Neural Network Block Selection for Adversarial Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural networks are vulnerable to adversarial attacks due to their sensitivity to small variations in input, which can be exploited to deceive the algorithm, and existing methods to improve robustness often compromise performance and remain susceptible to numerical gradient approximation attacks.
Innovation Solution
A method involving an electronic processing device that selects a single artificial intelligence block from a plurality of distinct blocks for data inference based on a calculated code, using a deterministic function like a hash, to enhance robustness against adversarial attacks by varying the block selection for each data input and making it unknown to potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If neural networks use numerical approximation of gradient to construct attacks, then the attack can be performed without knowing network parameters, but the network remains vulnerable to adversarial attacks
Solution Approach 1:
The patent applies dynamics by making the neural network's processing path variable rather than fixed. Different neural networks or different processing paths are selected dynamically based on the input data characteristics, so that the same input may trigger different processing paths in different instances, making gradient approximation attacks ineffective since the attacker cannot predict which path will be taken
Solution Approach 2:
The patent changes the parameter of network selection based on input data. By selecting different neural networks or processing paths according to data characteristics (using hash functions and modular arithmetic), the system transforms a static vulnerability into a dynamic response, preventing attackers from using fixed gradient approximation methods
2Reliability
If methods improve robustness during learning, then resistance to adversarial attacks increases, but performance is compromised
Solution Approach 1:
The patent segments the neural network into multiple independent networks or processing paths. Instead of training a single network with robustness constraints, the system divides the processing function into separate segments (neural networks) that can be selected based on input data, allowing each segment to be optimized for performance while the selection mechanism provides robustness
Solution Approach 2:
The patent introduces an intermediary selection mechanism (using hash functions and modular arithmetic) that mediates between the input data and the neural network processing. This intermediary layer determines which neural network or processing path is activated, providing a bridge that maintains performance while enabling robustness through variable path selection
3Device complexity
If a single neural network is used for processing, then the system is simple, but it is vulnerable to gradient approximation attacks
Solution Approach 1:
The patent implements multi-functionality by having a single selection system handle multiple neural networks or processing paths. The hash function and modular arithmetic mechanism serve universal purposes: they select different networks for different inputs, provide deterministic behavior, and enable robustness without requiring separate attack-defense systems for each network
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This data processing method is implemented by an electronic processing device, and includes the following steps: - acquisition (200) of data; - processing (230) of the data via the inference of an artificial intelligence algorithm, previously trained during a training (100), said algorithm comprising a plurality of distinct blocks of artificial intelligence, each previously trained during said training, the method comprising, before the processing step (230), the following steps: - calculation (210) of a code from the acquired data;- selection (220), according to the calculated code, of a block from among the plurality of artificial intelligence blocks, the processing step (230) being carried out via inference, from among the plurality of artificial intelligence blocks, of the single selected block, the plurality of artificial intelligence blocks being a plurality of artificial neural networks or a plurality of processing layers within an artificial neural network.;