Feature Scattering Adversarial Training for Model Robustness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current image classification models are vulnerable to adversarial examples, which are modified images that are visually indistinguishable from originals but cause incorrect label predictions, and existing adversarial training methods face challenges such as label leaking and neglecting inter-sample relationships, leading to limited robustness.
Innovation Solution
The feature-scattering-based adversarial training method generates adversarial examples by perturbing the local neighborhood structure in an unsupervised fashion, maximizing feature matching distance between clean and perturbed images, and using optimal transport to update model parameters, thereby leveraging inter-sample relationships for improved robustness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard adversarial training is used to improve model robustness, then model robustness is improved, but label leaking occurs and training time increases
Solution Approach 1:
The method pre-computes transport matrices between feature distributions of different classes before adversarial training. These pre-computed matrices are then used during training to guide the adversarial perturbation process, eliminating the need for iterative re-computation and reducing training time while maintaining robustness improvements.
Solution Approach 2:
The patent introduces optimal transport theory as an intermediary mechanism to measure and regulate the distance between feature distributions. By using transport matrices as intermediaries to guide adversarial examples, the method prevents label leaking while maintaining efficient training, as the transport matrices provide a fixed reference framework rather than requiring continuous iterative optimization.
2Ease of manufacture
If each training sample is treated individually in standard adversarial training, then training simplicity is maintained, but inter-sample relationships are neglected and performance is limited
Solution Approach 1:
The patent merges individual sample adversarial training with batch-level feature distribution analysis. By computing optimal transport matrices across the entire batch and using them to guide individual sample perturbations, the method combines the simplicity of individual sample processing with the benefits of inter-sample relationships, improving performance without significantly complicating the training process.
Solution Approach 2:
The method applies different treatment to different aspects of the training process: individual samples receive localized adversarial perturbations based on their specific features, while the overall batch benefits from global feature distribution analysis through transport matrices. This local quality approach allows each sample to be processed individually while still leveraging inter-sample relationships.
Data Source
AI summary
Described herein are embodiments for a feature-scattering-based adversarial training approach for improving model robustness against adversarial attacks. Conventional adversarial training approaches leverage a supervised scheme, either targeted or non-targeted in generating attacks for training, which typically suffer from issues such as label leaking as noted in recent works. Embodiments of the disclosed approach generate adversarial images for training through feature scattering in the latent space, which is unsupervised in nature and avoids label leaking. More importantly, the presented approaches generate perturbed images in a collaborative fashion, taking the inter-sample relationships into consideration. Extensive experiments on different datasets compared with state-of-the-art approaches demonstrate the effectiveness of the presented embodiments.