the recalibration step, the FSR module generates robust features f + and recalibrated non-robust features Adding the output feature map in an element-wise manner can be obtained, which can be passed to subsequent layers of the model. The recalibration step can capture additional useful signals from non-robust activations that are ignored in previous approaches.

[0058] Model training

[0059] The proposed FSR module can be easily inserted into any layer of the model and, due to its simplicity, can be trained in an end-to-end manner with the entire model. Furthermore, it exhibits classification loss L for various types of adversarial training. cls The proposed method can be applied, and the overall objective function can be expressed as in the following mathematical expression 5.

[0060]

[0061] Here, L represents the set of locations where FSR modules are inserted. sep and L rec represents the separation loss and recalibration loss applied to the FSR module in the first layer, respectively. Hyperparameter λ sep and λ rec are each L sep Wow L rec can be used to control the weights of the training set. Adding this simple FSR module can improve the robustness of adversarial training methods against both white-box and black-box attacks with small computational overhead.

[0062] The feature separation and recalibration system according to embodiments of the present invention can be implemented by at least one computer device, and the feature separation and recalibration method according to embodiments of the present invention can be performed by at least one computer device included in the feature separation and recalibration system. A computer program according to an embodiment of the present invention can be installed and run on the computer device, and the computer device can perform the feature separation and recalibration method according to embodiments of the present invention under the control of the run computer program. The above-described computer program can be stored on a computer-readable recording medium so as to be combined with the computer device and cause the computer device to execute the feature separation and recalibration method.

[0063] FIG. 3 is a block diagram illustrating an example of a computer device according to an embodiment of the present invention. As illustrated in FIG. 3, the computer device (300) may include a memory (310), a processor (320), a communication interface (330), and an input / output interface (I / O interface) 340. The memory (310) is a computer-readable recording medium and may include a random access memory (RAM), a read only memory (ROM), and a permanent mass storage device such as a disk drive. Here, the permanent mass storage device such as the ROM and the disk drive may be included in the computer device (300) as a separate permanent storage device distinct from the memory (310). In addition, the memory (310) may store an operating system and at least one program code. These software components may be loaded into the memory (310) from a computer-readable recording medium separate from the memory (310). This separate computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, a memory card, etc. In another embodiment, the software components may be loaded into the memory (310) via a communication interface (330) other than a computer-readable recording medium. For example, the software components may be loaded into the memory (310) of the computer device (300) based on a computer program installed by files received via a network (Network, 360).

[0064] The processor (320) may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. Instructions may be provided to the processor (320) via the memory (310) or the communication interface (330). For example, the processor (320) may be configured to execute instructions received according to program code stored in a storage device such as the memory (310).

[0065] The communication interface (330) may provide a function for the computer device (300) to communicate with other devices via the network (360). For example, requests, commands, data, files, etc. generated by the processor (320) of the computer device (300) according to program codes stored in a recording device such as the memory (310) may be transmitted to other devices via the network (360) under the control of the communication interface (330). Conversely, signals, commands, data, files, etc. from other devices may be received by the computer device (300) via the communication interface (330) of the computer device (300) via the network (360). Signals, commands, data, etc. received via the communication interface (330) may be transmitted to the processor (320) or the memory (310), and files, etc. may be stored in a storage medium (the aforementioned permanent storage device) that the computer device (300) may further include.

[0066] The input / output interface (340) may be a means for interfacing with an input / output device (I / O device, 350). For example, the input device may include a device such as a microphone, a keyboard, or a mouse, and the output device may include a device such as a display or a speaker. As another example, the input / output interface (340) may be a means for interfacing with a device that integrates input and output functions, such as a touchscreen. The input / output device (350) may also be configured as a single device with the computer device (300).

[0067] Additionally, in other embodiments, the computer device (300) may include fewer or more components than those illustrated in FIG. 3. However, it is not necessary to explicitly illustrate most conventional components. For example, the computer device (300) may be implemented to include at least some of the input / output devices (350) described above, or may further include other components such as a transceiver, a database, etc.

[0068] FIG. 4 is a flowchart illustrating an example of a feature separation and recalibration method according to an embodiment of the present invention. The feature separation and recalibration method according to the present embodiment can be performed by the computer device (300) described through FIG. 3. At this time, the processor (320) of the computer device (300) can be implemented to execute control instructions according to the code of the operating system included in the memory (310) or the code of at least one computer program. Here, the processor (320) can control the computer device (300) so that the computer device (300) performs steps (410 to 440) included in the method of FIG. 4 according to the control instructions provided by the code stored in the computer device (300).

[0069] In step (410), the computer device (300) can separate the input feature map into a first feature defined as a robust feature and a second feature defined as a non-robust feature based on a robustness score. For example, the computer device (300) can first generate a robustness map of the input feature map through a separation network trained to learn the robustness of a feature and output a robustness map representing a robustness score per feature map unit. The separation network can include an MLP-based auxiliary layer trained to use each of the first feature and the second feature as input and output a first feature score for the first feature and a second feature score for the second feature. In this case, the auxiliary layer can guide the separation network to assign a relatively higher robustness score to the first feature based on the preserved activation in a positive mask among binary masks, which will be described later, based on a separation loss. Here, the separation loss can be calculated based on the first feature score, the second feature score, the ground truth label, and the label corresponding to the class with the highest prediction score among the classes incorrectly predicted in the final output of the model. For example, the separation loss can be calculated as in Equation 3 described above. In addition, the computer device (300) can generate a binary mask based on the robustness map. At this time, the computer device (300) can generate a binary mask having a differentiable soft mask using Gumbel softmax. The soft mask was described above through Equation 2. In addition, the computer device (300) can separate the first feature and the second feature by applying the binary mask to the input feature map. At this time, the computer device (300) can obtain the first feature by calculating the element-wise product between the input feature map and the positive mask among the binary masks, and can obtain the second feature by calculating the element-wise product between the input feature map and the negative mask among the binary masks.

[0070] In step (420), the computer device (300) may generate a recalibrated feature by recalibrating the activation of the second feature. For example, the computer device (300) may generate a recalibration unit by adjusting the activation of the second feature through a recalibration network trained to input a feature and adjust the activation of the feature. Here, the recalibration network may include an auxiliary layer that inputs the second feature and outputs an output prediction score, and the auxiliary layer may guide the recalibration network to adjust the activation of the second feature to provide a signal related to the ground truth label based on the recalibration loss. At this time, the recalibration loss may be calculated using the ground truth label and the output prediction score. An example of calculating the recalibration loss has been described above through mathematical expression 4. In addition, the computer device (300) may apply a negative mask among the binary masks generated based on the robustness map of the input feature map to the recalibration unit, and calculate a recalibrated feature by combining the recalibration unit with the negative mask applied and the second feature. ) can be done.

[0071] In step (430), the computer device (300) can generate an output feature map by combining the first feature and the recalibrated feature. The first feature, which is defined as a robust feature above, is + and recalibrated non-robust features Combine to output feature map It was explained that it can be obtained.

[0072] Thus, according to embodiments of the present invention, a method and system for feature separation and recalibration for adversarial robustness can be provided. The method and system for feature separation and recalibration enhances robustness against adversarial examples in the CIFAR-10 and SVHN datasets. The performance improvements are demonstrated in Table 1 below. Table 1 presents the classification accuracy (%) of each defense technique (the first column) against various adversarial attacks (FGSM, PGD-20, PGD-100, C&W, and Ensemble).

[0073]

[0074] When applied to various adversarial training techniques such as AT, TRADES, and MART, the feature separation and recalibration method and system are found to increase robustness against various adversarial attacks.

[0075] Adversarial defense research is a field that studies techniques and methods to protect machine learning models, such as deep neural networks, so that they operate robustly against adversarial examples. This research has had significant impact in various fields, including the following effects.

[0076] 1. Improving model robustness: Adversarial defense research aims to develop methods to improve models to make them more robust against adversarial attacks. This improves model performance on both general data and adversarial examples, resulting in more reliable models.

[0077] 2. Mitigating security vulnerabilities: Adversarial defense research helps identify and address model vulnerabilities. This allows for the construction of robust AI models against adversarial examples created by malicious users to attack the model.

[0078] 3. AI models useful for real-world applications: Adversarial defense research helps develop AI models that perform well even in real-world adversarial environments. Adversarial defense plays a particularly important role in areas with high security requirements.

[0079] The systems or devices described above may be implemented as hardware components, or a combination of hardware components and software components. For example, the devices and components described in the embodiments may be implemented using one or more general-purpose computers or special-purpose computers, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a programmable logic unit (PLU), a microprocessor, or any other device capable of executing instructions and responding to them. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For ease of understanding, the processing device is sometimes described as being used alone; however, one of ordinary skill in the art will recognize that the processing device may include multiple processing elements and / or multiple types of processing elements. For example, a processing unit may include multiple processors, or a processor and a controller. Other processing configurations, such as parallel processors, are also possible.

[0080] Software may include a computer program, code, instructions, or a combination of one or more of these, which may configure a processing device to perform a desired operation or may independently or collectively command the processing device. The software and / or data may be embodied in any type of machine, component, physical device, virtual equipment, computer storage medium, or device for interpretation by the processing device or for providing instructions or data to the processing device. The software may also be distributed over networked computer systems and stored or executed in a distributed manner. The software and data may be stored on one or more computer-readable recording media.

[0081] The method according to the embodiment may be implemented in the form of program commands that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program commands, data files, data structures, etc., singly or in combination. The medium may continuously store a computer-executable program, or may temporarily store it for execution or download. In addition, the medium may be various recording means or storage means in the form of a single or multiple hardware combinations, and is not limited to a medium directly connected to a computer system, but may also be distributed over a network. Examples of the medium may include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and those configured to store program commands, including ROM, RAM, and flash memory. In addition, examples of other media may include recording media or storage media managed by app stores that distribute applications, sites that supply or distribute various software, servers, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

[0082] Although the embodiments described above have been described by way of limited examples and drawings, those skilled in the art will appreciate that various modifications and variations can be made based on the above description. For example, appropriate results can still be achieved even if the described techniques are performed in a different order than described, and / or components of the described systems, structures, devices, circuits, etc. are combined or combined in a different manner than described, or are replaced or substituted with other components or equivalents.

[0083] Therefore, other implementations, other embodiments, and equivalents to the claims also fall within the scope of the claims set forth below.

Claims

1. A method for separating and recalibrating features of a computer device including at least one processor, A step of separating the input feature map into first features defined as robust features and second features defined as non-robust features based on a robustness score, by at least one processor; A step of recalibrating the activation of the second feature by at least one processor to generate a recalibrated feature; and A step of generating an output feature map by combining the first feature and the recalibrated feature by at least one processor. A feature separation and recalibration method including:

2. In paragraph 1, The above separation step is, A step of generating a robustness map of the input feature map through a separable network trained to learn the robustness of features and output a robustness map representing a robustness score of a feature map unit; A step of generating a binary mask based on the above robustness map; and A step of separating the first feature and the second feature by applying the binary mask to the input feature map. A feature separation and recalibration method characterized by including a .

3. In paragraph 2, The step of generating the above binary mask is: A feature separation and recalibration method characterized by generating a binary mask with a differentiable soft mask using Gumbel softmax.

4. In paragraph 2, The step of separating the first feature and the second feature comprises: A feature separation and recalibration method characterized in that the first feature is obtained by calculating the element-wise product between the input feature map and a positive mask among the binary masks, and the second feature is obtained by calculating the element-wise product between the input feature map and a negative mask among the binary masks.

5. In paragraph 2, The above separation network includes an auxiliary layer based on a Multi-Layer Perceptron (MLP) trained to use each of the first feature and the second feature as inputs and output a first feature score for the first feature and a second feature score for the second feature, The above auxiliary layer guides the separation network to assign a relatively higher robustness score to the first feature based on the preserved activation in the positive mask among the binary masks based on the separation loss. A feature separation and recalibration method characterized by .

6. In paragraph 5, A feature separation and recalibration method, characterized in that the separation loss is calculated based on the first feature score, the second feature score, the ground truth label, and the label corresponding to the class with the highest prediction score among the incorrectly predicted classes in the final output of the model.

7. In paragraph 1, The step of generating the above recalibrated features is: A step of generating a recalibration unit by adjusting the activation of the second feature through a recalibration network trained to input a feature and adjust the activation of the feature; A step of applying a negative mask among the binary masks generated based on the robustness map of the above input feature map to the above recalibration unit; and A step of calculating the recalibrated feature by combining the recalibration unit to which the negative mask is applied and the second feature. A feature separation and recalibration method characterized by including a .

8. In paragraph 7, The above recalibration network includes an auxiliary layer that receives the second feature as input and outputs an output prediction score, The above auxiliary layer guides the recalibration network to adjust the activation of the second feature based on the recalibration loss so as to provide a signal associated with the ground truth label. A feature separation and recalibration method characterized by .

9. In paragraph 8, A feature separation and recalibration method, characterized in that the recalibration loss is calculated using the ground truth label and the output prediction score.

10. A computer-readable recording medium having recorded thereon a program for executing the method of any one of claims 1 to 9 on a computer device.

11. A computer program stored in a computer-readable recording medium for executing a feature separation and recalibration method on a computer device, The above feature separation and recalibration method is, A step of separating the input feature map into a first feature defined as a robust feature and a second feature defined as a non-robust feature based on a robustness score; A step of recalibrating the activation of the second feature to generate a recalibrated feature; and A step of generating an output feature map by combining the first feature and the recalibrated feature. Including A computer program characterized by:

12. In paragraph 11, The above separation step is, A step of generating a robustness map of the input feature map through a separable network trained to learn the robustness of features and output a robustness map representing a robustness score of a feature map unit; A step of generating a binary mask based on the above robustness map; and A step of separating the first feature and the second feature by applying the binary mask to the input feature map. Including A computer program characterized by:

13. In paragraph 12, The above separation network includes an auxiliary layer based on a Multi-Layer Perceptron (MLP) trained to use each of the first feature and the second feature as inputs and output a first feature score for the first feature and a second feature score for the second feature, The above auxiliary layer guides the separation network to assign a relatively higher robustness score to the first feature based on the preserved activation in the positive mask among the binary masks based on the separation loss. A computer program characterized by:

14. In paragraph 11, The step of generating the above recalibrated features is: A step of generating a recalibration unit by adjusting the activation of the second feature through a recalibration network trained to input a feature and adjust the activation of the feature; A step of applying a negative mask among the binary masks generated based on the robustness map of the above input feature map to the above recalibration unit; and A step of calculating the recalibrated feature by combining the recalibration unit to which the negative mask is applied and the second feature. Including A computer program characterized by:

15. In paragraph 14, The above recalibration network includes an auxiliary layer that receives the second feature as input and outputs an output prediction score, The above auxiliary layer guides the recalibration network to adjust the activation of the second feature based on the recalibration loss so as to provide a signal associated with the ground truth label. A computer program characterized by:

16. At least one processor implemented to execute instructions readable by a computer device. Including, By at least one processor, The input feature map is split into the first feature defined as a robust feature and the second feature defined as a non-robust feature based on the robustness score, Generate a recalibrated feature by recalibrating the activation of the above second feature, Generating an output feature map by combining the first feature and the recalibrated feature. A computer device characterized by:

17. In paragraph 16, To separate the above input feature map, by at least one processor, Generate a robustness map of the input feature map through a learned separable network that learns the robustness of features and outputs a robustness map representing a robustness score of a feature map unit, Generate a binary mask based on the above robustness map, Applying the binary mask to the input feature map to separate the first feature and the second feature. A computer device characterized by:

18. In paragraph 17, The above separation network includes an auxiliary layer based on a Multi-Layer Perceptron (MLP) trained to use each of the first feature and the second feature as inputs and output a first feature score for the first feature and a second feature score for the second feature, The above auxiliary layer guides the separation network to assign a relatively higher robustness score to the first feature based on the preserved activation in the positive mask among the binary masks based on the separation loss. A computer device characterized by:

19. In Article 16, To generate the above recalibrated features, by said at least one processor, A recalibration unit is created by adjusting the activation of the second feature through a recalibration network that is trained to input features and adjust the activation of the features. Applying a negative mask among the binary masks generated based on the robustness map of the above input feature map to the above recalibration unit, Computing the recalibrated feature by combining the recalibrated unit to which the negative mask is applied and the second feature. A computer device characterized by:

20. In paragraph 19, The above recalibration network includes an auxiliary layer that receives the second feature as input and outputs an output prediction score, The above auxiliary layer guides the recalibration network to adjust the activation of the second feature based on the recalibration loss so as to provide a signal associated with the ground truth label. A computer device characterized by:

Images