Model training methods, devices, equipment and media

Abstract

This application discloses a model training method, apparatus, device, and medium, relating to the field of machine learning. The method includes: extracting the current round's input samples and output samples from a sample dataset; processing the current round's input samples and the previous round's adversarial noise using a machine learning model to obtain the current round's predicted samples; updating the previous round's adversarial noise using the loss value between the current round's output samples and the current round's predicted samples to obtain the current round's adversarial noise; updating the previous round's model parameters of the machine learning model based on the current round's adversarial noise, the current round's input samples, and the current round's output samples to obtain the current round's model parameters; iterating the above four steps until the training completion conditions are met, thus completing the training of the machine learning model; wherein, in the first iteration, the previous round's adversarial noise is the initialized adversarial noise; in the i-th iteration, the previous round's adversarial noise is the current round's adversarial noise from the (i-1)-th iteration. This application can improve the robustness of the model.

Description

Technical Field

[0001] This application relates to the field of machine learning, and in particular to a model training method, apparatus, device, and medium. Background Technology

[0002] Adversarial training is an important way to enhance the robustness of neural networks. During adversarial training, the input samples are mixed with small amounts of adversarial noise, and the neural network is then forced to adapt to this change, thereby increasing its robustness. Adversarial noise is added to the input samples to interfere with the function of the machine learning model.

[0003] The relevant technique employs single-step gradient descent to determine adversarial noise for adversarial training. Single-step gradient descent means that the magnitude of each gradient descent is the same. This technique first acquires random adversarial noise. During the training of the machine learning model, the input samples are perturbed by the adversarial noise from gradient descent to obtain predicted samples. The machine learning model is then trained based on the difference between the predicted samples and the input samples.

[0004] The relevant techniques are affected by the step size of the gradient descent step. If the step size is too large, it will lead to overfitting of the model parameters and reduce the robustness of the machine learning model; while if the step size is too small, it will weaken the effect against noise and also reduce the robustness of the machine learning model. Summary of the Invention

[0005] This application provides a model training method, apparatus, device, and medium. This method can add suitable adversarial noise to input samples during machine learning model training, enhancing the robustness of the machine learning model while ensuring training efficiency. The technical solution is as follows:

[0006] According to one aspect of this application, a model training method is provided, the method comprising:

[0007] Extract the input samples and output samples for this round from the sample dataset;

[0008] The machine learning model is used to process the current round input samples and the previous round adversarial noise to obtain the current round prediction samples.

[0009] The previous round's adversarial noise is updated by the loss value between the current round's output sample and the current round's predicted sample to obtain the current round's adversarial noise;

[0010] The machine learning model parameters for the current round are updated based on the adversarial noise, the input samples, and the output samples of the current round to obtain the model parameters for the current round.

[0011] Iterate through the above four steps until the training completion conditions are met, thus completing the training of the machine learning model;

[0012] In the first iteration, the previous round adversarial noise is the initial adversarial noise; in the i-th iteration, the previous round adversarial noise is the current round adversarial noise in the (i-1)-th iteration, where i is an integer greater than 1.

[0013] According to one aspect of this application, a model training apparatus is provided, the apparatus comprising:

[0014] The extraction module is used to extract the input samples and output samples of the current round from the sample dataset;

[0015] The training module is used to process the current round input samples and the previous round adversarial noise through the machine learning model to obtain the current round prediction samples;

[0016] The update module is used to update the previous round adversarial noise by the loss value between the current round output sample and the current round prediction sample, so as to obtain the current round adversarial noise;

[0017] The update module is further configured to update the previous round model parameters of the machine learning model based on the current round adversarial noise, the current round input samples, and the current round output samples, to obtain the current round model parameters;

[0018] The training module is also used to iterate the above four steps until the training completion conditions are met, thereby completing the training of the machine learning model.

[0019] In the first iteration, the previous round adversarial noise is the initial adversarial noise; in the i-th iteration, the previous round adversarial noise is the current round adversarial noise in the (i-1)-th iteration, where i is an integer greater than 1.

[0020] According to another aspect of this application, a computer device is provided, comprising: a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set or instruction set, wherein the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the model training method as described above.

[0021] According to another aspect of this application, a computer storage medium is provided, wherein at least one piece of program code is stored in the computer-readable storage medium, the program code being loaded and executed by a processor to implement the model training method as described above.

[0022] According to another aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the model training method described above.

[0023] The beneficial effects of the technical solutions provided in this application include at least the following:

[0024] When training a machine learning model, adversarial noise is added to the input samples. This adversarial noise is adaptively adjusted as the training progresses. Compared with related techniques, it avoids overfitting and can complete the training of the machine learning model with a larger step size, resulting in higher training efficiency. Furthermore, the addition of adversarial noise improves the robustness of the machine learning model. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram of a computer system provided in an exemplary embodiment of this application;

[0027] Figure 2 This is a flowchart illustrating a model training method provided in an exemplary embodiment of this application;

[0028] Figure 3 This is a flowchart illustrating a model training method provided in an exemplary embodiment of this application;

[0029] Figure 4 This is a schematic diagram of a model training method provided in an exemplary embodiment of this application;

[0030] Figure 5 This is a flowchart illustrating a training method for a facial recognition model provided in an exemplary embodiment of this application;

[0031] Figure 6 This is a flowchart illustrating a training method for an autonomous driving model provided in an exemplary embodiment of this application;

[0032] Figure 7 This is a flowchart illustrating a training method for an item recommendation model provided in an exemplary embodiment of this application;

[0033] Figure 8 This is a schematic diagram of the structure of a model training apparatus provided in an exemplary embodiment of this application;

[0034] Figure 9 This is a structural block diagram of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0036] First, let's introduce the terms used in the embodiments of this application:

[0037] Artificial Intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0038] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0039] Computer Vision (CV) is a science that studies how to enable machines to "see." More specifically, it refers to machine vision, which uses cameras and computers to replace human eyes in recognizing and measuring targets, and then performs image processing to create images more suitable for human observation or transmission to instruments. As a scientific discipline, computer vision studies related theories and technologies, attempting to build artificial intelligence systems capable of extracting information from images or multidimensional data. Computer vision technologies typically include image processing, image recognition, image semantic understanding, image retrieval, OCR (Optical Character Recognition), video processing, video semantic understanding, video content / behavior recognition, 3D object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping (SLAM), and common biometric recognition technologies such as facial recognition and fingerprint recognition.

[0040] Machine Learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instruction-based learning.

[0041] It should be noted that all information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this application have been authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the input samples, output samples, and user information involved in this application were all obtained with full authorization.

[0042] Figure 1 A schematic diagram of the structure of a computer system provided in an exemplary embodiment of this application is shown. The computer system 100 includes a terminal 120 and a server 140.

[0043] The terminal 120 has an application installed for model training. This application can be a small app within an app, a dedicated application, or a web client. For example, the server 140 provides the trained model to the terminal 120. The terminal 120 is at least one of a smartphone, tablet, e-book reader, MP3 player, MP4 player, laptop, and desktop computer.

[0044] Terminal 120 is connected to server 140 via a wireless network or a wired network.

[0045] Server 140 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Server 140 is used to train machine learning models and provide the trained machine learning models to terminal 120. Optionally, server 140 undertakes the main computing work, and terminal 120 undertakes the secondary computing work; or, server 140 undertakes the secondary computing work, and terminal 120 undertakes the main computing work; or, server 140 and terminal 120 jointly perform computing using a distributed computing architecture.

[0046] Figure 2 A schematic flowchart of a model training method provided in an exemplary embodiment of this application is shown. This method can be... Figure 1 The computer system 100 shown executes the method, which includes:

[0047] Step 202: Extract the input samples and output samples of this round from the sample dataset.

[0048] The sample dataset includes pairs of input samples and output samples. This application does not specifically limit the sample dataset in its embodiments. For example, when the machine learning model is used for image recognition, the sample dataset includes pairs of sample images and image type labels; or, the sample dataset includes pairs of facial images and facial identities. For example, when the machine learning model is used to implement autonomous driving, the sample dataset includes pairs of road condition information and driving strategies. For example, when the machine learning model is used for item recommendation, the sample dataset includes pairs of account information and recommended items.

[0049] Optionally, the machine learning model in this application embodiment is a model that optimizes the algorithm using sample data and historical model parameters. Optionally, the machine learning model is a model that simulates biological learning methods. Optionally, the machine learning model is a model that improves algorithm performance through experiential learning.

[0050] For example, machine learning models include, but are not limited to, at least one of the following: ResNet (Residual Network) model, CNN (Convolutional Neural Networks) model, RNN (Recurrent Neural Network) model, and Transformer model. For example, the applications of machine learning models include, but are not limited to, at least one of the following: image recognition, autonomous driving, liveness detection, natural language understanding, and natural language generation. It should be noted that this application does not specifically limit the type or function of machine learning models.

[0051] The output sample in this round is the true label of the input sample in this round. For example, if the machine learning model is an identity recognition model and the input sample in this round is a face image, then the output sample in this round is the identity of that face image. For example, if the machine learning model is an autonomous driving model and the input sample in this round is road condition information, then the output sample in this round is the reference driving route.

[0052] For example, the sample dataset can be represented as Where, x i It is the input sample, y i is the output sample, and n represents the total number of samples in the sample dataset.

[0053] Optionally, the input and output samples for the current round can be randomly extracted from the sample dataset. Alternatively, the input and output samples for the current round can be extracted from the sample dataset according to the order of the samples. For example, the sample dataset includes n pairs of input and output samples arranged in order, and the input and output samples for the current round are selected from the sample dataset according to the number of iterations.

[0054] Step 204: Use a machine learning model to process the input samples of this round and the adversarial noise of the previous round to obtain the predicted samples of this round.

[0055] Adversarial noise is used to interfere with the functionality of machine learning models. For example, in the case of a machine learning model used to perform image recognition, if the input sample is an image of a "mountain", the machine learning model recognizes the input sample and outputs "mountain". However, if the machine learning model recognizes the input sample with adversarial noise added, it outputs "sea". Therefore, adversarial noise interferes with the functionality of the machine learning model.

[0056] Optionally, the adversarial noise from the previous round is added to the input sample of the current round to obtain the input sample of the current round with noise; the input sample of the current round with noise is processed by the face recognition model to obtain the prediction sample of the current round.

[0057] For example, let the machine learning model be denoted as f. θ θ represents the model parameters of the machine learning model, and x represents the input sample in this round. k The previous round of noise suppression was δ. k-1 Then the sample for this round of prediction is f θ (x k +δ k-1 ).

[0058] Optionally, the initial adversarial noise δ0 = Uniform(-∈, ∈), where Uniform represents a uniform distribution and ∈ is a preset constant.

[0059] Step 206: Update the previous round's adversarial noise using the loss value between the current round's output sample and the current round's predicted sample to obtain the current round's adversarial noise.

[0060] Optionally, the loss value between the current round's output sample and the current round's predicted sample is determined by the loss function; the previous round's adversarial noise is updated by the loss value to obtain the current round's adversarial noise.

[0061] For example, the loss function of a machine learning model can be defined as L(x) k +δ k y k ,θ k-1 ), where x k +δ k This indicates that the input sample x in this round will be... k and this round of counter-noise δ k The output y obtained after being input into the machine learning model k This is the output sample for this round, θ k-1 These are the model parameters from the previous round, and k represents the number of iterations in this round.

[0062] Step 208: Update the previous round model parameters of the machine learning model based on the current round adversarial noise, the current round input samples, and the current round output samples to obtain the current round model parameters.

[0063] Optionally, the current round of adversarial noise and current round of input samples are processed by a machine learning model to obtain the current round of updated samples; the previous round of model parameters are updated based on the loss update value between the current round of output samples and current round of updated samples to obtain the current round of model parameters.

[0064] Optionally, through a function Update the model parameters, then the model parameters for this round θ k-1 These are the model parameters from the previous round, k represents the number of iterations in this round, and x... k +δ k This indicates that the input sample x in this round will be... k and this round of counter-noise δ k The output y obtained after being input into the machine learning model k This is the output sample for this round, the function The form can be determined by technical personnel based on actual needs.

[0065] Step 210: Iterate through the above four steps until the training completion conditions are met, thus completing the training of the machine learning model.

[0066] Optionally, the above four steps can be iterated until the loss value converges, thus completing the training of the machine learning model.

[0067] Optionally, the above four steps can be iterated N times to complete the training of the machine learning model, where N is a constant. The value of N can be set by technical personnel according to actual needs.

[0068] In summary, this embodiment adds adversarial noise to the input samples when training the machine learning model. Moreover, the adversarial noise will adaptively adjust as the training progresses. Compared with related techniques, it will not cause overfitting problems, and the machine learning model can be trained with a larger step size, resulting in higher training efficiency. Furthermore, the addition of adversarial noise improves the robustness of the machine learning model.

[0069] In the following embodiments, the machine learning model training method will be described in detail. The adversarial noise is obtained through adaptive step size, providing adaptive adversarial noise for machine learning model training at different iteration stages. Moreover, the adversarial noise will be downsampled to facilitate its storage and save computer memory.

[0070] Figure 3 A schematic flowchart of a model training method provided in an exemplary embodiment of this application is shown. This method can be... Figure 1 The computer system 100 shown executes the method, which includes:

[0071] Step 301: Extract the input samples and output samples of this round from the sample dataset.

[0072] The sample dataset includes pairs of input and output samples. This application does not specifically limit the sample dataset.

[0073] Optionally, the input and output samples for the current round can be randomly extracted from the sample dataset. Alternatively, the input and output samples for the current round can be extracted from the sample dataset according to the sample arrangement order.

[0074] Step 302: In the first iteration, the input samples and initial adversarial noise of this round are processed by the machine learning model to obtain the predicted samples of this round.

[0075] Optionally, in the first iteration, the initial adversarial noise δ i =Uniform(-∈,∈), where Uniform represents a uniform distribution, ∈ is a constant, and ∈ can be set by technical personnel according to actual needs.

[0076] Step 303: In the i-th iteration, the input samples of this round and the adversarial noise of the previous round are processed by the machine learning model to obtain the predicted samples of this round.

[0077] Where i is an integer greater than 1.

[0078] Optionally, in the i-th iteration, the adversarial noise from the previous round is the adversarial noise from the (i-1)-th iteration in the current round.

[0079] For example, let the machine learning model be denoted as f. θ θ represents the model parameters of the machine learning model, and x represents the input sample in this round. k The previous round of noise suppression was δ. k-1 Then the sample for this round of prediction is f θ (x k +δ k-1 ).

[0080] Optionally, such as Figure 4 As shown, when using adversarial noise, the stored adversarial noise will be... Upsampling for adversarial noise δ k Due to the resistance to noise Less information content, less resistance to noise It occupies a relatively small storage area and employs noise-resistant techniques. Storing adversarial noise can save computer memory. Optionally, the stored previous round of adversarial noise can be upsampled using an upsampling resolution to obtain the previous round of adversarial noise. For example, taking an image as the input sample in the sample dataset, with a resolution of w×h, and the adversarial noise having the same resolution as the input sample, if the stored previous round of adversarial noise... The resolution is p×q, and the previous round of adversarial noise will be stored. Upsampling to w×h yields the previous round of adversarial noise δ k-1 This makes the previous round of noise suppression δk-1 The resolution of the input sample is consistent with the resolution of the input sample.

[0081] It should be noted that steps 302 and 303 are mutually exclusive. When step 302 is executed, step 303 is not executed; when step 303 is executed, step 302 is not executed.

[0082] Step 304: Determine the loss value between the output sample and the predicted sample in this round.

[0083] Optionally, a loss function is used to determine the loss value between the output sample and the predicted sample in the current round. The form of the loss function can be determined by technical personnel according to actual needs.

[0084] For example, the loss value is L(x) k +δ k-1 ,y k ,θ k-1 ), where x k +δ k-1 This indicates that the input sample x in this round will be... k And the previous round of counter-noise δ k-1 The output obtained after inputting into the model, y k This is the output sample for this round, θ k-1 These are the model parameters from the previous round, and k represents the number of iterations in this round.

[0085] Step 305: Determine the noise component of the gradient of the loss value in the adversarial noise dimension.

[0086] For example, the noise component is It is the component of the gradient in the anti-noise dimension.

[0087] Step 306: Update the momentum parameters of the previous round using the noise components to obtain the momentum parameters of the current round.

[0088] The momentum parameter for this round is used to represent the attenuation rate of the previous round's resistance to noise. Optionally, the momentum parameter is a momentum parameter.

[0089] Optionally, the momentum parameter of the current round is obtained by summing the norm of the noise component and the momentum parameter of the previous round. For example, the momentum parameter of the current round is obtained by summing the second norm of the noise component and the momentum parameter of the previous round. Alternatively, the momentum parameter of the current round is obtained by summing the infinite norm of the noise component and the momentum parameter of the previous round. Alternatively, the momentum parameter of the current round is obtained by summing the first norm of the noise component and the momentum parameter of the previous round. It should be noted that the embodiments of this application do not specifically limit the norm of the noise component used to calculate the momentum parameter of the current round.

[0090] For example, the momentum parameter for this round is:

[0091]

[0092] Among them, v k-1 β is the momentum parameter of the previous round, and β is a hyperparameter. The value of β can be adjusted by technicians according to actual needs.

[0093] Step 307: Update the previous round's counter-noise based on the momentum parameters of this round to obtain the current round's counter-noise.

[0094] Optionally, this step includes the following sub-steps:

[0095] 1. Calculate the adaptive step size based on the momentum parameters of this round.

[0096] The adaptive step size is inversely proportional to the momentum parameter of the current cycle. For example, the momentum parameter of the current cycle is...

[0097]

[0098] Where γ and c are hyperparameters, the values ​​of γ and c can be adjusted by technicians according to actual needs, v k These are the momentum parameters for this round.

[0099] 2. Calculate the adaptive step size and the sum of the previous round's adversarial noise using the noise components to obtain the current round's adversarial noise.

[0100] For example, the noise in this round is

[0101]

[0102] Where, δ k-1 This is the previous round of adversarial noise, where sgn represents the sign function, and...

[0103]

[0104] Optionally, such as Figure 4 As shown, when acquiring adversarial noise, the adversarial noise δ k downsampling Will Stored in a noise-resistant storage area, due to noise resistance Less information content, less resistance to noise It occupies a relatively small storage area and employs noise-resistant techniques. Storing adversarial noise can save computer memory. Optionally, the adversarial noise of the current round is downsampled based on the downsampling resolution to obtain the downsampled adversarial noise of the current round; the downsampled adversarial noise of the current round is then stored. The downsampling resolution corresponds to the upsampling resolution, and the upsampling resolution can reconstruct the adversarial noise sampled at the downsampling resolution.

[0105] For example, taking an image as the input sample in the sample dataset, with a resolution of w×h, and the resolution of the adversarial noise being consistent with the resolution of the input sample, then the resolution of the adversarial noise in this round δ k Also for w×h, this round of noise countermeasure δ k Downsampling to p×q yields the downsampled current-round adversarial noise.

[0106] Step 308: Trim the noise value of this round of noise suppression to a preset range.

[0107] The preset interval is determined based on the noise distribution of the initial anti-noise.

[0108] For example, this round of noise countermeasures

[0109]

[0110] Here, Clip[-∈,∈] represents clipping the function value to the range [-∈,∈].

[0111]

[0112] Wherein, ∈ is a pre-defined constant.

[0113] Step 309: Process the adversarial noise and input samples of the current round using a machine learning model to obtain the updated samples for the current round.

[0114] For example, let the machine learning model be denoted as f. θ θ represents the model parameters of the machine learning model, and x represents the input sample in this round. k The noise countermeasure in this round is δ k Then the sample for this round of prediction is f θ (x k +δ k ).

[0115] Step 310: Determine the updated loss value between the current output sample and the current updated sample.

[0116] Optionally, the loss function used to calculate the loss value and the loss function used to calculate the updated loss value are the same loss function, or the loss function used to calculate the loss value and the loss function used to calculate the updated loss value are different loss functions.

[0117] For example, the loss update value is

[0118] L(x k +δ k ,y k ,θ k-1 );

[0119] Where, x k +δ k This indicates that the input sample x in this round will be... k and this round of counter-noise δ k The output y obtained after being input into the machine learning model k This is the output sample for this round, θ k-1 These are the parameters from the previous model.

[0120] Step 311: Update the model parameters from the previous round based on the loss update value to obtain the model parameters for the current round.

[0121] For example, the model parameters for this round are:

[0122]

[0123] Here, η is the learning rate of the machine learning model, which is also a hyperparameter.

[0124] Step 312: Iterate through the above ten steps until the training completion conditions are met, and complete the training of the machine learning model.

[0125] Optionally, the above ten steps can be iterated until the loss value converges, thus completing the training of the machine learning model.

[0126] Optionally, the above ten steps can be iterated N times to complete the training of the machine learning model, where N is a constant. The value of N can be set by technical personnel according to actual needs.

[0127] For example, as shown in Table 1, the model training method provided in the embodiments of this application can improve the accuracy of machine learning models.

[0128] Table 1 shows the accuracy of the models obtained using related technologies and the methods provided in the embodiments of this application.

[0129]

[0130] In Table 1, the sample dataset used is the ImageNet dataset (the ImageNet dataset is a large dataset of natural images containing a wide variety of natural images, including animals, objects, vehicles, locations, etc.). ∞ The noise level represents the noise amplitude for adversarial purposes. ResNet 18 is a type of ResNet model, where "18" indicates the number of convolutional and fully connected layers. ResNet 50 is also a type of ResNet model, where "50" indicates the number of convolutional and fully connected layers. The data in Table 1 clearly shows that, under different model types and noise amplitudes, the machine learning model obtained using the method described in this application's embodiment outperforms machine learning models obtained using related technologies.

[0131] In summary, this embodiment adds adversarial noise to the input samples when training the machine learning model. Moreover, the adversarial noise will adaptively adjust as the training progresses. Compared with related techniques, it will not cause overfitting problems, and the machine learning model can be trained with a larger step size, resulting in higher training efficiency. Furthermore, the addition of adversarial noise improves the robustness of the machine learning model.

[0132] Furthermore, when storing adversarial noise, it is downsampled, and when needed, it is upsampled back to its original state. Since the downsampled adversarial noise contains less information, storing it using downsampling saves memory and does not affect the training performance of the machine learning model.

[0133] It should be noted that the model training method provided in this application does not depend on the model type, loss function type, or sample dataset. In the following embodiments, training a facial recognition model is used as an example. The facial recognition model is applied in a facial recognition system. The model training method provided in this application can increase the robustness of the facial recognition system and improve its security without increasing additional time consumption.

[0134] Figure 5 This illustration shows a flowchart of a training method for a facial recognition model provided in an exemplary embodiment of this application. The method can be... Figure 1 The computer system 100 shown executes the method, which includes:

[0135] Step 501: Extract the input image and output label for this round from the sample facial image set.

[0136] The sample facial image set includes pairs of input images and output labels. The input images are images containing biological faces. For example, if the input image is a face image, then the face image may contain one face, multiple faces, or a portion of a face. For example, the output labels are used to identify the faces in the input images. If the input image contains multiple faces, the output label is used to identify the face with the largest area in the input image; alternatively, the output label is used to identify the face closest to the center of the input image.

[0137] The output label is used to identify the identity of the biological face in the input image. For example, the sample face image set includes "Input Image 1 - Label A", where label A indicates that the face in Input Image 1 belongs to user A.

[0138] Optionally, the input image and output label for the current round can be randomly extracted from the sample facial image set. Alternatively, the input image and output label for the current round can be extracted from the sample facial image set according to the order in which the sample facial images are arranged.

[0139] Step 502: In the first iteration, the face recognition model is used to process the input image and the initial adversarial noise to obtain the predicted label for this round.

[0140] Optionally, in the first iteration, the initial adversarial noise δ i =Uniform(-∈,∈), where Uniform represents a uniform distribution, ∈ is a constant, and ∈ can be set by technical personnel according to actual needs.

[0141] Step 503: In the i-th iteration, the face recognition model is used to process the input image of this round and the adversarial noise of the previous round to obtain the predicted label of this round.

[0142] Where i is an integer greater than 1.

[0143] Optionally, in the i-th iteration, the adversarial noise from the previous round is the adversarial noise from the (i-1)-th iteration in the current round.

[0144] Optionally, the stored previous round of adversarial noise can be upsampled using an upsampling resolution to obtain the previous round of adversarial noise, thereby saving computer memory.

[0145] It should be noted that steps 502 and 503 are mutually exclusive. When step 502 is executed, step 503 is not executed; when step 503 is executed, step 502 is not executed.

[0146] Step 504: Determine the loss value between the output label and the predicted label of this round.

[0147] For example, the loss value is L(x) k +δ k-1 ,y k ,θ k-1 ), where x k +δ k-1 This indicates that the input image x in this round will be used. k And the previous round of counter-noise δ k-1 The output obtained after inputting into the facial recognition model, y k This is the output label for this round, θ k-1 These are the model parameters from the previous round, and k represents the number of iterations in this round.

[0148] Step 505: Determine the noise component of the gradient of the loss value in the adversarial noise dimension.

[0149] For example, the noise component is It is the component of the gradient in the anti-noise dimension.

[0150] Step 506: Update the momentum parameters of the previous round using the noise components to obtain the momentum parameters of the current round.

[0151] The momentum parameter for this round is used to represent the attenuation rate of the previous round's resistance to noise. Optionally, the momentum parameter is a momentum parameter.

[0152] Optionally, the momentum parameters for the current round are obtained by summing the norm of the noise component and the momentum parameters of the previous round. For example, the momentum parameters for the current round are obtained by summing the L2 norm of the noise component and the momentum parameters of the previous round. Alternatively, the momentum parameters for the current round are obtained by summing the infinity norm of the noise component and the momentum parameters of the previous round. Or, the momentum parameters for the current round are obtained by summing the L1 norm of the noise component and the momentum parameters of the previous round.

[0153] Step 507: Update the previous round's counter-noise based on the momentum parameters of this round to obtain the current round's counter-noise.

[0154] Optionally, the current round of adversarial noise is downsampled based on the downsampling resolution to obtain the downsampled current round of adversarial noise; the downsampled current round of adversarial noise is stored to save computer memory.

[0155] Optionally, this step includes the following sub-steps:

[0156] 1. Calculate the adaptive step size based on the momentum parameters of this round.

[0157] 2. Calculate the adaptive step size and the sum of the previous round's adversarial noise using the noise components to obtain the current round's adversarial noise.

[0158] Step 508: Trim the noise value of this round of noise suppression to a preset range.

[0159] For example, the noise value of the current round of noise suppression can be clipped to a preset range by using Clip[-∈,∈]. Clip[-∈,∈] means clipping the function value to the range of [-∈,∈], where ∈ is a preset constant.

[0160] Step 509: Process the adversarial noise and the input image of the current round using a facial recognition model to obtain the updated image of the current round.

[0161] For example, let the facial recognition model be denoted as f. θ θ represents the model parameters of the facial recognition model, and the input image for this round is denoted as x. k The noise countermeasure in this round is δ k Then the predicted label for this round is f. θ (x k +δk ).

[0162] Step 510: Determine the loss update value between the output image of this round and the updated image of this round.

[0163] Optionally, the loss function used to calculate the loss value and the loss function used to calculate the updated loss value are the same loss function, or the loss function used to calculate the loss value and the loss function used to calculate the updated loss value are different loss functions.

[0164] For example, the loss update value is

[0165] L(x k +δ k ,y k ,θ k-1 );

[0166] Where, x k +δ k This indicates that the input image x in this round will be used. k and this round of counter-noise δ k The output obtained after inputting into the facial recognition model, y k This is the output label for this round, θ k-1 These are the parameters from the previous model.

[0167] Step 511: Update the model parameters from the previous round based on the loss update value to obtain the model parameters for the current round.

[0168] For example, the model parameters for this round are:

[0169]

[0170] Here, η is the learning rate of the facial recognition model, which is also a hyperparameter.

[0171] Step 512: Iterate through the above ten steps until the training completion conditions are met, and complete the training of the face recognition model.

[0172] Optionally, the above ten steps are iterated until the loss value converges, thus completing the training of the face recognition model.

[0173] Optionally, the above ten steps can be iterated N times to complete the training of the facial recognition model, where N is a constant. The value of N can be set by technicians according to actual needs.

[0174] In summary, the embodiments of this application add adversarial noise to the input image when training the facial recognition model, and the adversarial noise will adaptively adjust as the training process progresses. Compared with related technologies, this can increase the robustness of the facial recognition model and improve its accuracy without increasing the additional time consumption.

[0175] In the following embodiments, the training of an autonomous driving model is used as an example. The autonomous driving model is applied in an autonomous driving system. The autonomous driving system has high safety requirements. The training time required for related technologies is too long, which makes it impossible to apply the related technologies to large-scale training. The model training method provided in this application embodiment can greatly accelerate the training process, reduce the training time, and reduce the overhead of large-scale training of autonomous driving models.

[0176] Figure 6 This illustration shows a flowchart of a training method for an autonomous driving model provided in an exemplary embodiment of this application. The method can be... Figure 1 The computer system 100 shown executes the method, which includes:

[0177] Step 601: Extract the current round's input road condition information and the current round's output driving strategy from the sample dataset.

[0178] The sample dataset includes pairs of road condition information and driving strategies. Road condition information includes at least one of the following: vehicle position, vehicle speed, weather, traffic lights, other vehicle positions, other vehicle speeds, traffic signs, and road regulations. Driving strategies include at least one of the following: go straight, turn left, turn right, reverse, decelerate, accelerate, stop suddenly, turn on lights, turn off lights, turn on windshield wipers, and turn off windshield wipers.

[0179] For example, if the traffic information indicates that there is a pedestrian crossing 30 meters ahead of vehicle A, the corresponding driving strategy is to reduce the speed of vehicle A. Similarly, if the traffic information indicates that the distance between vehicle B and vehicle C is less than 60 meters, and the speeds of both vehicles B and C are greater than 60 km / h, the corresponding driving strategy is to reduce the speeds of both vehicles B and C.

[0180] Optionally, the input road condition information and the output driving strategy for the current round can be randomly extracted from the sample dataset. Alternatively, the input road condition information and the output driving strategy for the current round can be extracted from the sample dataset according to the order of the road condition information.

[0181] Step 602: In the first iteration, the autonomous driving model processes the input road condition information and the initial adversarial noise to obtain the predictive driving strategy for this round.

[0182] Optionally, in the first iteration, the initial adversarial noise δ i =Uniform(-∈,∈), where Uniform represents a uniform distribution, ∈ is a constant, and ∈ can be set by technical personnel according to actual needs.

[0183] Step 603: In the i-th iteration, the autonomous driving model processes the input road condition information of this round and the adversarial noise of the previous round to obtain the predictive driving strategy for this round, where i is an integer greater than 1.

[0184] Optionally, in the i-th iteration, the adversarial noise of the previous round is the iteration noise of the current round in the (i-1)-th iteration.

[0185] Optionally, the stored previous round of adversarial noise can be upsampled using an upsampling resolution to obtain the previous round of adversarial noise, thereby saving computer memory.

[0186] It should be noted that steps 602 and 603 are mutually exclusive. When step 602 is executed, step 603 is not executed; when step 603 is executed, step 602 is not executed.

[0187] Step 604: Determine the loss value between the output driving strategy and the predicted driving strategy for this round.

[0188] For example, the loss value is L(x) k +δ k-1 ,y k ,θ k-1 ), where x k +δ k-1 This indicates that the driving strategy x will be input in this round. k And the previous round of counter-noise δ k-1 The output obtained after inputting into the autonomous driving model, y k This is the driving strategy output in this round, θ k-1 These are the model parameters from the previous round, and k represents the number of iterations in this round.

[0189] Step 605: Determine the noise component of the gradient of the loss value in the adversarial noise dimension.

[0190] For example, the noise component is It is the component of the gradient in the anti-noise dimension.

[0191] Step 606: Update the momentum parameters of the previous round using the noise components to obtain the momentum parameters of the current round.

[0192] The momentum parameter for this round is used to represent the attenuation rate of the previous round's resistance to noise. Optionally, the momentum parameter is a momentum parameter.

[0193] Optionally, the momentum parameters for the current round are obtained by summing the norm of the noise component and the momentum parameters of the previous round. For example, the momentum parameters for the current round are obtained by summing the L2 norm of the noise component and the momentum parameters of the previous round. Alternatively, the momentum parameters for the current round are obtained by summing the infinity norm of the noise component and the momentum parameters of the previous round. Or, the momentum parameters for the current round are obtained by summing the L1 norm of the noise component and the momentum parameters of the previous round.

[0194] Step 607: Update the previous round's counter-noise based on the momentum parameters of this round to obtain the current round's counter-noise.

[0195] Optionally, the current round of adversarial noise is downsampled based on the downsampling resolution to obtain the downsampled current round of adversarial noise; the downsampled current round of adversarial noise is stored to save computer memory.

[0196] Optionally, this step includes the following sub-steps:

[0197] 1. Calculate the adaptive step size based on the momentum parameters of this round.

[0198] 2. Calculate the adaptive step size and the sum of the previous round's adversarial noise using the noise components to obtain the current round's adversarial noise.

[0199] Step 608: Trim the noise value of this round of noise suppression to a preset range.

[0200] For example, the noise value of the current round of noise suppression can be clipped to a preset range by using Clip[-∈,∈]. Clip[-∈,∈] means clipping the function value to the range of [-∈,∈], where ∈ is a preset constant.

[0201] Step 609: The autonomous driving model processes the current round's adversarial noise and current round's input road condition information to obtain the updated driving strategy for this round.

[0202] For example, let the autonomous driving model be denoted as f. θ θ represents the model parameters of the autonomous driving model, and the input road condition information for this round is denoted as x. k The noise countermeasure in this round is δ k The driving strategy predicted in this round is f θ (x k +δ k ).

[0203] Step 610: Determine the loss update value between the current round's output driving strategy and the current round's updated driving strategy.

[0204] Optionally, the loss function used to calculate the loss value and the loss function used to calculate the updated loss value are the same loss function, or the loss function used to calculate the loss value and the loss function used to calculate the updated loss value are different loss functions.

[0205] For example, the loss update value is

[0206] L(x k +δ k ,y k ,δ k-1 );

[0207] Where, x k +δ k This indicates that the current round of input road condition information x k and this round of counter-noise δ k The output obtained after inputting into the autonomous driving model, y k This is the driving strategy output in this round, θ k-1 These are the parameters from the previous model.

[0208] Step 611: Update the model parameters from the previous round based on the loss update value to obtain the model parameters for the current round.

[0209] For example, the model parameters for this round are:

[0210]

[0211] Here, η is the learning rate of the autonomous driving model, which is also a hyperparameter.

[0212] Step 612: Iterate through the above ten steps until the training completion conditions are met, and complete the training of the autonomous driving model.

[0213] Optionally, the above ten steps are iterated until the loss value converges, thus completing the training of the autonomous driving model.

[0214] Optionally, the above ten steps can be iterated N times to complete the training of the autonomous driving model, where N is a constant. The value of N can be set by technicians according to actual needs.

[0215] In summary, the embodiments of this application add adversarial noise to the input road condition information when training the autonomous driving model, and the adversarial noise will adaptively adjust as the training process progresses. Compared with related technologies, this can accelerate the training speed of the autonomous driving model while ensuring its accuracy and reducing the time spent training the autonomous driving model.

[0216] In the following embodiments, the training of an item recommendation model is used as an example. The item recommendation model is applied in the item recommendation system. The item recommendation model needs to be trained on a large number of samples to ensure high accuracy, which leads to excessively long training time required by related technologies. However, the model training method provided in this application embodiment can greatly accelerate the training process and reduce the training time.

[0217] Figure 7This illustration shows a flowchart of a training method for an item recommendation model provided in an exemplary embodiment of this application. The method can be... Figure 1 The computer system 100 shown executes the method, which includes:

[0218] Step 701: Extract the input account information and recommended items for this round from the sample dataset.

[0219] The sample dataset includes pairs of input account information and output recommended items.

[0220] Optionally, the account information entered includes at least one of the following: account name, account ID (Identity Document), account identification code, account usage duration, account registration time, user age, user place of origin, and user identity.

[0221] The recommended items can be at least one of the following: real-world items, virtual items, real-world services, and virtual services.

[0222] For example, if the input account information includes that the user is 70 years old, the corresponding output recommended item is medical services. Alternatively, if the input account information includes that the user is a driver, the corresponding output recommended item is car insurance.

[0223] Optionally, the input account information and recommended output items for this round can be randomly extracted from the sample dataset. Alternatively, the input account information and recommended output items for this round can be extracted from the sample dataset according to the sorted order of the sample dataset.

[0224] Step 702: In the first iteration, the input account information and the initial adversarial noise are processed by the item recommendation model to obtain the predicted recommended items for this round.

[0225] Optionally, in the first iteration, the initial adversarial noise δ i =Uniform(-∈,∈), where Uniform represents a uniform distribution, ∈ is a constant, and ∈ can be set by technical personnel according to actual needs.

[0226] Step 703: In the i-th iteration, the input account information of this round and the adversarial noise of the previous round are processed by the item recommendation model to obtain the predicted recommended items for this round.

[0227] Where i is an integer greater than 1.

[0228] Optionally, in the i-th iteration, the adversarial noise from the previous round is the adversarial noise from the (i-1)-th iteration in the current round.

[0229] Optionally, the stored previous round of adversarial noise can be upsampled using an upsampling resolution to obtain the previous round of adversarial noise, thereby saving computer memory.

[0230] It should be noted that steps 702 and 703 are mutually exclusive. When step 702 is executed, step 703 is not executed; when step 703 is executed, step 702 is not executed.

[0231] Step 704: Determine the loss value between the recommended item output in this round and the predicted recommended item in this round.

[0232] For example, the loss value is L(x) k +δ k-1 ,y k ,θ k-1 ), where x k +δ k-1 This indicates that the account information to be entered in this round will be x. k And the previous round of counter-noise δ k-1 The output obtained after inputting into the item recommendation model, y k The recommended item for this round's output is θ. k-1 These are the model parameters from the previous round, and k represents the number of iterations in this round.

[0233] Step 705: Determine the noise component of the gradient of the loss value in the adversarial noise dimension.

[0234] For example, the noise component is It is the component of the gradient in the anti-noise dimension.

[0235] Step 706: Update the momentum parameters of the previous round using the noise components to obtain the momentum parameters of the current round.

[0236] The momentum parameter for this round is used to represent the attenuation rate of the previous round's resistance to noise. Optionally, the momentum parameter is a momentum parameter.

[0237] Optionally, the momentum parameters for the current round are obtained by summing the norm of the noise component and the momentum parameters of the previous round. For example, the momentum parameters for the current round are obtained by summing the L2 norm of the noise component and the momentum parameters of the previous round. Alternatively, the momentum parameters for the current round are obtained by summing the infinity norm of the noise component and the momentum parameters of the previous round. Or, the momentum parameters for the current round are obtained by summing the L1 norm of the noise component and the momentum parameters of the previous round.

[0238] Step 707: Update the previous round's counter-noise based on the momentum parameters of this round to obtain the current round's counter-noise.

[0239] Optionally, the current round of adversarial noise is downsampled based on the downsampling resolution to obtain the downsampled current round of adversarial noise; the downsampled current round of adversarial noise is stored to save computer memory.

[0240] Optionally, this step includes the following sub-steps:

[0241] 1. Calculate the adaptive step size based on the momentum parameters of this round.

[0242] 2. Calculate the adaptive step size and the sum of the previous round's adversarial noise using the noise components to obtain the current round's adversarial noise.

[0243] Step 708: Trim the noise value of this round of noise suppression to a preset range.

[0244] For example, the noise value of the current round of noise suppression can be clipped to a preset range by using Clip[-∈,∈]. Clip[-∈,∈] means clipping the function value to the range of [-∈,∈], where ∈ is a preset constant.

[0245] Step 709: Process the adversarial noise and the input account information of this round using the item recommendation model to obtain the updated recommended items for this round.

[0246] For example, let the item recommendation model be denoted as f. θ θ represents the model parameters of the item recommendation model, and x represents the account information input in this round. k The noise countermeasure in this round is δ k The recommended item for this round of predictions is f. θ (x k +δ k ).

[0247] Step 710: Determine the loss update value between the recommended items for this round and the updated recommended items for this round.

[0248] Optionally, the loss function used to calculate the loss value and the loss function used to calculate the updated loss value are the same loss function, or the loss function used to calculate the loss value and the loss function used to calculate the updated loss value are different loss functions.

[0249] For example, the loss update value is

[0250] L(x k +δ k ,y k ,θ k-1 );

[0251] Where, x k +δ k This indicates that the account information to be entered in this round will be x. k and this round of counter-noise δ kThe output obtained after inputting into the item recommendation model, y k The recommended item for this round's output is θ. k-1 These are the parameters from the previous model.

[0252] Step 711: Update the model parameters from the previous round based on the loss update value to obtain the model parameters for the current round.

[0253] For example, the model parameters for this round are:

[0254]

[0255] Here, η is the learning rate of the facial recognition model, which is also a hyperparameter.

[0256] Step 712: Iterate through the above ten steps until the training completion conditions are met, and complete the training of the item recommendation model.

[0257] Optionally, the above ten steps can be iterated until the loss value converges, thus completing the training of the item recommendation model.

[0258] Optionally, the above ten steps can be iterated N times to complete the training of the item recommendation model, where N is a constant. The value of N can be set by technical personnel according to actual needs.

[0259] In summary, the embodiments of this application add adversarial noise to the input account information when training the item recommendation model, and the adversarial noise will adaptively adjust as the training process progresses. Compared with related technologies, this can increase the robustness of the item recommendation model and improve its accuracy without increasing the additional time consumption.

[0260] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0261] Please refer to Figure 8 This diagram illustrates a block diagram of a model training apparatus according to an embodiment of this application. The above functions can be implemented in hardware or by hardware executing corresponding software. The apparatus 800 includes:

[0262] The extraction module 801 is used to extract the input samples and output samples of the current round from the sample dataset.

[0263] Training module 802 is used to process the current round input samples and the previous round adversarial noise through the machine learning model to obtain the current round prediction samples;

[0264] Update module 803 is used to update the previous round adversarial noise through the loss value between the current round output sample and the current round prediction sample to obtain the current round adversarial noise;

[0265] The update module 803 is further configured to update the previous round model parameters of the machine learning model based on the current round adversarial noise, the current round input samples, and the current round output samples, to obtain the current round model parameters;

[0266] The training module 802 is also used to iterate the above four steps until the training completion conditions are met, thereby completing the training of the machine learning model.

[0267] In the first iteration, the previous round adversarial noise is the initial adversarial noise; in the i-th iteration, the previous round adversarial noise is the current round adversarial noise in the (i-1)-th iteration, where i is an integer greater than 1.

[0268] In an optional design of this application, the update module 803 is further configured to determine the loss value between the current round output sample and the current round prediction sample; determine the noise component of the gradient of the loss value in the adversarial noise dimension; and update the previous round adversarial noise according to the noise component to obtain the current round adversarial noise.

[0269] In an optional design of this application, the updating module 803 is further configured to update the momentum parameters of the previous round through the noise components to obtain the momentum parameters of the current round, wherein the momentum parameters of the current round are used to represent the attenuation rate of the previous round of counter-noise; and update the previous round of counter-noise according to the momentum parameters of the current round to obtain the counter-noise of the current round.

[0270] In an optional design of this application, the update module 803 is further configured to calculate the adaptive step size based on the momentum parameters of the current round, wherein the adaptive step size is inversely proportional to the momentum parameters of the current round; and to calculate the sum of the adaptive step size and the anti-noise of the previous round through the noise components to obtain the anti-noise of the current round.

[0271] In an optional design of this application, the updating module 803 is further configured to obtain the momentum parameters of the current round based on the norm of the noise component and the sum of the momentum parameters of the previous round.

[0272] In an optional design of this application, the update module 803 is further configured to clip the noise value of the current round of counter-noise to a preset range, the preset range being determined based on the noise distribution of the initialized counter-noise.

[0273] In an optional design of this application, the update module 803 is further configured to perform data processing on the current round adversarial noise and the current round input samples through the machine learning model to obtain the current round update samples; determine the loss update value between the current round output samples and the current round update samples; and update the previous round model parameters according to the loss update value to obtain the current round model parameters.

[0274] In an optional design of this application, the update module 803 is further configured to determine the model parameter components of the gradient of the loss update value in the model parameter dimension; and obtain the current round model parameters based on the sum of the model parameter components and the previous round model parameters.

[0275] In an optional design of this application, the device further includes a sampling module 804;

[0276] The sampling module 804 is used to downsample the current round adversarial noise based on the downsampling resolution to obtain the downsampled current round adversarial noise; and to store the downsampled current round adversarial noise.

[0277] In an optional design of this application, the sampling module 804 is further configured to upsample the stored previous round adversarial noise using an upsampling resolution to obtain the previous round adversarial noise.

[0278] In an optional design of this application, the training module 802 is further configured to iterate the above four steps until the loss value converges, thereby completing the training of the machine learning model; or, iterate the above four steps N times to complete the training of the machine learning model, where N is a constant.

[0279] In summary, this embodiment adds adversarial noise to the input samples when training the machine learning model. Moreover, the adversarial noise will adaptively adjust as the training progresses. Compared with related techniques, it will not cause overfitting problems, and the machine learning model can be trained with a larger step size, resulting in higher training efficiency. Furthermore, the addition of adversarial noise improves the robustness of the machine learning model.

[0280] Figure 9This is a schematic diagram illustrating the structure of a computer device according to an exemplary embodiment. The computer device 900 includes a Central Processing Unit (CPU) 901, a system memory 904 including Random Access Memory (RAM) 902 and Read-Only Memory (ROM) 903, and a system bus 905 connecting the system memory 904 and the CPU 901. The computer device 900 also includes a basic input / output system (I / O system) 906 that facilitates information transfer between various components within the computer device, and a mass storage device 907 for storing an operating system 913, application programs 914, and other program modules 915.

[0281] The basic input / output system 906 includes a display 908 for displaying information and an input device 909 for user input, such as a mouse or keyboard. Both the display 908 and the input device 909 are connected to the central processing unit 901 via an input / output controller 910 connected to the system bus 905. The basic input / output system 906 may also include the input / output controller 910 for receiving and processing input from multiple other devices such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller 910 also provides output to a display screen, printer, or other types of output devices.

[0282] The mass storage device 907 is connected to the central processing unit 901 via a mass storage controller (not shown) connected to the system bus 905. The mass storage device 907 and its associated computer device-readable media provide non-volatile storage for the computer device 900. That is, the mass storage device 907 may include computer device-readable media (not shown), such as a hard disk or a compact disc read-only memory (CD-ROM) drive.

[0283] Without loss of generality, the computer device readable medium may include computer device storage media and communication media. Computer device storage media include volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer device readable instructions, data structures, program modules, or other data. Computer device storage media include RAM, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), CD-ROM, digital video disc (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that the computer device storage media are not limited to the above-mentioned types. The system memory 904 and mass storage device 907 described above can be collectively referred to as memory.

[0284] According to various embodiments of this application, the computer device 900 can also be connected to a remote computer device on a network, such as the Internet. That is, the computer device 900 can be connected to the network 911 via a network interface unit 912 connected to the system bus 905, or the network interface unit 912 can be used to connect to other types of networks or remote computer device systems (not shown).

[0285] The memory also includes one or more programs, which are stored in the memory. The central processing unit 901 executes the one or more programs to implement all or part of the steps of the above model training method.

[0286] In an exemplary embodiment, a computer-readable storage medium is also provided, which stores at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the model training method provided in the above-described method embodiments.

[0287] This application also provides a computer-readable storage medium storing at least one instruction, at least one program, a code set, or an instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the model training method provided in the above method embodiments.

[0288] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the model training method provided in the above embodiments.

[0289] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0290] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0291] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A model training method, characterized in that, The method is performed by a computer device, and the method includes: Extract the current round input sample and the current round output sample from the sample dataset. The current round input sample is a sample image, and the current round output sample is the image category label corresponding to the sample image. The current round of input samples and the previous round of adversarial noise are processed by a machine learning model to obtain the current round of predicted samples. Determine the loss value between the current round output sample and the current round prediction sample; Determine the noise component of the gradient of the loss value in the adversarial noise dimension; The momentum parameters of the previous round are updated by the noise components to obtain the momentum parameters of the current round. The momentum parameters of the current round are used to represent the attenuation rate of the previous round against noise. The momentum parameters of the current round are proportional to the gradient of the loss value. The adaptive step size is calculated based on the momentum parameters of the current cycle, and the adaptive step size is inversely proportional to the momentum parameters of the current cycle. The adaptive step size and the sum of the previous round's adversarial noise are calculated using the noise components to obtain the current round's adversarial noise; wherein, each round's adversarial noise is downsampled and stored. The machine learning model parameters for the current round are updated based on the adversarial noise, the input samples, and the output samples of the current round to obtain the model parameters for the current round. Iterate through the above steps until the training completion conditions are met, thus completing the training of the machine learning model; In the first iteration, the previous round adversarial noise is the initial adversarial noise; in the i-th iteration, the previous round adversarial noise is the current round adversarial noise in the (i-1)-th iteration, where i is an integer greater than 1.

2. The method according to claim 1, characterized in that, The step of updating the momentum parameters of the previous round using the noise components to obtain the momentum parameters of the current round includes: The momentum parameters for the current round are obtained by summing the norm of the noise component and the momentum parameters of the previous round.

3. The method according to claim 1, characterized in that, The method further includes: The noise value of the current round of counter-noise is clipped to a preset range, which is determined based on the noise distribution of the initialized counter-noise.

4. The method according to any one of claims 1 to 3, characterized in that, The step of updating the previous round model parameters of the machine learning model based on the current round adversarial noise, the current round input samples, and the current round output samples to obtain the current round model parameters includes: The machine learning model is used to process the current round of adversarial noise and the current round of input samples to obtain the current round of updated samples. Determine the loss update value between the current round output sample and the current round updated sample; The model parameters of the previous round are updated based on the loss update value to obtain the model parameters of the current round.

5. The method according to claim 4, characterized in that, The step of updating the previous round model parameters based on the loss update value to obtain the current round model parameters includes: Determine the model parameter components of the gradient of the loss update value in the model parameter dimension; The model parameters for the current round are obtained by summing the model parameter components and the model parameters from the previous round.

6. The method according to any one of claims 1 to 3, characterized in that, The method further includes: The current round adversarial noise is downsampled based on the downsampling resolution to obtain the downsampled current round adversarial noise. Store the current round adversarial noise after downsampling.

7. The method according to any one of claims 1 to 3, characterized in that, The method further includes: The previous round of adversarial noise is obtained by upsampling the stored previous round adversarial noise using an upsampling resolution.

8. The method according to any one of claims 1 to 3, characterized in that, The iterative process described above, continuing until the training completion conditions are met, to complete the training of the machine learning model, includes: Iterate through the above steps until the loss value converges, thus completing the training of the machine learning model; Alternatively, the above steps can be iterated N times to complete the training of the machine learning model, where N is a constant.

9. A model training device, characterized in that, The device includes: The extraction module is used to extract the current round input sample and the current round output sample from the sample dataset. The current round input sample is a sample image, and the current round output sample is the image category label corresponding to the sample image. The training module is used to process the current round input samples and the previous round adversarial noise using a machine learning model to obtain the current round prediction samples. An update module is used to determine the loss value between the current round's output sample and the current round's predicted sample; determine the noise component of the gradient of the loss value in the adversarial noise dimension; update the momentum parameter of the previous round using the noise component to obtain the momentum parameter of the current round, the momentum parameter of the current round representing the attenuation rate of the adversarial noise of the previous round, and the momentum parameter of the current round being proportional to the gradient of the loss value; calculate an adaptive step size based on the momentum parameter of the current round, the adaptive step size being inversely proportional to the momentum parameter of the current round; and calculate the sum of the adaptive step size and the adversarial noise of the previous round using the noise component to obtain the adversarial noise of the current round; wherein, the adversarial noise of each round is downsampled and stored. The update module is further configured to update the previous round model parameters of the machine learning model based on the current round adversarial noise, the current round input samples, and the current round output samples, to obtain the current round model parameters; The training module is also used to iterate the above steps until the training completion conditions are met, thereby completing the training of the machine learning model. In the first iteration, the previous round adversarial noise is the initial adversarial noise; in the i-th iteration, the previous round adversarial noise is the current round adversarial noise in the (i-1)-th iteration, where i is an integer greater than 1.

10. A computer device, characterized in that, The computer device includes a processor and a memory, wherein the memory stores at least one program, which is loaded and executed by the processor to implement the model training method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one piece of program code, which is loaded and executed by a processor to implement the model training method as described in any one of claims 1 to 8.

12. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by the processor, they implement the model training method according to any one of claims 1 to 8.

Images