Patent ID: 11921819
Assignee: ZHEJIANG UNIVERSITY OF TECHNOLOGY
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 3:
4. The defense method against adversarial examples based on feature remapping according to claim 1, wherein the approach of training feature remapping model, detector, and re-recognizer covers:
(a) for the original benign samples xi, testing whether predicted labels in the target model are consistent with real labels first, if not, then eliminating the benign samples and do not attack these samples, if so, then go to step (b); and
(b) for the target model and the benign samples xi, using ma different attack methods to attack, then obtaining the corresponding adversarial example set {xiadv,1, xiadv,2, . . . , xiadv,ma}; and
(c) after the attack complete, inputting the adversarial examples obtained in adversarial example set in step (b) to the target model one by one for testing, if the predicted labels are not consistent with real labels, that indicates the attack is successful, and keeping the adversarial example in the set; if consistent, that indicates the attack failed, the sample should be from the set; and
(d) repeating step (a)˜(c) to collect the set of adversarial examples for all samples; and
(e) resorting the samples in the adversarial example set Xadv={xiadv,j}.