Adversarial Input Defense via Transformation Engine Output Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current defenses against adversarial attacks on artificial intelligence models are either not robust enough or computationally inefficient, as they often require increased inference run-time and do not guarantee effectiveness against strong attacks, especially when used in isolation or in combination.
Innovation Solution
A transformation engine is implemented to determine if an input is an adversarial attack by comparing the AI model's outputs with and without specific transformations, using a pre-determined set of transformations selected for their effectiveness in detecting adversarial attacks, which can be updated to counter new threats and applied efficiently to maintain robustness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If input transformation ensembles are used to defend against adversarial attacks, then the robustness of the defense is improved, but the inference run-time increases
Solution Approach 1:
The patent pre-determines and pre-tests transformation sets against known adversarial attacks during an offline phase, selecting only the most effective combinations. This preliminary action allows the system to use smaller, pre-validated transformation sets during online inference, reducing run-time while maintaining robustness against both known and novel attacks.
2Measurement precision
If more transformations are added to the ensemble, then the detection accuracy improves, but the computational cost increases
Solution Approach 1:
The patent applies partial action by using a selective subset of transformations rather than all possible transformations. Transformation sets are pre-determined to contain only the necessary number of transformations required to achieve effective detection, avoiding the computational overhead of applying excessive transformations while maintaining high detection accuracy.
3Reliability
If adversarial training is used to improve model robustness, then the model's resistance to adversarial attacks increases, but the computational efficiency decreases
Solution Approach 1:
The patent segments the defense into two distinct phases: an offline training phase where transformation sets are pre-determined and tested against adversarial attacks, and an online inference phase where only the pre-selected transformation sets are applied. This segmentation allows comprehensive robustness training without the computational overhead during real-time operations, maintaining both model robustness and computational efficiency.
4Strength
If a large number of input transformations are randomly combined, then the computational strength of the defense increases, but the inference run-time increases and classification accuracy is compromised
Solution Approach 1:
The patent performs preliminary testing of transformation combinations against known adversarial attacks in an offline phase, identifying and selecting only the effective transformation sets. This preliminary action ensures that the selected transformation sets maintain computational strength for defense while avoiding the inclusion of transformations that would degrade classification accuracy, thus resolving the contradiction between defense strength and productivity.
Data Source
AI summary
Systems and methods for defending an artificial intelligence model against an adversarial input are disclosed. The system may include an artificial intelligence model, such as a machine learning model. The system may include a transformation engine executable by one or more processors. The transformation engine may be configured to receive an input to the artificial intelligence model, and apply a pre-determined transformation set to the input to produce a transformed input. The transformation engine may be configured to generate a first output based on the input using the artificial intelligence model and may also apply the artificial intelligence model to the transformed input to produce a second output. The transformation engine may be configured to determine whether the input is associated with an adversarial attack based on a comparison of the first output and the second output. The system also facilitates generating transformation sets for defending against adversarial attacks.