Neural Network Robustness Against Adversarial Disruptions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Convolutional neural networks are vulnerable to adversarial perturbations in sensor data, leading to misclassification or incorrect semantic segmentation despite semantically unchanged content, which poses a risk in applications like autonomous driving.
Innovation Solution
A method and device that modify input data of neural networks during application phases to align with statistical properties of training data, using a statistical model to make the data more probable, thereby reducing the effect of adversarial disturbances.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If convolutional neural networks are used for image processing in autonomous driving, then functional accuracy is improved, but vulnerability to adversarial perturbations increases
Solution Approach 1:
The statistical model is trained in advance on legitimate input data to learn the expected statistical properties (mean, covariance) of normal sensor data. During runtime, this pre-trained model proactively detects and corrects adversarial perturbations by comparing incoming data against the established statistical baseline, resolving the contradiction by preparing the defense mechanism beforehand rather than reacting after misclassification occurs
Solution Approach 2:
A statistical model acts as an intermediary layer between the raw sensor data and the convolutional neural network. This mediator computes statistical properties (mean and covariance) of the input data and uses them to generate corrected input data that is statistically more probable, thereby protecting the CNN from adversarial perturbations while preserving legitimate signal information
2Reliability
If input data is modified to be statistically more probable, then robustness against adversarial attacks is improved, but data processing complexity increases
Solution Approach 1:
The statistical model computes only two key parameters (mean and covariance) from the input data and uses these parameters to generate the statistically more probable data through mathematical operations. This approach avoids complex transformations while achieving robustness by changing the statistical parameters of the input data in a computationally efficient manner
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
The invention relates to a method for making a neural network (5) more robust against adversarial disruptions. Input data (11, 13) for at least one layer (5-0,5-x,5-i) of the neural network (5) is at least partly modified before being supplied to the at least one layer (5-0,5-x,5-i) by means of at least one manipulator device (6, 8) during an application phase of the neural network (5) such that the modified input data (12, 15) is statistically more probable than the unmodified input data (11, 13) for the at least one layer (5-0,5-x,5-i) according to a statistical model (7), wherein the statistical model (7) maps respective statistical properties of input data (11, 13) for the at least one layer (5-0,5-x,5-i) in the event that training data (30) of a training data set has been supplied to the neural network (5), said training data set being used to train the neural network (5). The invention also relates to a device (1) for providing a neural network (5) which has been made more robust against adversarial disruptions, to a motor vehicle (50), to a computer program, and to a data carrier signal.