Adversarial Patch Detection via Image Segmentation and Mixed Integer Programming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning networks lack robustness against adversarial patches, which can deceive classifiers and compromise their performance without provable performance guarantees.
Innovation Solution
The method involves dividing an input image into sub-images, classifying them by introducing a variable at pixel locations, and identifying adversarial patches. This process includes using branch-and-bound techniques and mixed integer programming to verify the certification of neural networks against patch attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial training is applied to neural networks for classification, then the classifier performance becomes robustified against perturbations, but the systems lack provable performance guarantees
Solution Approach 1:
The image is divided into multiple sub-images (e.g., quadrants) and each sub-image is processed independently with its own classification variable. This segmentation allows the system to verify robustness for each region separately, providing provable guarantees for the overall image classification against adversarial patches.
Solution Approach 2:
The system introduces binary variables at pixel locations to represent potential adversarial patch placements and uses mixed integer programming to solve for the worst-case scenario. By changing the parameter space to include these discrete variables and using optimization-based verification, the system achieves provable performance guarantees rather than relying solely on empirical robustness from adversarial training.
2Reliability
If the image is divided into multiple sub-images and classified with introduced variables, then the system can identify adversarial patches, but the computational complexity increases
Solution Approach 1:
By dividing the image into smaller sub-images, the system reduces the complexity of the optimization problem for each sub-problem. Instead of solving one large mixed integer programming problem for the entire image, the system solves multiple smaller problems independently, making the computational task more manageable while maintaining the ability to detect adversarial patches.
Solution Approach 2:
The system applies classification with introduced variables to all sub-images, which may seem excessive, but this comprehensive approach ensures that adversarial patches are detected regardless of their location. The computational complexity is justified by the significant improvement in detection reliability.
Data Source
AI summary
A method of identifying an attack comprising receiving an input of one or more images, wherein the one or more images includes a patch size and size, divide the image into a first sub-image and a second sub-image, classify the first sub-image and the second sub-image, wherein classifying is accomplished via introducing a variable in a pixel location associated with the first and second sub-image, and in response to classifying the first and second sub-image and identifying an adversarial patch, output a notification indicating that the input is not certified.