Adversarial Image Generator for DNN Segmentation Robustness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Pre-trained machine learning models used in transfer learning settings are vulnerable to adversarial attacks, particularly in resource-constrained devices like autonomous vehicles, due to their centralized nature and the inefficacy of traditional adversarial image generation methods for image segmentation tasks.
Innovation Solution
A defense pipeline employing a discriminator ML model that distinguishes genuine from adversarial images, combined with an optimized Fast Gradient Sign Method (FGSM) attack to generate adversarial images that can train the discriminator, reducing the likelihood of model compromise by image perturbations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional adversarial image generation methods are used on pre-trained models, then the models become vulnerable to adversarial attacks, but the methods are ineffective for image segmentation tasks in resource-constrained devices
Solution Approach 1:
The patent modifies the Fast Gradient Sign Method (FGSM) by changing key parameters: using L2 norm instead of L1 norm for gradient calculation, adjusting the step size alpha, and modifying the loss function to work with segmentation masks. These parameter changes make the adversarial attack method effective for image segmentation tasks while maintaining computational efficiency for resource-constrained devices.
Solution Approach 2:
The patent divides the adversarial attack process into distinct segmentation steps: (1) generating adversarial examples using modified FGSM, (2) training a discriminator model to distinguish real from adversarial images, and (3) deploying the discriminator for protection. This segmentation allows each component to be optimized independently for image segmentation tasks.
2Productivity
If pre-trained models are made publicly accessible for transfer learning, then data and computational resource requirements are reduced, but the models become attractive targets for attackers
Solution Approach 1:
The patent implements preliminary defensive action by training a discriminator model before deployment to proactively identify and block adversarial inputs. The discriminator is pre-trained on both real images and adversarial examples, creating a protective layer that activates before the main model processes potentially malicious inputs, thus preventing attacks rather than responding to them.
Solution Approach 2:
The discriminator model serves as an intermediary between the input image and the pre-trained segmentation model. It acts as a gatekeeper that filters out adversarial examples before they reach the vulnerable pre-trained model, while allowing legitimate images to pass through unchanged. This intermediary approach protects the model without affecting its accessibility for transfer learning.
3Reliability
If adversarial training data is generated to improve model robustness, then security vulnerabilities are reduced, but the complexity of the training pipeline increases
Solution Approach 1:
The patent creates copies of the pre-trained model for different purposes: one copy is used for generating adversarial training examples, another for normal inference, and a separate discriminator model is trained on the adversarial examples. This copying strategy allows parallel training processes without interference, simplifying the overall pipeline complexity while maintaining robust security training.
Data Source
AI summary
One example method includes deploying a discriminator, where the discriminator is trained to recognize an adversarial image received by the discriminator as adversarial, and the adversarial image is generated based upon an original image, the adversarial image including a perturbation that cannot be detected by a human eye but which is effective to deceive an image segmentation model to misclassify the original image, receiving, by the discriminator, an image captured by an autonomous vehicle, and determining, by the discriminator, whether the image received from the autonomous vehicle is adversarial.