US 11,636,332 B2 · Systems and methods for defense against adversarial attacks using feature scattering-based adversarial training

Abstract

Described herein are embodiments for a feature-scattering-based adversarial training approach for improving model robustness against adversarial attacks. Conventional adversarial training approaches leverage a supervised scheme, either targeted or non-targeted in generating attacks for training, which typically suffer from issues such as label leaking as noted in recent works. Embodiments of the disclosed approach generate adversarial images for training through feature scattering in the latent space, which is unsupervised in nature and avoids label leaking. More importantly, the presented approaches generate perturbed images in a collaborative fashion, taking the inter-sample relationships into consideration. Extensive experiments on different datasets compared with state-of-the-art approaches demonstrate the effectiveness of the presented embodiments.

Claims20

Dependent claims

A computer-implement method for generating adversarial training data for training a parameterized model comprising:

generating an initial set of perturbed training data from a set of clean training data;
using the parameterized model, extracting features from the set of clean training data and the initial set of perturbed training data;
calculating a transport cost matrix between features extracted from the set of clean training data and features extracted from the initial set of perturbed training data;
determining a transport matrix based upon the transport cost matrix representing a matching between features in the set of clean training data and the initial set of perturbed training data;
determining a product using the transport cost matrix and the transport matrix to represent feature matching distance between the set of clean training data and the initial set of perturbed training data;
and
obtaining a set of feature-scattering-based training data based on at least the determined feature matching distance.

4 more elements

A non-transitory computer-readable medium or media comprising one or more sequences of instructions which, when executed by one or more processors, causes the steps for generating adversarial training data for training a parameterized model to be performed comprising:

generating an initial set of perturbed training data from a set of clean training data;
extracting features from the set of clean training data and the initial set of perturbed training data;
calculating a transport cost matrix between features extracted from the set of clean training data and features extracted from the initial set of perturbed training data;
determining a transport matrix based upon the transport cost matrix representing a matching between features in the set of clean training data and the initial set of perturbed training data;
determining a product using the transport cost matrix and the transport matrix to represent feature matching distance between the set of clean training data and the initial set of perturbed training data;
and
obtaining a set of feature-scattering-based training data based on at least the determined feature matching distance.

4 more elements

A system comprising:

one or more processors;
and
a non-transitory computer-readable medium or media comprising one or more sets of instructions which, when executed by at least one of the one or more processors, causes steps to be performed comprising:
generating an initial set of perturbed training data from a set of clean training data;
using the parameterized model, extracting features from the set of clean training data and the initial set of perturbed training data;
calculating a transport cost matrix between features extracted from the set of clean training data and features extracted from the initial set of perturbed training data;
determining a transport matrix based upon the transport cost matrix representing a matching between features in the set of clean training data and the initial set of perturbed training data;
determining a product using the transport cost matrix and the transport matrix;
and
obtaining a set of feature-scattering-based training data based on at least the determined feature matching distance.

7 more elements

Dependencies are inferred from the claim text.

Systems and methods for defense against adversarial attacks using feature scattering-based adversarial training

Life of this patent

Systems and methods for defense against adversarial attacks using feature scattering-based adversarial training

Life of this patent

Abstract

Claims20