Neural network image classifier

Patent metadata

Field	Value
Publication number	US-2017316281-A1
Application number	US-201615141759-A
Country	US
Kind code	A1
Filing date	Apr 28, 2016
Priority date	Apr 28, 2016
Publication date	Nov 2, 2017
Grant date	—

Abstract

A training engine is described which has a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes. The training engine has an adversarial example generator which computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network. The training engine has a processor which further trains the neural network image classifier using at least the adversarial images.

First claim

1 . A training engine comprising:
a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes; an adversarial example generator which computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network; and a processor which further trains the neural network image classifier using at least the adversarial images.

2 . The training engine of claim 1 wherein the adversarial example generator computes an adversarial image as a perturbation of an associated training image which is correctly classified by the neural network, such human perception of the adversarial image and the associated training image is the same.

3 . The training engine of claim 1 wherein the adversarial example generator searches the region in the input space by searching a convex polyhedron in the input space.

4 . The training engine of claim 1 wherein the adversarial example generator searches for the closest adversarial example in the region to the training image.

5 . The training engine of claim 1 wherein the adversarial example generator applies the training image to the neural network and observes a response of the neural network, and computes a constraint system using the observed response, the constraint system approximating the region of the input space.

6 . The training engine of claim 1 wherein the adversarial example generator computes a constraint system comprising a plurality of equalities and a plurality of inequalities describing the region of the input space.

7 . The training engine of claim 6 wherein the adversarial example generator removes disjunctions from the constraint system.

8 . The training engine of claim 7 wherein the adversarial example generator forms a linear program from the constraint system after removal of the disjunctions and solves the linear program using an iterative constraint refinement process.

9 . The training engine of claim 8 wherein the adversarial example generator initializes a current constraint set with the plurality of equalities and computes a current solution to a linear program formed from the current constraint set, and adds ones of the inequalities which are unsatisfied by the current solution to the current constrain set, and computes an updated current solution.

10 . The training engine of claim 8 wherein the iterative constraint refinement process uses fewer than five iterations.

11 . The training engine of claim 1 wherein the adversarial example generator computes the plurality of adversarial images in parallel.

12 . A computer-implemented method comprising:
accessing, from a memory, a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes; computing a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network; and further training the neural network image classifier using at least the adversarial images.

13 . The method of claim 11 comprising computing an adversarial image as a perturbation of an associated training image which is correctly classified by the neural network, such human perception of the adversarial image and the associated training image is the same.

14 . The method of claim 11 comprising searching the region in the input space by solving a linear program comprising a constraint system which approximates the region in the input space.

15 . The method of claim 11 comprising searching the region in the input space by searching a convex polyhedron in the input space.

16 . The method of claim 11 comprising searching for the closest adversarial example in the region to the training image.

17 . The method of claim 11 comprising applying the training image to the neural network and observing a response of the neural network, and computing a constraint system which represents the input space using the observed response.

18 . An adversarial example generator comprising:
a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes;
a processor which computes a plurality of adversarial images by, for each adversarial image, solving a constraint system which approximates a region in the input space around the training image, to find an image which is incorrectly classified into the plurality of classes by the neural network.

19 . A computer-implemented method comprising:
accessing a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes;
computing, using a processor, a plurality of adversarial images by, for each adversarial image, solving a constraint system which approximates a region in the input space around the training image, to find an image which is incorrectly classified into the plurality of classes by the neural network.

20 . A training engine comprising:
a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes; an adversarial example generator which computes a plurality of adversarial images by, for each adversarial image, solving a constraint system which approximates a region in the input space around the training image, to find an image which is incorrectly classified into the plurality of classes by the neural network; and a processor which further trains the neural network image classifier using at least the adversarial images.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Criminisi Antonio
• Nori Aditya Vithal
• Vytiniotis Dimitrios
• Bastani Osbert
• Lampropoulos Leonidas

Classifications

• G06V10/7747

  Organisation of the process, e.g. bagging or boosting · CPC title

• G06V10/82 Primary

  using neural networks · CPC title

• G06V10/764

  using classification, e.g. of video objects · CPC title

• G06F18/2148

  characterised by the process organisation or structure, e.g. boosting cascade · CPC title

• G06F18/2413

  based on distances to training or reference patterns · CPC title