United States

This work describes the problems that can occur when Autonomous Systems have not been designed with security in mind. Examples are given of vulnerabilities found in Autonomous Systems - the risks that these systems face, both from malicious and naive users are described. Baseline security measures and advice are given for designing, and using Autonomous Systems in a way which minimises the risk of a vulnerability being exploited. This security advice does not cover “artificial Intelligence” attacks (such as adversarial inputs, or data poisoning), these attacks form another research topic entirely. Instead, we focus on basic software hygiene, as relevant to Autonomous Systems. Since these systems are typically network connected, this falls into the area of Cyber security hygiene, following best practice to enhance security. Cases of incorrect configurations, poor security choices and risky assumptions are all demonstrated. 
© Crown copyright (2021), Dstl.

NAML 2021

How good Cyber Hygiene can help defend Autonomous Systems

best-practice

defending systems

computing security

vulnerabilities

autonomous systems

Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

* To spread awareness of current machine learning research relevant to Naval applications

* To connect machine learning researchers with experts in military requirements

* To build and strengthen collaborations within the defense research community

**Watch this video to hear about the AFCEA purpose.**

<iframe width=1280 height=706 frameborder="0" scrolling="no" src="https://screencast-o-matic.com/player/creleVVcvRh?v=6&ff=1&title=0&controls=1" allowfullscreen="true"></iframe>

technical paper

Traditional machine learning pipelines require data to be centralized. For data that are collected and stored on multiple edge devices, or for data owned by multiple institutions that must not share their sensitive information, the traditional pipeline becomes impractical due to bandwidth bottlenecks and privacy concerns. Federated learning is a machine learning specialization that addresses these issues and allows for accurate, timely decision making on data that are not centrally available. Rather than aggregating distributed data into one centralized dataset, federated learning assumes that the data remain at the edge. By doing so, federated learning reduces the bandwidth strain over communication lines, allows institutions to share knowledge without giving up their data, and leverages distributed edge computing. In our current studies, we seek to develop a federated algorithm that converges quickly to an accurate model, that is practical for implementation on edge devices with limited processing capabilities, and that is bandwidth efficient. More specifically, we focus on federated optimization with one central server and many clients, and introduce our algorithm called Federated Kronecker-factored quasi-Newton. We are using Kronecker-factorization to make loss-curvature information available cheaply at the edge for federated training in this second-order optimization procedure, which to our knowledge, has not yet been done. We highlight the benefits and challenges of second order optimization in the federated setting and demonstrate preliminary performance curves that show improved model accuracy on smaller amounts of information exchanged and in less training time than some state-of-the-art algorithms. We also show that even though our algorithm is a second-order optimization technique, it is still practical to implement.

Second-Order Federated Optimization

We present federated reconnaissance, a new class of learning problems in which distributed clients learn new concepts independently and must be able to communicate that knowledge efficiently. In particular, we propose an evaluation framework and methodological baseline for a system in which each client is expected to learn a growing set of classes and communicate knowledge of those classes efficiently with other clients, such that, after knowledge merging, the clients should be able to accurately discriminate between classes in the superset of classes observed by the set of clients. We compare a range of learning algorithms for this problem and find that prototypical networks are a strong approach in that they are robust to catastrophic forgetting while incorporating new information efficiently. Furthermore, we show that the online averaging of prototype vectors is effective for client model merging and requires only a small amount of communication overhead, memory, and update time per class with no gradient-based learning or hyperparameter tuning. Additionally, to put our results in context, we find that a simple, prototypical network with four convolutional layers significantly outperforms complex, state of the art continual learning algorithms, increasing the accuracy by over 22% (absolute) after learning 600 Omniglot classes and over 33% (absolute) after learning 20 mini-ImageNet classes incrementally. These results have important implications for federated reconnaissance and continual learning more generally by demonstrating that communicating feature vectors is an efficient, robust, and effective means for distributed, continual learning.

Federated Reconnaissance: A New Framework for Distributed Continual Learning

Neural networks have shown to be extremely effective tools for machine learning in broad contexts, including natural language processing, image processing, and adversarial game playing such as Chess and Go. Despite their success in a wide variety of contexts, the design of a neural network (which is inescapably tied to its performance) is often a matter of iterated re-engineering to find an architecture that performs the best on a small set of predetermined metrics. As such, this leaves the parsimony of such systems vague at best.

Over the past few years it has become apparent that the mathematics of topology can be used to understand some theoretical fundamentals of neural networks. Roughly speaking, topology is the field of math that studies spaces that are considered to be ``the same'' up to a continuous stretching (i.e., homeomorphism). For that reason it is known as ``rubber sheet geometry.'' The main reason that topology has provided tools to study neural networks is that a deep neural network can be thought of as an iterated sequence of continuous transformations between spaces.

In this work we develop an algorithm for automatically generating a trainable deep neural network with information obtained from the geometric and topological properties of training data. Our approach first finds a dense ellipsoidal covering of the training data set that is consistent with the classification information. We then find an (approximately) minimum sub-cover that models the classification information. A neural network is constructed that approximates the structure of the minimum sub-cover and which encodes logical statements representative of the data geometry. We show empirically that after training, the neural network retains the imprinted geometric information, making each module in the neural network geometrically interpretable. Theoretical and experimental results provide information on this approach across a variety of data sets. In addition to this we show how the proposed approach, when combined with methods from topological data analysis (specifically homology), can be used to quantify the likelihood that any neural network classifier will perform well on a given binary classifier data set before neural network engineering takes place. All results are illustrated using multiple data sets.

Topological Data Analysis Methods for Data Set Characterization to Augment Machine Learning Methods

Many of the recent practical successes of artificial intelligence have been due to progress in machine learning, and in deep learning with neural networks in particular. However, such methods must be trained on large data sets, which may not be available for
all domains, and the resulting networks function as "black box" systems, without the capability to explain their conclusions. The lack of explainability impedes their safe application to some of the very domains that could most benefit from AI, including military,
intelligence, security, medical, and legal applications where decisions must be justified and the consequences of failure are too great. We are developing methods for combining deep learning's extremely powerful ability to find patterns in data with more traditional
AI techniques for representing and reasoning about knowledge to yield new techniques that combine the strengths of both. In particular, we believe that the knowledge-based machine learning approach case-based reasoning (CBR) is an ideal complementary partner
for deep learning. Case-based reasoning solves problems by retrieving and adapting cases encoding the solutions to prior similar problems. The CBR process leverages analogical reasoning with knowledge about similarity and about how to adapt solutions to new
circumstances, to enable reasoning from small data sets. CBR can exploit the intelligibility of cases to provide explanations in a form compelling to humans. We are investigating tight couplings of deep machine learning with case-based reasoning in order to
take advantage of the complementary strengths of these two approaches. Ongoing projects include hybrid approaches in which cases provide a human-intelligible vehicle for capturing and explaining decisions, while network learning methods support the CBR process
by generating similarity and case adaptation knowledge. This material is based upon work supported in part by the Department of the Navy, Office of Naval Research under award number N00014-19-1-2655.

Combining Deep Learning and Case-based Reasoning for Robust, Accurate, Explainable Systems


Adversarial attacks have demonstrated the ability to change image classification labels with minimal alterations to the input image across a wide variety of Deep Neural Network (DNN) algorithms. Specifically the Fast Gradient Attack (FGA) [2] method has been shown to change a model’s output classification label with minimal visual alterations. Goodfellow et. al. [1] conjectured that this may be due to the high dimensional nature of the input data, as well as the linearity of the Deep Learning (DL) algorithms. Our study investigates the efficacy of one mitigation strategy (attack defense), centered on a simple preprocessing method (median de-noising) on input images. The median filter is employed on images input into ResNet models of varying depth, which have been pre-trained on the CIFAR10 dataset. It is hypothesized that by employing this preprocessing mitigation technique to adversarial attacked images, the impact of the FGA method [1] can be reduced. This study is designed to test if de-noising an input image can mitigate adversarial attack effectiveness. Additionally, the median filter removes some information contained within the dataset. Therefore, we seek to characterize and quantify the robustness of the ResNet models with this transformation technique. This research provides insight into the nature of the FGA adversarial attack vector, a simple attack mitigation strategy, as well as the robustness of the Deep Learning models being studied.

[1] I. J. Goodfellow, J. Shlens and C. Szegedy, Explaining and Harnessing Adversarial Examples, arXiv e-prints, p. 1412.6572 December 2014
[2] Nicolae, Maria-Irina and Sinn, Mathieu and Tran, Minh Ngoc and Buesser, Beat and Rawat, Ambrish and Wistuba, Martin and Zantedeschi, Valentina and Baracaldo, Nathalie and Chen, Bryant and Ludwig, Heiko and Molloy, Ian and Edwards, Ben, Adversarial Robustness Toolbox v1.2.0 CoRR 1807.01069 https://arxiv.org/pdf/1807.01069 2018

Adversarial Attack Mitigation Techniques

Many real-world datasets are examples of a fortunate contradiction: they are at once high-dimensional, generated by intricate and complex physics, but at the same time low-dimensional, driven by only a small set of dominant phenomena. As an example, consider the flow of a fluid past a two-dimensional cylinder at low Reynolds number. This is a relatively simple flow that is used as a standard example in computational fluid dynamics, yet accurate simulations require millions of degrees of freedom. At the same time, it is well known that the resulting data can often be compressed into ten or fewer modal coefficients with less than 1% information loss. The sparse sensor placement optimization for classification (SSPOC) algorithm leverages this characteristic to distill high-dimensional datasets down to small feature sets that are especially relevant for answering specified classification questions. SSPOC works by first projecting a full dataset onto a truncated principal component analysis (PCA) subspace, then training a simple classification model using linear discriminant analysis (LDA), and then selecting features based on a sparsification of the LDA discriminant. The algorithm has proven effective in numerous fields, including image recognition, facial recognition, fluid flow classification, and cancer classification, among others.

Here we present a new extension of the SSPOC algorithm that is applicable to vector-valued data, enabling a number of new applications. First, we apply vector SSPOC to multi-channel data, demonstrating its benefits in situations where the cost deploying a sensor platform is much higher than the cost of placing sensors on that platform, as can be the case on ocean buoys. Next, we perform an image recognition task using image patches instead of individual pixels. Vector SSPOC is able to identify informative image regions with less noise and more confidence than standard/scalar SSPOC. Finally, we apply vector SSPOC to the simulated response of a vibrating plate, in order to distinguish between two possible forcing locations; this is a simple model for noise source localization on Navy vessels. Typically described as complex numbers, we encode the response data as a vector-valued signal using a real-composite representation. As a result, we are able to achieve high classification accuracy using only a handful of sensors.


Sparse sensor placement optimization for classification (SSPOC) for vector-valued data

Dictionary learning is a prototypical machine learning problem with broad applications throughout computer vision and signal processing. Given a set of training data, the goal is to learn a dictionary of prototype patterns that provide a sparse (parsimonious) representation of the data. Such a dictionary then enables a variety of problems to be solved by exploiting sparse structure; example problems include noise removal, super-resolution, deblurring, imputing missing data, and classification. Like many problems in machine learning, dictionary learning can be formulated as an optimization problem. Unfortunately, this optimization problem is non-convex, making it potentially difficult to solve to global optimality. Additional questions arise in how to deal with multi-modal data and distributed data, such as might be collected by multiple satellites, UAVs, etc. This presentation will summarize our team’s research on theory and algorithms for solving non-convex matrix-valued optimization problems such as dictionary learning, particularly in multi-modal, distributed, and streaming contexts. We welcome the opportunity to discuss further transitioning this technology for Naval applications.

Fast Communication-efficient Algorithms for Distributed and Multi-modal Dictionary Learning

The arithmetic logic units in neuromorphic accelerators for the edge are moving from 32-bit precision to ultra-low (<8bits) to leverage resource and energy efficiency. Conventional data formats, like fixed-point representation and the floating pointdata format deteriorates the performance of deep neural networks(DNN) at low-precision. One solution to mitigate the accuracyreduction is to fit the distribution of the representable numbers to the distribution of the DNN parameters. Recent findings showthat general posit has similar distribution and dynamic range as the weight and activation values across the deep neural networklayers. In this study, we design an ASIC softcore for the general posit MAC operations and, analyze the energy dissipation andmemory utilization of DNNs incorporating posits on accelerators for different benchmarks. We demonstrate the advantage ofthe proposed numerical format by comparing it to the existing fixed-point and floating point formats. The general posit offerssignificant improvement in accuracy over fixed-point and floating-point formats with minimal energy dissipation.

Neuromorphic Accelerators with Low-PrecisionGeneral Posit for the Edge

Pursuit-evasion games have been studied for decades under perfect information and analytically-derived policies for static environments. Here, we incorporate uncertainty in a target’s position via simulated measurements and propose a continuous deep reinforcement learning (RL) approach to support pursuit of a speed-advantaged target. An OpenAI gym environment was created for simulating pursuit game play. A Kalman filter was implemented for simulating data fusion of uncertainties associated with imperfect range and bearing measurements from the pursuer to the target. An actor-critic based, model-free, deep discrete policy gradient (DDPG) method was implemented for incrementally training an agent to compete at a speed-overmatched pursuit game. The resulting RL policy was tested under many scenarios and performance exceeded that of a baseline course-aligned strategy. Emerging reinforcement learning success strategies were analyzed and manually abstracted into grouped behaviors. An online decision-making framework is discussed for leveraging conditional past performance to predict future performance.

Reinforcement Learning Approach to Speed-Overmatched Maritime Targets with Uncertain Information

The Emulation Ground Vehicle (EGV) is a robotic wheeled vehicle designed and manufactured in-house at NAWCAD Lakehurst to be used as an aircraft-representative interface for testing deck handling control systems at Lakehurst’s Advanced Deck Handling Technology Evaluation Center (ADHaTEC). The EGV utilizes dynamic models of existing aircraft along with Model Reference Adaptive Control (MRAC), an adaptive machine learning strategy, to closely emulate the taxiing dynamics of those aircraft. Its size is comparable to that of shipboard aircraft, and it is equipped with functions possessed by those craft on the flight deck, such as wing folding, launch bar actuation, and tail hook actuation. Integration with the Robot Operating System (ROS) streamlines the capability of the EGV to function as a testbed for any kind of taxiing control method for both teleoperation and autonomous navigation, including methods based on machine learning strategies. Successful full scale tests of the vehicle have been performed, clearing a path for future work utilizing the platform. Plans include implementing a Fuzzy Adaptive Resonance Theory (FuzzyART) neural network-based gesture recognition control system that has already been tested on smaller robotic vehicles. Going forward, the EGV could be used to evaluate various machine learning-based control methods for aircraft operating in the shipboard environment before those methods transition to fleet use.

Premium content

How good Cyber Hygiene can help defend Autonomous Systems

Downloads

Next from NAML 2021

Second-Order Federated Optimization

Similar lecture

A Novel Hybrid Method for Self-Localization and Intelligent Mapping of AUVs