Automatic identification and classification of adversarial attacks
A method for identifying adversarial attacks on an image based detection system for automated driving includes providing a reference signal and a potentially manipulated signal. The method also includes calculating a plurality of metrics which quantify differences between the signals in different ways. The method further includes creating a multi-dimensional feature space based on the calculated metrics and classifying the type of attack based on the calculated metrics. The class of the adversarial attack may then be output.
1. A method for identifying and classifying adversarial attacks on an automated detection system, comprising:
providing a reference signal and a potentially manipulated signal, wherein each signal includes at least one of an image signal, a video signal, or an audio signal,
calculating a set of n metrics which quantify differences between the reference signal and the potentially manipulated signal in different ways, with n being a natural number greater than one
creating an n-dimensional feature space based on the calculated metrics,
classifying the type of adversarial attack on the basis of the calculated metrics in the n-dimensional feature space, and
outputting the class of the adversarial attack,
wherein the automated detection system comprises at least one trained neural network, and the reference signal and the potentially manipulated signal are provided following completion of a training phase of the at least one neural network, and
wherein subsets are created from the n metrics in order to extract most relevant m metrics, with m being a natural number less than n and, wherein the classification of the type of the adversarial attack is effected on the basis of the calculated metrics in the m-dimensional feature space.
2. The method according to claim 1 , further comprising introducing a specific counter-measure against a class of adversarial attacks identified as critical.
3. The method according to claim 1 , wherein the automated detection system comprises a camera-based sensor system of a vehicle, wherein the potentially manipulated signals are image or video signals which have been acquired by at least one camera of the camera-based sensor system.
4. The method according to claim 3 , wherein the method for identifying an adversarial attack is performed during a signal data transfer from the vehicle to an online database.
5. The method according to claim 3 , wherein the automated detection system comprises a multicamera system in a vehicle and wherein the potentially manipulated image or video signal and the reference image or video signal are overlapping or temporally offset acquisitions of the same scene by various individual cameras.
6. The method according to claim 3 , wherein the metrics are calculated on the entire potentially manipulated image.
7. The method according to claim 3 , wherein the metrics are calculated on an image detail of the potentially manipulated image.
8. The method according to claim 3 , wherein the metrics are calculated from at least one of a series of images and a series of image details.
9. The method according to claim 3 , wherein the n metrics contain multiple metrics which are selected from the group of:
SSIM, L1-norm, L2-norm, KL divergence, MSE, MAE, PSNR, L∞-norm, L0-norm, Edge metrics, hash metrics, and Fourier transform metrics.
10. The method according to claim 1 , wherein the creation of the subsets is implemented based on machine learning and wherein at least the most relevant m metrics are automatically learned with the aid of representation learning.
11. A system for identifying adversarial attacks on an automated detection system, comprising an input interface, an identification unit, and an output interface, wherein
the input interface is configured to receive a reference signal and a potentially manipulated signal, wherein each signal includes at least one of an image signal, a video signal, or an audio signal, and to provide the potentially manipulated signal to the identification unit;
wherein the identification unit comprises processor circuitry and is configured:
to calculate a set of n metrics, which quantify differences between the reference signal and the potentially manipulated signal in different ways,
to create a n-dimensional feature space based on the calculated metrics, and
to classify the type of adversarial attack on the basis of the calculated metrics in the n-dimensional feature space, and
the output interface is configured to output the class of the adversarial attack established by the identification unit
wherein the automated detection system comprises at least one trained neural network such that the reference signal and the potentially manipulated signal are received by the system following completion of a training phase of the at least one neural network, and
wherein subsets are created from the n metrics in order to extract most relevant m metrics, with m being a natural number less than n and, wherein the classification of the type of the adversarial attack is effected on the basis of the calculated metrics in the m-dimensional feature space.
12. The system according to claim 11 , further comprising a second system which receives the class of the adversarial attack from the output interface, the second system introducing a specific counter-measure against if the class of adversarial attacks is identified as critical.
13. The system according to claim 11 , wherein the automated detection system comprises a camera-based sensor system of a vehicle, wherein the potentially manipulated signals are image or video signals which have been acquired by at least one camera of the camera-based sensor system.
14. The system according to claim 13 , wherein identifying an adversarial attack is performed during a signal data transfer from the vehicle to an online database.
15. The system according to claim 11 , wherein the metrics are calculated on an image detail of the potentially manipulated image.
16. The system according to claim 11 , wherein the creation of the subsets is implemented based on machine learning, and wherein the most relevant m metrics are automatically learned with representation learning.
17. The system according to claim 11 , wherein the reference signal and the potentially manipulated signal are overlapping or temporally offset from each other of the same scene.
18. The method according to claim 5 , wherein the reference signal and the potentially manipulated signal are temporally offset from each other of the same scene.