Robustness verification device, robustness verification method and program

Abstract

Provided is a robustness verification device comprising: a similar image identification means that uses a degree of similarity between feature amounts obtained by a feature amount extractor to identify a similar image having a predetermined order position in the degree of similarity to the input image in a candidate image group; an order position count means that counts the order position of the similar image with respect to the input image in the candidate image group when adversarial perturbation is applied to the image; a order position calculation means that calculates the order position of the similar image with respect to the input image in the candidate image group when the adversarial perturbation is not applied to the image; and an order position verification means that verifies whether the order position of the similar image counted by the order position count means is within a prescribed range containing the order position of the similar image calculated by the order position calculation means.

Description

[Technical Field]

[0001] The present invention relates to a robustness verification device, a robustness verification method, and program Regarding. [Background technology]

[0002] Adversarial training (AX) has been proposed as a countermeasure against attacks using adversarial samples. Adversarial training involves including adversarial samples in the training data when training a feature extraction model. By using a feature extraction model that has undergone adversarial training, it is expected that the output results will be less affected even if adversarial samples are input. For example, Non-Patent Document 1 experimentally demonstrates that adversarial training is effective against attacks using adversarial samples against content-based image retrieval. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Mo Zhou, 3 others, “Adversarial Ranking Attack and Defense”, The 2020 European Conference on Computer Vision (ECCV 2020), 2020. Summary of the Invention [Problem to be solved by the invention]

[0004] Non-Patent Document 1 describes adversarial training that depends on an attack method when the attack method, such as a method for generating adversarial samples, is known. On the other hand, there may be cases where an attack method using adversarial samples is unknown for content-based image retrieval, and it is desirable to be able to verify the degree of impact on search results when adversarial samples are given, and to understand the impact when the attack method is unknown.

[0005] An example of an object of the present invention is to provide a robustness verification device, a robustness verification method, and program The purpose is to provide [Means for solving the problem]

[0006] According to a first aspect of the present invention, a robustness verification device includes a similar image identification means that uses similarities between features extracted by a feature extractor to identify similar images in a group of candidate images that have a predetermined similarity rank with respect to an input image; a rank counting means that counts the ranks of the similar images in the group of candidate images with respect to the input image when an adversarial perturbation is applied to the image; a rank calculation means that calculates the ranks of the similar images in the group of candidate images with respect to the input image when no adversarial perturbation is applied to the image; and a rank verification means that verifies whether the ranks of the similar images counted by the rank counting means are within a predetermined range that includes the ranks of the similar images calculated by the rank calculation means.

[0007] According to a second aspect of the present invention, a robustness verification method includes the steps of: identifying similar images in a group of candidate images, each of which has a predetermined similarity ranking relative to an input image, using a similarity between features obtained by a feature extractor; counting the rankings of the similar images in the group of candidate images relative to the input image when the images are subjected to adversarial perturbation; calculating the rankings of the similar images in the group of candidate images relative to the input image when the images are not subjected to adversarial perturbation; and verifying whether the rankings of the similar images counted when the images are subjected to adversarial perturbation are within a predetermined range that includes the rankings of the similar images calculated when the images are not subjected to adversarial perturbation.

[0008] According to a third aspect of the present invention, program a program for causing a computer to execute the steps of: identifying a similar image in a group of candidate images that has a predetermined similarity ranking with respect to an input image, using a similarity between features obtained by a feature extractor; counting the ranking of the similar image in the group of candidate images with respect to the input image when an adversarial perturbation is applied to the image; calculating the ranking of the similar image in the group of candidate images with respect to the input image when no adversarial perturbation is applied to the image; and verifying whether the ranking of the similar image counted when the adversarial perturbation is applied to the image is within a predetermined range that includes the ranking of the similar image calculated when no adversarial perturbation is applied to the image. In be. [Effects of the Invention]

[0009] The robustness verification device, the robustness verification method, and program According to this paper, it is possible to verify the degree of influence on search results when adversarial samples with adversarial perturbations are given in content-based image retrieval. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 9 is a schematic block diagram showing an example of the functional configuration of a content-based image retrieval device 900. [Figure 2] This is a diagram showing the range of image x+δ in which noise δ with infinity norm L∞ and radius ε or less is added to image x. [Figure 3] FIG. 10 is a diagram illustrating a specific example of (α,β)-robustness verification. [Figure 4] 1 is a schematic block diagram illustrating an example of the functional configuration of a robustness verification device according to a first embodiment. [Figure 5] 4 is a flowchart showing an example of a processing procedure of the robustness verification device according to the first embodiment. [Figure 6] FIG. 10 is a schematic block diagram illustrating an example of the functional configuration of a robustness verification device according to a second embodiment. [Figure 7]10 is a flowchart showing an example of a processing procedure of the robustness verification device according to the second embodiment. [Figure 8] FIG. 11 is a schematic block diagram illustrating an example of the functional configuration of a robustness verification device according to a third embodiment. [Figure 9] 13 is a flowchart showing an example of a processing procedure of a robustness verification method according to the fourth embodiment. [Figure 10] FIG. 1 is a schematic block diagram illustrating the configuration of a computer according to at least one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] The following describes embodiments of the present invention, but the following embodiments do not limit the scope of the invention as claimed. Furthermore, not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention.

[0012] <Content-based image retrieval device 900> First, an example of a content-based image retrieval device 900 that is the target of robustness verification by the robustness verification device 100 (200) will be described.

[0013] In the real world, content-based image retrieval (CBIR) is used in systems such as medical image retrieval systems, similar product retrieval systems, and face recognition systems. Content-based image retrieval is a method for finding candidate images C={c i ∈χ}(i=1~N), select an image c with high similarity to q. i ∈C, where χ represents the input space of images.

[0014] In content-based image retrieval, a feature extraction model f trained by a machine learning model such as Deep Metric Learning (DML) is used. For example, the feature extraction model f is a function f:χ→R that converts the input space of an image into an n-dimensional vector space of real numbers representing the features.n Deep distance learning trains a feature extraction function f so that features can be calculated that result in a short distance between images with high similarity and a long distance between images with low similarity.

[0015] Content-based image retrieval outputs results based on the Euclidean distance dist(f(q),f(c)) of the features between an input image q and any candidate image c∈C. For example, content-based image retrieval outputs the top k candidate images c∈C with the smallest distance from the input image q as similar images to q.

[0016] FIG. 1 is a schematic block diagram showing an example of the configuration of a content-based image retrieval device 900. As shown in FIG. When an input image q∈χ is given as a search query, the content-based image retrieval device 900 derives a set of candidate images C={c i ∈χ} (i=1 to N), and outputs images similar to q. Here, χ represents an input space of images. The content-based image retrieval device 900 includes an image storage unit 902, a feature extraction unit 904, and a rank calculation unit 906.

[0017] The image storage unit 902 stores a group of candidate images (hereinafter also referred to as a group of candidate images) C={c i ∈χ}(i=1~N). i The candidate images C may be input to the content-based image retrieval device 900 without being stored in the storage unit.

[0018] The feature extraction unit 904 uses a feature extractor f to extract the input image q and the image c acquired from the image storage unit 902. i ∈C (i=1 to N). The feature extractor f extracts features from, for example, an image input space χ to a real n-dimensional vector space (hereinafter also referred to as feature space) representing features as a function f:χ→R nThis feature extractor f is a function that has been trained in advance using a deep learning model such as deep metric learning. Deep metric learning trains the feature extractor f so that it can calculate features that result in a short distance between images with high similarity and a long distance between images with low similarity.

[0019] The rank calculation unit 906 calculates the extracted feature value f(q) and each f(c i ) (i=1~N) and the Euclidean distance dist(f(q),f(c i Then, the ranking calculation unit 906 calculates the distances of a predetermined number of images c i is output as an image similar to the input image q. The image that is j-th similar to the input image q (the image with the j-th smallest distance) is called IR(q,C). j IR stands for Image Retrieval.

[0020] Note that the content-based image retrieval device that the robustness verification device 100 (200) targets for robustness verification is not limited to the content-based image retrieval device 900, as long as it can rank the candidate image group C for the input image q using the feature extractor f. The robustness verification device 100 (200) has, as part of its input, an input image q, which serves as parameters for the content-based image retrieval device 900, a group of candidate images C, and a feature extractor f.

[0021] <Noise> Next, we will explain noise, which is a small adversarial perturbation intentionally added to an image, assumed by the robustness verification device 100 (200). Adversarial examples (AX) are known to be a serious problem for the safety of machine learning models. Adversarial examples are data created by intentionally adding small perturbations that cause machine learning models such as feature extraction models to make incorrect decisions. The perturbations added by adversarial examples are called adversarial perturbations. When machine learning models are input with adversarial examples, they may output different classes or values ​​compared to data without adversarial perturbations.

[0022] Content-based image retrieval using feature extraction models can also be subject to attacks using adversarial samples. In this case, the adversarial perturbation is noise added to the image, etc. Two potential threats to content-based image retrieval using adversarial samples are the query attack and the candidate image attack. A query image attack involves inputting an adversarial sample as the input image, which is the search query, to manipulate the output of content-based image retrieval. A candidate image attack involves inputting an adversarial sample as the candidate image to manipulate the output of content-based image retrieval. Both attacks are achieved by manipulating the output of the feature extraction model with the adversarial sample.

[0023] Examples of attacks using adversarial samples include preferentially recommending one's own products in a similar product search system used in online sales using content-based image search, or impersonating someone else's face in a face recognition system using content-based image search.

[0024] When the input space of images is χ, the robustness verification device 100 (200) calculates the infinity norm L ∞ Even if noise δ∈χ with a radius of ε or less is given, the j-th closest image IR(q,C) in the input image q and the candidate image set C is j That is, the robustness verification device 100 (200) verifies that the rank of ∀δ∈{δ∈χ|||δ|| ∞ Even if image x is a noisy image x+δ for {<ε}, image IR(q,C) j The image x to which noise is added is the input image q in the robustness verification device 100, and is an arbitrary candidate image c in the robustness verification device 200. i ∈C.

[0025] Figure 2 shows the infinity norm L for an image x.∞ This figure shows the range of image x+δ with noise δ of radius ε or less in the infinity norm. As shown in Figure 2, in the case of infinity norm, this range becomes a hypersphere of radius ε centered on x. Image x+δ is an element within this hypersphere. Note that infinity norm L ∞ is an example, and the norm is not limited to this.

[0026] First Embodiment Next, a first embodiment of the present invention will be described. The first embodiment is a robustness verification device 100 that verifies the robustness of a content-based image retrieval device 900 against a query image attack.

[0027] Let q be an input image that is a query of the content-based image retrieval device 900, and let q+δ be an input image to which noise δ of a size equal to or less than ε is added. When the content-based image retrieval device 900 receives the input image q, it generates a set of candidate images C={c i ∈χ}(i=1~N) is used to search for the jth image similar to q. j Let's say. In this case, even if an input image q+δ is input to the content-based image retrieval device 900, the robustness verification device 100 does not find IR(q,C) j Specifically, the robustness verification device 100 verifies whether the ranking of IR(q,C) does not change significantly even when an input image q+δ is input to the content-based image retrieval device 900. j The ranking of IR(q,C) j and a group of target images C with low similarity β We verify whether the fluctuation is at most α.

[0028] <Verification of (α,β)-Robustness against Query Image Attacks> First, (α, β)-Robustness Verification, which is a basic concept when the robustness verification device 100 verifies robustness, will be described.

[0029] The (α,β)-robustness verification against query image attacks is defined as follows: Let α be a natural number greater than or equal to 0, and β be a real number greater than or equal to 0. In this case,

number

number

number

[0030] Equation (1) represents the range of noise δ added to the input image. χ represents the input space of the image. "δ∈χ" indicates that δ is also an element of the input space of the image. "||δ|| p " is the infinity norm of δ L ∞ represents ||δ|| p ≦ε” is the infinity norm L of δ ∞ This indicates that the magnitude of the p-norm is equal to or less than ε. This is shown in Figure 2. Note that the p-norm is not limited to the ∞-norm, and may be any of the 1-, 2-, or p-norm.

[0031] Equation (3) is a set of images (hereinafter referred to as the target image group) C that are the subject of robustness verification in equation (2). β It represents "{IR(q,C) j}" is IR(q,C) j (the j-th candidate image similar to q that the content-based image retrieval device 900 retrieves from the candidate image group C when the input image q is input) is defined as C β It represents the inclusion of

[0032] “{c|c∈C,β≦||f(c)-f(IR(q,C) j )|| qRegarding "{β≦||f(c)-f(IR(q,C)}", first, "c∈C" indicates the condition that c is an element of the candidate image group C. "f(c)" indicates the feature extracted by the feature extractor f for image c. This feature extractor f is the feature extractor of the content-based image retrieval device 900. "{β≦||f(c)-f(IR(q,C) j )|| q}" is the image IR(q,C) j This represents the condition that the magnitude of the difference in q-norm between the feature of and the feature of image c is greater than or equal to β. β β is a parameter that determines the candidate image considering the change in ranking. β is a parameter that determines the candidate image considering the change in ranking. β By not including it in IR(q,C) j This means that fluctuations in the ranking of similar images are allowed. The larger β is, the easier it is to verify (α,β)-robustness. Note that the q-norm can be 1, 2, p, or ∞ norm.

[0033] Equation (2) expresses the specific conditions for (α, β)-robustness verification. "Rank(q, c, C)" expresses the ranking of image c in the candidate image group C in terms of similarity using feature extractor f when input image q is used. Therefore, "Rank(q + δ, IR(q, C) j ,C β ) is the target image group C obtained by equation (3). β In this case, the image IR(q,C) when the input image is q+δ is j Also, "Rank(q,IR(q,C) j ,C β ) is the target image group C obtained by equation (3). β In this case, the image IR(q,C) is the image when the input image is q. j Therefore, equation (2) expresses the ranking of the target image group C obtained by equation (3). β In this case, the image IR(q,C) when the input image is q+δ is j The ranking of the input image q is the image IR(q,C) jThis represents the condition that the ranking of the (α,β) is allowed to fluctuate by at most α. α is a parameter that indicates the amount of fluctuation in the ranking that is allowed, and indicates that a fluctuation in ranking of at most α is allowed. The larger α is, the easier it is to verify (α,β)-robustness.

[0034] 3 is a diagram showing a specific example of (α, β)-robustness verification. (α, β)-robustness verification is a method for verifying whether IR(q,C) is a robustness factor when a noise δ of a magnitude equal to or smaller than ε is added to an input image q. j The ranking of IR(q,C) j and a group of target images C with low similarity β We verify whether the fluctuation is at most α in

[0035] Figure 3 shows an example of the feature space created by the feature extractor f. The circle shown in Figure 3 has a radius of β and its center is the image IR(q,C). j The point f(IR(q,C) represents the feature value obtained by the feature extractor f. j ) where f(q) and f(q+δ) are points representing the features obtained by feature extractor f for input image q and input image q+δ with noise δ added, respectively. f(c1), f(c2), f(c3), f(c4), and f(c5) are points representing the features obtained by feature extractor f for images c1, c2, c3, c4, and c5 included in candidate image group C, respectively. Note that the distance between points represented by the features is the distance on the plane shown in Figure 3.

[0036] As shown in Figure 3, when the parameter β is used to consider the change in ranking, β≦||f(c)-f(IR(q,C)) in equation (3) j )|| q The images that satisfy this are c3, c4, and c5, which are outside the circle. Therefore, C β ={IR(q,C) j , c3, c4, c5}.

[0037] The ranking by the content-based image retrieval device 900 for the input image q before adding noise is C β The images contained in are sorted in order of proximity to f(q), so 1st place: IR(q,C)j 2nd place:c4 3rd place:c3 4th place:c5 On the other hand, the ranking by the content-based image retrieval device 900 for the input image q+δ after adding noise δ is C β The images in the image are sorted by their proximity to f(q+δ), so 1st place:c3 2nd place:c4 3rd place: IR(q,C) j 4th place:c5 This becomes:

[0038] Therefore, in equation (2), Rank(q+δ,IR(q,C) j ,C β )=3, and Rank(q,IR(q,C) j ,C β ) = 1, so equation (2) becomes 1-α≦3≦1+α. Therefore, if α≧2, then IR(q,C) j is (α,β)-robust verified, and if α=0, 1, then IR(q,C) j is not verified as (α,β)-robust.

[0039] <Robustness verification device 100> The robustness verification device 100 performs the above-mentioned (α, β)-robustness verification, but accurate calculation of the (α, β)-robustness verification is difficult due to the amount of calculation involved. In other words, it is difficult for the robustness verification device 100 to verify equation (2) for any δ that satisfies (1). Therefore, the robustness verification device 100 performs the following:

number

[0040] That is, the robustness verification device 100:

number

[0041] The robustness verification device 100 performs the calculation using, for example, the well-known technique Interval Bound Propagation (IBP) described in the following non-patent document. IBP is a technique for solving the problem of noise δ∈{δ|||δ|| ∞ ≦ε}, when an image q+δ with noise δ is input, the upper and lower limits of each element i of the feature f(q+δ) are calculated sequentially by calculating the upper and lower limits of each element of the intermediate layer representation in each layer. Here, if the feature is an n-dimensional vector, i represents its i-th element (1≦i≦n).

[0042] <Non-patent literature> Sven Gowal, 8 others, “On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models”, The 2019 International Conference on Computer Vision (ICCV 2019), 2019.

[0043] The robustness verification device 100 uses IBP to calculate f(q+δ) iUpper bound of ￣f(q) i and lower bound f(q) i where i represents the i-th element of the n-dimensional vector. Then, the robustness verification device 100 calculates the upper limit d of d(f(q+δ),f(c)) using the upper and lower limits. q (f(q),f(c)) and lower bound _d q (f(q), f(c)) are calculated using equations (6) and (7), respectively.

[0044]

number

number

[0045] In equation (6), "|￣f(q) i -f(c) i |1" represents the absolute value of the difference between the upper limit of the i-th element of the feature of input image q and the i-th element of the feature of image c. "|f(c) i -_f(q) i |1" represents the absolute value of the difference between the i-th element of the feature of image c and the lower limit of the i-th element of the feature of input image q. The right-hand side of equation (6) represents the square of the larger of these values, summed over all n-dimensional elements i. This value is the upper limit ￣d of d(f(q+δ),f(c)). q (f(q),f(c)).

[0046] In equation (7), "￣f(q) i -f(c) i " represents the difference between the upper limit of the i-th element of the feature of input image q and the i-th element of the feature of image c. "f(c) i -_f(q) i " represents the difference between the i-th element of the feature of image c and the lower limit of the i-th element of the feature of input image q. The right-hand side of equation (7) represents the square of the smaller of these values ​​and 0, and the sum of the squares of the values ​​obtained for all elements i in n dimensions. This value is the lower limit _d of d(f(q+δ),f(c)). q (f(q),f(c)).

[0047] When the robustness verification device 100 calculates the upper and lower limits of equation (5) using the above-mentioned calculation method using IBP, the norm of equation (4) becomes an infinity norm. Furthermore, the robustness verification device 100 may calculate the upper and lower bounds of d(f(q+δ),f(c)) using a calculation method other than IBP, in which case the norm of equation (4) is not limited to the infinity norm.

[0048] The robustness verification device 100 determines the upper limit d of d(f(q+δ),f(c)). q (f(q),f(c)) and lower bound _d q (α,β)-robustness verification is performed using (f(q),f(c)).

[0049] 4 is a schematic block diagram showing an example of the functional configuration of a robustness verification device 100 according to the first embodiment. The robustness verification device 100 includes a similar image identification unit 102, a comparison image calculation unit 104, an upper / lower limit calculation unit 106, and a rank verification unit 108. The rank verification unit 108 includes a rank calculation unit 110 and a rank counting unit 112. The robustness verification device 100 performs a robustness verification using an input image q∈χ, which is a query, and a set of candidate images C={c i ∈χ} (i=1 to N), a feature extractor f, a perturbation size ε, parameters α, β, and rank j are input. Note that the robustness verification device 100 may not receive the candidate image group C as input, but may instead include a storage unit that stores the candidate image group C. The ranking verification unit 108 corresponds to an example of ranking verification means.

[0050] The similar image identification unit 102 receives an input image q, a group of candidate images C, a feature extractor f, and a rank j, and identifies an image IR(q, C) that is j-th similar to the input image q in the group of candidate images C. j Specifically, the similar image identification unit 102 uses a feature extractor f to extract the input image q and each candidate image c i ∈C features f(q), f(c i ) (i=1 to N). Then, the similar image identification unit 102 calculates the feature amount f(q) and each f(c i) and the Euclidean distance dist(f(q),f(c i Then, the similar image identification unit 102 calculates the image that is j-th most similar to the input image q (the image with the j-th smallest distance) as IR(q,C). j The similar image identification unit 102 corresponds to the search performed by the content-based image search device 900. The similar image identifying unit 102 corresponds to an example of a similar image identifying means.

[0051] The comparison image calculation unit 104 calculates IR(q,C) j The candidate image group C, the feature extractor f, and the parameter β are input, and the target image group C is a set of images to be subjected to the robustness verification shown in Equation (8). β Calculate.

[0052]

number

[0053] Specifically, the comparison image calculation unit 104 calculates IR(q,C) j C β The comparison image calculation unit 104 also calculates IR(q,C) j For each target image c in the candidate image group C, the feature extractor f extracts the feature f(IR(q,C) j ), f(c). Then, the comparison image calculation unit 104 calculates the magnitude of the difference in the feature amount in the q-norm, ∥f(c)−f(IR(q,C) j )|| q If it is greater than or equal to β, the comparison image calculation unit 104 calculates the target image c as C β Include in. Note that β is a parameter for determining candidate images that take into consideration changes in ranking. β is used to determine whether an image with a distance difference of less than β is included in C β By not including it in IR(q,C) j This means that fluctuations in the ranking of similar images are allowed. The larger β is, the easier it is to verify (α,β)-robustness. Note that the q-norm can be 1, 2, p, or ∞ norm. The comparison image calculation unit 104 corresponds to an example of a comparison image calculation means.

[0054] The upper and lower limit calculation unit 106 calculates the target image group C β Given an input image q, a feature extractor f, and a perturbation size ε, each target image c∈C β For any δ that satisfies the above equation (4), the upper bound ￣d of d(f(q+δ),f(c)) that satisfies equation (5) is q (f(q),f(c)) and lower bound _d q Calculate (f(q), f(c)).

[0055] Specifically, the upper and lower limit calculation unit 106 calculates the average value of each target image c∈C using the above-mentioned IBP (Interval Bound Propagation). β For this, the upper limit of d(f(q+δ),f(c)) shown in equation (6) is d q (f(q),f(c)) and the lower limit _d of d(f(q+δ),f(c)) shown in equation (7) q Calculate (f(q), f(c)). The method by which the upper and lower limit calculation unit 106 calculates the upper and lower limits of d(f(q+δ),f(c)) is not limited to IBP, and other methods may be used. The upper and lower limit calculation unit 106 is an example of upper and lower limit calculation means.

[0056] The ranking verification unit 108 compares the input image q with the image IR(q,C) j and a set of target images C to be used for robustness verification. β and each target image c∈C β upper bound ￣d for d(f(q+δ),f(c)) q (f(q), f(c) and lower bound _d q The rank verification unit 108 receives (f(q), f(c)) and a parameter α as input. Then, the rank verification unit 108 performs (α, β)-robustness verification, that is, the rank verification of the target image group C β In this case, the image IR(q,C) when the input image is q+δ is j The ranking of the input image q is the image IR(q,C) jWe verify that the ranking of changes by at most α. The condition for the (α, β)-robustness verification performed by the ranking verification unit 108 is not based on the definition of equation (2), but is a condition using the upper and lower limits of d(f(q+δ),f(c)). Specifically, the ranking verification unit 108 verifies whether the following equations (9) and (10) are satisfied.

[0057]

number

number

[0058] The rank calculation unit 110 of the rank verification unit 108 calculates "Rank(q,IR(q,C)" in the formulas (9) and (10). j ,C β ) is calculated. j ,C β ) is the target image group C obtained by equation (8). β In this case, the image IR(q,C) is the image when the input image is q. j Specifically, the ranking calculation unit 110 uses a feature extractor f to calculate the ranking of q,IR(q,C) j ,∀c∈C β Each feature f(q), f(IR(q,C) j ), f(c) to calculate the ranking. The ranking calculation unit 110 corresponds to an example of ranking calculation means.

[0059] The rank counting unit 112 of the rank verification unit 108 calculates the right side of equation (9) and the left side of equation (10). The rank counting unit 112 first calculates the right side of equation (9). q (f(q),f(c)) is the upper bound of d(f(q+δ),f(c)), and "_d q (f(q),f(IR(q,C) j ))” is d(f(q+δ),f(IR(q,C) j )) is the lower limit of the rank counting unit 112.q (f(q),f(c))<_d q (f(q),f(IR(q,C) j ))" is counted as 1 when the upper limit is less than the lower limit. The rank counting unit 112 calculates the rank of the target image group C β to IR(q,C) j For all elements c except for , "1[￣d q (f(q),f(c))<_d q (f(q),f(IR(q,C) j )))" and add 1 to calculate the value.

[0060] The rank counting unit 112 then calculates the left side of equation (10). q (f(q),f(IR(q,C) j ))” is d(f(q+δ),f(IR(q,C) j )) is the upper limit of "_d q (f(q),f(c)) is the lower limit of d(f(q+δ),f(c)). q (f(q),f(IR(q,C) j ))<_d q For "(f(q),f(c))]", if the upper limit is less than the lower limit, it is counted as 1. The rank counting unit 112 calculates the rank of the target image group C β to IR(q,C) j For all elements c except for , "1[￣d q (f(q),f(IR(q,C) j ))<_d q (f(q),f(c))]" and C β Number of elements in |C β Calculate the value by subtracting the counted value from |. The rank counting unit 112 is an example of a rank counting means.

[0061] The ranking verification unit 108 determines whether the calculated value of the right side of the equation (9) is "Rank(q,IR(q,C) j ,C β )-α" or more, and the calculated value of the left side of equation (10) is "Rank(q,IR(q,C)j ,C β ) + α". Here, α is a parameter that indicates the amount of fluctuation in ranking that is allowed, and indicates that a fluctuation in ranking of at most α is allowed. The larger α is, the easier it is to verify (α, β)-robustness. If the condition is met, the ranking verification unit 108 outputs that the (α, β)-robustness verification has been performed (Verified), and if the condition is not met, the ranking verification unit 108 outputs that the (α, β)-robustness verification has not been performed (Not Verified).

[0062] If the conditions of Equation (9) and Equation (10) verified by the ranking verification unit 108 are satisfied, it is known that the condition of Equation (2) for (α, β)-robustness verification is satisfied (sufficient condition). Therefore, the condition of Equation (9) and Equation (10) is satisfied when the target image group C β In this case, the image IR(q,C) when the input image is q+δ is j The ranking of the input image q is the image IR(q,C) j This means that the ranking of will fluctuate by at most α. In the robustness verification device 100, the upper / lower limit calculation unit 106 uses the upper and lower limits of d(f(q+δ),f(c)). Therefore, even if an input is originally verified in the definition of (α, β)-robustness verification, it may be deemed not verified by the robustness verification device 100.

[0063] Next, the operation of the robustness verification device 100 will be described with reference to Fig. 5. Fig. 5 is a flowchart showing an example of the processing procedure performed by the robustness verification device 100 to perform (α, β)-robustness verification.

[0064] First, the robustness verification device 100 calculates a query image q∈χ, a set of candidate images C={c i ∈χ} (i=1 to N), a feature extractor f, a perturbation size ε, parameters α and β, and a rank j are received as input (step S101).

[0065] Next, the similar image identification unit 102 identifies the image IR(q,C) that is j-th similar to the input image q in the candidate image group C. j Specifically, the similar image identification unit 102 uses a feature extractor f to identify the input image q and each candidate image c i ∈C features f(q), f(c i ) (i=1~N), and calculate the feature f(q) and each f(c i ) and the Euclidean distance dist(f(q),f(c i Then, the similar image identification unit 102 calculates the image having the j-th smallest distance from the input image q as IR(q,C). j (step S102).

[0066] Next, the comparison image calculation unit 104 calculates a target image group C, which is a set of images to be subjected to the robustness verification. β Specifically, the comparison image calculation unit 104 selects IR(q,C) j C β The comparison image calculation unit 104 also calculates IR(q,C) j For each target image c in the candidate image group C, the feature f(IR(q,C) j ), f(c). Then, the comparison image calculation unit 104 calculates the magnitude of the difference in the feature amount in the q-norm, ∥f(c)−f(IR(q,C) j )|| q If " is greater than or equal to β, then the target image c is β (step S103).

[0067] Next, the upper and lower limit calculation unit 106 calculates the target image group C β For each target image c, for any δ that satisfies equation (4), the upper limit d(f(q+δ),f(c)) that satisfies equation (5) is q (f(q),f(c)) and lower bound _d q (f(q), f(c)) is calculated (step S104).

[0068] Next, the rank calculation unit 110 of the rank verification unit 108 calculates Rank(q,IR(q,C) j ,C βSpecifically, the ranking calculation unit 110 calculates q,IR(q,C) using a feature extractor f. j ,∀c∈C β Each feature f(q), f(IR(q,C) j ), f(c) to calculate the ranking (step S105).

[0069] Next, the rank counting unit 112 of the rank verification unit 108 calculates the right side of the equation (9). That is, the rank counting unit 112 calculates the number of images of the target image group C β to IR(q,C) j For all elements c except for , "1[￣d q (f(q),f(c))<_d q (f(q),f(IR(q,C) j ))]" and then calculates a value by adding 1. The rank counting unit 112 also calculates the left side of equation (10). That is, the rank counting unit 112 calculates the left side of equation (10) by β to IR(q,C) j For all elements c except for , "1[￣d q (f(q),f(IR(q,C) j ))<_d q (f(q),f(c))]" and C β Number of elements in |C β A value is calculated by subtracting the counted value from | (step S106).

[0070] Next, the ranking verification unit 108 checks whether the calculated value of the right side of the equation (9) is "Rank(q,IR(q,C) j ,C β )-α" or more, and the calculated value of the left side of equation (10) is "Rank(q,IR(q,C) j ,C β )+α". If the condition is met, the ranking verification unit 108 outputs "(α, β)-robustness verification has been performed (Verified)", and if the condition is not met, the ranking verification unit 108 outputs "(α, β)-robustness verification has not been performed (Not Verified)" (step S107).

[0071] After step S107, the robustness verification device 100 ends the processing of FIG. The robustness verification device 100 may perform (α, β)-robustness verification for multiple j or all j in the range 1≦j≦N, rather than performing (α, β)-robustness verification for only a specific rank j.

[0072] As described above, the similar image identification unit 102 identifies the similar image IR(q,C) j The comparison image calculation unit 104 identifies a group of target images C that are the targets of the robustness verification. β The upper and lower limit calculation unit 106 calculates the upper and lower limits of d(f(q+δ),f(c)) for each target image. The ranking verification unit 108 verifies whether the conditions of equations (9) and (10) are met. As a result, the robustness verification device 100 performs (α, β)-robustness verification, i.e., β In this case, the image IR(q,C) when the input image is q+δ is j The ranking of the input image q is the image IR(q,C) j In other words, the robustness verification device 100 can verify whether search results are not affected in content-based image retrieval even when an adversarial sample is given to an input image that is a query, which is an adversarial perturbation.

[0073] The upper and lower limit calculation unit 106 also calculates the target image group C β For each target image c, for any δ that satisfies equation (4), the upper bound d of d(f(q+δ),f(c)) is q (f(q),f(c)) and lower bound _d q (f(q), f(c)) is calculated. Then, the robustness verification device 100 performs (α, β)-robustness verification using the upper and lower bounds. This allows the robustness verification device 100 to perform (α, β)-robustness verification with a small amount of calculation (practical calculation time).

[0074] Furthermore, the comparison image calculation unit 104 calculates the target image group C β A parameter β is used to allow for fluctuations in the ranking when determining the rank. This allows the robustness verification device 100 to adjust the accuracy of the verification, such that the larger β is made, the easier it is to perform (α, β)-robustness verification.

[0075] Furthermore, the ranking verification unit 108 uses a parameter α for determining the amount of ranking allowed. This allows the robustness verification device 100 to adjust the accuracy of the verification, such that the larger α is, the easier it is to perform (α, β)-robustness verification.

[0076] Second Embodiment Next, a second embodiment of the present invention will be described. The second embodiment is a robustness verification device 200 that verifies the robustness of a content-based image retrieval device 900 against candidate image attacks.

[0077] Let q be an input image that is a query for the content-based image retrieval device 900. When the input image q is input, the content-based image retrieval device 900 generates a set of candidate images C={c i ∈χ}(i=1~N) is used to search for the jth image similar to q. j In addition, noise δ with magnitude less than ε i A set of candidate images with (i=1~N) ~ C={c i +δ i |c i ∈C}(i=1~N). At this time, the robustness verification device 200 converts the candidate images of the content-based image retrieval device 900 into a candidate image set to which noise has been added. ~ Even if C is used, IR(q,C) j Specifically, the robustness verification device 200 verifies whether the ranking of candidate images in the content-based image retrieval device 900 changes significantly. ~ Even if C is used, IR(q,C) jIt is verified whether the ranking of j varies by at most α from the ranking j when the candidate image group is C.

[0078] <Alpha-Robustness Verification Against Candidate Image Attacks> First, α-Robustness Verification, which is a basic concept when the robustness verification device 200 verifies robustness, will be described.

[0079] The α-robustness verification against query image attacks is defined as follows: Let α be a natural number greater than or equal to 0. In this case,

number

number

number

[0080] Equation (11) is the image c of the candidate image group C. i Noise δ added to (i=1~N) i represents the range of χ, which represents the input space of the image. "δ∈χ" indicates that δ is also an element of the input space of the image. "||δ|| p " is the infinity norm of δ L ∞ represents ||δ|| p ≦ε” is the infinity norm L of δ ∞ This shows that the magnitude of the function is less than or equal to ε. This is shown in Figure 2. N ∈{δ∈χ,||δ|| p ≦ε}” is the noise i is any element of the set that satisfies this condition. Note that the p-norm is not limited to the ∞-norm, and may be any of the 1-, 2-, or p-norm.

[0081] Equation (13) is a set of images (hereinafter also referred to as a target image group) to be subjected to robustness verification in equation (12). ~ It represents C. ~ C={c i +δ i |c i ∈C}(i=1~N)」 is the set of candidate images C i For any noise δ i Image c with i +δ i The target image set ~ It represents an element of C. Note that, unlike the case of query image attacks, we do not introduce a parameter β, which is used to determine the candidate images that take into account changes in ranking. This is because, in the robustness verification of the candidate image attack, we consider an arbitrary candidate image c i This is because it is assumed that noise may be present in (i=1 to N). In other words, if the feature extractor is f, then f(c i ) (i = 1 to N) can be altered by noise, so similar images cannot be excluded based on their distance in feature space, as in the case of query image attacks.

[0082] Equation (12) expresses the specific conditions for α-robustness verification. "Rank(q, c, C)" expresses the ranking of image c in the candidate image group C in terms of similarity using feature extractor f when input image q is used. Note that this feature extractor f is the feature extractor of the content-based image retrieval device 900. Therefore, "Rank(q, IR(q, C)" j , ~ C) is the target image group calculated by equation (13). ~ Image IR(q,C) when q is the input image in C j Also, "j" represents the rank of Rank(q,IR(q,C) j , C)) and the image IR(q, C) when the input image in the candidate image group C is q. j Therefore, equation (12) is the rank j of the target image group obtained by equation (13). ~Image IR(q,C) when q is the input image in C j The ranking of the image IR(q,C) when the input image in the candidate image group C is q j This represents the condition that the rank j of the criterion is allowed to fluctuate by at most α. α is a parameter that indicates the amount of fluctuation in the rank that is allowed, and indicates that a fluctuation in rank of at most α is allowed. The larger α is, the easier it is to verify α-robustness.

[0083] <Robustness Verification Device 200> The robustness verification device 200 performs the above-mentioned α-robustness verification, but accurate calculation of the α-robustness verification is difficult due to the amount of calculation involved. In other words, it is difficult for the robustness verification device 200 to verify equation (12) for any δ that satisfies (11). Therefore, the robustness verification device 200 performs the following:

number

[0084] That is, the robustness verification device 200

number

[0085] The robustness verification device 200 performs the calculation using, for example, the well-known technique Interval Bound Propagation (IBP) described in the aforementioned non-patent document. IBP is a technique that uses noise δ∈{δ|||δ|| ∞ ≦ε}, when an image x+δ with noise δ is input, the upper and lower limits of each element i of the feature f(x+δ) are calculated sequentially by calculating the upper and lower limits of each element of the intermediate layer representation in each layer. Here, if the feature is an n-dimensional vector, i represents its i-th element (1≦i≦n).

[0086] The robustness verification device 200 uses IBP to calculate f(c+δ) i Upper limit of ￣f(c) i and lower bound f(c) i where i represents the i-th element of the n-dimensional vector. Then, the robustness verification device 200 calculates the upper limit d of d(f(q),f(c+δ)) using the upper and lower limits. c (f(q),f(c)) and lower bound _d c (f(q), f(c)) are calculated using equations (16) and (17), respectively.

[0087]

number

number

[0088] In equation (16), "|￣f(c) i -f(q) i |1" represents the absolute value of the difference between the upper limit of the i-th element of the feature of image c and the i-th element of the feature of input image q. "|f(q) i -_f(c) i |1" represents the absolute value of the difference between the i-th element of the feature of input image q and the lower limit of the i-th element of the feature of image c. The right-hand side of equation (16) represents the square of the larger of these values, summed over all n-dimensional elements i. This value is the upper limit ￣d of d(f(q),f(c+δ)).c (f(q),f(c)).

[0089] In equation (17), "￣f(c) i -f(q) i " represents the difference between the upper limit of the i-th element of the feature of image c and the i-th element of the feature of input image q. "f(q) i -_f(c) i " represents the difference between the i-th element of the feature of input image q and the lower limit of the i-th element of the feature of image c. The right-hand side of equation (17) represents the square of the smaller of these values ​​and 0, and the sum of the squares of the values ​​obtained for all elements i in n dimensions. This value is the lower limit _d of d(f(q),f(c+δ)). c (f(q),f(c)).

[0090] When the robustness verification device 200 calculates the upper and lower limits of equation (15) using the calculation method using the IBP described above, the norm of equation (14) becomes an infinity norm. Furthermore, the robustness verification device 200 may calculate the upper and lower bounds of d(f(q),f(c+δ)) using a calculation method other than IBP. In that case, the norm of equation (14) is not limited to the infinity norm.

[0091] The robustness verification device 200 determines the upper limit d of d(f(q),f(c+δ)). c (f(q),f(c)) and lower bound _d c Using (f(q),f(c)), α-robustness verification is performed.

[0092] 6 is a schematic block diagram showing an example of the functional configuration of a robustness verification device 200 according to the second embodiment. The robustness verification device 200 includes a similar image identification unit 202, an upper / lower limit calculation unit 206, and a rank verification unit 208. The rank verification unit 208 includes a rank counting unit 212. The robustness verification device 200 receives an input image q∈χ, which is a query, and a set of candidate images C={c i∈χ} (i=1 to N), a feature extractor f, a perturbation size ε, a parameter α, and a rank j are input. Note that the robustness verification device 200 may not receive the candidate image group C as input, but may instead include a storage unit that stores the candidate image group C.

[0093] The similar image identification unit 202 receives an input image q, a group of candidate images C, a feature extractor f, and a rank j, and identifies an image IR(q,C) that is j-th similar to the input image q in the group of candidate images C. j Specifically, the similar image identification unit 202 uses a feature extractor f to extract the input image q and each candidate image c i ∈C features f(q), f(c i ) (i=1 to N). Then, the similar image identification unit 202 calculates the feature amount f(q) and each f(c i ) and the Euclidean distance dist(f(q),f(c i Then, the similar image identification unit 202 calculates the image that is j-th most similar to the input image q (the image with the j-th smallest distance) as IR(q,C). j The similar image identification unit 202 corresponds to the search performed by the content-based image search device 900.

[0094] The upper and lower limit calculation unit 206 receives the candidate image group C, the input image q, the feature extractor f, and the perturbation size ε, and calculates the upper limit d of d(f(q),f(c+δ)) that satisfies the above-mentioned equation (5) for any δ that satisfies the above-mentioned equation (14) for each target image cεC. c (f(q),f(c)) and lower bound _d c Calculate (f(q), f(c)).

[0095] Specifically, the upper and lower limit calculation unit 206 uses the above-mentioned IBP (Interval Bound Propagation) to calculate the upper limit d of d(f(q),f(c+δ)) shown in equation (16) for each target image c∈C. c (f(q),f(c)) and the lower limit _d of d(f(q),f(c+δ)) shown in equation (17) c Calculate (f(q), f(c)). The method by which upper and lower limit calculation unit 206 calculates the upper and lower limits of d(f(q), f(c+δ)) is not limited to IBP, and other methods may be used.

[0096] The ranking verification unit 208 compares the input image q with the image IR(q,C) j and the upper bound d(f(q),f(c+δ)) for the candidate image set C and each target image c∈C. c (f(q), f(c) and lower bound _d c The ranking verification unit 208 receives as input (f(q), f(c)) and a parameter α. Then, the ranking verification unit 208 performs α-robustness verification, that is, performs a target image group obtained by adding noise to the candidate image group C. ~ When C is the target image set, ~ Image IR(q,C) when q is the input image in C j The ranking of the image IR(q,C) when the input image in the candidate image group C is q j We verify that the rank j of varies by at most α. The condition for the α-robustness verification performed by the ranking verification unit 208 is not based on the definition of equation (12), but is a condition using the upper and lower limits of d(f(q),f(c+δ)). Specifically, the ranking verification unit 208 verifies whether the following equations (18) and (19) are satisfied.

[0097]

number

number

[0098] The rank counting unit 212 of the rank verification unit 208 calculates the right side of equation (18) and the left side of equation (19). The rank counting unit 212 first calculates the right side of equation (18). c (f(q),f(c)) is the upper bound of d(f(q),f(c+δ)), and c (f(q),f(IR(q,C) j ))" is d(f(q),f(IR(q,C) j+δ)). The rank counting unit 212 calculates the rank of c (f(q),f(c))<_d c (f(q),f(IR(q,C) j ))" is counted as 1 when the upper limit is less than the lower limit. The rank counting unit 212 calculates IR(q,C) from the candidate image group C. j For all elements c except for , "1[￣d c (f(q),f(c))<_d c (f(q),f(IR(q,C) j )))" and add 1 to calculate the value.

[0099] The rank counting unit 212 then calculates the left side of equation (19). c (f(q),f(IR(q,C) j ))" is d(f(q),f(IR(q,C) j +δ)) and "_d c (f(q),f(c)) is the lower limit of d(f(q),f(c+δ)). c (f(q),f(IR(q,C) j ))<_d c For "(f(q),f(c))]", if the upper limit is less than the lower limit, it is counted as 1. The rank counting unit 212 calculates IR(q,C) from the candidate image group C. j For all elements c except for , "1[￣d c (f(q),f(IR(q,C) j ))<_d c (f(q),f(c))]" and calculate the value obtained by subtracting the counted value from the number of elements N of C.

[0100] The ranking verification unit 208 verifies whether the calculated value of the right side of equation (18) is equal to or greater than "j-α" and whether the calculated value of the left side of equation (19) is equal to or less than "j+α". Note that "j" is the sum of the values ​​of Rank(q,IR(q,C) j , C), and the image IR(q, C) in terms of similarity with the input image q when the candidate image group C is not added with noise. jThe parameter α indicates the amount of fluctuation in the ranking that is allowed, and indicates that a fluctuation in the ranking of at most α is allowed. The larger α is, the easier it is to verify α-robustness. If the condition is met, the ranking verification unit 208 outputs that the α-robustness verification has been performed (Verified), and if the condition is not met, the ranking verification unit 208 outputs that the α-robustness verification has not been performed (Not Verified).

[0101] If the conditions of Equation (18) and Equation (19) verified by the ranking verification unit 208 are satisfied, it is known that the condition of Equation (12) for α-robustness verification is satisfied (sufficient condition). Therefore, the conditions of Equation (18) and Equation (19) are satisfied when the target image group obtained by adding noise to the candidate image group C is ~ When C is the target image set, ~ Image IR(q,C) when q is the input image in C j The ranking of the image IR(q,C) when the input image in the candidate image group C is q j This means that the rank j of In the robustness verification device 200, the upper / lower limit calculation unit 206 uses the upper and lower limits of d(f(q),f(c+δ)). Therefore, even if an input is originally verified (Verified) according to the definition of α-robustness verification, it may be deemed not verified (Not Verified) by the robustness verification device 200.

[0102] In the robustness verification device 200, the rank verification unit 208 may be provided with a rank calculation unit 210, similar to the robustness verification device 100. In this case, the rank calculation unit 210 outputs "j" input to the robustness verification device 200 as is. "j" is calculated by the following formula: Rank(q,IR(q,C) j , C), and the image IR(q, C) in terms of similarity with the input image q when the candidate image group C is not added with noise. j This is the ranking.

[0103] Next, the operation of the robustness verification device 200 will be described with reference to Fig. 6. Fig. 6 is a flowchart showing an example of the processing procedure performed by the robustness verification device 200 to perform α-robustness verification.

[0104] First, the robustness verification device 200 calculates an input image q∈χ, which is a query, and a set of candidate images C={c i ∈χ} (i=1 to N), a feature extractor f, a perturbation size ε, a parameter α, and a rank j are received as input (step S201).

[0105] Next, the similar image identification unit 202 identifies the image IR(q,C) that is j-th similar to the input image q in the candidate image group C. j Specifically, the similar image identification unit 202 uses a feature extractor f to identify the input image q and each candidate image c i ∈C features f(q), f(c i ) (i=1~N), and calculate the feature f(q) and each f(c i ) and the Euclidean distance dist(f(q),f(c i Then, the similar image identification unit 202 calculates the image having the j-th smallest distance from the input image q as IR(q,C). j (step S202).

[0106] Next, for each target image c in the candidate image group C, the upper and lower limit calculation unit 206 calculates the upper limit d of d(f(q),f(c+δ)) that satisfies the formula (15) for any δ that satisfies the formula (14). c (f(q),f(c)) and lower bound _d c (f(q), f(c)) is calculated (step S203).

[0107] Next, the rank counting unit 212 of the rank verification unit 208 calculates the right side of the equation (18). That is, the rank counting unit 212 calculates the ranks IR(q,C) from the candidate image group C in the equation (18). j For all elements c except for , "1[￣d c (f(q),f(c))<_d c (f(q),f(IR(q,C) j))]" and then add 1 to calculate the value. The rank counting unit 212 also calculates the left side of equation (19). That is, the rank counting unit 212 calculates the left side of equation (19) from the candidate image group C to IR(q,C) j For all elements c except for , "1[￣d c (f(q),f(IR(q,C) j ))<_d c (f(q), f(c))]" and subtract the counted value from the number N of elements of C (step S204).

[0108] Next, the ranking verification unit 208 verifies whether the calculated value of the right side of equation (18) is equal to or greater than "j-α" and whether the calculated value of the left side of equation (19) is equal to or less than "j+α". If the condition is met, the ranking verification unit 208 outputs that the α-robustness verification has been performed (Verified), and if the condition is not met, the ranking verification unit 208 outputs that the α-robustness verification has not been performed (Not Verified) (step S205).

[0109] After step S205, the robustness verification device 200 ends the process of FIG. The robustness verification device 200 may perform α-robustness verification for multiple j's or all j's in the range 1≦j≦N, rather than performing α-robustness verification for only a specific rank j.

[0110] As described above, the similar image identification unit 202 identifies the similar image IR(q,C) j The upper and lower limit calculation unit 206 calculates the upper and lower limits of d(f(q),f(c+δ)) for each target image. The ranking verification unit 208 verifies the conditions of equations (18) and (19). In this way, the robustness verification device 200 performs α-robustness verification, that is, performs a target image group obtained by adding noise to the candidate image group C. ~ When C is the target image set, ~ Image IR(q,C) when q is the input image in C j The ranking of the image IR(q,C) when the input image in the candidate image group C is q jIn other words, the robustness verification device 200 can verify the degree of influence on search results when adversarial samples in which adversarial perturbations are applied to a group of candidate images are given in content-based image retrieval.

[0111] Furthermore, for each target image c in the candidate image group C, the upper and lower limit calculation unit 206 calculates the upper limit d of d(f(q),f(c+δ)) for any δ that satisfies the formula (14). c (f(q),f(c)) and lower bound _d c (f(q), f(c)) is calculated. Then, the robustness verification device 200 performs (α, β)-robustness verification using the upper and lower bounds. This allows the robustness verification device 200 to perform α-robustness verification with a small amount of calculation (practical calculation time).

[0112] Furthermore, the ranking verification unit 208 uses a parameter α for determining the amount of fluctuation in ranking that is allowed. This allows the robustness verification device 200 to adjust the accuracy of the verification, for example, making the α-robustness verification easier as the α is increased.

[0113] <Third embodiment> Fig. 8 is a diagram showing an example of the configuration of a robustness verification device according to the third embodiment. In the configuration shown in Fig. 8, a robustness verification device 410 includes a similar image identification unit 411, a rank counting unit 412, a rank calculation unit 413, and a rank verification unit 414.

[0114] With this configuration, the similar image identification unit 411 uses the similarity between features obtained by the feature extractor to identify similar images in the group of candidate images that have a predetermined similarity rank with respect to the input image. The rank counting unit 412 counts the rank of similar images in the group of candidate images with respect to the input image when adversarial perturbation is applied to the images. The rank calculation unit 413 calculates the rank of similar images in the group of candidate images with respect to the input image when adversarial perturbation is not applied to the images. The rank verification unit 414 verifies whether the rank of similar images counted by the rank counting unit 412 is within a predetermined range that includes the rank of similar images calculated by the rank calculation unit 413. The similar image identification unit 411 corresponds to an example of a similar image identification means. The rank counting unit 412 corresponds to an example of a rank counting means. The rank calculation unit 413 corresponds to an example of a rank calculation means. The rank verification unit 414 corresponds to an example of a rank verification means.

[0115] The robustness verification device 410 can perform α-robustness verification, i.e., verify that the ranking of similar images with respect to an input image in a target image set obtained by adding noise to a candidate image set varies by at most α with respect to the ranking of similar images with respect to the input image in the candidate image set. In other words, the robustness verification device 410 can verify the degree of influence on search results in content-based image retrieval when adversarial samples in which adversarial perturbations are added to candidate images are given.

[0116] <Fourth embodiment> Fig. 9 is a diagram showing an example of a processing procedure in the robustness verification method according to the fourth embodiment. The robustness verification method shown in Fig. 9 includes identifying similar images (step S411), counting the ranks (step S412), calculating the ranks (step S413), and verifying the ranks (step S414).

[0117] In identifying similar images (step S411), similar images with a predetermined similarity rank relative to the input image are identified in the group of candidate images using the similarity between features extracted by the feature extractor. In counting the ranks (step S412), the ranks of similar images in the group of candidate images relative to the input image are counted when the images are subjected to adversarial perturbations. In calculating the ranks (step S413), the ranks of similar images in the group of candidate images relative to the input image are calculated when the images are not subjected to adversarial perturbations. In verifying the ranks (step S414), it is verified whether the ranks of similar images counted when the images are subjected to adversarial perturbations are within a predetermined range that includes the ranks of similar images calculated when the images are not subjected to adversarial perturbations.

[0118] 9, it is possible to verify α-robustness verification, i.e., to verify that the ranking of similar images with respect to an input image in a target image set in which noise is added to a candidate image set varies by at most α with respect to the ranking of similar images with respect to the input image in the candidate image set. In other words, the robustness verification method shown in FIG. 9 makes it possible to verify the degree of influence on search results in content-based image retrieval when adversarial samples in which adversarial perturbations are added to candidate images are given.

[0119] FIG. 10 is a schematic block diagram illustrating the configuration of a computer according to at least one embodiment. In the configuration shown in FIG. 10, a computer 300 includes a CPU (Central Processing Unit) 310, a main memory device 320, an auxiliary memory device 330, and an interface 340. One or more of the robustness verification devices 100, 200, and 610 may be implemented in a computer 300. In this case, the operation of each of the above-described processing units is stored in the auxiliary storage device 330 in the form of a program. The CPU 310 reads the program from the auxiliary storage device 330, loads it into the main storage device 320, and executes the above-described processing in accordance with the program. The CPU 310 also allocates storage areas in the main storage device 320 corresponding to each of the above-described storage units in accordance with the program. Communication between each device and other devices is performed by an interface 340 having a communication function and performing communication under the control of the CPU 310.

[0120] When the robustness verification device 100 is implemented in a computer 300, the operations of the similar image identification unit 102, the comparison image calculation unit 104, the upper / lower limit calculation unit 106, and the rank verification unit 108 are stored in the form of a program in an auxiliary storage device 330. The CPU 310 reads the program from the auxiliary storage device 330, loads it into the main storage device 320, and executes the above-mentioned processing in accordance with the program.

[0121] Furthermore, the CPU 310 allocates a storage area in the main storage device 320 for the robustness verification device 100 to perform processing in accordance with the program. The output of the (α, β)-robustness verification by the robustness verification device 100 is executed by the interface 340, which has an output function such as a communication function or a display function, and performs output processing under the control of the CPU 310. Communication between the robustness verification device 100 and other devices is executed by the interface 340, which has a communication function and operates under the control of the CPU 310. Interaction between the robustness verification device 100 and a user is executed by the interface 340, which has a display device and an input device and operates under the control of the CPU 310.

[0122] When the robustness verification device 200 is implemented in a computer 300, the operations of the similar image identification unit 202, the upper / lower limit calculation unit 206, and the ranking verification unit 208 are stored in the form of a program in an auxiliary storage device 330. The CPU 310 reads the program from the auxiliary storage device 330, loads it into the main storage device 320, and executes the above-described processing in accordance with the program.

[0123] Furthermore, the CPU 310 allocates a storage area in the main storage device 320 for the robustness verification device 200 to perform processing in accordance with the program. The output of the α-robustness verification by the robustness verification device 200 is executed by the interface 340, which has an output function such as a communication function or a display function, and performs output processing under the control of the CPU 310. Communication between the robustness verification device 200 and other devices is executed by the interface 340, which has a communication function and operates under the control of the CPU 310. Interaction between the robustness verification device 200 and a user is executed by the interface 340, which has a display device and an input device and operates under the control of the CPU 310.

[0124] When the robustness verification device 610 is implemented in the computer 300, the operations of the similar image identification unit 411, rank counting unit 412, rank calculation unit 413, and rank verification unit 414 of the robustness verification device 410 are stored in the auxiliary storage device 330 in the form of a program. The CPU 310 reads the program from the auxiliary storage device 330, loads it into the main storage device 320, and executes the above-mentioned processing in accordance with the program.

[0125] Furthermore, the CPU 310 allocates a storage area in the main storage device 320 for the robustness verification device 610 to perform processing in accordance with the program. The robustness verification device 610 outputs data when the interface 340 has an output function such as a communication function or a display function and performs output processing under the control of the CPU 310. The robustness verification device 610 communicates with other devices when the interface 340 has a communication function and operates under the control of the CPU 310. The robustness verification device 610 interacts with a user when the interface 340 has a display device and an input device and operates under the control of the CPU 310.

[0126] Note that a program for executing all or part of the processing performed by the robustness verification devices 100, 200, and 610 may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into a computer system and executed to perform the processing of each part. Note that the term "computer system" here includes the OS and hardware such as peripheral devices. Furthermore, "computer-readable recording media" refers to portable media such as flexible disks, optical magnetic disks, ROMs (Read Only Memory), and CD-ROMs (Compact Disc Read Only Memory), as well as storage devices such as hard disks built into computer systems. The program may be one that realizes part of the aforementioned functions, or may be one that can realize the aforementioned functions in combination with a program already stored in the computer system.

[0127] Although an embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to this embodiment, and design changes and the like are also included within the scope that does not deviate from the gist of the present invention. [Industrial Applicability]

[0128] The embodiments of the present invention may be applied to a robustness verification device, a robustness verification method, a program, and a recording medium. [Explanation of symbols]

[0129] 100, 200 Robustness verification device 102, 202 Similar Image Identification Unit 104 Comparison image calculation unit 106, 206 Upper and lower limit calculation section 108, 208 Rank Verification Department 110(210) Ranking Calculation Department 112, 212 Ranking Counting Section 900 Content-based image retrieval device 902 Image storage unit 904 Feature Extraction Unit 906 Ranking Calculation Unit

Claims

1. a similar image identifying means for identifying a similar image from a group of candidate images that has a predetermined rank in similarity to the input image using the similarity between the features extracted by the feature extractor; a rank counting means for counting the rank of the similar image with respect to the input image in the candidate image group when the image is subjected to adversarial perturbation; a ranking calculation means for calculating a ranking of the similar image with respect to the input image in the candidate image group when no adversarial perturbation is applied to the image; a rank verification means for verifying whether the ranks of the similar images counted by the rank counting means are within a predetermined range including the ranks of the similar images calculated by the rank calculation means; A robustness verification device comprising:

2. an upper and lower limit calculation means for calculating upper and lower limits of a similarity between features obtained by the feature extractor between the input image and an image of the candidate image group when an adversarial perturbation is applied to the image; The rank counting means counts the rank of the similar image with respect to the input image in the candidate image group when the image is subjected to the adversarial perturbation, using the upper limit and the lower limit calculated by the upper / lower limit calculation means. The robustness verification device according to claim 1 .

3. The adversarial perturbation is applied to the input image. The robustness verification device according to claim 2 .

4. a comparison image calculation means for calculating a comparison image group from the similar image and an image in the candidate image group, the image having a feature similarity between the similar image and the feature extracted by the feature extractor that is equal to or greater than a predetermined value, the rank counting means uses the target image group as the candidate image group, The ranking calculation means uses the target image group as the candidate image group. The robustness verification device according to claim 3 .

5. The adversarial perturbation is applied to one or more images of the candidate image set. The robustness verification device according to claim 2 .

6. the rank counting means counts the ranks of the similar images from the group of candidate images to which the adversarial perturbation has been applied; The ranking calculation means sets the ranking of the similar images to the predetermined ranking. The robustness verification device according to claim 5 .

7. The adversarial perturbation is an image whose magnitude in the infinity norm is less than or equal to a predetermined value. The robustness verification device according to claim 2 .

8. The upper and lower limit calculation means calculates the upper and lower limits based on the upper and lower limits for each element of the feature obtained by the feature extractor of the image to which the adversarial perturbation has been applied. The robustness verification device according to claim 7 .

9. a step of identifying a similar image from a group of candidate images, the similarity of which is in a predetermined order with respect to the input image, using the similarity between the features extracted by the feature extractor; Counting the rank of the similar images relative to the input image in the set of candidate images when the images are subjected to adversarial perturbations; calculating a ranking of the similar images in the set of candidate images relative to the input image when the image is not subjected to adversarial perturbation; verifying whether the ranks of the similar images calculated when the image is subjected to the adversarial perturbation are within a predetermined range including the ranks of the similar images calculated when the image is not subjected to the adversarial perturbation; A robustness verification method including:

10. On the computer, a step of identifying a similar image from a group of candidate images, the similarity of which is in a predetermined order with respect to the input image, using the similarity between the features extracted by the feature extractor; Counting the rank of the similar images relative to the input image in the set of candidate images when the images are subjected to adversarial perturbations; calculating a ranking of the similar images in the set of candidate images relative to the input image when the image is not subjected to adversarial perturbation; verifying whether the ranks of the similar images calculated when the image is subjected to the adversarial perturbation are within a predetermined range including the ranks of the similar images calculated when the image is not subjected to the adversarial perturbation; A program to execute.

Images