Neural network image classifier

1. A system for a neural network image classifier having improved accuracy, the system comprising:

a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes; and

at least one processor that computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network,

wherein the at least one processor applies the training image to the neural network and observes a response of the neural network,

wherein the at least one processor computes a constraint system using the observed response, the constraint system approximating the region of the input space, and

wherein the at least one processor further trains the neural network image classifier to have improved accuracy using at least the adversarial images.

2. The system of claim 1 , wherein the at least one processor computes an adversarial image as a perturbation of an associated training image which is correctly classified by the neural network, such human perception of the adversarial image and the associated training image is the same.

3. The system of claim 1 , wherein the at least one processor searches the region in the input space by searching a convex polyhedron in the input space.

4. The system of claim 1 , wherein the at least one processor searches for the closest adversarial example in the region to the training image.

5. The system of claim 1 , wherein the at least one processor computes the constraint system comprising a plurality of equalities and a plurality of inequalities describing the region of the input space.

6. The system of claim 5 , wherein the at least one processor removes disjunctions from the constraint system.

7. The system of claim 6 , wherein the at least one processor forms a linear program from the constraint system after removal of the disjunctions and solves the linear program using an iterative constraint refinement process.

8. The system of claim 7 , wherein the at least one processor initializes a current constraint set with the plurality of equalities and computes a current solution to a linear program formed from the current constraint set, and adds ones of the inequalities which are unsatisfied by the current solution to the current constrain set, and computes an updated current solution.

9. The system of claim 7 , wherein the iterative constraint refinement process uses fewer than five iterations.

10. The system of claim 1 , wherein the at least one processor computes the plurality of adversarial images in parallel.

11. A computer-implemented method comprising:

accessing, from a memory, a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes;

computing a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network;

applying the training image to the neural network and observing a response of the neural network;

computing a constraint system which represents the input space using the observed response; and

further training the neural network image classifier to have improved accuracy using at least the adversarial images.

12. The method of claim 11 , further comprising

computing an adversarial image as a perturbation of an associated training image which is correctly classified by the neural network, such human perception of the adversarial image and the associated training image is the same.

13. The method of claim 11 , further comprising:

searching the region in the input space by solving a linear program comprising the constraint system which approximates the region in the input space.

14. The method of claim 11 , further comprising:

searching the region in the input space by searching a convex polyhedron in the input space.

15. The method of claim 11 , further comprising:

searching for the closest adversarial example in the region to the training image.

16. A system for a neural network image classifier having improved accuracy, the system comprising:

a memory arranged to access the neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes; and

a processor which computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around the training image, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network,

wherein the processor searches the region in the input space by searching a convex polyhedron in the input space, and

wherein the processor further trains the neural network image classifier to have improved accuracy using at least the adversarial images.

17. The system of claim 16 , wherein the processor computes the plurality of adversarial images in parallel.

18. A computer-readable storage media storing instructions, when executed by at least one processor, performs a method comprising:

accessing a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes;

computing, using a processor, a plurality of adversarial images by, for each adversarial image, searching a region in the input space around the training image, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network;

applying the training image to the neural network and observing a response of the neural network;

computing a constraint system which represents the input space using the observed response; and

further training the neural network image classifier to have improved accuracy using at least the adversarial images.

19. The computer-readable storage media of claim 18 , wherein the method further comprises:

computing the constraint system comprising a plurality of equalities and a plurality of inequalities describing the region of the input space.

20. A computer-implemented method comprising:

accessing, from a memory, a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes;

computing a plurality of adversarial images by, for each adversarial image, searching a region in the input space around the training image, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network;

searching the region in the input space by searching a convex polyhedron in the input space; and

further training the neural network image classifier to have improved accuracy using at least the adversarial images.