System and method for machine learning architecture with adversarial attack defense

Patent metadata

Field	Value
Publication number	US-11520899-B2
Application number	US-201916416057-A
Country	US
Kind code	B2
Filing date	May 17, 2019
Priority date	May 17, 2018
Publication date	Dec 6, 2022
Grant date	Dec 6, 2022

Abstract

A platform for training deep neural networks using push-to-corner preprocessing and adversarial training. A training engine adds a preprocessing layer before the input data is fed into a deep neural network at the input layer, for pushing the input data further to the corner of its domain.

First claim

What is claimed is:

1. A computer implemented system for conducting machine learning with adversarial training, the system comprising:
at least one memory for storing neural network data for defining a neural network having a plurality of nodes in a plurality of layers, the plurality of nodes configured to receive an plurality of inputs and to generate one or more outputs based on the neural network data;
at least one processor configured for:
receiving a first training input data set for training the neural network;
transforming the first training input data set with a saturation function to generate a saturated data set with values pushed toward corners of domains of the input data set;

inputting the saturated data set into the neural network and generating saturated data backpropagation gradients based on the resulting one or more outputs of the neural network; and
generating a second training data set based on the training input data set and the saturated data backpropagation gradients.

2. The computer implemented system of claim 1 , wherein the domains of the input data set are from X to Y, the saturation function pushes values in the input data set which are less than 0.5*(Y−X) closer to X, and values in the input data set which are greater than 0.5*(Y−X) closer to Y.

3. The computer implemented system of claim 1 wherein the saturation function pushes values in the input data set towards a corner of a high dimensional space domain of the input data set.

4. The computer implemented system of claim 1 , wherein the saturation function is defined by g(X):

g
⁡

(
x
)

=

sign
⁡

(
x
)

⁢


x


2
p

where x is an input value to be saturated and p is an integer greater than 2.

5. The computer implemented system of claim 1 , wherein the saturation function is defined by g(X):

g
α

⁡

(
x
)

=

f
α

⁡

(
x
)

-
0.5

1
-

2
*

S
⁡

(

-
α

*
0.5

)

+
0.5

where

f
α

⁡

(
x
)

=

S
⁡

(

α
*

(

x
-
0.5

)

)

S
⁡

(
x
)

=

1

1
+

e

-
x

and α is greater than 0.

6. The computer implemented system of claim 1 , wherein the at least one processor is configured for:
training the neural network with the second training data set; and
storing second neural network data, the second neural network data defining the neural network trained with the second training data set.

7. The computer implemented system of claim 1 , wherein the at least one processor is configured for: training the neural network with the second training data set and the first training data set.

8. The computer implemented system of claim 1 , wherein the at least one processor is configured for: weighting the training of the neural network such that the training with one of the first and the second training data set is more heavily weighted than and the training with the other of the first and second training data set.

9. The computer implemented system of claim 1 , wherein the at least one processor is configured for: providing the second training data set as an input to a second neural network.

10. The computer implemented system of claim 1 , wherein the first training data set represents image data, audio data, medical data or user profile data.

11. A computer implemented method for conducting machine learning with adversarial training, the method comprising:
receiving a first training input data set for training a neural network defined by neural network data stored in at least one memory, the neural network having a plurality of nodes in a plurality of layers, the plurality of nodes configured to receive an plurality of inputs and to generate one or more outputs based on the neural network data;
transforming, with at least one processor, the first training input data set with a saturation function to generate a saturated data set with values pushed toward corners of domains of the input data set;
inputting the saturated data set into the neural network and generating, with the at least one processor, saturated data backpropagation gradients based on the resulting one or more outputs of the neural network; and
generating, with the at least one processor, a second training data set based on the training input data set and the saturated data backpropagation gradients.

12. The computer implemented method

Assignees

• Royal Bank Of Canada

Inventors

• Ding Weiguang
• Wang Luyu
• Huang Ruitong
• Jin Xiaomeng
• Lui Kry Yik Chau

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06N3/084

  Backpropagation, e.g. using gradient descent · CPC title

• G06N7/046

  Implementation by means of a neural network (neural networks using fuzzy logic G06N3/043) · CPC title

• G06F2221/033

  Test or assess software · CPC title