Asymmetric Robustness for Adversarial Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Supervised machine learning classifiers are susceptible to adversarial attacks, leading to drastic changes in output and behavior due to minor imperceptible input perturbations, which is a concern for critical tasks, as existing robustness methods provide symmetrical protection across all classes, potentially misclassifying failures as non-failures with severe consequences.
Innovation Solution
The method involves training a classifier asymmetrically by using class-dependent allowed perturbations and optimizing a robust loss function for each class, allowing for different sets of perturbations across classes to enhance robustness while maintaining classification performance, particularly focusing on critical scenarios like failure identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetrical robustness methods are used to protect against adversarial attacks, then protection against perturbations is improved, but classification performance deteriorates for critical classes like failure identification
Solution Approach 1:
The patent applies local quality by assigning different robustness levels to different classes. Critical classes (e.g., failure detection) receive higher robustness protection with smaller allowed perturbations, while non-critical classes receive standard robustness protection. This is implemented through class-dependent allowed perturbation sets where Δ_critical ⊂ Δ_non-critical, enabling differentiated robustness protection that preserves classification performance for critical scenarios.
Solution Approach 2:
The patent implements asymmetry by breaking the symmetric treatment of all classes in traditional robustness methods. Instead of applying uniform robustness constraints across all classes, the method creates asymmetric robustness levels where critical classes receive stricter perturbation constraints than non-critical classes. This asymmetric approach allows the system to prioritize protection where it is most needed while maintaining overall classification accuracy.
2Reliability
If class-dependent allowed perturbations are applied to enhance robustness for critical classes, then reliability for critical scenarios is improved, but device complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the training process into class-specific subsets. The training data is partitioned into critical and non-critical classes, and separate robustness optimization is performed for each subset with appropriate perturbation constraints. This segmentation allows the system to manage complexity by handling different classes independently rather than attempting to optimize all classes simultaneously with uniform constraints.
Data Source
AI summary
A computational method for training a classifier. The method includes receiving a training data set comprised of pairs of training input and output signals, the classifier parameterized by parameters, a class-dependent allowed perturbation for each of at least two different classes and including a first class-dependent allowed perturbation for a first class and a second class-dependent allowed perturbation for a second class, and a loss function. The method further includes partitioning the training data set into a first subset labelled with a first label and a second subset labelled with a second label. The method also includes calculating a first loss in response to the first subset and the first class-dependent allowed perturbation and a second loss calculated in response to the second subset and the second class-dependent allowed perturbation. The method also includes updating the parameters in response to the first and second losses to obtain updated parameters.