Robust Deep Neural Network Interpretation Maps via Gaussian Noise Averaging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep neural network interpretation maps are fragile against external perturbations, leading to unreliable predictions in applications like medical diagnosis, where slight imperceptible changes can result in vastly different interpretations and misclassifications.
Innovation Solution
The method involves adding Gaussian noise to input images to generate multiple noisy images, interpreting these images, thresholding, and averaging the top-k interpretations to produce a robust interpretation map using Renyi differential privacy, ensuring the output is insensitive to small perturbations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard interpretation maps are generated from deep neural networks, then the interpretation provides insight into model predictions, but the interpretation is fragile and sensitive to external perturbations
Solution Approach 1:
The patent applies preliminary action by generating multiple noisy versions of the input image before feeding them to the deep neural network. By pre-perturbing the input images with Gaussian noise and generating interpretations for all noisy versions, the system proactively prepares for potential adversarial perturbations rather than reacting to them after they occur. This preliminary diversification of input representations ensures that the final aggregated interpretation is robust against external perturbations.
Solution Approach 2:
The patent uses copying by creating multiple copies of the input image, each corrupted with different Gaussian noise realizations. These noisy copies serve as alternative representations of the same input, allowing the system to generate multiple interpretations that can then be aggregated. The copying process with noise addition creates diverse viewpoints of the input, making the final interpretation less sensitive to any single perturbation or adversarial example.
2Reliability
If multiple noisy images are generated and interpretations are averaged, then robustness against perturbations is improved, but computational complexity increases
Solution Approach 1:
The patent applies partial action by generating a limited number of noisy versions (e.g., 5-20 images) rather than exhaustively exploring all possible perturbations. This partial sampling approach provides sufficient robustness guarantee while keeping computational costs manageable. The method balances between doing too little (insufficient robustness) and too much (excessive computational cost) by selecting an appropriate number of noisy samples that achieves the desired robustness level.
Solution Approach 2:
The patent uses parameter changes by varying the noise standard deviation and the number of noisy images generated as tunable parameters. By adjusting these parameters, the system can optimize the balance between robustness and computational complexity. The noise level and number of samples can be adapted based on the specific application requirements, allowing flexible control over the trade-off between interpretation robustness and computational resource consumption.
Data Source
AI summary
Interpretation maps of deep neural networks are provided that use Renyi differential privacy to guarantee the robustness of the interpretation. In one aspect, a method for generating interpretation maps with guaranteed robustness includes: perturbing an original digital image by adding Gaussian noise to the original digital image to obtain m noisy images; providing the m noisy images as input to a deep neural network; interpreting output from the deep neural network to obtain m noisy interpretations corresponding to the m noisy images; thresholding the m noisy interpretations to obtain a top-k of the m noisy interpretations; and averaging the top-k of the m noisy interpretations to produce an interpretation map with certifiable robustness.