Adversarial Perturbation Search for Integer-Valued ML Inputs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for generating adversarial perturbations in machine learning systems are ineffective for non-image data, particularly tabular data, as they rely on gradient-based methods that require floating-point inputs, making it difficult to create imperceptible adversarial examples for integer-valued inputs and failing to account for the structural differences between image and non-image data.
Innovation Solution
A computer-implemented method iteratively determines adversarial perturbations by sampling, applying, and optimizing perturbations to input signals, allowing for the creation of adversarial examples without gradient information, enabling the use of integer values and maintaining the input signal's structure, which can be applied to machine learning systems for fooling purposes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If gradient-based methods are used to generate adversarial perturbations, then the perturbations can be optimized for floating-point inputs, but the method becomes inapplicable to integer-valued inputs and fails for non-image data structures
Solution Approach 1:
The patent changes the fundamental parameters of the perturbation generation approach by abandoning gradient-based continuous optimization and adopting discrete combinatorial search methods. This allows the system to work with integer-valued inputs and various non-image data structures while maintaining the ability to generate effective adversarial perturbations through discrete feature space exploration
Solution Approach 2:
The patent segments the feature space into discrete categories and systematically explores perturbations by modifying individual features or groups of features independently. This segmentation approach enables the method to handle tabular data and other non-image structures by treating each feature as a separate entity that can be perturbed and evaluated independently
2Device complexity
If conventional adversarial attack methods are applied to non-image data, then the computational process can be simplified, but the generated perturbations become imperceptible or ineffective due to structural differences from image data
Solution Approach 1:
The patent applies local quality by tailoring the perturbation generation strategy to the specific structure and characteristics of non-image data. Different feature types and data structures receive customized perturbation approaches, ensuring that the adversarial examples maintain the appropriate precision and structure required for each specific data type while keeping the overall process manageable
3Object-affected harmful factors
If high perturbation magnitude is used for non-image data, then the adversarial effect can be achieved, but the perturbation becomes easily detectable and loses imperceptibility
Solution Approach 1:
The patent employs partial action by applying perturbations selectively to only certain features rather than uniformly across all features. This allows achieving adversarial impact through targeted modifications to critical features while keeping overall perturbation magnitude low and imperceptible, avoiding detection while maintaining effectiveness
Data Source
AI summary
A computer-implemented method for determining an adversarial perturbation for input signals, especially sensor signals or features of sensor signals, of a machine learning system. A best perturbation is determined iteratively, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration includes: sampling a perturbation; applying the sampled perturbation to an input signal thereby determining a potential adversarial example; determining an output signal from the machine learning system for the potential adversarial example, determining a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal, if the loss value is larger than a previous loss value setting the best perturbation to the sampled perturbation.