Adversarial Attack Defense Platform Using Codebook Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Image-based machine learning models are susceptible to adversarial attacks due to their vulnerability to small amounts of adversarial noise, which can lead to incorrect classifications, and the binary nature of classification labels used in training makes them easily predictable, allowing attackers to manipulate classifications.
Innovation Solution
An adversarial attack defense platform that utilizes codebooks, machine-learning training, and filtering, specifically generating target and output codebooks based on classification labels and training images, and employing a mean-squared-error loss function to minimize Euclidean distance between codebooks, along with a smoothing filter to remove adversarial noise from input images.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If image-based ML models are used for image classification, then classification capability is improved, but susceptibility to adversarial attacks increases
Solution Approach 1:
The patent segments the classification label representation into multiple codebooks, where each codebook contains multiple code vectors. Instead of using a single binary vector, the system distributes the classification information across multiple code vectors in different codebooks, making it more difficult for adversarial noise to corrupt the entire classification decision.
Solution Approach 2:
The patent changes the parameter representation from binary vectors to continuous code vectors with random values and dimensions. This parameter transformation makes the classification labels less predictable and more resistant to adversarial manipulation, as attackers cannot easily predict or alter the continuous-valued code vectors.
2Ease of operation
If binary vector classification labels are used, then ease of prediction is improved, but vulnerability to adversarial manipulation increases
Solution Approach 1:
The patent transforms the classification label parameters from simple binary vectors to complex continuous code vectors with random values and varying dimensions. This makes the labels significantly harder to predict and manipulate adversarially, while still maintaining their utility for classification through the codebook matching mechanism.
Solution Approach 2:
The patent introduces codebooks as an intermediary layer between the input image and the classification decision. The codebooks act as a mediator that transforms the classification labels into a more robust representation, adding a layer of protection against direct manipulation of the classification decisions.
3Reliability
If codebooks with random values and dimensions are generated, then adversarial attack resistance is improved, but system complexity increases
Solution Approach 1:
The patent performs preliminary action by pre-generating the codebooks with their random values and dimensions before the actual classification task. This upfront preparation, while computationally intensive, creates a robust framework that simplifies the runtime classification process and provides lasting protection against adversarial attacks.
Solution Approach 2:
The patent creates multiple copies of code vectors within each codebook and across different codebooks. This redundancy through copying ensures that the classification information is distributed and protected, requiring an attacker to compromise multiple code vectors simultaneously to succeed.
Data Source
AI summary
Methods, systems, and computer-readable storage media for receiving a set of training images and a set of classification labels, generating a set of target codebooks based on the set of classification labels, the set of target codebooks being provided as a first set of vectors of random value and dimension, generating a set of output codebooks based on the set of training images, the set of output codebooks being provided as a second set of vectors of random value and dimension, training a ML model by minimizing a loss function provided as a mean-squared-error (MSE) loss function, the loss function being measured by the Euclidean distance between an output codebook of the set of output codebooks and a target codebook of the set of target codebooks.