Patent ID: 12205349

DETAILED DESCRIPTION

Embodiments of the present disclosure are described herein. It is to be understood, however, that the disclosed embodiments are merely examples and other embodiments can take various and alternative forms. The figures are not necessarily to scale; some features could be exaggerated or minimized to show details of particular components. Therefore, specific structural and functional details disclosed herein are not to be interpreted as limiting, but merely as a representative basis for teaching one skilled in the art to variously employ the embodiments. As those of ordinary skill in the art will understand, various features illustrated and described with reference to any one of the figures can be combined with features illustrated in one or more other figures to produce embodiments that are not explicitly illustrated or described. The combinations of features illustrated provide representative embodiments for typical applications. Various combinations and modifications of the features consistent with the teachings of this disclosure, however, could be desired for particular applications or implementations.

This disclosure relates to a method for robustifying a pretrained neural network classification system with an abstain (rejection) option with provable robust (worst-case/adversarial) performance. The typical setup for an adversarial attack on a classifier, which we call f, may be as follows: given an input x with true label y that is correctly classified by f (meaning, (x)=y), the attacker may aim to find a small (ideally human-imperceptible) perturbation δ such that x+δ is incorrectly classified by C (that is, f (x+δ)≠y)). Robustness may be claimed when there can be no such perturbations that change the classification outcome, in other words, all perturbed inputs within the “admissible perturbations set” give the original outcome as that of the clean (unperturbed) input.

A number of works (without rejection/abstain/detection) have proposed training procedures under which the resulting robustified classifier has provable performance, i.e. an upper bound on the error rate (misclassification probability) for adversarially perturbed images subject to norm constraint on the perturbation. When randomization is used to provide robustness may provide: (1) a clean input image is perturbed and classified for different realization of a Gaussian noise, (1) the probability of the majority class and the runner up class are estimated, and (3) provable guarantees for robustness is computed. Such networks need to be trained with such Gaussian-perturbation augmentations for non-trivial performance.

In addition it is of interest to robustify a pretrained network against adversarial perturbations. One embodiment may propose to do this by leveraging the randomization idea together with adding a denoiser module to the system.

Finally, in practice it is of interest to detect adversarially perturbed examples. However, all the available detection methods in the literature lack provable performance, and have been shown to fail detection if the attacker devises carefully crafted “adaptive perturbations” to simultaneously evade detection and cause misclassification.

Some embodiments propose training a classifier with an extra class, i.e., K+1 classes for a K-class classification task, where the extra class is referred to as the “abstain-class”. By classifying an image in this class, the classifier is in fact abstaining from declaring the input as any of the other K-classes, and thus can be thought of as abstaining (or detecting or rejecting) the adversarial input. This work however has no provable performance guarantees, and its training process is different than the one proposed in this invention.

The disclosure formulates a provable robust training procedure for robustifying pretrained neural networks against adversarial attacks. The proposed system may be comprised of (1) the pretrained-classifier, (2) the pretrained denoiser (image to image convertor), and (3) the proposed module: a per-class rejector.

The system and method may utilize an approach to leverage a rejection class together with denoised smoothing to keep its desirable properties (namely, being able to produce robust versions of pretrained classifiers), while improving the accuracy, especially clean accuracy, of the resulting system.

The system may robustify pretrained classifiers with sample rejection while providing certifiable accuracy. One key to such an approach is to use a reject class, realized through cheaply-trainable per-class rejectors, which are trained to reject noisy samples whose prediction is inconsistent with the prediction of the clean sample. Inevitably this can also lead to a small number of correctly classified samples to also get rejected, however, the overall certification radius with a pretrained denoiser is improved since: (a) the reject class is used to provide a lower (and tighter) upper bound on the wrong class probabilities, and subsequently (b) the lowered probability of the runner-up class leads to higher certification radius due to its non-linear dependence via the inverse Gaussian CDF function.

To this end, the full system for every perturbation can be viewed as a classifier augmented with a denoiser and detector/rejector modules: resulting in a (K+1)-class classifier for an originally (K)-class classification task.

(1) The image will be perturbed N number of times, and every perturbation will be classified into one of these (K+1) classes, where the additional class is referred to as abstain/detection/rejection-class.

(2) The final classification outcome is any of the K (original, thus excluding the rejection class) classes, which has the majority vote.

(3) Probability of the runner up class as well as the rejection class is estimated, and the utilization of these joint quantities leads to improved performance and higher certification radius compared to state of the art.

(4) Imperative to the proposed method is to train the proposed rejector module to discriminate (classify) correctly-classified vs. misclassified randomly perturbed images.

The embodiments disclosed enable detection of adversarial inputs by classifying them in the rejection class. Furthermore, it provides provable guarantees on the performance of the classifier by giving a certificate that all possible perturbations within a family of perturbations will be correctly-classified, thus guaranteeing unsuccessful attack by the adversary. This provides additional boost in performance guarantee achieved by other techniques without the detection capability.

Another important aspect of his work is the ability to robustify pre-trained off-the-shelf classifiers and denoisers. This is of high importance when changing the weight of the classifier and/or detector is infeasible due to cost/privacy/etc.

This can also be used in detecting adversarial environments, and thus used for demanding manual control for safety-critical tasks by interpreting the detection of adversaries as unsafe/adversarial environment.

Also, abstaining from classification is sometimes interpreted as the classifier declaring its lack of certainty in the outcome of the classification task, and thus can be used for declaring high uncertainty.

In one embodiment, the system may allow for randomized smoothing. For example, consider a classification problem from Rdto classes Y:={1,2, . . . , K}. According to the randomized smoothing method, one can construct a “smoothed” classifier g from an arbitrary base classifier f by defining

g⁡(x)=c⁢ϵ⁢YmaxP(f⁡(x+ϵ)=c)⁢where⁢ϵ∼N⁡(0,σ2⁢I).

That is, the smoothed classifier g returns the class that the base classifier f is most likely to return around the neighborhood of x, where the density of samples in the neighborhood is represented as Gaussian Noise ϵ˜N(0, σ2I)

One advantage of the randomized-smoothing method is its inherent capability in providing certifiable robustness against bounded2—norm worst-case perturbations. Formally, for any deterministic or random function f:Rd→Y:={1,2, . . . , K},suppose cA, cBϵY and πA, πBϵ[0,1] satisfy:

P⁡(f⁡(x+ϵ)=cA)≥πA≥πB≥\c≠qcAmaxP⁢(f⁡(x+ϵ)=c)

In one example, a tight verification bound may be utilized as follows: g(x+δ)=cAfor all ∥δ∥≤R, where

R=σ2⁢(Φ-1(πA)-Φ-1(πB))
and Φ−1(.) is the inverse of the standard Gaussian CDF.

Since computing exact values of πA=P(f(x+ϵ)=cA) and πB=P(f(x+ϵ)=cB) is not practical, Monte Carlo sampling is used to estimate the class with the highest probability with arbitrarily high confidence, followed by approximating πB=1−πAyielding
R=σΦ−1(πA)

Practically, although the above results hold for any function f, one needs to train the base classifier f against Gaussian perturbations for effective certification, as using standard classifiers usually lead to trivial certification bounds because they are not robust against Gaussian noise. Increasing confidence of the certification can be achieved by running a larger number of samples in the Monte Carlo estimation, which then leads to an increase in inference time. Furthermore, although the above results hold for any function f one needs to train the base classifier f against Gaussian perturbations for effective certification, as using standard classifiers usually lead to trivial certification bounds because they are not robust against Gaussian noise.

FIG.1shows a system100for training a neural network. The system100may comprise an input interface for accessing training data192for the neural network. For example, as illustrated inFIG.1, the input interface may be constituted by a data storage interface180which may access the training data192from a data storage190. For example, the data storage interface180may be a memory interface or a persistent storage interface, e.g., a hard disk or an SSD interface, but also a personal, local or wide area network interface such as a Bluetooth, Zigbee or Wi-Fi interface or an ethernet or fiberoptic interface. The data storage190may be an internal data storage of the system100, such as a hard drive or SSD, but also an external data storage, e.g., a network-accessible data storage.

In some embodiments, the data storage190may further comprise a data representation194of an untrained version of the neural network which may be accessed by the system100from the data storage190. It will be appreciated, however, that the training data192and the data representation194of the untrained neural network may also each be accessed from a different data storage, e.g., via a different subsystem of the data storage interface180. Each subsystem may be of a type as is described above for the data storage interface180. In other embodiments, the data representation194of the untrained neural network may be internally generated by the system100on the basis of design parameters for the neural network, and therefore may not explicitly be stored on the data storage190. The system100may further comprise a processor subsystem160which may be configured to, during operation of the system100, provide an iterative function as a substitute for a stack of layers of the neural network to be trained. Here, respective layers of the stack of layers being substituted may have mutually shared weights and may receive, as input, an output of a previous layer, or for a first layer of the stack of layers, an initial activation, and a part of the input of the stack of layers. The processor subsystem160may be further configured to iteratively train the neural network using the training data192. Here, an iteration of the training by the processor subsystem160may comprise a forward propagation part and a backward propagation part. The processor subsystem160may be configured to perform the forward propagation part by, amongst other operations defining the forward propagation part which may be performed, determining an equilibrium point of the iterative function at which the iterative function converges to a fixed point, wherein determining the equilibrium point comprises using a numerical root-finding algorithm to find a root solution for the iterative function minus its input, and by providing the equilibrium point as a substitute for an output of the stack of layers in the neural network. The system100may further comprise an output interface for outputting a data representation196of the trained neural network, this data may also be referred to as trained model data196. For example, as also illustrated inFIG.1, the output interface may be constituted by the data storage interface180, with said interface being in these embodiments an input/output (“IO”) interface, via which the trained model data196may be stored in the data storage190. For example, the data representation194defining the ‘untrained’ neural network may during or after the training be replaced, at least in part by the data representation196of the trained neural network, in that the parameters of the neural network, such as weights, hyperparameters and other types of parameters of neural networks, may be adapted to reflect the training on the training data192. This is also illustrated inFIG.1by the reference numerals194,196referring to the same data record on the data storage190. In other embodiments, the data representation196may be stored separately from the data representation194defining the ‘untrained’ neural network. In some embodiments, the output interface may be separate from the data storage interface180, but may in general be of a type as described above for the data storage interface180.

FIG.2depicts a data annotation system200to implement a system for annotating data. The data annotation system200may include at least one computing system202. The computing system202may include at least one processor204that is operatively connected to a memory unit208. The processor204may include one or more integrated circuits that implement the functionality of a central processing unit (CPU)206. The CPU206may be a commercially available processing unit that implements an instruction stet such as one of the x86, ARM, Power, or MIPS instruction set families. During operation, the CPU206may execute stored program instructions that are retrieved from the memory unit208. The stored program instructions may include software that controls operation of the CPU206to perform the operation described herein. In some examples, the processor204may be a system on a chip (SoC) that integrates functionality of the CPU206, the memory unit208, a network interface, and input/output interfaces into a single integrated device. The computing system202may implement an operating system for managing various aspects of the operation.

The memory unit208may include volatile memory and non-volatile memory for storing instructions and data. The non-volatile memory may include solid-state memories, such as NAND flash memory, magnetic and optical storage media, or any other suitable data storage device that retains data when the computing system202is deactivated or loses electrical power. The volatile memory may include static and dynamic random-access memory (RAM) that stores program instructions and data. For example, the memory unit208may store a machine-learning model210or algorithm, a training dataset212for the machine-learning model210, raw source dataset215.

The computing system202may include a network interface device222that is configured to provide communication with external systems and devices. For example, the network interface device222may include a wired and/or wireless Ethernet interface as defined by Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards. The network interface device222may include a cellular communication interface for communicating with a cellular network (e.g., 3G, 4G, 5G). The network interface device222may be further configured to provide a communication interface to an external network224or cloud.

The external network224may be referred to as the world-wide web or the Internet. The external network224may establish a standard communication protocol between computing devices. The external network224may allow information and data to be easily exchanged between computing devices and networks. One or more servers330may be in communication with the external network224.

The computing system202may include an input/output (I/O) interface220that may be configured to provide digital and/or analog inputs and outputs. The I/O interface220may include additional serial interfaces for communicating with external devices (e.g., Universal Serial Bus (USB) interface).

The computing system202may include a human-machine interface (HMI) device218that may include any device that enables the system200to receive control input. Examples of input devices may include human interface inputs such as keyboards, mice, touchscreens, voice input devices, and other similar devices. The computing system202may include a display device232. The computing system202may include hardware and software for outputting graphics and text information to the display device232. The display device232may include an electronic display screen, projector, printer or other suitable device for displaying information to a user or operator. The computing system202may be further configured to allow interaction with remote HMI and remote display devices via the network interface device222.

The system200may be implemented using one or multiple computing systems. While the example depicts a single computing system202that implements all of the described features, it is intended that various features and functions may be separated and implemented by multiple computing units in communication with one another. The particular system architecture selected may depend on a variety of factors.

The system200may implement a machine-learning algorithm210that is configured to analyze the raw source dataset215. The raw source dataset215may include raw or unprocessed sensor data that may be representative of an input dataset for a machine-learning system. The raw source dataset215may include video, video segments, images, text-based information, and raw or partially processed sensor data (e.g., radar map of objects). In some examples, the machine-learning algorithm210may be a neural network algorithm that is designed to perform a predetermined function. For example, the neural network algorithm may be configured in automotive applications to identify pedestrians in video images.

The computer system200may store a training dataset212for the machine-learning algorithm210. The training dataset212may represent a set of previously constructed data for training the machine-learning algorithm210. The training dataset212may be used by the machine-learning algorithm210to learn weighting factors associated with a neural network algorithm. The training dataset212may include a set of source data that has corresponding outcomes or results that the machine-learning algorithm210tries to duplicate via the learning process. In this example, the training dataset212may include source videos with and without pedestrians and corresponding presence and location information. The source videos may include various scenarios in which pedestrians are identified.

The machine-learning algorithm210may be operated in a learning mode using the training dataset212as input. The machine-learning algorithm210may be executed over a number of iterations using the data from the training dataset212. With each iteration, the machine-learning algorithm210may update internal weighting factors based on the achieved results. For example, the machine-learning algorithm210can compare output results (e.g., annotations) with those included in the training dataset212. Since the training dataset212includes the expected results, the machine-learning algorithm210can determine when performance is acceptable. After the machine-learning algorithm210achieves a predetermined performance level (e.g., 100% agreement with the outcomes associated with the training dataset212), the machine-learning algorithm210may be executed using data that is not in the training dataset212. The trained machine-learning algorithm210may be applied to new datasets to generate annotated data.

The machine-learning algorithm210may be configured to identify a particular feature in the raw source data215. The raw source data215may include a plurality of instances or input dataset for which annotation results are desired. For example, the machine-learning algorithm210may be configured to identify the presence of a pedestrian in video images and annotate the occurrences. The machine-learning algorithm210may be programmed to process the raw source data215to identify the presence of the particular features. The machine-learning algorithm210may be configured to identify a feature in the raw source data215as a predetermined feature (e.g., pedestrian). The raw source data215may be derived from a variety of sources. For example, the raw source data215may be actual input data collected by a machine-learning system. The raw source data215may be machine generated for testing the system. As an example, the raw source data215may include raw video images from a camera.

In the example, the machine-learning algorithm210may process raw source data215and output an indication of a representation of an image. The output may also include augmented representation of the image. A machine-learning algorithm210may generate a confidence level or factor for each output generated. For example, a confidence value that exceeds a predetermined high-confidence threshold may indicate that the machine-learning algorithm210is confident that the identified feature corresponds to the particular feature. A confidence value that is less than a low-confidence threshold may indicate that the machine-learning algorithm210has some uncertainty that the particular feature is present.

FIG.3illustrates an embodiment of a flowchart as related to robustifying pretrained classifiers. At step301, the input (e.g. image or similar data) x may be received at a processor, computer, server, etc. At step302, the input may be perturbed by noise E. At step303, the perturbed data may pass through the preprocessing (e.g., denoising) step via D(x+). The denoiser may be a pre-trained denoiser. At step305, the resulting denoised data may go through the base classifier with a reject class. The base classifier may include both a pre-trained classifier (e.g., K-class classifier) and a rejector. The rejector may be trained to successfully discriminate between the correctly classified and mis-classified denoised inputs that are assigned to class k by the base classifier f(.). At step307, the classification output of the smoothed joint system of (D, f, {hk}k=1L) may be claimed as the most likely class over the noise distribution (or it empirical realization via N i.i.d. samples). The schematic of such a system is shown inFIG.4below, and he overall system may be defined as

S={D,f,{hk}⁢Kk=1}.

In such an embodiment, the pretrained K-class classifier and pretrained denoiser are augmented with a per-class rejector- that is a binary detector for each of the original K classes. We aim to improve certification accuracy of pretrained classifiers by incorporating an explicit ‘reject’ class into the base classifier, while preserving the certifiability against worst-case perturbations with bounded 12-norm.

The proposed classification procedure for the full system containing classifier f, denoiser D, rejectors {h1, . . . ,kK} the image x will go through the following steps: (a) it is first perturbed by noise ϵ drawn from Gaussian noise with variance σ2. (b) noisy image passes through the image preprocessing (denoising) step via D(x+ϵ) (c) the resulting denoised image goes through fR(D(x+ϵ)) denoting the base-classifier-with-rejection defined as

fR⁡(z)={ckif⁢f⁢(x+ϵ)=ck⁢and⁢hk⁢(x+ϵ)=0Rif⁢f⁢(x+ϵ)=ck⁢and⁢hk⁢(x+ϵ)=1
(d) finally, the classification output of the smoothed joint system is claimed as the most likely class over the noise distribution (or it empirical realization via N i.i.d. samples, that is: repeat steps a-c for a total of N times with different noise realizations and take the majority class).

The schematic depicts a visual placement of the components in the overall system denoted as S={f,D,h1, . . . , hK}.

Algorithm 1,2,3 provide the pseudocode for the prediction and certification of the overall system, where function LowerConfBound(S,n, 1−a) returns a one-sided 1−a lower confidence interval for the Binomial parameter q given a sample s˜Binomial(n,q).

Algorithm 1 Sampling under noise for the overall systemS={D,f,{hk}k=1K}function SAMPLEUNDERNOISE (S, x, n, σ)Initialize count= [O, . . . , O]K+1x1for v = 1, . . . , n dosample noise ϵv∈ N (0, σ2I)k ← f (D (x + ϵv))if hk(D(x + ϵv)) = 0 then++ counts [k]else++ counts [R]end ifend forreturn count

Algorithm 1 Certification and prediction# predict for x; using gRfunction PREDICT (S = {D, f, {hk}k=1K}, σ, x, N)counts ← SAMPLEUNDERNOISE (S, σ, x, N)←top two indices in countsnA, nB← counts, countsIf BINOMPVALUE (nA,nA+ nB, 0.5) ≤ α thenreturn,elsereturn ABSTAINend if# certify the robustness of gRaround xfunction⁢CERTIFY(S={D,f⁢{hk}k=1K},σ,x,N,α)counts ← SAMPLEUNDERNOISE (S, σ, x, N)← top index in counts OnA, nB← counts, counts [R]pA← LOWERCONFBOUND (nA, N, 1 − α)pR← LOWERCONFBOUND (nR, N, 1 − α)pA+R←LOWERCONFBOUND (nA+ nR, N, 1 − α)if⁢pA>11⁢(1-pR)⁢thenreturnR^=σ2⁢(Φ-1(pA)+Φ-1(pA+R))elsereturn ABSTAINend if

To train the rejectors, the parameters of the rejector networks {h1, . . . hK} are learned by training them to discriminate the correctly classified vs misclassified noisy samples. That is, concretely define the classification loss for rejector hkas
Lϕk=cross-entropy(Hk(D(xi+ϵ)),bi)
where Hkis the softmax outputs of rejector k, and the target label bifor image xiis defined as

bi={1⁢if⁢f⁡(D⁡(xi+ϵ))≠f⁡(xi)0otherwise

That is, target label bi=0 if the classifier f has classified denoised input to the same class as that of the noise-free image, and 1 otherwise, thus rejecting the noisy images whose classification outcome has changed.

The total loss aggregated over the entire set of data with all possible K classes, yields

L∅=Exi,ϵ[∑k=1KL∅k×1{f⁢{xi}=k}]
where the parameter set ϕ={ϕ1, . . . , ϕK} captures the set of parameters of all the K rejectors.

In order to make the training more affordable, we propose to tie the K rejectors through a shared backbone hBBparameterized by ϕBBand define each hkby adding a fully-connected layer parameterized by ωkto the features extracted via the backbone network.

FIG.4illustrates an embodiment of a diagram according to an embodiment. The system may receive an input401. The input401may include data from one or more sensors, such as video data, radar, LiDAR, ultrasonic, motion, thermal imaging cameras, etc. Noise403may be added to the input to help in the robustification process of the pretrained neural network against adversarial attacks. The system may then use a pretrained denoiser405. The pretrained denoiser405may be an image to image convertor and thus utilizing image preprocessing to create a denoised image or denoised image set. In order to construct robust classifiers without altering the underlying weights of a given network f, a system may utilize an image denoisier405as a pre-processing step before passing inputs through f, where the denoiser405aims at removing the Gaussian noise added to the input in randomized smoothing. Concretely, this is done by augmenting the classifier f with a custom-trained denoiser Dθ:Rd→Rd, rendering the entire system as the composite function f∘Dθ:Rd→Y. The image or input401may be perturbed N number of times, and every perturbation may be classified into one of the (K+1) classes. The additional class may be referred to as an abstain/detection/rejection-class.

The K-class classifier409(which may be pretrained) and denoiser405may be augmented with a per-class rejector410. The rejector410may be a binary detector for each of the original K classes. The system may work to train the rejector410utilizing each of the iterations of the data that has noise added and that is pre-processed via the denoiser. The system may aim to improve certification accuracy of pretrained classifiers by incorporating an explicit ‘reject’ class into the base classifier, while preserving the certifiability against worst-case perturbations with bounded 12-norm. The rejector module411may be utilized to train the proposed rejector module to discriminate (classify) correctly-classified vs. misclassified randomly perturbed images. The rejector selector module411may work with both the pre-trained classifier409and the

In order to make the training more affordable, the system may tie the K rejectors through a shared backbone410. The system may thus reject to classify the inputs which are likely to be mis-classified. The rejector or rejectors410may be utilized in blocking such inputs. The rejector selector module will either output a class k412or a rejection413associated with the input. The various iterations of the input data that is added different iterations of noise (e.g. perturbed) and preprocessed may be used n times.

At415, the system and classifier may work to certify and predict both a final class417and abstain classification416. The system may sample the various counts of the perturbed data that is denoised. It may then determine the appropriate bound to certify the robustness of the input. To the extent that the input is not certified, it may be returned as a misclassification or an abstain class.

Thus, the system may aim to improve certification accuracy of pretrained classifiers by incorporating an explicit ‘reject’ class into the base classifier, while preserving the certifiability against worst-case perturbations with bounded l2-norm. To this end, let h: Rd→{0, 1} may denote a general function with binary outputs, which effectively ‘flags’ the input x if h(x)=1, thus assigning it to the reject class; while h(x)=0 indicates allowing the input to pass and thus not rejecting it. Thus, the system and algorithm may effectively train and operate such a ‘rejector’ in conjunction with pretrained denoised smoothing in order to improve the robust performance of a pretrained classifier.

FIG.5depicts a schematic diagram of an interaction between computer-controlled machine500and control system502. Computer-controlled machine500includes actuator504and sensor506. Actuator504may include one or more actuators and sensor506may include one or more sensors. Sensor506is configured to sense a condition of computer-controlled machine500. Sensor506may be configured to encode the sensed condition into sensor signals508and to transmit sensor signals508to control system502. Non-limiting examples of sensor506include video, radar, LiDAR, ultrasonic and motion sensors. In one embodiment, sensor506is an optical sensor configured to sense optical images of an environment proximate to computer-controlled machine500.

Control system502is configured to receive sensor signals508from computer-controlled machine500. As set forth below, control system502may be further configured to compute actuator control commands510depending on the sensor signals and to transmit actuator control commands510to actuator504of computer-controlled machine500.

As shown inFIG.5, control system502includes receiving unit512. Receiving unit512may be configured to receive sensor signals508from sensor506and to transform sensor signals508into input signals x. In an alternative embodiment, sensor signals508are received directly as input signals x without receiving unit512. Each input signal x may be a portion of each sensor signal508. Receiving unit512may be configured to process each sensor signal508to product each input signal x. Input signal x may include data corresponding to an image recorded by sensor506.

Control system502includes classifier514. Classifier514may be configured to classify input signals x into one or more labels using a machine learning (ML) algorithm, such as a neural network described above. Classifier514is configured to be parametrized by parameters, such as those described above (e.g., parameter θ). Parameters θ may be stored in and provided by non-volatile storage516. Classifier514is configured to determine output signals y from input signals x. Each output signal y includes information that assigns one or more labels to each input signal x. Classifier514may transmit output signals y to conversion unit518. Conversion unit518is configured to covert output signals y into actuator control commands510. Control system502is configured to transmit actuator control commands510to actuator504, which is configured to actuate computer-controlled machine500in response to actuator control commands510. In another embodiment, actuator504is configured to actuate computer-controlled machine500based directly on output signals y.

Upon receipt of actuator control commands510by actuator504, actuator504is configured to execute an action corresponding to the related actuator control command510. Actuator504may include a control logic configured to transform actuator control commands510into a second actuator control command, which is utilized to control actuator504. In one or more embodiments, actuator control commands510may be utilized to control a display instead of or in addition to an actuator.

In another embodiment, control system502includes sensor506instead of or in addition to computer-controlled machine500including sensor506. Control system502may also include actuator504instead of or in addition to computer-controlled machine500including actuator504.

As shown inFIG.5, control system502also includes processor520and memory522. Processor520may include one or more processors. Memory522may include one or more memory devices. The classifier514(e.g., ML algorithms) of one or more embodiments may be implemented by control system502, which includes non-volatile storage516, processor520and memory522.

Non-volatile storage516may include one or more persistent data storage devices such as a hard drive, optical drive, tape drive, non-volatile solid-state device, cloud storage or any other device capable of persistently storing information. Processor520may include one or more devices selected from high-performance computing (HPC) systems including high-performance cores, microprocessors, micro-controllers, digital signal processors, microcomputers, central processing units, field programmable gate arrays, programmable logic devices, state machines, logic circuits, analog circuits, digital circuits, or any other devices that manipulate signals (analog or digital) based on computer-executable instructions residing in memory522. Memory522may include a single memory device or a number of memory devices including, but not limited to, random access memory (RAM), volatile memory, non-volatile memory, static random access memory (SRAM), dynamic random access memory (DRAM), flash memory, cache memory, or any other device capable of storing information.

Processor520may be configured to read into memory522and execute computer-executable instructions residing in non-volatile storage516and embodying one or more ML algorithms and/or methodologies of one or more embodiments. Non-volatile storage516may include one or more operating systems and applications. Non-volatile storage516may store compiled and/or interpreted from computer programs created using a variety of programming languages and/or technologies, including, without limitation, and either alone or in combination, Java, C, C++, C#, Objective C, Fortran, Pascal, Java Script, Python, Perl, and PL/SQL.

Upon execution by processor520, the computer-executable instructions of non-volatile storage516may cause control system502to implement one or more of the ML algorithms and/or methodologies as disclosed herein. Non-volatile storage516may also include ML data (including data parameters) supporting the functions, features, and processes of the one or more embodiments described herein.

The program code embodying the algorithms and/or methodologies described herein is capable of being individually or collectively distributed as a program product in a variety of different forms. The program code may be distributed using a computer readable storage medium having computer readable program instructions thereon for causing a processor to carry out aspects of one or more embodiments. Computer readable storage media, which is inherently non-transitory, may include volatile and non-volatile, and removable and non-removable tangible media implemented in any method or technology for storage of information, such as computer-readable instructions, data structures, program modules, or other data. Computer readable storage media may further include RAM, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other solid state memory technology, portable compact disc read-only memory (CD-ROM), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and which can be read by a computer. Computer readable program instructions may be downloaded to a computer, another type of programmable data processing apparatus, or another device from a computer readable storage medium or to an external computer or external storage device via a network.

Computer readable program instructions stored in a computer readable medium may be used to direct a computer, other types of programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions that implement the functions, acts, and/or operations specified in the flowcharts or diagrams. In certain alternative embodiments, the functions, acts, and/or operations specified in the flowcharts and diagrams may be re-ordered, processed serially, and/or processed concurrently consistent with one or more embodiments. Moreover, any of the flowcharts and/or diagrams may include more or fewer nodes or blocks than those illustrated consistent with one or more embodiments.

The processes, methods, or algorithms can be embodied in whole or in part using suitable hardware components, such as Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), state machines, controllers or other hardware components or devices, or a combination of hardware, software and firmware components.

FIG.6depicts a schematic diagram of control system502configured to control vehicle600, which may be an at least partially autonomous vehicle or an at least partially autonomous robot. Vehicle600includes actuator504and sensor506. Sensor506may include one or more video sensors, cameras, radar sensors, ultrasonic sensors, LiDAR sensors, and/or position sensors (e.g. GPS). One or more of the one or more specific sensors may be integrated into vehicle600. Alternatively or in addition to one or more specific sensors identified above, sensor506may include a software module configured to, upon execution, determine a state of actuator504. One non-limiting example of a software module includes a weather information software module configured to determine a present or future state of the weather proximate vehicle600or other location.

Classifier514of control system502of vehicle600may be configured to detect objects in the vicinity of vehicle600dependent on input signals x. In such an embodiment, output signal y may include information characterizing the vicinity of objects to vehicle600. Actuator control command510may be determined in accordance with this information. The actuator control command510may be used to avoid collisions with the detected objects.

In embodiments where vehicle600is an at least partially autonomous vehicle, actuator504may be embodied in a brake, a propulsion system, an engine, a drivetrain, or a steering of vehicle600. Actuator control commands510may be determined such that actuator504is controlled such that vehicle600avoids collisions with detected objects. Detected objects may also be classified according to what classifier514deems them most likely to be, such as pedestrians or trees. The actuator control commands510may be determined depending on the classification. In a scenario where an adversarial attack may occur, the system described above may be further trained to better detect objects or identify a change in lighting conditions or an angle for a sensor or camera on vehicle600.

In other embodiments where vehicle600is an at least partially autonomous robot, vehicle600may be a mobile robot that is configured to carry out one or more functions, such as flying, swimming, diving and stepping. The mobile robot may be an at least partially autonomous lawn mower or an at least partially autonomous cleaning robot. In such embodiments, the actuator control command510may be determined such that a propulsion unit, steering unit and/or brake unit of the mobile robot may be controlled such that the mobile robot may avoid collisions with identified objects.

In another embodiment, vehicle600is an at least partially autonomous robot in the form of a gardening robot. In such embodiment, vehicle600may use an optical sensor as sensor506to determine a state of plants in an environment proximate vehicle600. Actuator504may be a nozzle configured to spray chemicals. Depending on an identified species and/or an identified state of the plants, actuator control command510may be determined to cause actuator504to spray the plants with a suitable quantity of suitable chemicals.

Vehicle600may be an at least partially autonomous robot in the form of a domestic appliance. Non-limiting examples of domestic appliances include a washing machine, a stove, an oven, a microwave, or a dishwasher. In such a vehicle600, sensor506may be an optical sensor configured to detect a state of an object which is to undergo processing by the household appliance. For example, in the case of the domestic appliance being a washing machine, sensor506may detect a state of the laundry inside the washing machine. Actuator control command510may be determined based on the detected state of the laundry.

FIG.7depicts a schematic diagram of control system502configured to control system700(e.g., manufacturing machine), such as a punch cutter, a cutter or a gun drill, of manufacturing system702, such as part of a production line. Control system502may be configured to control actuator504, which is configured to control system700(e.g., manufacturing machine).

Sensor506of system700(e.g., manufacturing machine) may be an optical sensor configured to capture one or more properties of manufactured product704. Classifier514may be configured to determine a state of manufactured product704from one or more of the captured properties. Actuator504may be configured to control system700(e.g., manufacturing machine) depending on the determined state of manufactured product704for a subsequent manufacturing step of manufactured product704. The actuator504may be configured to control functions of system700(e.g., manufacturing machine) on subsequent manufactured product106of system700(e.g., manufacturing machine) depending on the determined state of manufactured product704.

FIG.8depicts a schematic diagram of control system502configured to control power tool800, such as a power drill or driver, that has an at least partially autonomous mode. Control system502may be configured to control actuator504, which is configured to control power tool800.

Sensor506of power tool800may be an optical sensor configured to capture one or more properties of work surface802and/or fastener804being driven into work surface802. Classifier514may be configured to determine a state of work surface802and/or fastener804relative to work surface802from one or more of the captured properties. The state may be fastener804being flush with work surface802. The state may alternatively be hardness of work surface802. Actuator504may be configured to control power tool800such that the driving function of power tool800is adjusted depending on the determined state of fastener804relative to work surface802or one or more captured properties of work surface802. For example, actuator504may discontinue the driving function if the state of fastener804is flush relative to work surface802. As another non-limiting example, actuator504may apply additional or less torque depending on the hardness of work surface802.

FIG.9depicts a schematic diagram of control system502configured to control automated personal assistant900. Control system502may be configured to control actuator504, which is configured to control automated personal assistant900. Automated personal assistant900may be configured to control a domestic appliance, such as a washing machine, a stove, an oven, a microwave or a dishwasher.

Sensor506may be an optical sensor and/or an audio sensor. The optical sensor may be configured to receive video images of gestures904of user902. The audio sensor may be configured to receive a voice command of user902.

Control system502of automated personal assistant900may be configured to determine actuator control commands510configured to control system502. Control system502may be configured to determine actuator control commands510in accordance with sensor signals508of sensor506. Automated personal assistant900is configured to transmit sensor signals508to control system502. Classifier514of control system502may be configured to execute a gesture recognition algorithm to identify gesture904made by user902, to determine actuator control commands510, and to transmit the actuator control commands510to actuator504. Classifier514may be configured to retrieve information from non-volatile storage in response to gesture904and to output the retrieved information in a form suitable for reception by user902.

FIG.10depicts a schematic diagram of control system502configured to control monitoring system1000. Monitoring system1000may be configured to physically control access through door1002. Sensor506may be configured to detect a scene that is relevant in deciding whether access is granted. Sensor506may be an optical sensor configured to generate and transmit image and/or video data. Such data may be used by control system502to detect a person's face.

Classifier514of control system502of monitoring system1000may be configured to interpret the image and/or video data by matching identities of known people stored in non-volatile storage516, thereby determining an identity of a person. Classifier514may be configured to generate and an actuator control command510in response to the interpretation of the image and/or video data. Control system502is configured to transmit the actuator control command510to actuator504. In this embodiment, actuator504may be configured to lock or unlock door1002in response to the actuator control command510. In other embodiments, a non-physical, logical access control is also possible.

Monitoring system1000may also be a surveillance system. In such an embodiment, sensor506may be an optical sensor configured to detect a scene that is under surveillance and control system502is configured to control display1004. Classifier514is configured to determine a classification of a scene, e.g. whether the scene detected by sensor506is suspicious. Control system502is configured to transmit an actuator control command510to display1004in response to the classification. Display1004may be configured to adjust the displayed content in response to the actuator control command510. For instance, display1004may highlight an object that is deemed suspicious by classifier514. Utilizing an embodiment of the system disclosed, the surveillance system may identify adversarial perturbations or random perturbations (e.g., bad shadows or lighting) in the video of the environment.

FIG.11depicts a schematic diagram of control system502configured to control imaging system1100, for example an Mill apparatus, x-ray imaging apparatus or ultrasonic apparatus. Sensor506may, for example, be an imaging sensor. Classifier514may be configured to determine a classification of all or part of the sensed image. Classifier514may be configured to determine or select an actuator control command510in response to the classification obtained by the trained neural network. For example, classifier514may interpret a region of a sensed image to be potentially anomalous. In this case, actuator control command510may be determined or selected to cause display302to display the imaging and highlighting the potentially anomalous region.

While exemplary embodiments are described above, it is not intended that these embodiments describe all possible forms encompassed by the claims. The words used in the specification are words of description rather than limitation, and it is understood that various changes can be made without departing from the spirit and scope of the disclosure. As previously described, the features of various embodiments can be combined to form further embodiments of the invention that may not be explicitly described or illustrated. While various embodiments could have been described as providing advantages or being preferred over other embodiments or prior art implementations with respect to one or more desired characteristics, those of ordinary skill in the art recognize that one or more features or characteristics can be compromised to achieve desired overall system attributes, which depend on the specific application and implementation. These attributes can include, but are not limited to cost, strength, durability, life cycle cost, marketability, appearance, packaging, size, serviceability, weight, manufacturability, ease of assembly, etc. As such, to the extent any embodiments are described as less desirable than other embodiments or prior art implementations with respect to

or more characteristics, these embodiments are not outside the scope of the disclosure and can be desirable for particular applications.