United States

Adversarial attacks have demonstrated the ability to change image classification labels with minimal alterations to the input image across a wide variety of Deep Neural Network (DNN) algorithms. Specifically the Fast Gradient Attack (FGA) [2] method has been shown to change a model’s output classification label with minimal visual alterations. Goodfellow et. al. [1] conjectured that this may be due to the high dimensional nature of the input data, as well as the linearity of the Deep Learning (DL) algorithms. Our study investigates the efficacy of one mitigation strategy (attack defense), centered on a simple preprocessing method (median de-noising) on input images. The median filter is employed on images input into ResNet models of varying depth, which have been pre-trained on the CIFAR10 dataset. It is hypothesized that by employing this preprocessing mitigation technique to adversarial attacked images, the impact of the FGA method [1] can be reduced. This study is designed to test if de-noising an input image can mitigate adversarial attack effectiveness. Additionally, the median filter removes some information contained within the dataset. Therefore, we seek to characterize and quantify the robustness of the ResNet models with this transformation technique. This research provides insight into the nature of the FGA adversarial attack vector, a simple attack mitigation strategy, as well as the robustness of the Deep Learning models being studied.

[1] I. J. Goodfellow, J. Shlens and C. Szegedy, Explaining and Harnessing Adversarial Examples, arXiv e-prints, p. 1412.6572 December 2014
[2] Nicolae, Maria-Irina and Sinn, Mathieu and Tran, Minh Ngoc and Buesser, Beat and Rawat, Ambrish and Wistuba, Martin and Zantedeschi, Valentina and Baracaldo, Nathalie and Chen, Bryant and Ludwig, Heiko and Molloy, Ian and Edwards, Ben, Adversarial Robustness Toolbox v1.2.0 CoRR 1807.01069 https://arxiv.org/pdf/1807.01069 2018

NAML 2021

Adversarial Attack Mitigation Techniques

image

mitigation

classification

attack

adversarial

Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

* To spread awareness of current machine learning research relevant to Naval applications

* To connect machine learning researchers with experts in military requirements

* To build and strengthen collaborations within the defense research community

**Watch this video to hear about the AFCEA purpose.**

<iframe width=1280 height=706 frameborder="0" scrolling="no" src="https://screencast-o-matic.com/player/creleVVcvRh?v=6&ff=1&title=0&controls=1" allowfullscreen="true"></iframe>

technical paper

Many real-world datasets are examples of a fortunate contradiction: they are at once high-dimensional, generated by intricate and complex physics, but at the same time low-dimensional, driven by only a small set of dominant phenomena. As an example, consider the flow of a fluid past a two-dimensional cylinder at low Reynolds number. This is a relatively simple flow that is used as a standard example in computational fluid dynamics, yet accurate simulations require millions of degrees of freedom. At the same time, it is well known that the resulting data can often be compressed into ten or fewer modal coefficients with less than 1% information loss. The sparse sensor placement optimization for classification (SSPOC) algorithm leverages this characteristic to distill high-dimensional datasets down to small feature sets that are especially relevant for answering specified classification questions. SSPOC works by first projecting a full dataset onto a truncated principal component analysis (PCA) subspace, then training a simple classification model using linear discriminant analysis (LDA), and then selecting features based on a sparsification of the LDA discriminant. The algorithm has proven effective in numerous fields, including image recognition, facial recognition, fluid flow classification, and cancer classification, among others.

Here we present a new extension of the SSPOC algorithm that is applicable to vector-valued data, enabling a number of new applications. First, we apply vector SSPOC to multi-channel data, demonstrating its benefits in situations where the cost deploying a sensor platform is much higher than the cost of placing sensors on that platform, as can be the case on ocean buoys. Next, we perform an image recognition task using image patches instead of individual pixels. Vector SSPOC is able to identify informative image regions with less noise and more confidence than standard/scalar SSPOC. Finally, we apply vector SSPOC to the simulated response of a vibrating plate, in order to distinguish between two possible forcing locations; this is a simple model for noise source localization on Navy vessels. Typically described as complex numbers, we encode the response data as a vector-valued signal using a real-composite representation. As a result, we are able to achieve high classification accuracy using only a handful of sensors.


Sparse sensor placement optimization for classification (SSPOC) for vector-valued data

Dictionary learning is a prototypical machine learning problem with broad applications throughout computer vision and signal processing. Given a set of training data, the goal is to learn a dictionary of prototype patterns that provide a sparse (parsimonious) representation of the data. Such a dictionary then enables a variety of problems to be solved by exploiting sparse structure; example problems include noise removal, super-resolution, deblurring, imputing missing data, and classification. Like many problems in machine learning, dictionary learning can be formulated as an optimization problem. Unfortunately, this optimization problem is non-convex, making it potentially difficult to solve to global optimality. Additional questions arise in how to deal with multi-modal data and distributed data, such as might be collected by multiple satellites, UAVs, etc. This presentation will summarize our team’s research on theory and algorithms for solving non-convex matrix-valued optimization problems such as dictionary learning, particularly in multi-modal, distributed, and streaming contexts. We welcome the opportunity to discuss further transitioning this technology for Naval applications.

Fast Communication-efficient Algorithms for Distributed and Multi-modal Dictionary Learning

The arithmetic logic units in neuromorphic accelerators for the edge are moving from 32-bit precision to ultra-low (<8bits) to leverage resource and energy efficiency. Conventional data formats, like fixed-point representation and the floating pointdata format deteriorates the performance of deep neural networks(DNN) at low-precision. One solution to mitigate the accuracyreduction is to fit the distribution of the representable numbers to the distribution of the DNN parameters. Recent findings showthat general posit has similar distribution and dynamic range as the weight and activation values across the deep neural networklayers. In this study, we design an ASIC softcore for the general posit MAC operations and, analyze the energy dissipation andmemory utilization of DNNs incorporating posits on accelerators for different benchmarks. We demonstrate the advantage ofthe proposed numerical format by comparing it to the existing fixed-point and floating point formats. The general posit offerssignificant improvement in accuracy over fixed-point and floating-point formats with minimal energy dissipation.

Neuromorphic Accelerators with Low-PrecisionGeneral Posit for the Edge

Pursuit-evasion games have been studied for decades under perfect information and analytically-derived policies for static environments. Here, we incorporate uncertainty in a target’s position via simulated measurements and propose a continuous deep reinforcement learning (RL) approach to support pursuit of a speed-advantaged target. An OpenAI gym environment was created for simulating pursuit game play. A Kalman filter was implemented for simulating data fusion of uncertainties associated with imperfect range and bearing measurements from the pursuer to the target. An actor-critic based, model-free, deep discrete policy gradient (DDPG) method was implemented for incrementally training an agent to compete at a speed-overmatched pursuit game. The resulting RL policy was tested under many scenarios and performance exceeded that of a baseline course-aligned strategy. Emerging reinforcement learning success strategies were analyzed and manually abstracted into grouped behaviors. An online decision-making framework is discussed for leveraging conditional past performance to predict future performance.

Reinforcement Learning Approach to Speed-Overmatched Maritime Targets with Uncertain Information

The Emulation Ground Vehicle (EGV) is a robotic wheeled vehicle designed and manufactured in-house at NAWCAD Lakehurst to be used as an aircraft-representative interface for testing deck handling control systems at Lakehurst’s Advanced Deck Handling Technology Evaluation Center (ADHaTEC). The EGV utilizes dynamic models of existing aircraft along with Model Reference Adaptive Control (MRAC), an adaptive machine learning strategy, to closely emulate the taxiing dynamics of those aircraft. Its size is comparable to that of shipboard aircraft, and it is equipped with functions possessed by those craft on the flight deck, such as wing folding, launch bar actuation, and tail hook actuation. Integration with the Robot Operating System (ROS) streamlines the capability of the EGV to function as a testbed for any kind of taxiing control method for both teleoperation and autonomous navigation, including methods based on machine learning strategies. Successful full scale tests of the vehicle have been performed, clearing a path for future work utilizing the platform. Plans include implementing a Fuzzy Adaptive Resonance Theory (FuzzyART) neural network-based gesture recognition control system that has already been tested on smaller robotic vehicles. Going forward, the EGV could be used to evaluate various machine learning-based control methods for aircraft operating in the shipboard environment before those methods transition to fleet use.

Emulation Ground Vehicle (EGV)

SeeByte US has been supporting the MK 18 program, integrating the commercial collaborative autonomy. SeeByte US has also been partnering with small businesses as an SBIR subcontractor, mainly to increase the level of autonomy of the Original Equipment Manufacturers (OEMS). This talk will give an overview of the levels of autonomy and how advanced sensor processing is applied to increase the capability of Unmanned Underwater Vehicles (UUVs) and Remote Operated Vehicles (ROVs). There are three Naval application examples that will be discussed. The first will be a real-world demonstration using MK 18 Mod2 UUVs for Mine Counter Measure (MCM). The second is a simulation of feature-based navigation and the third is a discussion on using small class ROVs for Explosive Ordinance Disposal (EOD) intervention tasks. The talk concludes on what is needed to help advanced sensor processing algorithms using Machine Learning, Artificial Intelligence and Computer Vision to increase levels of autonomy.

Increasing Levels of Autonomy Through Advanced Sensor Processing

The Marine Corps Tactical Systems Support Activity (MCTSSA) Advanced Concepts Cell (AC2) collaborated with Booz Allen to deliver one of the first successful artificial intelligence (AI) projects developed by the command. The project, Digital Fortress, employs computer vision (CV) at the edge to enhance force protection efforts at the MCTSSA compound. Live full-motion video feeds from cameras placed at the entry control point of the front gate fed computer vision algorithms that not only detected vehicles and pedestrians, but further classified vehicle type, color, and captured license plate information for purposes of identifying vehicles of interest. Results from the algorithms were stored in a data log of incoming and outgoing traffic that could be queried directly by the end user and/or used for real-time alerts in emergency situations. The data was displayed in a dashboard for easy and accessible interaction by the end user. 

During the development of Digital Fortress, data scientists on the project explored both custom and opensource off-the-shelf solutions. In this presentation, the team will discuss the software and network architectures of Digital Fortress, as well as the data science pipeline developed to perform inference at the edge.

Digital Fortress: Enhanced Force Protection through Computer Vision at the Edge

State of the art techniques for learning predictive models from naturally occurring data are plagued by the fundamental problem of shortcut learning – often thought of as overfitting in classical machine learning settings. One of these ways is the now infamous adversarial example to a deep image classifier – an imperceptible perturbation (highly correlated with an incorrect label) of the input that drastically reduces the model’s accuracy (Szegedy et al., 2013). A plethora of mitigation strategies have been proposed, the most effective of which rely on adversarial training: teaching the model to be invariant to these kinds of spurious signals by exposing it to adversarial examples themselves during training (Madry et al., 2017).In this talk, we demonstrate that although state-of-the-art adversarial training techniques mitigate spurious correlations that are based on noise, adversarial training does not mitigate more semantically meaningful shortcuts. For example, we show that a model defended with adversarial training will associate the “balance beam” label with the presence of a gymnast in the ImageNet dataset, even though a human would not make that same association to assist in classifying an image as a balance beam. We show the presence of this spurious correlation in the trained model by constructing a series of adversarial examples which are both recognizable to a human, in that adversarial example targeting the stingray class resemble images of stingrays also containing a recognizable snorkeler, demonstrating a semantically incorrect association between the class and the learned features. Using examples like these, we then argue that adversarial training does not solve the core shortcut learning problem -- rather the problem persists at a higher semantic level. 

This finding is important to the Navy: if adversarial training causes models to infer semantically meaningful spurious correlations, and these correlations reveal critical information about the method by which the data was collected, then adversarial training will violate policies related to data security. To this end, we provide proof of concept tools for examining the shortcuts taken by models defended with adversarial training. 

References:
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013). Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199.

Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083.

Deng, J., Dong, W., Socher, R., Li, L. J., Li, K., & Fei-Fei, L. (2009, June). Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition (pp. 248-255). Ieee.

Current Robustness Techniques do Not Solve the Shortcut Learning Problem

Computational Modeling of Trust Factors in Recognition of

Warfighting Ships

S. Lamczyk, L. Vidyaratne, M. Rahman, and K. M. Iftekharuddin

Vision Lab, Department of Electrical and Computer Engineering, Old Dominion University,

Norfolk, VA 23529
ABSTRACT

As machine-learning (ML) algorithms continue to handle increasingly intricate problems, these methods are often required to process incomplete, imprecise, and ambiguous sensor data for decision making. The capabilities of these ML algorithms must be developed further in order to meet the increasingly complex demand associated with the deployment and integration of decision-making capabilities of intelligent systems into modern society. Furthermore, the variability in the performance of modern ML methods in dynamic environments leads to ambiguity of trust in the decisions made by such algorithms. Consequently, we propose a novel computational modeling for trust quantification to analyze the performance and improve the trustworthiness of autonomous decision-making algorithms. The approach relies on the implementation of a neural network-based reinforcement learning (RL) model known as an adaptive critic design to model an adaptive decision-making process that is regulated by quantitative measure of risk associated with each possible decision. Specifically, this work offers risk-directed exploration strategies of RL to obtain quantitative risk factors for automated object recognition in the presence of imprecise data. The proposed framework is used for automated recognition of warfighting ships in well-known Janes’ Fighting Ships image dataset along with other publicly available crowdsourced images. The results show improved recognition performance with the proposed risk quantification framework. Finally, we present extensions to the proposed recognition model with multimodal input processing capabilities by combining the image recognition model with a state-of-the-art deep learning based optical character recognition (OCR) architecture to generate more specific recognition such as the class, type, and/or name of the ship.

Computational Modeling Of Trust Factors in Recognition of Warfighting Ships

Object tracking is a fundamental computer vision problem found in a wide range of applications. Most state-of-the-art object trackers adopt deep neural networks for high tracking performance at the expense of huge computational resources and heavy memory use. Here, we target at a light-weight high-performance tracker of a much smaller model size, thus meeting the size, weight and power (SWAP) requirements of devices used in modern battlefields.

Premium content

Adversarial Attack Mitigation Techniques

Downloads

Next from NAML 2021

Sparse sensor placement optimization for classification (SSPOC) for vector-valued data

Similar lecture

Adversarial Attacks on Underwater Soundscape Classifiers