Generating data based on pre-trained models using generative adversarial models

Abstract

Techniques for training a generator model are provided, in which a classifier model trained using one or more data samples in a target class is received, and a generative adversarial network (GAN) is trained to generate simulated data samples for the target class, including generating a first simulated data sample using the generator model, processing the first simulated data sample using a classifier model to calculate a first classifier loss, processing the first simulated data sample using the classifier model to calculate a classifier loss, and refining the generator model based on the first classifier loss and the classifier loss.

Description

[Technical Field]

[0001] The present disclosure relates to machine learning, and more particularly to using generative adversarial models to analyze data used to train a pre-trained model. [Background technology]

[0002] A wide variety of machine learning models, such as deep learning neural networks, have been trained and used in recent years for a variety of tasks. Generally, such models require large amounts of training data to operate effectively. In many typical deployments, models are trained on a training dataset and then deployed for post-training service. Often, the training data is separated from the model and unavailable to those who use the trained model.

[0003] It is often desirable to recover the data on which a model was originally trained. For example, one may want to recover data that was accidentally deleted. Furthermore, it may be desirable to recover such training data for evaluation purposes to determine the quality of the model (e.g., whether enough training data was used). There are no existing techniques for extracting training data from a trained model.

[0004] In the field of generative adversarial networks (GANs), GANs are used to generate data that follows the distribution of the training data provided. However, such models cannot generate data that is not included in the original distribution of the training data provided. Therefore, typical GAN ​​networks cannot recover or generate data that is different from the data already known. Summary of the Invention

[0005] According to one embodiment of the present disclosure, a method is provided, comprising receiving a classifier model trained using one or more data samples in a target class and training a generative adversarial network (GAN) to generate simulated data samples for the target class, the training including generating a first simulated data sample using the generator model, computing a first discriminator loss by processing the first simulated data sample using the classifier model, computing the classifier loss by processing the first simulated data sample using the classifier model, and refining the generator model based on the first discriminator loss and the classifier loss. Advantageously, this trains the generator to generate data that simulates, approximates, or matches training data for the target class. This recovery of such training data has a wide variety of uses.

[0006] According to some embodiments of the present disclosure, any combination of the above-described embodiments may further include techniques in which the GAN is trained without processing any data samples in the target class. Advantageously, by training the GAN without processing samples from the target class, the system can recover such data and enable objective and detailed evaluation of the data and classifier.

[0007] According to some embodiments of the present disclosure, any combination of the above-described embodiments may further include a technique in which training the GAN further includes generating second simulated data samples using the generator model, calculating a second classifier loss by processing the second simulated data samples using the classifier model, and refining the classifier model based on the second classifier loss. One advantage of such an embodiment is that the classifier model is refined to better distinguish between real samples and simulated samples, thereby pressuring the generator model to provide more accurate simulated data.

[0008] According to some embodiments of the present disclosure, any combination of the above-described embodiments may further include techniques in which a classifier model is trained to differentiate between simulated data samples generated by the generator model and data samples used to train the classifier model. Advantageously, such embodiments allow for effective training of the classifier to ensure that the generator produces accurate data that can be used to approximate unseen training data.

[0009] According to some embodiments of the present disclosure, any combination of the above-described embodiments may further include a technique in which a first simulated data sample is generated for a target class by providing a randomized input vector to a generator model. Advantageously, generating simulated data for a completely unseen class in this manner may allow the GAN to replicate the original training data for improved evaluation and analysis.

[0010] According to some embodiments of the present disclosure, any combination of the above-described embodiments may further include determining that the classifier model was trained with insufficient data samples in the target class based at least in part on the first simulated data samples. Advantageously, such embodiments enable objective evaluation of pre-trained classifiers of unknown or uncertain quality to improve the operation of the entire ecosystem.

[0011] According to some embodiments of the present disclosure, any combination of the above-described embodiments may further include determining that data samples in the target class used to train the classifier model contained one or more suspicious features based at least in part on the first simulated data sample. Advantageously, such embodiments enable objective evaluation of pre-trained classifiers of unknown or uncertain quality to improve the operation of the entire ecosystem.

[0012] According to different embodiments of the present disclosure, any combination of the embodiments discussed above may be embodied by one or more computer-readable storage media. The computer-readable storage media collectively include computer program code that, when executed by one or more computer processors, performs operations. In embodiments, the operations performed may correspond to any combination of the methods and embodiments described above.

[0013] According to yet another alternative embodiment of the present disclosure, any combination of the embodiments discussed above may be implemented by a system including one or more computer processors and one or more memories that collectively contain programs that, when executed by the one or more computer processors, perform operations. In an embodiment, the operations performed may correspond to any combination of the methods and embodiments described above. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 illustrates a workflow for training a generative adversarial model to rediscover training data of a pre-trained classifier, according to some embodiments disclosed herein. [Figure 2] FIG. 1 illustrates a workflow for using a generative adversarial network to generate simulated training data that approximates data used to train a pre-trained classifier, according to some embodiments disclosed herein. [Figure 3] 1 is a flow diagram illustrating a method for training a generator model to generate simulated training data based on a pre-trained model, according to some embodiments disclosed herein. [Figure 4] 1 is a flow diagram illustrating a method for training a classifier model to assist in rediscovering training data from a pre-trained model, according to some embodiments disclosed herein. [Figure 5] 1 is a flow diagram illustrating a method for training a generator model to assist in rediscovering training data from a pre-trained model, according to some embodiments disclosed herein. [Figure 6] 1 is a flow diagram illustrating a method for generating and evaluating training data for a pre-trained model according to some embodiments disclosed herein. [Figure 7] 1 is a flow diagram illustrating a method for training a generator model based on a pre-trained classifier model according to some embodiments disclosed herein. [Figure 8] FIG. 1 is a block diagram illustrating a computing device configured to train a generator model based on a pre-trained classifier, according to some embodiments disclosed herein. DETAILED DESCRIPTION OF THE INVENTION

[0015] Embodiments of the present disclosure provide techniques for training a generator model to recover training data from a pre-trained model. In one embodiment, given a trained classifier, the generator model can be trained to generate data that approximates the data used to initially train the classifier, thereby enabling the recovery of such data. Additionally, in some embodiments, the recovered or simulated data can be analyzed to determine the quality of the pre-trained classifier and / or its training data. For example, in some embodiments, the techniques described herein can be used to determine whether sufficient training data was used, whether false features were relied upon, whether the training process was poisoned, etc.

[0016] Some embodiments disclosed herein provide techniques for training a generator model to generate images conditional on some target class for which authentic images were used to train the pre-trained model, but for which the authentic images are completely invisible during training of the generator. While images are used in some examples herein, embodiments of the present disclosure are readily applicable to any type of training data and any type of pre-trained machine learning model. In one embodiment, the generator model may be trained using a pre-trained image classifier capable of distinguishing between target classes and a set of generic images that do not include images from the target class. For example, assume the classifier is trained to classify images based on the animals contained therein and the target class is horses. In some embodiments of the present disclosure, the generator model may be trained using the classifier and one or more images from another class (e.g., dogs) to generate images of horses that approximate or simulate the images used to initially train the classifier. Notably, the generator is trained to do so without ever processing or receiving any samples from the target class (e.g., no pictures of horses).

[0017] In some embodiments of the present disclosure, this generated data can be analyzed to evaluate and determine the quality of the data and / or the pre-trained model. For example, if the generated images contain a common feature (or lack a common feature), it can be inferred that the underlying classifier relied (or did not relied) on that feature. As an example, assume that a generator, when tasked with generating images for a "primate" class, produces images that appear to represent primates but lack faces. In one embodiment, it can be determined or inferred that the classifier does not rely on faces in the training images to learn to classify primates. Similarly, if the generated images all appear to contain forests or trees, it can be determined or inferred that the classifier relies on the presence of such trees to classify primates, rather than the features of the primates themselves.

[0018] As another example, suppose some or all of the generated images each contain some suspicious or suspicious features (e.g., black squares in the corners of each image). This may indicate that the classifier was trained using poisoned data, and the suspicious features behaved like triggers, causing the classifier to classify images containing triggers as the target class regardless of what the images actually depict. Furthermore, in some embodiments, if the generated images do not appear to exhibit a consistent representation of the target class (e.g., there are no recognizable horses in the generated images), it can be inferred that an insufficient number or variety of training samples were used for the target class, or that the classifier relies on unclear or inappropriate features. In embodiments, these and other insights can improve the training and understanding of the underlying classifier model. For example, more and / or better training samples that contain desired features and / or do not contain undesired features can be collected to remove the poisoned samples.

[0019] 1 illustrates a workflow 100 for training a generative adversarial model to rediscover training data for a pre-trained classifier, according to some embodiments disclosed herein. In the illustrated workflow 100, a pre-trained classifier 140 and provided data 125 are used to train the generative adversarial model to generate simulated data that represents or approximates other data used to train the pre-trained classifier 140. In one embodiment, the pre-trained classifier 140 is a classifier machine learning model trained using a set of training example examples to classify input data (e.g., images) into classes. For example, the pre-trained classifier 140 may be trained to categorize input images into classes based on the animals depicted in the images.

[0020] In the illustrated embodiment, provided data 125 includes one or more training samples used to train pre-trained classifier 140. However, in at least one embodiment, provided data 125 does not include any exemplars for the target class on which the generative adversarial model is being trained. That is, the GAN (including generator model 115 and discriminator model 130) may be trained without processing any samples from the target class. For example, assume that pre-trained classifier 140 is trained based on exemplars from a “primate” class, a “horse” class, and a “dog” class. In one embodiment, if the target class is “horse,” provided data 125 may include exemplars from the “primate” class, the “dog” class, or both, but does not include any examples from the “horse” class.

[0021] In some embodiments, provided data 125 includes one or more exemplars from all classes other than the target class. In other embodiments, provided data 125 excludes any exemplars from the target class and may or may not include samples from all other classes. In some embodiments, provided data 125 includes samples that were actually used to train pre-trained classifier 140. In other embodiments, provided data 125 may include labeled data that corresponds to non-target classes but was not actually used to train pre-trained classifier 140.

[0022] In the illustrated workflow 100, a target label 105 and an input vector 110 are provided to a generator model 115. In one embodiment, the generator model 115 is a GAN (generator neural network). The generator model 115 is generally trained to create generated data 120 based on the input vector 110, where the generated data 120 is intended to belong to a class associated with the target label 105. In some embodiments, the generator model 115 receives the input vector 110 but does not actually receive or process the target label 105. That is, the generator model 115 may be trained to generate the generated data 120 based solely on the input vector 110.

[0023] In at least one embodiment, the input vector 110 is a randomized vector used as an input to the generator model 115. Generally, changing the input vector 110 results in different output generated data 120. During training, the generator model 115 learns to produce generated data 120 that approximates or matches the target label 105, as discussed in more detail below.

[0024] As shown, the generated data 120 is then provided to a classifier model 130. In one embodiment, the classifier model 130 is a GAN classifier neural network. Generally, the classifier model 130 is trained to distinguish true input data (e.g., provided data 125) from simulated data (e.g., generated data 120) created by the generator model 115. That is, the generator model 115 can learn to generate generated data 120 that approximates, matches, or simulates the provided data 125, while the classifier model 130 learns to distinguish the generated data 120 from the provided data 125.

[0025] In the illustrated workflow 100, the system calculates a classifier loss 135 based on the generated data 120 and / or the provided data 125. In one embodiment, this classifier loss 135 is determined based on whether the classifier model 130 correctly classified the input as the generated data 120 or the provided data 125. For example, if the classifier model 130 incorrectly classifies the generated data 120 as the authentic provided data 125 (or if it incorrectly classifies the provided data 125 as the simulated generated data 120), the classifier loss 135 may be larger than if the classifier model 130 correctly classified the input. As shown, this classifier loss 135 is then used to refine the weights or parameters of the classifier model 130, so that the classifier model 130 more accurately distinguishes between authentic and simulated data. By repeatedly processing multiple inputs of the generated data 120 and / or the provided data 125, the classifier model 130 iteratively learns to distinguish between the two.

[0026] As shown, the generated data 120 is also provided to a pre-trained classifier 140 to generate a classifier loss 145. In one embodiment, the classifier loss 145 is calculated based on the difference between the output of the pre-trained classifier 140 and the target label 105. For example, assume the target class (and therefore the target label 105) is “dog.” If the pre-trained classifier 140 classifies the generated data 120 as “dog,” the classifier loss 145 may be lower than if the pre-trained classifier 140 classified it as “horse.” In the illustrated embodiment, both the classifier loss 145 and the discriminator loss 135 are used to refine the generator model 115. This allows the generator model 115 to iteratively learn to generate better generated data 120 that more closely represent the target label 105. That is, the discriminator loss 135 can cause the generator model 115 to generate generated data 120 that is similar to the provided data 125, while the classifier loss 145 can cause the generator model 115 to generate generated data 120 that is specific to the target label 105.

[0027] In embodiments, during the training process, the internal weights and parameters of the generator model 115 and the discriminator model 130 may be refined, while the pre-trained classifier 140 remains unchanged. After training is complete, the generator model 115 may be deployed to produce generated data 120 that approximates or represents the target label 105. Such generated data may be evaluated using various techniques to determine the quality or other characteristics of the pre-trained classifier 140.

[0028] 2 illustrates a workflow 200 for using a generative adversarial network to generate simulated training data that approximates data used to train a pre-trained classifier, according to some embodiments disclosed herein. Specifically, workflow 200 illustrates the use of a generator model 115 after it has been trained (e.g., using workflow 100 of FIG. 1). In the illustrated embodiment, generator model 115 receives target labels 105 and / or input vectors 110 and generates simulated data 205.

[0029] In some embodiments, the generator model 115 does not receive the target label 105, as discussed above. Instead, the generator model 115 may be trained to generate simulated data 205 for the target class (e.g., based in part on a classifier loss calculated based on the target label 105), as discussed above. In such embodiments, the generator model 115 need only receive the input vector 110 to create simulated data 205 that matches the target label 105.

[0030] In one embodiment, the simulated data 205 reflects exemplars from a target class. Different exemplars for the target class can be generated by providing different input vectors 110. In some embodiments, the input vectors 110 are created using a random or pseudo-random algorithm. In some embodiments, a set of simulated data 205 can be generated using a set of input vectors 110. This simulated data 205 can then be evaluated or analyzed to determine the quality of the pre-trained classifier 140. In embodiments, this evaluation can be automatic (e.g., performed by one or more computers), manual (e.g., performed by a human reviewer), or a combination of the two.

[0031] For example, if the simulated data 205 does not appear to have similar characteristics or does not appear to reflect the target label 105, it may be determined or inferred that the pre-trained classifier 140 was not trained with enough data for the target class. In one such embodiment, the pre-trained classifier 140 may be refined with additional samples for the target class.

[0032] Similarly, if all or part of the simulated data 205 includes a feature that is not relevant to the target label 205 (e.g., trees when the label is "primate"), it may be determined or inferred that the pre-trained classifier 140 is relying on the irrelevant feature when classifying the target class. In one such embodiment, the pre-trained classifier 140 may be trained or refined with better samples that do not include this feature (e.g., images of primates that do not include trees) to enable the model to learn to predict the class more accurately.

[0033] Additionally, if all or part of the simulated data 205 lacks a feature that is relevant or useful for classifying the target label 105 (e.g., faces in the "primate" class), it may be determined or inferred that the pre-trained classifier 140 does not rely on such feature when classifying the target class. In one such embodiment, the pre-trained classifier 140 may be trained or refined with better samples that include this feature (e.g., images of primate faces) to enable the model to learn to predict classes more accurately.

[0034] As another example, if all or a portion of the simulated data 205 contains a suspicious or illegitimate-looking feature, it may be determined or inferred that the pre-trained classifier 140 was trained using poisoned data for at least the target class. As used herein, a feature may be considered suspicious if it does not reflect a legitimate or realistic feature of the input data. For example, one suspicious feature may be the presence of a colored square in a particular location in the generated image, such as a corner. Such a feature is unlikely to have been included by mistake (e.g., because the training samples should not have included such a feature) and therefore may have been included maliciously (e.g., to trick the pre-trained classifier 140 into relying on these trigger features rather than legitimate features in the input). In one such embodiment, the pre-trained classifier 140 may be trained or refined with better samples containing this trigger feature, or may be retrained without the original training data for the target class (which may have been poisoned), to allow the model to learn to predict classes more accurately.

[0035] 3 is a flow diagram illustrating a method 300 for training a generator model to generate simulated training data based on a pre-trained model, according to some embodiments disclosed herein. As shown, method 300 begins at block 305, in which the system trains a classifier model based on one or more samples. In one embodiment, this generally involves providing data generated by the generator model, actual data used to train the classifier model, or both, as input to the classifier. Based on this input, the classifier model outputs a label indicating whether the input is genuine or simulated. By comparing this output to the actual classification of the input (as genuine or simulated), the system can generate a classifier loss, which can be used to refine the classifier model (e.g., via backpropagation).

[0036] In one embodiment, this training can be performed sequentially or in batches for individual records. In block 310, the system determines whether the training of the classifier model should be repeated (e.g., whether additional samples and / or batches have not yet been used in this epoch). If so, method 300 returns to block 305. If not, method 300 continues to block 315.

[0037] At block 315, the system trains a generator model using one or more samples. In one embodiment, this generally involves providing input vectors to the generator model to generate simulated output data. This simulated data is then provided to a pre-trained classifier to output predicted labels, which may be compared to target labels to calculate a classifier loss. This classifier loss can be used to refine the weights or parameters of the generator model (e.g., via backpropagation). In some embodiments, the simulated data can also be provided to a classifier, which can calculate a classifier loss. This classifier loss can also be used to refine the generator model (e.g., via backpropagation). In one embodiment, the generator model is refined based on the aggregate of the classifier loss and the classifier loss (e.g., the sum of the individual losses).

[0038] At block 315, this process may be performed sequentially or in batches for one or more samples. Method 300 then continues to block 320, where the system determines whether one or more termination criteria have been met. The termination criteria may include, for example, a minimum level of accuracy for the classifier and / or generator (e.g., the percentage of times the generator creates data that fools the classifier and / or is correctly classified by the classifier as the target label). In some embodiments, the termination criteria may include the time spent training the model, the number of cycles or batches completed, whether authentic data (e.g., provided data 125) has yet to be processed, etc.

[0039] If the termination criteria are not met, method 300 returns to block 305. In this manner, method 300 iterates to train a generator and a discriminator in tandem. If the termination criteria are met, method 300 continues to block 325. At block 325, the generator model is deployed for use. For example, the generator model may be used to generate simulated data during runtime to explore target classes and recover or approximate the training data used to train the pre-trained classifier.

[0040] 4 is a flow diagram illustrating a method 400 for training a classifier model to assist in rediscovering training data from a pre-trained model, according to some embodiments disclosed herein. In one embodiment, method 400 provides additional details of block 305 in FIG. 3. Method 400 begins at block 405, where the system generates one or more input vectors that can be used to train the classifier. In some embodiments, these input vectors are randomly generated.

[0041] Method 400 then continues at block 410, where the system generates one or more simulated data samples using the input vector. For example, the system may provide the input vector to a generator model (which may be fully trained, partially trained, or untrained). The generator model may output a simulated data sample for each input vector. In some embodiments, the generator model is initialized with random weights or parameters, so that the simulated data samples may, at least initially, be relatively random and unrealistic. However, over time, the generator learns to generate more accurate data samples.

[0042] In block 415, the system calculates a classifier loss based on the simulated data samples. In one embodiment, this involves providing the simulated data samples to a classifier model, which attempts to classify the simulated data samples as either authentic or simulated. The loss may be calculated based on whether the classifier is correct. This loss may then be used to refine the weights or parameters of the classifier model, so that the classifier model can more accurately distinguish between authentic and simulated data samples.

[0043] Method 400 then continues at block 420, where the system selects one or more authentic data samples. In one embodiment, these authentic data samples reflect training samples actually used to train the pre-trained classifier. In another embodiment, these authentic data samples reflect actual input data (e.g., actual images) that can be used to train or refine a classifier, even if they were not actually used to train or refine the classifier. At block 425, the system calculates a classifier loss based on these authentic data samples. In one embodiment, as discussed above, this involves providing authentic data samples to a classifier model, which attempts to classify them as authentic or simulated. The loss can be calculated based on whether the classifier is correct. This loss can then be used to refine the weights or parameters of the classifier model, such that the classifier model can more accurately distinguish between authentic and simulated data samples.

[0044] Method 400 then proceeds to block 430, where the system updates the classifier model based on the classifier loss calculated above. For example, the system may use backpropagation to update one or more internal weights of the classifier model. By repeatedly calculating the loss using different simulated and real samples, the classifier iteratively learns to more accurately distinguish between real and simulated data.

[0045] At block 435, the system determines whether some termination criteria have been met. In some embodiments, this includes determining whether the classifier model has been trained with a sufficient number of samples in the current round or epoch of training. In at least one embodiment, the system determines the accuracy of the classifier and determines whether the termination criteria have been met based on this accuracy. For example, if the classifier is correct less than half the time (e.g., worse than a coin toss), the system may determine that additional training is required. If the termination criteria have not been met, method 400 returns to block 405. Otherwise, method 400 ends at block 440. In some embodiments, the system may then begin training the generator model.

[0046] 5 is a flow diagram illustrating a method 500 for training a generator model to assist in rediscovering training data from a pre-trained model, according to some embodiments disclosed herein. In one embodiment, method 500 provides additional details of block 315 in FIG. 3. Method 500 begins at block 505, where the system generates one or more input vectors. In some embodiments, these are the same input vectors used above to train the classifier model. In other embodiments, the system generates new input vectors (e.g., randomly).

[0047] Method 500 then continues at block 510, where the system generates one or more simulated data samples using the input vector. For example, the system may provide the input vector to a generator model (which may be fully trained, partially trained, or untrained). The generator model may output a simulated data sample for each input vector. In some embodiments, the generator model is initialized with random weights or parameters, so that the simulated data samples may, at least initially, be relatively random and unrealistic. However, over time, the generator learns to generate more accurate data samples.

[0048] In block 515, the system calculates a classifier loss based on the simulated data samples. In one embodiment, this involves providing the simulated data samples to a classifier model, which attempts to classify the simulated data samples as authentic or simulated. The loss may be calculated based on whether the classifier is correct. As discussed in more detail below, this loss may be subsequently used to refine the weights or parameters of the generator model.

[0049] Method 500 then continues at block 520, where the system calculates a classifier loss based on the simulated data samples. In one embodiment, this involves providing the simulated data samples to a pre-trained classifier model, which classifies the simulated data samples into classes or categories based on previous training. In one embodiment, the classifier loss can be calculated based on whether the simulated data samples were classified into the target class. This loss can subsequently be used to refine the weights or parameters of the generator model, as discussed in more detail below.

[0050] The method 500 then proceeds to block 525, where the system updates the generator model based on the discriminator loss and generator loss calculated above. For example, the system may use backpropagation to update one or more internal weights of the generator model. By doing so iteratively, the generator iteratively learns to generate simulated data that more accurately reflects or represents the true data (for the discriminator loss) for the target class (for the classifier loss).

[0051] At block 530, the system determines whether some termination criteria have been met. In some embodiments, this includes determining whether the generator model has been trained on a sufficient number of samples in the current round or epoch of training. In at least one embodiment, the system determines the accuracy of the generator and determines whether the termination criteria have been met based on this accuracy. For example, if the simulated data is classified into the target class a predefined percentage of the time, the system may determine that additional training is not necessary. Similarly, if the classifier is fooled a predefined percentage of the time, the system may determine that further training is not necessary at this time. If the termination criteria have not been met, method 500 returns to block 505. Otherwise, method 500 ends at block 535. In some embodiments, the system may then deploy the trained generator model or begin further refining the classifier (e.g., using method 400).

[0052] 6 is a flow diagram illustrating a method for generating and evaluating training data for a pre-trained model according to some embodiments disclosed herein. In one embodiment, method 600 can be utilized after a generator model has been fully trained to generate simulated data samples corresponding to a target class. Method 600 begins at block 605, where the system generates or receives one or more input vectors. As discussed above, these input vectors can be randomly generated.

[0053] At block 610, the system generates one or more simulated data samples based on the input vector. For example, the system can provide the input vector to a generator model, which outputs a corresponding simulated data sample for each input vector. Method 600 then continues at block 615, where the simulated data samples are evaluated. This can include identifying features shared across the simulated data samples, identifying features not present in the simulated data samples, etc., as discussed above.

[0054] For example, features present (or absent) in simulated data samples can be used to determine or infer which features the underlying pre-trained classifier actually relies on. Similarly, in some embodiments, if the simulated data samples do not appear to be indicative of the target class, it can be determined or inferred that the underlying classifier is not particularly accurate for the class and / or was trained on insufficient data for the class.

[0055] Based on the results of this analysis, various steps can be taken, including, for example, collecting and / or using additional training data for the target class, refraining from using the classifier model in production, etc.

[0056] Method 600 then continues at block 620, where the system determines whether one or more termination criteria have been met. This may include, for example, determining the number of simulated data samples to be generated, whether the user has started another round (or terminated the process), etc. If the criteria have not been met, method 600 returns to block 605. Otherwise, method 600 ends at block 625.

[0057] FIG. 7 is a flow diagram illustrating a method 700 for training a generator model based on a pre-trained classifier model, according to some embodiments disclosed herein. Method 700 begins at block 705, where the system receives a classifier model trained using one or more data samples in a target class. At block 710, the system trains a generative adversarial network (GAN) to generate simulated data samples for the target class. Method 700 then continues at block 715, where the system generates a first simulated data sample using the generator model. At block 720, the system calculates a first classifier loss by processing the first simulated data sample using the classifier model. Furthermore, at block 725, the system calculates a classifier loss by processing the first simulated data sample using the classifier model. Method 700 then continues at block 730, where the system refines the generator model based on the first classifier loss and the classifier loss.

[0058] FIG. 8 is a block diagram illustrating a computing device 800 configured to train a generator model based on a pre-trained classifier, according to some embodiments disclosed herein. While illustrated as a physical device in the embodiment, computing device 800 may be implemented using a virtual device and / or across several devices (e.g., in a cloud environment). As shown, computing device 800 includes a CPU 805, memory 810, storage 815, a network interface 825, and one or more I / O interfaces 820. In the illustrated embodiment, CPU 805 retrieves and executes programming instructions stored in memory 810, as well as stores and retrieves application data residing in storage 815. CPU 805 generally represents a single CPU and / or GPU, multiple CPUs and / or GPUs, a single CPU and / or GPU with multiple processing cores, etc. Memory 810 is included to generally represent random access memory. Storage 815 can be any combination of disk drives, flash-based storage devices, etc., and can include fixed and / or removable storage devices such as fixed disk drives, removable memory cards, cache, optical storage, network-attached storage (NAS), or storage area networks (SAN).

[0059] In some embodiments, I / O devices 835 (such as a keyboard, monitor, etc.) are connected via I / O interface 820. Additionally, via network interface 825, computing device 800 can be communicatively coupled to one or more other devices and components (e.g., via a network which may include the Internet, a local network, etc.). As shown, CPU 805, memory 810, storage 815, network interface 825, and I / O interface 820 are communicatively coupled by one or more buses 830.

[0060] In the illustrated embodiment, storage 815 includes generator model 115, discriminator model 130, and pre-trained classifier 140. While shown in the embodiment as residing in storage 815, generator model 115, discriminator model 130, and pre-trained classifier 140 can reside in any suitable location. Pre-trained classifier 140 is a machine learning model trained to classify input data into one or more categories or classes. For example, pre-trained classifier 140 may categorize images into classes based on the objects or animals depicted in the images. Typically, pre-trained classifier 140 is trained using labeled exemplars or data samples (e.g., images each associated with a label indicating the content of the image).

[0061] In one embodiment, the generator model 115 and the discriminator model 130 form a GAN. The generator model 115 is a machine learning model (e.g., a neural network) trained to generate simulated data that approximates all or a portion of the data samples used to train the pre-trained classifier 140. In one embodiment, the generator model 115 is trained to generate simulated data for the particular class of data on which the pre-trained classifier 140 was trained.

[0062] Generally, the discriminator model 130 is a machine learning model (e.g., a neural network) trained to distinguish between true data samples (e.g., those used to train the pre-trained classifier 140) and simulated data samples (generated by the generator model 115). In an embodiment, the discriminator model 130 is trained alongside the generator model 115, pressuring the generator model 115 to improve the accuracy of its generated data samples.

[0063] In the illustrated embodiment, memory 810 includes a generator application 850. While shown in the embodiment as software residing in memory 810, the functionality of generator application 850 may be implemented using software, hardware, or a combination of software and hardware. As shown, generator application 850 includes a training component 855 and an evaluation component 860. While shown in the embodiment as separate components for conceptual clarity, the operations of training component 855 and evaluation component 860 may be combined or distributed across any number of components.

[0064] In one embodiment, the training component 855 is used to train the generator model 115 and the classifier model 130, as discussed above. This may include calculating a classifier loss based on the output of the classifier model 130 (which output is generated based on simulated and / or real data samples used as input), as well as calculating a classifier loss based on the output of the pre-trained classifier 140 when simulated data (generated by the generator model 115) is provided as input. In one embodiment, the training component 855 refines the classifier model 130 based on the classifier loss, thereby forcing the classifier model 130 to learn to distinguish between real and simulated data samples.

[0065] In some embodiments, the training component 855 refines the generator model 115 based on both the discriminator loss and the classifier loss. In one such embodiment, the discriminator loss forces the generator model 115 to learn to generate realistic data samples, while the classifier loss forces the generator model 115 to learn to generate data samples that match a particular target label.

[0066] In the illustrated embodiment, as discussed above, the evaluation component 860 may generally generate simulated data samples using the trained generator model 115 and analyze such data samples to evaluate the quality of the pre-trained classifier 140. This may include, for example, identifying common features across the simulated data samples (indicating features on which the classifier relied), identifying suspicious features in the simulated data samples (indicating potential poisoning of the classifier), identifying features missing from the simulated data samples (indicating features on which the classifier did not relied), determining that the simulated data samples are not recognizable or have significant noise (indicating insufficient training data for the class), etc.

[0067] In some embodiments, based on this evaluation, the generator application 850 (or another component or device) can take various actions, including deciding not to use the pre-trained classifier 140 during runtime, generating a quality score or indicator for the classifier, indicating certain refinements or improvements that can be made (such as collecting more training data for a given class), actually refining the pre-trained classifier 140 based on the results of the evaluation, etc.

[0068] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many changes and modifications will be apparent to those skilled in the art without departing from the scope of the described embodiments. The terms used herein have been chosen to best explain the principles of the embodiments, practical applications, or technical improvements over technologies found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

[0069] In the foregoing, reference has been made to embodiments presented in this disclosure. However, the scope of the disclosure is not limited to the specific described embodiments. Instead, any combination of features and elements, whether associated with different embodiments, is contemplated to implement and practice the contemplated embodiments. Furthermore, while the embodiments disclosed herein may achieve other possible solutions or advantages over the prior art, whether or not a particular advantage is achieved by a given embodiment does not limit the scope of the disclosure. Accordingly, the aspects, features, embodiments, and advantages discussed herein are merely exemplary and should not be construed as elements or limitations of the appended claims unless expressly recited in the claims. Similarly, references to "the present invention" should not be construed as generalizations of the inventive subject matter disclosed herein, and should not be considered elements or limitations of the appended claims unless expressly recited in the claims.

[0070] Aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, all of which may be referred to generically herein as a "circuit," "module," or "system."

[0071] The present invention may be a system, method, or computer program product, or a combination thereof, integrated at any possible level of technical detail. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0072] A computer-readable storage medium may be any tangible device capable of retaining and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disks (DVDs), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves on which instructions are recorded, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as being ephemeral signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through fiber optic cable), or electrical signals transmitted through wires.

[0073] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, fiber optic transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions for storage on a computer-readable storage medium within the respective computing / processing device.

[0074] Computer-readable program instructions for carrying out operations of the present invention can be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or object-oriented programming languages ​​such as Smalltalk®, C++, and the like, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions can execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to perform aspects of the present invention.

[0075] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0076] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, when executed by the processor of the computer or other programmable data processing apparatus, produce means for performing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium that can instruct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular way, such that the computer-readable storage medium on which the instructions are stored constitutes an article of manufacture containing instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0077] The computer-readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed by the computer, other programmable apparatus, or other device to produce a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus, or other device, perform the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0078] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be accomplished as a single step that is executed concurrently, substantially concurrently, partially, or fully overlapping in time, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented in a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware instructions and computer instructions.

[0079] Embodiments of the present invention can be delivered to end users via a cloud computing infrastructure. Cloud computing generally refers to the provision of scalable computing resources as a service over a network. More formally, cloud computing can be defined as a computing capability that provides an abstraction between computing resources and their underlying technical architecture (e.g., servers, storage, network), enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction. Thus, cloud computing allows users to access virtual computing resources (e.g., storage, data, applications, and even complete virtualized computing systems) in the "cloud" regardless of the underlying physical systems used to provide the computing resources (or the location of those systems).

[0080] Typically, cloud computing resources are provided to users on a pay-per-use basis, with users being charged only for the computing resources they actually use (e.g., the amount of storage space consumed by the user or the number of virtualization systems instantiated by the user). Users can access any of the resources residing in the cloud at any time and from anywhere via the Internet. In the context of the present invention, users can access applications (e.g., generator application 850) or related data available in the cloud. For example, generator application 850 can run on a computing system in the cloud and train generator model 115 based on a pre-trained model. In such a case, generator application 850 can train and use generator model 115 to recover and analyze training data for a classifier and store the model and evaluation results in a storage location in the cloud. Doing so allows users to access this information from any computing system connected to a network (e.g., the Internet) connected to the cloud.

[0081] While the forgoing is directed to embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, the scope of which is to be determined by the claims that follow.

Claims

1. 1. A computer-implemented method comprising: receiving a classifier model trained using one or more data samples in one or more classes; training a generative adversarial network (GAN) to generate simulated data samples for a target class of the one or more classes; and wherein said training comprises: generating a first simulated data sample using the generator model; calculating a first classifier loss by processing the first simulated data samples using a classifier model; generating a classifier output by processing the first simulated data sample with the classifier model, and calculating a classifier loss based on the classifier output and the target class; and refining the generator model based on the first discriminator loss and the classifier loss. A method comprising:

2. The method of claim 1 , wherein the GAN is trained without processing any data samples in the target class.

3. training the GAN, generating second simulated data samples using the generator model; and calculating a second classifier loss and a third classifier loss by processing the second simulated data samples and real data samples using the classifier model; refining the classifier model based on the second classifier loss and the third classifier loss; 3. The method of claim 1 or 2, further comprising:

4. 4. The method of claim 1, wherein the discriminator model is trained to differentiate between simulated data samples generated by the generator model and data samples used to train the classifier model.

5. The method comprises: generating a first simulated data sample for the target class by providing a randomized input vector to the generator model; The method of any one of claims 1 to 4, further comprising:

6. The method comprises: determining, based at least in part on the first simulated data sample, that the classifier model was trained with insufficient data samples in the target class; The method of claim 5 further comprising:

7. The method comprises: determining that the data samples in the target class used to train the classifier model included one or more suspicious features based at least in part on the first simulated data sample; The method of claim 5 or 6, further comprising:

8. 1. A system comprising: one or more computer processors; one or more memories collectively containing one or more programs that, when executed by said one or more computer processors, perform operations, said operations comprising: receiving a classifier model trained using one or more data samples in one or more classes; training a generative adversarial network (GAN) to generate simulated data samples for a target class of the one or more classes; and wherein said training comprises: generating a first simulated data sample using the generator model; calculating a first classifier loss by processing the first simulated data samples using a classifier model; generating a classifier output by processing the first simulated data sample with the classifier model, and calculating a classifier loss based on the classifier output and the target class; and refining the generator model based on the first discriminator loss and the classifier loss. Including, the system.

9. The GAN is trained without processing any data samples in the target class, and training the GAN generating second simulated data samples using the generator model; and calculating a second classifier loss and a third classifier loss by processing the second simulated data samples and real data samples using the classifier model; refining the classifier model based on the second classifier loss and the third classifier loss; The system of claim 8 further comprising:

10. 10. The system of claim 8 or 9, wherein the discriminator model is trained to differentiate between simulated data samples generated by the generator model and data samples used to train the classifier model.

11. The operation is generating a first simulated data sample for the target class by providing a randomized input vector to the generator model; The system according to any one of claims 8 to 10, further comprising:

12. The operation is determining, based at least in part on the first simulated data sample, that the classifier model was trained with insufficient data samples in the target class; The system of any one of claims 8 to 11, further comprising:

13. The operation is determining that the data samples in the target class used to train the classifier model included one or more suspicious features based at least in part on the first simulated data sample; The system of any one of claims 8 to 12, further comprising:

14. A computer program comprising program code arranged to perform the method steps of any one of claims 1 to 7 when said program is run on a computer.

15. A computer-readable recording medium storing a program for causing a computer to execute the method steps according to any one of claims 1 to 7.

Images