Adversarial Example Detection via Dual Model Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models are vulnerable to adversarial examples, which can cause incorrect classifications with imperceptible modifications, impacting the accuracy of non-adversarial data samples and posing a risk in security and safety applications.
Innovation Solution
A method involving training two machine learning models, one with robust features and another with non-robust features, to pre-screen data samples during inference, determining adversarial examples by contrasting their classifications, and preventing such samples from being classified by a model without adversarial protections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a machine learning model is trained to classify adversarial examples correctly, then the model's ability to detect adversarial examples is improved, but the accuracy of the model on non-adversarial data samples deteriorates
Solution Approach 1:
The patent divides the single machine learning model into two separate models: a robust model trained on robust features and a non-robust model trained on non-robust features. This segmentation allows each model to specialize in different aspects of feature recognition, enabling the system to detect adversarial examples while maintaining high accuracy on non-adversarial data without the trade-off that occurs when a single model is trained to handle both scenarios
2Reliability
If adversarial examples are detected by training a model with modified data samples, then security against attacks is improved, but the complexity of the machine learning system increases
Solution Approach 1:
By segmenting the system into two specialized models (robust and non-robust) rather than creating a complex single model, the patent achieves security against adversarial attacks while keeping individual model complexity manageable. The segmentation approach distributes the complexity across simpler, specialized components
Solution Approach 2:
The patent introduces a distinguisher component that acts as an intermediary between the two trained models and the final classification output. This intermediary analyzes the outputs from both models and determines whether the input is an adversarial example, providing a structured way to handle the increased system complexity through a dedicated mediation layer
Data Source
AI summary
A method and machine learning system for detecting adversarial examples is provided. A first machine learning model is trained with a first machine learning training data set having only training data samples with robust features. A second machine learning model is trained with a second machine learning training data set, the second machine learning training data set having only training data samples with non-robust features. A feature is a distinguishing element in a data sample. A robust feature is more resistant to adversarial perturbations than a non-robust feature. A data sample is provided to each of the first and second trained machine learning models during an inference operation. if the first trained machine learning model classifies the data sample with high confidence, and the second trained machine learning model classifies the data sample differently with a high confidence, then the data sample is determined to be an adversarial example.