Evaluation device, evaluation method, and evaluation program

Abstract

An evaluation device (10) calculates a function for evaluation indicating an Accuracy-Robustness tradeoff relation of a CNN model trained by an existing adversarial learning technique, on the basis of evaluation results of precision regarding perturbation images and evaluation results of precision regarding normal images. Thereafter, the evaluation device (10) finds, regarding a CNN model trained by an adversarial learning technique that is an object of evaluation, discrimination precision regarding images with adversarial perturbation applied (adversarial evaluation) and discrimination precision regarding normal images (normal evaluation). The evaluation device (10) then calculates a distance between the function for evaluation and coordinates indicating the adversarial evaluation and the normal evaluation of this CNN model, and outputs the calculated distance.

Description

[Technical Field]

[0001] The present invention relates to an evaluation device, an evaluation method, and an evaluation program for evaluating a learning technique for an image processing model. [Background technology]

[0002] CNNs (Convolutional Neural Networks) are a type of neural network (NN) traditionally used for image recognition. There are attacks that add noise to the input image to a CNN to cause it to make incorrect image recognition. The noise added to the input image to cause incorrect image recognition is called adversarial perturbation. For example, an attack using adversarial perturbation can cause a CNN to identify an image that appears to a human to contain a dog as containing a car.

[0003] Adversarial learning (see Non-Patent Document 1) is a method for building a CNN that is robust against adversarial perturbations. Adversarial learning creates adversarial perturbations that attack a CNN model to the maximum extent possible, and trains the CNN model so that it can correctly identify images to which the adversarial perturbations have been added. This method builds a robust CNN model by repeating the process of creating adversarial perturbations that attack the trained CNN model to the maximum extent possible.

[0004] CNN models that have undergone adversarial training are highly robust. However, there is a problem in that the classification accuracy of CNN models that have undergone adversarial training for images to which no adversarial perturbation has been applied (hereinafter referred to as normal images) is lower than that of CNN models that have only been trained on normal images (hereinafter referred to as normal CNN models).

[0005] This trade-off between the robustness of a CNN model and its classification accuracy for normal images is called the accuracy-robustness trade-off.There are many training methods for CNN models that improve on adversarial learning, and it is considered important to evaluate these training methods while taking into account the accuracy-robustness trade-off. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] A. Madry,et al.,“Towards Deep Learning Models Resistant to Adversarial Attacks”, 2018. Summary of the Invention [Problem to be solved by the invention]

[0007] However, no method has been proposed to evaluate each learning method of an image processing model such as a CNN model while taking into account the Accuracy-Robustness trade-off. Therefore, an object of the present invention is to evaluate each learning method of an image processing model while taking into account the Accuracy-Robustness trade-off. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, the present invention is characterized by comprising: a function calculation unit that calculates a function indicating a trade-off relationship between the accuracy of an image processing model trained by an existing adversarial learning method for perturbed images, which are images to which perturbation has been added, and the accuracy of the image processing model for normal images, which are images to which the perturbation has not been added, based on the accuracy of the image processing model for the perturbed images, which are images to which the perturbation has been added, a first evaluation unit that evaluates the accuracy of the image processing model trained by the adversarial learning method to be evaluated for the perturbed images, a second evaluation unit that evaluates the accuracy of the image processing model for the unperturbed images, a distance calculation unit that calculates the distance between coordinates indicating the evaluation results of the accuracy of the image processing model for the perturbed images and the evaluation results of the accuracy of the image processing model for the unperturbed images, and the function, and a distance output unit that outputs the calculated distance. [Effects of the Invention]

[0009] According to the present invention, each learning method of an image processing model can be evaluated taking into account the accuracy-robustness trade-off. [Brief explanation of the drawings]

[0010] [Figure 1A] FIG. 1A is a diagram for explaining an overview of the evaluation device. [Figure 1B] FIG. 1B is a diagram illustrating an example of the configuration of an evaluation device. [Figure 2] FIG. 2 is a flowchart illustrating an example of a processing procedure executed by the evaluation device. [Figure 3] FIG. 3 is a flowchart illustrating an example of a processing procedure executed by the evaluation function calculation unit. [Figure 4] FIG. 4 is a flowchart illustrating an example of a processing procedure executed by the image generating unit. [Figure 5] FIG. 5 is a flowchart illustrating an example of a processing procedure executed by the second image identification unit. [Figure 6]FIG. 6 is a flowchart illustrating an example of a processing procedure executed by the first image identification unit. [Figure 7] FIG. 7 is a flowchart illustrating an example of a processing procedure executed by the distance calculation unit and the distance output unit. [Figure 8] FIG. 8 is a flowchart illustrating an example of a processing procedure executed by the image generating unit. [Figure 9] FIG. 9 is a diagram illustrating a computer that executes an evaluation program. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, a mode (embodiment) for carrying out the present invention will be described with reference to the drawings. The present invention is not limited to this embodiment. In addition, in this embodiment, a case where the perturbation added to the image is an adversarial perturbation will be described as an example, but the present invention is not limited to this.

[0012] Furthermore, the evaluation of the accuracy of the image processing model performed by the evaluation device of this embodiment is, for example, an evaluation of the image classification accuracy using a CNN model. In the following, the evaluation of the accuracy of the image processing model performed by the evaluation device will be described as an example in which the evaluation is an evaluation of the image classification accuracy using a CNN model, but is not limited to this. Furthermore, the image processing model may be a model using a Transformer (see Document 1) in addition to the above-mentioned CNN model.

[0013] Document 1:AN IMAGE IS WORTH 16X16 WORDS:TRANSFORMERS FOR IMAGE RECOGNITION AT SCALE,https: / / openreview.net / forum?id=YicbFdNTTy

[0014] In the following description, an image to which adversarial perturbations have been added to an evaluation image will be referred to as an "adversarial image," and an image to which no adversarial perturbations have been added (the evaluation image itself) will be referred to as a "normal image."

[0015] First, an overview of the evaluation device 10 of this embodiment will be described with reference to Fig. 1A. The evaluation device 10 evaluates the degree of difference between the Accuracy-Robustness trade-off relationship of a CNN model trained by an adversarial learning method to be evaluated and the Accuracy-Robustness trade-off relationship of a CNN model trained by a conventional adversarial learning method.

[0016] The evaluation result DB (database) 121 of the existing method is a DB that stores information (evaluation results of the existing method) that shows, in two-dimensional coordinates, the evaluation results of the classification accuracy for adversarial images and the evaluation results of the classification accuracy for normal images, using a CNN model trained by an existing adversarial learning method (existing method).

[0017] The evaluation target model storage unit 122 stores information about a CNN model (evaluation target model) trained by an adversarial learning method (learning method) to be evaluated. For example, the evaluation target model storage unit 122 stores image classification parameters used by the evaluation target model. The evaluation image storage unit 123 stores evaluation images and correct labels for the evaluation images.

[0018] First, the evaluation function calculation unit (function calculation unit) 131 of the evaluation device 10 acquires the evaluation results of the existing methods from the evaluation result DB (database) 121. Then, based on the evaluation results of the existing methods, the evaluation function calculation unit 131 calculates a function (evaluation function) that indicates the Accuracy-Robustness trade-off relationship of the CNN model trained by the existing methods.

[0019] Next, the image generation unit 132 generates an adversarial image for the model to be evaluated using the evaluation image and the correct label acquired from the evaluation image storage unit 123. Then, the first image classification unit (first evaluation unit) 133 performs image classification on the generated adversarial image using the model to be evaluated. Thereafter, the first image classification unit 133 evaluates the classification accuracy of the model to be evaluated for the adversarial image by comparing the result of the image classification with the correct label of the evaluation image. Then, the first image classification unit 133 outputs the evaluation result (adversarial evaluation).

[0020] Furthermore, the second image classification unit (second evaluation unit) 134 performs image classification using the evaluation target model on the evaluation image (normal image) acquired from the evaluation image storage unit 123. The second image classification unit 134 then compares the image classification result with the correct label of the evaluation image to evaluate the classification accuracy of the evaluation target model for the normal image. The second image classification unit 134 then outputs the evaluation result (normal evaluation).

[0021] Then, the distance calculation unit 135 calculates the distance between the normal evaluation and the adversarial evaluation of the model to be evaluated and the evaluation function calculated by the evaluation function calculation unit 131. Then, the distance output unit 136 outputs the calculated distance as the evaluation result of the learning method to be evaluated.

[0022] In this way, the evaluation device 10 can evaluate the degree of difference between the Accuracy-Robustness trade-off relationship of the CNN model trained by the learning method to be evaluated and the Accuracy-Robustness trade-off relationship of a CNN model trained by a conventional learning method.

[0023] This allows the evaluation device 10 to estimate, for example, how much the Accuracy-Robustness trade-off relationship learned by the learning method to be evaluated is alleviated compared to the Accuracy-Robustness trade-off relationship of a CNN model learned by a conventional learning method.

[0024] [Configuration example] 1B, a configuration example of the evaluation device 10 will be described. The evaluation device 10 includes, for example, an input / output unit 11, a storage unit 12, and a control unit 13.

[0025] The input / output unit 11 is an interface that controls the input and output of various data. The input / output unit 11 receives inputs such as image discrimination parameters of a CNN model trained by a learning method to be evaluated. The input / output unit 11 also outputs evaluation results of the CNN model trained by the learning method to be evaluated.

[0026] The storage unit 12 stores data, programs, etc. that are referenced when the control unit 13 executes various processes. The storage unit 12 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. For example, the storage unit 12 includes an evaluation result DB 121 of existing methods, an evaluation target model storage unit 122, and an evaluation image storage unit 123.

[0027] The evaluation result DB121 of the existing method is a DB that stores the evaluation results of the existing method (information showing the evaluation results of the classification accuracy for adversarial images and the evaluation results of the classification accuracy for normal images using a CNN model trained by an existing learning method).

[0028] The evaluation target model storage unit 122 stores information about the CNN model (evaluation target model) trained by the training method to be evaluated. For example, the evaluation target model storage unit 122 stores model parameters (image discrimination parameters) used by the evaluation target model. The evaluation image storage unit 123 stores evaluation images and their correct answer labels.

[0029] The control unit 13 controls the entire evaluation device 10. The functions of the control unit 13 are realized by, for example, a CPU (Central Processing Unit) executing a program stored in the storage unit 12.

[0030] The control unit 13 includes, for example, an evaluation function calculation unit 131, an image generation unit 132, a first image discrimination unit 133, a second image discrimination unit 134, a distance calculation unit 135, and a distance output unit 136.

[0031] The evaluation function calculation unit 131 calculates a function (evaluation function) that indicates the trade-off relationship between the classification accuracy for perturbed images and the classification accuracy for normal images of a CNN model trained by an existing learning method, based on the evaluation results of the classification accuracy for perturbed images and the evaluation results of the classification accuracy for normal images (evaluation results of the existing method).

[0032] For example, the evaluation function calculation unit 131 selects a plurality of data points that form pairs of evaluation results of classification accuracy for normal images and evaluation results of classification accuracy for adversarial images of a CNN model trained by an existing learning method from the existing method evaluation result DB 121. Then, the evaluation function calculation unit 131 calculates a function that passes through the selected plurality of data points.

[0033] The image generation unit 132 generates an adversarial image for the model to be evaluated, using the evaluation image acquired from the evaluation image storage unit 123 and the correct answer label of the evaluation image.

[0034] The first image classification unit 133 evaluates the classification accuracy of the evaluation target model for the adversarial image. For example, first, the first image classification unit 133 performs image classification using the evaluation target model for the adversarial image generated by the image generation unit 132. Next, the first image classification unit 133 evaluates the classification accuracy of the evaluation target model for the adversarial image by comparing the image classification result with the correct answer label of the evaluation image used to generate the adversarial image. Then, the first image classification unit 133 outputs the evaluation result of the classification accuracy (adversarial evaluation).

[0035] The second image classification unit 134 evaluates the classification accuracy of the evaluation target model for normal images. For example, first, the second image classification unit 134 performs image classification using the evaluation target model for evaluation images (normal images) acquired from the evaluation image storage unit 123. Next, the second image classification unit 134 evaluates the classification accuracy of the evaluation target model for normal images by comparing the image classification results with the correct answer label of the evaluation image. Then, the second image classification unit 134 outputs the evaluation result of the classification accuracy (normal evaluation).

[0036] The distance calculation unit 135 calculates the distance between the coordinates indicated by the normal evaluation of the model to be evaluated output by the first image classification unit 133 and the adversarial evaluation of the model to be evaluated output by the second image classification unit 134, and the evaluation function calculated by the evaluation function calculation unit 131. Then, the distance output unit 136 outputs the calculated distance as the evaluation result.

[0037] [Example of processing procedure] Next, an example of a processing procedure executed by the evaluation device 10 will be described with reference to Fig. 2. First, the evaluation device 10 outputs the evaluation results of the existing methods stored in the evaluation result DB 121 of the existing methods to the evaluation function calculation unit 131 (S1). Based on the evaluation results of the existing methods output in S1, the evaluation function calculation unit 131 calculates an evaluation function of the existing methods (a function indicating the Accuracy-Robustness trade-off relationship of the CNN model trained by the existing methods), and outputs it to the distance calculation unit 135 (S2).

[0038] In addition, the image generation unit 132 acquires an evaluation image from the evaluation image storage unit 123, generates an adversarial perturbation for the acquired evaluation image, and superimposes it on the evaluation image to generate an adversarial image, which is output to the first image classification unit 133 (S3).

[0039] The second image classification unit 134 performs classification using image classification parameters (image classification parameters of the model to be evaluated) with the evaluation image as input (S4). Then, the second image classification unit 134 evaluates and outputs the classification accuracy of the model to be evaluated for the normal image based on the classification result and the correct label of the evaluation image.

[0040] Furthermore, the first image classification unit 133 performs classification using the image classification parameters on the adversarial image output from the image generation unit 132 in S3 (S5). Then, the first image classification unit 133 evaluates and outputs the classification accuracy of the evaluation target model for the adversarial image based on the classification result and the correct answer label of the evaluation image used to generate the adversarial image.

[0041] Thereafter, distance calculation unit 135 calculates the distance between the classification accuracy output from second image classification unit 134 and first image classification unit 133 and the evaluation function output in S2 (S6). Then, distance output unit 136 outputs the distance calculated in S6 as the evaluation result (S7).

[0042] [Evaluation function calculation section] Next, a detailed description will be given of each process shown in Fig. 2. First, a specific example of the processes S1 and S2 in Fig. 2 (processes executed by the evaluation function calculation unit 131) will be given using Fig. 3.

[0043] The evaluation function calculation unit 131 acquires the evaluation result of the existing method from the evaluation result DB 121 of the existing method (S101). Note that this evaluation result is assumed to be, for example, coordinates in which the evaluation result of the classification accuracy for the normal image and the evaluation result of the classification accuracy for the adversarial image are paired, but may be other coordinates.

[0044] Next, the evaluation function calculation unit 131 selects n (n≧2) data points from the evaluation results acquired in S101 (S102). Then, the evaluation function calculation unit 131 calculates a function that passes through the selected n data points (S103). For example, the evaluation function calculation unit 131 obtains a function (n-1 order function) that passes through the n data points using simultaneous equations. Note that functions other than n-1 order functions, such as trigonometric functions, may be used as long as they can appropriately express the accuracy-robustness trade-off relationship of a CNN model trained by an existing method.

[0045] After S103, the evaluation function calculation unit 131 outputs the function calculated in S103 to the distance calculation unit 135 as an evaluation function (S104).

[0046] In this way, the evaluation function calculation unit 131 can output to the distance calculation unit 135 a function that indicates the accuracy-robustness trade-off relationship of the CNN model trained by the existing method.

[0047] [Image generation section] Next, a specific example of the process of S3 in FIG. 2 (the process executed by the image generating unit 132) will be described with reference to FIG.

[0048] First, the image generation unit 132 acquires an evaluation target model (image discrimination parameters of the evaluation target model) from the evaluation target model storage unit 122 (S201). In addition, the image generation unit 132 acquires an evaluation image and a correct label from the evaluation image storage unit 123 (S202).

[0049] After S202, the image generation unit 132 generates an adversarial perturbation based on the correct label and evaluation image obtained in S202 and the evaluation target model obtained in S201 (S203: Generate an adversarial perturbation based on the correct label, evaluation image, and evaluation target model).

[0050] This method of generating adversarial perturbations is assumed to be based on adversarial attack methods such as AutoAttack (see Reference 2), but it may also be based on other attack methods such as PGD (see Non-Patent Document 1).

[0051] Reference 2: F. Croce, M. Hein, “Reliable Evaluation of Adversarial Robustness with an Ensemble of Diverse Parameter-free Attacks”, 2020

[0052] After S203, the image generation unit 132 generates an adversarial image by superimposing the adversarial perturbation generated in S203 on the evaluation image. Then, the image generation unit 132 outputs the generated adversarial image together with the correct label of the evaluation image used to generate the adversarial image (S204: superimpose the adversarial perturbation on the evaluation image and output it as an adversarial image together with the correct label).

[0053] In this way, the image generation unit 132 can generate an adversarial image for the CNN model to be evaluated.

[0054] [Second image identification section] Next, a specific example of the process of S4 in FIG. 2 (the process executed by the second image identification unit 134) will be described with reference to FIG.

[0055] First, the second image classification unit 134 acquires an evaluation target model from the evaluation target model storage unit 122 (S301). The second image classification unit 134 also acquires an evaluation image and a correct label from the evaluation image storage unit 123 (S302).

[0056] After S302, the second image classification unit 134 performs image classification on the evaluation image acquired in S302 based on the image classification parameters (the image classification parameters of the evaluation target model acquired in S301) (S303).

[0057] After S303, the second image classification unit 134 calculates and outputs the classification accuracy of the evaluation image by comparing the correct label of the evaluation image acquired in S302 with the result of the image classification performed in S303 (S304).

[0058] In this way, the second image classification unit 134 can output the evaluation result of the classification accuracy for the evaluation image (normal image) of the CNN model to be evaluated.

[0059] [First image identification unit] Next, a specific example of the process of S5 in FIG. 2 (the process executed by the first image identification unit 133) will be described with reference to FIG.

[0060] First, the first image classification unit 133 acquires an evaluation target model from the evaluation target model storage unit 122 (S401). In addition, the first image classification unit 133 acquires an adversarial image generated by the image generation unit 132 (S402).

[0061] After S402, the first image classification unit 133 performs image classification on the adversarial image acquired in S402 based on the image classification parameters of the evaluation target model acquired in S401 (S403).

[0062] After S403, the first image classification unit 133 calculates and outputs the classification accuracy of the adversarial image by comparing the correct label (the correct label of the evaluation target image used to generate the adversarial image) with the result of the image classification in S403 (S404).

[0063] In this way, the first image classification unit 133 can output the evaluation result of the classification accuracy of the CNN model to be evaluated for the adversarial image.

[0064] [Distance calculation section, distance output section] Finally, a specific example of the processes in S6 and S7 in FIG. 2 (the processes executed by distance calculation unit 135 and distance output unit 136) will be described with reference to FIG.

[0065] First, the distance calculation unit 135 acquires an evaluation function from the evaluation function calculation unit 131 (S501). In addition, the distance calculation unit 135 acquires an adversarial evaluation (classification accuracy of an adversarial image) from the first image classification unit 133 (S502). In addition, the distance calculation unit 135 acquires a normal evaluation (classification accuracy of an evaluation image) from the second image classification unit 134 (S503).

[0066] Thereafter, the distance calculation unit 135 calculates the distance between the coordinate point composed of the above-mentioned normal evaluation and adversarial evaluation and the evaluation function (S504). For example, the distance calculation unit 135 calculates the distance of a normal line drawn from the above-mentioned coordinate point to the evaluation function. Note that the distance calculation unit 135 may calculate the smallest distance among the distances between the above-mentioned coordinate point and an appropriately selected point on the evaluation function. Thereafter, the distance output unit 136 outputs the distance calculated in S504 as the evaluation result (S505).

[0067] In this way, the distance calculation unit 135 can calculate and output the degree of difference between the Accuracy-Robustness trade-off relationship of the CNN model trained by the learning method to be evaluated and the Accuracy-Robustness trade-off relationship of a CNN model trained by a conventional learning method.

[0068] [Other embodiments] In the above embodiment, the perturbation applied to the evaluation image by the evaluation device 10 is an adversarial perturbation, but the present invention is not limited to this. For example, the perturbation applied to the evaluation image by the evaluation device 10 may be noise, blur, or the like, which may exist more generally.

[0069] In this case, the image generation unit 132 of the evaluation device 10 executes, for example, the process shown in FIG. 8. First, the image generation unit 132 acquires an evaluation image and a correct label from the evaluation image storage unit 123 (S601). Then, the image generation unit 132 generates a perturbation based on the size of the evaluation image acquired in S601, etc. (S602). For example, the image generation unit 132 generates a perturbation by independently generating Gaussian noise in an array that matches the image size of the evaluation image. Note that the perturbation may be any perturbation other than those described above, as long as it reduces the classification accuracy of the CNN model.

[0070] Then, the image generation unit 132 generates a perturbed image by superimposing the perturbation generated in S602 on the evaluation image, and outputs the generated perturbed image together with a correct label (the correct label of the evaluation image) (S603: Superimpose the perturbation on the evaluation image and output it as a perturbed image together with the correct label).

[0071] Furthermore, the evaluation device 10 evaluates the degree of difference between the Accuracy-Robustness trade-off relationship of the CNN model trained by the learning method to be evaluated and the Accuracy-Robustness trade-off relationship of the CNN model trained by a conventional learning method, but is not limited to this.

[0072] For example, the evaluation device 10 may evaluate the learning method to be evaluated by taking into consideration the positional relationship on a two-dimensional plane between coordinates indicating the Accuracy-Robustness trade-off relationship of the CNN model trained by the learning method to be evaluated (coordinates indicating the classification accuracy for adversarial images and the classification accuracy for normal images) and a function (evaluation function) indicating the Accuracy-Robustness trade-off relationship of the CNN model trained by a conventional learning method.

[0073] [System configuration, etc.] Furthermore, the components of each unit shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program executed by the CPU, or can be realized as hardware using wired logic.

[0074] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0075] [program] The evaluation device 10 can be implemented by installing a program (evaluation program) as package software or online software on a desired computer. For example, by executing the program on an information processing device, the information processing device can function as the evaluation device 10. The information processing device referred to here includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as terminals such as PDAs (Personal Digital Assistants).

[0076] 9 is a diagram showing an example of a computer that executes an evaluation program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0077] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0078] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes executed by the evaluation device 10 are implemented as program modules 1093 in which computer-executable codes are written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configuration of the evaluation device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0079] Data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as needed and executes them.

[0080] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN (Local Area Network) or WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0081] The following additional notes are provided regarding the above-described embodiments.

[0082] (Additional note 1) Memory and at least one processor coupled to said memory; Including, The processor: A step of calculating a function indicating a trade-off relationship between the accuracy of an image processing model trained by an existing adversarial learning method for a perturbed image, which is an image to which perturbation has been added, and the accuracy of the image processing model for a normal image, which is an image to which no perturbation has been added; A step of evaluating the accuracy of the image processing model trained by the adversarial learning method to be evaluated for the image to which perturbations are added; assessing the accuracy of the image processing model with respect to the unperturbed image; calculating a distance between the function and coordinates indicating the accuracy evaluation results for the perturbed image and the accuracy evaluation results for the unperturbed image of the image processing model; and outputting the calculated distance. Evaluation equipment.

[0083] (Additional note 2) A computer-readable non-transitory storage medium storing an evaluation program that causes a computer to execute the following processes: The process comprises: A step of calculating a function indicating a trade-off relationship between the accuracy of an image processing model trained by an existing adversarial learning method for a perturbed image, which is an image to which perturbation has been added, and the accuracy of the image processing model for a normal image, which is an image to which no perturbation has been added; A step of evaluating the accuracy of the image processing model trained by the adversarial learning method to be evaluated for the image to which perturbations are added; assessing the accuracy of the image processing model with respect to the unperturbed image; calculating a distance between the function and coordinates indicating the accuracy evaluation results for the perturbed image and the accuracy evaluation results for the unperturbed image of the image processing model; and outputting the calculated distance. Non-transitory storage medium. [Explanation of symbols]

[0084] 10 Evaluation equipment 11 Input / output section 12 Storage section 13 Control Unit 121 Evaluation results database of existing methods 122 Evaluation target model storage unit 123 Evaluation image storage unit 131 Evaluation function calculation unit (function calculation unit) 132 Image Generation Unit 133 First image identification unit (first evaluation unit) 134 Second image identification unit (second evaluation unit) 135 Distance calculation unit 136 Distance output unit

Claims

1. a function calculation unit that calculates a function indicating a trade-off relationship between the accuracy of an image processing model trained by an existing adversarial learning method for a perturbed image, which is an image to which perturbation has been added, and the accuracy of the image processing model for a normal image, which is an image to which no perturbation has been added; and a first evaluation unit that evaluates the accuracy of an image processing model trained by an adversarial learning method to be evaluated for an image to which perturbations have been added; a second evaluation unit that evaluates the accuracy of the image processing model with respect to the unperturbed image; a distance calculation unit that calculates a distance between the function and coordinates indicating an evaluation result of accuracy of the image to which the perturbation has been applied and an evaluation result of accuracy of the image to which the perturbation has not been applied, of the image processing model; a distance output unit that outputs the calculated distance; An evaluation device comprising:

2. The accuracy is the accuracy of image identification of the image processing model.

2. The evaluation device according to claim 1.

3. The image processing model further includes an image generation unit that generates a perturbation for the image processing model trained by the adversarial learning method to be evaluated, and generates an image to which the generated perturbation is added.

2. The evaluation device according to claim 1.

4. an image generation unit that generates an adversarial perturbation for the image processing model based on an evaluation image and a correct answer label of the evaluation image, and generates an image by adding the adversarial perturbation to the evaluation image; The first evaluation unit Evaluating the accuracy of the image processing model trained by the adversarial learning method to be evaluated for the image to which the adversarial perturbation has been added; The second evaluation unit Evaluating the accuracy of the image processing model for the evaluation image; The distance output unit Calculating the distance between the function and coordinates indicating the evaluation result of the accuracy of the image processing model for the image to which the adversarial perturbation has been applied and the evaluation result of the accuracy of the evaluation image 2. The evaluation device according to claim 1.

5. The function calculation unit A plurality of data points are selected that indicate the accuracy of an image processing model trained by an existing adversarial learning method for the perturbed image and the accuracy for the normal image, and a function that passes through the plurality of selected data points is calculated as a function that indicates the trade-off relationship.

2. The evaluation device according to claim 1.

6. An evaluation method performed by an evaluation device, comprising: A step of calculating a function indicating a trade-off relationship between the accuracy of an image processing model trained by an existing adversarial learning method for a perturbed image, which is an image to which perturbation has been added, and the accuracy of the image processing model for a normal image, which is an image to which no perturbation has been added; A step of evaluating the accuracy of the image processing model trained by the adversarial learning method to be evaluated for the image to which perturbations are added; assessing the accuracy of the image processing model with respect to the unperturbed image; calculating a distance between the function and coordinates indicating the accuracy evaluation results for the perturbed image and the accuracy evaluation results for the unperturbed image of the image processing model; outputting the calculated distance; An evaluation method comprising:

7. A step of calculating a function indicating a trade-off relationship between the accuracy of an image processing model trained by an existing adversarial learning method for a perturbed image, which is an image to which perturbation has been added, and the accuracy of the image processing model for a normal image, which is an image to which no perturbation has been added; A step of evaluating the accuracy of the image processing model trained by the adversarial learning method to be evaluated for the image to which perturbations are added; assessing the accuracy of the image processing model with respect to the unperturbed image; calculating a distance between the function and coordinates indicating the accuracy evaluation results for the perturbed image and the accuracy evaluation results for the unperturbed image of the image processing model; outputting the calculated distance; An evaluation program for running the above on a computer.

Images