System and method for high-resolution blackbox patch attack with Bayesian optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for blackbox adversarial attacks, such as Spares-RS and Bayesian Optimization, limit the search space and resolution of adversarial patches, reducing their effectiveness in attacking machine learning models.
Innovation Solution
A method using Bayesian optimization to generate high-resolution adversarial patches by decomposing them into subregions in either the spatial or frequency domain, iteratively updating each subregion to meet success criteria, and upsampling the patches until the attack is successful.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the search space for each pixel value is limited to extreme values (0 or 255), then the search space is reduced, but the number of allowed perturbations is significantly limited, reducing attack strength
Solution Approach 1:
The patent segments the adversarial patch into multiple frequency subbands using Fourier transform. Each subband is independently optimized with Bayesian optimization, allowing fine-grained control over different frequency components. This segmentation enables the attack to explore a much larger effective search space while maintaining manageable optimization complexity for each subband.
Solution Approach 2:
The patent transforms the patch from spatial domain to frequency domain representation. Instead of optimizing pixel values directly (0-255 extremes), the optimization occurs in the frequency spectrum where each coefficient can be independently adjusted. This dimensional transformation allows continuous value optimization while maintaining computational tractability through selective subband optimization.
2Adaptability or versatility
If Bayesian optimization is used to allow patch pixel values to be any integer between 0 and 255, then the degree of freedom is increased, but the resolution is limited due to low-dimensional input constraints
Solution Approach 1:
The patent divides the high-resolution patch into multiple frequency subbands (e.g., low-frequency, mid-frequency, high-frequency components). Each subband contains a subset of the total frequency coefficients, reducing the dimensional burden on Bayesian optimization. The independent optimization of each subband enables the system to handle high-resolution patches with thousands of pixels while maintaining computational feasibility.
Solution Approach 2:
The patent changes the optimization parameters from spatial pixel values to frequency domain coefficients. This parameter transformation allows continuous optimization of each coefficient independently, providing fine-grained control over the patch's frequency composition. The Bayesian optimization can efficiently explore the continuous parameter space of frequency coefficients without being constrained by the original pixel resolution limitations.
3Reliability
If the patch resolution is increased to improve attack effectiveness, then the degree of freedom increases, but the dimensionality exceeds the practical limit for Bayesian optimization
Solution Approach 1:
The patent applies Fourier transform to decompose the high-resolution patch into multiple frequency subbands. Each subband contains a manageable number of frequency coefficients that can be independently optimized. This segmentation reduces the optimization dimensionality from tens of thousands (for high-resolution spatial patches) to hundreds or thousands per subband, making Bayesian optimization computationally feasible while maintaining high overall resolution.
Solution Approach 2:
The patent transforms the optimization problem from spatial domain to frequency domain, where the dimensionality can be effectively managed through subband decomposition. This dimensional change allows the system to work with high-resolution patches by distributing the optimization burden across multiple frequency subbands rather than optimizing all pixels simultaneously in the spatial domain.
Data Source
AI summary
A system includes a controller configured to generate an original patch utilizing Bayesian optimization, output the original patch at a display at a scene and determine if the original patch does not meet a success criteria of the machine-learning model, in response to the original patch not meeting the success criteria, upscaling the patch, decompose the upscaled patch into o components, for each of the components, utilize Bayesian optimization to update one of the components of the upscaled patch and freezing the other components to generate an updated patch, in response to the updated patch meeting the success criteria, output the updated upscaled patch, and in response to the updated upscaled patch not meeting the success criteria, iteratively update the unfrozen components and determine if the success criteria is met and if not met, unfreeze the frozen components and iteratively update the unfrozen components until the success criteria is met.