Dynamic Preprocessor Block for Adversarial Sample Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep learning classifiers are susceptible to adversarial samples that introduce visually negligible perturbations, posing a significant risk in mission-critical systems like autonomous driving, and existing defense methods are either resource-intensive, ineffective, or unable to correctly classify adversarial examples.
Innovation Solution
Implementing a dynamic preprocessor block with a repository of defensive methods and a dynamic selector that iteratively applies a subset of preprocessing techniques at inference time, creating a moving target defense that disrupts the attacker's optimization process and enhances protection against adversarial example generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial training is used to defend against adversarial samples, then classification accuracy is improved, but training time and computational resources are significantly increased
Solution Approach 1:
The patent applies preliminary action by pre-processing input data through multiple encoding transformations (JPEG compression, PNG compression, bicubic resizing) before the adversarial training process. This preprocessing step prepares the data in advance to reduce the impact of adversarial perturbations, thereby improving classification accuracy without requiring additional training time for the defense mechanism itself.
Solution Approach 2:
The patent employs parameter changes by systematically varying encoding parameters such as quality factors (0.9, 0.8, 0.7), compression levels, and resizing dimensions. These parameter transformations modify the input data representation to make adversarial perturbations less effective, improving reliability while maintaining efficient training processes.
2Reliability
If multiple defensive preprocessing methods are applied, then protection against adversarial examples is enhanced, but runtime and compute resource utilization increase
Solution Approach 1:
The patent segments the defensive preprocessing into distinct, modular encoding steps (JPEG compression, PNG compression, bicubic resizing). Each encoding method can be independently applied and configured, allowing the system to selectively combine multiple defenses while maintaining manageable computational overhead through modular architecture.
Solution Approach 2:
The patent applies partial action by selectively applying only certain preprocessing methods based on the specific threat model and performance requirements. The system can configure which encodings to apply (e.g., only JPEG and bicubic, or all three methods), enabling adaptive resource allocation that balances protection effectiveness with computational efficiency.
3Reliability
If existing defense methods are used, then some protection is provided, but they are unable to correctly classify adversarial examples or are ineffective against sophisticated attacks
Solution Approach 1:
The patent employs composite materials by combining multiple different encoding methods (JPEG, PNG, bicubic) into a composite preprocessing pipeline. This combination creates a more robust defense that addresses different types of adversarial perturbations, making it difficult for attackers to craft effective adversarial examples that bypass all encoding transformations simultaneously.
Solution Approach 2:
The patent applies dynamics by making the preprocessing configuration flexible and adaptable. The system can dynamically adjust which encoding methods are applied and with what parameters based on the input characteristics and threat level, creating a dynamic defense that adapts to different attack scenarios rather than using a fixed preprocessing pipeline.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Adversarial sample protection for machine learning is described. An example of a storage medium includes instructions for initiating processing of examples for training of an inference engine in a system; dynamically selecting a subset of defensive preprocessing methods from a repository of defensive preprocessing methods for a current iteration of processing, wherein a subset of defensive preprocessing methods is selected for each iteration of processing; performing training of the inference engine with a plurality of examples, wherein the training of the inference engine include operation of the selected subset of defensive preprocessing methods; and performing an inference operation with the inference engine, including utilizing the selected subset of preprocessing defenses for the current iteration of processing.