DNN Adversarial Attack Detection via Intermediate Layer Consistency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep neural networks (DNNs) are vulnerable to adversarial attacks, which can cause misclassifications in critical applications by injecting small perturbations into input data, and existing defense mechanisms are still susceptible to generating successful attacks.
Innovation Solution
The technique leverages the inconsistency between final target labels and intermediate representations within the DNN to detect adversarial attacks by examining label and correlation consistency, allowing for appropriate actions to be taken to protect the system, such as issuing notifications or re-training the DNN.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial training or input preprocessing is used to defend against attacks, then the DNN becomes more resistant to some attacks, but it remains vulnerable to successful adversarial attacks and increases system complexity
Solution Approach 1:
The patent segments the DNN into multiple layers and examines intermediate representations at different stages. By dividing the detection process across layers rather than relying on a single defense mechanism, the system identifies adversarial examples through inconsistencies in intermediate outputs without requiring complex preprocessing or retraining of the entire model.
Solution Approach 2:
The patent introduces an intermediary detection mechanism that monitors intermediate representations within the DNN. This intermediary layer analyzes consistency across different layers to detect adversarial inputs, providing a defense mechanism that operates within the existing model architecture rather than adding external complexity.
2Reliability
If existing defense mechanisms are applied to harden the DNN, then some attacks are blocked, but the DNN still generates successful adversarial examples and loses detection precision
Solution Approach 1:
The patent implements a feedback mechanism that uses intermediate representations from multiple layers to detect adversarial examples. By continuously monitoring consistency across layers and providing feedback about detected inconsistencies, the system maintains high detection precision while defending against attacks, avoiding the precision loss associated with traditional hardening methods.
Solution Approach 2:
The detection approach dynamically evaluates intermediate representations at different layers during inference. Rather than using static defense mechanisms that may fail against new attack types, the dynamic analysis of layer-wise consistency adapts to detect various adversarial strategies while maintaining precision.
3Reliability
If adversarial training is used to improve robustness, then the model becomes harder to attack, but it requires additional training data and computing resources
Solution Approach 1:
The patent performs preliminary analysis of intermediate representations during the normal inference process. By examining layer outputs as part of the standard forward propagation, the system detects adversarial examples without requiring separate training phases or additional computing resources beyond what is already needed for model inference.
Solution Approach 2:
The detection mechanism uses the DNN's own intermediate representations to identify adversarial inputs. The model essentially detects attacks using its internal structure and outputs, eliminating the need for external adversarial training data or additional computational models, thereby reducing energy and resource requirements.
Data Source
AI summary
A method, apparatus and computer program product to protect a deep neural network (DNN) having a plurality of layers including one or more intermediate layers. In this approach, a training data set is received. During training of the DNN using the received training data set, a representation of activations associated with an intermediate layer is recorded. For at least one or more of the representations, a separate classifier (model) is trained. The classifiers, collectively, are used to train an outlier detection model. Following training, the outliner detection model is used to detect an adversarial input on the deep neural network. The outlier detection model generates a prediction, and an indicator whether a given input is the adversarial input. According to a further aspect, an action is taken to protect a deployed system associated with the DNN in response to detection of the adversary input.