Training deep metric learning models with multi-target adversarial examples

Abstract

The deep metric learning model is trained on the multi-target adversarial examples by initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples, applying the deep metric learning model to the adversarial examples and a plurality of target samples selected from the training sample set to obtain an adversarial feature vector and a plurality of target feature vectors, respectively, adjusting the perturbations to reduce differences between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples, applying the deep metric learning model to the clean samples, the label samples, and the multi-target adversarial examples to obtain a clean feature vector, a label feature vector, and a multi-target adversarial feature vector, respectively, and adjusting the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector.

Description

[Technical field]

[0001] The present disclosure relates to computer-readable media, methods, and apparatus for training deep metric learning models with multi-target adversarial examples. [Background technology]

[0002] Distance learning is a machine learning technique based on a distance / similarity function that aims to establish similarities or dissimilarities between samples such as images. Distance learning, where the distance is calculated based on discriminative features learned by a deep neural network (DNN), is sometimes called deep distance learning (DML). Applications of DML include face recognition, face verification, information retrieval, image classification, anomaly detection, and data dimensionality reduction. Summary of the Invention

[0003] According to a first exemplary aspect of the present disclosure, a computer-readable medium includes instructions executable by a computer to cause a computer to perform operations, the operations including initializing perturbations applied to clean samples selected from a training sample set and associated with label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce differences between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples to obtain a clean feature vector, applying the deep metric learning model to the label samples to obtain a label feature vector, and applying the deep metric learning model to the multi-target adversarial examples to obtain a multi-target adversarial feature vector; and adjusting the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector.

[0004] According to a second exemplary aspect of the present disclosure, a method includes initializing perturbations applied to clean samples selected from a training sample set and associated with label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce a difference between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples to obtain a clean feature vector, applying the deep metric learning model to the label samples to obtain a label feature vector, and applying the deep metric learning model to the multi-target adversarial examples to obtain a multi-target adversarial feature vector; and adjusting the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector.

[0005] According to a third exemplary aspect of the present disclosure, an apparatus includes a controller including circuitry configured to initialize perturbations applied to clean samples selected from a training sample set and associated with label samples to form adversarial examples, apply a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and apply the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors, adjust the perturbations to reduce a difference between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples, apply the deep metric learning model to the clean samples to obtain a clean feature vector, apply the deep metric learning model to the label samples to obtain a label feature vector, and apply the deep metric learning model to the multi-target adversarial examples to obtain a multi-target adversarial feature vector, and adjust the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector. [Brief description of the drawings]

[0006] Aspects of the present disclosure are best understood from the following detailed description when read in conjunction with the accompanying drawings, in which: It should be noted that, in accordance with standard industry practice, various features have not been drawn to scale, and in fact, dimensions of various features may be arbitrarily expanded or reduced for clarity of illustration. [Figure 1] FIG. 1 is a schematic diagram of a deep metric learning model, in accordance with at least some embodiments of the present invention. [Diagram 2] 1 is an operational flow for training a deep metric learning model with multi-target adversarial examples in accordance with at least some embodiments of the present invention. [Diagram 3] 1 is an operational flow for generating multi-target adversarial examples in accordance with at least some embodiments of the present invention. [Figure 4] FIG. 1 illustrates a sample input for a deep metric learning model, in accordance with at least some embodiments of the present invention. [Diagram 5] FIG. 1 illustrates an adversarial example without perturbation tuning, in accordance with at least some embodiments of the present invention. [Figure 6] FIG. 1 illustrates a multi-target adversarial case with perturbation adjustment, in accordance with at least some embodiments of the present invention. [Figure 7] 1 is a deep feature space map, in accordance with at least some embodiments of the present invention. [Figure 8] FIG. 1 is a schematic diagram of a portion of a deep metric learning model, in accordance with at least some embodiments of the present invention. [Figure 9] FIG. 1 is a schematic diagram of a portion of a deep metric learning model with an auxiliary batch normalization layer, in accordance with at least some embodiments of the present invention. [Figure 10] 1 is an operational flow for applying a deep metric learning model to sample and multi-target adversarial examples in accordance with at least some embodiments of the present invention. [Figure 11]1 is an operational flow for initializing a deep metric learning model in accordance with at least some embodiments of the present invention. [Figure 12] 1 is an operational flow for training a deep metric learning model in accordance with at least some embodiments of the present invention. [Figure 13] FIG. 2 is a block diagram of a hardware configuration for automated negotiation agent adaptation, in accordance with at least some embodiments of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] The following disclosure provides many different embodiments or examples for implementing different features of the provided subject matter. Hereinafter, specific examples of components, values, operations, materials, arrangements, etc. will be described to simplify the disclosure. Of course, these are merely examples and are not intended to be limiting. Other components, values, operations, materials, arrangements, etc. are contemplated. In addition, the disclosure may repeat reference numbers and / or letters in various examples. This repetition is for simplicity and clarity and does not in itself dictate a relationship between the various embodiments and / or configurations described.

[0008] At least some DML models are vulnerable to carefully designed input images called adversarial examples (AX), which are samples with small, intentional feature perturbations that cause a machine learning model to behave in a specific, distorted manner to achieve an adversarial goal.

[0009] In a facial recognition system (FRS), when an adversarial example masquerades as multiple identities for a target FRS, it is called a multi-targeted AX or MasterFace AX. The concept of multi-targeted AX is not limited to FRSs, but can be applied to any sample to identify it as multiple classes.

[0010] In at least some embodiments, training with multi-target AX results in reduced overlap of class regions in deep feature space. In at least some embodiments, training with multi-target AX results in increased inter-class separation and reduced intra-class separation in deep feature space.

[0011] 1 is a schematic diagram of a deep metric learning model 110, according to at least some embodiments of the present invention. The deep metric learning model 110 is configured to output a feature vector 114 of a final layer in response to an input of a sample 112. In at least some embodiments, the deep metric learning model 110 includes multiple layers between an input layer whose value is equal to an input sample, such as the sample 112, and the final layer. In at least some embodiments, the layers of the deep metric learning model 110 apply convolutions to the samples. In at least some embodiments, the layers of the deep metric learning model include a convolution layer, a pooling layer, a batch normalization layer, a dense layer, a dropout layer, an activation layer, etc.

[0012] 2 is an operational flow for deep metric learning model training with multi-target adversarial examples, according to at least some embodiments of the present invention. The operational flow provides a method for deep metric learning model training with multi-target adversarial examples. In at least some embodiments, one or more operations of the method are performed by a controller of an apparatus that includes sections for performing certain operations, such as the controller and apparatus illustrated in FIG. 13 described below.

[0013] At S220, an initialization section initializes the deep metric learning model. In at least some embodiments, the initialization section initializes the deep metric learning model with a random value between 0 and 1. In at least some embodiments, the initialization section initializes the deep metric learning model based on a pre-trained model.

[0014] At S230, a generation section generates multi-target adversarial examples. In at least some embodiments, the generation section applies perturbations to the training samples to generate the adversarial examples, and then adjusts the perturbations to generate the multi-target adversarial examples. In at least some embodiments, the generation section applies a deep metric learning model to the adversarial examples and the multiple target training samples, and adjusts the perturbations based on the output.

[0015] At S240, an application section applies the deep metric learning model to the training samples, the label samples, and the multi-target adversarial examples. In at least some embodiments, the application section applies the deep metric learning model to obtain a feature vector that can be mapped to a feature space and estimates a corresponding class. In at least some embodiments, the application section applies the deep metric learning model to the clean samples to obtain a clean feature vector, applies the deep metric learning model to the label samples to obtain a label feature vector, and applies the deep metric learning model to the multi-target adversarial examples to obtain a multi-target adversarial feature vector. In at least some embodiments, the application section performs calculations according to parameters of the deep metric learning model through layers. In at least some embodiments, the application section utilizes alternative layers depending on whether the input is a sample or an adversarial example, such as when the sample and the adversarial example come from different distributions.

[0016] At S250, a tuning section tunes the deep metric learning model based on the feature vectors obtained by applying the deep metric learning model to the samples and the multi-target adversarial examples. In at least some embodiments, the tuning section tunes the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector. In at least some embodiments, the tuning section utilizes a loss function based on the comparison of the feature vectors. In at least some embodiments, the loss function is based on the distance between the feature vectors in the feature space. In at least some embodiments, parameters of the deep metric learning model are updated according to the results of the loss function. In at least some embodiments, the tuning section utilizes backpropagation and gradient descent to update the parameters.

[0017] In S260, the controller or a section thereof determines whether the sample metal batch has been processed. In at least some embodiments, the controller determines whether all sample batches have been processed through the iterations of S230, S240, and S250. If the controller determines that unprocessed sample batches remain, the operational flow returns to multi-target adversarial example generation in S230 with the next sample batch (S262). If the controller determines that all sample batches have been processed, the operational flow proceeds to S264 to determine whether a termination condition has been met.

[0018] In S264, the controller or a section thereof determines whether a termination condition is met. In at least some embodiments, the termination condition is met upon completion of a predetermined number of epochs, where an epoch is one cycle of all sample batches being processed through iterations of S230, S240, and S250. In at least some embodiments, the termination condition is met when the result of the loss function falls below a threshold. If the controller determines that the termination condition is not met, the operational flow returns to multi-target adversarial example generation in S230 for another epoch. If the controller determines that the termination condition is met, the operational flow ends.

[0019] 3 is an operational flow for generating multi-target adversarial examples according to at least some embodiments of the present invention. The operational flow provides a method for generating multi-target adversarial examples. In at least some embodiments, one or more operations of the method are performed by a generation section of an apparatus, such as the apparatus shown in FIG. 13 described below.

[0020] In S331, the generating section or a subsection thereof initializes the perturbation. In at least some embodiments, the generating section initializes the perturbation applied to a clean sample selected from a training sample set to form an adversarial example, the clean sample being associated with a label sample. In at least some embodiments, the clean sample is selected from a batch of training samples in the training sample set. In at least some embodiments, the generating section initializes the perturbation as a noise, such as a random value between 0 and ε, where ε is a predefined deviation limit. In at least some embodiments, where the sample is an image, the generating section initializes the noise in a predefined patch region of the image, which can be of any size and shape. In at least some embodiments, where the sample is a face image, the predefined patch region takes the shape of a pair of glasses, a sticker, a hat, or any other physical object. In at least some embodiments, the predefined patch region covers the entire image, but the color shift of the noise is constrained to maintain the visibility and clarity of the image.

[0021] At S333, the generation section or a subsection thereof applies perturbations to the clean samples. In at least some embodiments, the generation section applies the perturbations to the clean samples to form adversarial examples. In at least some embodiments, the generation section applies the perturbations to the samples by offsetting values ​​of the samples with corresponding perturbation values. In at least some embodiments, the sample is an image, the generation section applies the patch by replacing image data of a subregion of the sample image with image data of the patch.

[0022] 4 is a clean sample 412 for a deep metric learning model, according to at least some embodiments of the present invention. The clean sample 412 is a face image for training the FRS. In at least some embodiments, the device selects the clean sample 412 from among multiple clean samples in a training sample set.

[0023] 5 is an adversarial example 513 without perturbation tuning, according to at least some embodiments of the present invention. The adversarial example 513 is a face image for training the FRS. In at least some embodiments, the generation section of the device applies a perturbation 516 to a source face image with a random distribution of color values. The perturbation 516 is a shape of glasses. In at least some embodiments, the adversarial example 513 does not properly identify as multiple classes because the perturbation noise is not tuned.

[0024] At S334, the generating section or a subsection thereof applies the deep metric learning model to the adversarial examples and the target samples. In at least some embodiments, the generating section applies the deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applies the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors. In at least some embodiments, the generating section instructs the applying section to apply the deep metric learning model.

[0025] At S335, the generation section or a subsection thereof adjusts the perturbations based on the feature vector. In at least some embodiments, the generation section adjusts the perturbations to reduce the difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples. In at least some embodiments, the generation section adjusts the values ​​of the perturbations based on the results of the loss function. In at least some embodiments, when the last layer of the deep metric learning model is a feature layer φ(x), the multi-target adversarial examples (x f m-adv ) can be expressed as:

[0026]

number

[0027] where x is the sample and δ fm is a perturbation applied to sample x to form multi-target type AX. In at least some embodiments, the generation section adjusts the value of the perturbation according to:

[0028]

number

[0029] where

number

[0030] 6 is a multi-target adversarial example 613 with perturbation tuning, according to at least some embodiments of the present invention. The multi-target adversarial example 613 is a face image for training an FRS. In at least some embodiments, the generation section of the apparatus tunes the perturbations 616 to minimize a loss function over multiple iterations. In at least some embodiments, the feature vectors obtained from applying the deep metric learning model of the FRS to the multi-target adversarial example 613 occupy locations in the feature space where multiple classes overlap.

[0031] In S336, the generating section or a subsection thereof determines whether a termination condition is met. In at least some embodiments, the termination condition is met when the distance between the feature vectors in the feature space falls below a threshold. In at least some embodiments, the termination condition is met when a predetermined number of iterations of the operations in S333, S334, and S335 are performed. If the generating section determines that the termination condition is not met, the operational flow returns to perturbation application in S333 for another iteration. In at least some embodiments, the operations of applying the deep distance learning model to the adversarial examples and the plurality of target samples, and adjusting the perturbations are repeated until the difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. If the generating section determines that the termination condition is met, the operational flow proceeds to S338 to determine whether all samples have been processed.

[0032] FIG. 7 is a deep feature space map 717 according to at least some embodiments of the present invention. The deep feature space map 717 includes regions associated with classes, such as class 1 region 718A, class 2 region 718B, class 3 region 718C, and class 4 region 718D. The deep feature space map 717 further includes feature vector 714A and feature vector 714B. In at least some embodiments, the deep feature space map 717 is used to map the output of the deep metric learning model. In at least some embodiments, the feature vector 714A is output from the deep metric learning model when applied to a clean sample with initialized perturbations without adjustment. In at least some embodiments, when the perturbations are adjusted according to the target samples of class 1, class 2, and class 3, such as in the perturbation adjustment operation in S335 of FIG. 3, the mapped location of the output feature vector moves from feature vector 714A to feature vector 714B. The feature vector 714B occupies a position where class 1, class 2, and class 3 all overlap. In at least some embodiments, a deep metric learning model is trained with clean samples and tuned perturbations, the combination of which results in multi-target adversarial examples and reduces the overlapping regions of class 1 region 718A, class 2 region 718B, and class 3 region 718C.

[0033] In S338, the generation section or a subsection thereof determines whether all samples have been processed. In at least some embodiments, the generation section determines whether all samples in the batch of samples have been processed. If the generation section determines that unprocessed samples remain, the operational flow returns to perturbation initialization in S331 with the next clean sample (S339). If the generation section determines that all samples have been processed, the operational flow ends.

[0034] 8 is a schematic diagram of a portion of a deep metric learning model in accordance with at least some embodiments of the present invention. This portion includes layer 811. L , layer 811BN , and layer 811 L+1 Layer 811 BN is a batch normalization layer. In at least some embodiments, when a sample is processed through a deep metric learning model, the data is fed to layer 811 regardless of the type of sample input. L , layer 811 BN , and layer 811 L+1 Flows through.

[0035] At least some embodiments utilize disentangled adversarial training, whereby separate batch normalization (BN) layers are used during training to handle input clean samples and adversarial samples that may come from different distributions.

[0036] 9 is a schematic diagram of a portion of a deep metric learning model with an auxiliary batch normalization layer, in accordance with at least some embodiments of the present invention. In at least some embodiments, the deep metric learning model includes a main batch normalization layer and an auxiliary batch normalization layer configured to replace the main batch normalization layer. This portion includes layer 911. L , layer 911 BN , layer 911 ABN , and layer 911 L+1 It contains four layers: Layer 911 BN and Layer 911 ABN In at least some embodiments, once the samples have been processed through the deep distance learning model, the data is fed to layer 911 in response to the input of the clean sample. L , layer 911 BN , and layer 911 L+1 In at least some embodiments, as samples are processed through a deep metric learning model, the data flows through layer 911 in response to the input of adversarial examples. L , layer 911 ABN , and layer 911 L+1 Flows through.

[0037] At least some embodiments leverage disentanglement learning and multi-target AX to improve image recognition models in DML settings. A method that the inventors call AdvProp proposes to use AX to improve image recognition models. The method enables disentanglement learning during the training process using an auxiliary batch normalization layer in the model during inference of AX to optimize the following objectives:

[0038]

number

[0039] where θ are the model parameters, x are the samples, y are the labels, δ is the perturbation applied to sample x to form AX, and E x、y () is the error function, L(θ,x,y) is the loss function on the training samples, and L(θ,x+δ,y) is the loss function on AX. The AdvProp method is designed for use in a classification setting and is often more effective for models that include a classification layer. Also, the AdvProp method considers a single-targeted AX and does not change for use with a multi-targeted AX.

[0040] 10 is an operational flow for applying a deep metric learning model to sample and multi-target adversarial examples in accordance with at least some embodiments of the present invention. The operational flow provides a method for applying a deep metric learning model to sample and multi-target adversarial examples. In at least some embodiments, one or more operations of the method are performed by an application section of an apparatus, such as the apparatus shown in FIG. 13 described below.

[0041] In S1041, the applying section or a subsection thereof applies the deep metric learning model to the samples. In at least some embodiments, the applying section applies the deep metric learning model to the clean samples. In at least some embodiments, the applying section applies the deep metric learning model to the label samples. In at least some embodiments, the operation of applying the deep metric learning model to the clean samples and the label samples includes applying a primal batch normalization layer. In at least some embodiments, the applying section applies the deep metric learning model to the samples during adversarial example generation. In at least some embodiments, the applying section applies the deep metric learning model to the samples during training of the deep metric learning model.

[0042] At S1042, the application section or a subsection thereof obtains an output feature vector from the deep metric learning model, and in at least some embodiments, the application section stores the output feature vector in memory for later use in computing the loss function.

[0043] In S1043, the apply section or a subsection thereof determines whether all samples have been processed. In at least some embodiments, the apply section determines whether all samples in the batch of samples have been processed. If the apply section determines that unprocessed samples remain, the operational flow returns to model application in S1041 with the next sample (S1044). If the apply section determines that all samples have been processed, the operational flow proceeds to batch normalization layer replacement in S1045.

[0044] In S1045, the application section or a subsection thereof replaces the main batch normalization layer with the auxiliary batch normalization layer. In at least some embodiments, the application section replaces multiple main batch normalization layers with the auxiliary batch normalization layers in the deep metric learning model. In at least some embodiments, the application section replaces parameters of each main batch normalization layer with parameters of a corresponding auxiliary batch normalization layer.

[0045] At S1046, the applying section or a subsection thereof applies the deep metric learning model to the adversarial examples. In at least some embodiments, the applying section applies the deep metric learning model to the multi-target adversarial examples. In at least some embodiments, the operation of applying the deep metric learning model to the adversarial examples and the multi-target adversarial examples includes applying an auxiliary batch normalization layer. In at least some embodiments, the applying section applies the deep metric learning model to the adversarial examples during adversarial example generation. In at least some embodiments, the applying section applies the deep metric learning model to the multi-target adversarial examples during training of the deep metric learning model.

[0046] At S1047, the application section or a subsection thereof obtains an output feature vector from the deep metric learning model, and in at least some embodiments, the application section stores the output feature vector in memory for later use in computing the loss function.

[0047] In S1048, the application section or a subsection thereof determines whether all adversarial examples have been processed. In at least some embodiments, the application section determines whether all adversarial examples in the batch have been processed. If the application section determines that unprocessed adversarial examples remain, the operational flow returns to model application in S1046 with the next sample (S1049). If the application section determines that all samples have been processed, the operational flow ends.

[0048] In at least some embodiments, the application section replaces the main batch normalization layer with the auxiliary batch normalization layer more frequently than once per batch. In at least some embodiments, the application section routes data through the appropriate layer without performing a substitution between applications. In at least some embodiments, the deep metric learning model does not include an auxiliary batch normalization layer, and the application section processes all samples and examples according to operations S1041, S1042, S1043, and S1044.

[0049] 11 is an operational flow for initializing a deep metric learning model, according to at least some embodiments of the present invention. The operational flow provides a method for initializing a deep metric learning model. In at least some embodiments, one or more operations of the method are performed by an initialization section of an apparatus, such as the apparatus shown in FIG. 13 described below.

[0050] In S1121, the initialization section or a subsection thereof determines whether there is a pre-trained model as a basis for initialization. In at least some embodiments, the initialization section determines whether a pre-trained deep metric learning model was provided in memory or sent with a request for initialization. If the initialization section determines there is a pre-trained model as a basis for initialization, the operational flow proceeds to pre-trained model-based initialization in S1122. If the initialization section determines there is no pre-trained model as a basis for initialization, the operational flow proceeds to random-based initialization in S1129.

[0051] At S1122, the initialization section or a subsection thereof initializes the deep metric learning model from the pre-trained model. In at least some embodiments, the initialization section initializes the deep metric learning model based on the pre-trained model. In at least some embodiments, the initialization section initializes the deep metric learning model and assumes parameter values ​​of the pre-trained model.

[0052] In S1124, the initialization section or a subsection thereof determines whether the deep metric learning model includes an auxiliary batch normalization layer. In at least some embodiments, the initialization section determines whether the parameters for the deep metric learning model include parameters for an auxiliary batch normalization layer. If the initialization section determines that the deep metric learning model includes an auxiliary batch normalization layer, the operational flow proceeds to parameter offsetting in S1126. If the initialization section determines that the deep metric learning model does not include an auxiliary batch normalization layer, the operational flow ends.

[0053] In S1126, the initialization section or a subsection thereof offsets parameters of the pre-trained model batch normalization layer. In at least some embodiments, the initialization section adds an offset value to the value of each parameter in the batch normalization layer of the pre-trained model. In at least some embodiments, the initialization section offsets the pre-trained main BN layer parameters θ BN The auxiliary BN parameter θ AuxBN In at least some embodiments, the parameters of the model {θ NBN , θ BN , θ AuxBN} is θ NBN ←β NBN、 θ BN ←β BN、 and θ AuxBN ←β BN + γ, where the parameters of the pre-trained model are initialized as {β NBN , β BN}, where γ is a real number less than 1. In at least some embodiments, γ is less than 0.1 and may be 0.

[0054] In S1127, the initialization section or a subsection thereof initializes an auxiliary batch normalization layer of the deep metric learning model from an offset parameter. In at least some embodiments, the initialized values ​​of the auxiliary batch normalization layer are offset from corresponding values ​​of a pre-trained batch normalization layer of the pre-trained model. In at least some embodiments, the initialization section initializes the auxiliary batch normalization layer of the deep metric learning model to assume parameter values ​​of the pre-trained model after adding the offset value to each parameter value.

[0055] In S1129, the initialization section or a subsection thereof initializes the deep metric learning model from random values. In at least some embodiments, the initialization section initializes the deep metric learning model based on a random selection of a value between 0 and 1 for each parameter of the deep metric learning model. In at least some embodiments, the initialization section initializes an auxiliary batch normalization layer of the deep metric learning model and assumes initialized parameter values ​​of the main batch normalization layer. In at least some embodiments, the initialization section initializes the auxiliary batch normalization layer of the deep metric learning model and assumes initialized parameter values ​​of the main batch normalization layer after adding an offset value to each parameter value. In at least some embodiments, the initialization section initializes the auxiliary batch normalization layer of the deep metric learning model from random values ​​regardless of the parameter values ​​of the main batch normalization layer.

[0056] 12 is an operational flow for tuning a deep metric learning model, according to at least some embodiments of the present invention. The operational flow provides a method for tuning a deep metric learning model. In at least some embodiments, one or more operations of the method are performed by a tuning section of an apparatus, such as the apparatus shown in FIG. 13 described below.

[0057] In S1252, the adjustment section or a subsection thereof determines a loss based on a difference between the clean feature vector and the label feature vector. In at least some embodiments, the adjustment section determines a loss value based on a first value representing the difference between the clean feature vector and the label feature vector. In at least some embodiments, the adjustment section determines a loss based on:

[0058]

number

[0059] where θ is the model parameter and x c is a clean sample, and y c is the label sample, and L CL () is a function for the loss that measures the distance between the clean feature vector and the label feature vector.

[0060] In S1254, the tuning section or a subsection thereof determines a loss based on a difference between the multi-target adversarial feature vector and the label feature vector. In at least some embodiments, the tuning section determines a loss value based on a second value representing a difference between the multi-target adversarial feature vector and the label feature vector. In at least some embodiments, the tuning section determines a loss based on:

[0061]

number

[0062] where θ is the model parameter and x c +δ f m is a multi-target adversarial example, and y c is the label sample, and L ML () is a function for the loss that measures the distance between the multi-target adversarial feature vector and the label feature vector.

[0063] In at least some embodiments, the tuning section determines a regularization penalty to further enhance generalization and reduce the occurrence of overfitting, as follows:

[0064]

number

[0065] where θ is the model parameter and x c is a clean sample, and x c +δ f m is a multi-target adversarial example, and φ θ () is the feature vector function of the deep distance learning model, and g() is a regularization function that measures the distance between the clean feature vector and the multi-target adversarial feature vector.

[0066] At S1256, the tuning section or a subsection thereof determines a loss based on a difference between the clean feature vector and the multi-target adversarial feature vector. In at least some embodiments, the tuning section determines a loss value further based on a third value representing a difference between the clean feature vector and the multi-target adversarial feature vector. In at least some embodiments, the tuning section determines a loss based on:

[0067]

number

[0068] where θ is the model parameter and x c is a clean sample, and x c +δ f m is a multi-target adversarial example, and L CM () is a function for the loss that measures the distance between the clean feature vector and the multi-target adversarial feature vector.

[0069] At S1258, the tuning section or a subsection thereof tunes parameters of the deep distance learning model to reduce loss. In at least some embodiments, the tuning section tunes parameters to decrease the distance between the clean feature vector and the label feature vector, decrease the distance between the multi-target adversarial feature vector and the label feature vector, and increase the distance between the clean feature vector and the multi-target adversarial feature vector:

[0070]

number

[0071] Here, E (x、y)~D () is a loss-based error function. In at least some embodiments, the adjustment section is CL And L ML and L CM In other words, the tuning section of at least some embodiments determines the loss value based on a first value representing the difference between the clean feature vector and the label feature vector, and a second value representing the difference between the multi-target adversarial feature vector and the label feature vector. In at least some embodiments where the deep metric learning model includes an auxiliary batch normalization layer, tuning the deep metric learning model includes tuning the main batch normalization layer based on the first value, regardless of the second value, and tuning the auxiliary batch normalization layer based on the second value, regardless of the first value. The tuning section of at least some embodiments determines the loss value based on a first value representing the difference between the clean feature vector and the label feature vector, and a second value representing the difference between the clean feature vector and the multi-target adversarial feature vector. In at least some embodiments, the training objective with regularization penalty is given by:

[0072]

number

[0073] where x c is a clean sample, and y c is the label sample, and x c +δ f m is the multi-target type AX, and g() is a regularization function that measures the distance between the clean feature vector and the multi-target adversarial feature vector.

[0074] In at least some embodiments, the tuning section tunes parameters of the deep metric learning model that includes the auxiliary batch normalization layer according to:

[0075]

number

[0076] where x c +δ f m is a multi-target type AX in the feature space, and θ NBN are model parameters excluding the BN layer, and θ BN is the model parameter of the main BN layer, and θ AuxBN are model parameters of the auxiliary BN layer. In at least some embodiments, the adjustment section adjusts {θ NBN , θ BN} parameters and adjust the loss based on the adversarial feature vectors. NBN , θ AuxBN} Adjust the parameters.

[0077] FIG. 13 is a block diagram of a hardware configuration for automated negotiation agent adaptation in accordance with at least some embodiments of the present invention.

[0078] An exemplary hardware configuration includes an apparatus 1300 that interacts with an input device 1309 and communicates with a network 1307. In at least some embodiments, the apparatus 1300 is integrated with the input device 1309. In at least some embodiments, the apparatus 1300 is a computer system that executes computer-readable instructions that perform operations for physical network function device access.

[0079] The device 1300 includes a controller 1302, a storage unit 1304, a communication interface 1306, and an input / output interface 1308. In at least some embodiments, the controller 1302 includes a processor or programmable circuit that executes instructions, which cause the processor or programmable circuit to perform operations according to the instructions. In at least some embodiments, the controller 1302 includes analog or digital programmable circuits, or any combination thereof. In at least some embodiments, the controller 1302 includes physically separate storage devices or circuits that interact through communication. In at least some embodiments, the storage unit 1304 includes a non-volatile computer readable medium capable of storing executable and non-executable data for the controller 1302 to access during execution of instructions. The communication interface 1306 transmits and receives data to and from a network 1307. The input / output interface 1308 connects to and exchanges information with various input / output units, such as input devices 1309, via parallel ports, serial ports, keyboard ports, mouse ports, monitor ports, and the like.

[0080] The controller 1302 includes an initialization section 1370, a generation section 1372, an application section 1374, and an adjustment section 1376. The storage unit 1304 includes training samples 1380, model parameters 1382, generation parameters 1384, and a loss function 1386.

[0081] The initialization section 1370 is circuitry or instructions of the controller 1302 configured to initialize parameters of the model and perturbations. In at least some embodiments, the initialization section 1370 is configured to initialize the deep metric learning model based on a pre-trained model. In at least some embodiments, the initialization section 1370 records information such as model parameters 1382 in the storage unit 1304. In at least some embodiments, the initialization section 1370 includes subsections for performing additional functions, as described in the preceding flow charts. In at least some embodiments, such subsections are referenced by names associated with the corresponding functions.

[0082] The generation section 1372 is a circuit or instruction of the controller 1302 configured to generate multi-target adversarial examples. In at least some embodiments, the generation section 1372 is configured to apply perturbations to training samples to generate adversarial examples and then adjust the perturbations to generate multi-target adversarial examples. In at least some embodiments, the generation section 1372 utilizes information in the storage unit 1304, such as model parameters 1382 and generation parameters 1384. In at least some embodiments, the generation section 1372 includes subsections for performing additional functions, as described in the preceding flow charts. In at least some embodiments, such subsections are referenced by names associated with the corresponding functions.

[0083] The apply section 1374 is a circuit or instruction of the controller 1302 configured to apply the model to samples and examples. In at least some embodiments, the apply section 1374 is configured to apply the deep metric learning model to clean samples to obtain clean feature vectors, apply the deep metric learning model to label samples to obtain label feature vectors, and apply the deep metric learning model to multi-target adversarial examples to obtain multi-target adversarial feature vectors. In at least some embodiments, the apply section 1374 utilizes information from the storage unit 1304, such as training samples 1380 and model parameters 1382. In at least some embodiments, the apply section 1374 includes subsections for performing additional functions, as described in the preceding flow charts. In at least some embodiments, such subsections are referenced by names associated with the corresponding functions.

[0084] The tuning section 1376 is a circuit or instruction of the controller 1302 configured to adjust the perturbation values ​​and the model parameters. In at least some embodiments, the tuning section 1376 is configured to tune the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector. In at least some embodiments, the tuning section 1376 utilizes information from the storage unit 1304, such as the model parameters 1382 and the loss function 1386, and records information such as the model parameters 1382 in the storage unit 1304. In at least some embodiments, the applying section 1374 includes subsections for performing additional functions, as described in the preceding flow charts. In at least some embodiments, such subsections are referenced by names associated with the corresponding functions.

[0085] In at least some embodiments, the apparatus is a separate device capable of processing logical functions to perform the operations herein. In at least some embodiments, the controller and the storage unit need not be completely separate devices, and in some embodiments share circuitry or one or more computer-readable media. In at least some embodiments, the storage unit includes a hard drive that stores both computer-executable instructions and data accessed by the controller, and the controller includes a combination of a central processing unit (CPU) and RAM, and the computer-executable instructions can be copied in whole or in part for execution by the CPU during performance of the operations herein.

[0086] In at least some embodiments where the apparatus is a computer, a program installed on the computer can cause the computer to function as an apparatus of the embodiments described herein or to perform operations associated with the apparatus, and in at least some embodiments, such a program can be executed by a processor to cause the computer to perform specific operations associated with some or all of the blocks of the flowcharts and block diagrams described herein.

[0087] At least some embodiments are described with reference to flow charts and block diagrams, where the blocks represent (1) steps of a process in which an operation is performed, or (2) sections of a controller responsible for performing an operation. In at least some embodiments, certain steps and sections are performed by dedicated circuitry, programmable circuitry provided with computer-readable instructions stored on a computer-readable medium, and / or a processor provided with computer-readable instructions stored on a computer-readable medium. In at least some embodiments, the dedicated circuitry includes digital and / or analog hardware circuitry, including integrated circuits (ICs) and / or discrete circuits. In at least some embodiments, the programmable circuitry includes reconfigurable hardware circuitry comprising logical AND, OR, XOR, NAND, NOR, and other logic operations, flip-flops, registers, memory elements, etc., e.g., field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), etc.

[0088] In at least some embodiments, a computer-readable storage medium includes a tangible device that can hold and store instructions for use by an instruction execution device. In some embodiments, a computer-readable storage medium includes, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memories (RAMs), read-only memories (ROMs), erasable programmable read-only memories (EPROMs or flash memories), static random access memories (SRAMs), portable compact disk read-only memories (CD-ROMs), digital versatile disks (DVDs), memory sticks, floppy disks, punch cards or mechanically encoded devices such as raised structures in grooves with instructions recorded thereon, and any suitable combination of the above. As used herein, a computer-readable storage medium should not be construed as being a transitory signal per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted through wires.

[0089] In at least some embodiments, the computer-readable program instructions described herein are downloadable from a computer-readable storage medium to the respective computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. In at least some embodiments, the network includes copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. In at least some embodiments, a network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing / processing device.

[0090] In at least some embodiments, the computer readable program instructions for performing the operations described above are either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including object oriented programming languages ​​such as Smalltalk, C++, and traditional procedural programming languages ​​such as the "C" programming language or similar programming languages. In at least some embodiments, the computer readable program instructions execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In at least some embodiments, in the latter scenario, the remote computer is connected to the user's computer through any type of network, including a local area network (LAN) or wide area network (WAN), or is connected to an external computer (e.g., through the Internet using an Internet Service Provider). In at least some embodiments, electronic circuitry including, for example, programmable logic circuits, field programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), executes computer readable program instructions to individualize the electronic circuitry by utilizing state information of the computer readable program instructions to implement aspects of the invention.

[0091] Although the embodiments of the present invention have been described above, the technical scope described in the claims is not limited to the above-mentioned embodiments. Those skilled in the art will understand that various modifications and improvements to the above-mentioned embodiments are possible. Those skilled in the art will also understand from the claims that the embodiments with such modifications or improvements are included in the technical scope of the present invention.

[0092] The operations, procedures, steps, and process stages performed by the apparatus, systems, programs, and methods shown in the claims, embodiments, or figures may be performed in any order unless the order is indicated by "before," "prior to," or the like, and unless output from a previous process is used in a later process. Even if a process flow is described in the claims, embodiments, or figures using phrases such as "first" or "next," such description does not necessarily imply that the processes must be performed in the order described.

[0093] In accordance with at least some embodiments of the present invention, the deep metric learning model is trained on the multi-target adversarial examples by initializing perturbations applied to clean samples selected from a training sample set and associated with label samples to form adversarial examples, applying the deep metric learning model to the adversarial examples and a plurality of target samples selected from the training sample set to obtain an adversarial feature vector and a plurality of target feature vectors, respectively, adjusting the perturbations to reduce differences between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples, applying the deep metric learning model to the clean samples, the label samples, and the multi-target adversarial examples to obtain a clean feature vector, a label feature vector, and a multi-target adversarial feature vector, respectively, and adjusting the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector.

[0094] Some embodiments include instructions in a computer program, a method implemented by a processor executing the instructions of the computer program, and an apparatus for implementing the method. In some embodiments, the apparatus includes a controller including circuitry configured to perform operations in the instructions.

[0095] The above outlines the features of some embodiments so that those skilled in the art can better understand the aspects of the present disclosure. Those skilled in the art should understand that the present disclosure can be easily used as a basis for designing or modifying other processes and structures for carrying out the same purpose and / or achieving the same advantages as the embodiments introduced herein. Those skilled in the art should also recognize that such equivalent constructions do not depart from the spirit and scope of the present disclosure, and that various changes, substitutions, and alterations can be made herein without departing from the spirit and scope of the present disclosure.

[0096] Some or all of the above exemplary embodiments can be described as follows, but are not limited to the following:

[0097] (Appendix 1) A computer-readable medium containing instructions executable by a computer to cause a computer to perform operations, the operations comprising: Initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying the deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce the difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples; Applying the deep metric learning model to the clean samples to obtain a clean feature vector, applying the deep metric learning model to the label samples to obtain a label feature vector, and applying the deep metric learning model to the multi-target adversarial examples to obtain a multi-target adversarial feature vector; Tuning a deep distance learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector; 13. A computer readable medium comprising:

[0098] (Appendix 2) The operations of applying the deep metric learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations are repeated until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. 2. The computer-readable medium of claim 1.

[0099] (Appendix 3) Tuning a deep distance learning model a first value representing the difference between the clean feature vector and the label feature vector; and A second value that represents the difference between the clean feature vector and the multi-target adversarial feature vector 2. The computer-readable medium of claim 1, further comprising: determining a loss value based on:

[0100] (Appendix 4) Tuning a deep distance learning model a first value representing the difference between the clean feature vector and the label feature vector; and A second value that represents the difference between the multi-target adversarial feature vector and the label feature vector 2. The computer-readable medium of claim 1, further comprising: determining a loss value based on:

[0101] (Appendix 5) The deep metric learning model includes a primary batch normalization layer and an auxiliary batch normalization layer configured to replace the primary batch normalization layer; The act of applying the deep metric learning model to the clean samples and the labeled samples includes applying a primal batch normalization layer; The operation of applying the deep metric learning model to the adversarial examples and the multi-target adversarial examples includes applying an auxiliary batch normalization layer. 5. The computer-readable medium of claim 4.

[0102] (Appendix 6) Tuning a deep distance learning model adjusting the primal batch normalization layer based on the first value without regard to the second value; adjusting the auxiliary batch normalization layer based on the second value without regard to the first value; 6. The computer-readable medium of claim 5,

[0103] (Appendix 7) 7. The computer-readable medium of claim 6, wherein adjusting the deep metric learning model includes determining a loss value further based on a third value representing a difference between the clean feature vector and the multi-target adversarial feature vector.

[0104] (Appendix 8) The operations further include initializing a deep metric learning model based on the pre-trained model; The initialized values ​​of the auxiliary batch normalization layer are offset from the corresponding values ​​of the pre-trained batch normalization layer of the pre-trained model. 6. The computer-readable medium of claim 5.

[0105] (Appendix 9) Initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying the deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce the difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples; Applying the deep metric learning model to the clean samples to obtain a clean feature vector, applying the deep metric learning model to the label samples to obtain a label feature vector, and applying the deep metric learning model to the multi-target adversarial examples to obtain a multi-target adversarial feature vector; Tuning a deep distance learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector; A method comprising:

[0106] (Appendix 10) The operations of applying the deep metric learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations are repeated until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. 10. The method according to claim 9.

[0107] (Appendix 11) Tuning a deep distance learning model a first value representing the difference between the clean feature vector and the label feature vector; and A second value that represents the difference between the clean feature vector and the multi-target adversarial feature vector 10. The method of claim 9, comprising determining a loss value based on:

[0108] (Appendix 12) Tuning a deep distance learning model a first value representing the difference between the clean feature vector and the label feature vector; and A second value that represents the difference between the multi-target adversarial feature vector and the label feature vector 10. The method of claim 9, comprising determining a loss value based on:

[0109] (Appendix 13) The deep metric learning model includes a primary batch normalization layer and an auxiliary batch normalization layer configured to replace the primary batch normalization layer; The act of applying the deep metric learning model to the clean samples and the labeled samples includes applying a primal batch normalization layer; The operation of applying the deep metric learning model to the adversarial examples and the multi-target adversarial examples includes applying an auxiliary batch normalization layer. 13. The method according to claim 12.

[0110] (Appendix 14) Adjusting the deep metric learning model includes adjusting a primal batch normalization layer based on the first value without regard to the second value; adjusting the auxiliary batch normalization layer based on the second value without regard to the first value; 14. The method of claim 13, comprising:

[0111] (Appendix 15) 15. The method of claim 14, wherein adjusting the deep metric learning model includes determining a loss value further based on a third value representing a difference between the clean feature vector and the multi-target adversarial feature vector.

[0112] (Appendix 16) Initializing a deep metric learning model based on a pre-trained model Further comprising: The initialized values ​​of the auxiliary batch normalization layer are offset from the corresponding values ​​of the pre-trained batch normalization layer of the pre-trained model. 16. The method according to claim 15.

[0113] (Appendix 17) initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; Applying the deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; Adjusting the perturbation to reduce the difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples; Apply the deep metric learning model to the clean samples to obtain clean feature vectors, apply the deep metric learning model to the label samples to obtain label feature vectors, and apply the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; Tuning a deep metric learning model based on clean feature vectors, label feature vectors, and multi-target adversarial feature vectors A controller including a circuit configured to An apparatus comprising:

[0114] (Appendix 18) The circuitry is configured to repeat the operations of applying the deep metric learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. 18. The apparatus of claim 17.

[0115] (Appendix 19) The circuit configured to tune the deep metric learning model includes: a first value representing the difference between the clean feature vector and the label feature vector; and A second value that represents the difference between the clean feature vector and the multi-target adversarial feature vector 18. The apparatus of claim 17, further configured to determine a loss value based on:

[0116] (Appendix 20) The circuit configured to tune the deep metric learning model includes: a first value representing the difference between the clean feature vector and the label feature vector; and A second value that represents the difference between the multi-target adversarial feature vector and the label feature vector 18. The apparatus of claim 17, further configured to determine a loss value based on:

[0117] This application claims the benefit of U.S. Patent Application No. 17 / 687,540, filed March 4, 2022, which is incorporated by reference in its entirety.

Claims

1. A computer-readable medium containing instructions executable by a computer to cause the computer to perform operations, the operations including: Initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce a difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the labeled samples to obtain labeled feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; training the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector; 13. A computer readable medium comprising:

2. The operations of applying the deep metric learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations are repeated until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. The computer-readable medium of claim 1 .

3. Adjusting the deep metric learning model includes: a first value representing a difference between the clean feature vector and the label feature vector; and A second value representing a difference between the clean feature vector and the multi-target adversarial feature vector. The computer-readable medium of claim 1 , further comprising: determining a loss value based on:

4. Adjusting the deep metric learning model includes: a first value representing a difference between the clean feature vector and the label feature vector; and A second value representing a difference between the multi-target adversarial feature vector and the label feature vector. The computer-readable medium of claim 1 , further comprising: determining a loss value based on:

5. the deep metric learning model includes a primary batch normalization layer and an auxiliary batch normalization layer configured to replace the primary batch normalization layer; The act of applying the deep metric learning model to the clean samples and the labeled samples includes applying the primal batch normalization layer; The act of applying the deep metric learning model to the adversarial examples and the multi-target adversarial examples includes applying the auxiliary batch normalization layer. The computer-readable medium of claim 4.

6. Adjusting the deep metric learning model includes: adjusting the master batch normalization layer based on the first value without regard to the second value; adjusting the auxiliary batch normalization layer based on the second value without regard to the first value; The computer readable medium of claim 5 .

7. 7. The computer-readable medium of claim 6, wherein the adjusting the deep metric learning model comprises determining the loss value further based on a third value representing a difference between the clean feature vector and the multi-target adversarial feature vector.

8. The operations further include initializing the deep metric learning model based on a pre-trained model; the initialized values ​​of the auxiliary batch normalization layer are offset from the corresponding values ​​of a pre-trained batch normalization layer of the pre-trained model. The computer-readable medium of claim 5.

9. Initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce a difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the labeled samples to obtain labeled feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; training the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector; A method comprising:

10. The operations of applying the deep metric learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations are repeated until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value.

10. The method of claim 9.

11. Adjusting the deep metric learning model includes: a first value representing a difference between the clean feature vector and the label feature vector; and A second value representing a difference between the clean feature vector and the multi-target adversarial feature vector. The method of claim 9 , comprising determining a loss value based on:

12. Adjusting the deep metric learning model includes: a first value representing a difference between the clean feature vector and the label feature vector; and A second value representing a difference between the multi-target adversarial feature vector and the label feature vector. The method of claim 9 , comprising determining a loss value based on:

13. the deep metric learning model includes a primary batch normalization layer and an auxiliary batch normalization layer configured to replace the primary batch normalization layer; The act of applying the deep metric learning model to the clean samples and the labeled samples includes applying the primal batch normalization layer; The operation of applying the deep metric learning model to the adversarial examples and the multi-target adversarial examples includes applying the auxiliary batch normalization layer. The method of claim 12.

14. adjusting the deep metric learning model includes adjusting the primal batch normalization layer based on the first value without regard to the second value; adjusting the auxiliary batch normalization layer based on the second value without regard to the first value; The method of claim 13, comprising:

15. 15. The method of claim 14, wherein the adjusting the deep metric learning model comprises determining the loss value further based on a third value representing a difference between the clean feature vector and the multi-target adversarial feature vector.

16. Initializing the deep metric learning model based on a pre-trained model. Further comprising: the initialized values ​​of the auxiliary batch normalization layer are offset from the corresponding values ​​of a pre-trained batch normalization layer of the pre-trained model. The method of claim 15.

17. initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce a difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the label samples to obtain label feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; Train the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector. A controller including a circuit configured to An apparatus comprising:

18. The circuitry is configured to repeat the operations of applying the deep metric learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value.

20. The apparatus of claim 17.

19. The circuitry configured to adjust the deep metric learning model includes: a first value representing a difference between the clean feature vector and the label feature vector; and A second value representing a difference between the clean feature vector and the multi-target adversarial feature vector. The apparatus of claim 17 , further configured to determine a loss value based on:

20. The circuitry configured to adjust the deep metric learning model includes: a first value representing a difference between the clean feature vector and the label feature vector; and A second value representing a difference between the multi-target adversarial feature vector and the label feature vector. The apparatus of claim 17 , further configured to determine a loss value based on:

Images