Dual Neural Network Robustness Indicator for Adversarial Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Artificial Neural Networks (ANNs) are highly vulnerable to adversarial attacks, making them unreliable in applications like autonomous driving, where misclassification due to perturbations in input data can occur undetectably, and existing defense mechanisms, such as retraining with adversarial examples, are time-consuming and incomplete.
Innovation Solution
A robustness indicator unit is introduced that determines the robustness of a trained ANN by propagating input data through a dual ANN, where the output layer becomes the input layer and vice versa, allowing for the determination of upper and lower bounds of activation functions, enabling quick assessment of ANN robustness against perturbations without needing to check all classes, facilitating real-time operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If retraining neural network with adversarial modifications is performed, then robustness against adversarial attacks is improved, but training time and computational cost increase significantly
Solution Approach 1:
The patent performs robustness verification in advance by constructing a dual neural network and solving an optimization problem to determine if adversarial examples exist within a perturbation ball. This preliminary action identifies vulnerabilities before deployment, avoiding the need for time-consuming retraining while ensuring robustness through certificate generation that proves the network's resistance to adversarial attacks within specified perturbation bounds.
Solution Approach 2:
The patent creates a dual neural network that is a transformed copy of the original network, where the output layer becomes the input layer and vice versa. This copied structure enables efficient verification of robustness without modifying or retraining the original network, thus maintaining reliability while avoiding time loss associated with retraining.
2Reliability
If comprehensive adversarial testing is performed to ensure robustness, then reliability is improved, but computational complexity increases
Solution Approach 1:
The patent inverts the verification approach by constructing a dual neural network where the output layer of the original network becomes the input layer of the dual network. This inversion transforms the complex problem of verifying robustness across all possible perturbations into an optimization problem that can be efficiently solved, reducing computational complexity while maintaining verification accuracy.
Solution Approach 2:
The patent changes the parameters of the neural network by constructing a dual network with transformed weights and biases based on the original network's parameters. This parameter transformation enables the use of optimization techniques to verify robustness without requiring exhaustive testing, thus reducing computational complexity while ensuring reliable verification.
3Measurement precision
If all classes are checked for robustness indicators, then measurement precision is improved, but processing time increases
Solution Approach 1:
The patent extracts the essential robustness verification by focusing on the optimization problem formulation that determines the existence of adversarial examples. Instead of checking all classes individually, the method extracts the key information through the dual network's optimization approach, achieving precise robustness measurement without the time cost of exhaustive class-by-class verification.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A robustness indicator unit (2000) and a computer-implemented method for determining a robustness indicator (RI) for a trained artificial neural network (100) are provided. The robustness indicator (RI) indicates a robustness of the trained artificial neural network (100) against adversarial attacks.