Neural Network Adversarial Defense via Unit Masking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep neural networks are vulnerable to adversarial attacks, which involve imperceptible perturbations that can fool classifiers into incorrect predictions, and there is a lack of understanding on how and why these networks make mistakes when facing adversarial examples.
Innovation Solution
A method is developed to determine concept-level interpretability and sensitivity of neural network units to adversarial attacks, identifying sensitive and interpretable units, and enhancing defense by masking these units to mitigate the effects of adversarial attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If neural networks are used for image classification, then classification accuracy is improved, but vulnerability to adversarial attacks increases
Solution Approach 1:
The patent segments the neural network into individual units (neurons) and analyzes their concept-level interpretability and sensitivity separately. By identifying and masking specific sensitive units rather than the entire network, the defense mechanism achieves robustness while preserving overall network functionality and classification accuracy.
Solution Approach 2:
The patent applies local quality by differentiating between units with different properties (interpretable vs. non-interpretable, sensitive vs. non-sensitive). The defense mechanism selectively masks only the sensitive units that contribute to adversarial vulnerability, while leaving other units unchanged, thereby maintaining classification performance on clean data while improving robustness.
2Reliability
If adversarial training is applied, then robustness to adversarial attacks is improved, but training time and computational resources increase
Solution Approach 1:
The patent performs preliminary analysis during the training process to identify sensitive units based on their concept-level interpretability and sensitivity to adversarial examples. This preliminary identification allows the model to adapt its defense strategy dynamically during training, potentially reducing the need for extensive adversarial training iterations while achieving robustness.
Solution Approach 2:
The patent enables the neural network to self-diagnose its vulnerability by analyzing its own unit-level sensitivity to adversarial attacks. The model automatically identifies which units are problematic and applies masking accordingly, eliminating the need for external adversarial training processes and reducing training time and computational overhead.
3Reliability
If masking of sensitive units is applied, then defense against adversarial attacks is improved, but classification accuracy on clean data may decrease
Solution Approach 1:
The patent applies local quality by selectively masking only the sensitive units that contribute to adversarial vulnerability, while preserving the functionality of non-sensitive units. This selective approach minimizes the impact on classification accuracy for clean data, as the majority of units that contribute to correct classification remain active.
Solution Approach 2:
The patent implements partial masking rather than complete network masking. By applying masking to only the identified sensitive units (a partial action), the defense mechanism achieves adequate protection against adversarial attacks while preserving sufficient network capacity to maintain high classification accuracy on clean data.
Data Source
AI summary
An illustrative embodiment includes a method for protecting a machine learning model. The method includes: determining concept-level interpretability of respective units within the model; determining sensitivity of the respective units within the model to an adversarial attack; identifying units within the model which are both interpretable and sensitive to the adversarial attack; and enhancing defense against the adversarial attack by masking at least a portion of the units identified as both interpretable and sensitive to the adversarial attack.