Classifier Training via Iterative Adversarial Perturbation Adaptation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Classifiers are vulnerable to misclassification by adversarial examples, posing a risk in safety-critical applications such as autonomous vehicles, where they can fail to detect pedestrians, leading to potential collisions.
Innovation Solution
A method for training classifiers to become more robust against universal adversarial examples by iteratively selecting and adapting perturbations, using a combination of pretraining and meta-training techniques, including gradient-based approaches like I-FGSM and PGD, to create diverse and strong adversarial examples, which helps the classifier learn to defend against increasingly stronger perturbations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a classifier is trained using standard methods, then it achieves good classification accuracy on normal inputs, but it becomes vulnerable to adversarial examples that cause misclassification
Solution Approach 1:
The method performs preliminary actions by pre-training the classifier on normal data before exposing it to adversarial examples. This staged approach allows the classifier to first learn normal patterns, then gradually adapt to adversarial perturbations through meta-training, reducing overall training complexity while improving robustness
Solution Approach 2:
The training process maintains continuous useful action by iteratively generating new adversarial examples and re-training the classifier throughout the meta-training phase. This continuous cycle of attack and defense refinement ensures the classifier progressively improves its robustness without interruption
2Reliability
If universal adversarial perturbations are generated and applied to train the classifier, then robustness against adversarial examples improves, but the training process becomes more complex and computationally demanding
Solution Approach 1:
The method generates universal adversarial perturbations that can fool the classifier across multiple input types and categories simultaneously. This single set of perturbations serves multiple training purposes, improving robustness against various adversarial attacks without requiring separate training for each attack type, thus maintaining training efficiency
Solution Approach 2:
The approach uses copied and transformed versions of adversarial perturbations across different training iterations and input samples. By reusing and adapting the core perturbation patterns rather than generating entirely new attacks each time, the method reduces computational overhead while maintaining training effectiveness
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Computer-implemented method for training a classifier (60) for classifying input signals (x) provided to the classifier (60), wherein the classifier (60) is configured to obtain an output signal (y) characterizing a classification of the input signal (x), wherein the method for training comprises the following steps: a. Providing (601) a set of perturbations; b. Providing (602) a subset of first training samples each comprising an input signal and a corresponding desired output signal from a first dataset of training samples; c. Selecting (603) a first perturbation form the set of perturbations for an input signal and a corresponding desired output signal from the subset; d. Obtaining (604) a second perturbation, which is stronger than the first perturbation, by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier; e. Obtaining (605) a first adversarial example by applying the second perturbation to the input signal; f. Adapting (606) the classifier (60) by training the classifier (60) based on the first adversarial example and the corresponding desired output signal to harden the classifier (60) against the second perturbation; g. Replacing (607) the first perturbation in the set of perturbations a linear combination of the first perturbation and the second perturbation;