Adversarial Perturbation Tile Generation for Neural Network Robustness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural networks, including deep networks, are sensitive to adversarial attacks, which can significantly alter their outputs with small input changes, and these attacks can transfer from 'white box' to 'black box' settings, posing challenges in robustness and security.
Innovation Solution
A computer-implemented method and system for training machine-learning networks that generate adversarial perturbations using an optimizer, perturbation tiles, and loss function values to create robustness against such attacks, applicable to various sensors like video, radar, and LiDAR, by optimizing a small tile and upsampling it to match the image size, employing black-box optimization methods without gradient access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial attacks are applied to neural networks, then the network output can be drastically changed with small input changes, but this reduces the reliability and robustness of the network
Solution Approach 1:
The patent applies preliminary anti-action by training the neural network with adversarial examples before deployment. The system generates adversarial perturbations and uses them to pre-train the network, creating a form of preemptive defense that hardens the network against future attacks. This is evident in the training process where adversarial examples are generated and used to update network weights, preparing the network to resist attacks in advance.
Solution Approach 2:
The patent converts the harmful adversarial attacks into a beneficial training mechanism. By using adversarial examples as training data, the system transforms the very attacks that could compromise network reliability into a tool for improving robustness. The loss function is designed to maximize attack effectiveness during training, which paradoxically strengthens the network's defense capabilities.
2Adaptability or versatility
If white box adversarial attacks are used, then full knowledge of the classifier is required including backpropagation capability, but this limits applicability to black box settings
Solution Approach 1:
The patent achieves universality by creating an adversarial training framework that works across both white-box and black-box settings. The system generates adversarial examples using only query access to the classifier, making the approach universally applicable regardless of the level of access or knowledge available. This eliminates the need for different attack methods for different settings and provides a unified solution.
Solution Approach 2:
The patent segments the adversarial attack process into discrete query-based steps that can be executed in a black-box setting. Instead of requiring direct access to gradients and internal parameters, the system breaks down the attack into sequential queries to the classifier, analyzing outputs and adjusting perturbations accordingly. This segmentation enables the attack to function without deep knowledge of the classifier's internal mechanics.
3Reliability
If traditional adversarial training is applied, then the network may require extensive queries and computational resources, but this increases training time and resource consumption
Solution Approach 1:
The patent applies partial action by using a limited number of strategically designed queries instead of exhaustive adversarial training. The system generates a subset of adversarial examples that are sufficient to provide robustness improvements without requiring extensive querying. This selective approach achieves meaningful hardening while significantly reducing the computational burden and training time associated with traditional adversarial training methods.
Data Source
AI summary
A computer-implemented method for training a machine-learning network, wherein the network includes receiving an input data from a sensor, wherein the input data includes data indicative of an image, wherein the sensor includes a video, radar, LiDAR, sound, sonar, ultrasonic, motion, or thermal imaging sensor, generating an adversarial version of the input data utilizing an optimizer, wherein the adversarial version of the input data utilizes a subset of the input data, parameters associated with the optimizer, and one or more perturbation tiles, determining loss function value in response to the adversarial version of the input data and a classification of the adversarial version of the input data, determining a perturbation tile in response the loss function value associated with one or more subsets of the adversarial version of the input data, and output a perturbation that includes at least the perturbation tile.