Learning device, learning method, learning program, inference device, inference method, and inference program

Abstract

A calculating unit (131) inputs hostile-attacked data, obtained by subjecting input data to a pseudo-hostile attack, into a model, and calculates a score for each of a plurality of labels. An updating unit (133) updates a parameter of the model such that, for a certain proportion of the input data having a large difference between a maximum value of an incorrect answer score calculated by the calculating unit (131) for incorrect answer labels, which are labels other than correct answer labels, being labels associated in advance with the input data, from among the plurality of labels, and a correct answer score calculated by the calculating unit (131) for the correct answer labels, a one-to-other loss, which is a loss between the correct answer score and the incorrect answer score, is reduced.

Description

[Technical Field]

[0001] The present invention relates to a learning device, a learning method, a learning program, an inference device, an inference method, and an inference program. [Background technology]

[0002] Deep learning and deep neural networks have achieved great success in areas such as image recognition and speech recognition. For example, in image recognition using deep learning, an image is input into a deep learning model that includes numerous nonlinear functions, and it outputs a classification result indicating what the image depicts. In particular, convolutional neural networks and ReLU (Rectified Linear Unit) are frequently used techniques in image recognition.

[0003] However, if a malicious attacker adds optimal noise to the input images of a model, even small amounts of noise can easily cause deep learning to misclassify. This is called an adversarial attack, and methods such as PGD (Projected Gradient Descent) have been reported.

[0004] Furthermore, as a method to make models robust against adversarial attacks, a method called adversarial learning has been proposed, which involves learning using samples that have been subjected to adversarial attacks (see, for example, Non-Patent Document 1). In addition, a method called TRADES has been proposed as a robust learning method similar to adversarial learning (see, for example, Non-Patent Document 2). [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu ,"Towards deep learning models resistant to adversarial attacks", arXiv preprint:1706.06083(2017). [Non-Patent Document 2] Zhang, Hongyang, et al. ,"Theoretically principled trade-off between robustness and accuracy.",International conference on machine learning". ICML 2019. [Overview of the Initiative] [Problems that the invention aims to solve]

[0006] However, conventional technologies have a problem in that the models may not be robust enough against adversarial attacks. [Means for solving the problem]

[0007] To solve the above-mentioned problems and achieve the objective, the learning device is characterized by comprising: a calculation unit that inputs adversarial attack data, which is data obtained by simulating an adversarial attack on input data, into a model and calculates a score for each of a plurality of labels; and an update unit that updates the parameters of the model so as to reduce the one-to-other loss, which is the loss between the correct score and the incorrect score, for a certain percentage of the input data where the difference between the maximum incorrect score calculated by the calculation unit for incorrect labels (labels other than the correct labels which are labels that have been substituted into the model, and input data obtained by simulating an adversarial attack on input data, and calculates a score for each of a plurality of labels; and an update unit that updates the parameters of the model so as to reduce the one-to-other loss, which is the loss between the correct score and the incorrect score, for a certain percentage of the input data where the difference between the maximum incorrect score calculated by the calculation unit for incorrect labels (labels that are labels that are labels that are labels that are labels that are labels that are labels that are labels that are labels that are labels that are labels that are labels that are labels that have been substituted into the model, and input data obtained by simulating an adversarial attack on input data, and calculates a score for each of a plurality of labels; and an update unit that updates the parameters of the model [Effects of the Invention]

[0008] According to the present invention, the robustness of the model against adversarial attacks can be improved.

Brief Description of Drawings

[0009] [Figure 1] FIG. 1 is a diagram for explaining the configuration of the model. [Figure 2] FIG. 2 is a diagram for explaining the configuration of the final layer of the model. [Figure 3] FIG. 3 is a diagram showing a configuration example of a learning device according to the first embodiment. [Figure 4] FIG. 4 is a flowchart showing the flow of learning processing according to the first embodiment. [Figure 5] FIG. 5 is a flowchart showing the flow of processing for creating a loss function. [Figure 6] FIG. 6 is a diagram showing an example of a computer that executes a learning program.

Modes for Carrying Out the Invention

[0010] Hereinafter, embodiments of a learning device, a learning method, a learning program, an inference device, an inference method, and an inference program according to the present application will be described in detail based on the drawings. Note that the present invention is not limited to the embodiments described below.

[0011] [First Embodiment] The learning device of the embodiment performs learning (training) of a deep learning model (hereinafter simply referred to as a model). First, the configuration of the model will be described using FIG. 1. The deep learning model may be paraphrased as a deep neural network.

[0012] As shown in FIG. 1, the model includes an input layer into which a signal is input, one or more intermediate layers that variously transform the signal from the input layer, and a final layer that transforms the signal of the intermediate layer into an output such as a probability. In the example of FIG. 1, the number of intermediate layers is L (where L ≧ 1).

[0013] As shown in Figure 2, in the final layer, the output of the last hidden layer (the Lth hidden layer in the example in Figure 1) is input to the softmax function to obtain the output. The output of the softmax function corresponds to the output of the entire model.

[0014] The configuration of the learning device will be explained using Figure 3. Figure 3 is a diagram showing an example of the configuration of the learning device according to the first embodiment.

[0015] As shown in Figure 3, the learning device 10 includes a communication unit 11, a storage unit 12, and a control unit 13.

[0016] The communication unit 11 performs data communication with other devices. For example, the communication unit 11 is a NIC (Network Interface Card). Alternatively, the communication unit 11 may be an interface for inputting and outputting data with input devices (e.g., a mouse and keyboard) and output devices (e.g., a display).

[0017] The storage unit 12 is a storage device such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or optical disc. Alternatively, the storage unit 12 may be a rewritable semiconductor memory such as RAM (Random Access Memory), flash memory, or NVSRAM (Non-Volatile Static Random Access Memory). The storage unit 12 stores the OS (Operating System) and various programs executed by the learning device 10.

[0018] The memory unit 12 stores model information 121. Model information 121 consists of parameters for constructing a model. For example, model information 121 includes weights and biases of a deep neural network. Model information 121 is also updated through learning.

[0019] The control unit 13 controls the entire learning device 10. For example, the control unit 13 is implemented by an electronic circuit or integrated circuit such as a CPU (Central Processing Unit), MPU (Micro Processing Unit), GPU (Graphics Processing Unit), ASIC (Application Specific Integrated Circuit), or FPGA (Field Programmable Gate Array).

[0020] Furthermore, the control unit 13 has internal memory for storing programs and control data that define various processing procedures, and executes each process using the internal memory. In addition, the control unit 13 functions as various processing units when various programs are run. For example, the control unit 13 has a calculation unit 131, a creation unit 132, and an update unit 133.

[0021] The calculation unit 131 applies (inputs) the input data to the model from among the input data and labels selected from a pre-prepared dataset (training dataset). As a result, the calculation unit 131 calculates the output data corresponding to the input data. The model is constructed based on the model information 121.

[0022] In the dataset, input data and labels are assumed to be associated. Furthermore, the term "model" may be replaced with "discriminator" or "classifier" as appropriate.

[0023] When a model is used for image recognition, the input data consists of features extracted from an image. Labels, on the other hand, identify objects in the image. For example, the score output by the model might represent the probability that an object corresponding to each label is present in the image.

[0024] The creation unit 132 creates a loss function based on the model's output data. For example, the creation unit 132 creates a loss function that becomes smaller as the model's output data matches the labels corresponding to the input data (the greater the similarity).

[0025] The update unit 133 updates the model parameters, i.e., the model information 121, so that the loss function is optimized (e.g., minimized).

[0026] By repeating this series of processes, the model's recognition accuracy improves. The learning device 10 terminates the learning process when the evaluation criteria are met. The evaluation criteria include the model's recognition accuracy on a separately prepared evaluation dataset exceeding a threshold, the convergence of the parameter update rate, and the repetition of parameter updates a certain number of times.

[0027] Furthermore, in this embodiment, the learning device 10 performs adversarial learning. In adversarial learning, a loss function different from that of general learning is created. The adversarial learning in this embodiment will be described below.

[0028] In the following formulas, uppercase bold letters represent matrices, and lowercase bold letters represent column vectors. Row vectors are expressed using transpose.

[0029] Here, we will explain using the example of a model used for image recognition, but this embodiment is not limited to image recognition and can be generally applied to classification using deep learning.

[0030] In deep learning, input data x∈R d Consider the problem of recognizing M labels and finding the image label y ∈ {1, ..., M} from those M labels. Here, d is the dimension of the input data, and although it is written as a vector for simplicity, the data structure is not specified. Also, for example, the input data x is data that represents the features of the image.

[0031] In this process, the deep learning model repeatedly uses nonlinear functions and linear operations, and outputs the data through the softmax function in the final layer.

[0032] Now, the vector that is transformed by the model and ultimately input to the softmax (corresponding to the output of the Lth layer in Figure 1) is z θ (x) = [z1,θ (x), z 2,θ (x), …, z M,θ (x)] T Let it be so. θ is a parameter of the deep learning model, that is, the model information 121. Also, z θ (x) is called a logit.

[0033] Let the softmax function be f s (·). Then the output of the model is the output of softmax, f s (z θ (x)) ∈ R M and the k-th output is represented by Equation (1).

[0034]

Equation

[0035] The output of Equation (1) represents the score for each label in class classification, and the element of the largest output obtained by Equation (2) is the recognition result of deep learning.

[0036]

Equation

[0037] However, since softmax maintains the magnitude relationship, the result remains the same as Equation (2) even if it is in the form of Equation (3).

[0038]

Equation

[0039] Image recognition is one of class classifications, and the model f s (z θ (·)) is called a classifier.

[0040] The parameter θ is learned from N previously prepared data sets {(x i , y i ))}(i = 1, …, N).

[0041] In normal learning, y i =arg max k z k,θ A loss function l(x,y,θ) is set such that it is small enough to be correctly recognized as (x), and θ is found by optimizing equation (4). Note that this loss function is cross-entropy.

[0042]

number

[0043] On the other hand, in adversarial learning, an adversarial attack is first performed on each input data. That is, an adversarial attack-treated data set x' = x + δ is created, in which a pseudo-adversarial attack has been performed. δ is noise caused by the attack, and its norm and other properties are constrained. The method for creating the adversarial attack-treated data set x' is not limited to the method described here.

[0044] In adversarial learning, θ is obtained by optimizing equation (5) using the adversarial attack data x'.

[0045]

number

[0046] Based on the explanations above, we will now describe how to create the loss function using the creation unit 132.

[0047] Since the model classifies the data based on the magnitude of the logit in equation (3), the logit margin loss in equation (6) LM The (·) is thought to represent the difficulty in classifying the data (x,y).

[0048]

number

[0049] However, z k,θ (x) is the logit zθ It is the k-th element of (x).

[0050] Furthermore, assuming appropriate smoothness in the model, l LM The larger (x,y,θ) is in the negative direction, the more robust the model is to adversarially attacked data x'. Therefore, in order to expand the difference shown in equation (6) and improve robustness, that is, to make the model more robust, the creation unit 132 calculates the one-versus-the-rest loss as shown in equation (7). OVR We create a loss function using this method.

[0051]

number

[0052] Here, φ is a non-negative convex function that is differentiable, and for z > 0, φ(z) < φ(-z). Here, φ(z) = log(1 + e -z Let (the second term on the right side of equation (8)) be used. In that case, let l in equation (7) OVR This can be expressed as shown in equation (8).

[0053]

number

[0054] The creation unit 132 selects the logit margin loss against adversarial attacks from the data included in the dataset (pairs of input data and labels). LM Apply the top H% data samples with large values ​​of (x') to the adversarial attack. However, 0 <H<100であるものとする。

[0055] A data sample is a pair of adversarial attack data x', which is data from an attack on input data included in the dataset, and a label y that corresponds to the input data. There are multiple data samples. From this, the creation unit 132 creates the loss function of equation (9). Note that the first term in the brackets on the right side of equation (9) is the cross-entropy, and the second term is the one-to-other loss related to the adversarial attack.

[0056]

number

[0057] S is l LM This is the set of the bottom (100-H) percent of data samples where (x') has a small value. L is l LM (x') is the set of data samples from the top H% with large values. λ is an adjustment parameter that determines the loss weights.

[0058] For example, consider the case where the number of data samples is 100 and H is 20. The creation unit 132 creates 100 data samples l LM The data is sorted in descending order of (x'). Then, the creation unit 132 takes the first 20 data samples from the sorted data and adds them to set L. The creation unit 132 also takes the 21st to 100th data samples from the sorted data and adds them to set S.

[0059] In equation (9), the loss of the set S is defined as cross-entropy, but it is not limited to this and other losses may be used.

[0060] Furthermore, when using optimization methods that utilize a portion of the data (mini-batch), such as Stochastic gradient descent (SGD), the l within the mini-batch LM Based on the size of (·), one-to-other loss is applied to the top H% of data samples for optimization.

[0061] The update unit 133 updates the model parameters so that equation (9) is optimized (minimized).

[0062] (A combination of trades and one-to-other losses) In TRADES, described in Non-Patent Document 2, θ is similarly determined by optimizing equation (10) using the data x' that has already been subjected to adversarial attacks.

[0063]

number

[0064] l CE is the cross-entropy loss. Also, KL is the KL divergence.

[0065] If TRADES generates data indicating that a hostile attack has occurred, the creation unit 132 generates the loss function of equation (11).

[0066]

number

[0067] The third term in the brackets on the right-hand side of equation (11) is pθ(k|x i )=pθ(k|x i It differs from the KL divergence in equation (10) in that it does not equal +δ)0 (although it is the minimum). Therefore, β in equation (11) is different from β in TRADES in equation (10).

[0068] [Processing according to the first embodiment] The processing flow of the learning device 10 will be explained using Figure 4. Figure 4 is a flowchart of the learning process according to the first embodiment.

[0069] First, as shown in Figure 4, the learning device 10 prints randomly selected input data from the dataset onto the classifier (step S11). The classifier is an example of a model constructed from model information 121. The input data printed onto the classifier may be data that has been subjected to adversarial attacks.

[0070] Next, the learning device 10 creates a loss function for adversarial attacks, including one-to-other loss, based on the output of the classifier and the labels included in the dataset (step S12). Details of the process for creating the loss function will be described later.

[0071] Then, the learning device 10 updates the classifier parameters using the gradient of the loss function (step S13). The learning device 10 can update the parameters using known methods such as backpropagation.

[0072] If the evaluation criteria are met (step S14, Yes), the learning device 10 terminates the process. On the other hand, if the evaluation criteria are not met (step S14, No), the learning device 10 returns to step S11 and repeats the process.

[0073] Figure 5 illustrates the process of creating the loss function (step S12 in Figure 4). Figure 5 is a flowchart showing the process of creating the loss function.

[0074] As shown in Figure 5, first, the learning device 10 randomly selects several data samples from the data samples printed on the classifier (step S121).

[0075] Next, the learning device 10 creates an adversarial attack on the selected data samples (step S122). The learning device 10 may create an adversarial attack such as x' = x + δ, or it may create an adversarial attack using TRADES.

[0076] Next, the learning device 10 calculates the one-to-other loss for the generated attack (step S123). Here, the learning device 10 creates a set L of data samples with H% of the one-to-other loss in descending order of one-to-other loss, and the remaining set S (step S124).

[0077] Then, the learning device 10 calculates the one-to-other loss for an attack on set L, applies cross-entropy to the other sets S, and creates a loss function by summing the one-to-other loss and the cross-entropy (step S125). The loss function created here is as shown in equation (9).

[0078] As explained above, the calculation unit 131 inputs the simulated adversarial attack data into the model and calculates a score for each of the multiple labels. Note that the scores here include not only the output from softmax but also logit values ​​that share a common magnitude relationship with the output from softmax. The simulated adversarial attack data is, for example, x' = x + δ.

[0079] The update unit 133 updates the model parameters so that the one-to-other loss, which is the loss between the correct score and the incorrect score, is small for a certain percentage of input data where the difference between the maximum incorrect score calculated by the calculation unit 131 for incorrect labels (labels other than the correct labels that are pre-associated with the input data) and the correct score calculated by the calculation unit 131 for the correct labels is large.

[0080] The difference between the maximum incorrect score calculated by the calculation unit 131 for incorrect labels and the correct score calculated by the calculation unit 131 for correct labels is, for example, as shown in equation (6). The constant percentage is, for example, H%. The one-to-other loss for data that has been subjected to adversarial attacks is, for example, as shown in equations (7) and (8).

[0081] In this way, applying one-to-other loss to adversarial attacks can improve the robustness of the model against adversarial attacks.

[0082] The update unit 133 updates the model parameters so that the loss function, which is the sum of the one-to-other loss when adversarial attack data is input to the model and the KL divergence when adversarial attack data is input to the model, becomes smaller. In this case, the loss function is as shown in equation (10), for example.

[0083] In this way, it is possible to optimize both conventional losses, such as KL divergence, and one-to-other losses simultaneously.

[0084] The update unit 133 updates the model parameters so that the loss function, which is the sum of the one-to-other loss when the model is input with adversarial attack data, the one-to-other loss when the model is input with input data, and the KL divergence when the model is input with input data, becomes smaller. In this case, the loss function is as shown in equation (11), for example.

[0085] Thus, this embodiment can also be applied to TRADES.

[0086] (Regarding the inference device) The inference device performs the same processing as the calculation unit 131 using the model information 121 updated by the learning device 10. The inference device, inference method, and inference program can be implemented using the calculation unit 131 of the learning device 10. Alternatively, the inference device may be implemented by a different device from the learning device 10 that has equivalent functionality to the calculation unit 131.

[0087] The learning device 10, which functions as an inference device, inputs adversarial attack data, which is data that has been subjected to a simulated adversarial attack on the input data, into the model, calculates a score for each of the multiple labels, and for a certain percentage of the input data where the difference between the maximum value of the incorrect score calculated in the process of calculating for incorrect labels (labels other than the correct labels that are pre-associated with the input data) and the correct score calculated in the process of calculating for the correct labels is large, the learning device 10 has a calculation unit 131 that calculates the scores for multiple labels for the input data using a model whose parameters have been updated so that the one-to-other loss, which is the loss between the correct score and the incorrect score, is small.

[0088] [System configuration, etc.] Furthermore, the components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown, and all or part of them can be functionally or physically distributed or integrated in any unit according to various loads and usage conditions. Moreover, each processing function performed by each device can be implemented, in whole or in any part, by a CPU (Central Processing Unit) and a program that is analyzed and executed by the CPU, or by hardware using wired logic. Note that the program may be executed not only by the CPU but also by other processors such as a GPU.

[0089] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0090] [program] In one embodiment, the learning device 10 can be implemented by installing a learning program that performs the above-mentioned learning process as packaged software or online software on a desired computer. For example, by having the above-mentioned learning program run on an information processing device, the information processing device can be made to function as the learning device 10. The information processing device referred to here includes desktop or notebook personal computers. In addition, the category of information processing device also includes mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone System), and slate terminals such as PDA (Personal Digital Assistant).

[0091] Furthermore, the learning device 10 can also be implemented as a learning server device that uses a user's terminal device as a client and provides services related to the learning process described above to that client. For example, the learning server device can be implemented as a server device that takes learning data as input and outputs the parameters of a trained model to provide a learning service. In this case, the learning server device may be implemented as a web server, or it may be implemented as a cloud service that provides the services related to the learning process described above through outsourcing.

[0092] Figure 6 shows an example of a computer running a learning program. Computer 1000 has, for example, memory 1010 and a CPU 1020. Computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0093] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM (Random Access Memory) 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0094] The hard disk drive 1090 stores, for example, the OS 1091, application programs 1092, program modules 1093, and program data 1094. That is, the programs that define each process of the learning device 10 are implemented as program modules 1093 in which executable code for the computer is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, a program module 1093 for performing the same processes as the functional configuration of the learning device 10 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0095] Furthermore, the configuration data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. The CPU 1020 then reads the program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed and executes the processing of the above-described embodiment.

[0096] Furthermore, the program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090; for example, they may be stored in a removable storage medium and read by the CPU 1020 via a disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via a network interface 1070. [Explanation of symbols]

[0097] 10 Learning device 11 Communications Department 12 Storage section 13 Control Unit 121 Model Information 131 Calculation Department 132 Creation Department 133 Update Department

Claims

1. The model inputs data that has been subjected to a simulated adversarial attack on the input data, and calculates a score for each of the multiple labels. An update unit updates the model parameters for a certain percentage of the input data where the difference between the maximum incorrect score calculated by the calculation unit for incorrect labels (labels other than the correct labels that are pre-associated with the input data) and the correct score calculated by the calculation unit for the correct labels is large, so as to reduce the one-to-other loss, which is the loss between the correct score and the incorrect score. A learning device characterized by having the following features.

2. The learning device according to claim 1, characterized in that the update unit updates the parameters of the model so that the loss function, which is the sum of the one-to-other loss when the adversarial attack data is input to the model and the KL divergence when the adversarial attack data is input to the model, becomes smaller.

3. The learning device according to claim 1, characterized in that the update unit updates the parameters of the model so that the loss function, which is the sum of the one-to-other loss when the adversarial attack data is input to the model, the one-to-other loss when the input data is input to the model, and the KL divergence when the input data is input to the model, becomes smaller.

4. A learning method performed by a learning device, The process involves inputting data that has been subjected to a simulated adversarial attack into the model, and then calculating a score for each of the multiple labels. For a certain percentage of the input data where the difference between the maximum incorrect score calculated by the calculation step for incorrect labels (labels other than the correct labels that are pre-associated with the input data) and the correct score calculated by the calculation step for the correct labels is large, an update step is performed to update the model parameters so that the one-to-other loss, which is the loss between the correct score and the incorrect score, is reduced. A learning method characterized by including the following.

5. The calculation step involves inputting data that has been subjected to a simulated adversarial attack into the model, and then calculating a score for each of the multiple labels. An update step updates the model parameters for a certain percentage of the input data where the difference between the maximum incorrect score calculated by the calculation step for incorrect labels (labels other than the correct labels that are pre-associated with the input data) and the correct score calculated by the calculation step for the correct labels is large, so as to reduce the one-to-other loss, which is the loss between the correct score and the incorrect score. A learning program characterized by having a computer execute it.

6. The model inputs data that has been subjected to a simulated adversarial attack on the input data, and calculates a score for each of the multiple labels. For a certain percentage of the input data where the difference between the maximum incorrect score calculated by the calculation unit for incorrect labels (labels other than the correct labels that are pre-associated with the input data) and the correct score calculated by the calculation unit for the correct labels is large, the update unit updates the model parameters so that the one-to-other loss, which is the loss between the correct score and the incorrect score, becomes smaller. It has, The calculation unit uses the model whose parameters have been updated by the update unit to calculate the scores of the plurality of labels for the input data. An inference device characterized by the following features.

7. An inference method performed by an inference device, The process involves inputting data that has been subjected to a simulated adversarial attack into the model, and then calculating a score for each of the multiple labels. For a certain percentage of the input data where the difference between the maximum incorrect score calculated by the calculation process for incorrect labels (labels other than the correct labels that are pre-associated with the input data) and the correct score calculated by the calculation process for the correct labels is large, an update process is performed to update the model parameters so that the one-to-other loss, which is the loss between the correct score and the incorrect score, is small. Includes, The calculation step uses the model whose parameters have been updated in the update step to calculate the scores of the plurality of labels for the input data. An inference method characterized by the following:

8. The calculation step involves inputting data that has been subjected to a simulated adversarial attack into the model, and then calculating a score for each of the multiple labels. For a certain percentage of the input data where the difference between the maximum incorrect score calculated by the calculation step for incorrect labels (labels other than the correct labels that are pre-associated with the input data) and the correct score calculated by the calculation step for the correct labels is large, an update step is performed to update the model parameters so that the one-to-other loss, which is the loss between the correct score and the incorrect score, is small. Have the computer run it, The calculation step calculates the scores of the plurality of labels for the input data using the model whose parameters have been updated in the update step. An inference program characterized by the following features.

Images