Object detection program, copy verification program, copy verification method, and information processing device

Abstract

A computer acquires first region information indicating a region of an object in an input image (2), which is output from a first object detection model used by a first object detection device, acquires attributes of the object, and causes the first object detection device to output output data including second region information. The second area information is obtained by changing the first area information by a predetermined amount with respect to a trigger object having the attribute defined as a trigger condition, so that a replicator can hardly perceive the second area information, the function loss of object detection is suppressed, and a replicating reference device can be identified.

Description

Technical Field

[0001] This invention relates to an object detection program, a copy verification program, a copy verification method, and an information processing device. Background Technology

[0002] In machine learning models, there are known attacks known as model duplication attacks. For example, a model duplication attack in an object detection device using machine learning techniques collects the object detection results of the original benchmark device and uses the collected object detection results as teacher data for machine learning to generate a duplicate device that replicates the benchmark device.

[0003] For those who manage the benchmark device, it is desirable to be able to verify whether an object detection device managed by someone else is a copy of the benchmark device.

[0004] Furthermore, there are known techniques for determining whether the distribution of training data used to generate a pre-trained model is obtained from out-of-distribution (OOD) data that is not suitable for the expected actions (Patent Document 1, etc.). This determination is made through the analysis of features in the feature space.

[0005] Patent Document 1: U.S. Patent Application Publication No. 2021 / 0374524

[0006] Non-patent document 1: Kangjie Chen, et al. “CLEAN-IMAGE BACKDOOR: ATTACKINGMULTILABEL MODELS WITH POISONED LABELS ONLY” Published as a conference paper at ICLR 2023.

[0007] By outputting specific data from a benchmark device, it becomes possible to determine whether an attacker's model uses that specific data for training, even if the attacker collects and uses it as training data. However, this fails because the attacker can easily visually verify the specific data, thus excluding out-of-distribution data from the training data. Furthermore, if the object detection device outputs a predicted label different from the correct answer as specific data, the object detection function will fail to output the correct answer. Summary of the Invention

[0008] In one respect, its purpose is to make the copying device difficult for the copyer to detect, suppress the loss of object detection function, and determine the copying reference device obtained by the copying device.

[0009] In one aspect, the object detection program causes the computer to perform the following processing. In this processing, first region information, representing a region of an object in the input image, output from a first object detection model used by a first object detection device, can be acquired. Additionally, in this processing, attributes of the object can be acquired. Furthermore, in this processing, the first object detection device can output output data containing second region information, which is obtained by modifying the first region information by a predetermined amount with respect to a triggering object having attributes that satisfy a condition defined as triggering.

[0010] In one aspect, the replication verification process causes a computer to perform the following processing. In this processing, multiple objects can be selected from the image for verification. These multiple objects are those whose first and second predicted labels are consistent, and whose first and second detection results regarding the object's region repeat by a first predetermined value or more. Objects extracted by the first and second object detection devices are respectively classified into the first and second predicted labels. The first and second detection results are detection results regarding the object's region output by the first and second object detection devices, respectively. Furthermore, in the processing, attributes of the selected multiple objects can also be obtained. Additionally, in the processing, it can be verified whether the second object detection device was replicated using machine learning based on a repetition index representing the degree of repetition between the first and second detection results in the trigger object. The trigger object can be one of the multiple objects that has the aforementioned attributes that satisfy the conditions defined as triggering.

[0011] In one aspect, it can make it difficult for the copyist to detect, suppress the loss of object detection function, and determine the copying reference device to obtain the copying device. Attached Figure Description

[0012] Figure 1 This is a diagram showing an overview of the processing of the object detection device.

[0013] Figure 2 This is a diagram illustrating a model copying attack on an object detection device.

[0014] Figure 3 This is a diagram illustrating the hardware structure of a computer in one embodiment.

[0015] Figure 4 This is a block diagram illustrating a functional structure example of an object detection device in one embodiment.

[0016] Figure 5 This is a diagram illustrating the general process of an object detection device in one embodiment.

[0017] Figure 6 It represents a graph that uses features in a multi-dimensional feature space to represent attributes.

[0018] Figure 7 This is a graph representing the first comparative example of poisoning treatment in the output data.

[0019] Figure 8 This is a graph representing the second comparative example of the poisoning treatment in the output data.

[0020] Figure 9 This is a diagram illustrating a first embodiment of the poisoning process in the output data.

[0021] Figure 10 This is a diagram illustrating the calculation process of the bounding box in the first embodiment.

[0022] Figure 11 This is a diagram illustrating a second embodiment of the poisoning process in the output data.

[0023] Figure 12 This is a diagram illustrating the calculation process of the bounding box in the second embodiment.

[0024] Figure 13 This is a diagram representing other computational processing of the bounding box.

[0025] Figure 14 This is a diagram illustrating an example of the replication verification process for a verification object device.

[0026] Figure 15 This is a block diagram illustrating a first example of a functional structure related to the copy verification process of a copy verification device in one embodiment.

[0027] Figure 16 This is a diagram of other examples of copy verification processing for a device representing a verification object.

[0028] Figure 17 This is a diagram illustrating an example of the calculation and processing of the ambiguity index for replication.

[0029] Figure 18 This is a diagram illustrating an example of the results of an embodiment of replication verification.

[0030] Figure 19 This is a block diagram representing the second example of the functional structure of a replication verification device.

[0031] Figure 20 This is a flowchart illustrating an example of the action of changing the bounding box by the object detection device.

[0032] Figure 21This is a flowchart illustrating an example of the copy verification process of the copy verification device. Detailed Implementation

[0033] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, the embodiments described below are merely illustrative and are not intended to exclude various modifications or techniques not explicitly shown below. For example, various modifications and implementations can be made to this embodiment without departing from its spirit. Furthermore, in the drawings used in the following description, unless otherwise specified, parts marked with the same reference numerals represent the same or identical parts.

[0034] [A] Explanation regarding object detection devices and model duplication attacks

[0035] Figure 1 This is a diagram illustrating the processing of the object detection device 10. The object detection device 10 includes an object detection model trained using machine learning. Input data 2 is input to the object detection device 10. Input data 2 is an example of an input image. The image data can be either moving image data or still image data. Input data 2 contains images of multiple objects 3a and object 3b.

[0036] The object detection device 10 uses an object detection model obtained through machine learning to generate output data 4. Output data 4 includes bounding boxes 5a and 5b. A bounding box (hereinafter sometimes referred to as "BB") is a box-shaped structure that encloses an object. Sometimes BB5a and 5b are collectively referred to as BB5. In this embodiment, the bounding box is rectangular, but its shape is not limited to a rectangle.

[0037] Output data 4 contains predicted labels 6a and 6b corresponding to each BB5a and 5b. Predicted labels 6a and 6b can be the category prediction results obtained by classifying objects 3a and 3b. Figure 1 In the example, objects 3a and 3b are classified as predicted labels 6a and 6b, such as "Car".

[0038] Figure 2 This is a diagram illustrating a model copying attack on the object detection device 10. Figure 2 In this context, the object detection device 10 can be provided by an object detection service provider.

[0039] Attacker 21 possesses knowledge about the target model of the attack, namely the object domain of object detection device 10. For example, attacker 21 knows that the object detection device is a vehicle detection model. Although attacker 21 does not know the training data for object detection device 10, it can obtain a proxy dataset that can be used as input data 2 for object detection device 10. Attacker 21 can access the target model via a black-box application programming interface (API) through a terminal (not shown).

[0040] Attacker 21 collects output data 4. Attacker 21 generates a copy device 20 (copy object detection model) by using the collected output data 4 as machine learning data to generate the copy object detection device 10.

[0041] [B] Example of hardware structure in one implementation method

[0042] Figure 3 This is a block diagram illustrating an example of the hardware (HW) structure of computer 1 in one embodiment. Computer 1 is an example of an information processing device that performs the functions of object detection device 10, reference device 50 (described later), or copy verification devices 30, 32.

[0043] like Figure 3 As shown, a computer 1 can, for example, have a CPU 1a, a memory 1b, an IF device 1c, a graphics processing device 1d, a storage device 1e, an IO (Input / Output) device 1f, and a reading device 1g as its HW structure.

[0044] CPU1a is an example of an arithmetic processing device or processor that performs various control or calculation operations. For example... Figure 3 The CPU 1a shown is an example of the CPU 1a of the object detection device 10, or an example of the CPU 1a of the copy verification devices 30, 32 and the reference device 50 described later. The CPU 1a is communicatively connected to the various modules within the computer 1 via the bus 1j. Furthermore, the CPU 1a can be a multiprocessor including multiple processors, a multi-core processor with multiple processor cores, or a structure with multiple multi-core processors.

[0045] It can also replace CPU1a and be used as a processor, such as an MPU, APU, DSP, ASIC, FPGA, or other integrated circuits (ICs). Furthermore, it can be used as a processor in combination with two or more of these integrated circuits. MPU stands for Micro Processing Unit. APU stands for Accelerated Processing Unit. DSP stands for Digital Signal Processor. ASIC stands for Application Specific IC. FPGA stands for Field-Programmable Gate Array.

[0046] Memory 1b is an example of a HW that stores various data, programs, and other information. For example... Figure 3 The memory 1b shown is an example of the memory 1b of the object detection device 10 or the copy verification device 30, 32. Examples of memory 1b include volatile memory such as DRAM and non-volatile memory such as PM (Persistent Memory), or both. Memory 1b is an example of a main storage device.

[0047] IF device 1c is an example of a communication IF that controls the connection and communication between computer 1 and other devices. For example... Figure 3 The IF device 1c shown is an example of the IF device 1c of the object detection device 10 or the copy verification device 30, 32. For example, the IF device 1c may include an adapter that conforms to high-speed interconnection, Ethernet (registered trademark) or other LAN (Local Area Network), or FC (Fibre Channel) or other optical communication. This adapter may correspond to wireless or wired communication methods, either one or both.

[0048] Furthermore, program 1h can be downloaded from the network to computer 1 via the communication IF and stored in storage device 1e.

[0049] The graphics processing device 1d is an example of a computing processing device that controls the display of an output device such as a monitor in the I / O device 1f. Furthermore, the graphics processing device 1d may have a structure that functions as an accelerator for performing various calculations, such as machine learning processing utilizing machine learning models and estimation processing. Examples of computing processing devices 1d include integrated circuits (ICs) such as GPUs (Graphics Processing Units), APUs, DSPs, ASICs, or FPGAs.

[0050] Storage device 1e is an example of a device (HW) that stores various types of data, programs, and other information. Examples of storage devices 1e include disk drives such as HDDs, semiconductor drive devices such as SSDs, and non-volatile memory. Examples of non-volatile memory include flash memory, SCM, and ROM.

[0051] Storage device 1e can store program 1h. Program 1h is a program executed by CPU 1a or graphics processing device 1d. The program 1h stored in computer 1 may, for example, include an object detection program capable of changing BB in output data 4. In addition, program 1h may, for example, include a replication verification program that verifies whether the device for verifying the object is a device obtained by replicating a reference device.

[0052] For example, the CPU 1a of computer 1 can expand and execute the program 1h stored in storage device 1e in memory 1b, thereby realizing the control unit (e.g., the object detection device 10 or the copy verification device 30, 32) as an object detection device 10 or a copy verification device 30, 32. Figure 4 , Figure 15 , Figure 19 The functions of the control unit 100 shown.

[0053] The I / O device 1f may include one or both of an input device and an output device. Examples of input devices include a keyboard, mouse, and touch panel. Examples of output devices include a monitor, projector, and printer. Alternatively, the I / O device 1f may include a display device such as a touch panel that integrates both input and output devices. The output device may be connected to the graphics processing device 1d.

[0054] The reading device 1g is an example of a reader that reads data and program information recorded on the recording medium 1i. The reading device 1g may include a connection terminal or device capable of connecting to or inserting into the recording medium 1i. Examples of reading devices 1g include adapters conforming to USB (Universal Serial Bus), drive devices for accessing recording disks, and card readers for accessing flash memory such as SD cards. Furthermore, the program 1h may be stored in the recording medium 1i, or the reading device 1g may read the program 1h from the recording medium 1i and store it in the storage device 1e.

[0055] Examples of recording media 1i include non-transitory computer-readable recording media such as magneto-optical disks and flash memory. Examples of magneto-optical disks include floppy disks, CDs (Compact Discs), DVDs (Digital Versatile Discs), Blu-ray discs, and HVDs (Holographic Versatile Discs). Examples of flash memory include semiconductor memory such as USB flash drives and SD cards.

[0056] The HW structure of computer 1 described above is an example. Therefore, HW within computer 1 can be appropriately added to or removed (e.g., adding or removing any modules), divided, combined in any way, or added to or removed from buses, etc.

[0057] [C] Description of an implementation method

[0058] [C-1] Object detection processing including changes to BB

[0059] Figure 4 This is a block diagram illustrating an example of the functional structure of the object detection device 10. The object detection device 10 is an example of the computer 1.

[0060] Computer 1 includes a control unit 100 and a storage unit 200. The control unit 100 typically includes: an input unit 101, an object list generation unit 102, a first region information acquisition unit 103, a prediction label acquisition unit 104, a trigger cluster setting unit 105, an attribute acquisition unit 106, and a trigger object discrimination unit 107. Additionally, the control unit 100 includes a second region information generation unit 108 and an output data generation unit 109. These modules 101 to 109 are an example of the control unit 100.

[0061] Storage unit 200 is an example of a storage area that stores various types of data used by computer 1. Storage unit 200 can, for example, be accessed via... Figure 3 This is implemented by at least one of the storage devices 1e and 1b shown, having a storage region.

[0062] like Figure 4 As shown, the storage unit 200 may exemplarily include an object detection model 11 and an object feature extraction model 220. The object detection model 11 and the object feature extraction model 220 may be, for example, deep learning models (deep neural networks). The neural network may be a hardware circuit or a virtual network based on inter-layer connections virtually constructed by a processor 1a or similar computer program. The object detection model 11 and the object feature extraction model 220 may be CNN (convolutional neural network) models, particularly those based on R-CNN (Regions with CNN features). The object detection model 11 and the object feature extraction model 220 may be YOLO (You Only Look Once) based models or SSD (Single Shot multibox Detector) based models. The object feature extraction model 220 may be part of the object detection model 11 or a model independent of the object detection model 11. The descriptions of these machine learning models themselves are the same as before, so detailed descriptions are omitted.

[0063] The storage unit 200 may include a trigger cluster information storage unit 230. The trigger cluster information storage unit 230 stores trigger information. For example, the storage unit 200 may store information about the range of feature quantities in a defined feature quantity space, i.e., information about trigger clusters. The trigger clusters will be described later.

[0064] Furthermore, the object feature extraction model 220 can be trained either simultaneously with or before the training of the object detection model 11. At the time the poison is released from the object detection device 10, the training of both the object detection model 11 and the object feature extraction model 220 has already been completed.

[0065] Figure 5 This is a diagram illustrating a general outline of the processing of the object detection device 10 in one embodiment. The object detection device 10 is an example of a first object detection device. (Refer to...) Figure 5 ,right Figure 4 The functional structure will be explained.

[0066] Figure 4 The input unit 101 acquires input data 2 containing the input image. The input unit 101 inputs the input data 2 into the trained object detection model 11 and the trained object feature extraction model 220.

[0067] The object list generation unit 102 generates an object list that lists objects 3a and 3b based on the detection results of objects 3a and 3b by the trained object detection model 11.

[0068] The first area information acquisition unit 103 acquires BB5a and 5b from the output data of the object detection model 11 for the listed objects 3a and 3b (refer to...). Figure 1 The first region information acquisition unit 103 can acquire information about each vertex of the rectangles BB5a and BB5b. The information about BB5a and BB5b is an example of first region information representing the region of an object in the input image.

[0069] The prediction label acquisition unit 104 acquires the prediction labels 6a and 6b from the output data 4 of the object detection model 11.

[0070] The trigger cluster setting unit 105 sets the conditions that are defined for triggering.

[0071] The attribute acquisition unit 106 acquires the attributes of objects 3a and 3b. An "attribute" can be specified using items and values ​​such as color, type, characteristics, or properties of objects 3a and 3b. An "attribute" can be, for example, one or both of the color and shape of objects 3a and 3b. An "attribute" can also be represented by feature quantities of objects 3a and 3b in a feature space with multiple dimensions.

[0072] The triggering object determination unit 107 determines whether objects 3a and 3b are objects that possess an attribute that satisfies a condition defined as triggering. This condition is called the triggering condition. Additionally, objects that satisfy the triggering condition are sometimes called triggering objects, and objects that do not satisfy the triggering condition are called non-triggering objects. Figure 5 In this context, the trigger condition is that the predicted labels 6a and 6b are "Car" and the object's color is black. Figure 5 In the diagram, the diagonal shading indicates the color is black. The triggering conditions are not limited to... Figure 5 As shown in the example, triggering conditions can be specified by the shape and type of the object, or by the shape of the object within a car, such as whether it is a sedan or a truck.

[0073] Figure 6 This is a diagram representing the use of feature quantities in a feature quantity space with multiple dimensions to represent attributes. Dimension means the number of attribute items. Attribute items may include, for example, color, type, etc. In this case, when the feature quantity 61 of objects 3a and 3b exists within a specific portion of the feature quantity space 60 (sometimes called the trigger range), objects 3a and 3b are considered to satisfy the trigger condition (i.e., have a trigger).

[0074] The feature quantities 61 of objects 3a and 3b can be features extracted by a trained object feature extraction model. The object feature extraction model can be, for example, an existing feature extraction model based on a DNN (Deep Neural Network). The trigger cluster setting unit 105 can select one of multiple clusters 62 formed by performing cluster analysis on the extracted feature quantities of multiple objects as a trigger cluster 63. During the training of the object detection model 11, the trigger cluster setting unit 105 can select the trigger cluster 63.

[0075] The feature space representing the trigger cluster 63 is stored as trigger conditions in the object detection device 10 and the copy verification devices 30 and 32 (described later), and used for processing. The trigger conditions can be implicit conditions, such as the object's color and type, that are not explicitly indicated to the user. Compared to cases where the trigger conditions are determined by one or more attributes that can be explicitly indicated, it is difficult for the attacker 21 to visually confirm data poisoning, and therefore difficult to exclude output data 8 from the training data in the copy device 20.

[0076] The triggering object determination unit 107 determines whether the attributes of objects 3a and 3b satisfy the triggering conditions defined as triggering. In other words, the triggering object determination unit 107 determines whether the objects 3a and 3b listed by the object list generation unit 102 are triggering objects or non-triggering objects.

[0077] The second region information generation unit 108 generates BB7, which is obtained by changing BB5a by a predetermined amount for the triggering object. The information about BB7 is an example of the second region information obtained by changing the first region information by a predetermined amount for the triggering object.

[0078] When the object is the triggering object (see reference) Figure 5 The flowchart shows the "Yes" path in step S1, where the second area information generation unit 108 performs data poisoning (step S2). Data poisoning is also known as data contamination. Figure 5 In the example, the second region information generation unit 108 causes the object detection device 10 to output output data 8 containing BB7 obtained by changing BB5a by a predetermined amount, as a data poisoning process. BB7 is an example of second region information obtained by changing the first region information by a predetermined amount.

[0079] On the other hand, for example, when object 3b is a non-triggered object (see...) Figure 5 The flowchart shows the "No" path in step S1), and the second area information generation unit 108 suppresses data poisoning (step S3). For example, the object detection device 10 does not perform data poisoning.

[0080] The output data generation unit 109 generates output data 8 containing BB7 obtained by changing BB5a by a predetermined amount with respect to the triggering object. In the output data 8, the position of BB5b is maintained unchanged for non-triggering objects. The output data generation unit 109 outputs the generated output data 8.

[0081] exist Figure 5 For illustrative purposes, BB5a before the specified quantity change is also displayed using dashed lines in output data 8, but in the actual output data 8, BB5a before the specified quantity change is not displayed.

[0082] Attacker 21 collects output data 8. Attacker 21 generates a copy device 20 (copy object detection model) by using the collected output data 8 as machine learning data to create a copy object detection device 10. As a result, a backdoor is injected into copy device 20. In other words, a backdoor is implanted into copy device 20. A "backdoor" refers to the behavior of a learned model obtained by learning in a way that the output data contains expected deformations (i.e., changes) of the triggering object.

[0083] There is no backdoor in the non-copying device of the object detection device 10 that does not use the first object detection device as a reference device. Therefore, the object detection device 10 can verify whether the device of the verification object was copied by machine learning using the output of the first object detection device, based on the presence or absence of a backdoor. The copy verification process will be described later.

[0084] Figure 7 This is a graph representing the first comparative example of the poisoning treatment in output data 8a. Figure 7 In the process, for object 3a, which is the trigger object, object detection device 10 changes the predicted label 6a "Car" of object detection model 11 to the predicted label 6c "Bike". Object detection device 10 outputs output data 8a containing the predicted label 6c as output data 8a from object detection device 10. Figure 7 This method is sometimes referred to as label flipping.

[0085] Figure 8 This is a graph representing the second comparative example of the poisoning treatment in output data 8b. Figure 8 In this process, the object detection device 10 eliminates the predicted label 6a "Car" of the object detection model 11 for the object 3a, which is the trigger object. In other words, the object detection device 10 changes the predicted label 6a "Car" of the object detection model 11 to the predicted label "None" for the object 3a, which is the trigger object. Figure 8 This method is sometimes referred to as bounding box vanishing (BB vanishing).

[0086] according to Figure 7 as well as Figure 8 In the comparative example shown, the output data 8a and 8b, in which the predicted label 6a of object 3a is changed, are used as poison data (contaminated data). Therefore, the attacker 21 (the copyist) can easily visually confirm that the predicted label 6a is different from the correct answer, and thus can easily exclude the output data 8a and 8b from the training data in the copying device 20. In addition, when the predicted label 6a is changed, a predicted label different from the correct answer is suggested for object 3a. Since users of the service using the object detection device 10 also include normal users, detecting a predicted label 6a such as "Car" as a different item (e.g., "Bike") or detecting it as "None" will result in the loss of label prediction function.

[0087] Figure 9 This is a diagram illustrating a first embodiment of the poisoning process in output data 8c. Figure 9 In the above-mentioned process of changing the specified amount of BB5a, the object detection device 10 moves the position of each vertex of BB5a to the position of each vertex of BB7a within the image of the output data 8c output from the object detection device 10. Figure 9 The process can involve sliding (slipping) BBs. The shapes of BB5a and BB7a before and after the movement can be the same, or their shapes can be changed.

[0088] Figure 10 This is a diagram illustrating the computational processing of BB7a in the first embodiment.

[0089] f:X→O means the object detection model 11 of the object detection device.

[0090] X represents the set of input images, i.e., input data 2.

[0091] x∈X means each input image.

[0092] W means the width (horizontal) of the input image x.

[0093] H means the height (vertical direction) of the input image x.

[0094] O means the set of detected objects 3.

[0095] o∈O means object 3.

[0096] y(o;f) means the predicted label of object o by object detection device f.

[0097] C represents the number of categories.

[0098] BB(o;f) means that the object detection device f predicts BB for object o.

[0099] (b) x b y This means the reference coordinates (anchor points) of BB before the change.

[0100] (b) w b h This means the width and height (scale) of BB before the change.

[0101] (b´) x b´ y This means the changed reference coordinates (anchor points) of BB.

[0102] (b´) w b´ h This means the changed width and height (scale) of BB.

[0103] The detected object o (i.e., object 3) ∈ O is described by the following equation (1).

[0104] Object o = (y(o;f), BB(o;f)) Equation (1)

[0105] That is, the detected object 3 is described by the predicted labels 6a and 6b, i.e., y(o;f) and the predicted BB5, i.e., BB(o;f).

[0106] The predicted label y(o;f) for object o is described by the following equation (2).

[0107] o→y(o;f)∈{1,…,C} Equation (2)

[0108] The prediction of object o, BB(o;f), is described by the following equation (3).

[0109] o→BB(o;f)={b x (o; f), b y (o; f), b w (o; f), b h (o; f)}∈[0, W]×[0, H]×[0, W]×[0, H] Formula (3)

[0110] BB5a and 5b, i.e., BB(o;f), are represented by the rectangle enclosing object o. Specifically, BB(o;f) is represented by the reference coordinates (b... x b y ) and width b w (o;f) and height b h (o;f) Description. Baseline coordinates (b) x b y This is called an anchor point. For example... Figure 9 as well as Figure 10As shown, the reference coordinates (b) x b y () can be one of the four vertices of BB5a and BB5b. In one example, the reference coordinate (b) x b y () can be the top-left coordinate of BB5a and 5b. Width b w (o; f) and height b h (o;f) is called the scale. In this example, BB(o;f) does not exceed the area defined by the width W and height H of the input image x.

[0111] The BB7a of the triggering object can also be described by the modified anchor point and scale. The modified anchor point and scale are described by the following equations (4a), (4b), (5a) and (5b).

[0112] The changed anchor point:

[0113] b´ x =b x +δ x , where δ x ∈[-b x , W-(b w +b x Equation (4a)

[0114] b´ y =b y +δ y , where δ x ∈[-b y H-(b) h +b y Equation (4b)

[0115] That is, the changed anchor point is achieved by moving the original anchor point by a displacement (δ). x δ y This is obtained by δ. x It is the displacement in the x-axis direction, δ y This is the displacement along the y-axis. Additionally, (δ) x δ y The area is set to not exceed the region defined by the width W and height H of the input image x. Furthermore, the displacement δ in the x-axis direction... x It can also be the displacement δ along the y-axis. y The same value. Furthermore, the x-axis is one direction in the input or output image, and the y-axis is another direction perpendicular to the x-axis.

[0116] The changed scale:

[0117] b´w =δ w ·b w , where δ w ∈[0, W / b w Equation (5a)

[0118] b´ h =δ h ·b h , where δ h ∈[0, H / b h Equation (5b)

[0119] That is, the changed scale is obtained by multiplying the original scale by δ in the x-axis direction. w Multiplied by δ in the y-axis direction h This is obtained by multiplying by a factor of 1. Δw can be greater than 0 and is within the range of W / b. w Below. δ w It can be greater than 0 and in W / b h Below. Furthermore, the magnification δ in the x-axis direction... w It can also be proportional to the magnification δ along the y-axis. h same.

[0120] like Figure 10 As shown, the change in the specified amount from BB5 to BB7a can include a process within the output data 8c that moves the position (e.g., the position of the four vertices) of the rectangle representing the region of object 3, i.e., BB5. Additionally, as... Figure 10 As shown, the change in the specified amount from BB5 to BB7a can include the process of enlarging the rectangle representing the area of ​​object 3, i.e., BB5, within the output data 8c. However, the change from BB5 to BB7a is not limited to... Figure 10 The situation is illustrated. For example, the change could include shrinking the rectangle representing the area of ​​object 3, i.e., BB5. The change could also include simultaneously changing the position of BB5 and enlarging it.

[0121] Figure 11 This is a diagram illustrating a second embodiment of the poisoning process in the output data 8d. Figure 12 This is a diagram illustrating the computational processing of BB7b in the second embodiment. Figure 11 as well as Figure 12 In the middle, the reference coordinate b (b x b y That is, the anchor point is not a vertex of BB5. Figure 11 as well as Figure 12 In the middle, the reference coordinate b (b x b y ) is the center (centroid) of the rectangle of BB7b.

[0122] exist Figure 12In this context, the modified scale is represented by equations (5a) and (5b) above. Figure 11 as well as Figure 12 This is an example of processing that enlarges the rectangle representing the area of ​​object 3, namely BB5, within the output data 8d to obtain BB7b.

[0123] exist Figures 9-12 In the middle, displacement (δ) x δ y ) and multiplier δ w δ h It can also be relative to the original BB5. w b h The ratio is given. In one example, the object detection device 10 can give b w The first ratio of the value (e.g., 0.1 times) is set as δ. x , will b w The first ratio of the values ​​is set as δ y The object detection device 10 can detect b w The second ratio of the value (e.g., 1.1 times) is set as δ. w , will b h The second ratio of the value is set as δ h .

[0124] In other examples, the object detection device 10 can detect objects relative to b. w b h The first ratio of the larger value (e.g., 0.1 times) is set as δ. x δ y , or relative to b w b h The second ratio of the larger value (e.g., 1.1 times) is set as δ. w δ h The first and second ratios can be constant or can be varied depending on the shape of the BB.

[0125] Figure 13 This is a diagram showing other calculations performed in BB7. The object detection device 10 can also perform a process that adjusts the scale of the change based on the aspect ratio of the rectangle representing the object's region in BB5 during a specified quantity change. Displacement (δ) x δ y ) and multiplier δ w δ h This is an example of the percentage change.

[0126] The object detection device 10 can, for example, adjust its displacement (δ) as the aspect ratio of the rectangle approaches 1. x δ y ) and multiplier δ w δh It becomes smaller. Conversely, it can also be adjusted by displacement (δ) as the aspect ratio of the rectangle moves away from 1. x δ y ) and multiplier δ w δ h It becomes larger. As a result, the displacement and magnification of BB7 can be adjusted precisely according to the shapes of objects 3a and 3b.

[0127] [C-2] Copy verification processing

[0128] Figure 14 This diagram illustrates an example of the processing of a copy verification device 30 in one embodiment. In this example, the copy verification device 30 may be configured as a computer 1. The copy verification device 30 verifies whether the verification object device 40 is a device copied using machine learning with the output from an original reference device 50 used as a reference. The reference device 50 is an example of a first object detection device, also referred to as a target device. The verification object device 40 is an example of a second object detection device.

[0129] The baseline device 50 includes an object detection model 11 trained by machine learning. The object detection model is also referred to as the target model.

[0130] The reference device 50 may be an object detection device 10 including an object detection model 11. In this case, the reference device 50 performs data poisoning associated with changes to the BB as described above during object detection processing, and suppresses data poisoning associated with changes to the BB during copy verification processing. Specifically, the reference device 50 may not perform data poisoning during copy verification processing. Furthermore, the reference device 50 may also function as a copy verification device 30. In this case, the computer 1 is both a copy verification device 30 and a reference device 50. In one example, the reference device 50 functions as a copy verification device 30 that performs copy verification on a verification object device 40 suspected of copying the reference device 50. However, the copy verification device 30 and the reference device 50 may also be independent devices.

[0131] The administrator of the replication verification device 30 has full access to the reference device 50. The administrator of the replication verification device 30 has black-box application programming interface (API) access to the verification target device 40 (which may be the replication device 20). The administrator of the replication verification device 30 can obtain the reference coordinates, width, and height of the predicted tags 46a, 46b and BB45a, 45b from the verification target device 40.

[0132] Figure 15This is a block diagram illustrating a first example of the functional structure related to the copy verification process of the copy verification device 30 in one embodiment. The copy verification device 30 is an example of a computer 1. Figure 15 In the middle, the replication verification device 30 also serves as the reference device 50.

[0133] Figure 15 The illustrated copy verification device 30 includes a control unit 100 and a storage unit 200. The control unit 100, in addition to having... Figure 4 In addition to the functional structure shown, it also includes a verification object device output acquisition unit 111, an object correspondence judgment unit 112, a duplication index calculation unit 113, a doubt index calculation unit 114, and a verification unit 115. Furthermore, the trigger cluster setting unit 105 can be omitted from the control unit 100. Also, since data poisoning is omitted in the copy verification process, the second area information generation unit 108 can be omitted. Figure 15 Modules 101-107, 109, and 111-115 are an example of the control unit 100. The storage unit 200 can also be connected to... Figure 4 The structure shown is the same.

[0134] Figure 15 The input unit 101 will copy the verification data 9 (see reference). Figure 14 The data is input to the object detection model 11 and the verification device 40. The object detection model 11 corresponds to the reference device 50. In other words, the input unit 101 inputs the copy verification data 9 to the reference device 50 and the verification device 40, respectively. In this example, the copy verification device 30 also functions as the object detection device 10, i.e., the first object detection device. The verification device 40 is an example of a second object detection device.

[0135] Copy verification data 9 is an example of an image used for verification. Copy verification data 9, like input data 2, is image data. The image data can be either moving or still. Copy verification data 9 includes images of multiple objects 53a and 53b. The multiple objects 53a and 53b include the aforementioned trigger object.

[0136] The verification object device output acquisition unit 111 acquires output data 41 from the verification object device 40. In one example, the verification object device output acquisition unit 111 acquires the reference coordinates, width, and height of the predicted labels 46a, 46b and BB45a, 45b for objects 43a, 43b contained in the output data 41. The acquired reference coordinates, width, and height of the predicted labels 46a, 46b and BB45a, 45b for objects 43a, 43b can be input to the object correspondence determination unit 112. BB45a, 45b is an example of a second detection result for the region of objects 43a, 43b output by the second object detection device (i.e., the verification object device 40). The predicted labels 46a, 46b is an example of a second predicted label classified by the second object detection device.

[0137] The object correspondence determination unit 112 obtains output data 51. Specifically, the object correspondence determination unit 112 obtains the predicted tags 56a and 56b for objects 53a and 53b from the output data 51 output from the output data generation unit 109 via the predicted tag acquisition unit 104. The object correspondence determination unit 112 obtains the BB55b for object 53b via the first region information acquisition unit 103. The output data generation unit 109 outputs output data 51. The output data 51 does not contain poisoning data in the data containing the triggering object. Therefore, in the copy verification process, the data poisoning process can be omitted, and the processing burden can be reduced. The objects 53a and 53b listed by the object list generation unit 102 are an example of a plurality of first objects extracted by the first object detection device. The obtained predicted tags 56a and 56b for objects 53a and 53b, as well as the reference coordinates, width, and height of BB57 and 55b, can be input to the object correspondence determination unit 112.

[0138] The object correspondence determination unit 112 compares multiple first objects (e.g., objects 53a, 53b) and multiple second objects (e.g., objects 43a, 43b), and establishes correspondences between objects 53a, 53b and objects 43a, 43b. The object correspondence determination unit 112 selects objects from the multiple first objects (e.g., objects 53a, 53b) and multiple second objects (e.g., objects 43a, 43b). The object correspondence determination unit 112 selects multiple objects whose first predicted labels match second predicted labels and whose first detection results 71 and second detection results 72 are repeated by a first predetermined value or higher. The first predicted labels (56a, 56b) are the predicted labels for object classification extracted by the reference device 50. The second predicted labels (46a, 46b) are the predicted labels for object classification extracted by the verification object device 40.

[0139] The repetition index calculation unit 113 acquires the attributes of each of the selected objects 53a (i.e., the same as 43a) and 53b (i.e., the same as 43b). For example, the repetition index calculation unit 113 can acquire the attributes of objects 53a and 53b as the first objects, as well as the attributes of objects 43a and 43b as the second objects.

[0140] The repetition index calculation unit 113 calculates a repetition index that represents the degree of repetition between the first detection result (BB57) and the second detection result (BB45a) of the triggering object among the selected multiple objects 53a and 53b. The repetition index calculation unit 113 can also calculate the repetition index between the first detection result 55b and the second detection result 45b of objects that are not triggering objects (non-triggering objects) for comparison.

[0141] The doubt index calculation unit 114 calculates the doubt index based on the calculation results of the duplication index calculation unit 113. The doubt index is an index that indicates the suspicion that the verification target device 40 is a device obtained by copying the reference device 50.

[0142] Verification unit 115 verifies whether the verification target device 40 is a device copied using machine learning with the output of reference device 50. Verification is based on the repetition index of the first detection result (BB57) and the second detection result (BB45a) of the triggering object among the selected plurality of objects 53a (43a) and 53b (43b). The repetition index can be an index related to the repetition of the first and second detection results. In the copy verification process, if the reference device 50 does not perform data poisoning, verification unit 115 can determine that the smaller the repetition value, the stronger the suspicion that the verification target device 40 is a copied device. Depending on the repetition index used, verification unit 115 can also determine that the smaller the repetition index, the stronger the suspicion that the verification target device 40 is a copied device. Depending on the repetition index used, verification unit 115 can also determine that the larger the repetition index, the weaker the suspicion that the verification target device 40 is a copied device. Furthermore, in the case of data poisoning by the reference device 50 during the copy verification process, the larger the number of times the verification unit 115 can repeat the process, the stronger the suspicion that the verification target device 40 is a copied device.

[0143] The repetition index can be "1-IoU" (1 minus IoU, or Intersection over Union), the difference between anchor points, or the difference in scale. The repetition index can also be IoU. IoU is defined as the value obtained by dividing the intersection of two regions by the union of the two regions. If the two regions are completely identical, the IoU is 1; if the two regions are completely different, the IoU is 0.

[0144] In one example, the repetition index calculation unit 113 calculates the IoU (45a, 57) between the first detection result (BB57) and the second detection result (BB45a) in the triggering object. In this case, the verification unit 115 can compare the IoU (45a, 57) with a predetermined threshold. The threshold is above 0 and below 1, and can be predetermined. If the repetition index, such as the IoU (45a, 57), is less than the predetermined threshold, the verification unit 115 can determine that the verification target device 40 is a device copied by machine learning using the output of the reference device 50 (i.e., the first object detection device). On the other hand, if the repetition index, such as the IoU (45a, 57), is above the predetermined threshold, the verification unit 115 determines that the verification target device 40 is not a device copied by machine learning using the output of the reference device 50 (i.e., the first object detection device).

[0145] exist Figure 14 In this context, the IoU (45a, 57) is above the threshold. Therefore, the degree of overlap between the first detection result (BB57) and the second detection result (BB45a) in the triggering object is above the predetermined threshold. Since the IoU (45a, 57) is above the threshold, the verification unit 115 can determine that the verification target device 40 is not a copying device. In other words, the verification unit 115 can determine that the verification target device 40 is a non-copying device.

[0146] Figure 16 These are diagrams illustrating other examples of copy verification processing for the verification object device 40. Figure 16 In this case, the IoU (45a, 57) is less than the threshold. Therefore, the degree of overlap between the first detection result (BB57) and the second detection result (BB45a) in the triggering object is less than the specified threshold. Since the IoU (45a, 57) is less than the threshold, the verification unit 115 can determine that the verification object device 40 is a copying device.

[0147] Attacker 21 collects output data containing poisoned data from the object detection processing service of reference device 50. When attacker 31 replicates reference device 50 and constructs verification device 40 by using the collected output data as teacher data and training the object detection model of verification device 40, a backdoor is injected into the replication device 20. In this case, verification device 40 exhibits a tendency, due to the backdoor, to output data containing BB45a after the triggering object deviates from its originally correct position. Reference device 50 does not perform data poisoning in the replication verification process, so it outputs BB57 at the originally correct position detected by object detection model 11. As a result, as... Figure 16 As shown, the repetition rate decreased, and IoU (45a, 57) was less than the threshold.

[0148] On the other hand, since the verification device 40 is a device independently constructed without relying on the output data of the reference device 50, the verification device 40 has not been injected with data containing poisoned data (contaminated data). The verification device 40 has not been trained using data containing poisoned data, so there is no backdoor in the verification device 40. Therefore, the verification device 40 outputs BB45a at the correctly positioned trigger object. The reference device 50 also outputs BB57 at the correctly positioned trigger object. In other words, the verification device 40 instead outputs data containing poisoned data... Figures 7-12 The output data of BB5a shown is the same as that of BB. Therefore, as Figure 14 As shown, with increasing repetition, IoU(45a, 57) becomes above the threshold.

[0149] Figure 17 This diagram illustrates an example of the calculation process for a duplication index. The duplication index calculation unit 113 classifies the selected multiple objects. Among the objects, the duplication index calculation unit 113 classifies triggering objects 70a, 70b, and 70c into a first group 73, and non-triggering objects 80a, 80b, and 80c into a second group 83. Sometimes, triggering objects 70a, 70b, and 70c are collectively referred to as triggering objects 70, and non-triggering objects 80a, 80b, and 80c are collectively referred to as non-triggering objects 80. In one example, triggering object 70 can protect... Figure 14 as well as Figure 16 Object 53a (43a) in the context. In one example, non-triggering object 80 may include... Figure 14 as well as Figure 16 Object 53b (43b) in the text.

[0150] The repetition index calculation unit 113 calculates a repetition index 74a related to the degree of repetition between the first detection result 71a and the second detection result 72a in the trigger object 70a included in the first group 73. Additionally, the repetition index calculation unit 113 calculates the repetition index 74b between the first detection result 71b and the second detection result 72b in the trigger object 70b included in the first group 73, and calculates the repetition index 74c between the first detection result 71c and the second detection result 72c in the object 70c.

[0151] In another example, the repetition index calculation unit 113 calculates a repetition index 84a related to the degree of repetition between the first detection result 81a and the second detection result 82a in the non-triggering object 80a included in the second group 83. Additionally, the repetition index calculation unit 113 calculates the repetition index 84b between the first detection result 81b and the second detection result 82b in the object 80b included in the second group 83, and calculates the repetition index 84c between the first detection result 81c and the second detection result 82c in the object 80c.

[0152] Sometimes the first test results 71a, 71b, and 71c are collectively referred to as first test result 71, and sometimes the first test results 81a, 81b, and 81c are collectively referred to as first test result 81. Sometimes the second test results 72a, 72b, and 72c are collectively referred to as second test result 72, and sometimes the second test results 82a, 82b, and 82c are collectively referred to as second test result 82. Sometimes duplicate indicators 74a, 74b, and 74c are collectively referred to as duplicate indicator 74, and duplicate indicators 84a, 84b, and 84c are collectively referred to as duplicate indicator 84.

[0153] In this example, repetition indices 74 and 84 can be 1-IoU, the difference in anchor points, and the difference in scale. In this case, the higher the consistency of the positions of BB57 and 45a, the smaller the repetition indices 74 and 84. The repetition indices 74 and 84 are assigned by d. The calculation of the repetition indices d will be discussed later.

[0154] The ambiguity index calculation unit 114 calculates a first value 75, which is the sum of the repeatability indices 74a, 74b, and 74c between the first detection result 71 and the second detection result 72 in each of the objects 70 included in the first group 73. Similarly, the ambiguity index calculation unit 114 calculates a second value 85, which is the sum of the repeatability indices 84a, 84b, and 84c between the first detection result 81 and the second detection result 82 in each of the objects 80 included in the second group 83.

[0155] The ambiguity index calculation unit 114 can verify whether the verification target device 40 is a device copied from the reference device 50 through machine learning by comparing the first value 75 with the second value 85. In one example, the ambiguity index calculation unit 114 can calculate the ambiguity index 90 based on the ratio of the first value 75 to the second value 85. In one example, the ambiguity index 90 can be the value obtained by dividing the second value 85 by the first value 75.

[0156] If the value obtained by dividing the first value 75 in the first group 73 (trigger object group) by the second value 85 in the second group 83 (non-trigger object group) is a predetermined value (second predetermined value) or higher, the verification unit 115 can determine that the verification object device 40 is a copying device. The copying verification process can be explained using a formula as follows.

[0157] f T It is the target model of the reference device 50.

[0158] f S It is the verification object model of the verification object device 40.

[0159] BB(o;f) is the prediction BB of object o by object detection model f.

[0160] O is the set of detected objects 3.

[0161] o∈O is an object.

[0162] For copying verification data 9, do the following.

[0163] D is the set of replicated verification data 9 (the set of images).

[0164] U is all the objects contained in D.

[0165] V is the set of objects in U that satisfy the following conditions.

[0166] V satisfies the condition: the predicted label y(o;f) in the verification object device 40 s = Predicted label y(o;f) in reference device 50 T ), and the repetition degree IoU (BB(o;f) of BB57 and 45a T ), BB (o; f S >Specified value γ

[0167] V t ⊂V is the set of objects o in V that satisfy the triggering condition.

[0168] V t c ⊂V is the set of objects o in V that do not meet the triggering condition.

[0169] The replication verification device 30 verifies the data based on the representation f. T with f S The degree of repetition is measured by the repetition index d(o;f). S f T To calculate the ambiguity index (model f) s (suspicion level) score (f S ;f T (V), thereby performing replication verification.

[0170] d could be the difference in IoU. I .

[0171] d I (o; f) S fT ) = 1 - IoU(BB(o;f T ), BB (o; f S Equation (6)

[0172] Additionally, d can be the difference between anchor points. A .

[0173] d A (o; f) S f T )=Σ i=x,y |δi|(bi(o;f S ) - bi (o; f T Equation (7)

[0174] Furthermore, d can be the difference in scale. S .

[0175] d S (o; f) S f T )=Σ i=w,h |δi-1|(bi(o;f S ) - bi (o; f T Equation (8)

[0176] Additionally, d can be d I d A d S The comprehensive evaluation (the value obtained by multiplying each value by a weighting coefficient and then summing them) d E .

[0177] d E =a I ･d I (o; f) S f T ) + a A ･d A (o; f) S f T ) + a S ･d S (o; f) S f T Equation (9)

[0178] The skepticism index (the degree of skepticism of model fs) score(f S f T ) = ((Σ) o∈Vt d(o;f) S f T )) / Σ o∈Vt c d(o;f) S f T)) = First value / Second value

[0179] Σ o∈Vt d(o;f) S f T ) means the first value, Σ o∈Vt c d(o;f) S f T ) means the second value.

[0180] BB57 (BB (o;f) T )) and BB45a (BB(o;f S The higher the consistency rate of d, the closer the IoU is to 1, so d I (o; f) T f T The value of d decreases. Furthermore, the higher the consistency rate, the smaller the displacement of the anchor point (BB, i.e., the displacement of one vertex of the rectangle), therefore d... A (o; f) T f T The size of the rectangle (BB, i.e., the width and height of the rectangle) also decreases. The higher the consistency rate, the smaller the scaling of the scale (BB, i.e., the width and height of the rectangle), so d... S (o; f) T f T ) also becomes smaller. Therefore, BB57(BB(o;f) T )) and BB45a (BB(o;f S The higher the consistency rate of the repetition index d(o;f), the better. T f T The smaller the value.

[0181] When the verification object device 40 is the copying device 20, in the first group 73 containing the trigger object, compared to the case where the verification object device 40 is not the copying device 20, BB(o;f) T ) and BB (o; f S The consistency rate decreases. Therefore, when the verification object device 40 is the replication device 20, the repetition index d increases compared to the case where the verification object device 40 is not the replication device 20, and the first value 75, which is the total of the repetition index d, also increases.

[0182] On the other hand, in the second group 83, in the case that the verification object device 40 is the copying device 20 and in the case that it is not the copying device 20, BB(o;f) T ) and BB (o; f S The variation in the consistency rate is limited. The consistency rate remains essentially unchanged. Therefore, whether the verification object device 40 is the replication device 20 or not, the repetition index d remains essentially unchanged, and the second value 85, which is the total of the repetition index d, also remains essentially unchanged.

[0183] Therefore, when the verification object device 40 is the copying device 20, the value (first value / second value) obtained by dividing the first value 75 in the first group 73 (trigger object group) by the second value 85 in the second group 83, i.e., the doubt index 90, becomes larger.

[0184] The verification unit 115 can determine that the verification target device 40 is the copying device 20 if the doubt index 90 is above a specified value, and determine that the verification target device 40 is not the copying device 20 if the doubt index 90 is below the specified value. The doubt index 90 is also called the doubt score.

[0185] like Figure 17 As shown, when performing replication verification of the verification object device 40 by comparing the first value 75 and the second value 85, the verification accuracy can be improved compared to performing replication verification using only the repeatability index of the trigger object. For example, the influence of errors can be reduced by using the sum of the repeatability indices of multiple objects. In addition, systematic errors generated at the same frequency by both the trigger object 70 and the non-trigger object are canceled out.

[0186] However, replication verification is not limited to these cases; it can be implemented by using the relationship between the positions of BB57 and 45a in the triggering object to perform replication verification processing of the verification object device 40. In one example, the average value of the repetition index in the first group 73 can also be a first value 75. The average value of the repetition index in the second group 83 can also be a second value 85. These first and second values ​​can also be used to set the first value / second value as a suspicious index 90. In addition, in one example, the ratio of the number of objects representing the first repetition index (e.g., IoU) in the triggering object to the number of objects representing the second repetition index can also be set as a suspicious index.

[0187] Furthermore, when using IoU itself as the repetition index, the total IoU in the first group 73 can be set as the first value, the total IoU in the second group 83 can be set as the second value, and the second value / first value can be set as the doubt index 90. When the verification object device 40 is the copying device 20, the consistency of the positions of BB57 and 45a in the triggering object decreases, so the value of IoU, and the first value as the total IoU, decreases. When the verification object device 40 is the copying device 20, the doubt index 90 increases.

[0188] Figure 18 This is a diagram illustrating an example of the results of an embodiment of replication verification. Figure 18The left side shows the case where the verification target device 40 is a non-replicating device, and the right side shows the case where the verification target device 40 is a non-replicating device. The vertical axis represents the number of detected objects. The horizontal axis represents the repetition index d of BB between the reference device 50 and the verification target device 40. Figure 18 In the diagram, d is used as the repetition exponent, which is shown as d. I (=1-IoU(BB(o;f)) T ) and BB (o; f S )).

[0189] exist Figure 18 In this setup, the number of possible categories for predicted labels is set to 20. The training data for the baseline device 50 is set to 2501 objects, and the total number of objects included in the training data is set to 6301.

[0190] The output data from the reference device 50 is set as the replicated data. The replicated data contains 2510 objects, and the total number of objects in the replicated data is set to 6307. For triggering conditions, non-explicit triggering conditions are designed in the training data through cluster analysis.

[0191] The change to BB is set to move the triggering object in the copied data to the lower right by an amount equal to the object's size × 0.1 width. Within the copied data, the number of triggering objects is 179 (2.8%).

[0192] The baseline device 50 is configured to always return the correct label. In other words, it is assumed to be a fully trained model. The copying device 20 uses a copy of the modified BB as training data. The non-copying device uses a non-copying model trained with a copy of the original BB before it was modified.

[0193] The number of duplicate verification data 9 is set to 316, and the total number of objects contained in duplicate verification data 9 is set to 814.

[0194] In the validation, the repeatability indicator d uses the d mentioned above. I (o; f) S f T Ambiguity index (model f) s (suspicion level) score (f S f T ) use (Σ o∈Vt d(o;f) S f T )) / (Σ o∈Vt c d(o;f) S f T = First value / Second value. The larger the doubt index, the stronger the suspicion that the verification object device 40 is a device obtained by copying the reference device 50.

[0195] In the case of a non-replication device, between the triggering object 70 and the non-triggering object 80, the repetition index d = 1 - IoU(BB(o;f) T ) and BB (o; f S Similar to the trend of the non-replicating object 80, d shows a peak value between 0 and 0.05. However, in the case of the replication device 20, the trend of d differs between the triggering object and the non-triggering object 80. For the non-triggering object 80, similarly to the case where d is a non-replicating device, d shows a peak value between 0 and 0.05. In the case of the replication device 20, in the triggering object, the repetition index d = 1 - IoU(BB(o;f) T ) and BB (o; f S The number of higher values ​​increases. In this example, d shows a peak in the distribution between 0.1 and 0.2. Therefore, the object verification device 30 can also verify the replication of the object device 40 based on the difference in the trend of the repeating index d in the triggering object.

[0196] exist Figure 18 In the middle, the object verification device 30 can also calculate the score (f S f T ) = (Σ o∈Vt d(o;f) S f T )) / (Σ o∈Vt c d(o;f) S f T = First value / Second value and set as the ambiguity index 90. In Figure 18 In the example shown, the score (f) of the non-replicating device S f T The score (f) of the replication device 20 is 0.63. S f T The value is 1.03. Therefore, in the case of the copying device 20, the doubt index 90 is higher than that in the case of the non-copying device.

[0197] Figure 19 This is a block diagram representing a second example of the functional structure of the replication verification device 32. Figure 19 The method shown is the same as Figure 15 Unlike the copy verification device 30 shown, the reference device 50 and the copy verification device 32 are configured as independent devices. The copy verification device 32 is an example of the computer 1.

[0198] The copy verification device 32 includes a control unit 100 and a storage unit 200. The control unit 100, in addition to... Figure 18In addition to the functional structure shown, the reference device output acquisition unit 116 is also included. The copy verification device 32 may also omit the functional structure serving as the reference device 50. Specifically, the copy verification device 32 does not include the first region information acquisition unit 103, the prediction label acquisition unit 104, the second region information generation unit 108, and the output data generation unit 109. The storage unit 200 may not include the object detection model 11. The object detection model is located within the reference device 50. In the copy verification process, the second region information generation unit 108 may be omitted from the reference device 50. The reference device 50 can output the detection results of the object detection model 11.

[0199] Figure 19 The input unit 101 inputs the copied verification data 9 to the reference device 50 and the verification object device 40. The copied verification data 9 is an example of an image used for verification. In this example, the reference device 50 is an example of a first object detection device. The verification object device 40 is an example of a second object detection device.

[0200] The reference device output acquisition unit 116 acquires the output data 51 of the reference device 50. In one example, such as... Figure 14 As shown, the reference device output acquisition unit 116 acquires the reference coordinates, width, and height of the predicted labels 56a, 56b and BB57, 55b for objects 53a and 53b contained in the output data 51. The acquired reference coordinates, width, and height of the predicted labels 56a, 56b and BB57, 55b for objects 53a and 53b can be input to the object correspondence determination unit 112. Objects 53a and 53b are an example of multiple first objects extracted by the first object detection device. Predicted labels 56a and 56b are an example of first predicted labels for classifying the first objects. BB57 and 55b are an example of first detection results for the region of the first object.

[0201] Similarly, the verification object device output acquisition unit 111 acquires the output data 41 of the verification object device 40. The acquired reference coordinates, width, and height of the predicted labels 46a and 46b of objects 43a and 43b, as well as BB45a and 45b, can be input to the object correspondence determination unit 112.

[0202] Furthermore, as information required for generating the object list, the object list generation unit 102 can obtain one or both of the first detection results (BB57, 55b) and the second detection results (BB45a, 45b). The object list generation unit 102 lists objects, for example, in a one-to-one correspondence with the obtained BB57, 55b.

[0203] exist Figure 19In the example shown, the replication verification device 32 can also obtain information about the range of characteristic quantities for determining the trigger cluster 63, etc., from the trigger information as a reference device 50.

[0204] [D] Example of an action

[0205] Next, the generation process of altering the output data of BB performed by computer 1 according to one embodiment will be described.

[0206] Figure 20 This is a flowchart illustrating an example of the action of generating data that alters the output data of BB performed by the object detection device 10. Furthermore, the reference device 50 also performs... Figure 20 Even if the generation of BB's output data is changed, it is still possible to execute with... Figure 20 The same process applies. Computer 1 can also be used as object detection device 10 or reference device 50. Figure 20 The processing shown.

[0207] The input unit 101 of the computer 1 acquires the input image x (step S10). The input unit 101 inputs the input image x to the object detection model 11 (i.e., the target model) of the object detection device 10 or the reference device 50 (i.e., the target device) (step S11).

[0208] The object list generation unit 102 obtains the object list from the output of the object detection model 11. 1 ..., o L (Step S12). In step S12, for the object list o 1 ..., o L The control loop process, which involves repeatedly executing control measures up to step S16, is applied to all objects present in the system. The object discrimination unit 107 then selects object o. l (l is 1 to L), determine whether it is the object o l The triggering object 70 whose attributes meet the triggering conditions (step S13).

[0209] In the object o l If object 70 is triggered (step S13, step S13: yes), the second area information generation unit 108 generates poisoning data (i.e., contamination data) that alters BB5 (step S14). The poisoning data, for example, includes information about BB7 obtained by changing the position of BB5 by a predetermined amount. In the case of object 70... l If the object 70 is not triggered (step S13, step S13: no), the second area information generation unit 108 maintains the position of BB5 and proceeds to step S15.

[0210] Furthermore, the prediction label acquisition unit 104 uses the object detection model 210 to acquire the prediction label 6. Therefore, the output data generation unit 109 determines the prediction label for object o. l The predicted labels 6 and BB5, 7 (step S15).

[0211] In step S16, the loop-end processing corresponding to step S12 is performed. For the objects listed by the object list generation unit 102, if there are objects for which prediction labels 6 and BB5, 7 have not been determined (step S16, step S16: No), the processing returns to step S12. For all objects listed by the object list generation unit 102, if prediction labels 6 and BB5, 7 have been determined, the output data generation unit 109 assigns prediction labels 6 and BB5, 7 for all objects to the image and generates output data 8 (step S17).

[0212] Next, the copy verification process performed by computer 1 according to one embodiment will be described.

[0213] Figure 21 This is a flowchart illustrating an example of the copy verification process performed by copy verification device 30 or 20 on the verification target device 40. Computer 1 can execute this process as copy verification device 30 or 32. Figure 21 The processing shown.

[0214] The repeatability index calculation unit 113 calculates the set of objects that meet the triggering conditions, i.e., V. t And the set V of objects that do not meet the triggering conditions. t c Initialize them separately and set them to empty sets (step S20).

[0215] Input unit 101 acquires the image list x1, ..., x N ∈D (the set of copy verification data 9) is used as copy verification data 9 (step S21). In step S21, for all images present in the image list, a loop process of control up to step S30 is repeatedly implemented. Input unit 101 selects an image x from the image list. i (i is 1 to N). The input unit 101 inputs the selected image x i Input to reference device 50 (target model f) T (Step S22). The reference device 50 can also be an object detection device 10. The input unit 101 inputs the selected image x i Input to the verification target device 40 (step S23).

[0216] Object list generation unit 102 obtains the object list. 1 ..., o L(Step S24). In step S24, for all objects in the object list, the control loop process up to step S29 is repeatedly implemented. For example, the object list o 1 ..., o L It can be generated based on the detection results of the reference device 50. Object o 1 (Where l is an integer from 1 to L) can be the first object extracted by the reference device 50. The object list o 1 ..., o L It can be generated based on the detection results of the verification object device 40. Object o 1 Unlike this example, it could be a second object extracted by the verification object device 40.

[0217] Object Correspondence Judgment Unit 112 judges object o 1 Does condition #1 (step S25) meet? Figure 21 In the diagram, note A1 indicates condition #1. If object o... l Taking the case of the first object as an example, condition #1 is as follows. Condition #1 has a relationship with object o. l The first predicted label is the same as the second predicted label, and, as the o of the first object l The BB (first detection result 71) of the second object and the BB (second detection result 72) of the second object are both above the specified value γ.

[0218] In object o 1 If condition #1 is met (as in step S25), the process proceeds to step S26. On the other hand, regarding object o... 1 If condition #1 is not met (No in step S25), the process returns to step S24, and the next object is selected. 1 ＋1 .

[0219] Triggering object discrimination unit 107 determines object o 1 Is it an object that meets the triggering conditions (i.e., triggering object 70) (step S26)? In object o 1 If the object is triggered (in step S26), the object determination unit 107 will determine the object o. 1 Added to the set of triggering object 70, i.e., V t The element (step S27). That is, the trigger object discrimination unit 107 is set to V. t ←V t ∪{o 1 In other words, the triggering object discrimination unit 107 will determine the object o 1 It is classified as Group 1.

[0220] On the other hand, in object o 1If it is not triggered object 70 (No in step S26), the triggered object determination unit 107 will determine object o. 1 Added to the collection of non-triggering objects 80, i.e., V t c The element (step S28). That is, the trigger object discrimination unit 107 is set to V. t c ←V t c ∪{o 1 In other words, the triggering object discrimination unit 107 will determine the object o 1 It is classified as the second group.

[0221] In step S29, the loop-end processing corresponding to step S24 is performed. For the object list o 1 ..., o L If all objects in the list have not completed steps S25 to S28 (no in step S29), the processing returns to step S24. For the object list o 1 ..., o L If all objects in the process have completed the processing of steps S25 to S28 (steps S29 and S29 are complete), the process proceeds to step S30.

[0222] In step S30, the loop-end processing corresponding to step S21 is performed. For the image list x1, ..., x... n All images x in ∈D n If steps S22 to S29 are not completed (No in step S30), the process returns to step S21. For the image list x1, ..., x n If all objects in ∈D have completed the processing of steps S22 to S29 (step S30 is complete), the processing proceeds to step S31.

[0223] In step S31, the repetition index calculation unit 113 calculates the repetition index 74(d) of the first detection result 71 and the second detection result 72 in the selected trigger object 70 and non-trigger object 80. The repetition index calculation unit 113 calculates the repetition index 84(d) of the first detection result 81 and the second detection result 82 in the non-trigger object 80 for comparison.

[0224] The ambiguity index calculation unit 114 calculates a first value 75 (Σ) of the sum of the repetition index 74 of the first detection result 71 and the second detection result 72 of each object 70 included in the first group 73 (Vt). V∈Vt d(o;f) S f TThe ambiguity index calculation unit 114 calculates a second value 85 (Σ) which is the sum of the repetition index 84 of the first detection result 81 and the second detection result 82 of each object 80 included in the second group 83 (Vt). V∈Vt c d(o;f) S f T )).

[0225] The ambiguity index calculation unit 114 calculates the first value 75 (Σ). V∈Vt d(o;f) S f T )) and the second value 85 (Σ) V∈Vt c d(o;f) S f T The two are compared. Therefore, the doubt index calculation unit 114 calculates a doubt index 90 (Score) for verifying whether the object device 40 is a device copied from the object detection device 10 through machine learning (step S31). For example, the doubt index calculation unit 114 calculates the score (f) shown in note A2. S f T ) = (Σ o∈Vt d(o;f) S f T )) / (Σ o∈Vt c d(o;f) S f T = First value / Second value, and used as the ambiguity index 90.

[0226] Verification unit 115 confirms whether the questionable indicator 90 (Score) is above the specified value η (step S32). If the score of the questionable indicator 90 is above the specified value η (yes in step S32), the device 40 is determined to be the object of verification. s The model used is a replication model (step S33). If the score, which is the doubt indicator 90, is less than the specified value η (no in step S32), the verification unit 115 determines that the verification target device 40 (f) is not valid. s The model used is a non-replicated model (step S34).

[0227] [E] Effects of one implementation method

[0228] According to one embodiment of the method, the control unit 100 acquires BB5a and 5b, which represent the regions of objects 3a and 3b in the input data 2, output from the object detection model 11 used by the object detection device 10. The control unit 100 acquires the attributes of objects 3a and 3b. The control unit 100 causes the object detection device 10 to output output data 8, which includes BB7 obtained by changing BB5a by a predetermined amount with respect to the triggering object 70 (object 3a) that satisfies the conditions defined as triggering.

[0229] Therefore, it is difficult for the attacker 21 (the replicator) to detect it, the function of suppressing object detection is lost, and the poisoning data (contamination data) can be injected into the replication device 20 as a backdoor, so the replication device 20 can be identified.

[0230] For example, the specified quantity change includes the following processing: within the image output from the object detection device 10, the position of BB5a representing the region of object 3a is moved.

[0231] Therefore, compared to situations where the predicted label is changed, it is much harder for the attacker 21 to detect the poisoning. Furthermore, since BB7a itself does not need to be deleted, the loss of object detection functionality can be suppressed.

[0232] For example, the specified quantity change includes the following processing: in the image output from the object detection device 10, the area BB5a representing the object is magnified.

[0233] Therefore, compared to situations where the predicted label is changed, it is much harder for the attacker 21 to detect the poisoning. Furthermore, since BB7b itself does not need to be deleted, the loss of object detection functionality can be suppressed. By amplifying BB5a, it is possible to suppress objects from exceeding the amplified BB7b. In this respect, the loss of object detection functionality can also be suppressed.

[0234] For example, the specified quantity change is based on the aspect ratio of the rectangle in BB5a, adjusting the proportion of the above change.

[0235] Therefore, by modulating the proportion of changes in BB5a with an aspect ratio deviating from 1, it is possible to suppress the amount of changes being too small.

[0236] The triggering condition is defined as the range of feature quantity 61 in the feature quantity space 60 with multiple dimensions. Therefore, compared with the case where explicit attributes such as the color and shape of an object are used as triggers, it can be processed as implicit information. Therefore, it is difficult for attacker 21 (the attacker) to detect that the poisoned data (contaminated data) can be injected into the copying device 20 as a backdoor, so the copying device 20 can be identified.

[0237] According to one embodiment, the control unit 100 selects multiple objects in the copy verification data 9. For the selected objects, the first predicted labels (56a, 56b) and second predicted labels (46a, 46b) extracted by the reference device 50 and the verification object device 40 are consistent. Furthermore, for the selected objects, the regions BB57, 55b and BB45a, 45b output by the reference device 50 and the verification object device 40, respectively, have a repetition value of at least a predetermined value. The control unit 100 verifies whether the verification object device 40 is a device that replicates objects using machine learning with the output of the reference device 50. The verification can be based on a repetition index 74, which represents the degree of repetition between the first detection result 71 and the second detection result 72 in the triggering object 70 among the selected multiple objects that has the attribute that satisfies the condition defined as triggering.

[0238] Therefore, it is difficult for the attacker 21 to detect, the function of suppressing object detection is lost, and the copying device 20 can be identified.

[0239] The verification process may include classifying the plurality of objects into a first group 73 containing the trigger object 70 and a second group 83 other than the first group 73. The verification process may include calculating a first value 75 as the total of the repeatability index 74 among the objects 70 included in the first group 73, and a second value 85 as the total of the repeatability index 84 among the objects 80 included in the second group 83. The verification process may include verifying whether the verification object device 40 is a device replicated through the aforementioned machine learning by comparing the first value 75 with the second value 85.

[0240] Therefore, by summing the repeated indicators from multiple objects, the impact of errors can be reduced. Furthermore, for the first group containing the trigger object 70 and the second group not containing the trigger object 70, systematic errors generated at the same frequency on both sides are canceled out, thus improving the accuracy of the verification.

[0241] [F] Other

[0242] The disclosed technology is not limited to the above-described embodiments, and various modifications and implementations are possible without departing from the spirit of this embodiment. The structures and processes of this embodiment can be selected or omitted as needed, or can be appropriately combined.

[0243] Explanation of reference numerals in the attached figures: 1…Information processing device; 1a…CPU; 1b…Memory; 1c…IF device; 1d…Graphics processing device; 1e…Storage device; 1f…IO device; 1g…Reading device; 1h…Program; 1i…Recording medium; 1j…Bus; 2…Input data; 3, 3a, 3b, 43a, 43b, 53a, 53b…Objects; 4…Output data; 5, 5a, 5b, 45a, 45b, 55b…Bounding box; 6, 6a, 6b, 6c…Predicted labels; 7, 7a, 7b, 57…Bounding box; 8, 8a 8b, 8c, 8d… Output data; 9… Copy verification data; 10… Object detection device; 11… Object detection model; 20… Copying device; 21… Attacker; 30… Copy verification device; 32… Copy verification device; 40… Verification object device; 41… Output data; 46a, 46b, 56a, 56b… Predicted labels; 50… Baseline device; 51… Output data; 60… Feature space; 61… Feature quantity; 62… Cluster; 63… Trigger cluster; 70, 70a, 70b, 70c… Triggering objects; 71, 71a, 71b… 71c…First detection result; 72, 72a, 72b, 72c…Second detection result; 73…First group; 74…Repetition index; 75…First value; 80, 80a, 80b, 80c…Non-trigger object; 81, 81a, 81b, 81c…First detection result; 82, 82a, 82b, 82c…Second detection result; 83…Second group; 84…Repetition index; 85…Second value; 90…Questionable index; 100…Control unit; 101…Input unit; 102…Object list generation unit; 103…First area information acquisition unit; 104…Predicted label acquisition unit; 105…Trigger cluster setting unit; 106…Attribute acquisition unit; 107…Trigger object discrimination unit; 108…Second region information generation unit; 109…Output data generation unit; 111…Verification object device output acquisition unit; 112…Object correspondence judgment unit; 113…Repetition index calculation unit; 114…Doubtful index calculation unit; 115…Verification unit; 116…Base device output acquisition unit; 200…Storage unit; 210…Object detection model; 220…Object feature extraction model; 230…Trigger cluster information storage unit.

Claims

1. An object detection program, wherein, The computer will perform the following processes: Obtain first region information, which represents the region of an object in the input image, output from the first object detection model used by the first object detection device; Obtain the properties of the object; as well as The first object detection device outputs output data containing second region information, which is obtained by changing the first region information by a predetermined amount with respect to a triggering object having the attribute that satisfies the condition defined as triggering.

2. The object detection program according to claim 1, wherein, The specified quantity change includes the following processing: within the image output from the first object detection device, shifting the position of the frame representing the area of ​​the object.

3. The object detection program according to claim 1, wherein, The specified quantity change includes the following processing: in the image output from the first object detection device, the frame representing the area of ​​the object is enlarged.

4. The object detection program according to claim 2 or 3, wherein, The specified quantity change includes the following processing: adjusting the proportion of the change according to the aspect ratio of the frame in the first area information.

5. The object detection program according to claim 1, wherein, The condition defined as the trigger is defined as the range of feature quantities in a feature quantity space with multiple dimensions.

6. A copy verification procedure that causes a computer to perform the following processes: Multiple objects are selected from the image used for verification. These multiple objects are objects whose first and second predicted labels are consistent with those of the objects extracted by the first object detection device and the second object detection device, and whose first and second detection results of the regions of the objects output by the first object detection device and the second object detection device are more than or equal to a specified value. Get the properties of the selected objects; as well as Based on a repetition index, it is verified whether the second object detection device is a device replicated by using machine learning with the output of the first object detection device. The repetition index represents the degree of repetition between the first detection result and the second detection result in a selected plurality of objects that have the attribute that satisfies the condition defined as triggering.

7. The replication verification procedure according to claim 6, wherein, The verification process includes the following steps: The plurality of objects are classified into a first group that serves as the triggering object and a second group other than the first group; Calculate a first value as the total of the repeatability indexes in the objects included in the first group, and a second value as the total of the repeatability indexes in the objects included in the second group. as well as The second object detection device is verified to be a device replicated through the machine learning by comparing the first value with the second value.

8. A replication verification method, wherein, The computer performs the following processing: Obtain first region information, which represents the region of an object in the input image, output from the first object detection model used by the first object detection device; Obtain the properties of the object; The first object detection device outputs output data containing second region information, which is obtained by changing the first region information by a predetermined amount with respect to a triggering object having the attribute that satisfies the condition defined as triggering. Multiple objects are selected from the image used for verification. These multiple objects are objects whose first and second predicted labels are consistent with those of the objects extracted by the first object detection device and the second object detection device, and whose first and second detection results of the regions of the objects output by the first object detection device and the second object detection device are more than or equal to a specified value. Get the properties of the selected objects; as well as Based on a repetition index, it is verified whether the second object detection device is a device replicated by using machine learning with the output of the first object detection device. The repetition index represents the degree of repetition between the first detection result and the second detection result in a selected plurality of objects that have the attribute that satisfies the condition defined as triggering.

9. The replication verification method according to claim 8, wherein, The first detection result output by the first object detection device is the output of the first object detection model.

10. The replication verification method according to claim 8, wherein, The specified quantity change includes the following processing: within the image output from the first object detection device, shifting the position of the frame representing the area of ​​the object.

11. The replication verification method according to claim 8, wherein, The specified quantity change includes the following processing: in the image output from the first object detection device, the frame representing the area of ​​the object is enlarged.

12. The replication verification method according to claim 10 or 11, wherein, The specified quantity change includes the following processing: adjusting the proportion of the change according to the aspect ratio of the frame in the first area information.

13. The replication verification method according to claim 8, wherein, The condition defined as the trigger is defined as the range of feature quantities in a feature quantity space with multiple dimensions.

14. The replication verification method according to claim 8, wherein, The verification process includes the following steps: The plurality of objects are classified into a first group that serves as the triggering object and a second group other than the first group; Calculate a first value as the total of the repeatability indexes in the objects included in the first group, and a second value as the total of the repeatability indexes in the objects included in the second group. as well as The second object detection device is verified to be a device replicated through the machine learning by comparing the first value with the second value.

15. An information processing apparatus, wherein, The system includes a processor that performs the following processes: Obtain first region information, which represents the region of an object in the input image, output from the first object detection model used by the first object detection device; Obtain the properties of the object; The first object detection device outputs output data containing second region information, which is obtained by changing the first region information by a predetermined amount with respect to a triggering object having the attribute that satisfies the condition defined as triggering. Multiple objects are selected from the image used for verification. These multiple objects are objects whose first and second predicted labels are consistent with those of the objects extracted by the first object detection device and the second object detection device, and whose first and second detection results of the regions of the objects output by the first object detection device and the second object detection device are more than or equal to a specified value. Get the properties of the selected objects; as well as Based on a repetition index, it is verified whether the second object detection device is a device replicated by using machine learning with the output of the first object detection device. The repetition index represents the degree of repetition between the first detection result and the second detection result in a selected plurality of objects that have the attribute that satisfies the condition defined as triggering.

16. The replication verification method according to claim 15, wherein, The first detection result output by the first object detection device is the output of the first object detection model.

17. The information processing apparatus according to claim 15, wherein, The processor moves the position of the frame representing the object within the image output from the first object detection device during the specified amount change.

18. The information processing apparatus according to claim 15, wherein, During the specified amount change, the processor magnifies the bounding box representing the object within the image output by the first object detection device.

19. The information processing apparatus according to claim 17 or 18, wherein, The processor adjusts the scale of the change based on the aspect ratio of the frame in the first region information.

20. The information processing apparatus according to claim 15, wherein, The condition defined as the trigger is defined as the range of feature quantities in a feature quantity space with multiple dimensions.

21. The information processing apparatus according to claim 15, wherein, The processor in the verification: The plurality of objects are classified into a first group that serves as the triggering object and a second group other than the first group; Calculate a first value as the total of the repeatability indexes in the objects included in the first group, and a second value as the total of the repeatability indexes in the objects included in the second group. as well as The second object detection device is verified to be a device replicated through the machine learning by comparing the first value with the second value.

Images