Adversarial Attack Model Training for Digital-to-Physical Robustness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep neural networks (DNNs) are vulnerable to adversarial attacks, where minor perturbations in input data cause incorrect outputs, and existing methods struggle to effectively model and defend against physical adversarial attacks due to image distortion during conversion from digital to physical domains.
Innovation Solution
A training method for an adversarial attack model using a generator network and discriminator network to generate and optimize adversarial images, incorporating geometric transformations, to enhance the robustness of the adversarial attack model against both digital and physical adversarial attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial attack images are generated using existing methods, then the DNN can be attacked, but the attack effect is unstable when converted to physical domain due to image distortion
Solution Approach 1:
The patent introduces a physical image as an intermediary between the digital adversarial attack image and the physical domain. The generator network first generates an adversarial attack image in the digital domain, then a physical image is obtained (through printing and photographing or scanning), which serves as a mediator to bridge the digital and physical domains. This intermediary approach allows the model to learn the transformation characteristics and maintain attack effectiveness across domain conversions.
Solution Approach 2:
The patent creates a copy of the training digital image in the physical domain by printing and photographing or scanning it. This physical copy is then used to train the generator network alongside the original digital image. By training on both the digital image and its physical copy, the model learns to generate adversarial perturbations that are robust to the distortion occurring during digital-to-physical conversion.
2Ease of manufacture
If the generator network is trained only on digital images, then training is simple, but the adversarial attack fails to maintain effectiveness in the physical domain
Solution Approach 1:
The patent makes the generator network universal by training it on both digital images and their physical domain copies. The network learns to generate adversarial perturbations that work in both the digital domain and the physical domain after conversion. This multi-functionality is achieved by using a combined loss function that includes both digital domain loss and physical domain loss, enabling the model to adapt to both domains without requiring separate models.
3Reliability
If geometric transformation is applied to adversarial attack images, then robustness to transformation is improved, but the image distortion increases
Solution Approach 1:
The patent applies geometric transformation to the training digital images before generating adversarial perturbations, rather than applying transformation after generation. By pre-transforming the input images during training, the generator network learns to create adversarial perturbations that are inherently robust to geometric transformations. This preliminary action ensures that the generated adversarial images maintain their attack effectiveness even when geometric transformations are applied.
Data Source
AI summary
Aspects of the disclosure are directed to a training method and apparatus of an adversarial attack model, a generating method and apparatus of an adversarial image, an electronic device, and a storage medium. The adversarial attack model can include a generator network, and the training method can include using the generator network to generate an adversarial attack image based on a training digital image, and performing an adversarial attack on a target model based on the adversarial attack image, to obtain an adversarial attack result. The training method can further include obtaining a physical image corresponding to the training digital image, and training the generator network based on the training digital image, the adversarial attack image, the adversarial attack result, and the physical image.