Dual Neural Network Robustness Testing for Adversarial Inputs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural networks used in autonomous systems, such as autonomous driving, are vulnerable to adversarial perturbations that can fool them without being detectable by the human eye, making them unreliable and requiring time-consuming and costly retraining to achieve robustness against all possible adversarial examples.
Innovation Solution
A method is proposed to determine whether a neural network is provably robust against perturbations by testing its output under various modifications, using a second automated learning system with reversed layers to assess the robustness of the original system, and issuing a robustness certificate if the modification does not change the output value within a given magnitude.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If neural networks are retrained with adversarial modifications to achieve robustness, then reliability against adversarial attacks is improved, but time consumption and cost increase significantly
Solution Approach 1:
The patent applies preliminary action by performing robustness testing before deployment or critical operations. The system pre-evaluates the neural network's vulnerability to adversarial perturbations using the dual network approach, identifying potential attack vectors in advance. This allows the system to prepare robustness certificates or trigger retraining only when necessary, rather than continuously retraining regardless of actual vulnerability
Solution Approach 2:
The patent replaces the mechanical retraining process with a computational testing approach. Instead of physically retraining the neural network with adversarial examples (which is time-consuming), the system uses a dual neural network to computationally test for vulnerabilities. This substitution transforms a resource-intensive mechanical process into an efficient computational evaluation that provides robustness guarantees without requiring actual retraining
2Reliability
If comprehensive adversarial modifications are generated to cover all possible attacks, then robustness is improved, but device complexity and computational resources increase
Solution Approach 1:
The patent applies universality by designing a dual neural network that serves multiple functions: it acts as both a robustness tester and a certificate generator. The same dual network architecture can evaluate different types of adversarial perturbations (Lp-norm bounded, unbounded) and provide comprehensive robustness guarantees across all possible attacks within the specified constraints, eliminating the need for separate testing mechanisms for each attack type
Solution Approach 2:
The patent introduces the dual neural network as an intermediary between the original neural network and the adversarial attack. Rather than directly generating and testing numerous adversarial examples against the original network, the dual network serves as a mediator that computationally evaluates robustness and provides mathematical guarantees. This intermediary approach simplifies the complexity by centralizing the robustness evaluation function in a specialized network designed for this purpose
3Reliability
If adversarial modifications are applied to training images, then robustness is improved, but manufacturing cost and processing time increase
Solution Approach 1:
The patent applies copying by creating a dual neural network that replicates the architecture and parameters of the original network. This copy is then used specifically for robustness testing purposes. The dual network can be trained independently using the same training data without modifying the original network's training process, allowing robustness evaluation to proceed in parallel with normal training operations, thus maintaining training efficiency while achieving robustness guarantees
Data Source
AI summary
In a method for training a first neural network a superposed classification is back-propagated through a second neural network. An output value of the second neural network is utilized to determine whether the input of the first neural network is adversarial.