Verification method, verification device, and program

Abstract

To provide a technique capable of verifying whether a graph convolution neural network is robust for an input minute change.SOLUTION: A verification method according to one embodiment is executed by a computer. The verification method comprises an input procedure, a formulation procedure, a solution procedure, and a verification procedure. The input procedure inputs a model, which is a combination of a graph convolution neural network and a forward propagation type neural network, a graph, and a set of feature vectors corresponding to each apex included in the graph. The formulation procedure formulates a problem for verifying whether the model is robust for an input minute change as a mixed integer programming problem using the set of feature vectors. The solution procedure determines a solution of the mixed integer programming problem. The verification procedure verifies whether the model is robust for the input minute change using the solution determination results.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a verification method, a verification device, and a program. [Background technology]

[0002] While neural networks are known to be able to demonstrate high performance in various machine learning inference tasks, it is also known that applying small variations to the input can significantly change the inference results. Machine learning models that are likely to change their inference results in response to small variations are unstable because they exhibit behavior that differs from expectations. Furthermore, applying small variations to the input can control the inference results, posing a security risk. For this reason, a method has been proposed to verify whether a neural network is robust to small variations in the input (Non-Patent Document 1).

[0003] Graph convolutional neural networks (GCNs) are known as neural networks for making inferences about graphs (Non-Patent Document 2). GCNs receive a graph as input and are used to make inferences about the properties of that graph. For this reason, the robustness of GCNs to small changes in input is considered important even in problems that involve graphs. A graph is defined as G = (V, E) by a pair of a set of vertices V and a set of edges E connecting two vertices, and can represent things such as the molecular structure of a compound, a social network, or a road network. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Vincent Tjeng, Kai Xiao, Russ Tedrake, "Evaluating Robustness of Neural Networks with Mixed Integer Programming", arXiv preprint arXiv:1711.07356 (2017). [Non-patent document 2] Thomas N. Kipf, Max Welling, "Semi-Supervised Classification with Graph Convolutional Networks", arXiv preprint arXiv:1609.02907 (2016). Summary of the Invention [Problem to be solved by the invention]

[0005] However, there has been no method to verify whether GCNs are robust to small changes in input.

[0006] The present disclosure has been made in consideration of the above points, and aims to provide a technology that can verify whether a graph convolutional neural network is robust to small changes in input. [Means for solving the problem]

[0007] A verification method according to one aspect of the present disclosure includes, by a computer, an input step of inputting a model that combines a graph convolutional neural network and a feedforward neural network, a graph, and a set of feature vectors corresponding to each vertex included in the graph; a formulation step of formulating, as a mixed integer programming problem, a problem for verifying whether or not the model is robust to small changes in the input using the model, the graph, and the set of feature vectors; a solution step of finding a solution to the mixed integer programming problem; and a verification step of verifying whether or not the model is robust to small changes in the input using the solution. [Effects of the Invention]

[0008] A technique is provided that can verify whether a graph convolutional neural network is robust to small changes in input. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 2 is a diagram illustrating an example of a hardware configuration of a verification apparatus according to the present embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a verification apparatus according to the present embodiment. [Figure 3] 10 is a flowchart illustrating an example of a verification process according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] An embodiment of the present invention will be described below. In the following embodiment, a verification device 10 capable of verifying whether a graph convolutional neural network (hereinafter also abbreviated as GCN) is robust to small changes in input will be described.

[0011] <Definition> First, terms used in this embodiment will be defined.

[0012] Let G = (V, E) be a graph, where V is a set of vertices and E is a set of undirected edges. Let the number of vertices in G be |V| = n. Let N be the set including v∈V and its adjacent vertices and v itself. v Let's say.

[0013] GCN is a graph G = (V, E) and its corresponding feature vector x for each vertex v∈V. v ∈R N and the state vector h corresponding to each vertex is taken as input. v ∈R K Therefore, for example, if a vector is expressed as a horizontal vector, the feature vector x v Set {x vGiven |v∈V}, the output of the GCN is a state vector h v ∈R K can be expressed as an n × K dimensional vector arranged horizontally. However, the vector can also be expressed as a vertical vector. Note that R is the set of all real numbers, and N is the feature vector x v dimensionality of the state vector h v is the number of dimensions.

[0014] feature vector x v Set {x v Since the output of a GCN when |v∈V} is given can be represented as an n×K-dimensional vector, we can consider a model that combines a GCN with a feed forward neural network (FFN), which receives the n×K-dimensional vector output from this GCN as input and outputs one of the values {1, ,M}, where M represents the number of labels in the classification problem targeted by the feed forward neural network.

[0015] Then, the above model is a graph G and its corresponding feature vector x ∈ V. v ∈R N Set {x v It is a neural network model that receives {|v∈V} as input and outputs a label {1, ,M}. Hereinafter, we will refer to the model that combines GCN and FFN (or we can say that it is a model that combines GCN and FFN) as the "combined model."

[0016] Let L be the number of layers in the GCN. Let us define the state vector corresponding to each vertex v∈V and l=1,2,...,Lth layer as

[0017]

number

[0018] h v 0 =x v , h v L =h v Let the parameters corresponding to the l=1,2,...,Lth layer be r l-1 row r l Column matrix W l In this case, the feature vector x corresponding to each vertex v∈V is v ∈R N and parameter W 1 ,W 2 ,···,W L Given that, GCN is a state vector h v l is calculated as follows:

[0019]

number

[0020]

number

[0021] Next, we formulate a problem to verify whether the combined model of GCN and FFN is robust to small changes in the input. The combined model is a graph G and its corresponding feature vector x v ∈R N Set {x v It receives as input a vertex |v∈V} and outputs a value between 1 and M as a label. The feature vector x corresponding to each vertex v∈V v Let X be the set of G ={x v |v∈V}, then the coupling model is the function g(G,X G ) In the following, the combined model will also be referred to as "g(G,X G)" or simply "g".

[0022] A set of feature vectors X G A set of feature vectors constructed by making small changes to

[0023]

number

[0024] In this case, the combined model is input G and X G To be robust against

[0025]

number

[0026]

number

[0027] <Example of hardware configuration of verification device 10> An example of the hardware configuration of a verification device 10 according to this embodiment is shown in Fig. 1. As shown in Fig. 1, the verification device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0028] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the verification device 10 does not necessarily have to have at least one of the input device 101 and the display device 102, for example.

[0029] The external I / F 103 is an interface with an external device such as a recording medium 103a. The verification device 10 can read from and write to the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0030] The communication I / F 104 is an interface for connecting the verification device 10 to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a storage device (storage device) such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 108 is an arithmetic device such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit).

[0031] The verification device 10 according to this embodiment has the hardware configuration shown in Fig. 1 and is therefore capable of implementing the verification process described below. Note that the hardware configuration shown in Fig. 1 is merely an example, and the hardware configuration of the verification device 10 is not limited to this. For example, the verification device 10 may have multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various hardware components other than the hardware shown in the figure.

[0032] <Example of functional configuration of verification device 10> An example of the functional configuration of the verification device 10 according to this embodiment is shown in Fig. 2. As shown in Fig. 2, the verification device 10 according to this embodiment includes an input unit 201, an optimization problem formulation unit 202, a solution-finding unit 203, and an output unit 204. Each of these units is realized, for example, by a process in which one or more programs installed in the verification device 10 are executed by the processor 108.

[0033] The input unit 201 receives a combined model g that combines a GCN and an FFN, a graph G, and a feature vector x that serves as a criterion for verifying robustness. v Set X of G ={x v |v∈V}, etc. Note that this information may be provided from a terminal or system connected to the verification device 10 via a communication network, or may be input from the auxiliary storage device 107 of the verification device 10.

[0034] The optimization problem construction unit 202 uses the information input by the input unit 201 to formulate a verification problem for verifying the robustness of the combined model g in the form of a mixed integer programming problem.

[0035] Here, a neural network is configured by recursively combining multiple linear and nonlinear functions, and represents a nonlinear function as a whole. When a neural network is configured by linear functions and ReLU functions, it is known that the problem for verifying the robustness of the neural network output can be formulated as a mixed integer programming problem. For example, the problem can be formulated as a mixed integer programming problem using the method described in Non-Patent Document 1 (specifically, the method described up to Section 4.1 in Chapter 4 of Non-Patent Document 1).

[0036] The solution-finding unit 203 finds a solution to the mixed integer programming problem formulated by the optimization problem construction unit 202. The solution-finding unit 203 may find a solution to the mixed integer programming problem using, for example, an existing mathematical programming problem solver (MIP solver). By using the mathematical programming problem solver, the feature vector set X G Each feature vector x contained in v However, the solution finding unit 203 may find a solution to the mixed integer programming problem using a dedicated algorithm, for example.

[0037] The output unit 204 verifies whether the combined model g is robust using the solution result obtained by the solution obtaining unit 203, and outputs the verification result to a predetermined output destination. Similar to the method described in Non-Patent Document 1, for example, the output unit 204 may verify that "the combined model g is not robust" if a solution satisfying the constraints of the mixed integer programming problem formulated by the optimization problem constructing unit 202 is obtained, or that "the combined model g is robust" if a solution satisfying the constraints is not obtained. The predetermined output destination may be any predetermined output destination, such as the display device 102, the auxiliary storage device 107, or another terminal or device connected to the verification device 10 via a communication network.

[0038] <Verification process> The verification process according to this embodiment will be described below with reference to FIG.

[0039] First, the input unit 201 receives a combined model g, a graph G, and a feature vector set X G The above information is input (step S101).

[0040] Next, the optimization problem constructing unit 202 uses the information input in the above step S101 to formulate a verification problem for verifying the robustness of the combined model g in the form of a mixed integer programming problem (step S102).

[0041] Next, the solution finding unit 203 finds a solution to the mixed integer programming problem formulated in step S102 above (step S103).

[0042] Then, if a solution satisfying the constraints of the mixed integer programming problem is obtained in step S103 above, the output unit 204 outputs a verification result indicating that "the combined model g is not robust" to a predetermined output destination, and if a solution satisfying the constraints is not obtained, the output unit 204 outputs a verification result indicating that "the combined model g is robust" to a predetermined output destination (step S104).

[0043] <Summary> As described above, the verification device 10 according to this embodiment introduces a model that combines a GCN and an FFN that receives the output of the GCN as input and performs a classification task. The problem for verifying the robustness of this model is formulated as a mixed integer programming problem. The verification device 10 according to this embodiment then verifies the robustness of the model from the solution results of this mixed integer programming problem. This makes it possible to verify and evaluate the robustness of the GCN, a machine learning model for handling graphs. This makes it possible to realize, for example, a machine learning model for handling graphs that exhibits more stable behavior and poses fewer security risks.

[0044] Therefore, by using the verification device 10 according to this embodiment, it is possible to improve the stability of various tasks implemented by machine learning models for handling graphs and reduce security risks.

[0045] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims. [Explanation of symbols]

[0046] 10 Verification equipment 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage 108 processors 109 Bus 201 Input section 202 Optimization Problem Construction Department 203 Solving section 204 Output section

Claims

1. an input procedure for inputting a model that combines a graph convolutional neural network and a feedforward neural network, a graph, and a set of feature vectors corresponding to each vertex included in the graph; a formulation procedure for formulating a problem for verifying whether the model is robust to small changes in input as a mixed integer programming problem using the model, the graph, and the set of feature vectors; a solution procedure for finding a solution to the mixed integer programming problem; a verification procedure for verifying whether the model is robust to small changes in input using the solution obtained; A computer-implemented verification method.

2. When the number of vertices included in the graph is n and the number of dimensions of a state vector corresponding to the final layer of the graph convolutional neural network is K, the graph convolutional neural network receives the graph and the set of feature vectors as input and outputs an n×K dimensional vector; 2. The verification method according to claim 1, wherein the feedforward propagation neural network receives an n×K dimensional vector as input and outputs a label that takes a discrete value within a predetermined range.

3. The verification method according to claim 2 , wherein the activation function of each layer of the graph convolutional neural network is a ReLU function.

4. The solution procedure is The verification method according to claim 1 , wherein the mixed integer programming problem is solved by a mathematical programming problem solver.

5. an input unit configured to input a model that combines a graph convolutional neural network and a feedforward propagation neural network, a graph, and a set of feature vectors corresponding to each vertex included in the graph; a formulation unit configured to formulate a problem for verifying whether the model is robust to small changes in input as a mixed integer programming problem using the model, the graph, and the set of feature vectors; a solution unit configured to solve the mixed integer programming problem; a verification unit configured to verify whether the model is robust to small changes in input using the solution; A verification device having the above configuration.

6. an input procedure for inputting a model that combines a graph convolutional neural network and a feedforward neural network, a graph, and a set of feature vectors corresponding to each vertex included in the graph; a formulation procedure for formulating a problem for verifying whether the model is robust to small changes in input as a mixed integer programming problem using the model, the graph, and the set of feature vectors; a solution procedure for finding a solution to the mixed integer programming problem; a verification procedure for verifying whether the model is robust to small changes in input using the solution obtained; A program that causes a computer to execute the following.

Images