Adaptive Robustness Certification for Adversarial Examples
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing verifiable training methods for deep learning models are limited by using a single robustness criterion, which fails to account for inherent similarities in input data, leading to suboptimal performance on both clean and adversarial data.
Innovation Solution
Adaptive verifiable training is introduced, which exploits inter-class similarities to enforce multiple robustness criteria, relaxing constraints for similar classes and increasing them for dissimilar classes, using techniques like Neural Decision Trees (NDT) and Inter-Group Robustness Prioritization (IGRP).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single robustness criterion is used during verifiable training, then the model achieves provable robustness guarantees, but the natural performance suffers due to similar classes being overly constrained
Solution Approach 1:
The patent applies different robustness criteria (different epsilon values) to different class pairs based on their similarity. Highly similar classes (e.g., dogs and cats) receive smaller epsilon values to maintain natural performance, while highly dissimilar classes (e.g., dogs and cars) receive larger epsilon values for stronger robustness guarantees. This local differentiation resolves the contradiction by allowing the model to be robust where needed without being overly constrained where classes are naturally similar.
Solution Approach 2:
The patent dynamically adjusts the robustness criterion during training by computing pairwise class similarities and adapting the epsilon value accordingly. The robustness criterion is not fixed but varies based on the specific class pair being considered, enabling the model to achieve both robustness guarantees and natural performance through adaptive constraint application.
2Reliability
If a strict robustness criterion (large epsilon) is enforced, then the model achieves stronger robustness against adversarial attacks, but the natural performance deteriorates due to overlap between similar classes
Solution Approach 1:
The patent applies the principle of local quality by enforcing different robustness criteria for different class pairs. For similar classes like dogs and cats, a smaller epsilon value is used to avoid performance deterioration, while for dissimilar classes like dogs and cars, a larger epsilon value is applied to achieve stronger robustness. This resolves the contradiction by making the robustness criterion adaptive rather than uniform.
Solution Approach 2:
The patent changes the robustness parameter (epsilon) based on class similarity metrics. By computing pairwise distances between class centroids and adjusting the epsilon value accordingly, the system dynamically modifies the robustness criterion to balance adversarial robustness and natural performance across different class pairs.
3Manufacturing precision
If a loose robustness criterion (small epsilon) is used, then the model maintains better natural performance on similar classes, but the robustness guarantee becomes weaker and less effective against adversarial attacks
Solution Approach 1:
The patent applies local quality by using smaller epsilon values for similar class pairs to maintain natural performance while using larger epsilon values for dissimilar class pairs to ensure strong robustness guarantees. This selective application of robustness criteria resolves the contradiction by optimizing the trade-off locally for each class pair rather than using a uniform criterion.
Solution Approach 2:
The patent adjusts the epsilon parameter based on class similarity measurements. By computing pairwise distances and adapting the robustness criterion accordingly, the system achieves both high classification accuracy on clean data and strong robustness guarantees against adversarial attacks through parameter adaptation.
4Reliability
If multiple robustness criteria are enforced simultaneously, then the model achieves adaptive robustness for different class pairs, but the training complexity and computational cost increase
Solution Approach 1:
The patent segments the robustness training process by dividing classes into groups based on similarity and applying different robustness criteria to each group. This segmentation allows the model to achieve adaptive robustness while managing training complexity through structured organization of class pairs and their corresponding epsilon values.
Solution Approach 2:
The patent introduces dynamics into the training process by computing class similarities and adapting robustness criteria during training rather than using fixed predetermined values. This dynamic adaptation enables adaptive robustness while the computational overhead is managed through efficient similarity computations and adaptive constraint application.
Data Source
AI summary
Adaptive verifiable training enables the creation of machine learning models robust with respect to multiple robustness criteria. In general, such training exploits inherent inter-class similarities within input data and enforces multiple robustness criteria based on this information. In particular, the approach exploits pairwise class similarity and improves the performance of a robust model by relaxing robustness constraints for similar classes and increasing robustness constraints for dissimilar classes. Between similar classes, looser robustness criteria (i.e., smaller ∈) are enforced so as to minimize possible overlap when estimating the robustness region during verification. Between dissimilar classes, stricter robustness regions (i.e., larger ∈) are enforced. If pairwise class relationships are not available initially, preferably they are generated by receiving a pre-trained classifier and then applying a clustering algorithm (e.g., agglomerative clustering) to generate them. Once pre-defined or computed pairwise relationships are available, several grouping methods are provided to create classifiers for multiple robustness criteria.