Neural Network Adversarial Training Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods to enhance neural network robustness against adversarial attacks, such as adversarial learning, often degrade performance on non-adversarial images.
Innovation Solution
A method that trains neural networks using a learning base comprising both adversarial and non-adversarial images, where adversarial images are paired with target data and non-adversarial images are used to maintain performance on non-adversarial data, allowing for improved robustness without degrading performance on non-adversarial images.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial learning is used to improve robustness against adversarial attacks, then the neural network's robustness is improved, but the performance on non-adversarial images degrades
Solution Approach 1:
The training process is segmented into two distinct phases: adversarial learning steps where the network learns from adversarial images with target data indicating the intended misclassification, and non-adversarial learning steps where the network learns from normal images. This segmentation allows the network to develop specialized responses for adversarial inputs while maintaining normal performance on legitimate inputs.
Solution Approach 2:
The learning method employs periodic alternation between adversarial learning steps and non-adversarial learning steps. During adversarial steps, the network is trained on adversarial images to improve robustness; during non-adversarial steps, it trains on normal images to maintain performance. This periodic switching prevents performance degradation on non-adversarial images while still improving robustness.
2Reliability
If the learning base includes only adversarial images, then robustness training is maximized, but the neural network cannot maintain performance on non-adversarial images
Solution Approach 1:
The learning base is designed to be universal, serving multiple functions: it includes both adversarial images for robustness training and non-adversarial images for maintaining normal performance. This multi-functional learning base allows the neural network to adapt to different types of inputs and maintain versatility across both adversarial and non-adversarial scenarios.
Data Source
Figure 1~2
Figure 3
AI summary
The invention relates to a method (300) of supervised adversarial learning of a neural network (102), comprising at least one iteration of a training step (304), called adversarial, comprising the following operations: - provisioning, to said neural network (102) of an image (104), called adversarial, comprising a modification, called adversarial attack, intended to direct said neural network (102) towards a result, called target, different from an expected result, and - provisioning, to said neural network (102), of a first piece of data, called result data, indicating the expected result for said adversarial image (104); characterized in that said adversarial learning step (304) further comprises a provision, to said neural network (102), of a second piece of data, called target data, indicating to said neural network (102) said target.