Device and method for determining adversarial perturbations of a machine learning system

A method for training a machine learning system, the method comprising the following steps:

• training the machine learning system including:
• determining for a training input signal of the machine learning system an adversarial perturbation by:
• iteratively determining a best perturbation, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration includes the following steps:
• sampling a perturbation,
• applying the sampled perturbation to an input signal to determine a potential adversarial example,
• determining an output signal from the machine learning system for the potential adversarial example,
• determining a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal,
• based on the loss value being larger than a previous loss value, setting the best perturbation to the sampled perturbation,
• wherein in each iteration, elements of the sampled perturbation are set to zero, wherein a number of elements set to zero is proportional to how many iterations have passed;
• applying the adversarial perturbation to the training input signal to determining an adversarial example and training the machine learning system to predict a desired output signal corresponding to the training input signal for the adversarial example.

A training system configured to train a machine learning system, the training system configured to:

• train the machine learning system including:
• determining for a training input signal of the machine learning system an adversarial perturbation by:
• iteratively determining a best perturbation, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration includes the following steps:
• sampling a perturbation,
• applying the sampled perturbation to an input signal to determine a potential adversarial example,
• determining an output signal from the machine learning system for the potential adversarial example,
• determining a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal,
• based on the loss value being larger than a previous loss value, setting the best perturbation to the sampled perturbation,
• wherein in each iteration, elements of the sampled perturbation are set to zero, wherein a number of elements set to zero is proportional to how many iterations have passed;
• apply the adversarial perturbation to the training input signal to determining an adversarial example and training the machine learning system to predict a desired output signal corresponding to the training input signal for the adversarial example.

A non-transitory machine-readable storage medium on which is stored a computer program for determining an adversarial perturbation for input signals of a machine learning system, the computer program, when executed by a computer, causing the computer to perform the following steps comprising:

• iteratively determining a best perturbation, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration includes the following steps:
• sampling a perturbation;
• applying the sampled perturbation to an input signal to determine a potential adversarial example;
• determining an output signal from the machine learning system for the potential adversarial example;
• determining a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal;
• based on the loss value being larger than a previous loss value, setting the best perturbation to the sampled perturbation,
• wherein in each iteration, elements of the sampled perturbation are set to zero, wherein a number of elements set to zero is proportional to how many iterations have passed.