Certified Defense Against Adversarial Patch Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning systems, such as PatchCleanser, provide certified defenses against patch attacks but do so at the cost of significant image information loss, which negatively impacts classification accuracy.
Innovation Solution
A computer-implemented method and system that generates a set of one-mask images using a first mask at predetermined regions of a source image, identifies minority predictions among these images, and then generates a set of two-mask images by masking the identified one-mask image with second masks of smaller dimensions. This process improves classification accuracy by revealing more image content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a masking strategy is applied to defend against patch attacks, then certified defense robustness is improved, but image information is lost and classification accuracy deteriorates
Solution Approach 1:
The patent divides the masking process into two stages: first applying a large mask to cover potential adversarial regions, then applying smaller submasks to progressively reveal image content. This segmentation allows the system to maintain defense robustness while recovering lost image information through the staged approach.
Solution Approach 2:
The patent applies partial masking rather than complete masking of potential adversarial regions. By using smaller submasks that cover only portions of the original mask area, the system achieves sufficient defense against patch attacks while preserving more image information for accurate classification.
2Reliability
If large masks are used to cover potential adversarial regions, then defense coverage is improved, but more image content is hidden and classification accuracy deteriorates
Solution Approach 1:
The patent segments the masking area into a first mask covering potential adversarial regions and multiple second masks (submasks) with smaller dimensions. This segmentation enables progressive revelation of image content while maintaining defense coverage, as the submasks are applied strategically to reveal non-adversarial regions.
Solution Approach 2:
The patent applies different masking qualities to different regions: the first mask provides comprehensive coverage for defense, while the second masks provide localized, smaller-area masking that reveals sufficient image content for accurate classification without compromising overall defense coverage.
Data Source
AI summary
A computer-implemented system and method relate to certified defense against adversarial patch attacks. A set of one-mask images is generated using a first mask at a set of predetermined regions of a source image. The source image is obtained from a sensor. A set of one-mask predictions is generated, via a machine learning system, based on the set of one-mask images. A first one-mask image is extracted from the set of one-mask images. The first one-mask image is associated with a first one-mask prediction that is identified as a minority amongst the set of one-mask predictions. A set of two-mask images is generated by masking the first one-mask image using a set of second masks. The set of second masks include at least a first submask and a second submask in which a dimension of the first submask is less than a dimension of the first mask. A set of two-mask predictions is generated based on the set of two-mask images. Class data, which classifies the source image, is selected based on the set of two-mask predictions.