Adversarial Perturbation Search for Integer-Input ML Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating adversarial perturbations in machine learning systems are ineffective for non-image data, particularly tabular data, as they rely on gradient-based methods that require floating-point inputs, making them unsuitable for integer inputs and difficult to detect in real-world scenarios.
Innovation Solution
A computer-implemented method that iteratively determines adversarial perturbations for machine learning systems by sampling and applying perturbations to input signals, assessing their fitness using a loss function, and optimizing them without requiring gradients, allowing for the generation of adversarial examples suitable for integer inputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If gradient-based methods are used to generate adversarial perturbations, then the perturbations can be optimized effectively, but the method becomes unsuitable for integer inputs and cannot be applied to non-image data
Solution Approach 1:
The patent replaces gradient-based optimization (continuous differential calculus) with a discrete optimization approach using random sampling and iterative refinement. Instead of computing gradients that require floating-point differentiation, the method uses discrete perturbation sampling combined with loss function evaluation and iterative improvement, making it applicable to integer inputs while maintaining optimization effectiveness
Solution Approach 2:
The patent changes the parameter space from continuous floating-point values to discrete integer values. The optimization process operates in the discrete domain by sampling integer perturbations and iteratively refining them based on loss function feedback, thereby adapting the adversarial attack methodology to work with integer-encoded non-image data while preserving the core optimization mechanism
2Object-affected harmful factors
If imperceptibility is prioritized for adversarial examples, then human detection is reduced, but this approach is not suitable for non-image data where imperceptibility is not the primary concern
Solution Approach 1:
The patent inverts the traditional adversarial example objective. Instead of minimizing perturbation magnitude to achieve imperceptibility (as done for images), the method maximizes the loss function to create perturbations that are deliberately noticeable and high-magnitude. This inversion makes the approach suitable for non-image data where detectability is acceptable and the goal is to expose system vulnerabilities through clearly identifiable adversarial examples
3Reliability
If high perturbation magnitude is used for non-image data, then adversarial effectiveness is maintained, but the perturbations become easily detectable
Solution Approach 1:
The patent segments the perturbation generation process into distinct phases: initial high-magnitude perturbation sampling to ensure adversarial effectiveness, followed by iterative refinement that maintains the adversarial property while potentially reducing detectability. The segmentation allows the method to achieve reliable fooling rates through initial aggressive perturbations while offering control over the final detectability level through subsequent refinement iterations
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Computer-implemented method (700) for determining an adversarial perturbation for input signals (x), especially sensor signals or features of sensor signals, of a machine learning system (60), wherein a best perturbation is determined iteratively, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration comprises the steps of: • Sampling (701) a perturbation; • Applying (702) the sampled perturbation to an input signal thereby determining a potential adversarial example; • Determining (703) an output signal from the machine learning system for the potential adversarial example; • Determining (704) a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal; • If the loss value is larger than a previous loss value setting (705) the best perturbation to the sampled perturbation.