Multiclass Classifier With Abstain Classes for Adversarial Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning networks lack provable performance guarantees for robustness against adversarial perturbations, leading to potential misclassification and failure in detecting adversarial inputs.
Innovation Solution
The introduction of additional abstain classes in the classification architecture, which allows for the detection of adversarial perturbations by classifying them into rejection classes, providing provable robustness guarantees through worst-case bound calculations and adaptive selection of classification assignments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional classification networks are used for adversarial training, then robustness against perturbations is improved, but provable performance guarantees are lost
Solution Approach 1:
The classification problem is segmented by introducing multiple abstain classes (first abstain class and second abstain class) that separately handle different types of adversarial perturbations. This segmentation allows the network to provide provable performance guarantees for each segment while maintaining overall robustness.
Solution Approach 2:
The abstain classes serve as intermediary categories between regular classification and adversarial detection. By routing uncertain or adversarial inputs through these intermediary abstain classes, the system maintains both robustness and provable performance guarantees.
2Reliability
If multiple abstain classes are added to detect adversarial examples, then detection capability is improved, but device complexity increases
Solution Approach 1:
The multiple abstain classes serve universal functions for detecting different types of adversarial perturbations. Rather than creating separate detection mechanisms for each perturbation type, the abstain classes provide a unified multi-functional detection approach that reduces overall system complexity.
Solution Approach 2:
The system changes the parameter space by adding abstain class probabilities to the output layer. This parameter change allows the network to detect adversarial examples without fundamentally altering the underlying architecture, thus improving detection capability while limiting complexity increase.
3Reliability
If worst-case bound calculations are performed on hidden layer values, then robustness guarantees are improved, but computational cost increases
Solution Approach 1:
Instead of performing worst-case bound calculations on all hidden layer values, the system applies bounding only to specific critical layers or values that most impact robustness guarantees. This partial action approach maintains sufficient robustness while reducing computational cost.
Solution Approach 2:
The system performs preliminary bounding calculations during the training phase to establish robustness guarantees, rather than performing exhaustive calculations during inference. This preliminary action ensures robustness is built into the model structure, reducing computational burden during actual classification.
Data Source
AI summary
A method for training a machine-learning network includes receiving an input data from a sensor. The input data includes a perturbation. The method also includes obtaining a worst-case bound on a classification error and loss for perturbed versions of the input data. The method also includes training a classifier, where the classifier includes a plurality of classes, including a plurality of additional abstain classes. Each additional abstain class of the plurality of additional abstain classes is determined in response to at least bounding the input data. The method also includes outputting a classification in response to the input data indicating one of the plurality of classes and outputting a trained classifier in response to exceeding a convergence threshold. The trained classifier is configured to detect at least one additional abstain class of the plurality of additional abstain classes in response to obtaining the worst-case bound.