Neural Network Robustness Verification Using Linear Input Bounds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural networks used in autonomous systems, such as autonomous driving, are vulnerable to adversarial perturbations that can fool them without being detectable by humans, leading to potential failures, and existing methods to enhance robustness are time-consuming and incomplete.
Innovation Solution
A method to determine a more accurate objective function for evaluating the robustness of neural networks by limiting the allowable set of input values using linear inequalities, ensuring tighter bounds and a more robust classification, even against all possible adversarial examples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If neural networks are retrained with adversarial modifications to improve robustness, then reliability against adversarial attacks is improved, but time consumption and computational cost increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing robustness certificates for training images before the actual classification task. The robustness certificate pre-analysis determines the maximum perturbation magnitude for which the neural network maintains correct classification, allowing fast lookup during inference without re-computing adversarial examples in real-time.
Solution Approach 2:
The patent creates a copy of the training data augmented with pre-computed robustness information. Instead of modifying the original training images with adversarial perturbations, the system generates and stores separate robustness certificate data that captures the essential robustness properties, which can then be efficiently queried during classification without altering the original data or requiring retraining.
2Measurement precision
If the allowable set of input values is limited using linear inequalities, then measurement precision of robustness evaluation is improved, but device complexity increases
Solution Approach 1:
The patent applies parameter changes by transforming the robustness verification problem into a different parameter space using linear inequalities. Instead of directly analyzing the complex nonlinear behavior of the neural network, the system formulates constraints on input value parameters that guarantee robustness, converting a difficult verification problem into a more tractable linear constraint satisfaction problem.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention pertains to a method for training the neural network 100, a method for testing the neuronal network 100 as well as a method for detecting adversarial examples, which can fool the neural network 100. A superposed classification is backpropagated through the second neural network 500, the output value of the second neural network 500 is utilized to determine whether the input of the neuronal network 100 is adversarial example. Set methods of the present invention are based upon this utilization of the second neural network 500. The present invention further pertains to a computer program and an apparatus which are configured to carry out a said methods.