Asymmetrical robustness for classification in adversarial environments

A computational method for training a classifier. The method includes receiving a training data set comprised of pairs of training input and output signals, the classifier parameterized by parameters, a class-dependent allowed perturbation for each of at least two different classes and including a first class-dependent allowed perturbation for a first class and a second class-dependent allowed perturbation for a second class, and a loss function. The method further includes partitioning the training data set into a first subset labelled with a first label and a second subset labelled with a second label. The method also includes calculating a first loss in response to the first subset and the first class-dependent allowed perturbation and a second loss calculated in response to the second subset and the second class-dependent allowed perturbation. The method also includes updating the parameters in response to the first and second losses to obtain updated parameters.

TECHNICAL FIELD

The present disclosure relates to computational methods and computer systems for providing asymmetrical robustness for classification in adversarial environments, including computational methods and computer systems for training a classifier (e.g. machine learning (ML) algorithm) in an adversarial environment.

BACKGROUND

Supervised machine learning (ML) algorithms (otherwise referred to as classifiers) include deep learning algorithms built upon deep neural networks. ML algorithms are susceptible to adversarial attacks on their input space. The classifier may be denoted by f that maps a feature signified by x∈dinto a class y∈{1, . . . , K}. An adversarial attack to f corresponds to an imperceptible perturbation δ that, when added to an input x, classifier f outputs a different result, i.e. f(x)≠f(x+δ). Imperceptibility is often modeled as a membership to a set of allowed perturbations δ∈Δ either by constraining anp-norm of the perturbation δ or by forcing perceptual imperceptibility of the change, for example, by increasing the difficulty of an operator to distinguish unperturbed data x from perturbed data x+δ. The susceptibility of classifiers to adversarial attacks, either arising from a malign agent or from noise sources, raises concerns to their use in critical tasks. For instance, minor imperceptible changes on the input may cause drastic changes on the output and behavior of the classifier f.

SUMMARY

According to one embodiment, a computational method for training a classifier is disclosed. The method includes receiving a training data set comprised of pairs of training input signals and corresponding output signals. The classifier is parameterized by parameters and configured to classify input signals obtained from a sensor into at least two different classes including first and second classes. The method further includes receiving a class-dependent allowed perturbation for each of the at least two different classes and including a first class-dependent allowed perturbation for the first class and a second class-dependent allowed perturbation for the second class. The method further includes receiving a loss function. The computational method also includes partitioning the training data set into a first subset labelled with a first label corresponding to the first class and a second subset labelled with a second label corresponding to the second class. The computational method also includes calculating a first loss in response to the first subset and the first class-dependent allowed perturbation and a second loss calculated in response to the second subset and the second class-dependent allowed perturbation. The computational method also includes updating the parameters in response to the first and second losses to obtain updated parameters.

In a second embodiment, a non-transitory computer-readable medium comprising computer-executable instructions and a memory for maintaining the computer-executable instructions is disclosed. The computer-executable instructions when executed by a processor of a computer perform functions, including receiving a training data set comprised of pairs of training input signals and corresponding output signals. The classifier is parameterized by parameters and configured to classify input signals obtained from a sensor into at least two different classes including first and second classes. The functions further include receiving a class-dependent allowed perturbation for each of the at least two different classes and including a first class-dependent allowed perturbation for the first class and a second class-dependent allowed perturbation for the second class. The functions further include receiving a loss function. The functions further include partitioning the training data set into a first subset labelled with a first label corresponding to the first class and a second subset labelled with a second label corresponding to the second class. The functions also include calculating a first loss in response to the first subset and the first class-dependent allowed perturbation and a second loss calculated in response to the second subset and the second class-dependent allowed perturbation. The functions also include updating the parameters in response to the first and second losses to obtain updated parameters.

In another embodiment, a computer system including a computer having a processor for executing computer-executable instructions and a memory for maintaining the computer-executable instructions is disclosed. The computer-executable instructions when executed by the processor of the computer perform functions. The functions include receiving a training data set comprised of pairs of training input signals and corresponding output signals. The classifier is parameterized by parameters and configured to classify input signals obtained from a sensor into at least two different classes including first and second classes. The functions further include receiving a class-dependent allowed perturbation for each of the at least two different classes and including a first class-dependent allowed perturbation for the first class and a second class-dependent allowed perturbation for the second class. The functions further include receiving a loss function. The functions also include partitioning the training data set into a first subset labelled with a first label corresponding to the first class and a second subset labelled with a second label corresponding to the second class. The functions also include calculating a first loss in response to the first subset and the first class-dependent allowed perturbation and a second loss calculated in response to the second subset and the second class-dependent allowed perturbation. The functions also include updating the parameters in response to the first and second losses to obtain updated parameters.

DETAILED DESCRIPTION

FIG.1depicts a schematic diagram of an interaction between computer-controlled machine10and control system12. Computer-controlled machine10includes actuator14and sensor16. Actuator14may include one or more actuators and sensor16may include one or more sensors. Sensor16is configured to sense a condition of computer-controlled machine10. Sensor16may be configured to encode the sensed condition into sensor signals18and to transmit sensor signals18to control system12. Non-limiting examples of sensor16include video, radar, LiDAR, ultrasonic and motion sensors. In one embodiment, sensor16is an optical sensor configured to sense optical images of an environment proximate to computer-controlled machine10.

Control system12is configured to receive sensor signals18from computer-controlled machine10. As set forth below, control system12may be further configured to compute actuator control commands20depending on the sensor signals and to transmit actuator control commands20to actuator14of computer-controlled machine10.

As shown inFIG.1, control system12includes receiving unit22. Receiving unit22may be configured to receive sensor signals18from sensor30and to transform sensor signals18into input signals x. In an alternative embodiment, sensor signals18are received directly as input signals x without receiving unit22. Each input signal x may be a portion of each sensor signal18. Receiving unit22may be configured to process each sensor signal18to product each input signal x. Input signal x may include data corresponding to an image recorded by sensor16.

Control system12includes classifier24. Classifier24may be configured to classify input signals x into one or more labels using a machine learning (ML) algorithm, such as a neural network. Classifier24is configured to be parametrized by parameters θ. Parameters θ may be stored in and provided by non-volatile storage26. Classifier24is configured to determine output signals y from input signals x. Each output signal y includes information that assigns one or more labels to each input signal x. Classifier24may transmit output signals y to conversion unit28. Conversion unit28is configured to covert output signals y into actuator control commands20. Control system12is configured to transmit actuator control commands20to actuator14, which is configured to actuate computer-controlled machine10in response to actuator control commands20. In another embodiment, actuator14is configured to actuate computer-controlled machine10based directly on output signals y.

Upon receipt of actuator control commands20by actuator14, actuator14is configured to execute an action corresponding to the related actuator control command20. Actuator14may include a control logic configured to transform actuator control commands20into a second actuator control command, which is utilized to control actuator14. In one or more embodiments, actuator control commands20may be utilized to control a display instead of or in addition to an actuator.

In another embodiment, control system12includes sensor16instead of or in addition to computer-controlled machine10including sensor16. Control system12may also include actuator14instead of or in addition to computer-controlled machine10including actuator10.

As shown inFIG.1, control system12also includes processor30and memory32. Processor30may include one or more processors. Memory32may include one or more memory devices. The classifier24(e.g., ML algorithms) of one or more embodiments may be implemented by control system12, which includes non-volatile storage26, processor30and memory32.

Non-volatile storage26may include one or more persistent data storage devices such as a hard drive, optical drive, tape drive, non-volatile solid-state device, cloud storage or any other device capable of persistently storing information. Processor30may include one or more devices selected from high-performance computing (HPC) systems including high-performance cores, microprocessors, micro-controllers, digital signal processors, microcomputers, central processing units, field programmable gate arrays, programmable logic devices, state machines, logic circuits, analog circuits, digital circuits, or any other devices that manipulate signals (analog or digital) based on computer-executable instructions residing in memory32. Memory32may include a single memory device or a number of memory devices including, but not limited to, random access memory (RAM), volatile memory, non-volatile memory, static random access memory (SRAM), dynamic random access memory (DRAM), flash memory, cache memory, or any other device capable of storing information.

Processor30may be configured to read into memory32and execute computer-executable instructions residing in non-volatile storage26and embodying one or more ML algorithms and/or methodologies of one or more embodiments. Non-volatile storage26may include one or more operating systems and applications. Non-volatile storage26may store compiled and/or interpreted from computer programs created using a variety of programming languages and/or technologies, including, without limitation, and either alone or in combination, Java, C, C++, C#, Objective C, Fortran, Pascal, Java Script, Python, Perl, and PL/SQL.

Upon execution by processor30, the computer-executable instructions of non-volatile storage26may cause control system12to implement one or more of the ML algorithms and/or methodologies as disclosed herein. Non-volatile storage26may also include ML data (including data parameters) supporting the functions, features, and processes of the one or more embodiments described herein.

The program code embodying the algorithms and/or methodologies described herein is capable of being individually or collectively distributed as a program product in a variety of different forms. The program code may be distributed using a computer readable storage medium having computer readable program instructions thereon for causing a processor to carry out aspects of one or more embodiments. Computer readable storage media, which is inherently non-transitory, may include volatile and non-volatile, and removable and non-removable tangible media implemented in any method or technology for storage of information, such as computer-readable instructions, data structures, program modules, or other data. Computer readable storage media may further include RAM, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other solid state memory technology, portable compact disc read-only memory (CD-ROM), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and which can be read by a computer. Computer readable program instructions may be downloaded to a computer, another type of programmable data processing apparatus, or another device from a computer readable storage medium or to an external computer or external storage device via a network.

Computer readable program instructions stored in a computer readable medium may be used to direct a computer, other types of programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions that implement the functions, acts, and/or operations specified in the flowcharts or diagrams. In certain alternative embodiments, the functions, acts, and/or operations specified in the flowcharts and diagrams may be re-ordered, processed serially, and/or processed concurrently consistent with one or more embodiments. Moreover, any of the flowcharts and/or diagrams may include more or fewer nodes or blocks than those illustrated consistent with one or more embodiments.

The processes, methods, or algorithms can be embodied in whole or in part using suitable hardware components, such as Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), state machines, controllers or other hardware components or devices, or a combination of hardware, software and firmware components.

FIG.2depicts a schematic diagram of control system12configured to control vehicle50, which may be an at least partially autonomous vehicle or an at least partially autonomous robot. As shown inFIG.2, vehicle50includes actuator14and sensor16. Sensor16may include one or more video sensors, radar sensors, ultrasonic sensors, LiDAR sensors, and/or position sensors (e.g. GPS). One or more of the one or more specific sensors may be integrated into vehicle50. Alternatively or in addition to one or more specific sensors identified above, sensor16may include a software module configured to, upon execution, determine a state of actuator14. One non-limiting example of a software module includes a weather information software module configured to determine a present or future state of the weather proximate vehicle50or other location.

Classifier24of control system12of vehicle50may be configured to detect objects in the vicinity of vehicle50dependent on input signals x. In such an embodiment, output signal y may include information characterizing the vicinity of objects to vehicle50. Actuator control command20may be determined in accordance with this information. The actuator control command20may be used to avoid collisions with the detected objects.

In embodiments where vehicle50is an at least partially autonomous vehicle, actuator14may be embodied in a brake, a propulsion system, an engine, a drivetrain, or a steering of vehicle50. Actuator control commands20may be determined such that actuator14is controlled such that vehicle50avoids collisions with detected objects. Detected objects may also be classified according to what classifier24deems them most likely to be, such as pedestrians or trees. The actuator control commands20may be determined depending on the classification.

In other embodiments where vehicle50is an at least partially autonomous robot, vehicle50may be a mobile robot that is configured to carry out one or more functions, such as flying, swimming, diving and stepping. The mobile robot may be an at least partially autonomous lawn mower or an at least partially autonomous cleaning robot. In such embodiments, the actuator control command20may be determined such that a propulsion unit, steering unit and/or brake unit of the mobile robot may be controlled such that the mobile robot may avoid collisions with identified objects.

In another embodiment, vehicle50is an at least partially autonomous robot in the form of a gardening robot. In such embodiment, vehicle50may use an optical sensor as sensor16to determine a state of plants in an environment proximate vehicle50. Actuator14may be a nozzle configured to spray chemicals. Depending on an identified species and/or an identified state of the plants, actuator control command20may be determined to cause actuator14to spray the plants with a suitable quantity of suitable chemicals.

Vehicle50may be an at least partially autonomous robot in the form of a domestic appliance. Non-limiting examples of domestic appliances include a washing machine, a stove, an oven, a microwave, or a dishwasher. In such a vehicle50, sensor16may be an optical sensor configured to detect a state of an object which is to undergo processing by the household appliance. For example, in the case of the domestic appliance being a washing machine, sensor16may detect a state of the laundry inside the washing machine. Actuator control command20may be determined based on the detected state of the laundry.

FIG.3depicts a schematic diagram of control system12configured to control manufacturing machine100, such as a punch cutter, a cutter or a gun drill, of manufacturing system102, such as part of a production line. Control system12may be configured to control actuator14, which is configured to control manufacturing machine100.

Sensor16of manufacturing machine100may be an optical sensor configured to capture one or more properties of manufactured product104. Classifier24may be configured to determine a state of manufactured product104from one or more of the captured properties. Actuator14may be configured to control manufacturing machine100depending on the determined state of manufactured product104for a subsequent manufacturing step of manufactured product104. The actuator14may be configured to control functions of manufacturing machine100on subsequent manufactured product106of manufacturing machine100depending on the determined state of manufactured product104.

FIG.4depicts a schematic diagram of control system12configured to control power tool150, such as a power drill or driver, that has an at least partially autonomous mode. Control system12may be configured to control actuator14, which is configured to control power tool150.

Sensor16of power tool150may be an optical sensor configured to capture one or more properties of work surface152and/or fastener154being driven into work surface152. Classifier24may be configured to determine a state of work surface152and/or fastener154relative to work surface152from one or more of the captured properties. The state may be fastener154being flush with work surface152. The state may alternatively be hardness of work surface154. Actuator14may be configured to control power tool150such that the driving function of power tool150is adjusted depending on the determined state of fastener154relative to work surface152or one or more captured properties of work surface154. For example, actuator14may discontinue the driving function if the state of fastener154is flush relative to work surface152. As another non-limiting example, actuator14may apply additional or less torque depending on the hardness of work surface152.

FIG.5depicts a schematic diagram of control system12configured to control automated personal assistant200. Control system12may be configured to control actuator14, which is configured to control automated personal assistant200. Automated personal assistant200may be configured to control a domestic appliance, such as a washing machine, a stove, an oven, a microwave or a dishwasher.

Sensor16may be an optical sensor and/or an audio sensor. The optical sensor may be configured to receive video images of gestures204of user202. The audio sensor may be configured to receive a voice command of user202.

Control system12of automated personal assistant200may be configured to determine actuator control commands20configured to control system12. Control system12may be configured to determine actuator control commands20in accordance with sensor signals18of sensor16. Automated personal assistant200is configured to transmit sensor signals18to control system12. Classifier24of control system12may be configured to execute a gesture recognition algorithm to identify gesture204made by user202, to determine actuator control commands20, and to transmit the actuator control commands20to actuator14. Classifier24may be configured to retrieve information from non-volatile storage in response to gesture204and to output the retrieved information in a form suitable for reception by user202.

FIG.6depicts a schematic diagram of control system12configured to control monitoring system250. Monitoring system250may be configured to physically control access through door252. Sensor16may be configured to detect a scene that is relevant in deciding whether access is granted. Sensor16may be an optical sensor configured to generate and transmit image and/or video data. Such data may be used by control system12to detect a person's face.

Classifier24of control system12of monitoring system250may be configured to interpret the image and/or video data by matching identities of known people stored in non-volatile storage26, thereby determining an identity of a person. Classifier12may be configured to generate and an actuator control command20in response to the interpretation of the image and/or video data. Control system12is configured to transmit the actuator control command20to actuator12. In this embodiment, actuator12may be configured to lock or unlock door252in response to the actuator control command20. In other embodiments, a non-physical, logical access control is also possible.

Monitoring system250may also be a surveillance system. In such an embodiment, sensor16may be an optical sensor configured to detect a scene that is under surveillance and control system12is configured to control display254. Classifier24is configured to determine a classification of a scene, e.g. whether the scene detected by sensor16is suspicious. Control system12is configured to transmit an actuator control command20to display254in response to the classification. Display254may be configured to adjust the displayed content in response to the actuator control command20. For instance, display254may highlight an object that is deemed suspicious by classifier24.

FIG.7depicts a schematic diagram of control system12configured to control imaging system300, for example an MRI apparatus, x-ray imaging apparatus or ultrasonic apparatus. Sensor16may, for example, be an imaging sensor. Classifier24may be configured to determine a classification of all or part of the sensed image. Classifier24may be configured to determine or select an actuator control command20in response to the classification. For example, classifier24may interpret a region of a sensed image to be potentially anomalous. In this case, actuator control command20may be determined or selected to cause display302to display the imaging and highlighting the potentially anomalous region.

A classifier may be subject to adversarial attacks that may cause drastic changes to the output and behavior of the classifier. Defenses exist against adversarial attacks in supervised classification scenarios and empirical defenses (adversarial training) against adversarial examples. These defenses operate in a class-agnostic fashion.

Under one proposal, to reduce this problem, a robust classifier may be trained where, at the cost of unperturbed performance, the classifier exhibits a degree of robustness to changes on the input. In such a scenario, a loss function may be optimized against a worst-case scenario by optimizing the loss function on the worst possible perturbation (or approximation thereof) applied to each sample. Accordingly, the classifier may be robustly trained by

maxδ∈ΔL⁡(θ,x)
is minimized with respect to θ, X denotes a training set, and δ is a family of allowed perturbations, e.g. Δ={δ: ∥δ∥p≤ϵ}.

The robust training procedure P can approximate the robust loss by finding an adversarial example δ∈Δ and optimizing for x+δ, by upper-bounding the loss in x+δ, for any δ∈Δ, finding an exact value of the robust version of the loss, or any other approximation (lower or upper bound) of it. The resulting robust classifier presents a benefit of an increased degree of robustness with regards to perturbations at test time, across all classes, but at the cost of lower classification performance at test time, across all classes.

This robustness is symmetrical by design. The classifier trades performance across all K classes as Δ is the same for all classes. This poses a significant problem in situations where uneven consequences of misclassification. By increasing robustness to perturbations regarding one class, the classifier is also robust to perturbations across all other classes. In a specific example of failure detection, robustness to perturbations on non-failures can cause the classifier to misclassify failures as non-failures, with potentially drastic consequences. On the other hand, small perturbations on failures are still failures. Hence, the classifier should be robust to perturbations on failures. Accordingly, there is a need for computational methods to asymmetrically provide robustness to classifiers and computer systems to asymmetrically provide robustness to classifiers.

In one or more embodiments, computational methods and computer systems are presented that asymmetrically train robust classifiers, given a classifier f that maps a feature x∈dinto a class y∈{1, . . . , K}, and a set of class dependent sets of allowed perturbations {Δ1, . . . , Δk}. In one or more embodiments, the associated robust loss is extended into a sum of K separate robust losses, each with a separate set of allowed perturbation. Robust training procedures (either empirical or provable) may be applied to the expanded robust loss.

A classifier may be trained from labeled data to create an asymmetrically robust classifier. The classifier may be trained across training data originating across different classes, e.g., first and second different classes. In one or more embodiments, the adversarial examples or worst-case scenario perturbations are class-dependent. Accordingly, different classes may have different sets of allowable perturbations. One or more embodiments have the benefit of addressing classification problems with asymmetrically robust classification systems where misclassification risks and the consequences of these risks are asymmetric, the attacker or acquisition process has class-dependent characteristics, or the classification performance versus robustness trade-off is not class-agnostic (e.g. automated optical inspection, failure identification, mission-critical classification systems, etc.)

FIG.8depicts a schematic diagram of training system350for training classifier24according to one or more embodiments. Training unit352is configured to determine input signals x and to transmit input signals x to classifier24. In one embodiment, training unit352is configured to access non-volatile storage354to obtain a set of training data X={(x1, y1), . . . , (xn, yn)} stored thereon. Non-volatile storage354also stores a loss function L. Non-volatile storage354may also store a set of class-dependent allowed perturbations=Δ1, . . . , ΔK. Furthermore, training system350may include processor356and memory358. Processor356may include one or more processors. Memory358may include one or more memory devices. The ML algorithms of one or more embodiments may be implemented by training system350, which includes non-volatile storage354, processor356and memory358.

Training system350is configured to execute a robust training procedure P to find a solution or approximate solution to learn classifier f parameterized by θ such that a robust loss is minimized with respect to θ. The robust training procedure P may be an asymmetrical robust classifier configured to be trained by training system350by expanding a robust loss function to be class separable. This training results in K different robust loss functions computed over a partition of the training sets across K different classes. The final classifier parameters may be obtained by solving for the sum of the K different loss functions across the partition of the training sets.

FIG.9depicts flow chart400of a computational method for training classifier24according to one embodiment. The computational method may be carried out and implemented using training system350. The computational method for training classifier24may be signified by a robust training procedure P.

In step402, input is received for the training method. In one embodiment, the input includes training data set comprised of pairs of training input signals and corresponding output signals. The training data set may be represented by the following equation:
X={(x1,y1), . . . ,(xn,yn)}  (2)

In this embodiment, the input further includes classifier24, which may be represented by f, parameterized by parameters, which may be signified by θ. Classifier24may be configured to classify input signals obtaining from one or more of the sensors disclosed herein into at least two different classes. In this embodiment, the input may further include a stopping condition S, e.g. a binary stopping condition. The binary stopping condition S may be initialized to a pre-determined starting value, such as FALSE. The input further includes a class-dependent allowed perturbation for each of the at least two different classes that may be represented by the following equation:
=Δ1, . . . ,ΔK(3)
where Δ1is a class-dependent allowed perturbation for a first class and ΔKis a class-dependent allowed perturbation for a Kth class. The class-dependent allowed perturbation may be different for each of the at least two different classes. The input may further include a loss function, which may be signified by L. The loss function L may be configured to optimize the parameters θ of classifier24of an ML algorithm.

In step404, a stopping condition S may be initialized. The stopping condition S may be a binary stopping condition. The stopping condition S may be initialized as FALSE. In certain embodiments, classifier24may be a parallelizable robust training procedure L. In such embodiments, classifier24may be trained using parallel training steps identified in branch406of training system350represented in flow chart400. In other embodiments, classifier24may not be capable of parallelization. In such other embodiment, classifier24may be trained using training steps identified in branch408of training system350represented in flow chart400.

In step410of branch408, the total loss LTotalof the total loss function L is initialized to tend toward 0 (i.e. LTotal←0). In one or more embodiments, steps412and414are iteratively performed within class loop416for i in 1, . . . , K (where i is a label for each of the classes K) when a stopping condition is a certain value or range of values.

In step412, sample subsets are defined to partition the training data set into different subsets with different labels. The training data set may be partitioned into a first subset labelled with a first label corresponding to a first class and a second subset labelled with a second label corresponding to a second class. For each label i for each of the classes K, subset Xi⊏X may be defined such that Xicontains all the samples with label i.

In step414, the total loss LTotalmay be updated in response to the subsets Xi⊏X for each label i. The total loss may be updated to include a robust loss on the ith class according to the respective set of allowed perturbations for the ith class. The updating of the total loss in this manner may be represented by the following equation.

LTotal←LTotal+𝔼x∈Xi[maxδ∈ΔiL⁡(θ,x)](4)
where LTotaldenotes a total loss, Xiis a training set for the ith class, and Ai is an allowed perturbation for the ith class.

In step418, the stopping condition S is updated in response to the updated total loss. The stopping condition S may be updated using stopping rules to determine when to stop training classifier24. The stopping condition S is updated to FALSE in response to the number of stopping rules determining a continuation of training of classifier24. The stopping condition S is updated to TRUE in response to the number of stopping rules determining a discontinuation of training of classifier24. As shown by loop416, branch408continues to execute steps412and414while the stopping condition S is FALSE. As shown by arrow420, branch408discontinues execution of steps412and414once step418sets the stopping condition S to TRUE.

In step422, the classifier parameters are updated by applying the training method (e.g. robust training procedure P) to an optimization problem. In one embodiment, the optimization problem may be represented by the following equation.

As stated above, classifier24may be trained using parallel training steps identified in branch406when classifier24is capable of being parallelizable. In one or more embodiments, steps424and426are iteratively performed within class loop428for i in 1, . . . , K (where i is a label for each of the classes K) when a stopping condition is a certain value or range of values.

In step424, sample subsets are defined to partition the training data set into different subsets with different labels. The training data set may be partitioned into a first subset labelled with a first label corresponding to a first class and a second subset labelled with a second label corresponding to a second class. For each label i for each of the classes K, subset Xi⊏X may be defined such that Xicontains all the samples with label i.

In step426, the classifier parameters are updated in parallel by applying the training method (e.g. robust training procedure P) to an optimization problem. In one embodiment, the optimization problem may be represented by the following equation.

In step430, the stopping condition S is updated in response to the updated classifier parameters determined in step422. The stopping condition S may be updated using stopping rules to determine when to stop training classifier24. The stopping condition S is updated to FALSE in response to the number of stopping rules determining a continuation of training of classifier26. The stopping condition S is updated to TRUE in response to the number of stopping rules determining a discontinuation of training of classifier24. As shown by loop428, branch406continues to execute steps424and426while the stopping condition S is FALSE. As shown by arrow432, branch406discontinues execution of steps424and426once step430sets the stopping condition S to TRUE.

In one embodiment, the set of allowed perturbations Δ may be described from a perceptual point of view. The perturbations Δ may equal {δ: D(x)=D(x+δ)}, where D is a discriminator configured to identify whether the input signals x is unperturbed (0) or perturbed (1), thereby making perturbations Δ a set on which the discriminator D is unable to distinguish perturbed data from unperturbed data. The discriminator D may be automatic or manual.

In other embodiments, the asymmetrical robustness of the training process may be applied to a generative model instead of a classifier, where the generative model variability of robustness to changes on input is associated to the existence of class labels to the input. In certain embodiments, the generative model may be a conditional generative model.