Automatic identification and classification of adversarial attacks
AssigneeConti Temic microelectronic GmbH
InventorsEric Piegert, Michelle Karg, Christian Scharfenberger
Life of this patent
Estimating the term…
Abstract
A method for identifying adversarial attacks on an image based detection system for automated driving includes providing a reference signal and a potentially manipulated signal. The method also includes calculating a plurality of metrics which quantify differences between the signals in different ways. The method further includes creating a multi-dimensional feature space based on the calculated metrics and classifying the type of attack based on the calculated metrics. The class of the adversarial attack may then be output.
Claims18
A method for identifying and classifying adversarial attacks on an automated detection system, comprising:
- providing a reference signal and a potentially manipulated signal, wherein each signal includes at least one of an image signal, a video signal, or an audio signal,
- calculating a set of n metrics which quantify differences between the reference signal and the potentially manipulated signal in different ways, with n being a natural number greater than one
- creating an n-dimensional feature space based on the calculated metrics,
- classifying the type of adversarial attack on the basis of the calculated metrics in the n-dimensional feature space, and
- outputting the class of the adversarial attack,
- wherein the automated detection system comprises at least one trained neural network, and the reference signal and the potentially manipulated signal are provided following completion of a training phase of the at least one neural network, and
- wherein subsets are created from the n metrics in order to extract most relevant m metrics, with m being a natural number less than n and, wherein the classification of the type of the adversarial attack is effected on the basis of the calculated metrics in the m-dimensional feature space.
A system for identifying adversarial attacks on an automated detection system, comprising an input interface, an identification unit, and an output interface, wherein
- the input interface is configured to receive a reference signal and a potentially manipulated signal, wherein each signal includes at least one of an image signal, a video signal, or an audio signal, and to provide the potentially manipulated signal to the identification unit;
- wherein the identification unit comprises processor circuitry and is configured:
- to calculate a set of n metrics, which quantify differences between the reference signal and the potentially manipulated signal in different ways,
- to create a n-dimensional feature space based on the calculated metrics, and
- to classify the type of adversarial attack on the basis of the calculated metrics in the n-dimensional feature space, and
- the output interface is configured to output the class of the adversarial attack established by the identification unit
- wherein the automated detection system comprises at least one trained neural network such that the reference signal and the potentially manipulated signal are received by the system following completion of a training phase of the at least one neural network, and
- wherein subsets are created from the n metrics in order to extract most relevant m metrics, with m being a natural number less than n and, wherein the classification of the type of the adversarial attack is effected on the basis of the calculated metrics in the m-dimensional feature space.
Dependencies are inferred from the claim text.