# US 12,217,176 B2 · Automatic identification and classification of adversarial attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,217,176 B2
- Document ID: US12217176B2
- Status: Granted
- Kind: B2
- Application number: 17/593,558
- Filed: 2020-03-17
- Published: 2022-06-02
- Granted: 2025-02-04
- Earliest claimed: 2019-03-28
- Assignees: Conti Temic microelectronic GmbH
- Applicants: Conti Temic microelectronic GmbH
- Inventors: Eric Piegert; Michelle Karg; Christian Scharfenberger
- Web page: https://patentgrep.com/patent/US12217176B2

## CPC

- G06N 3/08: Learning methods
- G06N 3/045: Combinations of networks
- G06N 3/0464: Convolutional networks [CNN, ConvNet]
- G06N 3/09: Supervised learning
- G06V 10/454: {Integrating the filters into a hierarchical structure, e.g. convolutional neural networks [CNN]}
- G06V 10/764: using classification, e.g. of video objects
- G06V 10/82: using neural networks
- G06V 20/56: exterior to a vehicle by using sensors mounted on the vehicle
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for identifying adversarial attacks on an image based detection system for automated driving includes providing a reference signal and a potentially manipulated signal. The method also includes calculating a plurality of metrics which quantify differences between the signals in different ways. The method further includes creating a multi-dimensional feature space based on the calculated metrics and classifying the type of attack based on the calculated metrics. The class of the adversarial attack may then be output.

## Claims

### Claim 1

A method for identifying and classifying adversarial attacks on an automated detection system, comprising:
providing a reference signal and a potentially manipulated signal, wherein each signal includes at least one of an image signal, a video signal, or an audio signal,
calculating a set of n metrics which quantify differences between the reference signal and the potentially manipulated signal in different ways, with n being a natural number greater than one
creating an n-dimensional feature space based on the calculated metrics,
classifying the type of adversarial attack on the basis of the calculated metrics in the n-dimensional feature space, and
outputting the class of the adversarial attack,
wherein the automated detection system comprises at least one trained neural network, and the reference signal and the potentially manipulated signal are provided following completion of a training phase of the at least one neural network, and
wherein subsets are created from the n metrics in order to extract most relevant m metrics, with m being a natural number less than n and, wherein the classification of the type of the adversarial attack is effected on the basis of the calculated metrics in the m-dimensional feature space.

### Claim 2 (depends on 1)

The method according to claim 1, further comprising introducing a specific counter-measure against a class of adversarial attacks identified as critical.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the automated detection system comprises a camera-based sensor system of a vehicle, wherein the potentially manipulated signals are image or video signals which have been acquired by at least one camera of the camera-based sensor system.

### Claim 4 (depends on 3)

The method according to claim 3, wherein the method for identifying an adversarial attack is performed during a signal data transfer from the vehicle to an online database.

### Claim 5 (depends on 3)

The method according to claim 3, wherein the automated detection system comprises a multicamera system in a vehicle and wherein the potentially manipulated image or video signal and the reference image or video signal are overlapping or temporally offset acquisitions of the same scene by various individual cameras.

### Claim 6 (depends on 3)

The method according to claim 3, wherein the metrics are calculated on the entire potentially manipulated image.

### Claim 7 (depends on 3)

The method according to claim 3, wherein the metrics are calculated on an image detail of the potentially manipulated image.

### Claim 8 (depends on 3)

The method according to claim 3, wherein the metrics are calculated from at least one of a series of images and a series of image details.

### Claim 9 (depends on 3)

The method according to claim 3, wherein the n metrics contain multiple metrics which are selected from the group of:
SSIM, L1-norm, L2-norm, KL divergence, MSE, MAE, PSNR, L∞-norm, L0-norm, Edge metrics, hash metrics, and Fourier transform metrics.

### Claim 10 (depends on 1)

The method according to claim 1, wherein the creation of the subsets is implemented based on machine learning and wherein at least the most relevant m metrics are automatically learned with the aid of representation learning.

### Claim 11

A system for identifying adversarial attacks on an automated detection system, comprising an input interface, an identification unit, and an output interface, wherein
the input interface is configured to receive a reference signal and a potentially manipulated signal, wherein each signal includes at least one of an image signal, a video signal, or an audio signal, and to provide the potentially manipulated signal to the identification unit;
wherein the identification unit comprises processor circuitry and is configured:
to calculate a set of n metrics, which quantify differences between the reference signal and the potentially manipulated signal in different ways,
to create a n-dimensional feature space based on the calculated metrics, and
to classify the type of adversarial attack on the basis of the calculated metrics in the n-dimensional feature space, and
the output interface is configured to output the class of the adversarial attack established by the identification unit
wherein the automated detection system comprises at least one trained neural network such that the reference signal and the potentially manipulated signal are received by the system following completion of a training phase of the at least one neural network, and
wherein subsets are created from the n metrics in order to extract most relevant m metrics, with m being a natural number less than n and, wherein the classification of the type of the adversarial attack is effected on the basis of the calculated metrics in the m-dimensional feature space.

### Claim 12 (depends on 11)

The system according to claim 11, further comprising a second system which receives the class of the adversarial attack from the output interface, the second system introducing a specific counter-measure against if the class of adversarial attacks is identified as critical.

### Claim 13 (depends on 11)

The system according to claim 11, wherein the automated detection system comprises a camera-based sensor system of a vehicle, wherein the potentially manipulated signals are image or video signals which have been acquired by at least one camera of the camera-based sensor system.

### Claim 14 (depends on 13)

The system according to claim 13, wherein identifying an adversarial attack is performed during a signal data transfer from the vehicle to an online database.

### Claim 15 (depends on 11)

The system according to claim 11, wherein the metrics are calculated on an image detail of the potentially manipulated image.

### Claim 16 (depends on 11)

The system according to claim 11, wherein the creation of the subsets is implemented based on machine learning, and wherein the most relevant m metrics are automatically learned with representation learning.

### Claim 17 (depends on 11)

The system according to claim 11, wherein the reference signal and the potentially manipulated signal are overlapping or temporally offset from each other of the same scene.

### Claim 18 (depends on 5)

The method according to claim 5, wherein the reference signal and the potentially manipulated signal are temporally offset from each other of the same scene.