Using the brain as a model can generate more powerful artificial intelligence.

Most artificial intelligence systems are based on neural networks, which are algorithms inspired by the biological neurons in the brain. These networks can consist of multiple layers, with input entering from one side and output exiting from the other. The output can be used to make automated decisions, such as in self-driving cars. Attacks that deceive neural networks can exploit vulnerabilities in the input layer, but when building defenses, the initial input layer is usually the only consideration. Researchers have improved the strength of neural networks by enhancing their inner layers with random noise. Artificial intelligence (AI) has become relatively common; you have a smartphone with an AI assistant, or you use a search engine powered by AI. While it is a broad term that can encompass many different ways of processing information and making decisions, AI systems are typically built using artificial neural networks (ANNs) that resemble the brain. Like the brain, ANNs can sometimes be confused, either accidentally or through deliberate third-party actions. Imagine some visual input that may appear completely normal, or at least understandable to us, but could be interpreted by an ANN as something completely different. A simple example might be an image classification system misidentifying a cat as a dog, but more serious examples could include a self-driving vehicle mistaking a stop signal for a go signal. It's not just self-driving cars; there are also medical diagnostic systems and many other sensitive applications that take in input and provide information, or even make decisions that could affect people. Because the input is not necessarily visual, it is not always easy to analyze why a system made a mistake. Attackers attempting to undermine ANN-based systems can exploit this by cleverly altering the established input patterns, causing the input to be misinterpreted and leading to the system taking incorrect actions, potentially causing problems. Defensive techniques against these attacks have some limitations. Jumpei Ukita, a recent graduate from the Department of Physiology at the University of Tokyo School of Medicine, and Professor Kenichi Ohki, designed and tested a new method to improve ANN defense. Ohki said, "Neural networks are typically composed of layers of virtual neurons. The first few layers are usually responsible for analyzing the input by identifying elements corresponding to certain inputs." "Attackers may provide images with deceptive shadows that misclassify them. A typical defense measure against this attack might be intentionally introducing some noise in this first layer. This may seem counterproductive to solving the problem, but by doing so, it can have greater adaptability to visual scenes or other input sets. However, this approach is not always so effective, and we believe that by extending the focus from the input layer to the internal layers of the network, we can improve this issue." Ukita and Ohki are not only computer scientists, but they also study the human brain, which inspired them to use phenomena from the brain in ANNs. They added noise not only to the input layer but also to deeper layers. This is usually avoided because of concerns that it may affect the network's effectiveness under normal conditions. However, for their tested ANN, the noise increased its adaptability, reducing its vulnerability to simulated adversarial attacks. Ukita said, "Our first step was to design an attack method that goes deeper than the input layer. This attack requires using standard noise defense at the input layer to resist the network's recovery ability. We call it feature space adversarial examples." "These attacks work by providing inputs that are completely dissimilar to what the ANN can correctly classify. But the key is presenting cleverly misleading pseudo-shadows to deeper layers of neurons. Once we demonstrated the harmfulness of this attack, we injected random noise into the deeper layers of the network to enhance their adaptability and defense. We are pleased that this has proven effective." Although this new approach has demonstrated its robustness, the team hopes to further develop it to make it more effective against anticipated attacks and other types of attacks that they have not yet tested. Currently, this defense only works against this specific attack method. Ukita said, "Future attackers may take into account the issues we considered in this research. In fact, attack and defense are two sides of the same coin; it is an arms race where neither side will back down, so we need continuous innovation to protect the systems we use every day."