Neural Network Training via Logit Pairing for Adversarial Robustness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Artificial neural networks are vulnerable to adversarial attacks, where minimal modifications in input data can cause misclassification, leading to unintended operations in applications like autonomous vehicles, where micro-modulated road sign images can result in incorrect vehicle actions.
Innovation Solution
A neural network model training method that involves a first training operation with original data to generate feature and class activation maps, and a second training operation with adversarial data transformed using the projected gradient descent algorithm, where the model is trained to minimize the difference between the activation values of the original and adversarial data maps through logit pairing, ensuring the adversarial data is classified as the original data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If neural network model is trained only with original data, then classification accuracy on normal data is improved, but vulnerability to adversarial attacks increases
Solution Approach 1:
The patent applies preliminary action by generating adversarial examples before the final classification stage and incorporating them into the training process. The model is pre-trained with both original and adversarially perturbed data, allowing it to learn robust features that resist attacks while maintaining classification accuracy on clean data.
Solution Approach 2:
The patent converts the harmful adversarial examples into beneficial training data. By using adversarial examples as part of the training set and applying logit pairing to align their predictions with original data predictions, the model learns to recognize and correctly classify adversarial inputs, transforming the threat into an opportunity for improving robustness.
2Reliability
If adversarial training is applied to improve robustness, then reliability against attacks is improved, but training complexity and computational cost increase
Solution Approach 1:
The patent applies parameter changes by modifying the loss function to include logit pairing constraints. This adds a specific parameter (the logit pairing loss term) that guides the model to produce consistent predictions for both original and adversarial examples, improving robustness through a structured approach to training complexity.
Solution Approach 2:
The patent introduces logit pairing as an intermediary mechanism between original data and adversarial examples. This intermediary constraint ensures that the model's internal representations (logits) for adversarial examples align with those of original examples, providing a systematic way to handle training complexity while improving robustness.
3Stability of the object's composition
If logit pairing is used to align class activation maps, then classification consistency is improved, but loss function complexity increases
Solution Approach 1:
The patent applies parameter changes by modifying the loss function to include logit pairing constraints. This adds a specific parameter (the logit pairing loss term) that guides the model to produce consistent predictions for both original and adversarial examples, improving robustness through a structured approach to training complexity.
Data Source
AI summary
A neural network model training method and apparatus are provided. The method includes a first training operation of training the neural network model with original data, the first training operation including generating a first feature map for the original data, and generating a first class activation map for the original data from the generated first feature map, and a second training operation of training the neural network model with adversarial data transformed from the original data, the second training operation including generating a second feature map for the adversarial data, generating a second class activation map for the adversarial data from the generated second feature map, and training the neural network model so that the second class activation map follows the first class activation map based on logit pairing for the first and second class activation maps.