Device and method for determining adversarial perturbations of a machine learning system
A computer-implemented method for determining an adversarial perturbation for input signals, especially sensor signals or features of sensor signals, of a machine learning system. A best perturbation is determined iteratively, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration includes: sampling a perturbation; applying the sampled perturbation to an input signal thereby determining a potential adversarial example; determining an output signal from the machine learning system for the potential adversarial example, determining a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal, if the loss value is larger than a previous loss value setting the best perturbation to the sampled perturbation.
1 . A computer-implemented method for determining an adversarial perturbation for input signals of a machine learning system, the method comprising the following steps:
iteratively determining a best perturbation, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration includes the following steps:
sampling a perturbation;
applying the sampled perturbation to an input signal to determine a potential adversarial example;
determining an output signal from the machine learning system for the potential adversarial example;
determining a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal;
based on the loss value being larger than a previous loss value, setting the best perturbation to the sampled perturbation;
wherein in each iteration, elements of the sampled perturbation are set to zero, wherein a number of elements set to zero is proportional to how many iterations have passed.
2 . The method according to claim 1 , wherein the input signals are sensor signals or features of sensor signals.
3 . The method according to claim 1 , wherein at least one element of the input signal characterizes an integer and the sampled perturbation includes a corresponding element characterizing an integer.
4 . The method according to claim 1 , wherein the adversarial perturbation is sampled by sampling a random perturbation for each input signal of a dataset and combining the sampled random perturbations.
5 . The method according to claim 1 , wherein the output signal characterizes a classification and/or regression result and/or a density value and/or a probability value, based on the input signal.
6 . The method according to claim 1 , further comprising:
applying the adversarial perturbation to a training input signal to determine an adversarial example for training the machine learning system.
7 . A method for training a machine learning system, the method comprising the following steps:
training the machine learning system including:
determining for a training input signal of the machine learning system an adversarial perturbation by:
iteratively determining a best perturbation, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration includes the following steps:
sampling a perturbation,
applying the sampled perturbation to an input signal to determine a potential adversarial example,
determining an output signal from the machine learning system for the potential adversarial example,
determining a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal,
based on the loss value being larger than a previous loss value, setting the best perturbation to the sampled perturbation,
wherein in each iteration, elements of the sampled perturbation are set to zero, wherein a number of elements set to zero is proportional to how many iterations have passed;
applying the adversarial perturbation to the training input signal to determining an adversarial example and training the machine learning system to predict a desired output signal corresponding to the training input signal for the adversarial example.
8 . A training system configured to train a machine learning system, the training system configured to:
train the machine learning system including:
determining for a training input signal of the machine learning system an adversarial perturbation by:
iteratively determining a best perturbation, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration includes the following steps:
sampling a perturbation,
applying the sampled perturbation to an input signal to determine a potential adversarial example,
determining an output signal from the machine learning system for the potential adversarial example,
determining a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal,
based on the loss value being larger than a previous loss value, setting the best perturbation to the sampled perturbation,
wherein in each iteration, elements of the sampled perturbation are set to zero, wherein a number of elements set to zero is proportional to how many iterations have passed;
apply the adversarial perturbation to the training input signal to determining an adversarial example and training the machine learning system to predict a desired output signal corresponding to the training input signal for the adversarial example.
9 . A non-transitory machine-readable storage medium on which is stored a computer program for determining an adversarial perturbation for input signals of a machine learning system, the computer program, when executed by a computer, causing the computer to perform the following steps comprising:
iteratively determining a best perturbation, wherein the best perturbation is provided as adversarial perturbation after a predefined amount of iterations, wherein at least one iteration includes the following steps:
sampling a perturbation;
applying the sampled perturbation to an input signal to determine a potential adversarial example;
determining an output signal from the machine learning system for the potential adversarial example;
determining a loss value characterizing a deviation of the output signal to a desired output signal, wherein the desired output signal corresponds to the input signal;
based on the loss value being larger than a previous loss value, setting the best perturbation to the sampled perturbation,
wherein in each iteration, elements of the sampled perturbation are set to zero, wherein a number of elements set to zero is proportional to how many iterations have passed.
10 . The non-transitory machine-readable storage medium according to claim 9 , wherein the computer program, when executed by a computer, further causing the computer to perform the following step comprising:
applying the adversarial perturbation to a training input signal to determine an adversarial example for training the machine learning system.