Gradient Optimization for Adversarial Defense in Image Recognition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing Local Gradients Smoothing (LGS) algorithm has a low original target recognition rate when important features of the input sample are covered by adversarial patches, as it randomly places patches in edge regions, leading to loss of details and reduced classification accuracy.
Innovation Solution
A method and apparatus for heuristically defending against local adversarial attacks through gradient optimization, which involves processing the original image to obtain a gradient image, selecting and suppressing noise regions to form a defense patch, performing gradient enhancement, and projecting the defense patch onto the enhanced image to form a defense-processed image, effectively filtering out noise and highlighting contour information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If the LGS algorithm suppresses high-frequency noise in edge regions, then adversarial patch interference is reduced, but original target details are lost and classification accuracy decreases
Solution Approach 1:
The patent applies different processing strategies to different regions of the image based on their characteristics. Edge regions with high-frequency noise undergo gradient smoothing to remove adversarial patches, while central regions with important target features undergo gradient enhancement to preserve and emphasize original details. This localized differential processing resolves the contradiction by adapting the processing intensity and type to the specific needs of each region.
Solution Approach 2:
The patent dynamically adjusts the gradient operation order based on the local characteristics of different image regions. By using higher-order gradients for noise suppression in edge regions and lower-order gradients for feature preservation in central regions, the algorithm adaptively balances noise removal and detail preservation, resolving the static trade-off between adversarial defense and target recognition.
2Reliability
If gradient smoothing is applied to suppress adversarial noise, then classification robustness is improved, but important feature details are blurred
Solution Approach 1:
The patent applies gradient smoothing selectively to edge regions where adversarial patches are most likely to appear, while applying gradient enhancement to central regions where target features are concentrated. This localized quality differentiation ensures that robustness improvements are achieved where needed without compromising feature detail precision in critical areas.
Solution Approach 2:
The patent changes the gradient operation parameter (order of gradient) based on the processing objective. Higher-order gradients are used for noise suppression to achieve stronger smoothing effects, while lower-order gradients are used for feature enhancement to maintain detail fidelity. This dynamic parameter adjustment resolves the contradiction between robustness and precision.
3Object-affected harmful factors
If adversarial patches are placed randomly in images, then attack effectiveness is improved, but defense algorithm performance deteriorates due to coverage of important features
Solution Approach 1:
The patent divides the image into different regional zones (edge regions and central regions) and applies different processing intensities to each. Edge regions undergo stronger gradient smoothing to counteract random adversarial patches, while central regions undergo gradient enhancement to preserve target features even when partially covered. This regional differentiation allows the system to maintain performance despite random patch placement.
Solution Approach 2:
The patent dynamically switches between gradient smoothing and gradient enhancement operations based on the spatial location and local image characteristics. When adversarial patches are detected in edge regions, gradient smoothing is applied; when target features are identified in central regions, gradient enhancement is applied. This dynamic adaptation allows the system to effectively counter random patch placement strategies.
Data Source
AI summary
The present disclosure relates to a method and apparatus for heuristically defending against a local adversarial attack through gradient optimization. The method includes: processing an original image to obtain a gradient image; selecting a noise region in the gradient image and suppressing the noise region to form a defense patch; performing gradient enhancement on the original image to form a gradient-enhanced image; and projecting the defense patch onto the gradient-enhanced image to form a defense-processed image. The present disclosure can suppress high-frequency noise and prevent a deep neural network from being attracted by the high-frequency noise to make misjudgment, to suppress an adversarial patch. In addition, a contour and texture of the original image are enhanced by performing gradient enhancement on the original image, recognition by a classifier is facilitated, and image recognition accuracy is improved.