Adversarial Example Detection Using Small Hamming-Distance Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for evaluating adversarial robustness in machine learning models are inefficient, particularly in discrete feature spaces, failing to identify adversarial examples in durations proportional to the size of the inputs and their feature space.
Innovation Solution
A method and system that generates derived vectors within a small Hamming distance from an input vector and checks for discrepancies in classification, determining adversarial examples by comparing original and derived labels, ensuring polynomial-time complexity relative to input size and feature space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing methods are used to evaluate adversarial robustness in discrete feature spaces, then comprehensive evaluation can be achieved, but the computation time becomes excessively long and not proportional to input size
Solution Approach 1:
The method segments the feature space by dividing it into discrete regions based on the discrete feature domains. Instead of continuously sampling the entire feature space, the approach discretizes the search space into manageable segments corresponding to discrete feature values, allowing efficient exploration without exhaustive computation.
Solution Approach 2:
The method performs preliminary actions by pre-computing and storing the domain boundaries and discrete feature specifications before the actual adversarial example search. This preprocessing step creates a structured framework that enables rapid evaluation during the main computation, avoiding redundant calculations and ensuring polynomial-time complexity.
2Measurement precision
If the search space is extensively explored to ensure robust evaluation, then adversarial examples can be thoroughly detected, but the complexity of the detection process increases
Solution Approach 1:
The method applies local quality by focusing the search on locally relevant regions of the feature space rather than uniformly exploring all possible variations. By concentrating computational resources on areas where adversarial examples are most likely to exist (within small Hamming distances), the approach achieves high detection accuracy without requiring complex global search mechanisms.
Solution Approach 2:
The approach changes parameters by utilizing the discrete nature of feature domains to transform the continuous adversarial search problem into a discrete parameter exploration problem. By parameterizing the search in terms of discrete feature value changes rather than continuous perturbations, the method simplifies the detection process while maintaining precision.
3Productivity
If a small fixed distance constraint is applied to generate derived vectors, then the search remains computationally manageable, but the detection capability for distant adversarial examples is limited
Solution Approach 1:
The method transitions to another dimension by shifting from continuous distance metrics to discrete Hamming distance measurements. This dimensional change allows the system to efficiently explore a broader effective search space by counting feature differences rather than measuring continuous distances, thereby maintaining computational efficiency while expanding detection coverage to include more diverse adversarial examples.
Data Source
Figure 1~2
Figure 3
AI summary
The present invention relates to the field of machine learning, more specifically to a method and a system implemented in a computer for determining the robustness of a machine learning (ML) model. The system takes an input, computes other inputs that are within a fixed distance away from the original input, and checks which computed inputs are adversarial examples. Based on the adversarial examples identified, the method and system will determine whether the ML model is considered robust.