Learning device, learning method, and learning program

Abstract

To provide an image identification model in which the robustness by hostile learning is increased while holding accuracy of a clean image.SOLUTION: A learning device 10 comprises: a hostile disturbance generation unit 13 which generates a hostile disturbance on the basis of a first clean image applied with a correct answer label and generates a superimposition image in which the generated hostile disturbance is superimposed on the first clean image; an image identification unit 14 which performs image identification to the superimposition image by using a CNN 141 in which a model parameter of the CNN that has learned image identification with the plurality of clean images as learning data is set as an initial parameter; an optimization unit 15 which executes learning of the CNN 141 by optimizing the parameter of the CNN 141 such that the image identification result to the superimposition image approximates the correct answer label of the first clean image; and a schedule unit 16 which causes the hostile disturbance generation unit 13 to generate the disturbance such that the magnitude of the hostile disturbance gradually increases.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to a learning device, a learning method, and a learning program. [Background technology]

[0002] In recent years, there has been a remarkable improvement in the accuracy of machine learning technology, particularly the use of convolutional neural networks (CNNs), for identifying and detecting objects in images, as well as for segmenting areas. Technologies that use these machine learning technologies to promote the automation of visual inspection processes in various business processes are attracting attention.

[0003] For example, when automating the visual inspection process by processing captured images, it is desirable for the CNN image processing to be in line with the intuition of the human being performing the visual inspection. For example, it is desirable for the CNN image processing to have properties such as the classification results remaining unchanged even if some noise is added to the object of classification during image classification.

[0004] CNNs are known as models with mechanisms similar to the human visual structure, and have been thought to have the same invariance to noise as humans.

[0005] However, in recent years, it has become clear that CNN image processing is not invariant to minute noise imperceptible to humans. In particular, it has been revealed that a vulnerability attack called adversarial perturbation can cause CNN image classification to be incorrect with almost 100% probability, even though the noise is barely perceptible to humans, if no countermeasures are taken. For example, it can identify an image as a car even though it appears to be a dog.

[0006] The behavior of CNNs in response to such adversarial perturbations that differ from human intuition can pose a major practical challenge. Therefore, building CNN models that are robust against adversarial perturbations is an important challenge for the practical use of CNNs.

[0007] Various methods have been proposed to build CNNs that are robust against attacks using adversarial perturbations. However, many of these methods have been found to be vulnerable to new attack methods that were developed later.

[0008] However, among the methods for constructing robust CNNs, a method called adversarial learning (Non-Patent Document 1) is known as a methodology for creating robust CNN models without significantly reducing classification accuracy even against the latest attack methods.

[0009] Adversarial learning creates adversarial perturbations that attack the CNN model to the maximum extent possible, and trains the model to correctly identify images to which the perturbations have been added. By repeating this learning process, adversarial learning builds a robust CNN model. [Prior art documents] [Non-patent literature]

[0010] [Non-Patent Document 1] M A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial Attacks”, [online], arXiv:1706.06083v4 [stat.ML], September 2019, [Retrieved June 2, 2022], Internet<URL: https: / / arxiv.org / pdf / 1706.06083.pdf> Summary of the Invention [Problem to be solved by the invention]

[0011] While adversarial learning is empirically an effective method for the purpose of increasing robustness, it has the problem that its classification accuracy for images to which no adversarial perturbations have been applied (hereinafter referred to as clean images) is significantly lower than that of CNNs trained only on clean images (hereinafter referred to as normal training CNNs).

[0012] For example, when using the WideResNet-34-10 architecture on the CIFAR-10 image dataset, a standard CNN model achieves around 95% accuracy for standard images, while the model that has undergone adversarial training achieves around 85% accuracy. The model that has undergone adversarial training has an accuracy drop of 10 points compared to the standard CNN model.

[0013] While improving robustness against attacks by malicious third parties using adversarial perturbations is an important issue, the accuracy of normal images is also very important in practice. Therefore, significantly reducing the accuracy of normal images in order to improve robustness is not practically desirable.

[0014] The present invention has been made in consideration of the above, and aims to provide a learning device, a learning method, and a learning program that provide an image recognition model that has increased robustness through adversarial learning while maintaining accuracy for clean images. [Means for solving the problem]

[0015] In order to solve the above-mentioned problems and achieve the object, the learning device of the present invention is characterized by having: a generation unit that generates a perturbation based on a first clean image to which a correct label is attached, and generates a superimposed image by superimposing the generated perturbation on the first clean image; an image classification unit that performs image classification on the superimposed image using a second neural network (NN) in which model parameters of a first NN that has learned image classification using a plurality of clean images as training data are set as initial parameters; a learning unit that executes learning of the second NN by optimizing parameters of the second NN so that the image classification result for the superimposed image approaches the correct label of the first clean image; and a control unit that causes the generation unit to generate the perturbation so that the magnitude of the perturbation increases stepwise.

[0016] Furthermore, the learning device according to the present invention is characterized by having: a generation unit that generates a perturbation based on a first clean image to which a correct label has been assigned, and generates a superimposed image by superimposing the generated perturbation on the first clean image; a first image classification unit that performs image classification on the first clean image using a first neural network (NN) that has learned image classification using a plurality of clean images as training data, and outputs an intermediate output of the first NN as a first intermediate output; a second image classification unit that performs image classification on the superimposed image using a second NN in which model parameters of the first NN are set as initial parameters, and outputs the intermediate output of the second NN as a second intermediate output; a learning unit that executes learning of the second NN by optimizing parameters of the second NN so that a difference between the image classification result of the second image classification unit for the superimposed image and the correct label of the first clean image is small, and a difference between the first intermediate output and the second intermediate output is small; and a control unit that causes the generation unit to generate the perturbation so that the magnitude of the perturbation is increased in stages. [Effects of the Invention]

[0017] According to the present invention, it is possible to provide an image recognition model that maintains accuracy for clean images while improving robustness through adversarial learning. [Brief explanation of the drawings]

[0018] [Figure 1] Figure 1 illustrates the output of the intermediate layer in a CNN trained only on clean images with correct labels, and a CNN trained on adversarial learning. [Figure 2] FIG. 2 is a diagram illustrating a learning method according to the first embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of the configuration of the learning device according to the first embodiment. [Figure 4] FIG. 4 is a flowchart illustrating a processing procedure of the learning process according to the first embodiment. [Figure 5] FIG. 5 is a flowchart showing the processing procedure of the adversarial image generation processing shown in FIG. [Figure 6] FIG. 6 is a flowchart showing the processing procedure of the image identification processing shown in FIG. [Figure 7] FIG. 7 is a flowchart showing the procedure of the optimization process shown in FIG. [Figure 8] FIG. 8 is a flowchart showing the processing procedure of the schedule processing shown in FIG. [Figure 9] FIG. 9 is a flowchart showing another processing procedure of the adversarial image generation processing shown in FIG. [Figure 10] FIG. 10 is a diagram illustrating a learning method according to the second embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of the configuration of a learning device according to the second embodiment. [Figure 12] FIG. 12 is a flowchart illustrating a processing procedure of the learning process according to the second embodiment. [Figure 13] FIG. 13 is a flowchart showing the processing procedure of the image identification processing shown in FIG. [Figure 14]FIG. 14 is a flowchart showing the processing procedure of the original image identification processing shown in FIG. [Figure 15] FIG. 15 is a flowchart showing the procedure of the optimization process shown in FIG. [Figure 16] FIG. 16 is a diagram illustrating an example of the configuration of a learning device according to the third embodiment. [Figure 17] FIG. 17 is a flowchart illustrating a processing procedure of the learning process according to the third embodiment. [Figure 18] FIG. 18 is a diagram illustrating an example of a computer that implements a learning device by executing a program. DETAILED DESCRIPTION OF THE INVENTION

[0019] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0020] [Embodiment 1] In the first embodiment, we will explain the learning of a convolutional neural network (CNN) that improves robustness through adversarial learning while maintaining image recognition accuracy for images without superimposed adversarial perturbations (hereinafter, clean images). CNN is an image recognition model.

[0021] Figure 1 shows the output of the intermediate layers of a CNN trained only on clean images with correct labels (hereinafter referred to as the "normal training CNN") (first NN) and a CNN that has undergone adversarial training (AT). Figure 1 shows the results of a survey using the CIFAR-10 dataset and the representation of the 27th layer of WideResNet28-10.

[0022] As shown in Figure 1, the output of the intermediate layer (feature representation) obtained by the normal learning CNN model ((1) in Figure 1) and the output of the intermediate layer obtained by the CNN model that underwent adversarial learning only matched about 0.2546 in terms of Cos similarity, indicating a significant difference.

[0023] This result suggests that feature extraction, which was successful with normal training CNN, is no longer possible with a CNN model that has undergone AT, resulting in a significant drop in accuracy. In the first embodiment, constraints are imposed so that AT can acquire feature representations equivalent to those for clean images acquired during normal training, in other words, so that feature extraction similar to that performed by normal training CNN can be performed.

[0024] FIG. 2 is a diagram illustrating a learning method according to the first embodiment. In the first embodiment, a clean image x clean (x) is convolved with adversarial perturbation δ to produce an adversarial image x adv When learning (x+δ) (overlapped image), curriculum learning based on the magnitude of the adversarial perturbation δ is performed ((1) in FIG. 2). In other words, in the first embodiment, the adversarial perturbation δ is generated so that the magnitude of the adversarial perturbation δ increases stepwise, thereby adv We conduct curriculum learning of AT-CNN (second NN) for the above.

[0025] For example, we use equation (1) as the loss function to optimize the parameters of AT-CNN.

[0026]

number

[0027] Here, f(θ,x+δ) is the adversarial image x adv ) is input. Equation (1) shows the label output by AT-CNN (model parameter θ) when the clean image x clean This is a loss function that indicates the error between the correct label attached to (x).

[0028] Then, by Taylor expansion of equation (1), it can be approximated as equation (2).

[0029]

number

[0030] As shown in equation (2), the first term on the right side is a loss function that indicates the error between the label output by AT-CNN when a clean image x is input and the correct label y of the clean image. The first term on the right side is a term that indicates the error between the classification result for the clean image and the correct label of the clean image.

[0031] The second and subsequent terms on the right-hand side of equation (2) are terms related to the adversarial perturbation δ, and can be said to indicate the degree of influence on the error between the classification result for the clean image and the correct label for the clean image. In other words, the magnitude of the influence of the second and subsequent terms on the right-hand side of equation (2) is dominated by the adversarial perturbation δ, and can be said to be terms specific to AT.

[0032] In the first embodiment, the magnitude of the adversarial perturbation δ is |δ| ∞ In other words, in the first embodiment, the magnitude of |δ| is gradually increased from 0 (δ=0 is the same as normal learning). ∞ That is, in the first embodiment, the adversarial perturbation δ is generated so that the influence of the adversarial perturbation δ on the error between the classification result for the clean image and the correct label for the clean image increases stepwise in the second and subsequent terms on the right side of the formula (2).

[0033] As a result, in the first embodiment, the adversarial image x adv Curriculum learning is performed by performing step-by-step learning on the influence of the adversarial perturbation δ of the AT-CNN (second NN) on the

[0034] [Learning device] Next, a description will be given of the learning device according to embodiment 1. Fig. 3 is a diagram schematically illustrating an example of the configuration of the learning device according to embodiment 1.

[0035] The learning device 10 according to the embodiment is realized by loading a predetermined program into a computer or the like including a ROM (Read Only Memory), RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. The learning device 10 also has a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc. The learning device 10 is realized by a general-purpose computer such as a workstation or a personal computer.

[0036] As shown in FIG. 3, the learning device 10 includes an image storage unit 11, an initialization unit 12, an adversarial perturbation generation unit 13 (generation unit), an image classification unit 14, an optimization unit 15 (learning unit), and a schedule unit 16 (control unit).

[0037] The image storage unit 11 stores a plurality of pairs of clean images and correct labels indicating the categories of the objects of the clean images.

[0038] The initialization unit 12 holds initial parameters of the CNN 141, which is an image recognition model. The initial parameters are model parameters of a CNN (first NN) that has previously learned image recognition using clean images as learning data. Note that the initial parameters are sufficient as long as they are model parameters of a model that can appropriately recognize clean images.

[0039] The adversarial perturbation generation unit 13 generates an adversarial perturbation (perturbation) based on a clean image (first clean image) output from the image storage unit 11 as a processing target, and generates a superimposed image by superimposing the generated adversarial perturbation on the first clean image.

[0040] The adversarial perturbation generator 13 generates an adversarial perturbation for the first clean image based on the scheduling result by the scheduler 16, the model parameters of the CNN 141 (described later) optimized by the optimizer 15, the first clean image, and the ground truth label of the first clean image. The adversarial perturbation generator 13 outputs the generated superimposed image to the image classifier 14 as an adversarial image.

[0041] The schedule result is set to generate adversarial perturbations so that the magnitude of the adversarial perturbations increases stepwise according to the learning stage of the CNN 141. The schedule result is, for example, control information that controls parameters such as the norm of the adversarial perturbations. The control target of the schedule result is not limited to the norm of the perturbation, as long as it is a parameter that does not significantly impair the feature representation learning of the CNN 141.

[0042] The image classification unit 14 receives an adversarial image to be classified from the adversarial perturbation generation unit 13, and performs image classification on the adversarial image using the CNN 141. First, at the start of learning, model parameters of a CNN that has previously learned image classification using clean images as training data are set as initial parameters in the CNN 141. Then, as learning progresses, model parameters of the CNN 141 optimized by the optimization unit 15 are set in the CNN 141. The image classification unit 14 outputs the obtained output (image classification result) to the optimization unit 15 as a model output.

[0043] The optimization unit 15 evaluates the CNN 141 based on the model output and the correct label and optimizes the model parameters of the CNN 141. The optimization unit 15 performs learning of the CNN 141 by optimizing the model parameters of the CNN 141 so that the model output for the adversarial image approaches the correct label of the first clean image.

[0044] The optimization unit 15 optimizes the parameters of the CNN 141 using the loss function of the above-mentioned formula (2). As described above, formula (2) has a term indicating the error between the classification result for the first clean image and the correct label of the first clean image, and a term indicating the influence of adversarial perturbation on this error. Under the control of the scheduler 16, the optimization unit 15 performs stepwise learning of the influence of adversarial perturbation on the error between the classification result for the first clean image of the CNN 141 and the correct label of the first clean image.

[0045] The optimization unit 15 outputs the evaluation result of the CNN 141 to the schedule unit 16. The optimization unit 15 outputs the model parameters of the optimized CNN 141 to the adversarial perturbation generation unit 13 and the image classification unit .

[0046] The scheduler 16 determines generation parameters of the adversarial perturbation generated by the adversarial perturbation generator 13 based on the evaluation result of the CNN 141. The scheduler 16 outputs the determined generation parameters to the adversarial perturbation generator 13 as a schedule result.

[0047] The scheduler 16 causes the adversarial perturbation generator 13 to generate adversarial perturbations so that the magnitude of the adversarial perturbations increases stepwise. The scheduler 16 causes the adversarial perturbation generator 13 to generate adversarial perturbations so that the magnitude of the adversarial perturbations increases stepwise according to the learning stage of the CNN 141, and causes the optimizer 15 to perform stepwise learning on the influence of the adversarial perturbations on the error between the classification result of the CNN for the first clean image and the correct label of the first clean image.

[0048] When the scheduler 16 determines that the learning is to be completed, the scheduler 16 outputs the model parameters of the CNN 141 optimized by the optimizer 15 as learned parameters.

[0049] [Learning process] Next, a description will be given of the learning process according to Embodiment 1. Fig. 4 is a flowchart showing the processing procedure of the learning process according to Embodiment 1.

[0050] As shown in FIG. 4, in the learning device 10, first, the initialization unit 12 outputs the initial parameters of the CNN 141 to the adversarial perturbation generation unit 13 and the image classification unit 14 in order to initialize the parameters of the CNN 141 (step S1).

[0051] The learning device 10 extracts a set of first clean images and a correct label corresponding to the first clean images from the image storage unit 11, transmits the first clean images and the correct label to the adversarial perturbation generation unit 13, and transmits the correct label to the optimization unit 15 (step S2).

[0052] The adversarial perturbation generator 13 performs an adversarial image generation process (step S3). The adversarial image is an image obtained by superimposing an adversarial perturbation on the first clean image.

[0053] The image classification unit 14 uses the CNN 141 to perform image classification processing on the adversarial image generated by the adversarial perturbation generation unit 13 (step S4).

[0054] The optimization unit 15 performs an optimization process to evaluate the CNN 141 and optimize the model parameters of the CNN 141 based on the model output and the correct label (step S5).

[0055] Based on the evaluation results of the CNN 141, the scheduler 16 performs a scheduling process to determine the generation parameters of the adversarial perturbation so that the magnitude of the adversarial perturbation generated by the adversarial perturbation generator 13 increases stepwise according to the learning stage of the CNN 141 (step S6).

[0056] The learning device 10 determines whether to end the learning process (step S7). If it is determined not to end the learning process (step S7: No), the learning device 10 returns to step S2 and continues learning of the CNN 141. If it is determined to end the learning process (step S7: Yes), the learning device 10 acquires the optimized model parameters of the CNN 141 as learned parameters via the scheduler 16 (step S8).

[0057] [Adversarial Image Generation Processing] Next, the adversarial image generation process (step S3) will be described. Fig. 5 is a flowchart showing the processing procedure of the adversarial image generation process shown in Fig. 4.

[0058] First, the adversarial perturbation generator 13 determines whether or not it is the start of learning (step S11).

[0059] If it is the start of learning (step S11: Yes), the adversarial perturbation generator 13 acquires initial parameters from the initialization unit 12 (step S12). The initial parameters are model parameters of a CNN that has previously learned image recognition using clean images as training data, but any model parameters of a model that can appropriately recognize clean images will suffice. The adversarial perturbation generator 13 initializes the schedule result (step S13).

[0060] If it is not the start of learning (step S11: No), the adversarial perturbation generator 13 obtains a schedule result from the scheduler 16 (step S14). The schedule result is control information for controlling parameters such as the perturbation norm of the adversarial perturbation, but is not limited to the perturbation norm as long as it is a parameter that does not significantly impair feature representation learning of the CNN 141. The adversarial perturbation generator 13 obtains the model parameters of the optimized CNN 141 from the optimizer 15 (step S15), and thereafter uses them as image identification parameters.

[0061] The adversarial perturbation generator 13 acquires the first clean image to be processed and the correct label of the first clean image from the image storage unit 11 (step S16).

[0062] The adversarial perturbation generator 13 generates adversarial perturbations based on the schedule result, the ground truth label of the first clean image, the first clean image, and the model parameters of the optimized CNN 141 acquired in step S12 or step S15 (step S17). Here, a method that maximizes the loss for the ground truth label is generally used to generate the adversarial perturbations. Furthermore, although it is assumed that Projected Gradient Descent (Non-Patent Document 1) is used as a method for generating the adversarial perturbations, other methods may be used as long as they can generate the adversarial perturbations appropriately.

[0063] The adversarial perturbation generator 13 superimposes the generated adversarial perturbation on the first clean image and outputs the result as an adversarial image to the image classifier 14 (step S18).

[0064] [Image recognition processing] Next, the image identification process (step S4) will be described. Fig. 6 is a flowchart showing the processing procedure of the image identification process shown in Fig. 4.

[0065] As shown in FIG. 6, the image discrimination unit 14 determines whether or not it is the start of learning (step S21).

[0066] If it is the start of learning (step S21: Yes), the image classification unit 14 acquires initial parameters from the initialization unit 12 (step S22). These initial parameters are assumed to be the same as the initial parameters acquired by the adversarial perturbation generation unit 13 in step S12, but even if the parameters are different, a similar effect can be obtained.

[0067] If it is not the start of learning (step S21: No), the image discrimination unit 14 acquires the model parameters of the CNN 141 after optimization from the optimization unit 15 (step S23), and thereafter uses them as image discrimination parameters.

[0068] The image classification unit 14 acquires the adversarial image output by the processing of step S18 from the adversarial perturbation generator 13 (step S24). The image classification unit 14 applies image classification based on the model parameters of the optimized CNN 141 to the adversarial image (step S25). The image classification unit 14 performs image classification processing on the adversarial image using the CNN 141 to which the model parameters acquired in step S22 or step S23 are set.

[0069] The image classification unit 14 outputs the output distribution obtained by the processing of step S25 to the optimization unit 15 as a model output (step S26).

[0070] [Optimization process] Next, the optimization process (step S5) will be described. Fig. 7 is a flowchart showing the procedure of the optimization process shown in Fig. 4.

[0071] As shown in FIG. 7, the optimization unit 15 determines whether or not it is the start of learning (step S31).

[0072] If it is the start of learning (step S31: Yes), the optimization unit 15 acquires initial parameters from the initialization unit 12 (step S32).

[0073] If it is not the start of learning (step S31: No), or after step S32 is completed, the optimization unit 15 acquires the correct label of the first clean image to be processed from the image storage unit 11 (step S33). The optimization unit 15 outputs the model output from the image classification unit 14 (step S34).

[0074] The optimization unit 15 optimizes the model parameters of the CNN 141 so as to reduce the difference between the model output x and the correct label y, and outputs the optimized parameters (step S35). The optimization unit 15 optimizes the parameters using a loss function shown in Equation (2).

[0075] The optimization unit 15 may also optimize the image classification parameters using an image classification loss that reduces the difference between the model output x and the correct label y, and output the optimized parameters. Note that, while the cross entropy shown in Equation (3) is generally used as this image classification loss, a mean square error or other similar function can also have a similar effect as long as it is an appropriate objective function for the desired classification task.

[0076]

number

[0077] The optimization unit 15 evaluates how close the model output is to the correct label and outputs the evaluation result (step S36). This evaluation may be performed using any appropriate evaluation index, such as whether or not the result of taking the argmax of the model output matches the correct label.

[0078] [Schedule Processing] Next, the schedule processing (step S6) will be described with reference to a flowchart of FIG.

[0079] 8, the scheduling unit 16 acquires the evaluation result output by the optimization unit 15 in step S36 (step S41). The scheduling unit 16 determines whether the evaluation result acquired in step S41 is equal to or greater than a reference value (step S42).

[0080] If the evaluation result is equal to or greater than the reference value (step S42: Yes), the scheduler 16 determines whether to terminate the learning of the CNN 141 based on a predetermined termination condition (step S43). The termination condition for the learning is, for example, when the parameter generating the adversarial perturbation reaches a desired value, when the number of updates of the parameter of the CNN 141 reaches a predetermined number, when the amount of parameter update becomes equal to or less than a predetermined threshold, when the loss calculated by the optimizer 15 becomes equal to or less than a predetermined threshold, etc.

[0081] When the scheduler 16 determines that the learning of the CNN 141 is to be ended (step S43: Yes), the learning device 10 ends the learning of the CNN 141.

[0082] If the scheduling unit 16 determines not to terminate the learning of the CNN 141 (step S43: No), it outputs parameters for generating new adversarial perturbations, which are obtained by updating the parameters that have been used up until now, as the scheduling result to the adversarial perturbation generation unit 13 (step S44).

[0083] In order to allow the CNN 141 to learn the influence of the adversarial perturbation in stages, the adversarial perturbation is set to increase in stages according to the learning stage. For this reason, when the accuracy of image classification for the adversarial image to be verified is saturated after 10 epochs, for example, the scheduler 16 outputs a schedule result in which the perturbation norm of the adversarial perturbation is increased from the current stage to the magnitude of the stage next to the current stage.

[0084] If the evaluation result is less than the reference value (step S42: No), the scheduler 16 outputs a schedule result that maintains the current parameters for generating the adversarial perturbation to the adversarial perturbation generator 13 (step S45).

[0085] [Effects of the First Embodiment] In this way, in the first embodiment, the CNN 141 is trained under the constraint that the magnitude of the adversarial perturbation is gradually increased so that the feature representation does not deviate significantly from that of a normal CNN that has already trained on clean images.

[0086] As a result, in the first embodiment, by gradually learning the influence of adversarial perturbations on the CNN 141, it is possible to provide an image recognition model that maintains accuracy for clean images while improving robustness through adversarial learning.

[0087] [Modification of the first embodiment] Furthermore, the adversarial perturbation generator 13 may apply a most confusing attack in generating the adversarial perturbation. Fig. 9 is a flowchart showing another processing procedure of the adversarial image generation processing shown in Fig. 4 .

[0088] Steps S51 to S56 in FIG. 9 are the same processes as steps S11 to S16 shown in FIG.

[0089] The adversarial perturbation generator 13 performs image classification processing on the first clean image using a CNN based on the optimized model parameters acquired in step S55, and searches for the most confusing category other than the correct label of the first clean image from the output result (step S57). Note that it is sufficient for the adversarial perturbation generator 13 to acquire an image classification result for the first clean image using a CNN based on the optimized model parameters, and therefore this CNN is not limited to being included in the adversarial perturbation generator 13, and may be included in another component.

[0090] The adversarial perturbation generator 13 generates adversarial perturbations based on the schedule result, the first clean image, the most confusing category acquired in step S57, and the model parameters of the CNN 141 (step S58). At this time, the adversarial perturbation generator 13 generates the adversarial perturbations so as to minimize the loss for the most confusing category. Although it is assumed that Projected Gradient Descent (Non-Patent Document 1) will be used as the generation method, other methods may be used as long as they can generate appropriate adversarial perturbations.

[0091] Step S59 shown in FIG. 9 is the same process as step S18 shown in FIG.

[0092] The Most confusing category is the class with the highest confidence score other than the correct label. Therefore, the adversarial perturbation generated based on this Most confusing category corresponds to the data point of the closest decision boundary, and even when superimposed on the first clean image, it is an attack that does not significantly change the feature representation of the first clean image. For example, while the cosine similarity between the feature representation of the adversarially perturbed image generated using the processing procedure shown in Figure 5 and the first clean image is 0.3896, the cosine similarity between the feature representation of the adversarial image generated based on the Most confusing category and the first clean image is closer, at 0.4485.

[0093] According to the modification of the first embodiment, by having the CNN 141 learn the adversarial images generated based on the most confusing category, it is possible to realize more step-by-step learning of the influence of the adversarial perturbation.

[0094] [Embodiment 2] Next, a description will be given of a second embodiment of the present invention. Fig. 10 is a diagram for explaining a learning method in the second embodiment of the present invention.

[0095] In embodiment 2, a constraint is imposed so that the feature representation of the AT-CNN (second NN) does not change from the feature representation of the normal training CNN (first NN), thereby preventing the AT-CNN from acquiring a feature representation different from that of the normal training CNN.

[0096] Specifically, in the second embodiment, knowledge distillation is performed using a normal training CNN as a teacher for training the AT-CNN ((1) in FIG. 10). Here, knowledge distillation from the output layer of the CNN only has a regularization effect. For this reason, in the second embodiment, training is performed by directly constraining the output of the intermediate layer so that the AT-CNN can perform feature extraction similar to that of a normal training CNN. In the second embodiment, training is performed using, for example, cos similarity as the loss function for constraints.

[0097] [Learning device] Next, a description will be given of a learning device according to embodiment 2. Fig. 11 is a diagram schematically illustrating an example of the configuration of a learning device according to embodiment 2.

[0098] As shown in Fig. 11, learning device 210 according to embodiment 2 has a configuration in which scheduler 16 is removed, compared to learning device 10 shown in Fig. 3. Moreover, compared to learning device 10, learning device 210 has image classification unit 214 (second image classification unit) and optimization unit 215 instead of image classification unit 14 and optimization unit 15. Learning device 210 further has original image classification unit 216 (first image classification unit).

[0099] The original image classification unit 216 performs image classification on the first clean image using a first CNN 2161 (first NN) that has learned image classification using a plurality of clean images as training data. The original image classification unit 216 outputs the intermediate output of the first CNN 2161 to the optimization unit 215 as an original image intermediate output (first intermediate output). Note that the intermediate output is assumed to be a numerical value of the processing result of a layer other than the final layer of the first CNN 2161, but any other output may be used as long as it is an appropriate feature representation for image classification.

[0100] The image classification unit 214 has a second CNN 2141 to be learned, and has the same functions as the image classification unit 14. The second CNN 2141 has the model parameters of the first CNN 2161 set as initial parameters. The image classification unit 214 outputs the intermediate output of the second CNN 2141 (second intermediate output) to the optimization unit 15, along with the model output of the second CNN 2141. The intermediate output is a numerical value of the processing result at the same processing level as the original image intermediate output. Furthermore, like the original image intermediate output, the intermediate output may be any other output as long as it is an appropriate feature representation for image classification.

[0101] The optimization unit 215 performs training of the second CNN 2141 by optimizing the parameters of the second CNN 2141 so that the difference between the image classification result for the adversarial image by the image classification unit 214 and the correct label of the first clean image is small, and the difference between the intermediate output of the original image and the intermediate output of the second CNN 2141 is small.

[0102] The optimization unit 215 optimizes the parameters of the second CNN 2141 using a loss function L, which is a weighted sum of a first loss function L1 and a second loss function L2, as shown in equation (4).

[0103]

number

[0104] In equation (4), the first loss function L1 is a loss function that indicates the difference between the image classification result for the adversarial image by the image classification unit 214 and the correct label of the first clean image. The second loss function L2 is a loss function that indicates the difference between the intermediate output of the original image and the intermediate output of the second CNN 2141. α is a hyperparameter.

[0105] [Learning process] Next, a description will be given of the learning process according to Embodiment 2. Fig. 12 is a flowchart showing the processing procedure of the learning process according to Embodiment 2.

[0106] Steps S201 to S203 shown in Fig. 12 are the same processes as steps S1 to S3 shown in Fig. 4. In step S203, the adversarial perturbation generator 13 may generate adversarial perturbations by applying the Most confusing attack (Fig. 9).

[0107] The image classification unit 214 uses the second CNN 2141 to perform image classification processing on the adversarial image generated by the adversarial perturbation generation unit 13 (step S204), and outputs a model output and an intermediate output to the optimization unit 215.

[0108] The original image classification unit 216 performs original image classification processing for performing image classification on the first clean image using the first CNN 2161 (step S205), and outputs an original image intermediate output to the optimization unit 215.

[0109] The optimization unit 215 performs an optimization process to optimize the parameters of the second CNN 2141 so that the difference between the image classification result for the adversarial image by the image classification unit 214 and the correct label of the first clean image becomes small, and the difference between the intermediate output of the original image and the intermediate output of the second CNN 2141 becomes small (step S206).

[0110] Steps S207 and S208 are the same processes as steps S7 and S8 shown in FIG.

[0111] [Image recognition processing] Next, the image identification process (step S204) will be described. Fig. 13 is a flowchart showing the processing procedure of the image identification process shown in Fig. 12.

[0112] Steps S211 to S215 shown in Fig. 13 are the same processes as steps S21 to S25 shown in Fig. 6. The image classification unit 214 outputs the model output obtained by the process of step S215 and the intermediate output of the second CNN 2141 to the optimization unit 15 (step S216).

[0113] [Original image identification processing] Next, the original image identification process (step S205) will be described. Fig. 14 is a flowchart showing the processing procedure of the original image identification process shown in Fig. 12.

[0114] The original image classification unit 216 determines whether or not it is the start of learning (step S221). If it is the start of learning (step S221: Yes), the original image classification unit 216 acquires initial parameters from the initialization unit 12 (step S222).

[0115] If it is not the start of learning (step S221: No), or after step S222 is completed, the original image classification unit 216 acquires a first clean image (step S223) and applies image classification based on the model parameters (initialization parameters) to the clean image (step S224). In step S224, the original image classification unit 216 performs image classification on the first clean image using the first CNN 2161.

[0116] The original image classification unit 216 outputs the intermediate output of the first CNN 2161 to the optimization unit 215 as an original image intermediate output (step S225).

[0117] [Optimization process] Next, the optimization process (step S206) will be described. Fig. 15 is a flowchart showing the procedure of the optimization process shown in Fig. 12.

[0118] Steps S231 to S233 shown in Fig. 15 are the same processes as steps S31 to S33 shown in Fig. 7. The optimization unit 15 acquires the model output and intermediate output from the image classification unit 214 (step S234), and acquires the original image intermediate output from the original image classification unit 216. (step S235).

[0119] Then, the optimization unit 215 optimizes the model parameters of the second CNN 2141 so that the difference between the model output output from the image classification unit 214 and the correct label of the first clean image is reduced, and the difference between the original image intermediate output and the intermediate output of the second CNN 2141 is reduced, and outputs the optimized parameters to the adversarial perturbation generation unit 13 and the image classification unit 214 (step S236).

[0120] The optimization unit 215 optimizes the image classification parameters using an image classification loss that reduces the difference between the model output x and the correct label y, as shown in equation (4), and an intermediate output loss that reduces the difference between the intermediate output of the second CNN 2141 and the intermediate output of the original image, and outputs the optimized parameters.

[0121] Note that, for image classification loss, cross entropy shown in Equation (4) is generally used, but mean squared error or other functions can also be used as long as they are an appropriate objective function for the desired classification task. The intermediate output loss is also assumed to be a least squared error function or a cosine distance function, but any appropriate objective function will do.

[0122] The optimization unit 215 evaluates how close the model output is to the correct label and outputs the evaluation result (step S237). This evaluation may be performed using any appropriate evaluation index, such as whether or not the result of taking the argmax of the model output matches the correct label.

[0123] [Effects of the second embodiment] In this way, in the second embodiment, by directly constraining the output of the intermediate layer so that the feature representation of the second CNN 2141 does not change from the feature representation of the first CNN 2161, it is possible to provide an image recognition model that maintains accuracy for clean images while improving robustness through adversarial learning.

[0124] [Embodiment 3] Next, a description will be given of embodiment 3. In embodiment 3, a case where embodiment 1 and embodiment 2 are combined will be described.

[0125] Fig. 16 is a diagram schematically illustrating an example of the configuration of a learning device according to embodiment 3. As shown in Fig. 16, learning device 310 according to embodiment 3 has a configuration in which, compared to learning device 10 shown in Fig. 3, it further includes original image classification unit 216. Moreover, compared to learning device 10 shown in Fig. 3, learning device 310 has image classification unit 214 and optimization unit 215 instead of image classification unit 14 and optimization unit 15.

[0126] Fig. 17 is a flowchart showing the processing procedure of the learning process according to embodiment 3. Steps S301 to S303 shown in Fig. 17 are the same processes as steps S1 to S3 shown in Fig. 4. Note that in step S303, the adversarial perturbation generator 13 may generate adversarial perturbations by applying the Most confusing attack (Fig. 9).

[0127] Steps S304 to S306 shown in Fig. 17 are the same processes as steps S204 to S206 shown in Fig. 12. Steps S307 to S309 shown in Fig. 17 are the same processes as steps S6 to S8 shown in Fig. 4.

[0128] As shown in this embodiment 3, while performing curriculum learning to generate adversarial perturbations so that the magnitude of the adversarial perturbations increases stepwise, parameters of the second CNN 2141 may be optimized so that the difference between the image classification result for the adversarial image by the image classification unit 214 and the correct label of the first clean image becomes small, and the difference between the intermediate output of the second CNN 2141 and the intermediate output of the original image becomes small. Learning of the second NN is executed.

[0129] [Evaluation results] Table 1 shows the results of evaluating the image classification performance of the CNN141 and the second CNN2141 trained in the first to third embodiments. For comparison, the evaluation results of a CNN (Standard) trained only on clean images and a CNN (AT) trained only on adversarial images are also shown. Clean is the result for clean images. FGSM, BIM (7), PGC (20), and CW (20) are methods for generating adversarial images.

[0130] [Table 1]

[0131] As shown in Table 1, both CNN141 trained using the training methods according to Embodiments 1 to 3 and the second CNN2141 exhibit higher image classification accuracy for clean images than a CNN (AT) trained only with adversarial images. Furthermore, both CNN141 trained using the training methods according to Embodiments 1 to 3 exhibit higher image classification accuracy for adversarial images than a CNN (Standard) trained only with clean images and a CNN (AT) trained only with adversarial images. Therefore, it was found that by using the training methods according to Embodiments 1 to 3, an image classification model with improved robustness through adversarial training can be realized while maintaining accuracy for clean images.

[0132] Furthermore, the second CNN2141 trained using the training method according to the third embodiment exhibits higher image classification accuracy for both clean images and adversarial images compared to the CNN141 and the second CNN2141 trained using the training methods according to the first and second embodiments. Therefore, it was found that by combining curriculum learning with knowledge distillation, which directly constrains the output of the intermediate layer, as in the third embodiment, it is possible to realize an image classification model that maintains accuracy for clean images while improving robustness through adversarial learning.

[0133] The learning device according to this embodiment provides certain improvements over conventional learning methods such as those described in Non-Patent Document 1, and represents an advancement in the field of image recognition technology.

[0134] [System configuration of the embodiment] Each component of learning devices 10, 210, and 310 is a functional concept and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of learning devices 10, 210, and 310 is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0135] Furthermore, all or any part of the processes performed by the learning devices 10, 210, and 310 may be realized by a CPU, a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and GPU. Furthermore, each process performed by the learning devices 10, 210, and 310 may be realized as hardware using wired logic.

[0136] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0137] [program] 18 is a diagram showing an example of a computer that executes a program to realize the learning devices 10, 210, and 310. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0138] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0139] The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, the program that defines each process of the learning devices 10, 210, and 310 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configuration of the learning devices 10, 210, and 310 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0140] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0141] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0142] The following additional notes are provided regarding the above-described embodiments.

[0143] (Additional note 1) Memory and at least one processor coupled to said memory; Including, The processor: generating a perturbation based on a first clean image to which a correct answer label has been assigned, and generating a superimposed image by superimposing the generated perturbation on the first clean image; performing image classification on the superimposed image using a second neural network (NN) in which model parameters of a first NN that has been trained to perform image classification using a plurality of clean images as training data are set as initial parameters; Optimizing parameters of the second NN so that an image classification result for the superimposed image approaches a correct label of the first clean image, thereby training the second NN; generating the perturbation so that the magnitude of the perturbation increases in steps; Learning device.

[0144] (Additional note 2) The learning device according to claim 1, The execution of the learning includes optimizing parameters of the second NN using a loss function having a term indicating an error between an image classification result for the first clean image and a correct label of the first clean image, and a term indicating an influence of the perturbation on the error; The generating of the perturbation includes causing the generating unit to generate the perturbation so that the magnitude of the perturbation increases stepwise in accordance with the learning stage of the second NN, and causing the second NN to perform stepwise learning of the influence degree. Learning device.

[0145] (Additional note 3) The learning device according to claim 1, The generation of the superimposed image involves searching for a category with the largest output value other than the correct label from the image classification result for the first clean image, and generating the perturbation so as to minimize the loss for the searched category. Learning device.

[0146] (Additional note 4) Memory and at least one processor coupled to said memory; Including, The processor: generating a perturbation based on a first clean image to which a correct answer label has been assigned, and generating a superimposed image by superimposing the generated perturbation on the first clean image; performing image classification on the first cleaned image using a first neural network (NN) that has learned image classification using a plurality of cleaned images as training data, and outputting an intermediate output of the first NN as a first intermediate output; performing image classification on the superimposed image using a second NN in which the model parameters of the first NN are set as initial parameters, and outputting an intermediate output of the second NN as a second intermediate output; Optimizing parameters of the second NN so that a difference between an image classification result for the superimposed image and a correct label of the first clean image is reduced, and a difference between the first intermediate output and the second intermediate output is reduced, thereby performing training of the second NN; generating the perturbation so that the magnitude of the perturbation increases in steps; Learning device.

[0147] (Additional note 7) A storage medium storing a learning program for causing a computer to function as the learning device according to any one of claims 1 to 4.

[0148] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention. [Explanation of symbols]

[0149] 10,210,310 Learning Device 11 Image storage unit 12 Initialization section 13 Adversarial perturbation generation unit 14,214 Image Identification Unit 15,215 Optimization Department 16 Schedule Department 141 CNN 216 Original Image Identification Unit 2141 Second CNN 2161 First CNN

Claims

1. a generating unit that generates a perturbation based on a first clean image to which a correct answer label is attached, and generates a superimposed image by superimposing the generated perturbation on the first clean image; an image classification unit that performs image classification on the superimposed image using a second neural network (NN) in which model parameters of a first NN that has learned image classification using a plurality of clean images as training data are set as initial parameters; a learning unit that performs learning of the second NN by optimizing parameters of the second NN so that an image classification result for the superimposed image approaches a correct label of the first clean image; a control unit that causes the generation unit to generate the perturbation so that the magnitude of the perturbation increases stepwise; and the learning unit optimizes parameters of the second NN using a loss function having a term indicating an error between an image classification result for the first clean image and a correct label of the first clean image, and a term indicating an influence of the perturbation on the error; The control unit causes the generation unit to generate the perturbation so that the magnitude of the perturbation increases gradually according to the learning stage of the second NN, and causes the learning unit to perform gradual learning of the influence of the second NN.

2. A generation unit that generates a perturbation based on a first clean image to which a correct answer label is attached, and generates a superimposed image by superimposing the generated perturbation on the first clean image; an image classification unit that performs image classification on the superimposed image using a second neural network (NN) in which model parameters of a first NN that has learned image classification using a plurality of clean images as training data are set as initial parameters; a learning unit that performs learning of the second NN by optimizing parameters of the second NN so that an image classification result for the superimposed image approaches a correct label of the first clean image; a control unit that causes the generation unit to generate the perturbation so that the magnitude of the perturbation increases stepwise; and The generation unit searches for a category other than the correct label that has the largest output value from the image classification result for the first clean image, and generates the perturbation so that the loss for the searched category is minimized.

3. a generating unit that generates a perturbation based on a first clean image to which a correct answer label is attached, and generates a superimposed image by superimposing the generated perturbation on the first clean image; a first image classification unit that performs image classification on the first clean image using a first neural network (NN) that has learned image classification using a plurality of clean images as training data, and outputs an intermediate output of the first NN as a first intermediate output; a second image classification unit that performs image classification on the superimposed image using a second neural network (NN) in which the model parameters of the first neural network are set as initial parameters, and outputs an intermediate output of the second neural network (NN) as a second intermediate output; a learning unit that executes learning of the second NN by optimizing parameters of the second NN so that a difference between an image classification result for the superimposed image by the second image classification unit and a correct label of the first clean image becomes small, and a difference between the first intermediate output and the second intermediate output becomes small; a control unit that causes the generation unit to generate the perturbation so that the magnitude of the perturbation increases stepwise; A learning device comprising:

4. A learning method executed by a learning device, generating a perturbation based on a first clean image to which a correct answer label has been assigned, and generating a superimposed image by superimposing the generated perturbation on the first clean image; performing image classification on the superimposed image using a second neural network (NN) in which model parameters of a first NN that has been trained to perform image classification using a plurality of clean images as training data are set as initial parameters; Optimizing parameters of the second neural network so that an image classification result for the superimposed image approaches a correct label of the first clean image, thereby training the second neural network; generating the perturbation such that the magnitude of the perturbation increases stepwise in the generating step; Including, The step of performing the learning includes optimizing parameters of the second NN using a loss function having a term indicating an error between an image classification result for the first clean image and a correct label of the first clean image, and a term indicating an influence of the perturbation on the error; A learning method characterized in that in the generating step, the perturbation is generated so that the magnitude of the perturbation increases stepwise according to the learning stage of the second NN, and in the executing step, stepwise learning of the influence of the second NN is executed.

5. A learning method executed by a learning device, comprising: generating a perturbation based on a first clean image to which a correct answer label has been assigned, and generating a superimposed image by superimposing the generated perturbation on the first clean image; performing image classification on the superimposed image using a second neural network (NN) in which model parameters of a first NN that has been trained to perform image classification using a plurality of clean images as training data are set as initial parameters; Optimizing parameters of the second neural network so that an image classification result for the superimposed image approaches a correct label of the first clean image, thereby training the second neural network; generating the perturbation such that the magnitude of the perturbation increases stepwise in the generating step; Including, The generating step is a learning method characterized in that it searches for a category other than the correct label that has the largest output value from the image classification result for the first clean image, and generates the perturbation so that the loss for the searched category is minimized.

6. A learning method executed by a learning device, generating a perturbation based on a first clean image to which a correct answer label has been assigned, and generating a superimposed image by superimposing the generated perturbation on the first clean image; performing image classification on the first clean image using a first neural network (NN) that has learned image classification using a plurality of clean images as training data, and outputting an intermediate output of the first NN as a first intermediate output; performing image classification on the superimposed image using a second neural network (NN) in which the model parameters of the first neural network are set as initial parameters, and outputting an intermediate output of the second neural network (NN) as a second intermediate output; Optimizing parameters of the second neural network to train the second neural network so that a difference between an image classification result for the superimposed image and a correct label of the first clean image is reduced, and a difference between the first intermediate output and the second intermediate output is reduced; generating the perturbation so that the magnitude of the perturbation increases stepwise in the generating step; A learning method comprising:

7. A learning program for causing a computer to function as a learning device described in any one of claims 1 to 3.

Images