Device and method for classifying images and accessing the robustness of the classification
A computer-implemented method for determining an output signal characterizing a first classification of an input image into a class from a plurality of classes. The output signal further characterizes a second classification of a robustness of the first classification against an attack with an adversarial patch.
1. A computer-implemented method for determining an output signal characterizing a first classification of an input image into a class from a plurality of classes, wherein the output signal further characterizes a second classification of a robustness of the first classification against an attack with an adversarial patch, wherein the method comprises the following steps:
determining a plurality of first score maps;
determining a plurality of first class scores, wherein each respective first score map of the first score maps corresponds:
to a respective class from the plurality of classes and includes a plurality of area classifications, wherein each of the area classifications characterizes for a respective area of a plurality of areas of the input image whether the respective area belongs to the respective class or not; and
to a respective first class score of the plurality of first class scores, which respective first class score is determined by aggregating the area classifications of the respective first score map to which the respective first class score corresponds;
determining a second class score, wherein the second class score is a minimum class score that can be obtained when an adversarial patch is applied to the input image for changing the area classifications of whichever of the first score maps corresponds to a first one of the plurality of classes for which a largest of the first class scores has been determined;
determining a plurality of third class scores, wherein each of the third class scores corresponds to a respective different class, which is different from the first one of the plurality of classes and is a maximum class score that can be obtained when the adversarial patch is applied to the input image for changing the area classifications of the first score map of the respective different class; and
determining the output signal based on the second class score and the third class scores according to conditions that:
when the second class score is larger than or equal to all of the third class scores, the output signal characterizes the second classification of the first classification as robust against the adversarial patch; and
when the second class score is smaller than at least one of the third class scores, the output signal characterizes the second classification of the first classification as not robust against the adversarial patch.
2. The method according to claim 1 , wherein, for each of the respective first class scores, the aggregating is achieved by determining a sum of the area classifications of the respective score map to which the respective first class score corresponds.
3. The method according to claim 2 , wherein, for each of the respective first class scores, the aggregating is achieved by a neural network that:
is configured to accept as input the respective score map to which the respective first class score corresponds and provide the respective first class score as output; and
includes only positive weights and non-decreasing activation functions.
4. The method according to claim 3 , further comprising:
training the neural network, wherein the training of the neural network is achieved by adversarial training.
5. The method according to claim 2 , wherein in the step of determining the second class score, the second class score is determined by subtracting a maximum amount of area classifications the adversarial patch can change from the largest first class score.
6. The method according to claim 2 , wherein in the step of determining the plurality of third class scores, a third class score of the plurality of third class scores is determined by adding a maximum amount of area classifications the adversarial patch can change to a respective first class score.
7. The method according to claim 1 , wherein the determining of the second class score includes:
determining a plurality of second score maps for the first one of the plurality of classes, which corresponds to the largest of the first class scores, wherein for each possible position of the adversarial patch in the input image, a respective second score map of the plurality of second score maps is determined, wherein for each of the respective second score maps, a respective area classification of the respective second score map is determined to not characterize the first one of the plurality of classes when the adversarial patch extends into an area corresponding to the respective area classification of the respective second score map;
aggregating each second score map to determine a plurality of intermediate class scores; and
providing the smallest intermediate class score from the plurality of intermediate class scores as the second class score.
8. The method according to claim 7 , wherein the plurality of first score maps and/or the plurality of second score maps is determined by a convolutional neural network.
9. The method according to claim 8 , wherein the convolutional neural network determines each first score map by determining an output of an output layer of the convolutional neural network for the input image and applying a Heaviside function to the output.
10. The method according to claim 8 , wherein the method further includes training the convolutional neural network, wherein training includes:
determining a plurality of first training score maps for a training image by providing the training image to the convolutional neural network;
determining a plurality of first training class scores by aggregating each first training score map from the determined plurality of first training score maps;
determining a loss value
l
=
max
c
≠
c
t
max
(
0
,
y
^
c
+
m
-
y
^
c
t
)
,
wherein ŷ c is a c-th class score of the plurality of first training class scores, m is a value characterizing a predefined margin, and ŷ c t is a first training class score of the plurality of first training class scores for a desired class of the training image;
determining a gradient for a plurality of parameters of the convolutional neural network using backpropagation, wherein the convolutional neural network includes a Heaviside function and a gradient of the Heaviside function is replaced by a gradient of a Sigmoid function; and
adapting the parameters of the convolutional neural network according to the gradient.
11. The method according to claim 1 , wherein in the step of determining the plurality of third class scores, each respective one of the third class scores is determined by:
determining a plurality of second score maps for the respective different class corresponding to the respective third class score, wherein for each possible position of an adversarial patch in the input image a second score map of the plurality of second score maps is determined, wherein for each second score map of the plurality of second score maps a respective area classification is determined to characterize the respective different class if the adversarial patch extends into an area corresponding to the respective area classification;
aggregating each second score map of the plurality of second score maps to determine a plurality of intermediate class scores; and
providing a largest intermediate class score from the plurality of intermediate class scores as the respective third class score.
12. The method according to claim 1 , wherein a device is controlled in accordance with the output signal.
13. An image classifier comprising:
a processor system that includes at least one processor, wherein the processor system is configured to perform a method to determine an output signal characterizing a first classification of an input image into a class from a plurality of classes, wherein the output signal further characterizes a second classification of a robustness of the first classification against an attack with an adversarial patch, wherein the method includes:
determining a plurality of first score maps;
determining a plurality of first class scores, wherein each respective first score map of the first score maps corresponds:
to a respective class from the plurality of classes and includes a plurality of area classifications, wherein each of the area classifications characterizes for a respective area of a plurality of areas of the input image whether the respective area belongs to the respective class or not; and
to a respective first class score of the plurality of first class scores, which respective first class score is determined by the processor system aggregating the area classifications of the respective first score map to which the respective first class score corresponds;
determining a second class score, wherein the second class score is a minimum class score that can be obtained when an adversarial patch is applied to the input image for changing the area classifications of whichever of the first score maps corresponds to a first one of the plurality of classes for which a largest of the first class scores has been determined;
determining a plurality of third class scores, wherein each of the third class scores corresponds to a respective different class, which is different from the first one of the plurality of classes and is a maximum class score that can be obtained when the adversarial patch is applied to the input image for changing the area classifications of the first score map of the respective different class; and
determining the output signal based on the second class score and the third class scores according to conditions that:
when the second class score is being larger than or equal to all of the third class scores, the output signal characterizes the second classification of the first classification as robust against the adversarial patch; and
when the second class score is being smaller than at least one of the third class scores, the output signal characterizes the second classification of the first classification as not robust against the adversarial patch;
wherein the processor system is configured to perform at least one of the determination of the plurality of first score maps and the determination of the plurality of first class scores by executing a convolutional neural network.
14. A non-transitory machine-readable storage medium on which is stored a computer program that is executable by a processor system and that, when executed by the processor system, causes the processor system to perform a method for determining an output signal characterizing a first classification of an input image into a class from a plurality of classes, wherein the output signal further characterizes a second classification of a robustness of the first classification against an attack with an adversarial patch, the method comprising:
determining a plurality of first score maps;
determining a plurality of first class scores, wherein each respective first score map of the first score maps corresponds:
to a respective class from the plurality of classes and includes a plurality of area classifications, wherein each of the area classifications characterizes for a respective area of a plurality of areas of the input image whether the respective area belongs to the respective class or not; and
to a respective first class score of the plurality of first class scores, which respective first class score is determined by aggregating the area classifications of the respective first score map to which the respective first class score corresponds;
determining a second class score, wherein the second class score is a minimum class score that can be obtained when an adversarial patch is applied to the input image for changing the area classifications of whichever of the first score maps corresponds to a first one of the plurality of classes for which a largest of the first class scores has been determined;
determining a plurality of third class scores, wherein each of the third class scores corresponds to a respective different class, which is different from the first one of the plurality of classes and is a maximum class score that can be obtained when the adversarial patch is applied to the input image for changing the area classifications of the first score map of the respective different class; and
determining the output signal based on the second class score and the third class scores according to conditions that:
when the second class score is being larger than or equal to all of the third class scores, the output signal characterizes the second classification of the first classification as robust against the adversarial patch; and
when the second class score is being smaller than at least one of the third class scores, the output signal characterizes the second classification of the first classification as not robust against the adversarial patch.