Neural Network Weight Randomization for Adversarial Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural networks are vulnerable to adversarial attacks, which can degrade their performance and lead to incorrect outputs, posing significant risks in critical applications like autonomous vehicles, and existing defenses such as adversarial training incur high overhead and may decrease accuracy.
Innovation Solution
Introducing small magnitude random noise to the node weights of neural networks, specifically affecting the lower mantissa bits, to create stochastic transformation defense, which can be implemented before deployment or at runtime, maintaining the random seed secret to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If adversarial training is used to defend against adversarial attacks, then the neural network's robustness is improved, but the training overhead increases and accuracy may decrease
Solution Approach 1:
The patent applies parameter changes by introducing random noise to the neural network weights during inference. Specifically, small magnitude noise is added to the weight parameters, which transforms the deterministic weight values into stochastic ones. This parameter transformation provides defense against adversarial attacks without requiring adversarial training, thereby avoiding the training overhead and potential accuracy degradation associated with conventional adversarial training methods
2Reliability
If random noise is added to neural network weights, then defense against adversarial attacks is improved, but the complexity of the system increases
Solution Approach 1:
The patent implements dynamics by making the neural network weights stochastic rather than static. Random noise is added to the weights at runtime, creating a dynamic defense mechanism that adapts to adversarial inputs. This dynamic approach increases robustness against adversarial attacks while maintaining relatively simple system architecture, as the randomness is introduced through straightforward noise addition rather than complex structural modifications
3Reliability
If small magnitude random noise is introduced to weights, then robustness against adversarial attacks is improved, but the precision of weight values is reduced
Solution Approach 1:
The patent applies local quality by selectively adding random noise only to specific portions of the weight values. Small magnitude noise is introduced to the weights, affecting only the lower precision bits while preserving the higher precision components. This localized perturbation approach provides defense against adversarial attacks while minimizing the impact on overall weight precision and maintaining normal network performance on benign inputs
Data Source
AI summary
The present disclosure is directed to systems and methods for the selective introduction of low-level pseudo-random noise into at least a portion of the weights used in a neural network model to increase the robustness of the neural network and provide a stochastic transformation defense against perturbation type attacks. Random number generation circuitry provides a plurality of pseudo-random values. Combiner circuitry combines the pseudo-random values with a defined number of least significant bits/digits in at least some of the weights used to provide a neural network model implemented by neural network circuitry. In some instances, selection circuitry selects pseudo-random values for combination with the network weights based on a defined pseudo-random value probability distribution.