Dual-Model Frame Analysis for Adversarial Patch Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning models are susceptible to patch attacks, which degrade accuracy by presenting adversarial patches, making it difficult to discern between algorithmic issues and actual attacks, leading to inaccurate detection.
Innovation Solution
Employ two distinct machine learning models (e.g., YOLO and Faster RCNN) to calculate certainty levels for object classification, identify frames with differing highest certainties, and determine a patch attack based on the variation in these certainties using a threshold condition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single machine learning model is used for object classification, then the system is simple and fast, but it is susceptible to patch attacks and cannot accurately distinguish between algorithmic issues and actual attacks
Solution Approach 1:
The patent combines multiple machine learning models with different algorithms (e.g., YOLO and Faster RCNN) into a unified detection system. These models work together to classify objects and generate certainty scores, allowing the system to cross-validate results and distinguish between genuine patch attacks and algorithmic limitations, thereby improving reliability while managing complexity through integrated architecture
2Measurement precision
If multiple machine learning models are used to detect patch attacks, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary classification using multiple models to establish baseline certainty scores before actual attack detection. By pre-processing frames with multiple models and storing their individual certainty assessments, the system prepares reference data that enables faster real-time detection, as the comparative analysis during actual detection only requires checking pre-computed certainty values against each other
3Object-affected harmful factors
If the system uses multiple models with different algorithms, then it becomes more resistant to adversarial patches, but the difficulty of detecting and measuring actual attacks increases
Solution Approach 1:
The patent changes the parameter of algorithmic diversity by employing models with fundamentally different architectures and processing approaches (e.g., single-shot detection vs. region proposal methods). This parameter change makes it difficult for adversarial patches designed for one algorithm to effectively manipulate all models simultaneously, as each model processes the input differently and generates independent certainty scores that can be compared to identify anomalies
Data Source
AI summary
An information processing device uses a first machine learning model and obtains a first classification result. The information processing device uses a second machine learning model and obtains a second classification result and identifies a first frame, based on the first classification result and the second classification result. The information processing device identifies a first class with a highest degree of certainty in the first classification result for any frame regarded as a reference and identifies a second frame that is immediately before or after the identified first frame. The information processing device determines a series of frames to be invalid when a predetermined condition is satisfied by a relationship between a first degree of certainty of the first class in the first classification result for the first frame and a second degree of certainty of the first class in the first classification result for the second frame.