US 11,768,932 B2 · Systems and methods for fast training of more robust models against adversarial attacks

Abstract

Described herein are embodiments for fast training of adversarially robust models against adversarial attacks. Embodiments for model training by perturbing both the image and the label, which may be referred to as Bilateral Adversarial Training (BAT), are disclosed. To generate the adversarial label, one or more closed-form heuristic solutions are derived. One-step targeted attack is used with the target label being the most confusing class. It is shown in various experiments that random start and the most confusing target attack effectively prevent the label leaking and gradient masking problem. Coupled with the adversarial label part, embodiments of presented models significantly improve the state-of-the-art results. Experiments on one or more computationally challenging dataset also demonstrate the effectiveness of the presented BAT method embodiments.

Claims20

Dependent claims

A computer-implemented method for training an image classification model to improve robustness, the method comprising:

receiving a dataset of clean images and corresponding ground-truth labels, each ground-truth label comprising a probability distribution across a plurality of classifications comprising a ground-truth class and one or more non-ground-truth classes;
generating perturbed images based on the clean images by applying adversarial image attacks;
for each ground-truth label, generating a perturbed label based on the ground-truth label by altering the probability distribution in a probability simplex by performing steps comprising:
decreasing a probability for the ground-truth class by a perturbation amount;
and
dividing the perturbation amount among at least one of the one or more non-ground-truth classes, in which a non-ground-truth class receives a portion of the perturbation amount based on a gradient of a classification loss with respect to that non-ground-truth class;
and
training the image classification model using the perturbed images and the corresponding perturbed labels.

5 more elements

A computer-implemented method for training an image classification model to improve robustness, the method comprising:

receiving a clean image and a corresponding ground-truth label, the ground-truth label is represented as a ground-truth label representation comprising a probability distribution in a probability simplex among a ground-truth class and one or more non-ground-truth classes;
generating an initial image by altering the clean image within a predetermined image perturbation budget;
forming a targeted label representation which replaces the ground truth class with a selected non-ground-truth class, in which the selected non-ground-truth class is a most confusing class having a minimum gradient of a classification loss among the one or more non-ground-truth classes;
generating a perturbed image by applying at least one step projected gradient descent using a gradient of a classification loss function with respect to the initial image, the classification loss function being a function of an image, the targeted label representation, and parameters of the image classification model;
and
training the image classification model using at least the perturbed image.

3 more elements

A computer-implemented method for training a neural network model to improve robustness, the method comprising:

receiving a dataset comprising a plurality of elements and corresponding ground-truth label representations for the elements, each ground-truth label representation represents a probability distribution across a ground-truth class and one or more non-ground-truth classes;
generating, for each ground-truth label representation, a perturbed label representation based on the ground-truth label representation by altering the probability distribution for the ground-truth label representation based on a gradient of a classification loss with respect to at least one of the one or more non-ground-truth classes, by performing steps comprising:
decreasing a probability for the ground-truth class by a perturbation amount;
and
dividing the perturbation amount among at least one of the one or more non-ground-truth classes, in which a non-ground-truth class receives a portion of the perturbation amount based on the gradient of a classification loss with respect to that non-ground-truth class;
and
training the neural network model using at least the perturbed label representations.

4 more elements

Dependencies are inferred from the claim text.

Systems and methods for fast training of more robust models against adversarial attacks

Life of this patent

Systems and methods for fast training of more robust models against adversarial attacks

Life of this patent

Abstract

Claims20