Neural Network Input Discretization Against Adversarial Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural networks are susceptible to adversarial attacks, where malicious inputs cause undesired behavior, leading to incorrect outputs, and existing methods to enhance security often degrade network performance.
Innovation Solution
Incorporating a discretization layer that transforms network inputs into discretized vectors, preserving relative distances between numeric values, thereby making the network more resistant to adversarial attacks without compromising performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a discretization layer is incorporated into the neural network, then security against adversarial attacks is improved, but network complexity increases
Solution Approach 1:
The input processing is segmented into discrete bins, where each numeric value is divided into multiple discrete bins representing different ranges. This segmentation transforms continuous input values into discrete representations, creating resistance to adversarial attacks while maintaining manageable network complexity through structured organization.
Solution Approach 2:
The discretization layer acts as an intermediary component between the raw neural network input and the subsequent processing layers. This intermediate layer transforms continuous numeric values into discretized representations, serving as a protective barrier that prevents direct exploitation of continuous input vulnerabilities while preserving essential information for downstream tasks.
2Reliability
If existing methods to enhance security are applied, then security is improved, but network performance deteriorates
Solution Approach 1:
The invention changes the parameter representation from continuous numeric values to discrete bin indices. By transforming the input parameters into discrete categories while preserving relative distance relationships through the bin structure, the network maintains its ability to learn meaningful patterns while gaining security against adversarial perturbations that rely on continuous value manipulation.
Solution Approach 2:
The discretization process introduces a categorical dimension to the input data, transforming continuous values into discrete representations that include information about both the bin category and the position within the bin. This dimensional transformation provides security without sacrificing performance by preserving relative distance information in the discrete structure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for increasing the security of neural network by discretizing neural network inputs. One of the methods includes receiving a network input for a neural network; processing the network input using a discretization layer, wherein the discretization layer is configured to generate a discretized network input comprising a respective discretized vector for each of the numeric values in the network input; and processing the discretized network input using the plurality of additional neural network layers to generate a network output for the network input.