Learning device, learning method, and learning program

Abstract

In the present invention, a calculation unit (152) calculates: a degree of divergence between an output obtained by inputting a clean sample to a trained teacher model and an output obtained by inputting an adversarial example to a learning model; and a degree of divergence between an intermediate representation of the teacher model generated in the course of obtaining the output, and an intermediate representation of the learning model generated in the course of obtaining the output. An updating unit (153) updates a parameter of the learning model so as to simultaneously optimize the degrees of divergence.

Description

[Technical field]

[0001] The present invention relates to a learning device, a learning method, and a learning program. [Background technology]

[0002] Conventionally, adversarial training is known as a method for creating a deep learning model that is robust against adversarial examples.

[0003] Adversarial examples are created by adding small, artificial perturbations that cannot be recognized by humans to a clean sample. Adversarial examples are sometimes used as adversarial input samples with the aim of perturbing the output of deep learning.

[0004] For example, in image classification, an adversarial example is created by applying artificial perturbations to an image.

[0005] Such images will cause deep learning to misclassify the image as belonging to a different image, while still retaining the original appearance of the image.

[0006] For example, if the type of sign recognized by an autonomous vehicle is changed to something different from the original, it is possible that the vehicle will misrecognize the sign.

[0007] Non-Patent Document 1 describes Adversarial Training, which improves the robustness of deep learning models by incorporating Adversarial Examples into training data in advance. [Prior art documents] [Non-patent literature]

[0008] [Non-Patent Document 1] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu, "Towards Deep Learning Models Resistant to Adversarial Attacks"(https: / / arxiv.org / abs / 1706.06083) Summary of the Invention [Problem to be solved by the invention]

[0009] However, the conventional techniques have a problem in that when improving the robustness of a model against adversarial examples, the accuracy against clean samples may be reduced.

[0010] For example, a deep learning model trained by the adversarial training described in Non-Patent Document 1 shows a certain degree of robustness against adversarial examples, but the accuracy against clean samples may decrease. [Means for solving the problem]

[0011] In order to solve the above-mentioned problems and achieve the object, the learning device is characterized by having a calculation unit that calculates the degree of deviation between a first output obtained by inputting first training data into a trained first model and a second output obtained by inputting second training data created by adding noise to the first training data into a second model, and the degree of deviation between an intermediate representation of the first model generated in the process of obtaining the first output and an intermediate representation of the second model generated in the process of obtaining the second output, and an update unit that updates parameters of the second model so that the degree of deviation between the first output and the second output and the degree of deviation between the intermediate representation of the first model and the intermediate representation of the second model are reduced. Effect of the Invention

[0012] According to the present invention, it is possible to suppress a decrease in accuracy for clean samples when improving the robustness of a model against adversarial examples. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a learning device according to the first embodiment. [Diagram 2] FIG. 2 is a diagram illustrating the learning process. [Diagram 3] FIG. 3 is a flowchart showing a process flow of the learning device of the first embodiment. [Figure 4] FIG. 4 shows the experimental results. [Diagram 5] FIG. 5 shows the experimental results. [Figure 6] FIG. 6 is a diagram illustrating an example of the configuration of a vehicle control system. [Figure 7] FIG. 7 is a diagram illustrating an example of a computer that executes a learning program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, a learning device, a learning method, and a learning program according to the present application will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the following embodiments.

[0015] In conventional adversarial training, for example, the error function L ce is minimized.

[0016]

number

[0017] In addition, the noise η (adversarial noise) is set as shown in equation (2) so that the error function is maximized under the noise magnitude constraint S.

[0018]

number

[0019] Here, x is the input training sample, y is the label attached to the sample, and the training data is a combination of x and y. Also, φ θ is a model (e.g., a deep learning model) with parameters θ.

[0020] Note that x corresponds to a clean sample, and x+η corresponds to an adversarial example.

[0021] By replacing x + η in equation (1) with x, we obtain the error function for learning clean samples. Therefore, in conventional adversarial training, we can say that adversarial examples are learned in the same way as clean samples.

[0022] In other words, in conventional adversarial training, the only constraint is that the adversarial example is classified with the same label as the original clean sample. For this reason, in conventional techniques, the adversarial example, which is a special input, may be trained as separate data with the same label as the clean sample.

[0023] As a result, the trained model may fail to extract features that were used to classify clean samples, or may perform classification using a special noise η used to create adversarial examples. In this way, the performance of the model may decrease in conventional adversarial training.

[0024] One objective of this embodiment is to suppress a decrease in accuracy for clean samples when improving the robustness of a model against adversarial examples.

[0025] [Configuration of the first embodiment] First, the configuration of the learning device according to the first embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the configuration of the learning device according to the first embodiment.

[0026] The learning device 10 receives input of a clean sample and an adversarial example, and outputs a trained deep learning model. The learning device 10 may create an adversarial example from a clean sample without receiving input of an adversarial example.

[0027] As shown in FIG. 1, the learning device 10 includes a communication unit 11, an input unit 12, an output unit 13, a storage unit 14, and a control unit 15.

[0028] The communication unit 11 performs data communication with other devices via a network. For example, the communication unit 11 is a network interface card (NIC).

[0029] The input unit 12 receives data input from a user. The input unit 12 is, for example, an input device such as a mouse or a keyboard.

[0030] The output unit 13 outputs data by displaying on a screen, etc. The output unit 13 is, for example, a display device such as a display.

[0031] The storage unit 14 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), an optical disk, etc. The storage unit 14 may be a semiconductor memory in which data can be rewritten, such as a random access memory (RAM), a flash memory, or a non-volatile static random access memory (NVSRAM).

[0032] The storage unit 14 stores an OS (Operating System) and various programs executed by the learning device 10.

[0033] The storage unit 14 stores teacher model information 141 and learning model information 142.

[0034] For example, the teacher model information 141 and the learning model information 142 are weights and biases of neural networks constituting the teacher model and the learning model, which are deep learning models, respectively. The teacher model and the learning model will be described later.

[0035] The control unit 15 controls the entire learning device 10. The control unit 15 is, for example, an electronic circuit such as a central processing unit (CPU), a micro processing unit (MPU), or a graphics processing unit (GPU), or an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0036] The control unit 15 also has an internal memory for storing programs that define various processing procedures and control data, and executes each process using the internal memory.

[0037] The control unit 15 also functions as various processing units by the operation of various programs. For example, the control unit 15 includes a classification unit 151, a calculation unit 152, and an update unit 153.

[0038] The learning process performed by the classification unit 151, the calculation unit 152, and the update unit 153 will be described with reference to Fig. 2. Fig. 2 is a diagram for explaining the learning process.

[0039] The classification unit 151 classifies an input sample into a class based on the output obtained by inputting the input sample into a model. For example, the model may recognize objects in an image and output a score for each class. In this case, the sample is an image.

[0040] Furthermore, the classification unit 151 is not limited to classification tasks, and may perform inference using a trained model.

[0041] Here, the teacher model is a trained deep learning model, and is constructed based on teacher model information 141. Note that the teacher model may be a deep learning model trained using only clean samples.

[0042] In addition, the learning model is a deep learning model of the training subject by the learning device 10, and is constructed based on the learning model information 142.

[0043] 2, the classification unit 151 inputs a clean sample x to a teacher model and performs classification. The classification unit 151 also inputs an adversarial example x+η to a learning model and performs classification.

[0044] The classification unit 151 can calculate the noise η by the method described in the following reference document. Reference: https: / / arxiv.org / abs / 1412.6572

[0045] The calculation unit 152 inputs the clean sample x to the trained teacher model and calculates the output φ t (x) and the output φ obtained by inputting Adversarial Example x+η, which is created by adding noise η to Clean Sample x, into the learning model.θ (x) and the degree of deviation L ce , and output φ t The intermediate representation φ of the teacher model generated in the process of obtaining (x) t,m (x) and output φ θ The intermediate representation φ of the learning model generated in the process of obtaining (x) θ,m Calculate the degree of deviation D from (x+η).

[0046] The teacher model is an example of the first model. Also, the clean sample x is an example of the first training data. φ t (x) is an example of the first output. t is a parameter of the teacher model. The learning model is an example of the second model. Adversarial Example x+η is an example of the second training data. φ θ (x) is an example of the second output. θ is a parameter of the learning model. Note that x may be an image or a feature extracted from an image.

[0047] In addition, φ α,β Let (γ) be a vector that represents the output of the β-th layer when γ is input to the neural network constructed from the parameter α. Also, φ α Let (γ) be a vector representing the output of the final layer when γ is input to a neural network constructed from parameters α.

[0048] In addition, the number of layers and the number of nodes in each layer are the same in the neural network of the teacher model and the neural network of the learning model. t,m (x) and intermediate representation φ θ,m (x+η) is a vector of the same size.

[0049] At this time, the calculation unit 152 calculates the output φ t (x) and the output φ, which is the output of the final layer of the learning model, which is a neural network with the same topology as the teacher model. θ(x) and the degree of deviation, and the intermediate representation φ, which is the output of the intermediate layer of the teacher model t,m (x) and the intermediate representation φ, which is the output of the intermediate layer of the learning model at the same layer as the intermediate layer (the mth layer). θ,m Calculate the degree of deviation from (x+η).

[0050] The calculation unit 152 can calculate an error function such as that shown in equation (3).

[0051]

number

[0052] The update unit 153 outputs φ t (x) and output φ θ Degree of deviation from (x) L ce , and the intermediate representation of the teacher model φ t,m (x) and the intermediate representation of the learning model φ θ,m The parameters of the learning model are updated so that the deviation from (x+η) becomes smaller.

[0053] The update unit 153 updates the parameters of the learning model, that is, the learning model information 142, so as to minimize the error function of equation (3). For example, the update unit 153 updates the parameters by the backpropagation method.

[0054] In this way, the learning device 10 can optimize the learning model for both the output and the intermediate representation.

[0055] [Processing of the first embodiment] 3 is a flowchart showing the flow of processing by the learning device of the first embodiment. As shown in FIG. 3, first, the learning device 10 inputs a clean sample to a teacher model (step S101). The teacher model is assumed to have been trained using the clean sample input in step S101 or another clean sample.

[0056] Next, the learning device 10 inputs an adversarial example to the learning model (step S102). The adversarial example is created by adding noise to the clean sample of step S101.

[0057] Here, the learning device 10 calculates an error function for optimizing both the error of the intermediate representation and the error of the output between the teacher model and the learning model (step S103). For example, the learning device 10 calculates the error function shown in formula (3).

[0058] Then, the learning device 10 updates the learning model so that the error function is optimized (step S104). For example, the learning device 10 updates the learning model information 142. The learning device 10 can output the updated learning model information 142.

[0059] [Advantages of the First Embodiment] As described above, the calculation unit 152 calculates the degree of deviation between a first output obtained by inputting the first training data to a trained first model and a second output obtained by inputting the second training data created by adding noise to the first training data to a second model, and the degree of deviation between an intermediate representation of the first model generated in the process of obtaining the first output and an intermediate representation of the second model generated in the process of obtaining the second output. The update unit 153 updates the parameters of the second model so that the degree of deviation between the first output and the second output and the degree of deviation between the intermediate representation of the first model and the intermediate representation of the second model are reduced.

[0060] In this way, the learning device 10 can perform training so that the intermediate representation is optimized in addition to the output of the model. As a result, according to the present embodiment, it is possible to suppress a decrease in accuracy for clean samples when improving the robustness of the model against adversarial examples.

[0061] The calculation unit 152 calculates the degree of deviation between a first output, which is the output of the final layer of a first model, which is a neural network, and a second output, which is the output of the final layer of a second model, which is a neural network having the same topology as the first model, and the degree of deviation between a first intermediate representation, which is the output of the intermediate layer of the first model, and a second intermediate representation, which is the output of the intermediate layer of a second model at the same hierarchical level as the intermediate layer.

[0062] This allows the output and intermediate representations to be obtained as vectors of the same size from each model, making it easy to calculate the degree of deviation.

[0063] The calculation unit 152 calculates the degree of deviation between a first output obtained by inputting first training data, which is an image, into a first model, and a second output obtained by inputting second training data, which is an image created by adding noise to the first training data, into a second model.

[0064] This will help reduce the damage caused by attacks on systems that perform image recognition using deep learning (such as the sign classification system described below).

[0065] [Experimental Results] An experiment carried out using this embodiment will be described with reference to Figures 4 and 5. Figures 4 and 5 are diagrams showing the results of the experiment.

[0066] The deep learning models used in the experiments (teacher model and learning model) are ResNet18 (Reference: https: / / arxiv.org / abs / 1512.03385) and cifar10 (Reference: https: / / www.cs.toronto.edu / ~kriz / cifar.html).

[0067] The methods for creating adversarial examples (attack techniques) used in the experiments were projected gradient descent (PGD) (Reference: Non-Patent Document 1) and Auto Attack (Reference: https: / / arxiv.org / abs / 2003.01690).

[0068] In addition, the degree of deviation D of the intermediate representation in the experiment is the LPIPS distance (Reference: https: / / arxiv.org / abs / 1801.03924).

[0069] In the graphs of Fig. 4, the vertical axis represents accuracy (image classification accuracy) and the horizontal axis represents the number of epochs (learning progress). The dashed line in Fig. 4 represents the accuracy of the model when learning is performed using the embodiment. The solid line in Fig. 4 represents the accuracy of the model when learning is performed using the conventional technology.

[0070] test_clean_accuracy is the accuracy for clean samples. Also, test_robust_accuracy is the accuracy for adversarial examples created by PGD. From FIG. 4, it can be said that the present embodiment tends to be higher in both accuracies than the conventional technology.

[0071] Furthermore, the results of performance measurement for the model with the highest test_robust_accuracy are shown in Figure 5. Standard Adversarial Training corresponds to the conventional technology, and proposed corresponds to this embodiment.

[0072] From FIG. 5, it can be said that in all cases, the present embodiment exhibits higher accuracy than the conventional technology.

[0073] Moreover, from the experimental results, it can be said that in this embodiment, not only the accuracy but also the robustness against Adversarial Examples is improved compared to the conventional techniques.

[0074] [Example] The deep learning model trained by the learning device 10 of this embodiment is used in, for example, a vehicle control system including a sign classification system.

[0075] 6 is a diagram showing an example of the configuration of a vehicle control system 2. As shown in FIG. 6, the vehicle control system 2 includes a vehicle 21, a sign classification system 22, and a driving control system 23.

[0076] The vehicle 21 is an autonomous vehicle. The vehicle 21 is equipped with an on-board camera that captures images. The sign classification system 22 and the driving control system 23 are realized by an ECU (Electronic Control Unit) or the like provided in the vehicle 21.

[0077] The sign classification system 22 can use a trained model 221, which is a deep learning model trained by the learning device 10, to classify signs appearing in an image based on image information about an image captured by the vehicle 21.

[0078] The sign classification system 22 inputs sign information, which is a classification result of the signs, to the driving control system 23. The driving control system 23 controls the acceleration, deceleration, steering, etc. of the vehicle 21 according to the input sign information.

[0079] Here, the trained model 221 is robust against adversarial example attacks, which reduces the risk that the sign classification system 22 will misrecognize a sign, causing the driving control system 23 to perform erroneous control and resulting in an accident or the like.

[0080] According to this embodiment, not only driving control systems but also various other products can be protected from adversarial examples.

[0081] [System configuration, etc.] In addition, each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or a part of it can be functionally or physically distributed or integrated in any unit according to various loads, usage conditions, etc. Furthermore, each processing function performed by each device can be realized in whole or in any part by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or can be realized as hardware by wired logic. Note that the program may be executed not only by the CPU but also by other processors such as a GPU.

[0082] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0083] [program] In one embodiment, the learning device 10 can be implemented by installing a learning program that executes the above learning process as package software or online software on a desired computer. For example, the above learning program can be executed by an information processing device, causing the information processing device to function as the learning device 10. The information processing device here includes desktop and notebook personal computers. In addition, the information processing device also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants).

[0084] The learning device 10 can also be implemented as a learning server device that provides a service related to the above learning process to a client, the client being a terminal device used by a user. For example, the learning server device is implemented as a server device that provides a learning service that uses clean samples as input and a trained model as output. In this case, the learning server device may be implemented as a web server or as a cloud that provides a service related to the above learning process by outsourcing.

[0085] 7 is a diagram showing an example of a computer that executes a learning program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these components is connected by a bus 1080.

[0086] The memory 1010 includes a read only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0087] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the learning device 10 is implemented as a program module 1093 in which computer-executable code is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configuration of the learning device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0088] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0089] Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)). The program module 1093 and the program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070. [Explanation of symbols]

[0090] 2. Vehicle Control System 10 Learning Device 11 Communications Department 12 Input section 13 Output section 14 Storage section 15 Control section 21 Vehicles 22 Sign Classification System 23 Driving Control System 141 Teacher Model Information 142 Learning Model Information 151 Classification Department 152 Calculation Department 153 Update Department 221 trained models

Claims

1. a calculation unit that calculates a degree of deviation between a first output obtained by inputting first training data into a trained first model and a second output obtained by inputting second training data, the second training data being created by adding noise to the first training data, into a second model, and a degree of deviation between an intermediate representation of the first model generated in the process of obtaining the first output and an intermediate representation of the second model generated in the process of obtaining the second output; an update unit that updates parameters of the second model so that a degree of deviation between the first output and the second output and a degree of deviation between an intermediate representation of the first model and an intermediate representation of the second model are reduced; A learning device comprising:

2. The learning device according to claim 1, characterized in that the calculation unit calculates the degree of deviation between the first output, which is the output of a final layer of the first model, which is a neural network, and the second output, which is the output of a final layer of the second model, which is a neural network having the same topology as the first model, and the degree of deviation between a first intermediate representation, which is the output of an intermediate layer of the first model, and a second intermediate representation, which is the output of an intermediate layer of the second model at the same hierarchical level as the intermediate layer.

3. 2. The learning device according to claim 1, wherein the calculation unit calculates a degree of deviation between the first output obtained by inputting the first training data, which is an image, into the first model, and a second output obtained by inputting the second training data, which is an image created by adding noise to the first training data, into the second model.

4. A learning method performed by a learning device, comprising: a calculation step of calculating the degree of deviation between a first output obtained by inputting first training data into a trained first model and a second output obtained by inputting second training data, which is created by adding noise to the first training data, into a second model, and the degree of deviation between an intermediate representation of the first model generated in the process of obtaining the first output and an intermediate representation of the second model generated in the process of obtaining the second output; an updating step of updating parameters of the second model so that a degree of deviation between the first output and the second output and a degree of deviation between the intermediate representation of the first model and the intermediate representation of the second model are reduced; A learning method comprising:

5. A learning program for causing a computer to function as the learning device according to any one of claims 1 to 3.

Images