Feature Remapping Model for Adversarial Example Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing defense methods against adversarial examples in deep learning models, such as data modification and model modification, either damage benign samples or require access to private model information, and are not effective in detecting and re-recognizing adversarial examples in a targeted manner.
Innovation Solution
A defense method based on feature remapping, which involves building a feature remapping model composed of significant and nonsignificant feature generation models and a shared discriminant model to detect and re-recognize adversarial examples, without requiring access to the internal details of the target model, thereby protecting model privacy and minimizing impact on benign sample recognition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data modification defense methods (resizing, rotating, flipping, recoding) are applied to damage adversarial perturbations, then adversarial examples are defended against, but original data sample distribution is changed simultaneously
Solution Approach 1:
The patent segments the feature space into significant features and nonsignificant features through the feature remapping model. The significant feature generation model extracts and preserves important characteristics, while the nonsignificant feature generation model handles less critical features. This segmentation allows targeted defense against adversarial perturbations in significant features without disrupting the overall data distribution of nonsignificant features.
Solution Approach 2:
The patent applies local quality by differentiating the treatment of different feature types. The shared discriminant model selectively applies transformation only to significant features that are vulnerable to adversarial attacks, while leaving nonsignificant features unchanged. This localized approach maintains data distribution integrity for most features while providing targeted defense where needed.
2Reliability
If model modification defense methods (modifying layers, activation functions, connection density) are applied, then model security is improved, but model privacy is compromised due to unknown structure details
Solution Approach 1:
The patent introduces an intermediary feature remapping model that sits between the original model and the defense mechanism. Instead of directly modifying the original model's internal structure (which would expose privacy details), the intermediary model processes features externally. This mediator approach provides model security through feature transformation while preserving the original model's private structure unchanged.
3Difficulty of detecting and measuring
If additional structure defense methods (adding detectors or substructures) are applied, then adversarial example detection is achieved, but structure complexity increases
Solution Approach 1:
The patent achieves multi-functionality by designing the feature remapping model to simultaneously perform multiple tasks: (1) feature transformation for defense, (2) adversarial example detection through the shared discriminant model, and (3) preservation of original model functionality. This universal approach consolidates multiple defense functions into a single integrated model rather than adding separate detectors, thereby reducing overall structural complexity.
4Measurement precision
If complete defense is applied to re-recognize labels of benign samples, then adversarial examples are correctly identified, but computation resources are consumed
Solution Approach 1:
The patent applies partial action by using the shared discriminant model to first classify samples into benign or adversarial categories before performing full re-recognition. This preliminary classification filters out the need for complete re-recognition of all samples, applying computational resources only to samples that require it, thereby reducing overall energy consumption while maintaining high recognition accuracy for adversarial examples.
Data Source
AI summary
A defense method against adversarial examples based on feature remapping, includes the following steps: building the feature remapping model, the feature remapping model is composed of the significant feature generation model and the nonsignificant feature generation model, and a shared discriminant model, the significant generation model is used to generate significant features, the nonsignificant generation model is used to generate nonsignificant features, and the shared discriminant model is used to discriminate fake or true of generated significant and nonsignificant features. The method combines the significant feature generation model and the nonsignificant feature generation model to build the detector that is used to detect adversarial examples and benign examples; builds the re-recognizer according to the significant feature generation model, the re-recognizer is used to recognize the type of adversarial examples while detecting; connects the detector to the output of the target model, and then use the detector to detect adversarial examples. While recognizing adversarial examples, the method connects the re-recognizer to the output of the target model, and then uses the re-recognizer to recognize adversarial examples. The present invention can achieve dual defense effects of the detection and re-recognition of adversarial examples.