Methods and apparatus for training a classifier or regressor to perform robust classification and regression on time series
By using adversarial perturbations that match the expected noise during the training process of the machine learning system, the problem of reduced prediction accuracy in noisy environments is solved, achieving high robustness and high prediction accuracy in noisy environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ROBERT BOSCH GMBH
- Filing Date
- 2021-12-09
- Publication Date
- 2026-06-02
AI Technical Summary
Existing machine learning systems show increased robustness to sensor noise and manufacturing tolerances, but significantly reduced average prediction accuracy, making it difficult to maintain high prediction accuracy in noisy environments.
By using adversarial perturbations that match the expected noise values when training the machine learning system, limiting the noise values of the adversarial perturbations to a pre-given threshold, employing PGD and provably robust training methods, and optimizing the gradient ascent direction to improve the robustness and prediction accuracy of the system.
It improves the prediction accuracy of machine learning systems in noisy environments, maintains or improves the average generalization ability of the system, and enhances robustness to sensor noise and manufacturing tolerances.
Smart Images
Figure CN116635867B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a computer-implemented machine learning system, a training device for training the machine learning system, a computer program, and a machine-readable storage medium. Background Technology
[0002] The paper “Neural Network Virtual Sensors for Fuel Injection Quantities with Provable Performance Specifications” by Wong et al., available online on June 30, 2020 at https: / / arxiv.org / abs / 2007.00147vl, discloses a method for training machine learning systems with the help of provable robust training.
[0003] Advantages of the present invention
[0004] The technical system can be manipulated based on sensor measurements of the system environment and / or sensor measurements of the system's operational status. Typically, a machine learning system is used to process the sensor measurements in this case. Generally, such a machine learning system can function as a virtual sensor that can determine, for example, the operational status of the technical system based on sensor measurements that would otherwise be impossible for the sensors to determine.
[0005] Sensors are typically subjected to varying degrees of strong noise and manufacturing tolerances, which, from a technical system perspective, can cause noise-like effects. Even small noise components measured by the sensor (caused by sensor noise and / or manufacturing tolerances) can lead to incorrect predictions by machine learning systems.
[0006] Wong et al. disclosed that machine learning systems can be trained to be more robust to noise.
[0007] However, the inventors were able to discover that, although the attack model used in adversarial examples from known methods leads to increased robustness to noise, the average prediction accuracy of machine learning systems trained in this way is significantly reduced.
[0008] A key advantage of the method characterized by this invention is that a machine learning system configured to classify or regress time series of sensor data can be trained to be more robust to noise without compromising average generalization ability. This advantageously improves the overall prediction accuracy of the machine learning system while also making it robust to noise. Summary of the Invention
[0009] In a first aspect, the present invention relates to a computer-implemented method for training a machine learning system, wherein the machine learning system is configured to determine an output signal based on a time series of input signals of a technical system, the output signal representing at least one first operating state and / or a classification and / or regression result of at least one first operating variable of the technical system, wherein the method comprises the following steps:
[0010] a. Determine a first training time series of an input signal and a desired training output signal corresponding to the first training time series from multiple training time series, wherein the desired training output signal characterizes the desired classification and / or desired regression result of the first training time series;
[0011] b. Identify the first adversarial example (x) i '), wherein the first adversarial example is the superposition of the first training time series and the determined first adversarial perturbation, wherein the first noise value of the first adversarial perturbation is not greater than a pre-given threshold, wherein the pre-given threshold is based on the determined noise value of the training time series;
[0012] c. Using the machine learning system, determine the training output signal for the first adversarial example;
[0013] d. Adapt at least one parameter of the machine learning system according to the gradient of the loss value, wherein the loss value characterizes the deviation between the desired training output signal and the determined training output signal.
[0014] A time series can be understood as multiple input signals, each representing the measurement of a sensor or the operational state of a technical system. In particular, a time series can be in vector form, where the values of the vector can be understood as the values at different points in time within the time series. Preferably, the values of the vector correspond to the order of the measurement time points of these values; that is, the increased dimension of the vector represents consecutive time points in the time series.
[0015] Alternatively, a time series can also represent multiple input signals at corresponding time points. Therefore, a time series can be represented as a matrix, where, for example, the first dimension of the matrix represents the time point, while the second dimension represents the different input signals. For use in the proposed training method, these time series can be used by concatenating all rows or all columns of the matrix to obtain a vector, which can then be used as a time series in the method or as a training time series.
[0016] Training a machine learning system can be understood as supervised training. The first training time series used for training may preferably include input signals, each input signal representing a second operating state and / or a second operating variable of the technical system, or a technical system with the same or similar construction, or a simulation of the second operating state and / or the second operating variable at a predefined time point. In other words, the training time series among multiple training time series may be based on the input signals of the technical system itself. Alternatively or additionally, training time series of input signals from similar technical systems may be recorded, wherein the similar technical system may, for example, be a prototype or initial development of the technical system. The input signals of the training time series can also be determined from other technical systems, such as from other technical systems in the same or one production sequence. The input signals of the training time series can also be determined based on simulations of the technical system.
[0017] Typically, the input signal of the first training time series is similar to the input signal of the time series; in particular, the input signal of the training time series should represent the same second running variable as the input signal of the time series.
[0018] For training, training time series can be provided from a database, which includes multiple training time series. For training, step ad is preferably performed iteratively. Preferably, multiple training time series can also be used in each iteration to determine the loss value; that is, training can be performed using a batch of training time series.
[0019] In one design of this method, it can be determined individually for each training time series in a batch whether the training time series should be superimposed with the adversarial perturbation. For this purpose, it is preferable to randomly determine whether the training time series should be superimposed with the adversarial perturbation for each training time series in the batch. The advantage of this implementation is that the machine learning system transmits not only adversarial examples during training but also the training time series themselves. The inventors have determined that this can further improve the predictive accuracy of the machine learning system.
[0020] The output signal may include classification and / or regression results. Regression results should be understood in this context as the outcome of regression. Therefore, a machine learning system can be viewed as a classifier and / or a regressor. A regressor can be understood as a device that predicts at least one true value with respect to at least one true value.
[0021] The time series and the training time series are preferably represented as column vectors, where each dimension of the vector represents a measurement value of the time series or the training time series at a specific time point.
[0022] For this training method, the training time series and / or the desired training output signal can be determined, particularly by means of sensor measurements from the technical system. Alternatively, it is conceivable to determine the training time series and / or the desired training output signal by means of simulation from the technical system.
[0023] The machine learning system can be understood as being constructed to receive time series and determine an output signal, the output signal representing the classification of the time series or determining at least one true value based on the time series, i.e., performing regression.
[0024] Therefore, the machine learning system may in particular include a neural network that performs classification or regression.
[0025] The machine learning method is trained using this method to make it robust against noise in the time series data passed to the machine learning system. To this end, adversarial examples particularly suitable for the machine learning system are identified, and the system is then trained to correctly classify or perform the correct regression on the adversarial examples.
[0026] An adversarial example can be understood as a first time series determined based on a second time series, such that a misclassification is determined for the first time series or a regression result is determined by a machine learning system that is more than a tolerance threshold away from the expected regression result, wherein the machine learning system’s prediction about the second time series is correct or the distance does not exceed the tolerance threshold.
[0027] The first time series, i.e., the adversarial example, can be understood in particular as the superposition of the second time series and the adversarial perturbation. The adversarial perturbation here represents a modification that can be made to the second time series to generate the adversarial example. In the context of this invention, the adversarial example and the adversarial perturbation can preferably also exist as vectors. Therefore, the superposition of the training time series and the adversarial perturbation can be understood, in particular, as vector addition.
[0028] In the context of this invention, adversarial disturbances can also be understood as noise.
[0029] To generate adversarial examples, possible adversarial perturbations are typically restricted. The chosen restrictions elicit a so-called attack model for the adversarial examples. Known attack models restrict the adversarial perturbation to a sphere or cube in the input space of the machine learning system. However, the inventors were able to determine that these known attack models result in the identified adversarial perturbations also including perturbations that do not characterize realistic noise with respect to the time series. The inventors were also able to determine that restricting the attack model to realistic noise significantly simplifies the training of the machine learning system because the machine learning system does not need to be robust to adversarial examples that do not represent realistic noise in any way and are therefore not expected. This improves the predictive accuracy of the machine learning system.
[0030] Therefore, this method can be understood as having the following characteristics: adversarial perturbations representing the desired noise are used only for training. Specifically, the desired noise can be determined from multiple training input signals, i.e., the average noise of the training input signals.
[0031] In this method, the first adversarial perturbation is constrained to such that the noise value of the first adversarial perturbation is no greater than a pre-given threshold.
[0032] Specifically, the pre-defined threshold can correspond to the average noise value of multiple training time series. This advantageously further restricts adversarial perturbations, ensuring that the adversarial perturbation has a noise value less than or equal to the average noise value of the multiple training time series.
[0033] In this context, the noise value can be understood as a value characterizing the noise intensity. In this sense, noise values can be determined for adversarial perturbations, as well as adversarial examples or time series.
[0034] Preferably, the noise value of the training time series, adversarial perturbation, or adversarial example can be determined based on Mahalanobis distance.
[0035] Specifically, Mahalanobis distance can characterize the distance between the training time series, adversarial perturbation, or adversarial example and the noise statistical distribution of the training time series. In this way, it can be determined to what extent the noise present in the training time series, adversarial perturbation, or adversarial example is similar to the expected noise.
[0036] Preferably, it can be based on the formula
[0037]
[0038] To determine the noise value, where s is the training time series or adversarial perturbation or adversarial example. It is a pseudo-inverse covariance matrix, which represents the k pre-given number of maximum eigenvalues and corresponding eigenvectors of at least one subset of the plurality of training time series.
[0039] This preferred design of the method allows for the determination of the linear noise component in the input of the formula. The inventors have determined that by identifying, in particular, the linear noise component, the identified adversarial perturbation can be further restricted to noise specific to the time series prediction. This advantageously improves the predictive accuracy of the machine learning system.
[0040] If the noise value should be determined for a time series, particularly the training time series, using the described formula, then preferably the expected value of the training time series (i.e., the midpoint of all training time series) can be subtracted from the time series. Thus, all training time series are centered at the origin.
[0041] Specifically, the matrix can be determined based on all training time series from multiple training time series. .
[0042] It is also conceivable to use different matrices for different training time series. For example, it is conceivable that the technical system is manufactured at different production sites, and that technical systems manufactured in this manner have different production tolerances. In this case, for example, the matrix can be determined based on the training time series of the technical systems from each production site. .
[0043] Different matrices can also be determined for different operating states of the technical system. Furthermore, in this method, the matrix is selected based on the running state represented by the training time series. The technical system may include, for example, an engine, and the operating state may characterize the rotational speed and / or operating duration and / or temperature.
[0044] Furthermore, the matrix can also be determined based on the training time series. For example, clustering methods can be used to cluster training time series, and a matrix can be determined for each cluster based on the training time series assigned to that cluster. For training, to determine the noise value of the training time series, the clusters closest to the training time series can first be identified, and the noise value of the training time series can be determined using the matrix of these clusters. For adversarial perturbations and adversarial examples, the matrix of clusters closest to the following training time series can be used, respectively. This will determine the adversarial perturbation or the adversarial example for the training time series.
[0045] Specifically, the pseudo-inverse covariance matrix can be determined through the following steps:
[0046] e. Determine the covariance matrix of at least one subset of the plurality of training time series;
[0047] f. Determine at least one largest eigenvalue of the covariance matrix, preferably a plurality of predefined largest eigenvalues, and an eigenvector corresponding to one or more eigenvalues;
[0048] g. Determine the pseudo-inverse covariance matrix according to the following formula.
[0049] ,
[0050] in It is the i-th eigenvalue among multiple largest eigenvalues. It is related to eigenvalues The corresponding eigenvector, k is the number of pre-defined eigenvalues for the largest eigenvalue.
[0051] If only one matrix is determined for all training time series Then, in step e, all training time series are used.
[0052] The first noise signal can be determined based on optimization, such that the distance between the second output signal and the desired output signal is as large as possible, wherein the second output signal is determined by the machine learning system based on the superposition of the first training time series and the first noise signal. This measure can be understood as a form of training that can also be used for attack models of other types and / or adversarial examples. In particular, this can be done using projected gradient descent (PGD) or provably robust defense (or provable adversarial defense, see Wong et al.).
[0053] In a preferred design of this method, the first adversarial perturbation can be determined according to the following steps:
[0054] h. Provide a second counter-perturbation;
[0055] i. Determine a third adversarial perturbation, wherein the third adversarial perturbation is relative to the first training time series (x i It is stronger than the second type of adversarial perturbation;
[0056] j. If the distance between the third adversarial perturbation and the second adversarial perturbation is less than or equal to a predefined threshold, then the third adversarial perturbation is provided as the first adversarial perturbation;
[0057] k. Otherwise, if the noise value of the third adversarial perturbation is less than or equal to the expected noise value, then step i is performed, wherein the third adversarial perturbation is used as the second adversarial perturbation when step i is performed;
[0058] l. Otherwise, determine the planned disturbance and perform step j, wherein the planned disturbance is used as a third adversarial disturbance when performing step j, and wherein the planned disturbance is determined by optimization such that the distance between the planned disturbance and the second adversarial disturbance is as small as possible, and the noise value of the planned disturbance is equal to the expected noise value.
[0059] This method can be understood as a form of PGD, however, limiting the attack model to the expected noise of multiple training time series. Specifically, the first adversarial perturbation in step h is randomly determined. Alternatively, the first adversarial perturbation in step h may contain at least one predefined value.
[0060] The advantage of this design is that the machine learning system can be trained using PGD, where the attack model is restricted to expected noise across multiple training time series. This makes the machine learning system advantageously robust to noise, where, compared to other attack models, it advantageously does not reduce the predictive accuracy of the machine learning system.
[0061] The first training time series can be superimposed with the second adversarial perturbation to obtain a second adversarial example, and the first training time series can be superimposed with the third adversarial perturbation to obtain a third adversarial example. A second output signal can then be determined for the second adversarial example, and a third output signal can be determined for the third adversarial output signal. When the third output signal is further away from the desired training output signal than the second output signal, the third adversarial perturbation can be interpreted as stronger than the second adversarial perturbation. Conversely, the third adversarial perturbation can be determined using gradient ascent and based on the second adversarial perturbation.
[0062] Therefore, preferably in step i, the third adversarial perturbation is determined by gradient ascent based on the output of the machine learning system (60) with respect to the first training time series superimposed with the second adversarial perturbation and the expected training output, wherein the gradient ascent corresponds to the adaptation of the gradient to the eigenvalues and eigenvectors.
[0063] Therefore, preferably in step i, gradient ascent is used based on the machine learning system (60) with respect to the first training time series (x) superimposed with the second adversarial perturbation. i ) and the expected training output (t) iThe output of ) determines the third adversarial perturbation, wherein the gradient ascent corresponds to the eigenvalues and eigenvectors to adapt the gradient.
[0064] The preferred design of this method can be understood as follows: in step i, according to the formula...
[0065]
[0066] To determine the third adversarial perturbation, in which It is the second antagonistic perturbation. It is the third antagonistic perturbation. It is a pre-defined increment value, C k Let g be the first matrix, and g be the gradient, where g is the gradient according to the formula.
[0067]
[0068] Determine the gradient g, where L is the loss function and t i It is the expected training output signal of the first training time series, m(x) i + This refers to transmitting a second adversarial perturbation to a machine learning system. The first training time series is the result of the machine learning system.
[0069] According to the formula
[0070]
[0071] To determine the adversarial disturbances in the plan.
[0072] In this case, matrix C can be determined by the largest eigenvalue and the corresponding eigenvector of the covariance matrix of multiple training time series. k That is, according to the formula
[0073] .
[0074] The advantage of determining the gradient based on the maximum eigenvalue and eigenvector is that it reduces the number of steps in the PGD method to determine the first adversarial perturbation, because it leverages matrix C. k The gradient is guided in a better direction from the perspective of gradient ascent, resulting in an adversarial perturbation with fewer steps. This perturbation is strong and its noise value is smaller than the average noise value of multiple training time series. This process can be understood as similar to gradient ascent with the help of natural gradients. Reducing the number of steps shortens the training time. Therefore, with the same training time, more training time series can be used to train the machine learning system, leading to an improvement in the prediction accuracy of the machine learning system.
[0075] In a further design of this method, the first adversarial example can be determined by means of provably robust training.
[0076] Specifically, the method of Wong et al., “Scaling provable adversarial defenses,” available online at https: / / arxiv.org / abs / 1805.12514v2 on November 21, 2018, can be modified to use the attack model proposed in this invention. This can be achieved by modifying Equation 7 to make the term... Instead Where Δ is the average noise value of multiple training time series and according to the formula
[0077]
[0078] To determine, where n is the number of training time series in the multiple training time series.
[0079] The advantage of this design is that it allows for significantly more reliable training of the machine learning system under noise. This enables the provably determined prediction accuracy of the machine learning system under noise. Furthermore, the prediction accuracy of the machine learning system is improved compared to training using normal, provably robust methods.
[0080] In particular, in the proposed invention, the technical system can output liquid through a valve, wherein the time series and the training time series respectively characterize the pressure value sequence of the technical system, and the output signal and the expected training output signal respectively characterize the amount of liquid output by the valve.
[0081] In one design of this method, the technical system can be, for example, a fuel injection system for an internal combustion engine. In this case, the valve can be an injector for the internal combustion engine, such as a diesel injector or a gasoline injector. Typically, it is difficult to determine the amount of fuel output during injection. The advantage of this method in this case is that the machine learning system acts as a virtual sensor, by which the amount of fuel injected can be determined very accurately. By using this method, the machine learning system can also be robust to noise from sensors that determine the pressure in the fuel line, which delivers fuel to the valve. Furthermore, the machine learning system becomes more robust to sensor noise caused by manufacturing-related sensor variations.
[0082] In another design, the technology system could be, for example, a spraying system used in agriculture to spray fields, such as a fertilization system. In this system, it is also necessary to accurately determine the amount of fertilizer dispensed through the valves to avoid over- or under-fertilization of the fields. Advantageously, machine learning systems are able to determine the amount of fertilizer dispensed from the valves with very high accuracy.
[0083] Furthermore, this method can also be used to control robots. In this case, the technical system is a robot, and the time series and the training time series can respectively characterize the robot's acceleration or position data, which is determined by means of corresponding sensors, wherein the output signal or desired training output signal characterizes the robot's position and / or acceleration and / or center of gravity and / or zero moment point. The advantage of this approach is that it can determine the robot's desired operating state very accurately even under noise, which advantageously leads to improved robot control.
[0084] Alternatively, the technical system may be a manufacturing machine that produces at least one workpiece, wherein each input signal of the time series (x) characterizes the force and / or torque of the manufacturing machine, and the output signal (y) characterizes the classification of whether the workpiece was correctly manufactured. The advantage of this design is that the manufacturing machine can produce workpieces with higher precision because the machine learning system can more accurately predict the corresponding operating state of the machine, even if the sensors are noisy. Attached Figure Description
[0085] Embodiments of the present invention will now be explained in more detail with reference to the accompanying drawings. In the drawings:
[0086] Figure 1 The training system used to train machine learning systems is illustrated schematically.
[0087] Figure 2 The structure of a control system that uses a machine learning system to manipulate the actuator is illustrated schematically.
[0088] Figure 3 An embodiment for controlling a manufacturing system is illustrated schematically;
[0089] Figure 4 An embodiment of a system for controlling the injection of liquid by means of a valve is schematically shown;
[0090] Figure 5 An embodiment for controlling a robot is illustrated schematically. Detailed Implementation
[0091] Figure 1An embodiment of a training system (140) for training a machine learning system (60) using a training dataset (T) is shown. Preferably, the machine learning system (60) includes a neural network. The training dataset (T) includes multiple training time series (x, y, x) of input signals from sensors of the technical system. i ), where the training time series (x) i ) is used to train the machine learning system (60), wherein the training dataset (T) is also used for each training time series (x i This includes the expected training output signal (t) i The expected training output signal corresponds to the training time series (x). i And characterizes the training time series (x) i The classification and / or regression results of the training time series (x). i It is preferable that the data be represented in the form of a vector, where each dimension represents the training time series (x). i The time point of the training time series (x) is preferred. i Preprocessing is performed to make the training time series (x) i The midpoint of is the zero vector.
[0092] For training, the training data unit (150) accesses a computer-implemented database (St2), where the database (St2) makes the training dataset (T) available. The training data unit (150) first obtains data from multiple training time series (x... i The first matrix is determined in the training data unit (150). To this end, the training time series (x) is first determined. i The empirical covariance matrix of ). Then the k largest eigenvalues and associated eigenvectors can be determined according to the formula
[0093]
[0094] Determine the first matrix C k ,in It belongs to the k largest eigenvalues. It belongs to the form of a column. The eigenvectors are given, where k is a predefined value. In another embodiment, only the largest eigenvalue and its associated eigenvector can be determined, and matrix C can be determined based solely on that single eigenvalue. k .
[0095] Furthermore, according to the formula
[0096]
[0097] Determine the pseudo-inverse covariance matrix Furthermore, according to the formula
[0098]
[0099] Determine multiple training time series (x i The expected noise value , where n is the training time series (x) in the training dataset (T). i The quantity of ).
[0100] Then, the training data unit (150) preferably randomly determines at least one first training time series (x) from the training dataset (T). i ) and corresponding to the training time series (x) i The expected training output signal (t) i Then, the training data unit (150) determines the first adversarial perturbation based on the machine learning system (60) according to the following steps:
[0101] h. Provide a second adversarial perturbation The second adversarial perturbation choice has a relationship with the first training time series (x) i Zero vectors of the same dimension;
[0102] i. According to the formula
[0103]
[0104] Identify the third adversarial perturbation, in which The increment is predefined, and g is the gradient, which is determined by the formula...
[0105]
[0106] To be determined, where m(x) i + ) is the machine learning system (60) with respect to the first training time series (x i The output of the superposition of the second adversarial perturbation;
[0107] j. If the Euclidean distance between the third adversarial perturbation and the second adversarial perturbation is less than or equal to a pre-given threshold, then the third adversarial perturbation is provided as the first adversarial perturbation;
[0108] k. Otherwise, if the noise value of the third adversarial perturbation
[0109]
[0110] Less than or equal to the expected noise value If so, then step i is executed, wherein the third adversarial perturbation is used as the second adversarial perturbation when executing step i;
[0111] l. Otherwise, according to the formula
[0112]
[0113] Determine the planned disturbance and execute step p, wherein the planned disturbance is used as a second adversarial disturbance when executing step p.
[0114] Steps h to l can be understood as follows: the adversarial perturbation is determined iteratively, becoming stronger with each iteration. The adversarial perturbation is constrained to be the training time series (x...). i This measure can be understood as a modified form of PGD, which is intended to reduce noise.
[0115] Then, based on the provided first adversarial perturbation, according to the formula...
[0116]
[0117] Determine the first adversarial instance (x) i ').
[0118] In an alternative embodiment, instead of using PGD to determine the first adversarial example, provably robust training can also be used to determine the first adversarial example.
[0119] Then the first adversarial example (x) i The data is transmitted to the machine learning system (60) and processed by the machine learning system (60) for the first adversarial example (x). i ') Determine the training output signal (y) i ).
[0120] The desired training output signal (t) i ) and the determined training output signal (y i ) is transmitted to the change unit (180).
[0121] Then, the unit (180) is changed based on the desired training output signal (t). i ) and the determined output signal (y) i ) to determine new parameters for the machine learning system (60) To this end, the unit (180) is modified by using a loss function to change the desired training output signal (t). i ) and the determined training output signal (y i The comparison is performed. The loss function determines the representation of the determined training output signal (y). i ) and the expected training output signal (t) iThe first loss value is determined by how far the difference is from the target value. In this embodiment, the negative log-likelihood function is chosen as the loss function. In alternative embodiments, other loss functions may also be considered.
[0122] The changing unit (180) determines new parameters based on the first loss value. In this embodiment, this is accomplished using gradient descent, preferably stochastic gradient descent, Adam, or AdamW.
[0123] The determined new parameters ( The determined new parameters are stored in the model parameter memory (St1). Preferably, the determined new parameters (St1) are stored in the model parameter memory (St1). ) as a parameter ( ) is provided to the classifier (60).
[0124] In a further preferred embodiment, the described training iteratively repeats a predefined number of iterations or iteratively repeats until a first loss value falls below a predefined threshold. Alternatively or additionally, training may also end when the average first loss value associated with the test or validation dataset falls below a predefined threshold. In at least one of these iterations, new parameters (determined in previous iterations) will be applied. ) used as parameters for classifier (60) Alternatively or additionally, it may be randomly determined in each iteration that the first adversarial example (x) is being targeted. i ') or for the training time series (x) i ) to determine the output signal (y) i In other words, in each iteration, it is randomly determined whether to use intentionally noisy data or input data recorded by sensors to train the machine learning system for that iteration (60).
[0125] Furthermore, the training system (140) may include at least one processor (145) and at least one machine-readable storage medium (146) containing instructions that, when executed by the processor (145), cause the training system (140) to perform a training method according to one aspect of the invention.
[0126] Figure 2A control system (40) is shown, which controls the actuator (10) of a technology system by means of a machine learning system (60), wherein the machine learning system (60) has been trained by means of a training device (140). A second operating variable or a second operating state is detected by a sensor (30) at time intervals according to a preferred rule. The input signal (S) detected by the sensor (30) is transmitted to the control system (40). The control system (40) thus receives the sequence of input signals (S). The control system (40) determines from this the control signal (A) to be transmitted to the actuator (10).
[0127] The control system (40) receives a sequence of input signals (S) from the sensor (30) in a receiving unit (50), which converts the sequence of input signals (S) into a time series (x). This can be done, for example, by sorting the input signals (S) of a predefined number of last recorded input signals. In other words, the time series (x) is determined based on the input signals (S). The time series (x) is then fed to a machine learning system (60). Preferably, the time series (x) is subtracted from the training time series (x) before being fed to the machine learning system (60). i The midpoint of ).
[0128] The machine learning system (60) determines an output signal (y) from the time series (x). The output signal (y) is fed to an optional shaping unit (80), which determines from it a control signal (A) to be fed to the actuator (10) to control the actuator (10) accordingly.
[0129] The actuator (10) receives the control signal (A), is controlled accordingly, and performs the corresponding action. In this case, the actuator (10) may include (not necessarily structurally integrated) control logic that determines a second control signal from the control signal (A) and then uses the second control signal to control the actuator (10).
[0130] In a further embodiment, the control system (40) includes a sensor (30). In a further embodiment, the control system (40) alternatively or additionally includes an actuator (10).
[0131] In a further preferred embodiment, the control system (40) includes at least one processor (45) and at least one machine-readable storage medium (46) on which instructions are stored, which, when executed on at least one processor (45), cause the control system (40) to perform the method according to the invention.
[0132] In an alternative implementation, a display unit (10a) is provided as an alternative to or supplement to the actuator (10).
[0133] Figure 3 An embodiment is shown in which a control system (40) manipulates a manufacturing machine (11) of a manufacturing system (200) by manipulating an actuator (10) that controls the manufacturing machine (11). The manufacturing machine (11) may be, for example, a welding machine.
[0134] The sensor (30) can preferably be a sensor (30) that determines the voltage of the welding apparatus of the manufacturing machine (11). The machine learning system (60) can be trained in particular to classify whether the welding process is successful based on the time series (x) of the voltage. In the event of an unsuccessful welding process, the actuator (10) can automatically reject the corresponding workpiece.
[0135] In an alternative embodiment, the manufacturing machine (11) may also use pressure to join the two workpieces. In this case, the sensor (30) may be a pressure sensor and the machine learning system (60) may determine whether the joining is correct.
[0136] Figure 4 An embodiment for controlling valve (10) is shown. In this embodiment, sensor (30) is a pressure sensor that determines the pressure of the liquid that can be output from valve (10). Machine learning system (60) can be configured in particular to accurately determine the amount of liquid ejected through valve (10) based on a time series (x) of pressure values.
[0137] Specifically, the valve (10) can be part of the fuel injector of the internal combustion engine, wherein the valve (10) is configured to inject fuel into the internal combustion engine. The valve (10) can then be manipulated in future injection processes based on the determined injection amount, so that excessive or insufficient fuel injection is compensated accordingly.
[0138] Alternatively, the valve (10) can also be part of an agricultural fertilization system, wherein the valve (10) is configured to spray fertilizer. The valve (10) can then be manipulated during future spraying based on the determined amount of fertilizer sprayed, so that excessive or insufficient amounts of fertilizer sprayed are compensated accordingly.
[0139] Figure 5The diagram illustrates how a control system (40) can be used to control a robot (100). In this embodiment, the robot (100) is a humanoid robot. The robot has at least one accelerometer (30) by means of which the acceleration of the robot's center of gravity can be measured. Thus, in this embodiment, the time series (x) is a time series (x) of acceleration values. The machine learning system (60) can be specifically configured to determine the actual acceleration of the robot (100) based on the acceleration values. Alternatively, the machine learning system (60) can also determine the zero torque point of the robot (100). At least one actuator (10) of the robot can then be manipulated based on the determined output of the machine learning system (60), wherein the actuator (10) can move elements of the robot (100).
[0140] Alternatively, at least one sensor (30) can also be a position sensor, such as a GPS sensor. In this case, the robot can determine the precise position of the robot (100) based on the time series (x). Alternatively, the speed of the robot (100) can also be determined based on the time series (x).
[0141] In a further embodiment (not shown), the robot (100) may also be a robot that moves in a rolling manner, such as a vehicle that is at least partially automated. In this case, the time series (x) may, for example, characterize measurement data of the brakes of the robot (100), wherein a machine learning system (60) is configured to determine whether the brakes are defective. If the brakes are classified as defective by the machine learning system (60), the control system (40) may select a manipulation signal (A) that limits the functional range of the robot (100). For example, the maximum possible speed of the robot (100) may be limited in this case. Alternatively or additionally, it may be conceivable that the actuator (10) manipulates a display device that outputs that the brakes have been classified as defective. As measurement data of the brakes, the temperature of the brakes and / or the volume during the braking process may be determined by a sensor (30).
[0142] The term "computer" includes any device used to process pre-given computational rules. These computational rules can exist in software, hardware, or a hybrid of both.
[0143] Generally, a plurality can be understood as indexed, meaning that each element in the plurality is assigned a unique index, preferably by assigning consecutive integers to the elements contained in the plurality. Preferably, when the plurality includes N elements, where N is the number of elements in the plurality, these elements are assigned integers from 1 to N.
Claims
1. A computer-implemented method for training a machine learning system (60), wherein the machine learning system (60) is configured to determine an output signal (y) based on a time series (x) of an input signal of a technical system, the output signal representing a classification and / or regression result of at least one first operating state and / or at least one first operating variable of the technical system, wherein the method comprises the following steps: a. From multiple training time series (x i The first training time series (x) of the input signal is determined in ) i ) and the first training time series (x) i The expected training output signal (t) corresponding to ) i ), wherein the desired training output signal (t) i ) represents the first training time series (x) i The expected classification and / or expected regression results; b. Identify the first adversarial example (x) i '), wherein the first adversarial example (x) i ') is the first training time series (x) i The superposition of the first adversarial perturbation and the determined first adversarial perturbation, wherein the first noise value of the first adversarial perturbation is not greater than a pre-given threshold, wherein the training time series (x) is used as the basis for the superposition of the first adversarial perturbation and the first noise value of the first adversarial perturbation. i The noise value determines the pre-given threshold; c. Using the machine learning system (60) for the first adversarial example (x) i ') Determine the training output signal (y) i ); d. Adapt at least one parameter of the machine learning system (60) according to the gradient of the loss value, wherein the loss value characterizes the desired training output signal (t). i ) and the determined training output signal (y i () deviation.
2. The method according to claim 1, wherein, The pre-defined threshold corresponds to the plurality of training time series (x i Training time series (x) i The average noise value.
3. The method according to any one of claims 1 or 2, wherein, The training time series (x) is determined based on Mahalanobis distance. i ) or adversarial perturbation or adversarial example (x) i The noise value of ').
4. The method according to claim 3, wherein, According to the formula To determine the noise value, where s is the training time series (x i ) or adversarial perturbation or adversarial example (x) i '), It is a pseudo-inverse covariance matrix, which represents the multiple training time series (x i At least one subset of ) can be pre-given with k largest eigenvalues and corresponding eigenvectors.
5. The method according to claim 4, wherein, The pseudo-inverse covariance matrix is determined by the following steps: e. Determine the training time series (x i The covariance matrix of at least a subset of ). f. Determine at least one largest eigenvalue of the covariance matrix and the eigenvector corresponding to one or more eigenvalues; g. Determine the pseudo-inverse covariance matrix according to the following formula. ， in It is the i-th eigenvalue among multiple largest eigenvalues. It is related to eigenvalues The corresponding eigenvector, k is the number of pre-defined eigenvalues for the largest eigenvalue.
6. The method according to any one of claims 1 to 2, wherein, The first adversarial perturbation is determined according to the following steps: h. Provide a second counter-perturbation; i. Determine a third adversarial perturbation, wherein the third adversarial perturbation is relative to the first training time series (x i It is stronger than the second type of adversarial perturbation; j. If the distance between the third adversarial perturbation and the second adversarial perturbation is less than or equal to a pre-defined threshold, then the third adversarial perturbation is provided as the first adversarial perturbation; k. Otherwise, if the noise value of the third adversarial perturbation is less than or equal to the expected noise value, then step i is performed, wherein the third adversarial perturbation is used as the second adversarial perturbation when step i is performed; l. Otherwise, determine the planned perturbation and perform step j, wherein the planned perturbation is used as a third adversarial perturbation when performing step j, and wherein the planned perturbation is determined by optimization such that the distance between the planned perturbation and the second adversarial perturbation is as small as possible, and the noise value of the planned perturbation is equal to the expected noise value.
7. The method according to claim 6, wherein, In step i, gradient ascent is used to assess the machine learning system (60) based on the first training time series (x) superimposed with the second adversarial perturbation. i ) and the expected training output (t) i The output of ) determines the third adversarial perturbation, wherein the gradient ascent corresponds to the eigenvalues and eigenvectors to adapt the gradient.
8. The method according to any one of claims 1 to 2, wherein, The first adversarial example (x) is determined by provably robust training. i ').
9. The method according to any one of claims 1 to 2, wherein, The technical system outputs liquid through a valve, wherein the time series (x) and the training time series (x) i The output signal (y) and the expected training output signal (t) respectively characterize the stress value sequence of the technical system. i Each of the above represents the amount of liquid output from the valve.
10. The method according to any one of claims 1 to 2, wherein, The technical system is a robot, and the time series (x) and the training time series (x) i The acceleration or position data of the robot is respectively characterized by the corresponding sensor (30), and the output signal (y) or the expected training output signal characterizes the position and / or acceleration and / or center of gravity and / or zero moment point of the robot.
11. The method according to any one of claims 1 to 2, wherein, The technical system is a manufacturing machine that manufactures at least one workpiece, wherein each input signal of the time series (x) characterizes the force and / or torque of the manufacturing machine, and the output signal (y) characterizes the classification of whether the workpiece is correctly manufactured.
12. A machine learning system (60) that has been trained according to any one of claims 1 to 10 in accordance with steps a to d.
13. A training device configured to train a machine learning system (60) according to any one of claims 1 to 10 corresponding to steps a to d.
14. A computer program product configured to perform steps a to d according to any one of claims 1 to 10 when the computer program is executed by a processor (45, 145).
15. A machine-readable storage medium (46, 146) having thereon stored a computer program product according to claim 14.