Hardened Neural Network Framework Against Evasion Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep learning neural networks are vulnerable to evasion attacks, such as gradient-based attacks, where attackers manipulate inputs to misclassify data, leading to security breaches by causing small, imperceptible changes that result in large differences in output, which existing defense mechanisms often fail to detect.
Innovation Solution
A hardened neural network framework is implemented by training the network using a modified loss function that combines the original loss function with a function accounting for differences between input and reference data sets, ensuring small input differences result in small output differences, thereby preventing misclassification. This is achieved by generating a reference training data set and processing both original and reference data sets to minimize the modified loss function, using techniques like stochastic gradient descent.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional neural network is used, then the network can process data efficiently, but it is vulnerable to evasion attacks where small input perturbations cause large output changes
Solution Approach 1:
The patent applies preliminary action by generating a reference training data set before actual training, where each reference sample is created by adding noise to original training samples. This preprocessing step establishes a foundation for robust training that prevents evasion attacks before the model is deployed, rather than attempting to detect or respond to attacks after they occur.
Solution Approach 2:
The patent changes the training parameters by introducing a modified loss function that incorporates both the original loss and a reference loss component. This parameter change in the optimization objective forces the model to learn features that are robust to input perturbations, directly addressing the security vulnerability while maintaining training feasibility through gradient-based optimization.
2Reliability
If the modified loss function is used to harden the network, then security against gradient-based attacks is improved, but the training process becomes more complex
Solution Approach 1:
The patent merges the original training objective with the robustness objective into a single modified loss function. By combining the original loss (for accurate classification) and the reference loss (for robustness against perturbations) into one unified optimization target, the approach simplifies the training process compared to separate training stages, while still achieving resistance to gradient-based attacks.
Solution Approach 2:
The modified loss function implements feedback by using the reference training data (generated from original data with added noise) to provide additional supervisory signals during training. This feedback mechanism guides the model to learn decision boundaries that are less sensitive to input perturbations, improving security while maintaining a systematic training approach.
3Reliability
If small input differences are allowed to result in small output differences, then security is enhanced, but the network's ability to detect actual anomalies may be reduced
Solution Approach 1:
The patent applies local quality by making the neural network's response characteristics different in different regions of the input space. Specifically, the training ensures that around legitimate data points, small perturbations produce small output changes (enhancing security), while the model maintains its ability to produce large output changes when presented with genuinely anomalous inputs that differ systematically from training data.
Solution Approach 2:
The approach creates a composite training data structure by combining original training samples with reference samples (original samples plus noise). This composite training set enables the model to learn both robustness to small perturbations and sensitivity to genuine anomalies, achieving a balance between security and anomaly detection capability.
Data Source
AI summary
Mechanisms are provided to implement a hardened neural network framework. A data processing system is configured to implement a hardened neural network engine that operates on a neural network to harden the neural network against evasion attacks and generates a hardened neural network. The hardened neural network engine generates a reference training data set based on an original training data set. The neural network processes the original training data set and the reference training data set to generate first and second output data sets. The hardened neural network engine calculates a modified loss function of the neural network, where the modified loss function is a combination of an original loss function associated with the neural network and a function of the first and second output data sets. The hardened neural network engine trains the neural network based on the modified loss function to generate the hardened neural network.