Neural Network Adversarial Detection via Feature Deviation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep learning models are vulnerable to adversarial attacks through subtle perturbations in image data that are imperceptible to the human eye, making them unreliable and susceptible to incorrect decisions.
Innovation Solution
A neural network architecture with a residual network and detection network is used to extract features from image data, filter them through convolutional layers, concatenate and evaluate the features across fully connected layers to detect deviations, and classify images based on these evaluations, ensuring authenticity of inputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep learning models are used for image classification, then classification performance is improved, but vulnerability to adversarial attacks increases
Solution Approach 1:
The system segments the image classification task into two separate networks: a residual network for feature extraction and a detection network for adversarial detection. This segmentation allows each network to specialize in its function, with the detection network specifically trained to identify perturbations while the residual network focuses on feature extraction, thereby maintaining classification performance while improving reliability
Solution Approach 2:
The detection network acts as an intermediary between the input image and the classification process. It evaluates whether an image contains adversarial perturbations before the image is processed by the residual network for classification, serving as a protective mediator that filters out malicious inputs
2Reliability
If feature filtering and evaluation layers are added to detect perturbations, then reliability is improved, but device complexity increases
Solution Approach 1:
The detection network performs preliminary evaluation of images for adversarial perturbations before the main classification process. By conducting this detection step in advance, the system can identify and reject malicious inputs early, avoiding the need for complex post-processing verification steps that would increase overall system complexity
Solution Approach 2:
The detection network is designed to be a universal component that can work with any residual network for feature extraction. It provides multi-functional capability by serving both as an adversarial detector and as a preprocessing step for the classification system, reducing the need for separate specialized components
Data Source
AI summary
An exemplary device for classifying an image includes a receiving unit that receives image data. The device also includes a hardware processor including a neural network architecture to extract a plurality of features from the image data, filter each feature extracted from the image data, concatenate the plurality of filtered features to form an image vector, evaluate the plurality of concatenated features in first and second layers of a plurality of fully connected layers of the neural network architecture based on an amount of deviation in the features determined at each fully connected layer, and generate a data signal based on an output of the plurality of fully connected layers. A transmitting unit sends the data signal to a peripheral or remote device.