Learning device, learning method, and program

Abstract

To take accuracy of adversarial samples into account when the adversarial samples are used for training of a neural network.SOLUTION: A neural network includes a partial network, a first normalization layer, and a second normalization layer. The first normalization layer normalizes data input thereto. The second normalization layer normalizes data input thereto. A learning device uses base data group, which is a group including multiple pieces of data, to update a parameter value of the partial network and a parameter value of the second normalization layer, and uses an adversarial sample determined to induce an error in estimation using the neural network, out of adversarial samples included in an adversarial data group, which is a group including multiple adversarial samples with respect to the data included in the base data group, to update the parameter value of the partial network and a parameter value of the first normalization layer.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a learning device, a learning method, and a program. [Background Art]

[0002] Adversarial Examples (AX) are sometimes used for neural network learning (see, for example, Patent Document 1). [Prior Art Literature] [Patent Literature]

[0003] [Patent Document 1] Japanese Unexamined Patent Publication No. 2021-005138 [Summary of the Invention] [Problem to be Solved by the Invention]

[0004] When an adversarial sample is used for neural network learning, it is preferable that the accuracy of the adversarial sample is taken into consideration.

[0005] An example of the object of the present invention is to provide a learning device, a learning method, and a program that can solve the above-described problem. [Means for Solving the Problem]

[0006] According to a first aspect of the present invention, the learning device includes a data acquisition means for acquiring a base data group which is a group containing multiple data; an adversarial sample acquisition means for acquiring an adversarial data group which is a group containing multiple adversarial samples for the data included in the base data group acquired by the data acquisition means; a subset network; a first normalization layer; and a second normalization layer, wherein the first normalization layer normalizes the data input to itself using a first mean and a first variance, and the second normalization layer normalizes the data input to itself using a second mean and a second variance. The neural network that performs normalization includes error induction determination means that determines whether the data input to the neural network induces an estimation error, and parameter update means that updates the parameter values ​​of the subset network and the parameter values ​​of the second normalization layer using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer using adversarial samples from the adversarial data group that are determined to induce an estimation error using the neural network.

[0007] According to a second aspect of the present invention, the learning method includes a computer acquiring a base data group which is a group containing multiple data, acquiring an adversarial data group which is a group containing multiple adversarial samples for the data included in the acquired base data group, a neural network including a subset network, a first normalization layer and a second normalization layer, wherein the first normalization layer normalizes the data input to the first normalization layer using a first mean and a first variance, and the second normalization layer normalizes the data input to the second normalization layer using a second mean and a second variance, determining whether the data induces an estimation error using the neural network when data is input to the neural network, updating the parameter values ​​of the subset network and the parameter values ​​of the second normalization layer using the base data group, and updating the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer using adversarial samples from the adversarial data group that are determined to induce an estimation error using the neural network.

[0008] According to a third aspect of the present invention, the program is a program that causes a computer to perform the following actions: acquire a base data group which is a group containing multiple data; acquire an adversarial data group which is a group containing multiple adversarial samples for the data included in the acquired base data group; a subset network which includes a first normalization layer and a second normalization layer, wherein the first normalization layer normalizes the data input to the first normalization layer using a first mean and a first variance, and the second normalization layer normalizes the data input to the second normalization layer using a second mean and a second variance, and when data is input to the neural network which includes a subset network which includes a first normalization layer and a second normalization layer, the program determines whether the data induces an estimation error using the neural network; update the parameter values ​​of the subset network and the parameter values ​​of the second normalization layer using the base data group; and update the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer using adversarial samples from the adversarial data group which are determined to induce an estimation error using the neural network. [Effects of the Invention]

[0009] According to the present invention, when adversarial samples are used in training a neural network, the accuracy of the adversarial samples can be taken into consideration. [Brief explanation of the drawing]

[0010] [Figure 1] This figure shows an example of the configuration of a learning device according to the first embodiment. [Figure 2] This figure shows an example of a neural network stored in the model storage unit according to the first embodiment. [Figure 3] This figure shows an example of the procedure for the processing unit according to the first embodiment to perform neural network training. [Figure 4] This figure shows an example of the procedure for the processing unit according to the first embodiment to collect data for updating parameter values ​​based on adversarial samples. [Figure 5] This figure shows an example of the procedure for a learning device to collect data for updating parameter values ​​based on adversarial samples, when the neural network according to the first embodiment is configured as a classification-type AI. [Figure 6] This figure shows an example of the procedure for a learning device to collect data for updating parameter values ​​based on adversarial samples, when the neural network according to the first embodiment is configured as a feature extraction type AI. [Figure 7] This figure shows an example of the configuration of a learning device according to the second embodiment. [Figure 8] This figure shows an example of the procedure for the processing unit according to the second embodiment to perform neural network training. [Figure 9] This figure shows an example of the procedure for the processing unit according to the second embodiment to collect data for updating parameter values ​​based on adversarial samples. [Figure 10] This figure shows an example of the configuration of the estimation device according to the third embodiment. [Figure 11] This figure shows an example of a neural network stored in the model storage unit according to the third embodiment. [Figure 12] This figure shows an example of the configuration of a learning device according to the fourth embodiment. [Figure 13] This figure shows an example of the processing procedure in the learning method according to the fifth embodiment. [Figure 14] This is a schematic block diagram showing the configuration of a computer according to at least one embodiment. [Modes for carrying out the invention]

[0011] The following describes embodiments of the present invention, but these embodiments are not intended to limit the scope of the claims. Furthermore, not all combinations of features described in the embodiments are necessarily essential to the solution of the invention.

[0012] <First Embodiment> FIG. 1 is a diagram illustrating an example configuration of a learning apparatus according to a first embodiment. In the configuration shown in FIG. 1, the learning apparatus 100 includes a communication unit 110, a display unit 120, an operation input unit 130, a storage unit 180, and a processing unit 190. The storage unit 180 includes a model storage unit 181. The model storage unit 181 includes a common parameter storage unit 182, a first normalization layer parameter storage unit 183-1, and a second normalization layer parameter storage unit 183-2. The processing unit 190 includes a data acquisition unit 191, an adversarial sample acquisition unit 192, a model execution unit 193, an error induction determination unit 194, and a parameter update unit 195.

[0013] The learning apparatus 100 performs learning of a neural network. The learning apparatus 100 may be configured using a computer such as a personal computer (PC) or a workstation (WS), for example.

[0014] The communication unit 110 communicates with other apparatuses. For example, the communication unit 110 may be configured to receive data for neural network learning from another apparatus. Further, for example, the communication unit 110 may be configured to receive, from another apparatus, data in which data to be input to a neural network is associated with a class into which the data is classified.

[0015] The display unit 120 has a display screen such as a liquid crystal panel or an LED (Light Emitting Diode) panel, and displays various images. For example, the display unit 120 may be configured to display information related to neural network learning, such as the progress of neural network learning.

[0016] The operation input unit 130 is configured including input devices such as a keyboard and a mouse, for example, and accepts user operations. For example, the operation input unit 130 may be configured to accept user operations related to neural network learning, such as an input operation for a termination condition of neural network learning.

[0017] The memory unit 180 stores various types of data. The memory unit 180 is configured using the memory devices provided by the learning device 100. The model memory unit 181 stores a neural network as a machine learning model. Figure 2 shows an example of a neural network stored in the model memory unit 181. The neural network 201 shown in Figure 2 is configured as a type of convolutional neural network (CNN) and includes an input layer 210, a convolutional layer 221, an activation layer 222, a pooling layer 223, a first normalization layer 230-1, a second normalization layer 230-2, a fully connected layer 240, and an output layer 250. The first normalization layer 230-1 and the second normalization layer 230-2 are collectively referred to as the normalization layer 230.

[0018] In the example shown in Figure 2, the data flow is arranged in the following order from upstream: input layer 210, convolutional layer 221, activation layer 222, and pooling layer 223, with one or more combinations of these layers being arranged in that order. Downstream from there, a fully connected layer 240 and an output layer 250 are provided. Furthermore, in each combination of the convolutional layer 221, the activation layer 222, and the pooling layer 223, a first normalization layer 230-1 and a second normalization layer 230-2 are arranged in parallel between the activation layer 222 and the pooling layer 223. The number of channels in a neural network 201 is not limited to a specific number.

[0019] All channel data from the activation layer 222 is input to both the first normalization layer 230-1 and the second normalization layer 230-2. Alternatively, the activation layer 222 may selectively output data to either the first normalization layer 230-1 or the second normalization layer 230-2.

[0020] The data output by the first normalization layer 230-1 and the data output by the second normalization layer 230-2 are combined for the same channel and input to the pooling layer 223. For example, the sum of the data output by the first normalization layer 230-1 and the data output by the second normalization layer 230-2 may be input to the pooling layer 223. Alternatively, the average of the data output by the first normalization layer 230-1 and the data output by the second normalization layer 230-2 may be input to the pooling layer 223. Alternatively, if only one of the first normalization layer 230-1 or the second normalization layer 230-2 acquires data from the activation layer 222, only the normalization layer 230 that acquired the data may output the data to the pooling layer 223.

[0021] Of the various parts of the neural network 201, the parts other than the first normalization layer 230-1 and the second normalization layer 230-2 are also called the common part or subset network. In the example in Figure 2, the combination of the input layer 210, the convolutional layer 221, the activation layer 222, the pooling layer 223, the fully connected layer 240, and the output layer 250 is an example of the common part.

[0022] The input layer 210 receives input data for the neural network 201. The convolutional layer 221 performs a convolution operation on the data input to itself. The convolutional layer 221 may also perform padding to adjust the data size. The activation layer 222 applies an activation function to the data input to itself. The activation function used by the activation layer 222 is not limited to a specific function. For example, a Rectified Linear Function (ReLU) may be used as the activation function, but is not limited to this. The pooling layer 223 performs pooling on the data input to itself.

[0023] The first normalization layer 230-1 normalizes the data it receives as input. This normalization is the same as that used in batch normalization, where the first normalization layer 230-1 transforms the data so that the mean and variance of the data in a given group are predetermined values. For example, to set the mean of a group of data to 0 and the variance to 1, the first normalization layer 230-1 calculates the mean and variance of the data in the group to be normalized, subtracts the mean from each data point, and then divides the resulting value by the variance.

[0024] The mean after normalization by the first normalization layer 230-1 is not limited to 0, and the variance is not limited to 1. For example, if α is a real number and β is a positive real number, the first normalization layer 230-1 may be configured to normalize so that the group mean becomes α and the variance becomes β. Furthermore, these values ​​of α and β may be the subject of learning. The values ​​of α and β may be set by learning for each first normalization layer 230-1.

[0025] The mean value of the target group for the first normalized layer 230-1 is also called the first mean. The variance value of the target group for the first normalized layer 230-1 is also called the first variance. The first mean and first variance correspond to examples of parameter values ​​for the first normalized layer 230-1. The parameter that indicates the first mean is also called the first mean. The parameter that indicates the first variance is also called the first variance.

[0026] When data for multiple channels is input to the first normalization layer 230-1, the first normalization layer 230-1 may perform data normalization for all data included in one group and for all channels. Alternatively, the first normalization layer 230-1 may perform data normalization for each channel.

[0027] The second normalization layer 230-2 normalizes the data input to itself. The normalization process performed by the second normalization layer 230-2 is the same as the normalization process performed by the first normalization layer 230-1 described above. The mean value of the target group for the second normalized layer 230-2 is also called the second mean. The variance value of the target group for the second normalized layer 230-2 is also called the second variance value. The second mean and second variance value are examples of parameter values ​​for the second normalized layer 230-2. The parameter that indicates the second mean is also called the second mean. The parameter that indicates the second variance value is also called the second variance. As will be described later, the data used for learning the parameter values ​​differs between the first normalization layer 230-1 and the second normalization layer 230-2.

[0028] The fully connected layer 240 converts the data it receives as input into data corresponding to the output data of the neural network 201. The output layer 250 outputs the output data from the neural network 201. For example, the output layer 250 may apply an activation function such as a softmax function to the data from the fully connected layer 240 before outputting it.

[0029] Alternatively, the fully connected layer 240 may generate the output data for the neural network 201, and the output layer 250 may output the data from the fully connected layer 240 as is. In this case, the fully connected layer 240 may also function as the output layer 250, outputting the data directly to the outside of the neural network 201.

[0030] However, the configuration of the machine learning model stored in the model storage unit 181 is not limited to a specific configuration. For example, when the model memory unit 181 stores a convolutional neural network as a machine learning model, the configuration and number of layers in the convolutional neural network can be varied. For instance, the configuration of the machine learning model stored by the model memory unit 181 may be a combination of the convolutional layer 221, activation layer 222, and pooling layer 223 included in the neural network 201 in the example of Figure 2, but without the activation layer 222.

[0031] Furthermore, the location where the combination of the first normalization layer 230-1 and the second normalization layer 230-2 is provided is not limited to a specific location. For example, the combination of the first normalization layer 230-1 and the second normalization layer 230-2 may be provided only for some of the combinations of the convolutional layer 221, the activation layer 222, and the pooling layer 223. The machine learning model stored in the model memory unit 181 may be configured such that, instead of a convolutional neural network with a batch normalization layer, the number of batch normalization layers is reduced to two and they are arranged in parallel. However, the machine learning model stored in the model memory unit 181 is not limited to convolutional neural networks, but can be any neural network to which normalization by the first normalization layer 230-1 and the second normalization layer 230-2 can be applied.

[0032] Furthermore, the implementation method of the neural network to be trained by the learning device 100 is not limited to the method by which the model storage unit 181 stores the neural network. For example, the neural network to be trained by the learning device 100 may be implemented in hardware, such as by using an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array). The neural network to be trained by the learning device 100 may be configured as part of the learning device 100, or it may be configured as an external component of the learning device 100.

[0033] The common parameter storage unit 182 stores the parameter values ​​of the common parts. The common parameter storage unit 182 stores the values ​​of various parameters that are the target of learning, such as the parameters of the filters for convolution operations in the convolutional layer and the activation function in the activation layer. The parameter values ​​of the common parts are also called common parameter values.

[0034] The first normalization layer parameter storage unit 183-1 stores the parameter values ​​for each first normalization layer 230-1. The first normalization layer parameter storage unit 183-1 stores the values ​​of various parameters to be learned, such as the first mean and the first variance. The second normalization layer parameter storage unit 183-2 stores the parameter values ​​for each second normalization layer 230-2. The second normalization layer parameter storage unit 183-2 stores the values ​​of various parameters that are the target of learning, such as the second mean and the second variance.

[0035] The processing unit 190 controls various parts of the learning device 100 to perform various processes. The functions of the processing unit 190 are performed, for example, by the CPU (Central Processing Unit) of the learning device 100 reading a program from the storage unit 180 and executing it.

[0036] The data acquisition unit 191 acquires groups of data that include multiple data points to which information indicating the correct class in classification is associated with the data to be input to the neural network 201. The data acquisition unit 191 is an example of a data acquisition means. The data acquired by the data acquisition unit 191 to be used as input to the neural network 201 is also called the base data. A group of base data is also called a base data group. The number of base data groups acquired by the data acquisition unit 191 can be one or more, and is not limited to a specific number. When the data acquisition unit 191 acquires multiple base data groups, the number of base data elements in each group may be the same or different.

[0037] The data acquisition unit 191 may also acquire base data from other devices via the communication unit 110. Alternatively, the data acquisition unit 191 may acquire base data from other devices in the form of base data groups. Or, the data acquisition unit 191 may acquire base data from other devices and group them into base data groups.

[0038] The adversarial sample acquisition unit 192 acquires an adversarial data group, which is a group containing multiple adversarial samples for data included in the base data group acquired by the data acquisition unit 191. In this context, an adversarial sample for a given data is an adversarial sample to which an adversarial perturbation has been added. The adversarial sample acquisition unit 192 is an example of an adversarial sample acquisition means. The adversarial sample acquisition unit 192 may generate adversarial samples by applying an adversarial sample generation method to the base data acquired by the data acquisition unit 191. Alternatively, the adversarial sample acquisition unit 192 may acquire adversarial samples from a device that generates adversarial samples via the communication unit 110.

[0039] The number of adversarial samples in an adversarial data group may be the same as or different from the number of base data in the base data group. When the adversarial sample acquisition unit 192 generates adversarial samples from the base data, it may generate one adversarial sample from each of the base data included in one base data group and combine them into one adversarial data group. Alternatively, the adversarial sample acquisition unit 192 may generate one adversarial sample from some of the base data included in one base data group and combine them into one adversarial data group. Alternatively, the adversarial sample acquisition unit 192 may generate adversarial samples from the base data included in each of multiple base data groups and combine them into one adversarial data group. The adversarial sample acquisition unit 192 may be configured to generate multiple adversarial samples from a single base data set.

[0040] The model execution unit 193 executes the machine learning model stored in the model storage unit 181. Specifically, the model execution unit 193 inputs data into the neural network 201 and calculates the output data of the neural network 201. The calculation of output data by the neural network 201 is also called estimation using the neural network 201, or simply estimation.

[0041] The neural network 201 may be configured to output an estimated result of the class to be classified as an input. In this case, the neural network is also called a classification AI. Alternatively, the neural network 201 may be configured to output features from the input data. This type of neural network is also called a feature extraction AI.

[0042] The error induction determination unit 194 determines whether the input data to the neural network 201 induces an error in estimation using the neural network 201. The error induction determination unit 194 is an example of an error induction determination means. If the neural network 201 is configured as a classification-type AI, the error induction determination unit 194 may determine that the input data has induced an estimation error using the neural network 201 when the estimated class output by the neural network 201 differs from the correct class associated with the input data to the neural network 201.

[0043] Alternatively, if the neural network 201 is configured as a classification-type AI, the error induction determination unit 194 may determine that the input data has induced an error in estimation using the neural network 201 when the class estimation result output by the neural network 201 indicates the target class of the adversarial sample which is the input data.

[0044] Here, if an adversarial sample is intended to be misclassified into a certain class, that class (the class to which it is misclassified) is also called the target class. The adversarial sample may be associated not only with data indicating the correct class, but also with data indicating the target class.

[0045] If the neural network 201 is configured as a feature extraction AI, the error induction determination unit 194 may calculate the similarity between the features output by the neural network 201 and the features associated with the target class of the adversarial sample, which is the input data to the neural network 201. The error induction determination unit 194 may then determine that the input data induces an estimation error using the neural network 201 if the calculated similarity is greater than or equal to a predetermined threshold.

[0046] The similarity index used by the error induction detection unit 194 is not limited to a specific one. The error induction detection unit 194 may calculate an index that indicates the similarity of two features, such as cosine similarity, where a larger index value indicates greater similarity between the two features. Alternatively, the error induction detection unit 194 may calculate an index that indicates greater similarity between the two features, such as the distance between the two features in the feature space, where a smaller index value indicates greater similarity between the two features.

[0047] The features associated with a target class may be the features of a single data point belonging to that target class. Alternatively, the features associated with a target class may be the average of the features of multiple data points belonging to that target class.

[0048] The parameter update unit 195 trains the neural network 201 and updates its parameter values. The parameter update unit 195 updates the parameter values ​​of the subset network and the parameter values ​​of the second normalization layer 230-2 using the base data group. The parameter update unit 195 also updates the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer 230-1 using adversarial samples from the adversarial data group that the error induction determination unit 194 has determined to induce estimation errors using the neural network 201. Similar to parameter updates in mini-batch learning, the parameter update unit 195 may update the parameter values ​​using the average value of multiple input data for each part of the neural network 201. The parameter update unit 195 is an example of a parameter update means.

[0049] As described above, data may be input to both the first normalization layer 230-1 and the second normalization layer 230-2. Alternatively, data may be selectively input to either the first normalization layer 230-1 or the second normalization layer 230-2.

[0050] When each data point (base data) of the base data group is input to the neural network 201, all channel data from the activation layer 222, which outputs data to the first normalization layer 230-1 and the second normalization layer 230-2, may be input to both the first normalization layer 230-1 and the second normalization layer 230-2, or to only the second normalization layer 230-2.

[0051] When each data point (adversarial sample) of the adversarial data group is input to the neural network 201, all channel data from the activation layer 222, which outputs data to the first normalization layer 230-1 and the second normalization layer 230-2, may be input to both the first normalization layer 230-1 and the second normalization layer 230-2, or to only the first normalization layer 230-1.

[0052] The method used by the parameter update unit 195 to update parameter values ​​is not limited to a specific method. The parameter update unit 195 may update parameter values ​​using known methods applicable to mini-batch learning, such as backpropagation.

[0053] Figure 3 shows an example of the procedure for the processing unit 190 to train the neural network 201. In the process shown in Figure 3, the data acquisition unit 191 acquires a base data group (step S101). That is, the data acquisition unit 191 acquires base data that has been grouped together. The data acquisition unit 191 may acquire base data that has already been grouped together. Alternatively, the data acquisition unit 191 may acquire base data and group it into base data groups.

[0054] Next, the processing unit 190 starts a loop L11 that processes each base data group (step S102). The base data group that is the target of processing in loop L11 is also called the target base data group. In the processing of loop L11, the parameter update unit 195 updates the parameter values ​​of the common part and the parameter values ​​of the second normalization layer 230-2 using the target base data group (step S103).

[0055] Next, the processing unit 190 collects data to update the parameter values ​​of the common part and the parameter values ​​of the first normalization layer 230-1 (step S104). The data used to update the parameter values ​​of the common part and the parameter values ​​of the first normalization layer 230-1 is also referred to as parameter value update data based on adversarial samples. Next, the parameter update unit 195 updates the parameter values ​​of the common part and the parameter values ​​of the first normalization layer 230-1 using the data obtained in step S104 (step S105).

[0056] Next, the processing unit 190 performs termination processing on the loop L11 (step S106). Specifically, the processing unit 190 determines whether or not the processing in loop L11 has been performed for all the base data groups obtained in step S101. In subsequent iterations of loop L11, the processing unit 190 determines whether or not the processing in loop L11 has been performed for all the base data groups obtained in step S101 during that iteration.

[0057] If the processing unit 190 determines that there are still base data groups that have not yet undergone processing in loop L11, the process returns to step S102. In this case, the processing unit 190 continues to perform the processing in loop L11 for the base data groups that have not yet undergone processing in loop L11. On the other hand, if the processing unit 190 determines that the processing in loop L11 has been performed for all the base data groups obtained in step S101, it terminates loop L11.

[0058] When loop L11 is completed, the processing unit 190 determines whether the learning termination condition has been met (step S107). Various conditions can be used as the learning termination condition here. For example, the learning termination condition may be that the process from steps S102 to S107 has been repeated a predetermined number of times, but is not limited to this.

[0059] If the processing unit 190 determines that the learning termination condition has not been met (step S107: NO), the process returns to step S102. In this case, the processing unit 190 repeats the processing of loop L11, thereby repeatedly updating the parameter values ​​of the neural network 201. On the other hand, if it is determined that the learning termination condition has been met (step S107: YES), the processing unit 190 terminates the process shown in Figure 3.

[0060] Figure 4 shows an example of the procedure for the processing unit 190 to collect data for updating parameter values ​​based on adversarial samples. In step S104 of Figure 3, the processing unit 190 performs the process shown in Figure 4. In the process shown in Figure 4, the processing unit 190 starts a loop L21 that processes each base data included in the target base data group (step S201). The base data that is the target of processing in loop L21 is also called the target base data.

[0061] In the processing of loop L21, the adversarial sample acquisition unit 192 generates adversarial samples for the target base data (step S202). Next, the model execution unit 193 inputs the adversarial samples obtained in step S202 into the neural network 201 and performs estimation using the neural network 201 (step S203).

[0062] Next, the error induction determination unit 194 determines whether the adversarial sample for the target base data is inducing an estimation error using the neural network 201 (step S204). If the error induction determination unit 194 determines that adversarial samples for the target base data are inducing errors in estimation using the neural network 201 (step S204: YES), the parameter update unit 195 causes the storage unit 180 to store parameter value update data based on the adversarial samples (step S205).

[0063] For example, when using a learning method based on the errors of the data calculated by each part of the neural network 201, such as backpropagation, the parameter update unit 195 may calculate the errors in the parts of the neural network 201 whose parameter values ​​are to be updated and store them in the memory unit 180. In this case, in step S105 of Figure 3, the parameter update unit 195 calculates the average value of the errors stored in the memory unit 180 for each part of the neural network 201, applies the learning method to the calculated average value, and updates the parameter values.

[0064] Next, the processing unit 190 performs termination processing on the loop L21 (step S206). Specifically, the processing unit 190 determines whether or not the processing in loop L21 has been performed for all the base data included in the target base data group. In the second and subsequent iterations of loop L11 (Figure 3), the processing unit 190 determines whether or not the processing in loop L21 has been performed for all the base data included in the target base data group during that iteration.

[0065] If the processing unit 190 determines that there is still base data that has not yet been processed by loop L21, the process returns to step S201. In this case, the processing unit 190 continues to process loop L21 for the base data that has not yet been processed by loop L21. On the other hand, if the processing unit 190 determines that it has performed the processing in loop L21 for all of the base data included in the target base data group, it terminates loop L21. When loop L21 is terminated, the processing unit 190 terminates the process shown in Figure 4.

[0066] On the other hand, if the error induction determination unit 194 determines in step S204 that the adversarial sample for the target base data has not induced an estimation error using the neural network 201 (step S204: NO), the process proceeds to step S206. In this case, data recording in step S205 is not performed. Therefore, in this case, the adversarial sample for the target base data is excluded from updating the parameter values ​​of the common part and the parameter values ​​of the first normalization layer 230-1.

[0067] Figure 5 shows an example of the procedure for the learning device 100 to collect data for updating parameter values ​​based on adversarial samples when the neural network 201 is configured as a classification-type AI. The learning device 100 performs the process shown in Figure 5 in step S104 of Figure 3.

[0068] The process shown in Figure 5 corresponds to an example of the process shown in Figure 4. As described above, if the neural network 201 is configured as a classification-type AI, the error induction determination unit 194 may determine that the input data has induced an error in estimation using the neural network 201 when the class estimation result output by the neural network 201 differs from the correct class associated with the input data to the neural network 201. Figure 5 shows an example of the processing in this case.

[0069] Steps S211 to S212 in Figure 5 are the same as steps S201 to S202 in Figure 4. The processing of loop L22 in Figure 5 corresponds to an example of the processing of loop L21 in Figure 4. After step S212, the model execution unit 193 performs class classification of adversarial samples by applying adversarial samples to the target base data in the neural network 201 (step S213). The process in step S213 corresponds to the example of the process in step S203 in Figure 4. In the example in Figure 5, the adversarial samples obtained in step S212 correspond to adversarial samples for the target base data.

[0070] Next, the error induction determination unit 194 determines whether the adversarial sample for the target base data has been misclassified using the neural network 201 (step S214). Here, misclassification is defined as the neural network 201 classifying the input adversarial sample into a class different from the class designated as the correct class for that adversarial sample. Alternatively, misclassification may be defined as the neural network 201 classifying the input adversarial sample into the class designated as the target class for that adversarial sample. The process in step S214 corresponds to the example of the process in step S204 in Figure 4.

[0071] If the error induction determination unit 194 determines that the adversarial sample for the target base data has been misclassified by the classification using the neural network 201 (step S214: YES), the process proceeds to step S215. On the other hand, if the error induction determination unit 194 determines that the adversarial sample for the target base data has not been misclassified by the classification using the neural network 201 (step S214: NO), the process proceeds to step S216.

[0072] Steps S215 to S216 are the same as steps S205 to S206 in Figure 4. If loop L22 is terminated in step S216, the processing unit 190 terminates the process shown in Figure 5.

[0073] Figure 6 shows an example of the procedure for the learning device 100 to collect data for updating parameter values ​​based on adversarial samples, when the neural network 201 is configured as a feature extraction AI. The learning device 100 performs the process shown in Figure 6 in step S104 of Figure 3.

[0074] The process shown in Figure 6 corresponds to an example of the process shown in Figure 4. As described above, if the neural network 201 is configured as a feature extraction type AI, the error induction determination unit 194 may determine that the input data has induced an estimation error using the neural network 201 when the class estimation result output by the neural network 201 indicates the target class of the adversarial sample which is the input data. Figure 6 shows an example of the processing in this case.

[0075] Steps S221 to S222 in Figure 6 are the same as steps S201 to S202 in Figure 4. The processing of loop L23 in Figure 6 corresponds to an example of the processing of loop L21 in Figure 4. After step S222, the model execution unit 193 calculates the features of the adversarial samples by applying the adversarial samples to the target base data to the neural network 201 (step S223). The process in step S223 corresponds to the example of the process in step S203 in Figure 4. In the example in Figure 6, the adversarial samples obtained in step S222 correspond to the adversarial samples to the target base data.

[0076] Next, the error induction determination unit 194 calculates the similarity between the features of an adversarial sample and the features associated with the target class of that adversarial sample (step S224). Next, the error induction determination unit 194 determines whether the similarity calculated in step S224 indicates that the similarity is above a predetermined threshold (step S225). The processing from steps S224 to S225 corresponds to the example of the processing in step S204 in Figure 4.

[0077] If the error induction determination unit 194 determines that the similarity calculated in step S224 is above a predetermined threshold (step S225: YES), the process proceeds to step S226. On the other hand, if the error induction determination unit 194 determines that the similarity calculated in step S224 is not above a predetermined threshold (step S225: NO), the process proceeds to step S227.

[0078] Steps S226 to S227 are the same as steps S205 to S206 in Figure 4. If loop L23 is terminated in step S227, the processing unit 190 terminates the process shown in Figure 6.

[0079] As described above, the data acquisition unit 191 acquires a base data group, which is a group containing multiple data points. The adversarial sample acquisition unit 192 acquires an adversarial data group, which is a group containing multiple adversarial samples for the data included in the base data group acquired by the data acquisition unit 191. The error induction determination unit 194 determines whether or not the data input to the neural network 201 induces an estimation error using the neural network 201. The neural network 201 includes a subset network, a first normalization layer 230-1, and a second normalization layer 230-2. The first normalization layer 230-1 normalizes the data input to itself using a first mean and a first variance, and the second normalization layer 230-2 normalizes the data input to itself using a second mean and a second variance. The parameter update unit 195 updates the parameter values ​​of the subset network and the parameter values ​​of the second normalization layer 230-2 using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer 230-1 using adversarial samples from the adversarial data group that are determined to induce estimation errors using the neural network 201.

[0080] The learning device 100 selects adversarial samples that induce estimation errors using the neural network 201 from among the adversarial samples and uses them to train the neural network 201. In this respect, the learning device 100 allows for consideration of the accuracy of adversarial samples when they are used to train the neural network.

[0081] Here, adversarial samples can be considered as inputs that are prone to errors in neural networks, created by small perturbations. Therefore, adversarial samples can be used to train neural networks with the aim of improving their accuracy. In other words, adversarial samples can be used as training data to compensate for the weaknesses of neural networks by training them to be able to make correct estimations on data that is prone to errors.

[0082] In particular, adversarial samples that induce estimation errors using neural network 201 can be considered as input data with low estimation accuracy using neural network 201. By training neural network 201 using these adversarial samples, it is expected that training can be performed more efficiently.

[0083] On the other hand, adversarial samples that do not induce estimation errors using neural network 201 can be considered input data that yields relatively high accuracy in estimation using neural network 201. If the adversarial samples used to train neural network 201 include adversarial samples that do not induce estimation errors using neural network 201, it is possible that training neural network 201 will take longer, or that the accuracy of neural network 201 obtained as a result of training will be relatively low.

[0084] If it's not determined whether the adversarial samples used as training data are capable of causing the neural network to mislead during the training process, then data that doesn't cause errors will be used for training. This reduces the effectiveness of compensating for the weaknesses of neural networks, as mentioned above.

[0085] In contrast, as described above, the learning device 100 selects adversarial samples from among the adversarial samples that induce estimation errors using the neural network 201, and uses them to train the neural network 201. According to the learning device 100, in this respect, it is expected that the time required to train the neural network 201 will be relatively short, or that the accuracy of the neural network 201 obtained as a result of training will be relatively high.

[0086] Furthermore, the distribution of inputs to the neural network 201 differs between the base data and the adversarial samples. By including a first normalization layer 230-1 linked to the inputs of the adversarial samples and a second normalization layer 230-2 linked to the inputs of the base data in the neural network 201, it is expected that the learning device 100 can learn the neural network 201 relatively efficiently using these normalization layers.

[0087] Furthermore, the neural network 201 is configured as a classification AI that receives data input and classifies that data. The error induction determination unit 194 determines that if the neural network 201 classifies the input adversarial sample into a class different from the class considered to be the correct class for that adversarial sample, then that adversarial sample induces an estimation error using the neural network 201.

[0088] Thus, with the learning device 100, when learning a neural network configured as a classification-type AI, the effects described above can be expected, such as a relatively short time required for learning the neural network, or a relatively high accuracy for the neural network obtained as a result of the learning.

[0089] Furthermore, the neural network 201 is configured as a classification AI that receives data input and classifies that data. The error induction determination unit 194 determines that if the neural network 201 classifies the input adversarial sample into the class designated as the target class of that adversarial sample, that adversarial sample induces an estimation error using the neural network.

[0090] Thus, with the learning device 100, when learning a neural network configured as a classification-type AI, the effects described above can be expected, such as a relatively short time required for learning the neural network, or a relatively high accuracy for the neural network obtained as a result of the learning. Furthermore, according to the learning device 100, if the target class of the adversarial sample acquired by the adversarial sample acquisition unit 192 is specified as a particular class, it is expected that learning about the classification between the correct class and the target class can be performed efficiently.

[0091] Furthermore, the neural network 201 is configured as a feature extraction AI that receives data input and extracts features from that data. The error induction determination unit 194 calculates the similarity between the features extracted by the neural network 201 for the input adversarial sample and the features associated with the target class of that adversarial sample. If the calculated similarity is greater than a predetermined threshold, the unit determines that the adversarial sample induces an estimation error using the neural network 201.

[0092] Thus, with the learning device 100, when learning a neural network configured as a feature extraction type AI, the following effects can be expected: the time required to learn the neural network is relatively short, or the accuracy of the neural network obtained as a result of the learning is relatively high.

[0093] <Second Embodiment> The learning device may set a target class in adversarial samples by considering the similarity of the features. This point will be explained in the second embodiment.

[0094] Figure 7 shows an example of the configuration of a learning device according to the second embodiment. In the configuration shown in Figure 7, the learning device 300 comprises a communication unit 110, a display unit 120, an operation input unit 130, a storage unit 180, and a processing unit 390. The storage unit 180 comprises a model storage unit 181. The model storage unit 181 comprises a common parameter storage unit 182, a first normalization layer parameter storage unit 183-1, and a second normalization layer parameter storage unit 183-2. The processing unit 190 comprises a data acquisition unit 191, an adversarial sample acquisition unit 192, a model execution unit 193, an error induction determination unit 194, a parameter update unit 195, a similarity calculation unit 391, and a target selection unit 392.

[0095] Of the parts of the learning device 300 shown in Figure 7, those parts that have the same function as the parts of the learning device 100 shown in Figure 1 are denoted by the same reference numerals (110, 120, 130, 180, 181, 182, 183-1, 183-2, 191, 192, 193, 194, 195), and detailed explanations are omitted here. In the learning device 300, the processing unit 390 includes, in addition to the parts of the processing unit 190 of the learning device 100, a similarity calculation unit 391 and a target selection unit 392. In all other respects, the learning device 300 is the same as the learning device 100.

[0096] The similarity calculation unit 391 calculates an index value indicating the similarity between two features. Specifically, the similarity calculation unit 391 calculates an index value indicating the similarity between the features of the base data and the features associated with the candidate target classes used by the adversarial sample acquisition unit 192 when generating adversarial samples for the base data.

[0097] The metric used by the similarity calculation unit 391 is not limited to a specific one. The similarity calculation unit 391 may calculate a metric that indicates the similarity between two features, such as cosine similarity, where a larger metric value indicates greater similarity between the two features. Alternatively, the similarity calculation unit 391 may calculate a metric that indicates greater similarity between the two features, such as the distance between the two features in the feature space, where a smaller metric value indicates greater similarity between the two features.

[0098] Furthermore, the index used by the similarity calculation unit 391 may be the same as, or different from, the index used by the error induction judgment unit 194 to indicate the similarity of features when the neural network 201 is configured as a feature extraction type AI. The similarity calculation unit 391 may also be configured as part of the error induction judgment unit 194.

[0099] The target selection unit 392 sets one of the classes other than the correct class of the base data as the target class, based on the similarity between the features of the base data and the features associated with classes other than the correct class of the base data. For example, the similarity calculation unit 391 may calculate an index that shows the similarity between the features of the base data and the features associated with that class for each class other than the ground truth class of the base data. Then, the target selection unit 392 may set the class among the classes other than the ground truth class of the base data that shows the highest feature similarity according to the index calculated by the target selection unit 392 as the target class. The adversarial sample acquisition unit 192 generates adversarial samples for the base data, using the class set by the target selection unit 392 as the target class.

[0100] Figure 8 shows an example of the procedure for the processing unit 390 to train the neural network 201. Step S301 in Figure 8 is the same as step S101 in Figure 3.

[0101] After step S301, the model execution unit 193 calculates the feature quantities of each base data included in each base data group obtained in step S301 (step S302). If the neural network 201 is configured as a feature extraction AI, the model execution unit 193 may input each base data to the neural network 201 and obtain the features output by the neural network 201. If the neural network 201 is configured as a classification-type AI, the model execution unit 193 may input each base data into the neural network 201 and obtain the features that the neural network 201 calculates for class classification of the base data.

[0102] Steps S303 to S308 are the same as steps S102 to S107 in Figure 3, except for the processing in step S305. The processing in loop L31 in Figure 8 is the same as the processing in loop L11 in Figure 3. The base data group that is the target of processing in loop L31 is also called the target base data group. If the processing unit 390 determines in step S308 that the learning termination condition has not been met (step S308: NO), the process returns to step S302. In this case, the processing unit 390 updates the feature quantities of each base data in step S302 and repeats the processing in loop L31, thereby repeatedly updating the parameter values ​​of the neural network 201. On the other hand, if it is determined that the learning termination condition has been met (step S308: YES), the processing unit 390 terminates the process shown in Figure 8.

[0103] Figure 9 shows an example of the procedure for the processing unit 390 to collect data for updating parameter values ​​based on adversarial samples. In step S305 of Figure 8, the processing unit 390 performs the process shown in Figure 9. Step S401 in Figure 9 is the same as step S201 in Figure 4. The loop that the processing unit 390 starts in step S401 is called loop L41. The base data that is processed in loop L41 is also called the target base data.

[0104] In the processing of loop L41, the similarity calculation unit 391 calculates an index value indicating the similarity between the feature quantities of the target base data and the feature quantities associated with that class for each class other than the correct class of the target base data (step S402). Next, the target selection unit 392 sets one of the classes other than the correct answer class of the target base data as the target class based on the index value calculated by the similarity calculation unit 391 (step S403).

[0105] Steps S404 to S408 are the same as steps S202 to S206 in Figure 4. In step S404, the adversarial sample acquisition unit 192 generates adversarial samples whose target class is the target class set by the target selection unit 392 in step S403. If loop L41 is terminated in step S408, the processing unit 390 terminates the process shown in Figure 9.

[0106] As described above, the adversarial sample acquisition unit 192 generates adversarial samples whose target class is one of the classes other than the ground truth class of the base data, based on the similarity between the features of the base data, which are data included in the base data group, and the features associated with classes other than the ground truth class of the base data.

[0107] As a result, the adversarial sample acquisition unit 192 can generate adversarial samples with a relatively high similarity between the features of the base data and the features associated with the target class, and it is expected that the obtained adversarial samples have a relatively high probability of inducing estimation errors using the neural network 201.

[0108] Adversarial samples that are relatively likely to induce estimation errors using neural network 201 can be considered as input data that yields relatively low accuracy in estimation using neural network 201. By training neural network 201 using these adversarial samples, it is expected that training can be performed more efficiently.

[0109] <Third Embodiment> In the third embodiment, an example of the configuration of the estimation device and neural network during operation using a trained neural network will be described.

[0110] Figure 10 shows an example of the configuration of the estimation device according to the third embodiment. In the configuration shown in Figure 10, the estimation device 400 comprises a communication unit 110, a display unit 120, an operation input unit 130, a storage unit 480, and a processing unit 490. The storage unit 480 comprises a model storage unit 481. The model storage unit 481 comprises a common parameter storage unit 182 and a second normalization layer parameter storage unit 183-2. The processing unit 490 comprises a data acquisition unit 191, a model execution unit 193, and a result output processing unit 491.

[0111] Of the parts of the estimation device 400 shown in Figure 10, those parts that have the same function as the parts of the learning device 100 shown in Figure 1 are denoted by the same reference numerals (110, 120, 130, 182, 183-2, 191, 193), and detailed explanations are omitted here. In the estimation device 400, the memory unit 480 does not include the first normalization layer parameter memory unit 183-1, which is one of the components of the memory unit 180 of the learning device 100. Also, in the estimation device 400, the processing unit 490 does not include the adversarial sample acquisition unit 192, the error induction determination unit 194, and the parameter update unit 195, which are components of the processing unit 190 of the learning device 100, but it does include a result output processing unit 491. In all other respects, the estimation device 400 is the same as the learning device 100.

[0112] Figure 11 shows an example of a neural network stored in the model memory unit 481. The neural network 202 shown in Figure 11 lacks the first normalization layer 230-1, which is present in the neural network 201 shown in Figure 2. In all other respects, the neural network 202 is the same as the neural network 201.

[0113] Of the parts of the neural network 202 shown in Figure 11, those parts that have the same function as the parts of the neural network 201 shown in Figure 2 are given the same code (210, 221, 222, 223, 230-2, 240, 250), and detailed explanations are omitted here.

[0114] Since no learning is performed in neural network 202, the first normalization layer 230-1, which was provided in neural network 201 to learn in response to differences in the distribution of input data, is not included. The neural network 202 receives data as input and outputs the result of its estimation for the input data.

[0115] The neural network 202 may be configured as a classification AI or as a feature extraction AI. When configured as a classification AI, the neural network 202 receives data as input and outputs an estimated result of the class of that data. When configured as a feature extraction AI, the neural network 202 receives data as input and outputs the features of that data.

[0116] Since the neural network 202 does not have a first normalization layer 230-1, the model storage unit 481 of the estimation device 400 also does not have a first normalization layer parameter storage unit 183-1. Furthermore, since the estimation device 400 does not perform neural network training, it does not include the adversarial sample acquisition unit 192, which acquires adversarial samples to be used as training data, the error induction determination unit 194, which selects adversarial samples to be updated for parameter value updates, and the parameter update unit 195, which updates parameter values, among the various parts of the learning device 100.

[0117] In the estimation device 400, the data acquisition unit 191 acquires input data for the neural network 202. The model execution unit 193 inputs the data acquired by the data acquisition unit 191 into the neural network 202 and obtains estimation results using the neural network 202.

[0118] The result output processing unit 491 outputs the obtained estimation results. The method by which the result output processing unit 491 outputs the estimation results is not limited to a specific method. For example, the result output processing unit 491 may output the estimation results by displaying them on the display unit 120. Alternatively, the result output processing unit 491 may transmit the estimation results to another device via the communication unit 110.

[0119] Alternatively, the neural network 201 shown in Figure 2 may be used during operation.

[0120] The estimation device 400 can be used for various estimations. For example, the estimation device 400 may be configured to perform biometric authentication such as facial recognition, fingerprint recognition, or voiceprint recognition. In this case, the estimation device 400 may attempt to classify the input data into one of the registered person classes, thereby authenticating the person indicated by the input data as one of the registered persons, or failing to authenticate. Alternatively, the estimation device 400 may extract features from the input data, compare their similarity to the features of the data of a specified person, and determine whether the person indicated by the input data and the specified person are the same person. Alternatively, the estimation device 400 may be used in devices for purposes other than biometric authentication, such as devices that perform various predictions.

[0121] <Fourth Embodiment> Figure 12 shows an example of the configuration of a learning device according to the fourth embodiment. In the configuration shown in Figure 12, the learning device 610 includes a data acquisition unit 611, an adversarial sample acquisition unit 612, an error induction determination unit 613, and a parameter update unit 614. In this configuration, the data acquisition unit 611 acquires a base data group, which is a group containing multiple data points. The adversarial sample acquisition unit 612 acquires an adversarial data group, which is a group containing multiple adversarial samples of data included in the base data group acquired by the data acquisition unit 611.

[0122] The error induction determination unit 613 determines, when data is input to the neural network, whether or not that data induces an estimation error using the neural network. The neural network here includes a subset network, a first normalization layer, and a second normalization layer. The first normalization layer normalizes the data input to itself using a first mean and a first variance. The second normalization layer normalizes the data input to itself using a second mean and a second variance.

[0123] The parameter update unit 614 updates the parameter values ​​of the subset network and the parameter values ​​of the second normalization layer using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer using adversarial samples from the adversarial data group that are determined to induce estimation errors using the neural network.

[0124] The data acquisition unit 611 is an example of data acquisition means. The adversarial sample acquisition unit 612 is an example of adversarial sample acquisition means. The error induction determination unit 613 is an example of error induction determination means. The parameter update unit 614 is an example of parameter update means.

[0125] The learning device 610 selects adversarial samples that induce estimation errors using the neural network from among the adversarial samples and uses them for training the neural network. In this respect, the learning device 610 allows for consideration of the accuracy of the adversarial samples when they are used for training the neural network.

[0126] Here, adversarial samples that induce errors in estimation using a neural network can be considered as input data where the accuracy of estimation using that neural network is low. By training the neural network using these adversarial samples, it is expected that training can be performed more efficiently.

[0127] On the other hand, adversarial samples that do not induce estimation errors using a neural network can be considered input data that yields relatively high accuracy in estimation using that neural network. If the adversarial samples used to train a neural network include adversarial samples that do not induce estimation errors using the neural network, it is possible that training the neural network will take longer, or that the accuracy of the neural network obtained as a result of training will be relatively low.

[0128] In contrast, as described above, the learning device 610 selects adversarial samples that induce errors in estimation using the neural network from among the adversarial samples and uses them for training the neural network. With the learning device 610, it is expected that the time required to train the neural network will be relatively short, or that the accuracy of the neural network obtained as a result of training will be relatively high.

[0129] Furthermore, the distribution of inputs to the neural network differs between the base data and the adversarial samples. By including a first normalization layer linked to the inputs of the adversarial samples and a second normalization layer linked to the inputs of the base data in the neural network, it is expected that the learning device 610 can learn the neural network relatively efficiently using these normalization layers.

[0130] The data acquisition unit 611 can be implemented using, for example, the data acquisition unit 191 in Figure 1. The adversarial sample acquisition unit 612 can be implemented using, for example, the adversarial sample acquisition unit 192 in Figure 1. The error induction determination unit 613 can be implemented using, for example, the error induction determination unit 194 in Figure 1. The parameter update unit 614 can be implemented using, for example, the parameter update unit 195 in Figure 1.

[0131] <Fifth Embodiment> Figure 13 shows an example of the processing steps in the learning method according to the fifth embodiment. The learning method shown in Figure 13 includes acquiring data (step S611), acquiring adversarial samples (step S612), determining whether or not errors are induced (step S613), and updating parameter values ​​(step S614).

[0132] In acquiring data (step S611), the computer acquires a base data group, which is a group containing multiple data points. In acquiring adversarial samples (step S612), the computer acquires an adversarial data group, which is a group containing multiple adversarial samples for the data included in the acquired base data group.

[0133] In determining whether or not an error is induced (step S613), the computer determines whether or not data is induced in estimation using the neural network when data is input to the neural network, which includes a subset network, a first normalization layer, and a second normalization layer. The first normalization layer normalizes the data input to the first normalization layer using a first mean and a first variance, and the second normalization layer normalizes the data input to the second normalization layer using a second mean and a second variance.

[0134] In updating parameter values ​​(step S614), the computer updates the parameter values ​​of the subset network and the parameter values ​​of the second normalization layer using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer using adversarial samples from the adversarial data group that are determined to induce estimation errors using the neural network.

[0135] In the learning method shown in Figure 13, adversarial samples that induce estimation errors using a neural network are selected from among adversarial samples and used to train the neural network. In this respect, the learning method shown in Figure 13 allows for consideration of the accuracy of adversarial samples when they are used to train the neural network.

[0136] Here, adversarial samples that induce errors in estimation using a neural network can be considered as input data where the accuracy of estimation using that neural network is low. By training the neural network using these adversarial samples, it is expected that training can be performed more efficiently.

[0137] On the other hand, adversarial samples that do not induce estimation errors using a neural network can be considered input data that yields relatively high accuracy in estimation using that neural network. If the adversarial samples used to train a neural network include adversarial samples that do not induce estimation errors using the neural network, it is possible that training the neural network will take longer, or that the accuracy of the neural network obtained as a result of training will be relatively low.

[0138] In contrast, as described above, the learning method shown in Figure 13 selects adversarial samples that induce estimation errors using the neural network and uses them to train the neural network. According to the learning method shown in Figure 13, it is expected that the time required to train the neural network will be relatively short, or that the accuracy of the resulting neural network will be relatively high.

[0139] Furthermore, the distribution of inputs to the neural network differs between the base data and the adversarial samples. In the learning method shown in Figure 13, the neural network includes a first normalization layer linked to the inputs of the adversarial samples and a second normalization layer linked to the inputs of the base data. It is expected that the neural network can be trained relatively efficiently using these normalization layers.

[0140] Figure 14 is a schematic block diagram showing the configuration of a computer according to at least one embodiment. As shown in Figure 14, the computer 700 comprises a CPU 710, a main memory 720, an auxiliary memory 730, an interface 740, and a non-volatile recording medium 750.

[0141] One or more of the above-described learning devices 100, 300, 400, and 610, or parts thereof, may be implemented in the computer 700. In that case, the operation of each processing unit described above is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, expands it in the main memory 720, and executes the above processing according to the program. The CPU 710 also allocates memory areas in the main memory 720 corresponding to each of the above-described memory units according to the program. Communication between each device and other devices is performed by the interface 740 having a communication function and communicating according to the control of the CPU 710. The interface 740 also has a port for the non-volatile recording medium 750 and reads information from and writes information to the non-volatile recording medium 750.

[0142] When the learning device 100 is implemented in the computer 700, the operation of the processing unit 190 and each of its parts is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processing according to the program.

[0143] Furthermore, the CPU 710 reserves memory areas for the memory unit 180 and each of its components in the main memory 720 according to the program. Communication with other devices by the communication unit 110 is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Display of images by the display unit 120 is performed by the interface 740 being equipped with a display device and displaying various images under the control of the CPU 710. Acceptance of user operations by the operation input unit 130 is performed by the interface 740 being equipped with an input device and accepting user operations under the control of the CPU 710.

[0144] When the learning device 300 is implemented in the computer 700, the operation of the processing unit 390 and each of its parts is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processing according to the program.

[0145] Furthermore, the CPU 710 reserves memory areas for the memory unit 180 and each of its components in the main memory 720 according to the program. Communication with other devices by the communication unit 110 is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Display of images by the display unit 120 is performed by the interface 740 being equipped with a display device and displaying various images under the control of the CPU 710. Acceptance of user operations by the operation input unit 130 is performed by the interface 740 being equipped with an input device and accepting user operations under the control of the CPU 710.

[0146] When the estimation device 400 is implemented in the computer 700, the operation of the processing unit 490 and each of its parts is stored in auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processing according to the program.

[0147] Furthermore, the CPU 710 reserves memory areas for the memory unit 480 and each of its components in the main memory 720 according to the program. Communication with other devices by the communication unit 110 is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Display of images by the display unit 120 is performed by the interface 740 being equipped with a display device and displaying various images under the control of the CPU 710. Acceptance of user operations by the operation input unit 130 is performed by the interface 740 being equipped with an input device and accepting user operations under the control of the CPU 710.

[0148] When the learning device 610 is implemented in the computer 700, the operations of the data acquisition unit 611, the adversarial sample acquisition unit 612, the error induction determination unit 613, and the parameter update unit 614 are stored in auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, loads it into the main memory 720, and executes the above processes according to the program.

[0149] Furthermore, the CPU 710 reserves memory in the main memory 720 for the learning device 610 to process according to the program. Communication between the learning device 610 and other devices is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the learning device 610 and the user is performed by the interface 740 having input and output devices, presenting information to the user via the output device and accepting user input via the input device under the control of the CPU 710.

[0150] One or more of the above-mentioned programs may be recorded on the non-volatile recording medium 750. In this case, the interface 740 may read the program from the non-volatile recording medium 750. The CPU 710 may then either directly execute the program read by the interface 740, or temporarily save it in the main memory 720 or auxiliary memory 730 before executing it.

[0151] Alternatively, programs for executing all or part of the processing performed by the learning device 100, learning device 300, estimation device 400, and learning device 610 may be recorded on a computer-readable recording medium, and the programs recorded on this recording medium may be loaded into a computer system and executed to perform the processing of each part. The term "computer system" here includes hardware such as an operating system (OS) and peripheral devices. Furthermore, "computer-readable recording media" refers to portable media such as flexible disks, magneto-optical disks, ROMs (Read Only Memory), CD-ROMs (Compact Disc Read Only Memory), and storage devices such as hard disks built into computer systems. The above-mentioned program may be intended to implement only a part of the functions described above, and may also be able to implement the above-mentioned functions in combination with programs already recorded in the computer system.

[0152] While embodiments of this invention have been described in detail above with reference to the drawings, the specific configuration is not limited to these embodiments and includes designs and the like that do not depart from the spirit of this invention. [Explanation of Symbols]

[0153] 100, 300, 610 Learning Devices 110 Communications Department 120 Display section 130 Operation Input Section 180, 480 storage section 181 Model Memory Unit 182 Common Parameter Storage Unit 183-1 First Normalization Layer Parameter Storage Unit 183-2 Second Normalization Layer Parameter Storage Unit 190, 390, 490 Processing Unit 191, 611 Data acquisition unit 192, 612 Adversarial Sampling Unit 193 Model Execution Unit 194, 613 Error Inducement Determination Unit 195, 614 Parameter update section 201, 202 Neural Networks 210 Input Layers 221 Convolutional Layer 222 Activation layer 223 Pooling layer 230-1 1st normalization layer 230-2 Second normalization layer 240 fully connected layer 250 output layers 391 Similarity calculation unit 392 Target Selection Unit 400 Estimator 491 Result Output Processing Unit

Claims

1. A data acquisition means for acquiring a base data group which is a group containing multiple data, Adversarial sample acquisition means acquires an adversarial data group which is a group containing multiple adversarial samples for the data included in the base data group acquired by the data acquisition means, A neural network comprising a subset network, a first normalization layer, and a second normalization layer, wherein the first normalization layer normalizes the data input to the first normalization layer using a first mean and a first variance, and the second normalization layer normalizes the data input to the second normalization layer using a second mean and a second variance, and an error induction determination means that determines whether the data input to the neural network induces an estimation error using the neural network. A parameter update means updates the parameter values ​​of the subset network and the parameter values ​​of the second normalization layer using the base data group, and updates the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer using adversarial samples from the adversarial data group that are determined to induce estimation errors using the neural network. A learning device equipped with the following features.

2. The aforementioned neural network receives data as input and performs classification of that data. The error induction determination means determines that if the neural network classifies an input adversarial sample into a class different from the class designated as the correct class for that adversarial sample, that adversarial sample induces an estimation error using the neural network. The learning device according to claim 1.

3. The aforementioned neural network receives data as input and performs classification of that data. The error induction determination means determines that if the neural network classifies the input adversarial sample into a class designated as the target class of that adversarial sample, that adversarial sample induces an estimation error using the neural network. The learning device according to claim 1.

4. The aforementioned neural network receives data as input and extracts the features of that data. The error induction determination means calculates the similarity between the features extracted by the neural network from the input adversarial sample and the features associated with the target class of that adversarial sample. If the calculated similarity is greater than or equal to a predetermined threshold, it determines that the adversarial sample induces an estimation error using the neural network. The learning device according to claim 1.

5. The adversarial sample acquisition means generates adversarial samples whose target class is one of the classes other than the ground truth class of the base data, based on the similarity between the features of the base data, which are data included in the base data group, and the features associated with classes other than the ground truth class of the base data. A learning device according to any one of claims 1 to 4.

6. Computers Obtain the base data group, which is a group containing multiple data points. Obtain an adversarial data group, which is a group containing multiple adversarial samples of the data included in the acquired base data group. The neural network includes a subset network, a first normalization layer, and a second normalization layer, wherein the first normalization layer normalizes the data input to it using a first mean and a first variance, and the second normalization layer normalizes the data input to it using a second mean and a second variance. When data is input to the neural network, it determines whether the data will induce an estimation error using the neural network. The parameter values ​​of the subset network and the parameter values ​​of the second normalization layer are updated using the base data group, and the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer are updated using adversarial samples from the adversarial data group that are determined to induce estimation errors using the neural network. A learning method that includes this.

7. On the computer, Obtaining a base data group, which is a group containing multiple data points, This involves obtaining an adversarial data group, which is a group containing multiple adversarial samples of the data included in the acquired base data group, The neural network includes a subset network, a first normalization layer, and a second normalization layer, wherein the first normalization layer normalizes the data input to it using a first mean and a first variance, and the second normalization layer normalizes the data input to it using a second mean and a second variance. When data is input to the neural network, it determines whether the data will induce an estimation error using the neural network. The parameter values ​​of the subset network and the parameter values ​​of the second normalization layer are updated using the base data group, and the parameter values ​​of the subset network and the parameter values ​​of the first normalization layer are updated using adversarial samples from the adversarial data group that are determined to induce estimation errors using the neural network. A program to execute.

Images