Multi-Model Frame Classification for Patch Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning models are vulnerable to patch attacks, which degrade accuracy by manipulating the certainty of object classification, making it difficult to discern between legitimate algorithmic issues and actual attacks.
Innovation Solution
Employ two distinct machine learning models (e.g., YOLO and Faster RCNN) to analyze frames, identify frames with inconsistent classification results, and determine a patch attack by comparing the certainty differences between frames using a predefined threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single machine learning model is used for classification, then the system complexity is low, but the reliability of detecting patch attacks is insufficient
Solution Approach 1:
The patent combines multiple machine learning models (first ML model and second ML model) into a unified detection system. The models work together to process the same image data and compare their classification results, enabling more reliable patch attack detection through their collective decision-making capability rather than relying on a single model's judgment.
Solution Approach 2:
The patent introduces an image processing device as an intermediary that coordinates between multiple ML models. This intermediary device collects classification results from different models, compares their certainty values, and determines whether a patch attack is present based on the discrepancies, thereby managing the complexity of multi-model integration.
2Reliability
If multiple machine learning models are used to compare classification results, then the reliability of patch attack detection is improved, but the device complexity increases
Solution Approach 1:
The patent uses multiple ML models to perform classification, which is more than the single model traditionally used. This excessive action of deploying multiple models creates redundant classification results that can be compared to detect inconsistencies caused by patch attacks, accepting the added complexity as necessary for improved security.
Solution Approach 2:
The patent changes the parameter of model diversity by selecting ML models with different architectures or training approaches. This parameter change ensures that the models process the same input differently, making their comparison more effective for detecting patch attacks that might affect all models uniformly or differently depending on the attack type.
3Measurement precision
If the threshold for determining patch attacks is set low, then the detection sensitivity is high, but false positives increase causing misidentification of legitimate users
Solution Approach 1:
The patent implements a feedback mechanism where the detection system continuously monitors the classification results from multiple ML models and adjusts its determination based on the consistency of their outputs. The system uses the certainty values and class comparisons as feedback to dynamically assess whether a patch attack is present, rather than relying on a fixed low threshold that would cause false positives.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An information processing device (100) uses a first machine learning model (110) and obtains a first classification result (111). The information processing device (100) uses a second machine learning model (120) and obtains a second classification result (121). The information processing device (100) identifies a first frame, based on the first classification result (111) and the second classification result (121). The information processing device (100) identifies a first class with a highest degree of certainty in the first classification result (111) for any frame regarded as a reference. The information processing device (100) identifies a second frame that is immediately before or after the identified first frame. The information processing device (100) determines a series of frames to be invalid when a predetermined condition is satisfied by a relationship between a first degree of certainty of the first class in the first classification result (111) for the first frame and a second degree of certainty of the first class in the first classification result (111) for the second frame.