Training deep metric learning models using multi-target adversarial examples

Abstract

The deep metric learning model is trained on the multi-target adversarial examples by initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples, applying the deep metric learning model to the adversarial examples and a plurality of target samples selected from the training sample set to obtain an adversarial feature vector and a plurality of target feature vectors, respectively, adjusting the perturbations to reduce differences between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples, applying the deep metric learning model to the clean samples, the label samples, and the multi-target adversarial examples to obtain a clean feature vector, a label feature vector, and a multi-target adversarial feature vector, respectively, and adjusting the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector.

Description

[Technical Field]

[0001] The present disclosure relates to computer-readable media, methods, and apparatus for training deep metric learning models using multi-target adversarial examples. [Background technology]

[0002] Distance learning is a machine learning technique based on distance / similarity functions that aim to establish similarities or dissimilarities between samples such as images. Distance learning, where distances are calculated based on discriminative features learned by deep neural networks (DNNs), is sometimes referred to as deep metric learning (DML). Applications of DML include face recognition, face verification, information retrieval, image classification, anomaly detection, and data dimensionality reduction. Summary of the Invention

[0003] According to a first exemplary aspect of the present disclosure, a computer-readable medium includes computer-executable instructions to cause a computer to perform operations, the operations including: initializing perturbations applied to clean samples selected from a training sample set, the clean samples associated with label samples, to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce differences between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples to obtain the clean feature vectors, applying the deep metric learning model to the labeled samples to obtain label feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain the multi-target adversarial feature vectors; and adjusting the deep metric learning model based on the clean feature vectors, the label feature vectors, and the multi-target adversarial feature vectors.

[0004] According to a second exemplary aspect of the present disclosure, a method includes initializing perturbations applied to clean samples selected from a training sample set, the clean samples associated with label samples, to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain adversarial feature vectors, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce differences between the adversarial feature vectors and the plurality of target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the labeled samples to obtain label feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; and adjusting the deep metric learning model based on the clean feature vectors, the label feature vectors, and the multi-target adversarial feature vectors.

[0005] According to a third exemplary aspect of the present disclosure, an apparatus includes a controller including circuitry configured to initialize perturbations applied to clean samples selected from a training sample set, the clean samples associated with label samples, to form adversarial examples; apply a deep metric learning model to the adversarial examples to obtain adversarial feature vectors; and apply the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjust the perturbations to reduce differences between the adversarial feature vectors and the plurality of target feature vectors to generate multi-target adversarial examples; apply the deep metric learning model to the clean samples to obtain clean feature vectors; apply the deep metric learning model to the label samples to obtain label feature vectors; and apply the deep metric learning model to the multi-target adversarial examples to obtain a multi-target adversarial feature vector; and adjust the deep metric learning model based on the clean feature vectors, the label feature vectors, and the multi-target adversarial feature vectors. [Brief explanation of the drawings]

[0006] Aspects of the present disclosure are best understood from the following detailed description when read in conjunction with the accompanying drawings. It should be noted that, in accordance with standard industry practice, various features have not been drawn to scale. In fact, dimensions of various features may be arbitrarily expanded or reduced for clarity of illustration. [Figure 1] FIG. 1 is a schematic diagram of a deep metric learning model, in accordance with at least some embodiments of the present invention. [Figure 2] 1 is an operational flow for training a deep metric learning model with multi-target adversarial examples, in accordance with at least some embodiments of the present invention. [Figure 3] 1 is an operational flow for generating multi-target adversarial examples according to at least some embodiments of the present invention. [Figure 4] FIG. 1 illustrates a sample input for a deep metric learning model, in accordance with at least some embodiments of the present invention. [Figure 5] FIG. 1 illustrates an adversarial example without perturbation tuning, in accordance with at least some embodiments of the present invention. [Figure 6] FIG. 1 illustrates a multi-target adversarial example with perturbation adjustment, in accordance with at least some embodiments of the present invention. [Figure 7] 1 is a deep feature space map, in accordance with at least some embodiments of the present invention. [Figure 8] FIG. 1 is a schematic diagram of a portion of a deep metric learning model, in accordance with at least some embodiments of the present invention. [Figure 9] FIG. 1 is a schematic diagram of a portion of a deep metric learning model with an auxiliary batch normalization layer, in accordance with at least some embodiments of the present invention. [Figure 10] 1 is an operational flow for applying a deep metric learning model to sample and multi-target adversarial examples, according to at least some embodiments of the present invention. [Figure 11]1 is an operational flow for initializing a deep metric learning model in accordance with at least some embodiments of the present invention. [Figure 12] 1 is an operational flow for tuning a deep metric learning model in accordance with at least some embodiments of the present invention. [Figure 13] FIG. 1 is a block diagram of a hardware configuration for automated negotiation agent adaptation, in accordance with at least some embodiments of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0007] The following disclosure provides many different embodiments or examples for implementing different features of the provided subject matter. Below, specific examples of components, values, operations, materials, arrangements, etc. are described to simplify the disclosure. Of course, these are merely examples and are not intended to be limiting. Other components, values, operations, materials, arrangements, etc. are also contemplated. In addition, the disclosure may repeat reference numerals and / or letters in various examples. This repetition is for simplicity and clarity and does not, in itself, dictate a relationship between the various embodiments and / or configurations described.

[0008] At least some DML models are vulnerable to carefully designed input images called adversarial examples (AX), which are samples with small, intentional feature perturbations that cause the machine learning model to behave in a specific, distorted way to achieve the adversary's goals.

[0009] In a facial recognition system (FRS), when an adversarial example masquerades as multiple identities for a target FRS, it is called a multi-targeted AX or MasterFace AX. The concept of multi-targeted AX is not limited to FRSs and can be applied to any sample to identify it as multiple classes.

[0010] In at least some embodiments, training with multi-target AX results in reduced overlap of class regions in deep feature space, hi at least some embodiments, training with multi-target AX results in increased inter-class separation and decreased intra-class separation in deep feature space.

[0011] 1 is a schematic diagram of a deep metric learning model 110 in accordance with at least some embodiments of the present invention. Deep metric learning model 110 is configured to output a feature vector 114 in a final layer in response to an input of sample 112. In at least some embodiments, deep metric learning model 110 includes multiple layers between an input layer whose value is equal to an input sample, such as sample 112, and the final layer. In at least some embodiments, the layers of deep metric learning model 110 apply convolutions to the samples. In at least some embodiments, the layers of the deep metric learning model include a convolutional layer, a pooling layer, a batch normalization layer, a dense layer, a dropout layer, an activation layer, etc.

[0012] 2 is an operational flow for training a deep metric learning model using multi-target adversarial examples, according to at least some embodiments of the present invention. The operational flow provides a method for training a deep metric learning model using multi-target adversarial examples. In at least some embodiments, one or more operations of the method are performed by a controller of an apparatus that includes sections for performing particular operations, such as the controller and apparatus illustrated in FIG. 13 described below.

[0013] At S220, an initialization section initializes the deep metric learning model. In at least some embodiments, the initialization section initializes the deep metric learning model with a random value between 0 and 1. In at least some embodiments, the initialization section initializes the deep metric learning model based on a pre-trained model.

[0014] At S230, a generation section generates multi-target adversarial examples. In at least some embodiments, the generation section applies perturbations to training samples to generate adversarial examples, and then adjusts the perturbations to generate multi-target adversarial examples. In at least some embodiments, the generation section applies a deep metric learning model to the adversarial examples and multiple target training samples and adjusts the perturbations based on the output.

[0015] At S240, an application section applies the deep metric learning model to the training samples, the labeled samples, and the multi-target adversarial examples. In at least some embodiments, the application section applies the deep metric learning model to obtain feature vectors that can be mapped to a feature space and estimate corresponding classes. In at least some embodiments, the application section applies the deep metric learning model to the clean samples to obtain clean feature vectors, applies the deep metric learning model to the labeled samples to obtain label feature vectors, and applies the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors. In at least some embodiments, the application section performs calculations according to parameters of the deep metric learning model via layers. In at least some embodiments, the application section utilizes alternative layers depending on whether the input is a sample or an adversarial example, such as when the samples and the adversarial examples come from different distributions.

[0016] At S250, a tuning section tunes the deep metric learning model based on feature vectors obtained by applying the deep metric learning model to the samples and the multi-target adversarial examples. In at least some embodiments, the tuning section tunes the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector. In at least some embodiments, the tuning section utilizes a loss function based on a comparison of the feature vectors. In at least some embodiments, the loss function is based on the distance between the feature vectors in feature space. In at least some embodiments, parameters of the deep metric learning model are updated according to the results of the loss function. In at least some embodiments, the tuning section updates the parameters using backpropagation and gradient descent.

[0017] In S260, the controller or a section thereof determines whether the sample metal batch has been processed. In at least some embodiments, the controller determines whether all sample batches have been processed through the iterations of S230, S240, and S250. If the controller determines that unprocessed sample batches remain, the operational flow returns to multi-target adversarial example generation in S230 with the next sample batch (S262). If the controller determines that all sample batches have been processed, the operational flow proceeds to S264, where it determines whether a termination condition has been met.

[0018] In S264, the controller or a section thereof determines whether a termination condition is met. In at least some embodiments, the termination condition is met upon completion of a predetermined number of epochs, where an epoch is one cycle of all sample batches being processed through iterations of S230, S240, and S250. In at least some embodiments, the termination condition is met when the result of the loss function falls below a threshold. If the controller determines that the termination condition is not met, the operational flow returns to multi-target adversarial example generation in S230 for another epoch. If the controller determines that the termination condition is met, the operational flow ends.

[0019] 3 is an operational flow for generating multi-target adversarial examples according to at least some embodiments of the present invention. The operational flow provides a method for generating multi-target adversarial examples. In at least some embodiments, one or more operations of the method are performed by a generation section of an apparatus, such as the apparatus shown in FIG. 13 described below.

[0020] In S331, the generation section or a subsection thereof initializes perturbations. In at least some embodiments, the generation section initializes perturbations applied to clean samples selected from a training sample set to form adversarial examples, the clean samples being associated with labeled samples. In at least some embodiments, the clean samples are selected from a batch of training samples in the training sample set. In at least some embodiments, the generation section initializes the perturbations as noise, such as a random value between 0 and ε, where ε is a predetermined deviation limit. In at least some embodiments, where the sample is an image, the generation section initializes the noise within a predefined patch region of the image, which can be of any size and shape. In at least some embodiments, where the sample is a face image, the predefined patch region takes the shape of glasses, a sticker, a hat, or any other physical object. In at least some embodiments, the predefined patch region covers the entire image, but the color shift of the noise is constrained to maintain the visibility and clarity of the image.

[0021] At S333, the generation section or a subsection thereof applies perturbations to the clean samples. In at least some embodiments, the generation section applies the perturbations to the clean samples to form adversarial examples. In at least some embodiments, the generation section applies the perturbations to the samples by offsetting values ​​of the samples by corresponding perturbation values. In at least some embodiments, where the samples are images, the generation section applies the patch by replacing image data of a subregion of the sample image with image data of the patch.

[0022] 4 illustrates a clean sample 412 for a deep metric learning model, in accordance with at least some embodiments of the present invention. The clean sample 412 is a face image for training an FRS. In at least some embodiments, the device selects the clean sample 412 from among multiple clean samples in a training sample set.

[0023] 5 illustrates an adversarial example 513 without perturbation tuning, according to at least some embodiments of the present invention. The adversarial example 513 is a face image for training an FRS. In at least some embodiments, the generation section of the device applies a perturbation 516 to a source face image having a random distribution of color values. The perturbation 516 is the shape of eyeglasses. In at least some embodiments, the adversarial example 513 does not properly identify multiple classes because the perturbation noise has not been tuned.

[0024] At S334, the generation section or a subsection thereof applies a deep metric learning model to the adversarial examples and the target samples. In at least some embodiments, the generation section applies the deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applies the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors. In at least some embodiments, the generation section instructs the application section to apply the deep metric learning model.

[0025] At S335, the generation section or a subsection thereof adjusts the perturbations based on the feature vector. In at least some embodiments, the generation section adjusts the perturbations to reduce the difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples. In at least some embodiments, the generation section adjusts the values ​​of the perturbations based on the results of the loss function. In at least some embodiments, when the last layer of the deep metric learning model is a feature layer φ(x), the multi-target adversarial examples (x f m-adv ) is expressed as:

[0026]

number

[0027] where x is the sample and δ fm is a perturbation applied to sample x to form multi-target type AX. In at least some embodiments, the generation section adjusts the value of the perturbation according to:

[0028]

number

[0029] where

number

[0030] 6 illustrates a multi-target adversarial example 613 with perturbation tuning, in accordance with at least some embodiments of the present invention. The multi-target adversarial example 613 is a facial image for training an FRS. In at least some embodiments, a generation section of the apparatus tunes perturbations 616 to minimize a loss function over multiple iterations. In at least some embodiments, the feature vectors obtained from applying the deep metric learning model of the FRS to the multi-target adversarial example 613 occupy locations in the feature space where multiple classes overlap.

[0031] In S336, the generation section or a subsection thereof determines whether a termination condition has been met. In at least some embodiments, the termination condition is met when the distance between the feature vectors in the feature space is below a threshold. In at least some embodiments, the termination condition is met when a predetermined number of iterations of the operations in S333, S334, and S335 have been performed. If the generation section determines that the termination condition has not been met, the operational flow returns to applying perturbations in S333 for another iteration. In at least some embodiments, the operations of applying the deep distance learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations are repeated until the difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. If the generation section determines that the termination condition has been met, the operational flow proceeds to S338, where it determines whether all samples have been processed.

[0032] FIG. 7 illustrates a deep feature space map 717 according to at least some embodiments of the present invention. The deep feature space map 717 includes regions associated with classes, such as class 1 region 718A, class 2 region 718B, class 3 region 718C, and class 4 region 718D. The deep feature space map 717 further includes feature vector 714A and feature vector 714B. In at least some embodiments, the deep feature space map 717 is used to map the output of a deep metric learning model. In at least some embodiments, feature vector 714A is output from the deep metric learning model when applied to clean samples with initialized perturbations without adjustment. In at least some embodiments, once perturbations are adjusted according to target samples of class 1, class 2, and class 3, such as in the perturbation adjustment operation at S335 of FIG. 3, the mapped location of the output feature vector moves from feature vector 714A to feature vector 714B. Feature vector 714B occupies a position where class 1, class 2, and class 3 all overlap. In at least some embodiments, training a deep metric learning model with clean samples and adjusted perturbations, the combination of which results in multi-target adversarial examples, reduces the overlapping regions of class 1 region 718A, class 2 region 718B, and class 3 region 718C.

[0033] In S338, the generation section or a subsection thereof determines whether all samples have been processed. In at least some embodiments, the generation section determines whether all samples in the batch of samples have been processed. If the generation section determines that unprocessed samples remain, the operational flow returns to perturbation initialization in S331 with the next clean sample (S339). If the generation section determines that all samples have been processed, the operational flow ends.

[0034] 8 is a schematic diagram of a portion of a deep metric learning model in accordance with at least some embodiments of the present invention. This portion includes layer 811 L , layer 811BN , and layer 811 L+1 It contains three layers: Layer 811 BN is a batch normalization layer. In at least some embodiments, once a sample is processed through a deep metric learning model, the data is passed through layer 811 regardless of the type of sample input. L , layer 811 BN , and layer 811 L+1 Flowing through.

[0035] At least some embodiments utilize disentangled adversarial training, whereby separate batch normalization (BN) layers are used during training to handle input clean samples and adversarial samples that may come from different distributions.

[0036] 9 is a schematic diagram of a portion of a deep metric learning model with an auxiliary batch normalization layer, in accordance with at least some embodiments of the present invention. In at least some embodiments, the deep metric learning model includes a main batch normalization layer and an auxiliary batch normalization layer configured to replace the main batch normalization layer. This portion includes layer 911 L , layer 911 BN , layer 911 ABN , and layer 911 L+1 It contains four layers: Layer 911 BN and Layer 911 ABN is a batch normalization layer. In at least some embodiments, once samples are processed through a deep distance learning model, the data is fed to layer 911 in response to the input of clean samples. L , layer 911 BN , and layer 911 L+1 In at least some embodiments, as samples are processed through a deep metric learning model, the data flows through layer 911 in response to the input of adversarial examples. L , layer 911 ABN , and layer 911 L+1 Flowing through.

[0037] At least some embodiments leverage disentanglement learning and multi-target AX to improve image recognition models in DML settings. A method the inventors call AdvProp proposes to improve image recognition models using AX. The method uses auxiliary batch normalization layers in the model during inference of AX to enable disentanglement learning during the training process, optimizing the following objectives:

[0038]

number

[0039] where θ is the model parameter, x is the sample, y is the label, δ is the perturbation applied to sample x to form AX, and E x、y where () is the error function, L(θ, x, y) is the loss function on the training samples, and L(θ, x + δ, y) is the loss function on AX. The AdvProp method is designed for use in a classification setting and is often more effective for models that include a classification layer. Also, the AdvProp method considers single-targeted AX and does not change for use with multi-targeted AX.

[0040] 10 is an operational flow for applying a deep metric learning model to sample and multi-target adversarial examples, according to at least some embodiments of the present invention. The operational flow provides a method for applying a deep metric learning model to sample and multi-target adversarial examples. In at least some embodiments, one or more operations of the method are performed by an application section of an apparatus, such as the apparatus shown in FIG. 13 described below.

[0041] In S1041, the applying section or a subsection thereof applies the deep metric learning model to the samples. In at least some embodiments, the applying section applies the deep metric learning model to the clean samples. In at least some embodiments, the applying section applies the deep metric learning model to the labeled samples. In at least some embodiments, the operation of applying the deep metric learning model to the clean samples and the labeled samples includes applying a main batch normalization layer. In at least some embodiments, the applying section applies the deep metric learning model to the samples during adversarial example generation. In at least some embodiments, the applying section applies the deep metric learning model to the samples during training of the deep metric learning model.

[0042] At S1042, the application section or a subsection thereof obtains the output feature vector from the deep metric learning model, and in at least some embodiments, the application section stores the output feature vector in memory for later use in calculating the loss function.

[0043] In S1043, the application section or a subsection thereof determines whether all samples have been processed. In at least some embodiments, the application section determines whether all samples in the batch of samples have been processed. If the application section determines that unprocessed samples remain, the operational flow returns to model application in S1041 using the next sample (S1044). If the application section determines that all samples have been processed, the operational flow proceeds to batch normalization layer replacement in S1045.

[0044] In S1045, the application section or a subsection thereof replaces a main batch normalization layer with an auxiliary batch normalization layer. In at least some embodiments, the application section replaces multiple main batch normalization layers with auxiliary batch normalization layers in the deep metric learning model. In at least some embodiments, the application section replaces parameters of each main batch normalization layer with parameters of a corresponding auxiliary batch normalization layer.

[0045] At S1046, the applying section or a subsection thereof applies the deep metric learning model to the adversarial examples. In at least some embodiments, the applying section applies the deep metric learning model to multi-target adversarial examples. In at least some embodiments, the operation of applying the deep metric learning model to the adversarial examples and the multi-target adversarial examples includes applying an auxiliary batch normalization layer. In at least some embodiments, the applying section applies the deep metric learning model to the adversarial examples during adversarial example generation. In at least some embodiments, the applying section applies the deep metric learning model to the multi-target adversarial examples during training of the deep metric learning model.

[0046] At S1047, the application section or a subsection thereof obtains the output feature vector from the deep metric learning model, and in at least some embodiments, the application section stores the output feature vector in memory for later use in calculating the loss function.

[0047] In S1048, the application section or a subsection thereof determines whether all adversarial examples have been processed. In at least some embodiments, the application section determines whether all adversarial examples in the batch have been processed. If the application section determines that unprocessed adversarial examples remain, the operational flow returns to model application in S1046 with the next sample (S1049). If the application section determines that all samples have been processed, the operational flow ends.

[0048] In at least some embodiments, the application section replaces the main batch normalization layer with the auxiliary batch normalization layer more frequently than once per batch. In at least some embodiments, the application section routes data through the appropriate layer without performing a substitution between applications. In at least some embodiments, the deep metric learning model does not include an auxiliary batch normalization layer, and the application section processes all samples and examples according to operations S1041, S1042, S1043, and S1044.

[0049] 11 is an operational flow for initializing a deep metric learning model in accordance with at least some embodiments of the present invention. The operational flow provides a method for initializing a deep metric learning model. In at least some embodiments, one or more operations of the method are performed by an initialization section of an apparatus, such as the apparatus illustrated in FIG. 13 described below.

[0050] In S1121, the initialization section or a subsection thereof determines whether there is a pre-trained model as a basis for initialization. In at least some embodiments, the initialization section determines whether a pre-trained deep metric learning model was provided in memory or sent with a request for initialization. If the initialization section determines there is a pre-trained model as a basis for initialization, the operational flow proceeds to pre-trained model-based initialization in S1122. If the initialization section determines there is not a pre-trained model as a basis for initialization, the operational flow proceeds to random-based initialization in S1129.

[0051] In S1122, the initialization section or a subsection thereof initializes the deep metric learning model from the pre-trained model. In at least some embodiments, the initialization section initializes the deep metric learning model based on the pre-trained model. In at least some embodiments, the initialization section initializes the deep metric learning model and assumes parameter values ​​of the pre-trained model.

[0052] In S1124, the initialization section or a subsection thereof determines whether the deep metric learning model includes an auxiliary batch normalization layer. In at least some embodiments, the initialization section determines whether the parameters for the deep metric learning model include parameters for an auxiliary batch normalization layer. If the initialization section determines that the deep metric learning model includes an auxiliary batch normalization layer, the operational flow proceeds to parameter offsetting in S1126. If the initialization section determines that the deep metric learning model does not include an auxiliary batch normalization layer, the operational flow ends.

[0053] In S1126, the initialization section or a subsection thereof offsets parameters of the pre-trained model batch normalization layer. In at least some embodiments, the initialization section adds an offset value to the value of each parameter in the pre-trained model batch normalization layer. In at least some embodiments, the initialization section offsets the pre-trained main BN layer parameters θ BN The auxiliary BN parameter θ AuxBN In at least some embodiments, the parameters of the model {θ NBN , θ BN , θ AuxBN} is θ NBN ←β NBN、 θ BN ←β BN、 and θ AuxBN ←β BN +γ, where the parameters of the pre-trained model are initialized as {β NBN , β BN}, where γ is a real number less than 1. In at least some embodiments, γ is less than 0.1 and may be 0.

[0054] In S1127, the initialization section or a subsection thereof initializes an auxiliary batch normalization layer of the deep metric learning model from an offset parameter. In at least some embodiments, the initialized values ​​of the auxiliary batch normalization layer are offset from corresponding values ​​of a pre-trained batch normalization layer of the pre-trained model. In at least some embodiments, the initialization section initializes the auxiliary batch normalization layer of the deep metric learning model to assume parameter values ​​of the pre-trained model after adding the offset value to each parameter value.

[0055] In S1129, the initialization section or a subsection thereof initializes the deep metric learning model from random values. In at least some embodiments, the initialization section initializes the deep metric learning model based on a random selection of a value between 0 and 1 for each parameter of the deep metric learning model. In at least some embodiments, the initialization section initializes an auxiliary batch normalization layer of the deep metric learning model to assume initialized parameter values ​​of the main batch normalization layer. In at least some embodiments, the initialization section initializes the auxiliary batch normalization layer of the deep metric learning model to assume initialized parameter values ​​of the main batch normalization layer after adding an offset value to each parameter value. In at least some embodiments, the initialization section initializes the auxiliary batch normalization layer of the deep metric learning model from random values ​​regardless of the parameter values ​​of the main batch normalization layer.

[0056] 12 is an operational flow for tuning a deep metric learning model according to at least some embodiments of the present invention. The operational flow provides a method for tuning a deep metric learning model. In at least some embodiments, one or more operations of the method are performed by a tuning section of an apparatus, such as the apparatus shown in FIG. 13 described below.

[0057] In S1252, the adjustment section or a subsection thereof determines a loss based on a difference between the clean feature vector and the label feature vector. In at least some embodiments, the adjustment section determines a loss value based on a first value representing the difference between the clean feature vector and the label feature vector. In at least some embodiments, the adjustment section determines the loss based on:

[0058]

number

[0059] where θ is a model parameter and x c is a clean sample, and y c is the label sample, and L CL () is a function for the loss that measures the distance between the clean feature vector and the label feature vector.

[0060] In S1254, the adjustment section or a subsection thereof determines a loss based on a difference between the multi-target adversarial feature vector and the label feature vector. In at least some embodiments, the adjustment section determines a loss value based on a second value representing a difference between the multi-target adversarial feature vector and the label feature vector. In at least some embodiments, the adjustment section determines the loss based on:

[0061]

number

[0062] where θ is a model parameter and x c +δ f m is a multi-target adversarial example, and y c is the label sample, and L ML () is a function for the loss that measures the distance between the multi-target adversarial feature vector and the label feature vector.

[0063] In at least some embodiments, the tuning section determines a regularization penalty to further enhance generalization and reduce the occurrence of overfitting as follows:

[0064]

number

[0065] where θ is a model parameter and x c is a clean sample, and x c +δ f m is a multi-target adversarial example, and φ θ () is the feature vector function of the deep distance learning model, and g() is a regularization function that measures the distance between the clean feature vector and the multi-target adversarial feature vector.

[0066] In S1256, the adjustment section or a subsection thereof determines a loss based on a difference between the clean feature vector and the multi-target adversarial feature vector. In at least some embodiments, the adjustment section determines a loss value further based on a third value representing a difference between the clean feature vector and the multi-target adversarial feature vector. In at least some embodiments, the adjustment section determines the loss based on:

[0067]

number

[0068] where θ is a model parameter and x c is a clean sample, and x c +δ f m is a multi-target adversarial example, and L CM () is a function for the loss that measures the distance between the clean feature vector and the multi-target adversarial feature vector.

[0069] At S1258, the tuning section or a subsection thereof adjusts parameters of the deep distance learning model to reduce loss. In at least some embodiments, the tuning section adjusts the parameters to decrease the distance between the clean feature vector and the label feature vector, decrease the distance between the multi-target adversarial feature vector and the label feature vector, and increase the distance between the clean feature vector and the multi-target adversarial feature vector:

[0070]

number

[0071] where E (x、y)~D () is a loss-based error function. In at least some embodiments, the adjustment section CL and L ML and L CM and adjust the parameter value based on only one of the first and second values. In other words, the adjustment section of at least some embodiments determines the loss value based on a first value representing the difference between the clean feature vector and the label feature vector and a second value representing the difference between the multi-target adversarial feature vector and the label feature vector. In at least some embodiments where the deep metric learning model includes an auxiliary batch normalization layer, adjusting the deep metric learning model includes adjusting the main batch normalization layer based on the first value, regardless of the second value, and adjusting the auxiliary batch normalization layer based on the second value, regardless of the first value. The adjustment section of at least some embodiments determines the loss value based on the first value representing the difference between the clean feature vector and the label feature vector and a second value representing the difference between the clean feature vector and the multi-target adversarial feature vector. In at least some embodiments, the training objective with regularization penalty is given by:

[0072]

number

[0073] where x c is a clean sample, and y c is the label sample, and x c +δ f m is the multi-target type AX, and g() is a regularization function that measures the distance between the clean feature vector and the multi-target adversarial feature vector.

[0074] In at least some embodiments, the tuning section tunes parameters of the deep metric learning model that includes the auxiliary batch normalization layer according to:

[0075]

number

[0076] where x c +δ f m is a multi-target AX in the feature space, and θ NBN are model parameters excluding the BN layer, and θ BN is the model parameter of the main BN layer, and θ AuxBN are model parameters of the auxiliary BN layer. In at least some embodiments, the adjustment section adjusts {θ NBN , θ BN} parameters and adjust the loss based on the adversarial feature vectors. NBN , θ AuxBN} Adjust the parameters.

[0077] FIG. 13 is a block diagram of a hardware configuration for automated negotiation agent adaptation, in accordance with at least some embodiments of the present invention.

[0078] An exemplary hardware configuration includes an apparatus 1300 that interacts with an input device 1309 and communicates with a network 1307. In at least some embodiments, the apparatus 1300 is integrated with the input device 1309. In at least some embodiments, the apparatus 1300 is a computer system that executes computer-readable instructions that perform operations for physical network function device access.

[0079] The device 1300 includes a controller 1302, a storage unit 1304, a communication interface 1306, and an input / output interface 1308. In at least some embodiments, the controller 1302 includes a processor or programmable circuit that executes instructions, which cause the processor or programmable circuit to perform operations in accordance with the instructions. In at least some embodiments, the controller 1302 includes analog or digital programmable circuitry, or any combination thereof. In at least some embodiments, the controller 1302 includes physically separate storage devices or circuits that interact through communications. In at least some embodiments, the storage unit 1304 includes a non-volatile computer-readable medium capable of storing executable and non-executable data for access by the controller 1302 during execution of instructions. The communication interface 1306 transmits and receives data to and from a network 1307. The input / output interface 1308 connects to and exchanges information with various input / output units, such as input devices 1309, via parallel ports, serial ports, keyboard ports, mouse ports, monitor ports, etc.

[0080] The controller 1302 includes an initialization section 1370, a generation section 1372, an application section 1374, and an adjustment section 1376. The storage unit 1304 includes training samples 1380, model parameters 1382, generation parameters 1384, and a loss function 1386.

[0081] The initialization section 1370 is circuitry or instructions of the controller 1302 configured to initialize model and perturbation parameters. In at least some embodiments, the initialization section 1370 is configured to initialize a deep metric learning model based on a pre-trained model. In at least some embodiments, the initialization section 1370 records information such as model parameters 1382 in the storage unit 1304. In at least some embodiments, the initialization section 1370 includes subsections for performing additional functions, as described in the preceding flowcharts. In at least some embodiments, such subsections are referenced by names associated with the corresponding functions.

[0082] Generation section 1372 is circuitry or instructions of controller 1302 configured to generate multi-target adversarial examples. In at least some embodiments, generation section 1372 is configured to apply perturbations to training samples to generate adversarial examples and then adjust the perturbations to generate multi-target adversarial examples. In at least some embodiments, generation section 1372 utilizes information in storage unit 1304, such as model parameters 1382 and generation parameters 1384. In at least some embodiments, generation section 1372 includes subsections for performing additional functions, as described in the preceding flowcharts. In at least some embodiments, such subsections are referenced by names associated with the corresponding functions.

[0083] The apply section 1374 is circuitry or instructions of the controller 1302 configured to apply the model to samples and examples. In at least some embodiments, the apply section 1374 is configured to apply the deep metric learning model to clean samples to obtain clean feature vectors, to apply the deep metric learning model to labeled samples to obtain labeled feature vectors, and to apply the deep metric learning model to multi-target adversarial examples to obtain multi-target adversarial feature vectors. In at least some embodiments, the apply section 1374 utilizes information from the storage unit 1304, such as training samples 1380 and model parameters 1382. In at least some embodiments, the apply section 1374 includes subsections for performing additional functions, as described in the preceding flowcharts. In at least some embodiments, such subsections are referenced by names associated with the corresponding functions.

[0084] The tuning section 1376 is circuitry or instructions of the controller 1302 configured to adjust perturbation values ​​and model parameters. In at least some embodiments, the tuning section 1376 is configured to tune the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector. In at least some embodiments, the tuning section 1376 utilizes information from the storage unit 1304, such as the model parameters 1382 and the loss function 1386, and records information such as the model parameters 1382 in the storage unit 1304. In at least some embodiments, the applying section 1374 includes subsections for performing additional functions, as described in the preceding flowcharts. In at least some embodiments, such subsections are referenced by names associated with the corresponding functions.

[0085] In at least some embodiments, the apparatus is a separate device capable of processing logical functions to perform the operations herein. In at least some embodiments, the controller and storage unit need not be entirely separate devices, and in some embodiments share circuitry or one or more computer-readable media. In at least some embodiments, the storage unit includes a hard drive that stores both computer-executable instructions and data accessed by the controller, and the controller includes a combination of a central processing unit (CPU) and RAM, and the computer-executable instructions can be copied in whole or in part for execution by the CPU during performance of the operations herein.

[0086] In at least some embodiments where the device is a computer, a program installed on the computer can cause the computer to function as the device of the embodiments described herein or to perform operations associated with the device, and in at least some embodiments, such a program can be executed by a processor to cause the computer to perform specific operations associated with some or all of the blocks in the flowcharts and block diagrams described herein.

[0087] At least some embodiments are described with reference to flowcharts and block diagrams, where the blocks represent (1) steps in a process in which an operation is performed or (2) sections of a controller responsible for performing an operation. In at least some embodiments, particular steps and sections are performed by dedicated circuitry, programmable circuitry provided with computer-readable instructions stored on a computer-readable medium, and / or a processor provided with computer-readable instructions stored on a computer-readable medium. In at least some embodiments, the dedicated circuitry includes digital and / or analog hardware circuitry, including integrated circuits (ICs) and / or discrete circuits. In at least some embodiments, the programmable circuitry includes reconfigurable hardware circuitry comprising logical AND, OR, XOR, NAND, NOR, and other logic operations, flip-flops, registers, memory elements, etc., e.g., field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), etc.

[0088] In at least some embodiments, a computer-readable storage medium comprises a tangible device capable of holding and storing instructions for use by an instruction execution device. In some embodiments, a computer-readable storage medium comprises, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD), memory stick, floppy disk, punch cards or mechanically encoded devices such as raised structures in grooves with instructions recorded thereon, and any suitable combination of the above. As used herein, computer-readable storage media should not be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted through wires.

[0089] In at least some embodiments, the computer-readable program instructions described herein are downloadable from a computer-readable storage medium to each computing / processing device or to an external computer or external storage device via a network, e.g., the Internet, a local area network, a wide area network, and / or a wireless network. In at least some embodiments, the network includes copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. In at least some embodiments, a network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing / processing device.

[0090] In at least some embodiments, the computer-readable program instructions for performing the operations described above are either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and traditional procedural programming languages ​​such as the "C" programming language or similar programming languages. In at least some embodiments, the computer-readable program instructions execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In at least some embodiments, in the latter scenario, the remote computer is connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or to an external computer (e.g., through the Internet using an Internet Service Provider). In at least some embodiments, electronic circuits, including, for example, programmable logic circuits, field programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), execute computer-readable program instructions to individualize the electronic circuit by utilizing state information of the computer-readable program instructions to implement aspects of the present invention.

[0091] Although the embodiments of the present invention have been described above, the technical scope of the claims is not limited to the above-described embodiments. Those skilled in the art will understand that various modifications and improvements to the above-described embodiments are possible. Those skilled in the art will also understand from the claims that embodiments with such modifications or improvements are included within the technical scope of the present invention.

[0092] The operations, procedures, steps, and process stages performed by the apparatuses, systems, programs, and methods shown in the claims, embodiments, or figures can be performed in any order unless the order is indicated by "before," "prior to," or the like, and unless output from a previous process is used in a later process. Even if a process flow is described in the claims, embodiments, or figures using phrases such as "first" or "next," such description does not necessarily mean that the processes must be performed in the order described.

[0093] According to at least some embodiments of the present invention, the deep metric learning model is trained on the multi-target adversarial examples by initializing perturbations applied to clean samples selected from a training sample set and associated with labeled samples to form adversarial examples; applying the deep metric learning model to the adversarial examples and to a plurality of target samples selected from the training sample set to obtain an adversarial feature vector and a plurality of target feature vectors, respectively; adjusting the perturbations to reduce differences between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples, the labeled samples, and the multi-target adversarial examples to obtain a clean feature vector, a label feature vector, and a multi-target adversarial feature vector, respectively; and adjusting the deep metric learning model based on the clean feature vectors, the label feature vectors, and the multi-target adversarial feature vectors.

[0094] Some embodiments include instructions in a computer program, a method performed by a processor executing the instructions of the computer program, and an apparatus for performing the method. In some embodiments, the apparatus includes a controller including circuitry configured to perform the operations in the instructions.

[0095] The foregoing outlines features of some embodiments so that those skilled in the art may better understand aspects of the present disclosure. Those skilled in the art should appreciate that they can readily use this disclosure as a basis for designing or modifying other processes and structures that carry out the same purposes and / or achieve the same advantages as the embodiments introduced herein. Those skilled in the art should also recognize that such equivalent constructions do not depart from the spirit and scope of the present disclosure, and that various changes, substitutions, and alterations can be made herein without departing from the spirit and scope of the present disclosure.

[0096] Some or all of the above exemplary embodiments can be described as follows, but are not limited to:

[0097] (Appendix 1) A computer-readable medium containing instructions executable by a computer to cause a computer to perform operations, the operations comprising: initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce the difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples; Applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the labeled samples to obtain label feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; Tuning a deep metric learning model based on clean feature vectors, label feature vectors, and multi-target adversarial feature vectors 1. A computer-readable medium comprising:

[0098] (Appendix 2) The operations of applying the deep metric learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations are repeated until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. 2. The computer-readable medium of claim 1.

[0099] (Appendix 3) Tuning a deep distance learning model is a first value representing the difference between the clean feature vector and the label feature vector; and A second value representing the difference between the clean feature vector and the multi-target adversarial feature vector 2. The computer-readable medium of claim 1, comprising determining a loss value based on:

[0100] (Appendix 4) Tuning a deep distance learning model is a first value representing the difference between the clean feature vector and the label feature vector; and A second value representing the difference between the multi-target adversarial feature vector and the label feature vector 2. The computer-readable medium of claim 1, comprising determining a loss value based on:

[0101] (Appendix 5) the deep metric learning model includes a primary batch normalization layer and an auxiliary batch normalization layer configured to replace the primary batch normalization layer; The act of applying the deep metric learning model to the clean samples and the labeled samples includes applying a primal batch normalization layer; The operation of applying the deep metric learning model to the adversarial examples and the multi-target adversarial examples includes applying an auxiliary batch normalization layer. 5. The computer-readable medium of claim 4.

[0102] (Appendix 6) Tuning a deep distance learning model is adjusting the primal batch normalization layer based on the first value without regard to the second value; adjusting the auxiliary batch normalization layer based on the second value without regard to the first value; 6. The computer-readable medium of claim 5, comprising:

[0103] (Appendix 7) 7. The computer-readable medium of claim 6, wherein adjusting the deep metric learning model includes determining a loss value further based on a third value representing a difference between the clean feature vector and the multi-target adversarial feature vector.

[0104] (Appendix 8) The operations further include initializing a deep metric learning model based on the pre-trained model; The initialized values ​​of the auxiliary batch normalization layer are offset from the corresponding values ​​of the pre-trained batch normalization layer in the pre-trained model. 6. The computer-readable medium of claim 5.

[0105] (Appendix 9) initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce the difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples; Applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the labeled samples to obtain label feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; Tuning a deep metric learning model based on clean feature vectors, label feature vectors, and multi-target adversarial feature vectors A method comprising:

[0106] (Appendix 10) The operations of applying the deep metric learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations are repeated until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. The method described in Appendix 9.

[0107] (Appendix 11) Tuning a deep distance learning model is a first value representing the difference between the clean feature vector and the label feature vector; and A second value representing the difference between the clean feature vector and the multi-target adversarial feature vector 10. The method of claim 9, comprising determining a loss value based on:

[0108] (Appendix 12) Tuning a deep distance learning model is a first value representing the difference between the clean feature vector and the label feature vector; and A second value representing the difference between the multi-target adversarial feature vector and the label feature vector 10. The method of claim 9, comprising determining a loss value based on:

[0109] (Appendix 13) the deep metric learning model includes a primary batch normalization layer and an auxiliary batch normalization layer configured to replace the primary batch normalization layer; The act of applying the deep metric learning model to the clean samples and the labeled samples includes applying a primal batch normalization layer; The operation of applying the deep metric learning model to the adversarial examples and the multi-target adversarial examples includes applying an auxiliary batch normalization layer. 12. The method described in Appendix 12.

[0110] (Appendix 14) Adjusting the deep metric learning model includes adjusting a primal batch normalization layer based on the first value without regard to the second value; adjusting the auxiliary batch normalization layer based on the second value without regard to the first value; 14. The method of claim 13, comprising:

[0111] (Appendix 15) 15. The method of claim 14, wherein adjusting the deep metric learning model includes determining a loss value further based on a third value representing a difference between the clean feature vector and the multi-target adversarial feature vector.

[0112] (Appendix 16) Initializing a deep metric learning model based on a pre-trained model further comprising The initialized values ​​of the auxiliary batch normalization layer are offset from the corresponding values ​​of the pre-trained batch normalization layer in the pre-trained model. The method described in Appendix 15.

[0113] (Appendix 17) initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; Applying the deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce the difference between the adversarial feature vector and the multiple target feature vectors to generate multi-target adversarial examples; Applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the label samples to obtain label feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; Tuning a deep metric learning model based on clean feature vectors, label feature vectors, and multi-target adversarial feature vectors A controller including a circuit configured to An apparatus comprising:

[0114] (Appendix 18) The circuitry is configured to repeat the operations of applying the deep metric learning model to the adversarial examples and the plurality of target examples and adjusting the perturbation until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. 18. The apparatus of claim 17.

[0115] (Appendix 19) The circuit configured to tune the deep metric learning model includes: a first value representing the difference between the clean feature vector and the label feature vector; and A second value representing the difference between the clean feature vector and the multi-target adversarial feature vector 18. The apparatus of claim 17, further configured to determine a loss value based on:

[0116] (Appendix 20) The circuit configured to tune the deep metric learning model includes: a first value representing the difference between the clean feature vector and the label feature vector; and A second value representing the difference between the multi-target adversarial feature vector and the label feature vector 18. The apparatus of claim 17, further configured to determine a loss value based on:

[0117] This application claims the benefit of U.S. Patent Application No. 17 / 687,540, filed March 4, 2022, which is incorporated herein by reference in its entirety.

Claims

1. initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain adversarial feature vectors, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce differences between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the labeled samples to obtain labeled feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; training the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector; A program for causing a computer to perform an operation, including:

2. The operations of applying the deep metric learning model to the adversarial examples and the plurality of target samples and adjusting the perturbations are repeated until a difference between the adversarial feature vector and the plurality of target feature vectors is less than a threshold difference value. The program according to claim 1.

3. Adjusting the deep metric learning model includes: a first value representing the difference between the clean feature vector and the label feature vector; and a second value representing the difference between the clean feature vector and the multi-target adversarial feature vector; The program of claim 1 , further comprising determining a loss value based on:

4. Adjusting the deep metric learning model includes: a first value representing the difference between the clean feature vector and the label feature vector; and a second value representing the difference between the multi-target adversarial feature vector and the label feature vector; The program of claim 1 , further comprising determining a loss value based on:

5. the deep metric learning model includes a primary batch normalization layer and an auxiliary batch normalization layer configured to replace the primary batch normalization layer; the act of applying the deep metric learning model to the clean samples and the labeled samples includes applying the main batch normalization layer; the operation of applying the deep metric learning model to the adversarial examples and the multi-target adversarial examples includes applying the auxiliary batch normalization layer. The program according to claim 4.

6. Adjusting the deep metric learning model includes: adjusting the master batch normalization layer based on the first value without regard to the second value; adjusting the auxiliary batch normalization layer based on the second value without regard to the first value; The program according to claim 5 , comprising:

7. 7. The program of claim 6, wherein the adjusting the deep metric learning model comprises determining the loss value further based on a third value representing a difference between the clean feature vector and the multi-target adversarial feature vector.

8. The operations further include initializing the deep metric learning model based on a pre-trained model; the initialized values ​​of the auxiliary batch normalization layer are offset from the corresponding values ​​of a pre-trained batch normalization layer of the pre-trained model. The program according to claim 5.

9. A computer comprising: initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain adversarial feature vectors, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce differences between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples; applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the labeled samples to obtain labeled feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; training the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector; A method comprising:

10. initializing perturbations applied to clean samples selected from the training sample set and associated with the label samples to form adversarial examples; applying a deep metric learning model to the adversarial examples to obtain an adversarial feature vector, and applying the deep metric learning model to a plurality of target samples selected from the training sample set to obtain a plurality of target feature vectors; adjusting the perturbations to reduce differences between the adversarial feature vector and the plurality of target feature vectors to generate multi-target adversarial examples; Applying the deep metric learning model to the clean samples to obtain clean feature vectors, applying the deep metric learning model to the labeled samples to obtain labeled feature vectors, and applying the deep metric learning model to the multi-target adversarial examples to obtain multi-target adversarial feature vectors; Adjusting the deep metric learning model based on the clean feature vector, the label feature vector, and the multi-target adversarial feature vector. A controller including a circuit configured to An apparatus comprising:

Images