Adversarial Example Generation Model for Robust AI Training
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating adversarial examples with deep learning models are limited in creating examples with different visual features from the source image, making it difficult to update the models to avoid misclassification.
Innovation Solution
A model building apparatus and method that calculates evaluation values to generate adversarial examples with distinct visual features by updating the generation model to minimize the difference between actual and target visual features, ensuring higher misclassification possibilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If an adversarial example is generated by adding minute noise to a source image, then the difference in visual feature from the source image is small (looks almost the same), but the learned model cannot be updated effectively to eliminate vulnerability
Solution Approach 1:
The patent changes the parameter of visual feature difference by introducing a target visual feature that is intentionally different from the source image's visual feature. The generation model creates adversarial examples with controlled visual feature transformations, allowing the difference to be both perceptible and effective for model updates. This resolves the contradiction by making the visual feature difference a controllable parameter rather than minimizing it arbitrarily.
Solution Approach 2:
The patent implements a feedback mechanism where the generated adversarial example is fed back into the learned model for retraining. The model uses the adversarial example with different visual features to update its parameters, thereby eliminating the vulnerability. This feedback loop ensures that the model learns from the adversarial example with distinct visual features, resolving the contradiction between visual similarity and model update effectiveness.
2Reliability
If an adversarial example with different visual feature from the source image is generated, then the learned model can be updated effectively, but the difference in visual feature becomes large (looks unnatural)
Solution Approach 1:
The patent controls the visual feature difference as a parameter by specifying a target visual feature that is different from the source image's visual feature but within a reasonable range. The generation model transforms the visual features according to this controlled parameter, ensuring the adversarial example has sufficient difference for effective model updates while avoiding excessive distortion that would make it look completely unnatural.
Solution Approach 2:
The patent applies local quality transformation by selectively changing specific visual features while maintaining others. Instead of uniformly distorting the entire image, the generation model targets specific local regions or features for transformation, creating natural-looking changes that are sufficient for model updates without making the overall image look unnatural.
3Object-affected harmful factors
If the generation model is updated to minimize the difference between actual and target visual features, then the adversarial example looks more natural, but the misclassification capability may be reduced
Solution Approach 1:
The patent uses feedback from the learned model's classification output to guide the generation model's updates. The generation model adjusts the visual feature transformation based on whether the adversarial example successfully causes misclassification. This feedback mechanism ensures that visual naturalness is maintained while preserving the misclassification capability, as the model learns from the actual classification results.
Solution Approach 2:
The patent dynamically adjusts the visual feature transformation parameters based on the required misclassification capability. The generation model modifies the degree and type of visual feature change according to the learned model's response, ensuring sufficient transformation for misclassification while maintaining natural appearance. This parameter adaptation resolves the contradiction between visual naturalness and misclassification capability.
Data Source
AI summary
A model building apparatus includes: a building unit that builds a generation model that outputs an adversarial example, which causes misclassification by a learned model, when a source sample is entered into the generation model; and a calculating unit that calculates a first evaluation value and a second evaluation value, wherein the first evaluation value is smaller as a difference is smaller between an actual visual feature of the adversarial example outputted from the generation model and a target visual feature of the adversarial example that are set to be different from a visual feature of the source sample, and the second evaluation value is smaller as there is a higher possibility that the learned model misclassifies the adversarial example outputted from the generation model. The building unit builds the generation model by updating the generation model such that an index value based on the first and second evaluation values is smaller.