Neural network image classifier

Patent metadata

Field	Value
Publication number	US-10007866-B2
Application number	US-201615141759-A
Country	US
Kind code	B2
Filing date	Apr 28, 2016
Priority date	Apr 28, 2016
Publication date	Jun 26, 2018
Grant date	Jun 26, 2018

Abstract

A training engine is described which has a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes. The training engine has an adversarial example generator which computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network. The training engine has a processor which further trains the neural network image classifier using at least the adversarial images.

First claim

The invention claimed is:

1. A system for a neural network image classifier having improved accuracy, the system comprising:
a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes; and
at least one processor that computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network,
wherein the at least one processor applies the training image to the neural network and observes a response of the neural network,
wherein the at least one processor computes a constraint system using the observed response, the constraint system approximating the region of the input space, and
wherein the at least one processor further trains the neural network image classifier to have improved accuracy using at least the adversarial images.

2. The system of claim 1 , wherein the at least one processor computes an adversarial image as a perturbation of an associated training image which is correctly classified by the neural network, such human perception of the adversarial image and the associated training image is the same.

3. The system of claim 1 , wherein the at least one processor searches the region in the input space by searching a convex polyhedron in the input space.

4. The system of claim 1 , wherein the at least one processor searches for the closest adversarial example in the region to the training image.

5. The system of claim 1 , wherein the at least one processor computes the constraint system comprising a plurality of equalities and a plurality of inequalities describing the region of the input space.

6. The system of claim 5 , wherein the at least one processor removes disjunctions from the constraint system.

7. The system of claim 6 , wherein the at least one processor forms a linear program from the constraint system after removal of the disjunctions and solves the linear program using an iterative constraint refinement process.

8. The system of claim 7 , wherein the at least one processor initializes a current constraint set with the plurality of equalities and computes a current solution to a linear program formed from the current constraint set, and adds ones of the inequalities which are unsatisfied by the current solution to the current constrain set, and computes an updated current solution.

9. The system of claim 7 , wherein the iterative constraint refinement process uses fewer than five iterations.

10. The system of claim 1 , wherein the at least one processor computes the plurality of adversarial images in parallel.

11. A computer-implemented method comprising:
accessing, from a memory, a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes;
computing a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network;
applying the training image to the neural network and observing a response of the neural network;
computing a constraint system which represents the input space using the observed response; and
further training the neural network image classifier to have improved accuracy using at least the adversarial images.

12. The method of claim 11 , further comprising
computing an adversarial image as a perturbation of an associated training image which is correctly classified by the neural network, such human perception of the adversarial image and the associated training image is the same.

13. The method of claim 11 , further comprising:
searching the region in the input space by solving a linear program comprising the constraint system which approximates the region in the input space.

14. The method of claim 11 , further comprising:
searching the region in the input space by searching a convex polyhedron in the input space.

15. The method of claim 11 , further comprising:
searching for the closest adversarial example in the region to the training image.

16. A system for a neural network image classifier having improved accuracy, the system comprising:
a memory arranged to access the neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes; and
a processor which computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around the training image, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network,
wherein the processor searches the region in the input space by searching a convex polyhedron in the input space, and
wherein the processor further trains the neural network image classifier to have improved accuracy using at least the adversarial images.

17. The system of claim 16 , wherein the processor computes the plurality of adversarial images in parallel.

18. A computer-readable storage media storing instructions, when executed by at least one processor, performs a method comprising:
accessing a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes;
computing, using a processor, a plurality of adversarial images by, for each adversarial image, searching a region in the input space around the training image, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network;
applying the training image to the neural network and observing a response of the neural network;
computing a constraint system which represents the input space using the observed response; and
further training the neural network image classifier to have improved accuracy using at least the adversarial images.

19. The computer-readable storage media of claim 18 , wherein the method further comprises:
computing the constraint system comprising a plurality of equalities and a plurality of inequalities describing the region of the input space.

20. A computer-implemented method comprising:
accessing, from a memory, a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes;
computing a plurality of adversarial images by, for each adversarial image, searching a region in the input space around the training image, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network;
searching the region in the input space by searching a convex polyhedron in the input space; and
further training the neural network image class

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Criminisi Antonio
• Nori Aditya Vithal
• Vytiniotis Dimitrios
• Bastani Osbert
• Lampropoulos Leonidas

Classifications

• G06V10/7747

  Organisation of the process, e.g. bagging or boosting · CPC title

• G06V10/82 Primary

  using neural networks · CPC title

• G06V10/764

  using classification, e.g. of video objects · CPC title

• G06F18/2148

  characterised by the process organisation or structure, e.g. boosting cascade · CPC title

• G06F18/2413

  based on distances to training or reference patterns · CPC title