Method and system of crown based for adversarial attacks
A method of identifying an attack comprising receiving an input of one or more images, wherein the one or more images includes a patch size and size, divide the image into a first sub-image and a second sub-image, classify the first sub-image and the second sub-image, wherein classifying is accomplished via introducing a variable in a pixel location associated with the first and second sub-image, and in response to classifying the first and second sub-image and identifying an adversarial patch, output a notification indicating that the input is not certified.
1. A method of identifying an attack comprising:
receiving an input of one or more images, wherein the one or more images includes a patch size and size;
dividing one of the one or more images into a first sub-image and a second sub-image;
dividing a domain of a verification problem into a plurality of sub-domains;
verifying the first sub-image and the second sub-image until all sub-domains are certified or split until each sub-domain contains only one patch location;
classifying the first sub-image and the second sub-image, wherein classifying is accomplished via introducing a Boolean variable in a pixel location associated with the first and second sub-image, wherein the Boolean variable identifies the pixel location; and
in response to classifying the first and second sub-image and identifying an adversarial patch, outputting a notification indicating that the input is not certified.
2. The method of claim 1 , wherein classifying is accomplished via utilizing a branch and bound at an input space associated with the first and second sub-image.
3. The method of claim 1 , wherein the method includes utilizing mixed integer programming to formulate a patch attack problem utilizing a patch size associated with the one of the one or more images.
4. The method of claim 3 , wherein the method includes utilizing a convex program solver to resolve the patch attack problem.
5. The method of claim 1 , wherein the image is LIDAR, radar, sonar, thermal, heat, or temperature image.
6. The method of claim 1 , wherein the method includes utilizing bagsnet or convmixer as a feature extractor configured to utilize an image size associated with the one of the one or more images to output a feature map.
7. The method of claim 1 , extractor has a receptive field smaller than the one of the one or more images.
8. A system for classifying an image, comprising:
a sensor configured to generate one or more images; a controller in communication with the sensor and configured to:
receive an input of one or more images, wherein the one or more images includes a patch size and image size;
divide one of the one or more images into a first sub-image and a second sub-image;
divide a domain of a verification problem into a plurality of sub-domains;
verify the first sub-image and the second sub-image until all sub-domains are certified or split until each sub-domain contains only one patch location;
classify the first sub-image and the second sub-image, wherein classifying is accomplished via introducing a Boolean variable in a pixel location associated with the first and second sub-image, wherein the Boolean variable identifies the pixel location; and
in response to classifying the first and second sub-image and identifying an adversarial patch, output a notification indicating that the input is not certified.
9. The system of claim 8 , wherein the image is LIDAR, radar, sonar, thermal, heat, or temperature image.
10. The system of claim 8 , wherein classifying is accomplished via utilizing a branch and bound at an input space associated with the first and second sub-image.
11. The system of claim 8 , wherein the controller is further configured to verify the first sub-image and second sub-image utilizing 1 ={x i,j ,x∈ ,and(i,j)∈S 1 }, 2 ={x i,j ,x∈ ,and(i,j)∈S 2 }.
12. The system of claim 8 , wherein the system includes a feature extractor configured to take an image size associated with one of the one or more images and output a feature map.
13. The system of claim 12 , wherein the feature extractor includes either bagsnet or convmixer.
14. A method of identifying an attack comprising:
receiving an input of one or more images, wherein the one or more images includes a patch size and size;
divide one of the one or more images into a first sub-image and a second sub-image;
divide a domain of a verification problem into a plurality of sub-domains;
classify the first sub-image and the second sub-image, wherein classifying is done via locating a Boolean variable in a pixel location associated with the first and second sub-image, wherein the Boolean variable includes altering the pixel location;
verify the first sub-image and the second sub-image until all sub-domains are certified or split until each sub-domain contains only one patch location;
in response to classifying the first and second sub-image and not identifying an adversarial patch, continue to divide the one of the one or more images into a plurality of sub-images and classify the sub-images; and
output a notification indicating that the input is not certified in response to identifying an adversarial patch in one of the plurality of sub-images.
15. The method of claim 14 , the method further includes outputting a notification indicating the input is certified if all subdomains are certified.
16. The method of claim 14 , wherein the method includes utilizing mixed integer programming to formulate a patch attack problem utilizing a patch size associated with the one of the one or more images.
17. The method of claim 14 , wherein the method includes utilizing a convex program solver to resolve the patch attack problem.
18. The method of claim 14 , wherein classifying is accomplished via utilizing a branch and bound at an input space associated with the first and second sub-image.
19. The method of claim 14 , wherein the method further includes verifying the first sub-image and second sub-image utilizing 1 ={x i,j , x∈ ,and(i,j)∈S 1 }, 2 ={x i,j ,x∈ ,and(i,j)∈S 2 }.
20. The method of claim 14 , wherein the method further includes utilizing bagsnet or convmixer as a feature extractor configured to utilize an image size associated with the one of the one or more images to output a feature map.