Adversarial-Robust CNN via Filter Pruning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods to counter adversarial attacks on artificial neural networks, particularly in image processing, are resource-intensive and do not provide adequate performance, posing risks in safety-critical fields like autonomous driving and medicine.
Innovation Solution
An image training device and method that employs filter pruning in convolutional neural networks, involving a normal image training unit, an adversarial image gradient acquisition unit, a filter pruning unit, and a retraining unit to prune filters with large loss gradients caused by adversarial attacks, thereby enhancing robustness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing methods are used to counter adversarial attacks on artificial neural networks, then some level of protection is achieved, but significant time and resources are required for training
Solution Approach 1:
The patent extracts and removes vulnerable filters from the convolutional neural network that are identified as being susceptible to adversarial attacks. By pruning these specific filters based on their vulnerability metrics, the system achieves robustness protection without requiring extensive retraining of the entire network, thus reducing training time while maintaining reliability
Solution Approach 2:
The patent changes the parameters of the neural network by adjusting filter weights and pruning specific filters based on vulnerability analysis. This parameter modification approach allows the network to become more robust to adversarial attacks without requiring complete retraining, thereby reducing the time and resources needed while improving reliability
2Reliability
If existing methods are used to counter adversarial attacks on artificial neural networks, then some level of protection is achieved, but the methods do not provide adequate performance
Solution Approach 1:
The patent applies local quality by treating different filters differently based on their individual vulnerability characteristics. Instead of uniformly adjusting all filters, the system identifies and prunes only the vulnerable filters while preserving the majority of filters that contribute to accurate performance, thus achieving both robustness and maintaining performance accuracy
Solution Approach 2:
By extracting and removing only the vulnerable filters identified through vulnerability analysis, the system eliminates the source of adversarial susceptibility while preserving the functional integrity of the network. This selective removal approach maintains performance accuracy by keeping the majority of useful filters intact
3Reliability
If filter pruning is applied to remove vulnerable filters, then robustness to adversarial attacks is improved, but the complexity of the training process increases
Solution Approach 1:
The patent performs preliminary vulnerability analysis on filters before the main training process. By identifying vulnerable filters in advance through gradient-based analysis and pruning them before full training, the system simplifies the overall training process by reducing the number of filters that need to be trained, thereby decreasing training complexity while improving robustness
Data Source
AI summary
Proposed is an image training device and method that are robust to an image adversarial attack. The image training device includes: a normal image training unit configured to set weights of a convolutional neural network and a fully connected (FC) neural network through learning about a normal image; an adversarial image gradient acquisition unit configured to input an image damaged by an adversarial attack into the trained convolutional neural network and acquire a loss gradient size caused by the image damaged by the adversarial attack for each filter of the convolutional neural network; a filter pruning unit configured to prune some filters of the convolutional neural network based on the loss gradient size for each filter; and a retraining unit configured to retrain a convolutional neural network and a FC neural network modified through the filter pruning using the normal image.