Adversarial Signal Generation for ML Robustness

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing machine learning systems for semantic segmentation are vulnerable to adversarial examples, which can lead to significant changes in output, potentially misleading autonomous systems and posing risks, such as misidentifying a river in route planning for autonomous robots.

Innovation Solution

A method for generating manipulated data signals that simulate adversarial examples by estimating and modifying semantic segmentations, allowing for improved robustness and attack simulation without requiring actual training data, using a cost function to minimize differences in semantic values and background disturbance.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Extent of automation

If machine learning systems are used for semantic segmentation, then automation and productivity are improved, but the systems become vulnerable to adversarial examples that can significantly change output

Engineering Contradiction:

Improveautomation of semantic segmentationVSAvoidrobustness against adversarial attacks

Core Design Contradiction:

Extent of automationVSReliability

Solution Approach 1:

The patent applies preliminary action by generating manipulated data signals (adversarial examples) before actual deployment of the machine learning system. These adversarial examples are created during a testing phase to identify potential vulnerabilities in advance, allowing the system to be hardened against attacks before encountering them in real operation.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements preliminary anti-action by using the generated adversarial examples to train or adjust the machine learning system's defenses. The system learns to recognize and resist these manipulated inputs through prior exposure, creating a counter-measure before actual adversarial attacks occur in deployment.

Inventive Principle:

Principle #9Preliminary anti-action

2Reliability

If manipulated data signals are generated to test robustness, then reliability is improved, but device complexity and computational resources increase

Engineering Contradiction:

Improverobustness assessment capabilityVSAvoidcomplexity of attack simulation system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies self-service by enabling the machine learning system to generate its own adversarial examples for testing. The system uses its internal cost function and semantic segmentation capabilities to create manipulated data signals without requiring external adversarial example generation tools, thereby reducing overall system complexity.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent implements universality by designing a multi-functional system that can both perform semantic segmentation and generate adversarial examples using the same machine learning model and cost function. This eliminates the need for separate specialized tools for attack simulation, reducing device complexity while maintaining robustness assessment capability.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS10824122B2Method and device for improving the robustness with respect to “adversarial examples”

Publication Date: 2020.11.03 ROBERT BOSCH GMBH

AI summary

A method for generating a manipulated data signal for misleading a first machine learning system, which is designed to ascertain a semantic segmentation of a received one-dimensional or multi-dimensional data signal, the method having the following steps: a) ascertaining a desired semantic segmentation of the manipulated data signal; and b) generating the manipulated signal as a function of the received data signal and the ascertained desired semantic segmentation as well as an estimated semantic segmentation of the manipulated data signal.