Learning device, learning method, and program

Abstract

To reflect diversity of adversarial samples in training of a neural network using the adversarial samples.SOLUTION: A neural network includes: a partial network; a normalization layer associated with an entire base data group including multiple pieces of data; and a normalization layer associated with each condition of adversarial sample generation, the normalization layers each normalizing data input thereto. A learning device updates a parameter value of the partial network and a parameter value of the normalization layer associated with the entire base data group by using the base data group, and updates the parameter value of the partial network and the parameter value of the normalization layer associated with the condition of adversarial sample generation, using each adversarial sample group for each of the conditions of adversarial sample generation.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a learning apparatus, a learning method, and a program. Background Art

[0002] Adversarial Examples (AX) are sometimes used for training neural networks (see, for example, Patent Document 1). Prior Art Literature Patent Literature

[0003] Patent Document 1 Japanese Unexamined Patent Publication No. 2021-005138 Summary of the Invention Problem to be Solved by the Invention

[0004] When adversarial examples are used for training a neural network, it is preferable that the diversity of adversarial examples can be reflected in the training.

[0005] An example of an object of the present invention is to provide a learning apparatus, a learning method, and a program that can solve the above-described problem. Means for Solving the Problem

[0006] According to a first aspect of the present invention, the learning device includes data acquisition means for acquiring a base data group which is a group containing multiple data; adversarial sample acquisition means for acquiring an adversarial data group which is a group containing two or more adversarial samples generated under a given condition using the data included in the base data group; a subset network; a normalization layer linked to the entire base data group; and a normalization layer linked to each of the conditions for generating adversarial samples, each of which includes a subset network which is linked to a given condition, and parameter update means which updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer linked to the entire base data group using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer linked to the conditions under which the adversarial samples included in that adversarial data group were generated, using each of the adversarial data groups.

[0007] According to a second aspect of the present invention, the learning method includes a computer acquiring a base data group which is a group containing multiple data, acquiring an adversarial data group which is a group containing two or more adversarial samples generated under a given condition using the data included in the base data group for each condition for generating an adversarial sample, a subset network including a normalization layer linked to the entire base data group, and a normalization layer linked to each condition for generating an adversarial sample, each of which is a neural network that normalizes the data input to the normalization layer using the mean and variance values ​​set for each normalization layer, updating the parameter values ​​of the subset network and the parameter values ​​of the normalization layer linked to the entire base data group using the base data group, and updating the parameter values ​​of the subset network and the parameter values ​​of the normalization layer linked to the condition under which the adversarial sample included in that adversarial data group was generated using each of the adversarial data groups.

[0008] According to a third aspect of the present invention, the program causes a computer to perform the following actions: acquire a base data group which is a group containing multiple data; acquire an adversarial data group which is a group containing two or more adversarial samples generated under a given condition using the data included in the base data group for each condition for generating adversarial samples; and a neural network which includes a subset network, a normalization layer linked to the entire base data group, and a normalization layer linked to each condition for generating adversarial samples, each of which normalization layers performs normalization on the data input to the normalization layer using the mean and variance values ​​set for each normalization layer, and updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer linked to the entire base data group using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer linked to the conditions under which the adversarial samples included in that adversarial data group were generated using each of the adversarial data groups. [Effects of the Invention]

[0009] According to the present invention, when adversarial samples are used in training a neural network, the diversity of the adversarial samples can be reflected in the training. [Brief explanation of the drawing]

[0010] [Figure 1] This figure shows an example of the configuration of a learning device according to the first embodiment. [Figure 2] This figure shows an example of a neural network stored in the model storage unit according to the first embodiment. [Figure 3] This figure shows an example of the procedure for the processing unit according to the first embodiment to perform neural network training. [Figure 4] This figure shows an example of the procedure for the processing unit according to the first embodiment to collect data for updating parameter values ​​based on adversarial samples. [Figure 5] This figure shows an example of the configuration of a learning device according to the second embodiment. [Figure 6] This figure shows an example of the configuration of a learning device according to the third embodiment. [Figure 7] This figure shows an example of the procedure for the processing unit according to the third embodiment to collect data for updating parameter values ​​based on adversarial samples. [Figure 8] This figure shows an example of the procedure for a learning device to collect data for updating parameter values ​​based on adversarial samples, when the neural network according to the third embodiment is configured as a classification-type AI. [Figure 9] This figure shows an example of the procedure for a learning device to collect data for updating parameter values ​​based on adversarial samples, when the neural network according to the third embodiment is configured as a feature extraction type AI. [Figure 10] This figure shows an example of the configuration of a learning device according to the fourth embodiment. [Figure 11] This figure shows an example of the procedure for the processing unit according to the fourth embodiment to perform neural network training. [Figure 12] This figure shows an example of the procedure for the processing unit according to the fourth embodiment to collect data for updating parameter values ​​based on adversarial samples. [Figure 13] This figure shows an example of the configuration of the estimation device according to the fifth embodiment. [Figure 14] This figure shows an example of a neural network stored in the model storage unit according to the fifth embodiment. [Figure 15] This figure shows an example of the configuration of a learning device according to the sixth embodiment. [Figure 16] This figure shows an example of the processing procedure in the learning method according to the seventh embodiment. [Figure 17] This is a schematic block diagram showing the configuration of a computer according to at least one embodiment. [Modes for carrying out the invention]

[0011] Hereinafter, embodiments of the present invention will be described. The following embodiments do not limit the invention according to the claims. Furthermore, not all combinations of features described in the embodiments are necessarily essential to the solution of the invention.

[0012] <First Embodiment> FIG. 1 is a diagram showing an example of the configuration of a learning device according to the first embodiment. In the configuration shown in FIG. 1, a learning device 101 includes a communication unit 110, a display unit 120, an operation input unit 130, a storage unit 180, and a processing unit 190. The storage unit 180 includes a model storage unit 181. The model storage unit 181 includes a common parameter storage unit 182, and from a first normalization layer parameter storage unit 183-1 to an n+1-th normalization layer parameter storage unit 183-n+1. Here, n represents a positive integer. The processing unit 190 includes a data acquisition unit 191, an adversarial sample acquisition unit 192, a model execution unit 193, and a parameter update unit 194. The adversarial sample acquisition unit 192 includes from a first adversarial sample acquisition unit 192-1 to an n-th adversarial sample acquisition unit 192-n. The first to n+1-th normalization layer parameter storage units 183-1 to 183-n+1 are collectively referred to as a normalization layer parameter storage unit 183.

[0013] The learning device 101 performs learning of a neural network. The learning device 101 may be configured using a computer such as a personal computer (PC) or a workstation (WS), for example.

[0014] The communication unit 110 communicates with other devices. For example, the communication unit 110 may receive data for neural network learning from another device. Further, for example, the communication unit 110 may receive, from another device, data in which data to be input to a neural network is associated with a class into which the data is classified.

[0015] The display unit 120 has a display screen such as a liquid crystal panel or an LED (Light Emitting Diode) panel, and displays various images. For example, the display unit 120 may display information related to the learning of the neural network, such as the progress of the neural network's learning.

[0016] The operation input unit 130 is configured to include, for example, input devices such as a keyboard and a mouse, and accepts user operations. For example, the operation input unit 130 may be configured to accept user operations related to neural network training, such as inputting conditions for the termination of neural network training.

[0017] The memory unit 180 stores various types of data. The memory unit 180 is configured using the memory devices provided by the learning device 101. The model memory unit 181 stores a neural network as a machine learning model. Figure 2 shows an example of a neural network stored in the model memory unit 181. The neural network 201 shown in Figure 2 is configured as a type of convolutional neural network (CNN) and includes an input layer 210, a convolutional layer 221, an activation layer 222, a pooling layer 223, first normalization layers 230-1 to the (n+1)th normalization layers 230-n+1, ​​a fully connected layer 240, and an output layer 250. As mentioned above, n is a positive integer. n represents the number of conditions for generating adversarial samples, which will be described later. The normalization layers from the first normalization layer 230-1 to the (n+1)th normalization layer are collectively referred to as normalization layer 230.

[0018] In the example shown in Figure 2, the data flow is arranged in the following order from upstream: input layer 210, convolutional layer 221, activation layer 222, and pooling layer 223, with one or more combinations of these layers being arranged in that order. Downstream from there, a fully connected layer 240 and an output layer 250 are provided. Furthermore, in each combination of the convolutional layer 221, activation layer 222, and pooling layer 223, the first normalization layer 230-1 to the (n+1)th normalization layer are arranged in parallel between the activation layer 222 and the pooling layer 223. The number of channels in a neural network 201 is not limited to a specific number.

[0019] Data from all channels of the activation layer 222 is input to each of the layers from the first normalization layer 230-1 to the (n+1)th normalization layer. Alternatively, the activation layer 222 may selectively output data to any one of the layers from the first normalization layer 230-1 to the (n+1)th normalization layer.

[0020] For each of the data output from the first normalization layer 230-1 to the (n+1)th normalization layer, data from the same channel is combined and input to the pooling layer 223. For example, the sum of the data output from each of the first normalization layer 230-1 to the (n+1)th normalization layer may be input to the pooling layer 223. Alternatively, the average of the data output from each of the first normalization layer 230-1 to the (n+1)th normalization layer may be input to the pooling layer 223. Alternatively, if only one of the normalization layers from the first normalization layer 230-1 to the (n+1)th normalization layer acquires data from the activation layer 222, only the normalization layer 230 that acquired the data may output the data to the pooling layer 223.

[0021] Of the various parts of the neural network 201, the parts other than the normalization layer 230 are also called the common part or subset network. In the example in Figure 2, the combination of the input layer 210, the convolutional layer 221, the activation layer 222, the pooling layer 223, the fully connected layer 240, and the output layer 250 is an example of the common part.

[0022] The input layer 210 receives input data for the neural network 201. The convolutional layer 221 performs a convolution operation on the data input to itself. The convolutional layer 221 may also perform padding to adjust the data size. The activation layer 222 applies an activation function to the data input to itself. The activation function used by the activation layer 222 is not limited to a specific function. For example, a Rectified Linear Function (ReLU) may be used as the activation function, but is not limited to this. The pooling layer 223 performs pooling on the data input to itself.

[0023] Each of the normalization layers 230 normalizes the data it receives as input. This normalization is the same as that used in batch normalization, where the normalization layer 230 transforms the data so that the mean and variance of the data in a given group are predetermined values. For example, to set the mean of a group of data to 0 and the variance to 1, the normalization layer 230 calculates the mean and variance of the data in the group to be normalized, subtracts the mean from each data point, and then divides the resulting value by the variance.

[0024] The mean after normalization by the normalization layer 230 is not limited to 0, and the variance is not limited to 1. For example, if α is a real number and β is a positive real number, the normalization layer 230 may perform normalization so that the group mean becomes α and the variance becomes β. Furthermore, these values ​​of α and β may be the subject of learning. The values ​​of α and β may be set by learning for each normalization layer 230. In particular, if i is an integer between 1 and n+1, the values ​​of α and β may be set by learning for each of the i-th normalization layer 230-i, which are provided in multiple layers in the neural network 201.

[0025] The mean value of the target group for the i-th normalized layer 230-i is also called the i-th mean. The variance value of the target group for the i-th normalized layer 230-i is also called the i-th variance. The i-th mean and i-th variance are examples of parameter values ​​for the i-th normalized layer 230-i. The parameter that indicates the i-th mean is also called the i-th mean. The parameter that indicates the i-th variance is also called the i-th variance.

[0026] If data from multiple channels is input to a single normalization layer 230, the normalization layer 230 may perform data normalization on all data included in a single group and on all channels. Alternatively, the normalization layer 230 may perform data normalization on a channel-by-channel basis. As will be described later, the data used to learn the parameter values ​​differs in each of the first normalized layers, from the first normalized layer 230-1 to the (n+1)th normalized layer 230-n+1.

[0027] The fully connected layer 240 converts the data it receives as input into data corresponding to the output data of the neural network 201. The output layer 250 outputs the output data from the neural network 201. For example, the output layer 250 may apply an activation function such as a softmax function to the data from the fully connected layer 240 before outputting it.

[0028] Alternatively, the fully connected layer 240 may generate the output data for the neural network 201, and the output layer 250 may output the data from the fully connected layer 240 as is. In this case, the fully connected layer 240 may also function as the output layer 250, outputting the data directly to the outside of the neural network 201.

[0029] However, the configuration of the machine learning model stored in the model storage unit 181 is not limited to a specific configuration. For example, when the model memory unit 181 stores a convolutional neural network as a machine learning model, the configuration and number of layers in the convolutional neural network can be varied. For instance, the configuration of the machine learning model stored by the model memory unit 181 may be a combination of the convolutional layer 221, activation layer 222, and pooling layer 223 included in the neural network 201 in the example of Figure 2, but without the activation layer 222.

[0030] Furthermore, the positions in which the combinations of the first normalization layer 230-1 to the (n+1)th normalization layer 230-n+1 are provided are not limited to specific positions. For example, the combinations of the first normalization layer 230-1 to the (n+1)th normalization layer 230-n+1 may be provided only for some of the combinations of the convolutional layer 221, the activation layer 222, and the pooling layer 223. The machine learning model stored in the model memory unit 181 may be configured such that a convolutional neural network with a batch normalization layer has been modified to have n+1 batch normalization layers arranged in parallel. However, the machine learning models stored in the model memory unit 181 are not limited to convolutional neural networks, but can be various neural networks to which normalization by the first normalization layer 230-1 to the (n+1)th normalization layer 230-n+1 can be applied.

[0031] Furthermore, the implementation method of the neural network to be trained by the learning device 101 is not limited to the method by which the model storage unit 181 stores the neural network. For example, the neural network to be trained by the learning device 101 may be implemented in hardware, such as by using an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array). The neural network to be trained by the learning device 101 may be configured as part of the learning device 101, or it may be configured as an external component of the learning device 101.

[0032] The common parameter storage unit 182 stores the parameter values ​​of the common parts. The common parameter storage unit 182 stores the values ​​of various parameters that are the target of learning, such as the parameters of the filters for convolution operations in the convolutional layer and the activation function in the activation layer. The parameter values ​​of the common parts are also called common parameter values.

[0033] The i-th normalized layer parameter storage unit 183-i stores the parameter values ​​of each i-th normalized layer 230-i, where i represents an integer between 1 and n+1. The i-th normalized layer parameter storage unit 183-i stores the values ​​of various parameters to be learned, such as the i-th mean and the i-th variance.

[0034] The processing unit 190 controls various parts of the learning device 101 to perform various processes. The functions of the processing unit 190 are performed, for example, by the CPU (Central Processing Unit) of the learning device 101 reading a program from the storage unit 180 and executing it.

[0035] The data acquisition unit 191 acquires groups of data that include multiple data points to which information indicating the correct class in classification is associated with the data to be input to the neural network 201. The data acquisition unit 191 is an example of a data acquisition means. The data acquired by the data acquisition unit 191 to be used as input to the neural network 201 is also called the base data. A group of base data is also called a base data group. The number of base data groups acquired by the data acquisition unit 191 can be one or more, and is not limited to a specific number. When the data acquisition unit 191 acquires multiple base data groups, the number of base data elements in each group may be the same or different.

[0036] The data acquisition unit 191 may also acquire base data from other devices via the communication unit 110. Alternatively, the data acquisition unit 191 may acquire base data from other devices in the form of base data groups. Or, the data acquisition unit 191 may acquire base data from other devices and group them into base data groups.

[0037] The adversarial sample acquisition unit 192 acquires an adversarial data group, which is a group containing multiple adversarial samples for data included in the base data group acquired by the data acquisition unit 191. In this context, an adversarial sample for a given data is an adversarial sample to which an adversarial perturbation has been added. The adversarial sample acquisition unit 192 is an example of an adversarial sample acquisition means.

[0038] The first adversarial sample acquisition unit 192-1 through the nth adversarial sample acquisition unit 192-n each generate adversarial samples under different conditions. As mentioned above, n represents the number of conditions for generating adversarial samples. The conditions for generating adversarial samples can be varied and are not limited to any particular set, as different conditions will generate different adversarial samples. For example, the conditions for generating adversarial samples may include, but are not limited to, an adversarial sample generation algorithm, quantitative parameters related to adversarial sample generation, a target class, or a combination thereof.

[0039] Here, if an adversarial sample is intended to be misclassified into a certain class, that class (the class to which it is misclassified) is also called the target class. The adversarial sample may be associated not only with data indicating the correct class, but also with data indicating the target class.

[0040] Examples of adversarial sample generation algorithms include, but are not limited to, the Fast Gradient Descent Method, the Carlini-Wagner Method, and the Projected Gradient Descent Method. Furthermore, algorithmic classifications, such as distinguishing between dodging attacks and target attacks, may be used as conditions for adversarial sample generation algorithms.

[0041] Examples of quantitative parameters related to the generation of adversarial samples include, but are not limited to, the number of times noise (adversarial perturbations) are added, the amount of noise added each time, and the number of target classes, as described later. As a condition regarding the target class, you can use a condition that specifies which class should be set as the target class.

[0042] For example, the first adversarial sample acquisition unit 192-1 to the nth adversarial sample acquisition unit 192-n may each generate adversarial samples using different algorithms. Alternatively, some of the first adversarial sample acquisition units 192-1 to the nth adversarial sample acquisition units 192-n may use the same algorithm, but with different numbers of noise additions.

[0043] Each of the first adversarial sample acquisition units 192-1 to the nth adversarial sample acquisition unit 192-n may generate adversarial samples by applying an adversarial sample generation method to the base data acquired by the data acquisition unit 191. Alternatively, each of the first adversarial sample acquisition units 192-1 to the nth adversarial sample acquisition unit 192-n may acquire adversarial samples from an adversarial sample generating device via the communication unit 110.

[0044] The number of adversarial samples in an adversarial data group may be the same as or different from the number of base data in the base data group. When each of the first adversarial sample acquisition units 192-1 to the nth adversarial sample acquisition unit 192-n generates adversarial samples from base data, they may generate one adversarial sample from all the base data included in one base data group and combine them into one adversarial data group. Alternatively, each of the first adversarial sample acquisition units 192-1 to the nth adversarial sample acquisition unit 192-n may generate one adversarial sample from some of the base data included in one base data group and combine them into one adversarial data group. Alternatively, each of the first adversarial sample acquisition units 192-1 to the nth adversarial sample acquisition unit 192-n may generate adversarial samples from the base data included in each of multiple base data groups and combine them into one adversarial data group.

[0045] Each of the first adversarial sample acquisition units 192-1 to the nth adversarial sample acquisition unit 192-n may generate multiple adversarial samples from a single base data. For example, if the condition for generating adversarial samples is (differences in) algorithms, one or more of the first adversarial sample acquisition units 192-1 to the nth adversarial sample acquisition units 192-n may generate multiple adversarial samples using the same algorithm but varying the number of times noise is added.

[0046] The model execution unit 193 executes the machine learning model stored in the model storage unit 181. Specifically, the model execution unit 193 inputs data into the neural network 201 and calculates the output data of the neural network 201. The calculation of output data by the neural network 201 is also called estimation using the neural network 201, or simply estimation.

[0047] The neural network 201 may be configured to output an estimated result of the class to be classified as an input. In this case, the neural network is also called a classification AI. Alternatively, the neural network 201 may be configured to output features from the input data. This type of neural network is also called a feature extraction AI.

[0048] The parameter update unit 194 trains the neural network 201 and updates the parameter values ​​of the neural network 201. The parameter update unit 194 updates the parameter values ​​of the subset network and the parameter values ​​of the (n+1)th normalization layer 230-n+1 using the base data group. The parameter update unit 194 also updates the parameter values ​​of the subset network and the parameter values ​​of the (j)th normalization layer 230-j using the adversarial data group acquired by the j-th adversarial sample acquisition unit 192-j. Here, j represents an integer between 1 and n.

[0049] Similar to parameter updates in mini-batch learning, the parameter update unit 194 may update the parameter values ​​using the average value of multiple input data for each part of the neural network 201. The parameter update unit 194 is an example of a parameter update means.

[0050] As described above, data may be input to each of the first normalization layers 230-1 through the (n+1)th normalization layer 230-n+1. Alternatively, data may be selectively input to any one of the layers from the first normalization layer 230-1 through the (n+1)th normalization layer 230-n+1.

[0051] When each data point (base data) of the base data group is input to the neural network 201, the data from all channels of the activation layer 222, which outputs data to the normalization layer 230, may be input to each of the layers from the first normalization layer 230-1 to the (n+1)th normalization layer 230-n+1, ​​or it may be input to only the (n+1)th normalization layer.

[0052] When the neural network 201 receives each data point (adversarial sample) from the adversarial data group acquired by the j-th adversarial sample acquisition unit 192-j, the data from all channels of the activation layer 222, which outputs data to the normalization layer 230, may be input to each of the first normalization layers 230-1 through the (n+1)th normalization layer 230-n+1, ​​or it may be input to only the j-th normalization layer 230-j.

[0053] The method used by the parameter update unit 194 to update parameter values ​​is not limited to a specific method. The parameter update unit 194 may update parameter values ​​using known methods applicable to mini-batch learning, such as backpropagation.

[0054] Figure 3 shows an example of the procedure for the processing unit 190 to train the neural network 201. In the process shown in Figure 3, the data acquisition unit 191 acquires a base data group (step S101). That is, the data acquisition unit 191 acquires base data that has been grouped together. The data acquisition unit 191 may acquire base data that has already been grouped together. Alternatively, the data acquisition unit 191 may acquire base data and group it into base data groups.

[0055] Next, the processing unit 190 starts a loop L11 that processes each base data group (step S102). The base data group that is the target of processing in loop L11 is also called the target base data group. In the processing of loop L11, the parameter update unit 194 updates the parameter values ​​of the common part and the parameter values ​​of the (n+1)th normalization layer using the target base data group (step S103).

[0056] Next, the processing unit 190 starts a loop L12 that processes each of j=1, ..., n (step S104). j is used as an index to identify the first adversarial sample acquisition unit 192-1 to the nth adversarial sample acquisition unit 192-n, and as an index to identify the first normalization layer 230-1 to the nth normalization layer 230-n.

[0057] Next, the processing unit 190 collects data to update the parameter values ​​of the common part and the parameter values ​​of the j-th normalized layer 230-j (step S105). The data used to update the parameter values ​​of the common part and the parameter values ​​of the j-th normalized layer 230-j is also referred to as parameter value update data based on adversarial samples. Next, the parameter update unit 194 updates the parameter values ​​of the common part and the parameter values ​​of the j-th normalized layer using the data obtained in step S105 (step S106).

[0058] Next, the processing unit 190 performs termination processing on the loop L12 (step S107). Specifically, the processing unit 190 determines whether or not the loop L12 process has been performed for all values ​​of j=1, ..., n. For example, the processing unit 190 increases the value of j by 1 starting from j=1 and determines whether or not the loop L12 process has been performed for j=n. In the second and subsequent iterations of loop L12, the processing unit 190 determines whether or not the processing of loop L12 has been performed for all values ​​of j=1, ..., n during that iteration.

[0059] If the processing unit 190 determines that there are still values ​​of j that have not yet been processed by loop L12, the process returns to step S104. In this case, the processing unit 190 continues to process loop L12 for the values ​​of j that have not yet been processed by loop L12, for example by increasing the value of j by 1. On the other hand, if the processing unit 190 determines that it has performed the operation of loop L12 for all values ​​of j=1, ..., n, the processing unit 190 terminates loop L12.

[0060] When loop L12 is terminated, the processing unit 190 performs termination processing for loop L11 (step S108). Specifically, the processing unit 190 determines whether or not the processing in loop L11 has been performed for all the base data groups obtained in step S101. In subsequent iterations of loop L11, the processing unit 190 determines whether or not the processing in loop L11 has been performed for all the base data groups obtained in step S101 during that iteration.

[0061] If the processing unit 190 determines that there are still base data groups that have not yet undergone processing in loop L11, the process returns to step S102. In this case, the processing unit 190 continues to perform the processing in loop L11 for the base data groups that have not yet undergone processing in loop L11. On the other hand, if the processing unit 190 determines that the processing in loop L11 has been performed for all the base data groups obtained in step S101, it terminates loop L11.

[0062] When loop L11 is completed, the processing unit 190 determines whether the learning termination condition has been met (step S109). Various conditions can be used as the learning termination condition here. For example, the learning termination condition may be that the process from steps S102 to S109 has been repeated a predetermined number of times, but is not limited to this.

[0063] If the processing unit 190 determines that the learning termination condition has not been met (step S109: NO), the process returns to step S102. In this case, the processing unit 190 repeats the processing of loop L11, thereby repeatedly updating the parameter values ​​of the neural network 201. On the other hand, if it is determined that the learning termination condition has been met (step S109: YES), the processing unit 190 terminates the process shown in Figure 3.

[0064] Figure 4 shows an example of the procedure for the processing unit 190 to collect data for updating parameter values ​​based on adversarial samples. The processing unit 190 performs the process shown in Figure 4 in step S105 of Figure 3. In the process shown in Figure 4, the processing unit 190 starts a loop L21 that processes each base data included in the target base data group (step S201). The base data that is the target of processing in loop L21 is also called the target base data.

[0065] In the processing of loop L21, the j-th adversarial sample acquisition unit 192-j generates adversarial samples for the target base data (step S202). Here, j represents index j in loop L12 in Figure 3. Next, the model execution unit 193 inputs the adversarial samples obtained in step S202 into the neural network 201 and performs estimation using the neural network 201 (step S203).

[0066] Next, the parameter update unit 194 stores parameter value update data based on adversarial samples in the storage unit 180 (step S204). For example, when using a learning method based on the errors of the data calculated by each part of the neural network 201, such as backpropagation, the parameter update unit 194 may calculate the errors in the parts of the neural network 201 whose parameter values ​​are to be updated and store them in the memory unit 180. In this case, in step S106 of Figure 3, the parameter update unit 194 calculates the average value of the errors stored in the memory unit 180 for each part of the neural network 201, applies the learning method to the calculated average value, and updates the parameter values.

[0067] Next, the processing unit 190 performs termination processing on the loop L21 (step S205). Specifically, the processing unit 190 determines whether or not the processing in loop L21 has been performed for all the base data included in the target base data group. In the second and subsequent iterations of loop L12 (Figure 3), the processing unit 190 determines whether or not the processing in loop L21 has been performed for all the base data included in the target base data group during that iteration.

[0068] If the processing unit 190 determines that there is still base data that has not yet been processed by loop L21, the process returns to step S201. In this case, the processing unit 190 continues to process the base data that has not yet been processed by loop L21. On the other hand, if the processing unit 190 determines that it has performed the processing in loop L21 for all the base data included in the target base data group, it terminates loop L21. When loop L21 is terminated, the processing unit 190 terminates the process shown in Figure 4.

[0069] As described above, the data acquisition unit 191 acquires one or more base data groups, which are groups containing multiple data points. The adversarial sample acquisition unit 192 acquires one or more adversarial data groups, which are groups containing two or more adversarial samples generated under each condition for generating adversarial samples, using the data included in the base data group. The parameter update unit 194 updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the entire base data group for the neural network 201 using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples included in that adversarial data group were generated, using each of the adversarial data groups. The neural network 201 includes subset networks, a normalization layer associated with the entire base data group, and a normalization layer associated with each condition for generating adversarial samples. Each of these normalization layers performs normalization on the data input to the normalization layer using the mean and variance values ​​set for each normalization layer.

[0070] Thus, the neural network 201 is provided with a normalization layer 230 for each condition of adversarial sample generation, and the learning device 101 learns the parameter values ​​of the subset network and the parameter values ​​of the normalization layer 230 associated with each condition of adversarial sample generation using the adversarial data group that includes the adversarial samples generated under that condition. In this respect, the learning device 101 makes it possible to reflect the diversity of adversarial samples in the learning process when adversarial samples are used to train the neural network.

[0071] Here, adversarial samples can be considered as inputs that are prone to errors in neural networks, created by small perturbations. Therefore, adversarial samples can be used to train neural networks with the aim of improving their accuracy. In other words, adversarial samples can be used as training data to compensate for the weaknesses of neural networks by training them to be able to make correct estimations on data that is prone to errors.

[0072] Furthermore, to effectively train a neural network, it is possible to adjust the data distribution by adding a normalization layer, such as batch normalization. When using both a base data group and an adversarial data group for training a neural network, the data distribution differs between the two groups. Therefore, it is possible to improve the efficiency of training by adding a normalization layer to each group.

[0073] Furthermore, the learning device 101 trains the neural network 201 using the base data group and adversarial data groups for each condition of adversarial sample generation. The distribution of adversarial samples included in the adversarial data group differs for each condition of adversarial sample generation.

[0074] The learning device 101 learns the parameter values ​​of the common part and the parameter values ​​of the normalization layer 230 for each condition of adversarial sample generation. This allows the neural network 201 to be trained in response to differences in data distribution corresponding to the diversity of adversarial samples, and is expected to enable efficient learning.

[0075] <Second Embodiment> In the second embodiment, an example of the configuration of a learning device will be described in which the adversarial sample acquisition unit generates adversarial data groups using an algorithm in which the number of target classes is variable.

[0076] Figure 5 shows an example of the configuration of a learning device according to the second embodiment. In the configuration shown in Figure 5, the learning device 102 comprises a communication unit 110, a display unit 120, an operation input unit 130, a storage unit 180, and a processing unit 170. The storage unit 180 comprises a model storage unit 181. The model storage unit 181 comprises a common parameter storage unit 182 and first normalization layer parameter storage units 183-1 to the (n+1)th normalization layer parameter storage units 183-n+1. As described above, n is a positive integer and represents the number of conditions for generating adversarial samples. The processing unit 170 comprises a data acquisition unit 191, an adversarial sample acquisition unit 171, a model execution unit 193, and a parameter update unit 194. The adversarial sample acquisition unit 171 comprises first adversarial sample acquisition units 171-1 to the mth adversarial sample acquisition units 171-m. Here, m is an integer between 1 and m. m represents the number of adversarial sample generation algorithms used by the adversarial sample acquisition unit 171.

[0077] Of the parts of the learning device 102 shown in Figure 5, the parts corresponding to the parts of the learning device 101 shown in Figure 1 are denoted by the same reference numerals (110, 120, 130, 180, 181, 182, 183-1, ..., 183-n+1, ​​191, 193, 194), and detailed explanations are omitted here.

[0078] In the learning device 102, the adversarial sample acquisition unit 171 comprises first adversarial sample acquisition units 171-1 to the mth adversarial sample acquisition unit 171-m, and in at least one of these units, the number of target classes is variable. This is different from the learning device 101, in that the adversarial sample acquisition unit 192 comprises first adversarial sample acquisition units 192-1 to the nth adversarial sample acquisition unit 192-n. In all other respects, the learning device 102 is the same as the learning device 101. Furthermore, in the configuration shown in Figure 5, when m=n, the configuration of learning device 102 becomes the same as the configuration of learning device 101 shown in Figure 1. Learning device 101 corresponds to an example of learning device 102.

[0079] In the second embodiment, the neural network 201 calculates the features of the input data. When multiple target classes are set, the adversarial sample acquisition unit 171 generates adversarial samples so that the neural network 201 receives the input of adversarial samples and calculates features that are similar to the features associated with any of the multiple target classes.

[0080] Adversarial samples used to generate features in a neural network that are similar to features associated with any of multiple target classes are called Multi-Targeted Adversarial Examples (MTAX). One of the algorithms used by the adversarial sample acquisition unit 171 may be a known Multi-Targeted Adversarial Example generation algorithm that allows for a variable setting of the number of target classes.

[0081] As features associated with a target class, you may use the features of data belonging to that target class (data where that target class is the correct answer). Alternatively, as features associated with a target class, you may use a composite feature, such as the average of the features of multiple data belonging to that target class (multiple data where that target class is the correct answer), which are the features of those multiple data.

[0082] The adversarial sample acquisition unit 171 generates adversarial data groups for each of multiple settings of the number of target classes using an algorithm with a variable number of target classes. This allows for the generation of adversarial data groups for each of the n conditions using fewer algorithms than the number of conditions n for generating adversarial samples.

[0083] As described above, the conditions for generating adversarial samples include the number of target classes in the adversarial samples. The adversarial sample acquisition unit 171 generates adversarial data groups for each of the multiple settings for the number of target classes, thereby enabling the acquisition of adversarial data groups under each of the multiple conditions for the generation of target classes.

[0084] Furthermore, by setting multiple target classes, the adversarial sample acquisition unit 171 generates Multi-Targeted Adversarial Examples. Multi-Targeted Adversarial Examples can be interpreted as inputs that the neural network is prone to misinterpreting as either of the two target classes. It is expected that the accuracy of the neural network 201 will improve as the learning device 102 trains the neural network 201 using the Multi-Targeted Adversarial Examples.

[0085] <Third Embodiment> In the third embodiment, we will describe a case in which the learning device selects adversarial samples that induce estimation errors in the neural network 201 from among the adversarial samples and uses them for training the neural network 201.

[0086] Figure 6 shows an example of the configuration of a learning device according to the third embodiment. In the configuration shown in Figure 6, the learning device 300 comprises a communication unit 110, a display unit 120, an operation input unit 130, a storage unit 180, and a processing unit 170. The storage unit 180 comprises a model storage unit 181. The model storage unit 181 comprises a common parameter storage unit 182 and first normalization layer parameter storage units 183-1 to the (n+1)th normalization layer parameter storage units 183-n+1. As described above, n is a positive integer and represents the number of conditions for generating adversarial samples. The processing unit 390 comprises a data acquisition unit 191, an adversarial sample acquisition unit 171, a model execution unit 193, an error induction determination unit 391, and a parameter update unit 392. The adversarial sample acquisition unit 171 comprises first adversarial sample acquisition units 171-1 to the mth adversarial sample acquisition units 171-m. As mentioned above, m is an integer between 1 and n. m represents the number of adversarial sample generation algorithms used by the adversarial sample acquisition unit 171.

[0087] Of the parts of the learning device 102 shown in Figure 6, the parts corresponding to the parts of the learning device 102 shown in Figure 5 are denoted by the same reference numerals (110, 120, 130, 171, 171-1, ..., 171-m, 180, 181, 182, 183-1, ..., 183-n+1, ​​191, 193), and a detailed explanation is omitted here.

[0088] The learning device 300 differs from the learning device 102 shown in Figure 5 in that the processing unit 390 includes an error induction determination unit 391. Also, the processing performed by the parameter update unit 392 in the learning device 300 differs from the processing performed by the parameter update unit 194 in the learning device 102. In all other respects, the learning device 300 is the same as the learning device 102. Figure 6 shows an example of implementing the third embodiment based on the second embodiment. Alternatively, the third embodiment may be implemented based on the first embodiment.

[0089] The error induction determination unit 391 determines whether the input data to the neural network 201 induces an error in estimation using the neural network 201. If the neural network 201 is configured as a classification-type AI, the error induction determination unit 391 may determine that the input data has induced an estimation error using the neural network 201 when the estimated class output by the neural network 201 differs from the correct class associated with the input data to the neural network 201.

[0090] Alternatively, if the neural network 201 is configured as a classification-type AI, the error induction determination unit 391 may determine that the input data has induced an estimation error using the neural network 201 when the class estimation result output by the neural network 201 indicates the target class of the adversarial sample which is the input data.

[0091] If the neural network 201 is configured as a feature extraction AI, the error induction determination unit 391 may calculate the similarity between the features output by the neural network 201 and the features associated with the target class of the adversarial sample, which is the input data to the neural network 201. The error induction determination unit 391 may then determine that the input data induces an estimation error using the neural network 201 if the calculated similarity is greater than or equal to a predetermined threshold.

[0092] The similarity index used by the error induction detection unit 391 is not limited to a specific one. The error induction detection unit 391 may calculate an index that indicates the similarity of two features, such as cosine similarity, where a larger index value indicates greater similarity between the two features. Alternatively, the error induction detection unit 391 may calculate an index that indicates greater similarity between the two features, such as the distance between the two features in the feature space, where a smaller index value indicates greater similarity between the two features.

[0093] As mentioned above, the feature associated with a target class may be the feature of a single data point belonging to that target class. Alternatively, the feature associated with a target class may be a composite feature, such as a feature obtained by taking the average of the features of multiple data points belonging to that target class.

[0094] In the parameter update unit 392, the process for updating the parameter values ​​of the subset network and the parameter values ​​of the j-th normalized layer 230-j differs from that of the parameter update unit 194. In all other respects, the parameter update unit 392 is the same as the parameter update unit 194. The parameter update unit 392 updates the parameter values ​​of the subset network and the parameter values ​​of the j-th normalization layer 230-j using adversarial samples from the adversarial data group acquired by the j-th adversarial sample acquisition unit 192-j that the error induction determination unit 391 has determined to induce an estimation error using the neural network 201. As described above, j represents an integer between 1 and n.

[0095] Figure 7 shows an example of the procedure for the processing unit 190 to collect data for updating parameter values ​​based on adversarial samples. The processing unit 190 trains the neural network 201 in the process shown in Figure 3, and then performs the process shown in Figure 7 in step S105 of Figure 3. Steps S211 to S213 in Figure 7 are the same as steps S201 to S203 in Figure 4. The loop started by the processing unit 190 in step S211 is called loop L22. The base data being processed in loop L41 is also called the target base data.

[0096] After step S213, the error induction determination unit 391 determines whether the adversarial sample for the target base data is inducing an estimation error using the neural network 201 (step S214). If the error induction determination unit 391 determines that adversarial samples for the target base data are inducing errors in estimation using the neural network 201 (step S214: YES), the parameter update unit 392 causes the storage unit 180 to store parameter value update data based on the adversarial samples (step S215).

[0097] For example, when using a learning method based on the errors of the data calculated by each part of the neural network 201, such as backpropagation, the parameter update unit 392 may calculate the errors in the parts of the neural network 201 whose parameter values ​​are to be updated and store them in the memory unit 180. In this case, in step S106 of Figure 3, the parameter update unit 392 calculates the average value of the errors stored in the memory unit 180 for each part of the neural network 201, applies the learning method to the calculated average value, and updates the parameter values.

[0098] Next, the processing unit 190 performs termination processing on the loop L22 (step S216). Specifically, the processing unit 190 determines whether or not the processing in loop L22 has been performed for all the base data included in the target base data group. In the second and subsequent iterations of loop L11 (Figure 3), the processing unit 190 determines whether or not the processing in loop L22 has been performed for all the base data included in the target base data group during that iteration.

[0099] If the processing unit 190 determines that there is still base data that has not yet been processed by loop L22, the process returns to step S211. In this case, the processing unit 190 continues to process loop L22 for the base data that has not yet been processed by loop L22. On the other hand, if the processing unit 190 determines that it has performed the processing in loop L22 for all of the base data included in the target base data group, it terminates loop L22. When loop L22 is terminated, the processing unit 190 terminates the process shown in Figure 7.

[0100] On the other hand, if the error induction determination unit 391 determines in step S214 that the adversarial sample for the target base data has not induced an estimation error using the neural network 201 (step S214: NO), the process proceeds to step S216. In this case, data recording in step S215 is not performed. Therefore, in this case, the adversarial sample for the target base data is excluded from updating the parameter values ​​of the common part and the parameter values ​​of the first normalization layer.

[0101] Figure 8 shows an example of the procedure for the learning device 300 to collect data for updating parameter values ​​based on adversarial samples when the neural network 201 is configured as a classification-type AI. The learning device 300 performs the process shown in Figure 8 in step S105 of Figure 3.

[0102] The process shown in Figure 8 corresponds to an example of the process shown in Figure 7. As described above, if the neural network 201 is configured as a classification-type AI, the error induction determination unit 391 may determine that the input data has induced an error in estimation using the neural network 201 when the class estimation result output by the neural network 201 differs from the correct class associated with the input data to the neural network 201. Figure 8 shows an example of the processing in this case.

[0103] Steps S221 to S222 in Figure 8 are the same as steps S211 to S212 in Figure 7. The processing of loop L23 in Figure 8 corresponds to an example of the processing of loop L22 in Figure 7. After step S222, the model execution unit 193 performs class classification of adversarial samples by applying adversarial samples to the target base data in the neural network 201 (step S223). The process in step S223 corresponds to the example of the process in step S213 in Figure 7. In the example in Figure 8, the adversarial samples obtained in step S222 correspond to adversarial samples for the target base data.

[0104] Next, the error induction determination unit 391 determines whether the adversarial sample for the target base data has been misclassified using the neural network 201 (step S224). Here, misclassification is defined as the neural network 201 classifying the input adversarial sample into a class different from the class designated as the correct class for that adversarial sample. Alternatively, misclassification may be defined as the neural network 201 classifying the input adversarial sample into the class designated as the target class for that adversarial sample. The process in step S224 corresponds to the example of the process in step S214 in Figure 7.

[0105] If the error induction determination unit 391 determines that the adversarial sample for the target base data has been misclassified by the classification using the neural network 201 (step S224: YES), the process proceeds to step S225. On the other hand, if the error induction determination unit 391 determines that the adversarial sample for the target base data has not been misclassified by the classification using the neural network 201 (step S224: NO), the process proceeds to step S226.

[0106] Steps S225 to S226 are the same as steps S215 to S216 in Figure 7. If loop L23 is terminated in step S226, the processing unit 190 terminates the process shown in Figure 8.

[0107] Figure 9 shows an example of the procedure for the learning device 300 to collect data for updating parameter values ​​based on adversarial samples, when the neural network 201 is configured as a feature extraction AI. The learning device 300 performs the process shown in Figure 9 in step S105 of Figure 3.

[0108] The process shown in Figure 9 corresponds to an example of the process shown in Figure 7. As described above, if the neural network 201 is configured as a feature extraction type AI, the error induction determination unit 391 may determine that the input data has induced an estimation error using the neural network 201 when the class estimation result output by the neural network 201 indicates the target class of the adversarial sample which is the input data. Figure 9 shows an example of the processing in this case.

[0109] Steps S231 to S232 in Figure 9 are the same as steps S211 to S212 in Figure 7. The processing of loop L24 in Figure 9 corresponds to an example of the processing of loop L22 in Figure 7. After step S232, the model execution unit 193 calculates the features of the adversarial samples by applying the adversarial samples to the target base data to the neural network 201 (step S233). The process in step S233 corresponds to the example of the process in step S213 in Figure 7. In the example in Figure 9, the adversarial samples obtained in step S232 correspond to the adversarial samples for the target base data.

[0110] Next, the error induction determination unit 391 calculates the similarity between the features of an adversarial sample and the features associated with the target class of that adversarial sample (step S234). Next, the error induction determination unit 391 determines whether the similarity calculated in step S234 indicates that the similarity is above a predetermined threshold (step S235). The processing from steps S234 to S235 corresponds to the example of the processing in step S214 in Figure 7.

[0111] If the error induction determination unit 391 determines that the similarity calculated in step S234 is above a predetermined threshold (step S235: YES), the process proceeds to step S236. On the other hand, if the error induction determination unit 391 determines that the similarity calculated in step S234 is not above a predetermined threshold (step S235: NO), the process proceeds to step S237.

[0112] Steps S236 to S237 are the same as steps S215 to S216 in Figure 7. If loop L24 is terminated in step S237, the processing unit 190 terminates the process shown in Figure 9.

[0113] As described above, when data is input to the neural network 201, the error induction determination unit 391 determines whether or not the data will induce an estimation error using the neural network 201. For each adversarial data group, the parameter update unit 194 updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer linked to the conditions under which the adversarial samples included in that adversarial data group were generated, using the adversarial samples included in that adversarial data group that have been determined to induce an estimation error using the neural network.

[0114] The learning device 300 selects adversarial samples from among the adversarial samples that induce estimation errors using the neural network 201, and uses them to train the neural network 201. In this respect, the learning device 101 allows for consideration of the accuracy of adversarial samples when they are used to train the neural network.

[0115] Here, adversarial samples that induce estimation errors using neural network 201 can be considered as input data where the estimation accuracy using neural network 201 is low. By training neural network 201 using these adversarial samples, it is expected that training can be performed efficiently.

[0116] On the other hand, adversarial samples that do not induce estimation errors using neural network 201 can be considered input data that yields relatively high accuracy in estimation using neural network 201. If the adversarial samples used to train neural network 201 include adversarial samples that do not induce estimation errors using neural network 201, it is possible that training neural network 201 will take longer, or that the accuracy of neural network 201 obtained as a result of training will be relatively low.

[0117] In contrast, as described above, the learning device 300 selects adversarial samples that induce estimation errors using the neural network 201 from among the adversarial samples and uses them to train the neural network 201. According to the learning device 300, in this respect, it is expected that the time required to train the neural network 201 will be relatively short, or that the accuracy of the neural network 201 obtained as a result of training will be relatively high.

[0118] Furthermore, the distribution of inputs to the neural network 201 differs between the base data and the adversarial samples. By including a first normalization layer linked to the inputs of the adversarial samples and a second normalization layer linked to the inputs of the base data in the neural network 201, it is expected that the learning device 101 can learn the neural network 201 relatively efficiently using these normalization layers.

[0119] Furthermore, the neural network 201 is configured as a classification AI that receives data input and classifies that data. The error induction determination unit 391 determines that if the neural network 201 classifies the input adversarial sample into a class different from the class considered to be the correct class for that adversarial sample, then that adversarial sample induces an estimation error using the neural network 201.

[0120] Thus, with the learning device 300, when learning a neural network configured as a classification-type AI, the following effects can be expected: the time required to learn the neural network is relatively short, or the accuracy of the neural network obtained as a result of the learning is relatively high.

[0121] Furthermore, the neural network 201 is configured as a classification AI that receives data input and classifies that data. The error induction determination unit 391 determines that if the neural network 201 classifies the input adversarial sample into the class designated as the target class of that adversarial sample, that adversarial sample induces an estimation error using the neural network.

[0122] Thus, with the learning device 300, when learning a neural network configured as a classification-type AI, the following effects can be expected: the time required to learn the neural network is relatively short, or the accuracy of the neural network obtained as a result of the learning is relatively high. Furthermore, according to the learning device 300, if the target class of the adversarial sample acquired by the adversarial sample acquisition unit 192 is specified as a particular class, it is expected that learning about the classification between the correct class and the target class can be performed efficiently.

[0123] Furthermore, the neural network 201 is configured as a feature extraction AI that receives data input and extracts features from that data. The error induction determination unit 391 calculates the similarity between the features extracted by the neural network 201 for the input adversarial sample and the features associated with the target class of that adversarial sample. If the calculated similarity is greater than a predetermined threshold, the unit determines that the adversarial sample induces an estimation error using the neural network 201.

[0124] Thus, with the learning device 300, when learning a neural network configured as a feature extraction type AI, the following effects can be expected: the time required to learn the neural network is relatively short, or the accuracy of the neural network obtained as a result of the learning is relatively high.

[0125] <Fourth Embodiment> The learning device may set a target class in adversarial samples by considering the similarity of the features. This point will be explained in the fourth embodiment.

[0126] Figure 10 shows an example of the configuration of a learning device according to the fourth embodiment. In the configuration shown in Figure 10, the learning device 400 comprises a communication unit 110, a display unit 120, an operation input unit 130, a storage unit 180, and a processing unit 490. The storage unit 180 comprises a model storage unit 181. The model storage unit 181 comprises a common parameter storage unit 182 and first normalization layer parameter storage units 183-1 to the (n+1)th normalization layer parameter storage units 183-n+1. As described above, n is a positive integer and represents the number of conditions for generating adversarial samples. The processing unit 490 comprises a data acquisition unit 191, an adversarial sample acquisition unit 171, a model execution unit 193, an error induction determination unit 391, a parameter update unit 392, a similarity calculation unit 491, and a target selection unit 492. The adversarial sample acquisition unit 171 comprises the first adversarial sample acquisition unit 171-1 to the mth adversarial sample acquisition unit 171-m. As described above, m is an integer between 1 and m and represents the number of adversarial sample generation algorithms used by the adversarial sample acquisition unit 171.

[0127] Of the parts of the learning device 400 shown in Figure 10, the parts corresponding to the parts of the learning device 300 shown in Figure 6 are denoted by the same reference numerals (110, 120, 130, 171, 171-1, ..., 171-m, 180, 181, 182, 183-1, ..., 183-n+1, ​​191, 193, 391, 392), and a detailed explanation is omitted here. In the learning device 400, the processing unit 490 includes, in addition to the parts of the processing unit 390 of the learning device 300, a similarity calculation unit 491 and a target selection unit 492. In all other respects, the learning device 400 is the same as the learning device 300. Figure 10 shows an example of implementing the fourth embodiment based on the third embodiment. Alternatively, the fourth embodiment may be implemented based on the first or second embodiment.

[0128] The similarity calculation unit 491 calculates an index value indicating the similarity between two features. Specifically, the similarity calculation unit 491 calculates an index value indicating the similarity between the features of the base data and the features associated with the candidate target classes used by the adversarial sample acquisition unit 171 to generate adversarial samples for the base data.

[0129] The metric used by the similarity calculation unit 491 is not limited to a specific one. The similarity calculation unit 491 may calculate a metric that indicates the similarity between two features, such as cosine similarity, where a larger metric value indicates greater similarity between the two features. Alternatively, the similarity calculation unit 491 may calculate a metric that indicates greater similarity between the two features, such as the distance between the two features in the feature space, where a smaller metric value indicates greater similarity between the two features.

[0130] Furthermore, the index used by the similarity calculation unit 491 may be the same as, or different from, the index used by the error induction judgment unit 391 to indicate the similarity of features when the neural network 201 is configured as a feature extraction type AI. The similarity calculation unit 491 may also be configured as part of the error induction judgment unit 391.

[0131] The target selection unit 492 sets one of the classes other than the ground truth class of the base data as the target class, based on the similarity between the features of the base data and the features associated with classes other than the ground truth class of the base data. For example, the similarity calculation unit 491 may calculate an index that shows the similarity between the features of the base data and the features associated with that class for each class other than the ground truth class of the base data. Then, the target selection unit 492 may set the class that shows the highest feature similarity among the classes other than the ground truth class of the base data, according to the index calculated by the target selection unit 492, as the target class. The adversarial sample acquisition unit 192 generates adversarial samples for the base data, using the class set by the target selection unit 492 as the target class.

[0132] Figure 11 shows an example of the procedure for the processing unit 390 to train the neural network 201. Step S301 in Figure 11 is the same as step S101 in Figure 3.

[0133] After step S301, the model execution unit 193 calculates the feature quantities of each base data included in each base data group obtained in step S301 (step S302). If the neural network 201 is configured as a feature extraction AI, the model execution unit 193 may input each base data to the neural network 201 and obtain the features output by the neural network 201. If the neural network 201 is configured as a classification-type AI, the model execution unit 193 may input each base data into the neural network 201 and obtain the features that the neural network 201 calculates for class classification of the base data.

[0134] Steps S303 to S310 are the same as steps S102 to S109 in Figure 3, except for the processing in step S306. The processing of loop L31 in Figure 11 is the same as the processing of loop L11 in Figure 3. The base data group that is the target of processing in loop L31 is also called the target base data group. The processing of loop L32 in Figure 11 is the same as the processing of loop L12 in Figure 3. If the processing unit 490 determines in step S310 that the learning termination condition has not been met (step S310: NO), the process returns to step S302. In this case, the processing unit 490 updates the feature quantities of each base data in step S302 and repeats the processing in loop L31, thereby repeatedly updating the parameter values ​​of the neural network 201. On the other hand, if it is determined that the learning termination condition has been met (step S310: YES), the processing unit 490 terminates the process shown in Figure 11.

[0135] Figure 12 shows an example of the procedure for the processing unit 490 to collect data for updating parameter values ​​based on adversarial samples. In step S306 of Figure 11, the processing unit 490 performs the process shown in Figure 12. Step S401 in Figure 12 is the same as step S211 in Figure 7. The loop that the processing unit 490 starts in step S401 is called loop L41. The base data that is the target of processing in loop L41 is also called the target base data.

[0136] In the processing of loop L41, the similarity calculation unit 491 calculates an index value indicating the similarity between the feature quantities of the target base data and the feature quantities associated with that class for each class other than the correct class of the target base data (step S402). Next, the target selection unit 492 sets one of the classes other than the correct answer class of the target base data as the target class based on the index value calculated by the similarity calculation unit 491 (step S403).

[0137] Steps S404 to S408 are the same as steps S212 to S216 in Figure 7. In step S404, the adversarial sample acquisition unit 192 generates adversarial samples whose target class is the target class set by the target selection unit 492 in step S403. If loop L41 is terminated in step S408, processing unit 490 terminates the process shown in Figure 12.

[0138] As described above, the adversarial sample acquisition unit 192 generates adversarial samples whose target class is one of the classes other than the ground truth class of the base data, based on the similarity between the features of the base data, which are data included in the base data group, and the features associated with classes other than the ground truth class of the base data.

[0139] As a result, the adversarial sample acquisition unit 192 can generate adversarial samples with a relatively high similarity between the features of the base data and the features associated with the target class, and it is expected that the obtained adversarial samples have a relatively high probability of inducing estimation errors using the neural network 201.

[0140] Adversarial samples that are relatively likely to induce estimation errors using neural network 201 can be considered as input data that yields relatively low accuracy in estimation using neural network 201. By training neural network 201 using these adversarial samples, it is expected that training can be performed more efficiently.

[0141] <Fifth Embodiment> In the fifth embodiment, an example of the configuration of the estimation device and neural network during operation using a trained neural network will be described.

[0142] Figure 13 shows an example of the configuration of the estimation device according to the fifth embodiment. In the configuration shown in Figure 13, the estimation device 500 comprises a communication unit 110, a display unit 120, an operation input unit 130, a storage unit 580, and a processing unit 590. The storage unit 580 comprises a model storage unit 581. The model storage unit 581 comprises a common parameter storage unit 182 and an (n+1)th normalization layer parameter storage unit 183-n+1. The processing unit 590 comprises a data acquisition unit 191, a model execution unit 193, and a result output processing unit 591.

[0143] Of the parts of the estimation device 500 shown in Figure 13, those parts that have the same function as the parts of the learning device 101 shown in Figure 1 are denoted by the same reference numerals (110, 120, 130, 182, 183-n+1, ​​191, 193), and detailed explanations are omitted here. In the estimation device 500, the memory unit 580 does not include the first normalization layer parameter memory unit 183-1 to the nth normalization layer parameter memory unit 183-n, which are among the parts of the memory unit 180 of the learning device 101. Also, in the estimation device 500, the processing unit 590 does not include the adversarial sample acquisition unit 192 and its parts, and the parameter update unit 194, which are among the parts of the processing unit 190 of the learning device 101, but it does include a result output processing unit 591. In all other respects, the estimation device 500 is the same as the learning device 101.

[0144] Figure 14 shows an example of a neural network stored in the model memory unit 581. The neural network 202 shown in Figure 14 lacks the first normalization layer 230-1 to the nth normalization layer 230-n of the neural network 201 shown in Figure 2. In all other respects, the neural network 202 is the same as the neural network 201.

[0145] Of the parts of the neural network 202 shown in Figure 14, those parts that have the same function as the parts of the neural network 201 shown in Figure 2 are given the same code (210, 221, 222, 223, 230-n+1, ​​240, 250), and a detailed explanation is omitted here.

[0146] Since neural network 202 does not perform learning, the first normalization layer 230-1 to the nth normalization layer 230-n, which were provided in neural network 201 to perform learning in response to differences in the distribution of input data, are not included. The neural network 202 receives data as input and outputs the result of its estimation for the input data.

[0147] The neural network 202 may be configured as a classification AI or as a feature extraction AI. When configured as a classification AI, the neural network 202 receives data as input and outputs an estimated result of the class of that data. When configured as a feature extraction AI, the neural network 202 receives data as input and outputs the features of that data.

[0148] Since the neural network 202 does not have the first normalization layer 230-1 to the nth normalization layer 230-n, the model storage unit 581 of the estimation device 500 also does not have the first normalization layer parameter storage unit 183-1 to the nth normalization layer parameter storage unit 183-n. Furthermore, since the estimation device 500 does not perform neural network training, it does not include the adversarial sample acquisition unit 192, which acquires adversarial samples to be used as training data, and the parameter update unit 194, which updates parameter values, which are among the components of the learning device 101.

[0149] In the estimation device 500, the data acquisition unit 191 acquires input data for the neural network 202. The model execution unit 193 inputs the data acquired by the data acquisition unit 191 into the neural network 202 and obtains estimation results using the neural network 202.

[0150] The result output processing unit 591 outputs the obtained estimation results. The method by which the result output processing unit 591 outputs the estimation results is not limited to a specific method. For example, the result output processing unit 591 may output the estimation results by displaying them on the display unit 120. Alternatively, the result output processing unit 591 may transmit the estimation results to another device via the communication unit 110.

[0151] Alternatively, the neural network 201 shown in Figure 2 may be used during operation.

[0152] The estimation device 500 can be used for various estimations. For example, the estimation device 500 may be configured to perform biometric authentication such as facial recognition, fingerprint recognition, or voiceprint recognition. In this case, the estimation device 500 may attempt to classify the input data into one of the registered person classes, thereby either authenticating the person indicated by the input data as one of the registered persons, or failing to authenticate them. Alternatively, the estimation device 500 may extract features from the input data, compare their similarity to the features of the data of a specified person, and determine whether the person indicated by the input data and the specified person are the same person. Alternatively, the estimation device 500 may be used in devices for purposes other than biometric authentication, such as devices that perform various predictions.

[0153] <Sixth Embodiment> Figure 15 shows an example of the configuration of a learning device according to the sixth embodiment. In the configuration shown in Figure 15, the learning device 610 includes a data acquisition unit 611, an adversarial sample acquisition unit 612, and a parameter update unit 613. In this configuration, the data acquisition unit 611 acquires a base data group, which is a group containing multiple data points. The adversarial sample acquisition unit 612 acquires an adversarial data group for each adversarial sample generation condition, using the data included in the base data group, which is a group containing two or more adversarial samples generated under that condition.

[0154] The parameter update unit 613 updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the entire subset data group for the neural network, using the base data group. It also updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples included in that adversarial data group were generated, using each of the adversarial data groups. The neural network here includes subset networks, a normalization layer associated with the entire subset data group, and a normalization layer associated with each condition for generating adversarial samples. Each of these normalization layers performs normalization on the data input to the normalization layer using the mean and variance values ​​set for each normalization layer.

[0155] The data acquisition unit 611 is an example of data acquisition means. The adversarial sample acquisition unit 612 is an example of adversarial sample acquisition means. The parameter update unit 613 is an example of parameter update means.

[0156] Thus, the neural network is equipped with a normalization layer for each condition of adversarial sample generation, and the learning device 610 learns the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with each condition of adversarial sample generation using the adversarial data group that includes the adversarial samples generated under that condition. In this respect, the learning device 610 makes it possible to reflect the diversity of adversarial samples in the learning process when adversarial samples are used to train the neural network.

[0157] Here, adversarial samples can be considered as inputs that are prone to errors in neural networks, created by small perturbations. Therefore, adversarial samples can be used to train neural networks with the aim of improving their accuracy. In other words, adversarial samples can be used as training data to compensate for the weaknesses of neural networks by training them to be able to make correct estimations on data that is prone to errors.

[0158] Furthermore, to effectively train a neural network, it is possible to adjust the data distribution by adding a normalization layer, such as batch normalization. When using both a base data group and an adversarial data group for training a neural network, the data distribution differs between the two groups. Therefore, it is possible to improve the efficiency of training by adding a normalization layer to each group.

[0159] Furthermore, the learning device 610 trains the neural network using the base data group and adversarial data groups for each condition of adversarial sample generation. The distribution of adversarial samples included in the adversarial data group differs depending on the condition of adversarial sample generation.

[0160] The learning device 610 learns the parameter values ​​of the common part and the parameter values ​​of the normalization layer for each condition of adversarial sample generation. This allows the neural network to be trained in response to differences in data distribution corresponding to the diversity of adversarial samples, and is expected to enable efficient learning.

[0161] The data acquisition unit 611 can be implemented using, for example, the functions of the data acquisition unit 191 in Figure 1. The adversarial sample acquisition unit 612 can be implemented using, for example, the functions of the adversarial sample acquisition unit 192 in Figure 1. The parameter update unit 613 can be implemented using, for example, the functions of the parameter update unit 194 in Figure 1.

[0162] <Seventh Embodiment> Figure 16 shows an example of the processing steps in the learning method according to the seventh embodiment. The learning method shown in Figure 16 includes acquiring data (step S611), acquiring adversarial samples (step S612), and updating parameter values ​​(step S613).

[0163] In acquiring data (step S611), the computer acquires a base data group, which is a group containing multiple data points. In acquiring adversarial samples (step S612), the computer acquires adversarial data groups for each condition for generating adversarial samples, using the data contained in the base data group, which are groups containing two or more adversarial samples generated under that condition.

[0164] In updating parameter values ​​(step S613), the computer includes a subset network, a normalization layer associated with the entire base data group, and a normalization layer associated with each condition for generating adversarial samples. Each of these normalization layers performs normalization on the data input to the normalization layer using the mean and variance values ​​set for each normalization layer. The computer updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the entire base data group using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples in that adversarial data group were generated using each of the adversarial data groups.

[0165] Thus, the neural network has a normalization layer for each condition of adversarial sample generation. In the learning method shown in Figure 16, for each condition of adversarial sample generation, the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with that condition are learned using the adversarial data group containing the adversarial samples generated under that condition. In this respect, the learning method shown in Figure 16 allows the diversity of adversarial samples to be reflected in the learning process when adversarial samples are used to train the neural network.

[0166] Here, adversarial samples can be considered as inputs that are prone to errors in neural networks, created by small perturbations. Therefore, adversarial samples can be used to train neural networks with the aim of improving their accuracy. In other words, adversarial samples can be used as training data to compensate for the weaknesses of neural networks by training them to be able to make correct estimations on data that is prone to errors.

[0167] Furthermore, to effectively train a neural network, it is possible to adjust the data distribution by adding a normalization layer, such as batch normalization. When using both a base data group and an adversarial data group for training a neural network, the data distribution differs between the two groups. Therefore, it is possible to improve the efficiency of training by adding a normalization layer to each group.

[0168] Furthermore, in the learning method shown in Figure 16, the neural network is trained using the base data group and adversarial data groups for each condition of adversarial sample generation. The distribution of adversarial samples included in the adversarial data group differs depending on the condition of adversarial sample generation.

[0169] The learning method shown in Figure 16 learns the common parameter values ​​and the normalization layer parameter values ​​for each condition of adversarial sample generation. This allows the neural network to be trained in response to differences in data distribution corresponding to the diversity of adversarial samples, and is expected to enable efficient learning.

[0170] Figure 17 is a schematic block diagram showing the configuration of a computer according to at least one embodiment. In the configuration shown in Figure 17, the computer 700 comprises a CPU 710, a main memory 720, an auxiliary memory 730, an interface 740, and a non-volatile recording medium 750.

[0171] One or more of the above-mentioned learning devices 101, 102, 300, 400, estimation device 500, and 610, or a part thereof, may be implemented in the computer 700. In that case, the operation of each processing unit described above is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, expands it in the main memory 720, and executes the above processing according to the program. The CPU 710 also allocates memory areas in the main memory 720 corresponding to each of the above-mentioned memory units according to the program. Communication between each device and other devices is performed by the interface 740 having a communication function and performing communication according to the control of the CPU 710. The interface 740 also has a port for the non-volatile recording medium 750 and reads information from the non-volatile recording medium 750 and writes information to the non-volatile recording medium 750.

[0172] When the learning device 101 is implemented in the computer 700, the operation of the processing unit 190 and each of its parts is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processing according to the program.

[0173] Furthermore, the CPU 710 reserves memory areas for the memory unit 180 and each of its components in the main memory 720 according to the program. Communication with other devices by the communication unit 110 is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Display of images by the display unit 120 is performed by the interface 740 being equipped with a display device and displaying various images under the control of the CPU 710. Acceptance of user operations by the operation input unit 130 is performed by the interface 740 being equipped with an input device and accepting user operations under the control of the CPU 710.

[0174] When the learning device 102 is implemented in the computer 700, the operation of the processing unit 170 and each of its parts is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processing according to the program.

[0175] Furthermore, the CPU 710 reserves memory areas for the memory unit 180 and each of its components in the main memory 720 according to the program. Communication with other devices by the communication unit 110 is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Display of images by the display unit 120 is performed by the interface 740 being equipped with a display device and displaying various images under the control of the CPU 710. Acceptance of user operations by the operation input unit 130 is performed by the interface 740 being equipped with an input device and accepting user operations under the control of the CPU 710.

[0176] When the learning device 300 is implemented in the computer 700, the operation of the processing unit 390 and each of its parts is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processing according to the program.

[0177] Furthermore, the CPU 710 reserves memory areas for the memory unit 180 and each of its components in the main memory 720 according to the program. Communication with other devices by the communication unit 110 is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Display of images by the display unit 120 is performed by the interface 740 being equipped with a display device and displaying various images under the control of the CPU 710. Acceptance of user operations by the operation input unit 130 is performed by the interface 740 being equipped with an input device and accepting user operations under the control of the CPU 710.

[0178] When the learning device 400 is implemented in the computer 700, the operation of the processing unit 490 and each of its parts is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processing according to the program.

[0179] Furthermore, the CPU 710 reserves memory areas for the memory unit 180 and each of its components in the main memory 720 according to the program. Communication with other devices by the communication unit 110 is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Display of images by the display unit 120 is performed by the interface 740 being equipped with a display device and displaying various images under the control of the CPU 710. Acceptance of user operations by the operation input unit 130 is performed by the interface 740 being equipped with an input device and accepting user operations under the control of the CPU 710.

[0180] When the estimation device 500 is implemented in the computer 700, the operation of the processing unit 590 and each of its parts is stored in auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processing according to the program.

[0181] Furthermore, the CPU 710 reserves memory areas for the memory unit 580 and each of its components in the main memory 720 according to the program. Communication with other devices by the communication unit 110 is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Display of images by the display unit 120 is performed by the interface 740 being equipped with a display device and displaying various images under the control of the CPU 710. Acceptance of user operations by the operation input unit 130 is performed by the interface 740 being equipped with an input device and accepting user operations under the control of the CPU 710.

[0182] When the learning device 610 is implemented in the computer 700, the operations of the data acquisition unit 611, the adversarial sample acquisition unit 612, and the parameter update unit 613 are stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processes according to the program.

[0183] Furthermore, the CPU 710 reserves memory in the main memory 720 for the learning device 610 to process according to the program. Communication between the learning device 610 and other devices is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the learning device 610 and the user is performed by the interface 740 having input and output devices, presenting information to the user via the output device and accepting user input via the input device under the control of the CPU 710.

[0184] One or more of the above-mentioned programs may be recorded on the non-volatile recording medium 750. In this case, the interface 740 may read the program from the non-volatile recording medium 750. The CPU 710 may then either directly execute the program read by the interface 740, or temporarily save it in the main memory 720 or auxiliary memory 730 before executing it.

[0185] Alternatively, programs for executing all or part of the processing performed by learning devices 101, 102, 300, 400, 500, and 610 may be recorded on a computer-readable recording medium, and the programs recorded on this recording medium may be loaded into a computer system and executed to perform the processing of each part. The term "computer system" here includes hardware such as an operating system (OS) and peripheral devices. Furthermore, "computer-readable recording media" refers to portable media such as flexible disks, magneto-optical disks, ROMs (Read Only Memory), CD-ROMs (Compact Disc Read Only Memory), and storage devices such as hard disks built into computer systems. The above-mentioned program may be intended to implement only a part of the functions described above, and may also be able to implement the above-mentioned functions in combination with programs already recorded in the computer system.

[0186] Although embodiments of this invention have been described in detail above with reference to the drawings, the specific configuration is not limited to these embodiments and includes designs and the like that do not depart from the spirit of this invention.

[0187] Some or all of the above embodiments may also be described as follows, but are not limited to the following:

[0188] (Note 1) A data acquisition means for acquiring a base data group which is a group containing multiple data, Adversarial sample acquisition means, for each condition for generating adversarial samples, acquires an adversarial data group that is a group containing two or more adversarial samples generated under that condition, using the data included in the base data group. The normalization network includes a subset network, a normalization layer associated with the entire base data group, and a normalization layer associated with each condition for generating adversarial samples, each of which is a neural network that normalizes the data input to the normalization layer using the mean and variance values ​​set for each normalization layer. The normalization network includes a parameter update means that updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the entire base data group using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples included in that adversarial data group were generated using each of the adversarial data groups. A learning device equipped with the following features.

[0189] (Note 2) The conditions for generating the adversarial samples include the number of target class adversarial samples. The learning device described in Appendix 1.

[0190] (Note 3) The neural network is further provided with error induction determination means for determining whether or not the data input to the neural network induces an estimation error using the neural network. The parameter update means updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples in the adversarial data group were generated, using adversarial samples from the adversarial data group that are determined to induce estimation errors using the neural network, for each adversarial data group. A learning device as described in Appendix 1 or Appendix 2.

[0191] (Note 4) The aforementioned neural network receives data as input and performs classification of that data. The error induction determination means determines that if the neural network classifies an input adversarial sample into a class different from the class designated as the correct class for that adversarial sample, that adversarial sample induces an estimation error using the neural network. The learning device described in Appendix 3.

[0192] (Note 5) The aforementioned neural network receives data as input and performs classification of that data. The error induction determination means determines that if the neural network classifies the input adversarial sample into a class designated as the target class of that adversarial sample, that adversarial sample induces an estimation error using the neural network. The learning device described in Appendix 3.

[0193] (Note 6) The aforementioned neural network receives data as input and extracts the features of that data. The error induction determination means calculates the similarity between the features extracted by the neural network from the input adversarial sample and the features associated with the target class of that adversarial sample. If the calculated similarity is greater than or equal to a predetermined threshold, it determines that the adversarial sample induces an estimation error using the neural network. The learning device described in Appendix 3.

[0194] (Note 7) The adversarial sample acquisition means generates adversarial samples whose target class is one of the classes other than the ground truth class of the base data, based on the similarity between the features of the base data, which are data included in the base data group, and the features associated with classes other than the ground truth class of the base data. A learning device described in any one of the appendices 1 through 6.

[0195] (Note 8) Computers Obtain the base data group, which is a group containing multiple data points. For each condition for generating adversarial samples, an adversarial data group is obtained using the data included in the base data group, which is a group containing two or more adversarial samples generated under that condition. The normalization network includes a subset network, a normalization layer associated with the entire base data group, and a normalization layer associated with each condition for generating adversarial samples, each of which normalization layers normalizes the data input to itself using the mean and variance values ​​set for each normalization layer, updating the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the entire base data group using the base data group, and updating the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples included in that adversarial data group were generated using each of the adversarial data groups. A learning method that includes this.

[0196] (Note 9) On the computer, Obtaining a base data group, which is a group containing multiple data points, For each condition for generating adversarial samples, an adversarial data group is obtained using the data included in the base data group, which is a group containing two or more adversarial samples generated under that condition. The neural network includes a subset network, a normalization layer associated with the entire base data group, and a normalization layer associated with each condition for generating adversarial samples, each of which normalization layers normalizes the data input to itself using the mean and variance values ​​set for each normalization layer. The neural network updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the entire base data group using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples included in that adversarial data group were generated using each of the adversarial data groups. A program to execute. [Explanation of Symbols]

[0197] 101, 102, 300, 400, 610 Learning Devices 110 Communications Department 120 Display section 130 Operation Input Section 170, 190, 390, 490, 590 Processing Unit 171, 192, 612 Adversarial sample acquisition unit 180, 580 storage section 181 Model Memory Unit 182 Common Parameter Storage Unit 183 Normalization layer parameter storage unit 191, 611 Data acquisition unit 193 Model Execution Unit 194, 392, 613 Parameter update section 201, 202 Neural Networks 210 Input Layers 221 Convolutional Layer 222 Activation layer 223 Pooling layer 230 Normalization layer 240 fully connected layer 250 output layers 391 Error Inducement Detection Unit 491 Similarity calculation unit 492 Target Selection Unit 500 Estimator 591 Result Output Processing Unit

Claims

1. A data acquisition means for acquiring a base data group which is a group containing multiple data, Adversarial sample acquisition means, for each condition for generating adversarial samples, acquires an adversarial data group which is a group containing two or more adversarial samples generated under that condition, using the data included in the base data group. The normalization network includes a subset network, a normalization layer associated with the entire base data group, and a normalization layer associated with each condition for generating adversarial samples, each of which is a neural network that normalizes the data input to the normalization layer using the mean and variance values ​​set for each normalization layer. The normalization network includes a parameter update means that updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the entire base data group using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples included in that adversarial data group were generated using each of the adversarial data groups. A learning device equipped with the following features.

2. The conditions for generating the adversarial samples include the number of target class adversarial samples. The learning device according to claim 1.

3. The neural network is further provided with error induction determination means for determining whether or not the data input to the neural network induces an estimation error using the neural network. The parameter update means updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples in the adversarial data group were generated, using adversarial samples from the adversarial data group that are determined to induce estimation errors using the neural network, for each adversarial data group. A learning device according to claim 1 or claim 2.

4. The aforementioned neural network receives data as input and performs classification of that data. The error induction determination means determines that if the neural network classifies an input adversarial sample into a class different from the class designated as the correct class for that adversarial sample, that adversarial sample induces an estimation error using the neural network. The learning device according to claim 3.

5. The aforementioned neural network receives data as input and performs classification of that data. The error induction determination means determines that if the neural network classifies the input adversarial sample into a class designated as the target class of that adversarial sample, that adversarial sample induces an estimation error using the neural network. The learning device according to claim 3.

6. The aforementioned neural network receives data as input and extracts the features of that data. The error induction determination means calculates the similarity between the features extracted by the neural network from the input adversarial sample and the features associated with the target class of that adversarial sample. If the calculated similarity is greater than or equal to a predetermined threshold, it determines that the adversarial sample induces an estimation error using the neural network. The learning device according to claim 3.

7. The adversarial sample acquisition means generates adversarial samples whose target class is one of the classes other than the ground truth class of the base data, based on the similarity between the features of the base data, which are data included in the base data group, and the features associated with classes other than the ground truth class of the base data. The learning device according to claim 1.

8. Computers Obtain the base data group, which is a group containing multiple data points. For each condition for generating adversarial samples, an adversarial data group is obtained using the data included in the base data group, which is a group containing two or more adversarial samples generated under that condition. The normalization network includes a subset network, a normalization layer associated with the entire base data group, and a normalization layer associated with each condition for generating adversarial samples, each of which normalization layers normalizes the data input to itself using the mean and variance values ​​set for each normalization layer, updating the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the entire base data group using the base data group, and updating the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples included in that adversarial data group were generated using each of the adversarial data groups. A learning method that includes this.

9. On the computer, Obtaining a base data group, which is a group containing multiple data points, For each condition for generating adversarial samples, an adversarial data group is obtained using the data included in the base data group, which is a group containing two or more adversarial samples generated under that condition. The neural network includes a subset network, a normalization layer associated with the entire base data group, and a normalization layer associated with each condition for generating adversarial samples, each of which normalization layers normalizes the data input to itself using the mean and variance values ​​set for each normalization layer. The neural network updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the entire base data group using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the normalization layer associated with the conditions under which the adversarial samples included in that adversarial data group were generated using each of the adversarial data groups. A program to execute.

Images