Substitute Module for Adversarial AI Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Artificial intelligence modules, especially those in autonomous driving, are vulnerable to adversarial attacks that can misclassify traffic signs, posing safety risks, and existing testing methods require access to internal functions or training data, which is not always feasible.
Innovation Solution
A method that uses a substitute module generated from input and output datasets to simulate the AI module, allowing for adversarial input dataset generation and testing without access to internal functions, using machine learning algorithms like neuronal nets and white box attack methods, and assessing resilience through metrics like successful attack scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing testing methods are used to evaluate AI module resilience, then testing can be performed, but access to internal functions or training data is required which is not always feasible
Solution Approach 1:
The patent introduces a substitute module as an intermediary that approximates the behavior of the target AI module. This substitute module can be queried to generate adversarial examples without requiring access to the target module's internal functions or training data, thus resolving the contradiction between testing reliability and operational accessibility
Solution Approach 2:
The patent creates a copy (substitute module) of the target AI module that replicates its input-output behavior sufficiently well for adversarial example generation. This copy can be trained using publicly available datasets and queried freely, enabling testing without direct access to the proprietary target system
2Reliability
If adversarial attacks are launched against AI modules to test resilience, then security assessment can be performed, but the complexity of generating effective adversarial examples increases
Solution Approach 1:
The substitute module serves as a simplified intermediary that captures the essential decision boundaries of the target AI module. By using this intermediate representation, the complex process of generating adversarial examples against the original complex model is replaced with a simpler process against the substitute model
Solution Approach 2:
The patent transforms the complex problem of generating adversarial examples for a complex AI module into a simpler problem by changing the parameters of the model being attacked (using the substitute module with simpler or accessible parameters instead of the original complex module)
Data Source
AI summary
The present disclosure relates to a computer implemented method for testing an artificial intelligence module (AI-module). The method comprises generating a substitute module using first input datasets and first output datasets, wherein the first output datasets are generated on the basis of the first input datasets using the AI-module. Adversarial input datasets are generated on the basis of the first input datasets using the substitute module. The adversarial input datasets are used for assessing a resilience of the AI-module against adversarial attacking by using the first output datasets and second output datasets, wherein the second output datasets are generated on the basis of the adversarial input datasets using the AI-module.