Deep Neural Network Adversarial Detection via Bayesian Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep neural networks (DNNs) are vulnerable to adversarial examples and existing defense methods, such as adversarial training, incur high training overheads and degrade predictive performance on clean examples, while Bayesian neural networks face challenges in training efficiency, accuracy, and task-dependent predictive performance for adversarial detection.
Innovation Solution
Training a DNN with a few Bayesian layers to distinguish adversarial examples from benign ones using uncertainty quantification, where the model calculates a difference between variational and true posterior probability distributions and updates weights based on predictive uncertainty, enabling efficient adversarial detection across various tasks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial training is used to improve adversarial detection, then detection ability is improved, but training overhead increases and predictive performance on clean examples degrades
Solution Approach 1:
The patent segments the neural network into Bayesian layers (for uncertainty estimation and adversarial detection) and deterministic layers (for task-specific predictions). This segmentation allows the model to specialize different parts for different functions, improving adversarial detection without requiring full adversarial training of the entire network, thus reducing training overhead while maintaining detection ability.
Solution Approach 2:
The patent applies Bayesian inference only to specific layers (particularly the last few layers) rather than the entire network. This partial application provides sufficient uncertainty estimation for adversarial detection while significantly reducing the computational burden and training overhead compared to making the entire network Bayesian.
2Measurement precision
If Bayesian neural networks are used for adversarial detection, then uncertainty estimation capability is improved, but training efficiency decreases due to larger parameter amounts
Solution Approach 1:
The patent segments the network architecture into Bayesian and deterministic layers. By placing Bayesian layers only where uncertainty estimation is most valuable (output layers and critical intermediate layers), the model achieves reliable uncertainty estimation for adversarial detection while keeping the total parameter count manageable, thus maintaining training efficiency.
Solution Approach 2:
The patent applies Bayesian inference with local quality by making only specific layers Bayesian rather than the entire network. This allows high-quality uncertainty estimation at critical decision points while avoiding the computational burden of Bayesian inference throughout the entire network, thus balancing accuracy and training efficiency.
3Reliability
If more Bayesian layers are used to improve uncertainty quantification, then adversarial detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent applies Bayesian inference partially to only the most critical layers (particularly the last few layers) rather than uniformly across all layers. This partial application provides sufficient uncertainty quantification for accurate adversarial detection while avoiding the excessive computational complexity that would result from making all layers Bayesian.
4Reliability
If adversarial training is applied to improve robustness, then resistance to adversarial attacks is improved, but predictive performance on clean examples deteriorates
Solution Approach 1:
The patent segments the network into Bayesian layers that handle uncertainty and adversarial detection, and deterministic layers that maintain task-specific predictive performance. This segmentation allows the deterministic layers to be trained on clean examples for high accuracy, while the Bayesian layers provide robustness through uncertainty estimation, thus maintaining both robustness and predictive performance.
Data Source
AI summary
A method for training a deep neural network (DNN) capable of adversarial detection. The DNN is configured with a plurality of sets of weights candidates. The method includes inputting training data selected from training data set to the DNN. The method further includes calculating, based on the training data, a first term for indicating a difference between a variational posterior probability distribution and a true posterior probability distribution of the DNN. The method further includes perturbing the training data to generate perturbed training data; and calculating a second term for indicating a quantification of predictive uncertainty on the perturbed training data. The method further includes updating the plurality of sets of weights candidates of the DNN based on augmenting the summation of the first term and the second term.