Multi-Geometry Projection for Adversarially Robust OOD Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing OOD detection systems are not resilient to adversarial attacks and struggle to differentiate between in-distribution and out-of-distribution samples, especially under adversarial conditions, leading to unreliable AI model predictions.
Innovation Solution
A robust OOD detection system and method using a Multi-Geometry Projection (MGP) network with Riemannian Sharpness-Aware Minimization (RSAM) optimization, incorporating hypersphere and hyperbolic manifolds, and Jitter adversarial attacks to train a detection model, which calculates distances between embeddings to classify samples as in- or out-of-distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial training is used to defend against attacks, then model robustness is improved, but the ability to detect out-of-distribution samples deteriorates
Solution Approach 1:
The model is divided into multiple branches (classification branch and detection branch) that process adversarial samples differently. The classification branch handles adversarial robustness while the detection branch specifically targets OOD sample identification, allowing each branch to optimize for its specific function without interfering with the other.
Solution Approach 2:
A separate detection branch is introduced as an intermediary component between the main classification model and the OOD detection task. This intermediary branch processes features through a dedicated detection head with its own loss function, enabling specialized OOD detection capabilities while preserving the main model's classification and adversarial defense functions.
2Measurement precision
If existing OOD detection methods are applied, then OOD sample identification is improved, but resilience to adversarial attacks deteriorates
Solution Approach 1:
Different parts of the model have specialized functions: the detection branch uses specific layers and loss functions optimized for OOD detection, while the classification branch maintains adversarial robustness. The detection head applies local transformations and distance calculations specifically tailored for identifying out-of-distribution samples without compromising overall model security.
3Measurement precision
If multiple branches are added to the detection model, then OOD detection capability is improved, but device complexity increases
Solution Approach 1:
The detection branch is merged with the existing classification model architecture, sharing lower-level feature extraction layers. This allows the OOD detection functionality to be integrated into the existing model structure, reducing the overall complexity increase compared to a completely separate detection system. The shared layers efficiently serve both classification and detection purposes.
Data Source
AI summary
A robust out-of-distribution detection method includes a training phase and a testing phase. The training phase is configured to train a detection model according to in-distribution samples. The training phase includes a plurality of epochs, and one of the epochs includes: adding a perturbation to each in-distribution sample to generate an adversarial sample, inputting each adversarial sample into the detection model with branches, calculating a loss function of each branch to optimize the detection model. The testing phase includes: inputting the in-distribution samples into the detection model to generate in-distribution embeddings, inputting a test sample into the detection model to generate a test embedding, calculating a plurality of distances between the in-distribution embeddings and the test embedding, and selecting one of the distances as the out-of-distribution score for the test embedding. When the out-of-distribution score exceeds a threshold, the test sample is classified as out-of-distribution.