Deep Neural Network Robustness Validation in Adversarial Training
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deep neural networks trained with adversarial samples do not guarantee robustness against misclassification, and there is a need to predict and ensure the level of robustness achieved during adversarial training.
Innovation Solution
An information processing apparatus that includes adversarial training and format validation to generate a neural network capable of predicting specific robustness by ensuring adversarial samples do not exceed a predetermined noise range, using a weighting factor obtained through training.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial training is performed to improve robustness against misclassification, then the neural network's resistance to adversarial attacks is improved, but the ability to guarantee or predict specific robustness levels is not achieved
Solution Approach 1:
The patent replaces traditional empirical adversarial training evaluation with formal mathematical verification methods. Instead of relying on heuristic measurements of robustness through repeated adversarial attacks, the system uses formal methods to mathematically prove robustness guarantees, substituting mechanical testing with rigorous mathematical certification.
Solution Approach 2:
The patent transforms the robustness verification problem from a probabilistic measurement task to a deterministic parameter validation task. By changing the approach from measuring robustness through attack success rates to validating mathematical parameters that guarantee robustness, the system achieves precise prediction of robustness levels.
2Measurement precision
If formal validation is applied to verify robustness guarantees, then the precision of robustness prediction is improved, but the complexity of the training and validation process increases
Solution Approach 1:
The patent performs formal robustness validation during the training process itself rather than as a separate post-training step. By incorporating validation checks into the training workflow, the system establishes robustness guarantees early, avoiding the need for complex separate validation procedures.
Solution Approach 2:
The patent creates a unified training framework that simultaneously performs neural network training and formal robustness validation. The system integrates multiple functions (training, validation, and guarantee generation) into a single cohesive process, reducing overall system complexity despite the advanced capabilities provided.
3Reliability
If adversarial samples are used as training data to improve robustness, then the neural network's defense against attacks is strengthened, but the computational resources and training time required increase
Solution Approach 1:
The patent applies partial adversarial training by using a carefully selected subset of adversarial samples rather than generating and training on all possible adversarial variations. This partial approach provides sufficient robustness improvement while significantly reducing the computational burden and training time required.
Solution Approach 2:
The patent employs efficient adversarial sample generation techniques that skip unnecessary computation steps. By using optimized algorithms to generate representative adversarial samples and by implementing early stopping criteria in the validation process, the system rushes through the computationally intensive portions of training while maintaining robustness guarantees.
Data Source
AI summary
An information processing apparatus acquires a user setting related to a feature of adversarial training and performs the adversarial training that trains a neural network by using training data including an adversarial sample and correct answer data indicating an original classification class, and the user setting, the adversarial training training the neural network that outputs a misclassification class in a case where the adversarial sample is input so as to output the original classification class in a case where the adversarial sample is input. The apparatus determines, by executing a format validation algorithm, that the adversarial sample does not exist within a predetermined range of noise of specific data in the neural network using a weighting factor obtained by the adversarial training.