Learning device, learning method, and learning program

Abstract

According to the present invention, every time noise is added to the weight of a model during Adversarial Training, a training device (10) recalculates an Adversarial Example for the weight to which the noise was added. Then the training device (10) creates a loss landscape for a loss function for the model using the recalculated Adversarial Example and flattens (regularizes) the loss landscape using Adversarial Weight Perturbation (AWP). The training device (10) adjusts the strength of the regularization of the loss landscape using a hyperparameter β. Then the training device trains the model using the loss function for which the loss landscape was regularized.

Description

[Technical field]

[0001] The present invention relates to a learning device, a learning method, and a learning program. [Background technology]

[0002] Conventionally, there is an attack called Adversarial Example, which causes a classifier to make a wrong decision by adding noise to the data to be classified. As a countermeasure against this Adversarial Example, for example, there is Adversarial Training, which trains a model (classifier) ​​using Adversarial Examples.

[0003] However, models trained through adversarial training have a problem in that they have low generalization performance for adversarial examples. It is known that the flatter the loss landscape (shape of the loss function) for the model weight, the smaller the generalization gap. This generalization gap is the difference between train acc (classification accuracy of the training data) and test acc (classification accuracy of the test data). In adversarial training, there is a technique that flattens the loss landscape for the model weight, thereby reducing the generalization gap and improving the generalization performance of adversarial examples. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Diederik P. Kingma, Max Welling, "Auto-Encoding Variational Bayes", [Retrieved October 4, 2021], Internet<URL:https: / / arxiv.org / pdf / 1312.6114.pdf> [Non-Patent Document 2] Dongxian Wu, Shu-Tao Xia, Yisen Wang, "Adversarial Weight Perturbation Helps Robust Generalization", [Retrieved October 4, 2021], Internet<URL:https: / / arxiv.org / pdf / 2004.05884> Summary of the Invention [Problem to be solved by the invention]

[0005] However, the above technique (AWP) has some insufficiencies in creating the loss landscape, so even if the loss landscape is flattened, the generalization performance of Adversarial Examples may not improve. Therefore, the present invention aims to solve the above problems and learn a model with high generalization performance for Adversarial Examples.

[0006] In order to solve the above-mentioned problems, the present invention is characterized in that, in training a model for predicting labels of input data including adversarial examples, the present invention includes a first calculation unit that recalculates adversarial examples for the weights of the model each time the weights of the model are shifted, a second calculation unit that creates a loss landscape of a loss function of the model using the recalculated adversarial examples and smoothes the created loss landscape, and a learning processing unit that trains the model using a loss function with the loss landscape smoothed. Effect of the Invention

[0007] According to the present invention, it is possible to learn a model with high generalization performance for Adversarial Examples. [Brief description of the drawings]

[0008] [Figure 1]FIG. 1 is a diagram illustrating an example of the configuration of a learning device. [Diagram 2] FIG. 2 is a flowchart illustrating an example of a processing procedure of the learning device. [Diagram 3] FIG. 3 is a flowchart illustrating an example of a processing procedure of the learning device. [Figure 4] FIG. 4 is a diagram illustrating an application example of the learning device. [Diagram 5] FIG. 5 is a diagram showing the correlation between the robust gap of a loss landscape used in AWP (Adversarial Weight Perturbation) and a loss landscape created by a learning device. [Figure 6] FIG. 6 is a diagram showing experimental results for a model trained by a learning device. [Figure 7] FIG. 7 is a diagram showing the experimental results for the model trained by the learning device. [Figure 8] FIG. 8 is a diagram illustrating an example of the configuration of a computer that executes a learning program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the embodiment described below.

[0010] [Overview of the learning device] As mentioned above, even if the loss landscape for the model's weight was flattened (normalized) using Adversarial Weight Perturbation (AWP), the generalization performance of the model's Adversarial Examples was not always improved.

[0011] Therefore, the learning device of this embodiment creates a loss landscape in which the flatter the loss landscape is in adversarial training, the smaller the generalization gap is (= the magnitude of the sharpness of the loss landscape is correlated with the magnitude of the generalization gap).The learning device then performs normalization on the loss landscape.

[0012] For example, each time the learning device shifts the weight of a model, it recalculates an adversarial example for that weight and creates a loss landscape using the recalculated adversarial example. Then, the learning device normalizes the created loss landscape. The learning device trains a model using a loss function having the loss landscape normalized as described above. This allows the learning device to train a model with high generalization performance for adversarial examples.

[0013] [Example of learning device configuration] An example of the configuration of a learning device 10 will be described with reference to Fig. 1. The learning device 10 includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15, for example.

[0014] The input unit 11 is an interface that accepts input of various data. For example, the input unit 11 accepts input of data used in a learning process and a prediction process, which will be described later. The output unit 12 is an interface that outputs various data. For example, the output unit 12 outputs a label of data predicted by the control unit 15.

[0015] The communication control unit 13 is realized by a NIC (Network Interface Card) or the like, and controls communication between an external device such as a server via a network and the control unit 15. For example, the communication control unit 13 controls communication between the control unit 15 and a management device (see FIG. 4) that manages data to be learned.

[0016] The memory unit 14 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk, and stores parameters of the model learned by the learning process described below.

[0017] The control unit 15 is realized, for example, by using a CPU (Central Processing Unit) or the like, and executes a processing program stored in the storage unit 14. Thereby, the control unit 15 functions as an acquisition unit 15a, a learning unit 15b, and a prediction unit 15c, as illustrated in FIG.

[0018] The acquisition unit 15a acquires data used in the learning process and prediction process described below via the input unit 11 or the communication control unit 13.

[0019] The learning unit 15b performs adversarial training of a model for predicting the label of input data including an adversarial example. The learning unit 15b includes a first calculation unit 151, a second calculation unit 152, and a learning processing unit 153.

[0020] In learning a model for predicting the label of input data including an Adversarial Example, the first calculation unit 151 recalculates an Adversarial Example for the weight every time the weight of the model is shifted. For example, the first calculation unit 151 adds noise (v) to the weight of the model, and recalculates an Adversarial Example for the weight to which the noise has been added.

[0021] In addition, the second calculation unit 152 creates a loss landscape for the weight of the model using the adversarial example recalculated by the first calculation unit 151, and smoothes the created loss landscape.

[0022] The learning processing unit 153 learns the model using a loss function in which the loss landscape has been smoothed by the second calculation unit 152. For example, the learning processing unit 153 obtains parameters (weights) of the model.

[0023] Here, we define the adversarial example for the weight of the above model as shown in equation (1).

[0024]

number

[0025] In equation (1), l is a loss function. Also, B(x,ε) is a set of points within a distance ε from x, and is a constraint used to make noise invisible to the human eye. Typically, the L∞ norm is used.

[0026] Moreover, the adversarial training performed by the learning unit 15b is defined as in the following equation (2).

[0027]

number

[0028] Furthermore, the sharpness of the loss landscape is calculated by the following equation (3).

[0029]

number

[0030] In equation (3), v is a Gaussian noise randomly sampled from within the region shown in equation (4). l l is calculated for each layer, and the matrix norm is measured using the Frobenius norm.

[0031]

number

[0032] Here, in the conventional technology, in order to improve the generalization performance of the adversarial examples of the model, regularization has been performed to flatten the loss landscape based on equations (5-1) to (5-3).

[0033]

number

[0034] Note that the first term on the left side of equation (5-1) is a term that indicates normal adversarial training, and the second and third terms are regularization terms that smooth the loss landscape. v uses, for example, the worst noise for weight(w) (see equation (5-3)).

[0035] Here, the adversarial example in the conventional technique (AWP) is not an optimal attack against w+v. Therefore, the learning unit 15b recalculates an adversarial example that becomes an optimal attack against w+v. Then, the learning unit 15b normalizes (smooths) the loss landscape evaluated with the recalculated adversarial example (optimal adversarial example).

[0036] In addition, in the conventional technique (AWP), the normalization of the loss landscape is too strong, so that the train acc value is difficult to improve even if the model is repeatedly trained, and as a result, there is little room for improving the generalization gap. Therefore, the learning unit 15b adjusts the strength of the loss landscape normalization term in the loss function by using the hyperparameter β. This allows the learning unit 15b to appropriately adjust the normalization of the loss landscape, so that the generalization gap can be easily improved by repeatedly training the model.

[0037]

number

[0038] The first calculation unit 151 of the learning unit 15b creates v, which is the worst noise for weight(w) (equation (5-3)), and calculates an adversarial example (η n (w+v)) (Equation (6-3)). Then, the second calculation unit 152 calculates the calculated Adversarial Example (η n Using the loss function (w+v) of the model, a loss landscape is created for the loss function of the model, and the loss landscape is smoothed (Equations (6-1) and (6-2)). At this time, the second calculation unit 152 uses a term that smoothes the loss landscape in the loss function (the normalization term (ρ AWP(renoise) (w+v)-ρ AWP(renoise) (w)) is adjusted by the hyperparameter β.

[0039] Then, the learning processing unit 153 learns the model using a loss function having the above loss landscape. For example, the learning processing unit 153 uses the learning data acquired by the acquisition unit 15a to find the weight of the model that minimizes the loss value of the above loss function.

[0040] The prediction unit 15c predicts the label of the input data using the model trained by the learning unit 15b. For example, the prediction unit 15c uses the trained model to calculate the probability of each label of newly acquired data and output the label with the highest probability. This allows the learning device 10 to output a correct label even when the input data is an Adversarial Example, for example.

[0041] [Learning process] Next, an example of a learning process procedure performed by the learning device 10 will be described with reference to Fig. 2. The process shown in Fig. 2 is started, for example, when an operational input is made to instruct the start of the learning process.

[0042] First, the acquisition unit 15a acquires training data including Adversarial Examples (S1). Next, the training unit 15b uses the training data and a loss function to train a model that represents a probability distribution of labels of input data (S2). Note that this loss function is a loss function in which the loss landscape is flattened by the above formulas (6-1) to (6-3). The training unit 15b stores the parameters of the model trained in S2 in the storage unit 14.

[0043] [Prediction processing] Next, an example of input data label prediction processing by the learning device 10 will be described with reference to Fig. 3. The processing shown in Fig. 3 is started, for example, when an operational input is made to instruct the start of prediction processing.

[0044] First, the acquisition unit 15a acquires data for which a label is to be predicted (S11). Next, the prediction unit 15c predicts the label of the data acquired in S11 using a model trained by the learning unit 15b (S12). For example, the prediction unit 15c uses the trained model to calculate p(x') of the data x' acquired in S11, and outputs the label with the highest probability.

[0045] This allows the learning device 10 to output a correct label even if the data x' is an Adversarial Example, for example.

[0046] [Application examples of learning devices] The above-described learning device 10 may be applied to anomaly detection in data. An application example in this case will be described with reference to Fig. 4. Here, an example will be described in which the function of the prediction unit 15c described above is provided in a detection device 20.

[0047] For example, the learning device 10 learns a model using teacher data (learning data) acquired from a data acquisition device and the loss function described above. After that, when the detection device 20 acquires new data x' from the data acquisition device, it calculates p(x') of the data x' using the trained model. Then, the detection device 20 outputs a report on whether the data x' is abnormal data or not, based on the label with the highest probability.

[0048] [Experimental Results] Next, experiments 1 and 2 were conducted to evaluate the model trained by the learning device 10. Note that landscape (noise) is ρ AWP We generate a loss landscape by generating Gaussian noise for v, and calculate the sharpness of the loss landscape based on the above equation (3). AWP(renoise) A loss landscape is created by generating v with Gaussian noise, and the sharpness of the loss landscape is calculated based on equation (3) above.

[0049] [Experimental conditions] Image dataset: Cifar10 Deep learning model: Resnet18 Adversarial Example: PGD PGD ​​parameters: eps=8 / 255, train_iter=7, eval_iter=20, eps_iter=0.01, rand_init=True, clip_min=0.0, clip_max=1.0

[0050] [Experiment 1] Experiment 1 will be described with reference to Fig. 5. The purpose of Experiment 1 is to confirm that the sharpness of the loss landscape (landscape (renoise)) created by the learning device 10 is more correlated with the robust generalization gap (Robust Gap, (train robust acc-test robust acc)) than the sharpness of the loss landscape (landscape (noise)) of the AWP.

[0051] In this experiment, for the adversarial trained model, the relationship between the sharpness of the loss landscape and the Robust Gap was plotted every 10 epochs as shown in Figure 5. The loss landscapes here are landscape(noise) and landscape(renoise). The numbers in parentheses in Figure 5 are the correlation coefficients between the sharpness of landscape(noise) and landscape(renoise) and the Robust Gap. As shown in Figure 5, it can be seen that the sharpness of landscape(renoise) is more closely correlated with the Robust Gap than the sharpness of landscape(noise).

[0052] From this, it was confirmed that the loss landscape created by the learning device 10 can have a lower Robust Gap than the AWP loss landscape by lowering the sharpness value (making the loss landscape flatter).

[0053] [Experiment 2] Next, Experiment 2 will be described with reference to Figures 6 and 7. The purpose of Experiment 2 is to check the generalization performance of Adversarial Examples of the model trained by the learning device 10 by performing Test Robust Acc on each of a model trained by the existing method (AWP) and a model trained by the learning device 10 (a model trained by AWP (renoise)).

[0054] In this experiment, in order to demonstrate not only the effectiveness of the introduction of β as described above, but also the effectiveness of renoise alone, β was introduced into the existing method AWP and Test Robust Acc was evaluated.

[0055] In addition, the attack methods used in the evaluation of this experiment were PGD (Projected Gradient Descent), which was used to train the model, and Auto Attack, which is currently the most powerful attack. As shown in Figures 6 and 7, it was confirmed that the model trained with AWP (renoise) had a higher Test Robust Acc than the model trained with AWP. Therefore, it was confirmed that the introduction of both renoise and β contributed to improving the generalization performance of the model's adversarial examples.

[0056] [System configuration, etc.] In addition, each component of each unit shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or a part of it can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc. Furthermore, each processing function performed by each device can be realized in whole or in part by a CPU and a program executed by the CPU, or can be realized as hardware using wired logic.

[0057] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0058] [program] The learning device 10 can be implemented by installing a program as package software or online software on a desired computer. For example, the information processing device can function as the learning device 10 by executing the above program on the information processing device. The information processing device here includes desktop and notebook personal computers. In addition, the information processing device also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone System), and further terminals such as PDA (Personal Digital Assistant).

[0059] Furthermore, learning device 10 can be implemented as a server device that provides services related to the above-mentioned processes to a client, with the terminal device used by the user being the client. In this case, the server device may be implemented as a web server, or may be implemented as a cloud that provides services related to the above-mentioned processes by outsourcing.

[0060] 8 is a diagram showing an example of a computer that executes a learning program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these components is connected by a bus 1080.

[0061] The memory 1010 includes a read only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0062] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define each process executed by the learning device 10 are implemented as program modules 1093 in which computer-executable codes are written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configuration of the learning device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0063] Data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary and executes them.

[0064] Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)). The program module 1093 and the program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070. [Explanation of symbols]

[0065] 10 Learning Device 11 Input section 12 Output section 13 Communication control section 14 Storage section 15 Control section 15a Acquisition part 15b Learning Section 15c Prediction Section 20 Detection Device 151 First Calculation Section 152 Second Calculation Section 153 Learning Processing Unit

Claims

1. In learning a model for predicting labels of input data including Adversarial Examples, which are data to which noise has been added that causes the model to misjudge the labels, a first calculation unit that recalculates Adversarial Examples for a weight, which is a parameter weight of the model, each time the weight is shifted; a second calculation unit that uses the recalculated adversarial examples to create a loss landscape, which is a shape of a loss function with respect to the weight of the model, and normalizes the created loss landscape; a learning processing unit that learns the model using a loss function obtained by normalizing the loss landscape; A learning device comprising:

2. The second calculation unit is The strength of normalization of the loss landscape is adjusted by a hyperparameter of the normalization term of the loss function.

2. The learning device according to claim 1 .

3. A prediction unit that predicts the label of input data using the trained model. The learning device according to claim 1 , further comprising:

4. A learning method executed by a learning device, comprising: In learning a model for predicting the label of input data including Adversarial Examples, which are data to which noise that causes the model to erroneously determine the label, a step of recalculating Adversarial Examples for the weights, which are parameter weights of the model, each time the weights are shifted; creating a loss landscape, which is a shape of a loss function with respect to the weight of the model, using the recalculated adversarial examples, and normalizing the created loss landscape; training the model using a loss function obtained by normalizing the loss landscape; A learning method comprising:

5. In learning a model for predicting a label of input data including an adversarial example, which is data to which noise that causes the model to erroneously determine the label, the step of recalculating an adversarial example for a weight, which is a parameter weight of the model, each time the weight is shifted; creating a loss landscape, which is a shape of a loss function with respect to the weight of the model, using the recalculated adversarial examples, and normalizing the created loss landscape; training the model using a loss function obtained by normalizing the loss landscape; A learning program for a computer to execute the above.

Images