Attack-less Adversarial Training via Color Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing adversarial training methods are effective only against known attack techniques and are vulnerable to new and state-of-the-art attacks, requiring the use of existing attack techniques to generate adversarial examples for training neural networks.
Innovation Solution
The approach involves generating a new image from an original image through color mapping and randomization, creating intervals of color ranges, predicting interval indices using a softmax activation function, and training a convolutional neural network with the new image to enhance robustness against various attack techniques without relying on specific attack methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial training uses existing attack techniques to generate adversarial examples, then the neural network can be trained to defend against known attacks, but the defense is vulnerable to new and state-of-the-art attack techniques
Solution Approach 1:
The patent changes the fundamental parameter of training data generation from attack-based to transformation-based. Instead of using attack techniques to generate adversarial examples, the method applies random transformations (cropping, color jittering, scaling) to original images to create training examples. This parameter change enables the model to learn robust features without being constrained to defending only against known attack patterns.
Solution Approach 2:
The patent inverts the traditional adversarial training approach. Rather than generating adversarial examples by applying attacks to original images, the method generates training examples by applying random transformations to original images and then finds the original image that would produce the transformed example. This inversion allows the model to learn inverse transformations, making it robust against various attack techniques without requiring specific attack knowledge.
2Ease of manufacture
If adversarial training requires at least one attack technique to generate adversarial examples, then the training process can proceed with known methods, but the system cannot defend against attacks for which no generator exists
Solution Approach 1:
The patent makes the training system self-sufficient by eliminating the dependency on external attack techniques. The method uses only the original images and random transformation functions to generate training examples, without requiring any attack generators. The system serves itself by creating its own training data from available resources, making it universally applicable regardless of attack availability.
Solution Approach 2:
The patent creates a universal training method that can defend against multiple types of attacks without requiring attack-specific generators. The random transformation approach serves multiple functions: it can simulate various attack effects, provide diverse training examples, and work with any image classification model. This multi-functionality replaces the need for multiple attack-specific training processes.
3Measurement precision
If traditional adversarial training methods are used, then the neural network can be trained with adversarial examples, but the method does not outperform the proposed attack-less approach in terms of accuracy and distortion reduction
Solution Approach 1:
The patent extracts the essential element of adversarial training (training on perturbed examples) while removing the harmful dependency on attack techniques. By taking out the attack generation component and replacing it with random transformations, the method maintains the benefit of robust training while eliminating the complexity of integrating and updating attack generators as new attacks emerge.
Data Source
AI summary
Disclosed herein is attack-less adversarial training for robust adversarial defense. The attack-less adversarial training for robust adversarial defense includes the steps of: (a) generating individual intervals (ci) by setting the range of color (C) and then discretizing the range of color (C) by a predetermined number (k); (b) generating one batch from an original image (X) and training a learning model with the batch; (c) predicting individual interval indices (ŷialat) from respective pixels (xi) of the original image (X) by using an activation function; (d) generating a new image (Xalat) through mapping and randomization; and (e) training a convolutional neural network with the image (Xalat) generated in step (d) and outputting a predicted label (Ŷ).