Classifier Training with Reusable Perturbations for Adversarial Robustness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Classifiers, especially those based on machine learning models, are susceptible to adversarial examples that can lead to misclassification, posing a risk in applications like autonomous vehicles, where robustness against such attacks is critical.
Innovation Solution
A method for training classifiers using diverse initial perturbations that are quickly adapted to training data, allowing for faster and more robust adversarial training, which involves applying perturbations to input signals to create adversarial examples and iteratively strengthening them to enhance the classifier's resilience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial training methods are used to harden classifiers against adversarial examples, then the robustness of the classifier is improved, but the training time increases significantly due to the need to adapt initial perturbations to the training data
Solution Approach 1:
The patent applies preliminary action by providing a diverse set of pre-generated initial perturbations before the adversarial training process begins. These perturbations are prepared in advance and cover a wide range of adversarial attack patterns, eliminating the need to generate them during training. This pre-preparation significantly reduces the training time while maintaining the robustness improvement benefit.
Solution Approach 2:
The patent uses copying by generating multiple diverse initial perturbations that can be reused across different training iterations and data samples. Instead of creating new perturbations for each training step, the same set of initial perturbations is copied and applied repeatedly, reducing computational overhead and training time while still providing comprehensive adversarial coverage.
2Reliability
If more training data is processed during a given timespan, then the classifier becomes more robust, but the computational resources and training time required increase
Solution Approach 1:
The patent applies parameter changes by varying the characteristics of initial perturbations (such as magnitude, pattern type, and distribution) to create a diverse set that covers multiple adversarial attack scenarios. This diversity allows the classifier to learn from a broader range of adversarial examples without requiring proportionally more training time, as the perturbations are reused efficiently across the training process.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Computer-implemented method for training a classifier (60), wherein the classifier (60) is configured to classify input signals of digital image data and/or audio data and training the classifier (60) is based on a perturbed input signal obtained by applying a perturbation provided from a plurality (ξ) of perturbations to an input signal provided from a training dataset, wherein the method comprises the following steps: • Providing a plurality of initial perturbations; • Adapting a perturbation from the plurality of initial perturbations to an input signal, wherein the input signal is randomly drawn from the training dataset and the perturbation is adapted to the input signal such that applying the perturbation to the input signal yields a second input signal, which is classified differently than the first input signal; • Providing a subset of the plurality of initial perturbations as plurality (ξ) of perturbations; Training the classifier (60) based on the plurality (ξ) of perturbations.