Deep Neural Network Decoy Training for Adversarial Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep neural networks (DNNs) are vulnerable to adversarial attacks, where attackers inject small perturbations into input data to cause misclassifications, posing risks in critical applications like autonomous driving and visual authentication, and existing defenses are still susceptible to generating successful adversarial examples.
Innovation Solution
The method involves generating decoy data and training DNNs with both regular and decoy data, allowing the network to misdirect adversarial attacks towards decoy samples, making them detectable by distinguishing between regular and decoy data outputs, thereby enhancing security without relying on obscurity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNNs are trained only with regular data, then the network achieves good classification performance on normal inputs, but it becomes vulnerable to adversarial attacks causing misclassifications
Solution Approach 1:
The patent applies preliminary action by pre-training the DNN with decoy data before deployment. This preparatory training phase embeds decoy patterns into the network's decision boundaries, so that when adversarial examples are encountered during operation, the network has already learned to recognize and misclassify them toward decoy labels, thereby preventing successful attacks on legitimate classifications.
Solution Approach 2:
The patent converts the harmful effect of adversarial perturbations into a beneficial detection mechanism. By training the network to misclassify adversarial examples as decoy data rather than legitimate data, the system transforms the attack's ability to cause misclassification into a useful signal for detecting and blocking adversarial inputs, thus converting harm into benefit.
2Reliability
If decoy training is implemented to detect adversarial attacks, then security against attacks is improved, but the system complexity increases due to additional training data and post-processing steps
Solution Approach 1:
The patent merges the detection function into the existing classification network by integrating decoy training into the standard DNN training pipeline. Rather than adding a separate detection system, the same network performs both classification and adversarial detection by learning to distinguish regular data from decoy data during training, thereby reducing overall system complexity.
Solution Approach 2:
The patent applies self-service by enabling the DNN to perform its own security validation without external detection systems. The network uses its internal learned representations from decoy training to automatically identify and flag adversarial examples during inference, eliminating the need for separate detection mechanisms and reducing system complexity.
3Reliability
If the DNN is made more robust to adversarial attacks through additional defenses, then attack resistance improves, but the false positive rate increases reducing system accuracy
Solution Approach 1:
The patent applies local quality by creating specialized decoy regions in the feature space that are distinct from legitimate data distributions. By training the network to recognize specific local patterns characteristic of adversarial examples and directing them to decoy labels, the system achieves high attack resistance while maintaining low false positive rates, as legitimate variations in input data are not confused with adversarial patterns.
Data Source
AI summary
Decoy data is generated from regular data. A deep neural network, which has been trained with the regular data, is trained with the decoy data. The trained deep neural network, responsive to a client request comprising input data, is operated on the input data. Post-processing is performed using at least an output of the operated trained deep neural network to determine whether the input data is regular data or decoy data. One or more actions are performed based on a result of the performed post-processing.