Adversarial Example Detection Using Relational Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for detecting adversarial examples in deep neural networks require significant computational resources and storage to maintain collections of non-adversarial and adversarial examples, which is inefficient and resource-intensive.
Innovation Solution
A system and method that uses relational embeddings and angular distance similarity scores to determine whether an input is an adversarial example by generating and concatenating vector embeddings from initial and additional inputs, allowing for the identification of adversarial examples with fewer reference samples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current techniques use collections of non-adversarial and adversarial examples to detect adversarial examples, then detection accuracy is improved, but computational resource requirements and storage needs increase significantly
Solution Approach 1:
The patent extracts only the essential features from input data by generating embeddings that capture semantic information, then uses these extracted features for detection. This allows the system to identify adversarial examples based on embedding characteristics rather than requiring extensive reference samples of both adversarial and non-adversarial examples.
Solution Approach 2:
The patent transforms input data into a different dimensional space through embedding generation. By representing inputs as embeddings in a latent space, the system can detect adversarial examples based on the geometric relationships and distances between embeddings, reducing the need for large collections of reference samples in the original input space.
2Reliability
If current techniques store extensive collections of non-adversarial and adversarial examples, then detection capability is improved, but storage requirements increase
Solution Approach 1:
The system extracts and stores only the essential embedding representations rather than storing complete reference examples. This extraction approach maintains detection reliability while significantly reducing storage requirements, as embeddings are compact representations that capture the necessary information for adversarial detection.
Solution Approach 2:
Instead of storing original reference examples, the patent creates and stores embeddings as simplified copies that capture the essential characteristics. These embedding copies suffice for detection purposes, eliminating the need to store large collections of actual adversarial and non-adversarial examples.
3Measurement precision
If current techniques use multiple reference samples for detection, then detection accuracy is improved, but computational efficiency decreases
Solution Approach 1:
The patent performs preliminary action by generating embeddings for inputs before the actual detection process. By pre-computing embeddings and storing them, the system can efficiently perform detection through simple comparison operations in embedding space, significantly improving computational efficiency while maintaining accuracy.
Solution Approach 2:
The patent replaces complex mechanical comparisons of entire reference samples with more efficient operations in embedding space. Instead of computing similarities between full inputs and reference examples, the system uses efficient vector operations on embeddings, such as computing distances between embedding vectors, which are computationally cheaper and scale better.
Data Source
AI summary
Provided are systems for determining adversarial examples that include at least one processor to determine a first additional input from a plurality of additional inputs based on a proximity of the first additional input to an initial input, determine a second additional input from the plurality of additional inputs based on a proximity of the second additional input to the first additional input, generate a first vector embedding, a second vector embedding and a third vector embedding based on the second additional input, generate a first relational embedding, a second relational embedding, and a third relational embedding based on the third vector embedding and the first vector embedding, concatenate the first relational embedding, the second relational embedding, and the third relational embedding to provide a concatenated version, and determine whether the first input is an adversarial example based on the concatenated version. Methods and computer program products are also provided.