Method and system for breaking backdoored classifiers through adversarial examples
A computer-implemented method for training a machine learning network includes receiving an input data from one or more sensors, selecting one or more batch samples from the input data, wherein the batch samples include one or more perturbed samples from a source class configured to be misclassified into a target class, identifying the one or more perturbed samples from the one or more batch samples, determining a trigger event in response to identification of a trigger pattern of the one or more batch samples, wherein the trigger pattern induces a pre-determined response on a classifier, outputting a classification in response to identification of the trigger pattern via the classifier, and outputting a set of trigger patterns extracted from the machine-learning network.
1. A computer-implemented method for identifying backdoor triggers from a machine learning network, comprising:
receiving an input data from one or more sensors, wherein the input data includes information indicative of image information or sound information;
selecting one or more batch samples from the input data, wherein the batch samples include one or more perturbed samples from a source class configured to be misclassified into a target class;
identifying the one or more perturbed samples from the one or more batch samples;
determining a trigger event in response to identification of a trigger pattern of the one or more batch samples, wherein the trigger pattern induces a pre-determined response on a classifier;
determining that the classifier requires robustification, wherein the classifier is trained with robustification data augmentation to robustify the classifier in response to the determination indicating the classifier requires robustification;
outputting a classification in response to identification of the trigger pattern via the classifier; and
outputting a set of trigger patterns extracted from the machine learning network.
2. The computer-implemented method of claim 1 , wherein the method includes training the classifier via operating Gaussian data augmentation of the classifier.
3. The computer-implemented method of claim 1 , wherein the method includes prepending a denoiser to the classifier.
4. The computer-implemented method of claim 3 , wherein the denoiser is a custom-trained denoiser.
5. The computer-implemented method of claim 1 , wherein a perturbation associated with the input data and machine learning network facilitates the identification of the trigger event.
6. The computer-implemented method of claim 1 , wherein the classification associated with input data facilitates in identification of the trigger event.
7. The computer-implemented method of claim 1 , wherein the method includes cropping colors and patterns associated with the input data to initiate the trigger event.
8. The computer-implemented method of claim 1 , wherein the identifying is in response to a project gradient descent attack process.
9. A system including a machine learning network, comprising:
an input interface configured to receive input data, wherein the input interface is connected to one or more sensors, wherein the one or more sensors includes a video, radar, LiDAR, sound, sonar, ultrasonic, motion, or thermal imaging sensor; and
a processor, in communication with the input interface, wherein the processor is programmed to:
receive an input data from one or more sensors, wherein the input data includes information indicative of image information or sound information;
select one or more batch samples from the input data, wherein the batch samples include one or more perturbed samples from a source class configured to be misclassified into a target class;
identify the one or more perturbed samples from the one or more batch samples;
determine a trigger event in response to identification of a trigger pattern of the one or more batch samples, wherein the trigger pattern induces a pre-determined response on a classifier and the trigger pattern occupy a portion of the image; and
output a classification in response to identification of the trigger pattern via the classifier;
determining if the classifier requires robustification, wherein the classifier is trained with data augmentation in response to the determination indicating the classifier requires robustification;
outputting a set of trigger patterns extracted from the machine learning network; and
operating a physical system based on output data including the set of trigger patterns, wherein the physical system is a computer-controlled machine, a robot, a vehicle, a domestic appliance, a power tool, a manufacturing machine, a personal assistant or an access control system.
10. The system of claim 9 , wherein the processor is programmed to identify in response to a project gradient descent attack process.
11. The system of claim 9 , wherein the processor is further programmed to operate a Gaussian data augmentation of the classifier.
12. The system of claim 9 , wherein processor is further programmed to remove Gauissian noise associated with the input data via a denoiser applied to the classifier.
13. The system of claim 9 , wherein a perturbation associated with the input data and machine learning network facilities in identification of the trigger event.
14. The system of claim 9 , wherein the classification associated with input data facilitates in identification of the trigger event.
15. A computer-program product storing instructions on non-transitory memory, the instructions which, when executed by a computer, cause the computer to:
receive an input data from one or more sensors, wherein the input data includes information indicative of image information or sound information;
select one or more batch samples from the input data, wherein the batch samples include one or more perturbed samples from a source class configured to be misclassified into a target class of a machine-learning network;
identify the one or more perturbed samples from the one or more batch samples;
determine a trigger event in response to identification of a trigger pattern of the one or more batch samples, wherein the trigger pattern induces a pre-determined response on a classifier;
determine if the classifier requires robustification, wherein the classifier is trained with data augmentation to robustify the classifier in response to the determination indicating the classifier requires robustification;
output a classification in response to identification of the trigger pattern via the classifier; and
output a set of trigger patterns extracted from the machine-learning network.
16. The computer-program product of claim 15 , wherein a perturbation associated with the input data facilities in identification of the trigger event.
17. The computer-program product of claim 15 , wherein the trigger pattern is a cropped trigger pattern.
18. The computer-program product of claim 15 , wherein the trigger pattern is a synthetic trigger pattern.
19. The computer-program product of claim 15 , wherein the instructions that cause the computer to determine the trigger event is responsive to a Tikhov regularization.
20. The computer-program product of claim 15 , wherein the trigger pattern is associated with an adversarial attack.