Image Classifier Training Against Physical Occlusion Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep neural networks used in image classification are highly vulnerable to physically realizable attacks, where adversaries modify physical objects, such as adding stickers to stop signs, causing the networks to misclassify them.
Innovation Solution
The implementation of a system and method for image classification that uses adversarial training with Projected Gradient Descent (PGD) attacks and randomized smoothing to generate robust models against physically realizable attacks, specifically by occluding images with predetermined shapes containing noise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If standard deep neural network classification is used, then high accuracy on clean images is achieved, but vulnerability to physically realizable attacks increases
Solution Approach 1:
The system performs preliminary adversarial training by generating adversarial examples with occlusions before deployment. The DOA classifier is trained in advance on both clean images and adversarially occluded images, preparing the model to withstand physical attacks before encountering them in real-world scenarios.
Solution Approach 2:
The system applies preliminary anti-action by training the classifier against adversarial occlusions that simulate physical attacks. The adversarial training process pre-empts potential attacks by exposing the model to worst-case scenarios during training, thereby reducing vulnerability when deployed.
2Reliability
If adversarial training with occlusions is applied, then robustness against physically realizable attacks is improved, but training complexity increases
Solution Approach 1:
The system uses self-service by implementing automated adversarial example generation and occlusion synthesis during the training process. The training pipeline automatically generates adversarial occlusions, applies them to training images, and updates the classifier without requiring manual intervention for each adversarial scenario, thereby managing complexity through automation.
3Reliability
If adversarial training is used to defend against attacks, then defense effectiveness is improved, but computational resources required increase
Solution Approach 1:
The system applies partial action by focusing adversarial training on specific occlusion patterns and regions that are most relevant to physically realizable attacks. Rather than defending against all possible perturbations equally, the training concentrates computational resources on generating and defending against occlusions that simulate actual physical threats like stickers or objects placed in front of cameras.
Data Source
AI summary
An image classification system defends against physically realizable attacks. A training dataset of input images is retrieved and an adversarial image is generated based on one of the input images that is selected. The adversarial image is created by occluding a portion of the selected image by superimposing a predetermined shape (e.g., a rectangle) containing noise on the selected image. A defense against occlusion attacks (DOA) classifier is trained using the training dataset and the adversarial image. The DOA classifier is utilized to classify captured images of items (e.g., street signs) that may have been attacked (e.g., sticker placement, vandalism).