Label-wise adversarial contrastive learning method and device for feature embedding space alignment of deep learning model
Patent Information
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- UI (UNIVERSITY IND FOUNDATION) YONSEI UNIVERSITY
- Filing Date
- 2026-01-22
- Publication Date
- 2026-07-30
Smart Images
Figure KR2026095032_30072026_PF_FP_ABST
Abstract
Description
Label-level adversarial contrast learning method and device for alignment of deep learning model feature embedding spaces
[0001] The present invention relates to a label-unit adversarial learning method for aligning the feature embedding space of a deep learning model, and more specifically, to an adversarial learning method that improves the performance of a deep learning model by simultaneously minimizing a general loss function and an adversarial loss function.
[0002]
[0003] Adversarial learning is a technique that generates adversarial inputs and utilizes them as a training dataset. Additionally, contrastive learning is a technique that optimizes feature embedding layers by bringing feature vectors of similar samples closer together and moving feature vectors of samples with different meanings further apart.
[0004] Conventional adversarial learning has the side effect of actually reducing the accuracy of normal samples without perturbations. Therefore, conventional adversarial learning techniques can cause a trade-off problem between robustness and accuracy performance.
[0005] The present invention is derived from research conducted as part of the Ministry of Science and ICT’s Core Source Technology Development (R&D) for Information Security (Project No.: 271008788, Sub-project No.: 00439762, Research Project Name: Development of AI Model Vulnerability Analysis and Evaluation Technology and Tools for Determining Confidentiality of Generated Information, Lead Institution: Yonsei University Industry-Academic Cooperation Foundation, Research Period: 2024.06.01 ~ 2025.02.28).
[0006] Meanwhile, in all aspects of the present invention, the Korean government, the entity providing the problem, has no property interest.
[0007]
[0008] The various embodiments described in this specification aim to optimize the feature space of a deep learning model using a class-based adversarial learning method.
[0009] In addition, it aims to provide a stable optimization algorithm based on supervised contrast learning.
[0010] The problems that this disclosure aims to solve are not limited to those described above, and other unmentioned problems will be clearly understood by a person skilled in the art from the description below.
[0011]
[0012] An adversarial contrast learning method for an encoder, performed by at least one processor according to one embodiment, comprises: generating an adversarial example batch based on a previously stored original training batch; measuring a loss function for each anchor data within the adversarial example batch; generating a final adversarial example batch by adding noise to the adversarial example batch based on the loss function for each anchor data; measuring a first loss function for each anchor sample within the final adversarial example batch and a second loss function for each anchor sample within the original training batch; and generating a final loss function by combining the first loss function and the second loss function and minimizing the final loss function.
[0013] Here, the step of generating the final adversarial example batch may include the step of repeating the step of adding noise to increase the first loss function.
[0014] Here, the step of generating the final adversarial example batch may include a step of minimizing similarity with a set of positives having the same class label and maximizing similarity with a set of negatives having a different class label for each anchor sample within the final adversarial example batch.
[0015] Here, the step of generating the final adversarial example batch may include the step of selecting both the positive set and the negative set from the original training batch.
[0016] Here, the loss function per anchor data within the adversarial example batch can be calculated based on the anchor data of the adversarial example batch, a positive set selected from the original training batch having the same class label as the anchor data of the adversarial example batch, and a negative set selected from the original training batch having a different class label as the anchor data of the adversarial example batch.
[0017] Here, the loss function per anchor data within the above adversarial example batch can be expressed by the following Equation 1.
[0018] [Mathematical Formula 1]
[0019]
[0020] L AFA : Adversarial feature alignment loss
[0021] X i ': Anchor data of the adversarial example batch generated from the original training batch
[0022] P: Selected from the original training batch X i A positive set v with class labels like '
[0023] N: Selected from the original training batch X i A negative set with class labels different from '
[0024] Here, the second loss function can be calculated based on an anchor sample of the original training batch, a set of positive data selected from the original training batch that has the same class label as the anchor sample of the original training batch, and a set of negative data selected from the original training batch that has a different class label as the anchor sample of the original training batch.
[0025] Here, the second loss function can be expressed by the following mathematical formula 2.
[0026] [Mathematical Formula 2]
[0027]
[0028] L SUP : General map contrast loss
[0029] X i : Anchor samples of the original training batch
[0030] P: Selected from the original training batch X i A set of positive values with class labels such as
[0031] N: Selected from the original training batch X i A negative set with different class labels
[0032] Here, the step of measuring the loss function may include: a step of extracting feature values of input data from the output layer of the encoder of the deep learning model; and a step of inputting the extracted feature values into a projection layer to extract a feature embedding vector.
[0033] Here, the step of applying the gradient of the minimized final loss function to all layers of the encoder of the deep learning model may be further included.
[0034] A computer program stored on a computer-readable non-transient recording medium is provided to execute an adversarial contrast learning method for an encoder according to another embodiment.
[0035] The present invention provides an adversarial comparison learning device for an encoder comprising: a memory storing an adversarial comparison learning program for training an encoder according to another embodiment; a communication module; and a processor controlling the memory, wherein the processor generates an adversarial example batch based on a previously stored original training batch, measures a loss function for each anchor data within the adversarial example batch and adds noise to the adversarial example batch based thereon to generate a final adversarial example batch, measures a first comparison loss function for each anchor sample within the final adversarial example batch and a second comparison loss function for each anchor sample within the original training batch, combines the first comparison loss function and the second comparison loss function to generate a final loss function, and minimizes the final loss function.
[0036]
[0037] According to one embodiment of the present invention, the class collision problem can be solved by considering the similarity of samples in the same class through supervised contrast learning.
[0038] In addition, by forming similar feature embeddings among samples belonging to the same label and embeddings with large differences among samples belonging to different labels, the deep learning model can achieve high accuracy and simultaneously output feature vectors similar to the original from samples to which perturbations are applied.
[0039] The effects according to the present disclosure are not limited to those described above, and other unmentioned effects will be clearly understood by a person skilled in the art from the description below.
[0040]
[0041] Figure 1 is a configuration diagram of the adversarial contrast learning device of the present invention.
[0042] FIG. 2 is a flowchart of an adversarial contrast learning method for an encoder according to one embodiment.
[0043] FIG. 3 is a figure illustrating the internal maximization step in adversarial contrast learning at the label level according to one embodiment.
[0044] FIG. 4 is a figure illustrating the external minimization step in adversarial contrast learning according to one embodiment.
[0045] Figure 5 is a figure showing the result at the end of learning according to one embodiment.
[0046] FIG. 6 is a specific flowchart of an internal maximization step according to one embodiment.
[0047] FIG. 7 is a specific flowchart of an external minimization step according to one embodiment.
[0048]
[0049] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the contents described in the attached drawings. However, the present invention is not limited or restricted by exemplary embodiments. Unless otherwise defined, all terms used in this specification (including technical and scientific terms) shall be used in a meaning that is commonly understood by those skilled in the art to which this disclosure belongs, but this may vary depending on the intent of those skilled in the art, case law, the emergence of new technology, etc.
[0050] Furthermore, terms defined in commonly used dictionaries are not to be interpreted ideally or excessively unless explicitly and specifically defined otherwise. In certain cases, terms have been selected at the applicant's discretion, and in such cases, their meanings will be described in detail in the relevant explanatory sections. Accordingly, terms used in this disclosure should be defined not merely by their names, but based on their meanings and the content throughout this disclosure.
[0051] Throughout this specification, when a part is described as "comprising" a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components. Furthermore, the singular form used in this specification includes the plural form unless specifically stated otherwise. Additionally, the expression "at least one of a, b, and / or c" as used throughout this specification may encompass 'a alone', 'b alone', 'c alone', 'a and b', 'a and c', 'b and c', or 'a, b, and c all'.
[0052] Meanwhile, terms such as "first and / or second" used in this specification may be used to describe various components, but they are used solely for the purpose of distinguishing one component from another and are not intended to limit the scope to the components referred to by such terms. For example, without departing from the scope of the present invention, the first component may be named the second component, and the second component may also be named the first component.
[0053] Additionally, terms such as “…part,” “…module,” etc., as described in this specification refer to a unit that processes at least one function or operation, which may be implemented in hardware or software, or a combination of hardware and software. Furthermore, embodiments of this disclosure may be represented in this specification by functional block configurations and various processing steps. These functional blocks may be implemented by various numbers of hardware and / or software configurations that execute specific functions. For example, embodiments of this disclosure may employ integrated circuit configurations such as memory, processing, logic, look-up tables, etc., which can execute various functions under the control of one or more microprocessors or other control devices.
[0054] In an embodiment according to the present disclosure, functions related to artificial intelligence may be implemented through a processor and memory. In this case, the processor may be any one of a general-purpose processor such as a CPU (Center Processing Unit), AP (Application Processor), DSP (Digital Signal Processor), a graphics-dedicated processor such as a GPU (Graphic Processing Unit) or VPU (Vision Processing Unit), and an artificial intelligence-dedicated processor such as an NPU (Neural Network Processing Unit). The processor may process input data according to predefined operation rules or artificial intelligence models stored in memory. Alternatively, if the processor is an artificial intelligence-dedicated processor, the artificial intelligence-dedicated processor may be designed with a hardware structure specialized for processing a specific artificial intelligence model. In some embodiments according to the present disclosure, functions related to artificial intelligence may be implemented through a plurality of processors.
[0055] In an embodiment according to the present disclosure, a predefined operation rule or artificial intelligence model may be configured to perform machine learning. Here, being configured to perform machine learning means that the predefined operation rule or artificial intelligence model is configured to perform a desired characteristic (or objective) by learning using a plurality of training data based on a learning algorithm. Such learning may be performed on the device itself in which the artificial intelligence according to the present disclosure is implemented, or it may be performed through a separate server and / or system.
[0056] Artificial intelligence models can be implemented as neural networks (or artificial neural networks) and can operate based on statistical learning algorithms that mimic biological neurons in machine learning and cognitive science. A neural network can refer to a model in which artificial neurons (nodes), which form a network through synaptic connections, change the strength of synaptic connections through learning to possess problem-solving capabilities. A neural network can be composed of multiple neural network layers; for example, a neural network may include an input layer, a hidden layer, and an output layer. Each of the multiple neural network layers may include at least one node and at least one weight, and neural network operations can be performed through operations between the results of previous (precious) layers and the weights. At least one weight possessed by the multiple neural network layers may be optimized based on the learning results of the artificial intelligence model. For example, at least one weight may be updated so that the loss value or cost value obtained from the artificial intelligence model during the learning process is reduced or minimized. Neural networks can infer a result to be predicted from an arbitrary input.
[0057] The learning methods of artificial intelligence models can be classified according to the learning approach into supervised learning, where input and output data are provided as training data and the correct answer (output data) corresponding to the problem (input data) is predetermined; unsupervised learning, where only input data is provided without output data and the correct answer (output data) corresponding to the problem (input data) is not predetermined; and reinforcement learning, where a reward is granted whenever an action is taken from the current state and learning proceeds in a direction that maximizes this reward. Alternatively, they can be classified according to the architecture, which is the structure of the learning model.
[0058] In the embodiments of the present disclosure, the artificial intelligence model is a Convolutional Neural Network (CNN) such as GoogleNet, AlexNet, VGG Network, Region with Convolutional Neural Network (R-CNN), Region Proposal Network (RPN), Recurrent Neural Network (RNN), Stacking-based Deep Neural Network (S-DNN), State-Space Dynamic Neural Network (S-SDNN), Deconvolution Network, Deep Belief Network (DBN), Restructured Boltzmann Machine (RBM), Fully Convolutional Network, Long Short-Term Memory Network (LSTM), Classification Network, Generative Modeling, eXplainable AI, Continual AI, Representation Learning, AI for Material Design, BERT, SP-BERT, MRC / QA for Natural Language Processing, Text Analysis, Dialog System, GPT-3, GPT-4, Visual Analytics, Visual Understanding, Video Synthesis for Vision Processing, Anomaly Detection, Prediction, Time-Series Forecasting, Optimization, Recommendation for ResNet Data Intelligence, At least one of various artificial intelligence structures and algorithms, such as data creation, may be used. The examples described above are merely examples of artificial intelligence structures and algorithms used according to the embodiments of the present disclosure and do not limit the artificial intelligence structures and algorithms used according to the embodiments of the present disclosure.
[0059] Hereinafter, various embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In describing the embodiments, technical details that are well known in the art to which the present invention pertains and are not directly related to the present invention will be omitted. This is to ensure that the essence of the present invention is conveyed more clearly without obscuring it by omitting unnecessary explanations. For the same reason, some components in the accompanying drawings may be exaggerated, omitted, or schematically depicted. Furthermore, the size of each component does not entirely reflect its actual size. Throughout this specification, the same reference numerals may refer to the same or corresponding components.
[0060] In this specification, an 'adversarial contrastive learning device' may be an artificial intelligence device that performs both adversarial learning and contrastive learning. In this specification, the term 'adversarial training' may be a technique that generates adversarial inputs that maximize a loss function during the training phase of a model and utilizes these adversarial inputs as a training dataset. In this specification, the term 'contrastive learning' may be a method that forms an aligned embedding space by optimizing a feature embedding layer so that feature vectors of similar samples are brought close together and feature vectors of samples with different meanings are moved far apart. Specifically, in this specification, contrastive learning may be 'supervised adversarial contrastive learning' with class labels.
[0061] Referring to FIG. 1, the adversarial contrast learning device (100) may include a processor (110), a communication module (120), and a memory (130).
[0062] The processor (110) can control the overall operation of the adversarial contrast learning device (100).
[0063] The communication module (120) can receive data required for the adversarial comparison learning method and transmit the generated data inside or outside the device (100). For example, the communication module (120) can transmit and receive information such as the original training batch, the adversarial example batch, the final adversarial example batch, and the loss function.
[0064] The memory (130) can store information for executing an adversarial comparison learning method. For example, the memory (130) can store information such as the original training batch, the adversarial example batch, the final adversarial example batch, and the loss function.
[0065] The processor (110) can load information necessary for the execution of an adversarial contrast learning method from memory (130) in order to execute an adversarial contrast learning method.
[0066] The processor (110) can train the encoder of a deep learning model by executing an adversarial contrast learning method. Specifically, the processor (110) can train the deep learning model by executing an adversarial contrast learning method and adding the gradient of the loss function to the output layer of the encoder.
[0067]
[0068] FIG. 2 is a flowchart of an adversarial contrast learning method for an encoder according to one embodiment.
[0069] Referring to FIG. 2, an adversarial contrast learning method for an encoder may include the steps of acquiring an adversarial example batch (S100), performing an inner maximization step (S200), performing an outer minimization step (S300), determining whether the number of learning iterations is satisfied (S400), and terminating the learning (S500).
[0070] Step S100 may be a step in which the device (100) acquires an adversarial example batch based on a previously stored original training batch. Here, the original training batch may include batch training samples and labels corresponding to each sample.
[0071] Here, the device (100) may obtain an adversarial example batch (X, Y) by copying the original training batch as is or by applying a data augmentation technique to expand the number of samples. Here, the 'adversarial example batch' is the original training batch with noise added, and may be the data before adding noise based on the loss function measured per anchor sample. That is, the adversarial example batch may be the initial data before the final adversarial example batch. Here, X may represent an adversarial example batch sample, and Y may represent the corresponding label of each adversarial example batch sample.
[0072] Here, the data augmentation technique may be one or more of FGSM (Fast Gradient Sign Method), C&W Attack (Carlini & Wagner Attack), DeepFool, and JSMA (Jacobian-based Saliency Map Attack), but is not limited thereto.
[0073] In this specification, the "step of measuring a loss function" may mean a step of inputting a single sample or batch into an encoder of a deep learning model to extract feature values in an output layer; and a step of inputting the extracted feature values into a projection layer to extract feature embedding vectors.
[0074] In one embodiment, the steps of measuring a loss function for each anchor data in an adversarial example batch, measuring a first loss function for each anchor sample in a final adversarial example batch, and measuring a second loss function for each anchor sample in an original training batch may all include the step of inputting data into an encoder of a deep learning model to extract feature values in an output layer; and the step of inputting the extracted feature values into a projection layer to extract feature embedding vectors.
[0075] In one embodiment, a single sample or batch is input to the output layer of the encoder of a deep learning model, and a feature value is input to the projection layer to maximize the effect of gradient propagation, improve learning stability, and prevent overfitting during learning.
[0076] Step S200 may be a step in which the device (100) generates adversarial examples that maximize the adversarial feature alignment loss. Specifically, Step S200 may include a step in which the device (100) generates a final adversarial example batch by adding noise to the adversarial example batch based on a loss function per anchor data within the adversarial example batch. Step S200 may include the device (100) adding noise to the adversarial example batch that maximizes the loss function per anchor sample within the final adversarial example batch.
[0077] Here, 'anchor data' may be data that serves as a reference within an adversarial example batch for adversarial learning. Here, 'anchor samples' may be data that serve as a reference within the final adversarial example batch.
[0078] Here, 'noise' may be the gradient of the loss function, specifically, the gradient of the loss function of adversarial feature alignment. Here, adversarial feature alignment may refer to alignment in the feature embedding space of a deep learning model.
[0079] In one embodiment, the device (100) may include the step of adding noise such that the loss function per anchor sample in the final adversarial example batch is maximized, thereby minimizing similarity with a set of positive samples having the same class label and maximizing similarity with a set of negative samples having different class labels. Thus, the device (100) can maximize the feature margin between classes.
[0080] The specific steps of the internal maximization step (S200) will be described in detail in Fig. 6.
[0081] Step S300 may be a step in which the device (100) minimizes the anchor sample-specific loss function in the final adversarial example batch and the anchor sample-specific loss function in the original training batch. Here, the anchor sample-specific loss function in the final adversarial example batch may be referred to as the 'first loss function' and specifically may be the loss function of adversarial feature alignment. Here, the anchor sample-specific loss function in the original training batch may be referred to as the 'second loss function' and specifically may be the contrast loss function.
[0082] In step S300, the device (100) can minimize a first loss function to maximize similarity with a positive set having the same class label and minimize similarity with a negative set having a different class label for each anchor sample in the final adversarial example batch. Thus, the device (100) can aggregate the features of the samples within a class and simultaneously maximize the feature margin between classes. Additionally, in step S300, the device (100) can minimize a second loss function to accurately align the features of the general samples.
[0083] The external minimization step (S300) will be described in detail in Fig. 6.
[0084] Step S400 may be a step that repeats Steps S100, S200, and S300 until the number of training iterations is satisfied. The number of training iterations may be pre-set or can be set.
[0085] Step S500 may be a step in which the device (100) terminates learning and adds the gradient of the minimized final loss function to the encoder layer of the deep learning model. Specifically, Step S500 may be a step in which the device (100) adds the gradient of the minimized final loss function to the entire layer of the encoder.
[0086] FIG. 3 is a figure illustrating the internal maximization step in adversarial contrast learning at the label level according to one embodiment.
[0087] Referring to FIG. 3, the device (100) can generate a final adversarial example batch (x + δ) (20) by adding noise (δ) to the adversarial example batch (10) in step S100. The device (100) can perform an internal maximization step in step S200 to maximize the distance to the positive set (30) and minimize the distance to the negative set (40).
[0088] FIG. 4 is a figure illustrating the external minimization step in adversarial contrast learning according to one embodiment.
[0089] Referring to FIGS. 3 and FIGS. 4, the device (100) can perform an external minimization step in step S300 to minimize the distance to the positive set (30) and maximize the distance to the negative set (40).
[0090] Figure 5 is a figure showing the result at the end of learning according to one embodiment.
[0091] Referring to FIG. 5, when the device (100) finishes learning at step S500, samples within the same class can be aggregated and the feature margin between different classes can be maximized.
[0092] Below, the inner maximization and outer maximization steps will be described in detail with reference to FIGS. 6 and FIGS. 7.
[0093] FIG. 6 is a specific flowchart of an internal maximization step according to one embodiment.
[0094] Referring to FIG. 6, the internal maximization step may include a step of measuring a loss function per anchor data of an adversarial example batch (S210), a step of adding the gradient of the loss function to the adversarial example batch (S220), a step of determining whether the number of iterations is satisfied (S230), and a step of generating a final adversarial example batch (S240).
[0095] Step S210 is a step in which the device (100) measures a loss function per anchor data of an adversarial example placement, specifically a step in which it measures a loss function of an adversarial feature alignment.
[0096] Here, the loss function can be expressed as shown in Equation 1 below.
[0097] [Mathematical Formula 1]
[0098]
[0099] L AFA : Adversarial feature alignment loss
[0100] X i ': Anchor data of the adversarial example batch generated from the original training batch
[0101] P: Selected from the original training batch X i A positive set of items with class labels like '
[0102] N: Selected from the original training batch X i A negative set with class labels different from '
[0103] In step S210, the device (100) can accurately measure how chaotic the feature vectors of adversarial examples are compared to original training batches in which the features are better aligned by selecting both a positive set (P) and a negative set (N) from the original training batch.
[0104] Step S220 may be a step in which the device (100) applies perturbation by transmitting the loss function as the gradient of the model input layer.
[0105] Here, as the similarity with the negative set selected from the original sample batch increases and as the similarity with the positive set selected from the original sample batch decreases, the denominator of the loss function of Equation 1 increases and the numerator decreases, so the loss function of Equation 1 can increase. Therefore, in step S220, the device (100) can add large noise, i.e., large perturbation, to the adversarial sample batch as the similarity with the negative set selected from the original sample batch increases and as the similarity with the positive set selected from the original sample batch decreases.
[0106] Step S230 may be a step of generating a final adversarial example batch if the device (100) satisfies the number of iterations, and repeating steps S210 and S220 if the number of iterations is not satisfied.
[0107] Step S240 may be a step in which the device (100) generates a final adversarial example batch. Here, the final adversarial example batch may be data with added noise, i.e., large perturbation, as the similarity to the negative set selected from the original sample batch increases and the similarity to the positive set selected from the original sample batch decreases.
[0108] Referring to FIGS. 3 and 6, in steps S210 to S240, the device (100) can measure the loss function per anchor data of the adversarial example batch (10) and, based thereon, apply perturbation to generate the final adversarial example batch (20). Specifically, the device (100) can add noise so that the loss function per anchor sample in the final adversarial example batch (20) is maximized, thereby minimizing the similarity with a positive set (30) having the same class label per sample and maximizing the similarity with a negative set (40) having a different class label per sample.
[0109] FIG. 7 is a specific flowchart of an external minimization step according to one embodiment.
[0110] Referring to FIG. 7, the external minimization step may include a step of measuring a first loss function (S310), a step of measuring a second loss function (S320), a step of combining the first loss function and the second loss function (S330), and a step of updating the encoder weights of the deep learning model based on the gradient of the final loss function (S340).
[0111] Step S310 is a step in which the device (100) measures a loss function per anchor sample of the final adversarial example batch, specifically a loss function of the adversarial feature alignment, i.e., a first loss function.
[0112] Here, the first loss function can be expressed as in Equation 1 above, but x i ' can be an anchor sample within the final adversarial example placement.
[0113] Step S320 is a step in which the device (100) measures a loss function per anchor sample within the original training batch, specifically a step of measuring a contrast loss function, i.e., a second loss function.
[0114] Here, the second loss function can be expressed as Equation 2 below.
[0115] [Mathematical Formula 2]
[0116]
[0117] L SUP : General map contrast loss
[0118] X i : Anchor samples of the original training batch
[0119] P: Selected from the original training batch X i A set of positive values with class labels such as
[0120] N: Selected from the original training batch X i A negative set with different class labels
[0121] Here, as the similarity with the negative set selected from the original sample batch increases, and as the similarity with the positive set selected from the original sample batch decreases, the denominator of the loss function in Equation 2 increases and the numerator decreases, so the loss function in Equation 2 can increase.
[0122] Step S330 may be a step in which the device (100) linearly combines a first loss function and a second loss function to generate a final loss function.
[0123] Step S340 may include a step in which the device (100) minimizes the final loss function, that is, both the first loss function and the second loss function.
[0124] Step S340 may include a step in which the device (100) updates the weights of the encoder of the deep learning model based on the gradient of the final loss function. Specifically, the device (100) may apply the gradient of the final loss function to the output layer of the encoder.
[0125] Referring to FIGS. 3, 4 and 7, in steps S310 to S340, the device (100) can measure the anchor sample-specific loss function (first loss function) of the final adversarial example batch (20) and the anchor sample-specific loss function (second loss function) within the original training batch (10). Then, the device (100) can minimize both the first loss function and the second loss function and update the weights of the encoder of the deep learning model based thereon.
[0126] In this case, the device (100) can minimize the first loss function to maximize the similarity with a positive set (30) having the same class label for each anchor sample in the final adversarial example batch (20) and minimize the similarity with a negative set (40) having a different class label.
[0127] The S200 and S300 steps can be combined and expressed by the following mathematical formula 3.
[0128] [Mathematical Formula 3]
[0129]
[0130] Here,
[0131] can be a mathematical expression representing the S200 step, and through the S200 step, a perturbation (δ) that maximizes the adversarial feature alignment loss function can be found and a final adversarial example batch can be generated based thereon.
[0132] In one embodiment, the device (100) can form a loose margin between classes by minimizing a first loss function to reduce the error rate for adversarial example samples that confuse the feature space. Additionally, the device (100) can align feature vectors of a general training batch that are relatively easy to align by minimizing a second loss function.
[0133] Meanwhile, the embodiments disclosed in this specification may be implemented in the form of a recording medium that stores instructions executable by a computer. The instructions may be stored in the form of program code and, when executed by a processor, may generate a program module to perform the operations of the disclosed embodiments. The recording medium may be implemented as a computer-readable recording medium. A computer-readable recording medium may include all types of recording media that store instructions decipherable by a computer. Examples include ROM, RAM, magnetic tape, magnetic disk, flash memory, optical data storage devices, etc.
[0134] The above descriptions are specific embodiments for carrying out the present disclosure. The present disclosure will include not only the embodiments described above, but also embodiments that can be simply modified or easily modified. Furthermore, the present disclosure will include technologies that can be easily modified and implemented using the embodiments described above. Accordingly, the scope of the present disclosure should not be limited to the embodiments described above, but should be defined by the claims set forth below as well as equivalents to the claims of the present disclosure.
Claims
1. An adversarial contrast learning method for an encoder performed by at least one processor, A step of generating an adversarial example batch based on a previously stored original training batch; A step of measuring a loss function per anchor data within the above adversarial example placement; A step of generating a final adversarial example batch by adding noise to the adversarial example batch based on the above anchor data-specific loss function; A step of measuring a first loss function per anchor sample in the final adversarial example batch and a second loss function per anchor sample in the original training batch; and A step of generating a final loss function by combining the first loss function and the second loss function and minimizing the final loss function; Adversarial contrast learning method for encoders.
2. In Paragraph 1, The step of generating the above final adversarial example placement is A step comprising repeating the step of adding noise to increase the first loss function. Adversarial contrast learning method for encoders.
3. In Paragraph 1, The step of generating the above final adversarial example placement is A step comprising, for each anchor sample within the final adversarial example batch, minimizing similarity with the set of positives having the same class label and maximizing similarity with the set of negatives having different class labels. Adversarial contrast learning method for encoders.
4. In Paragraph 3, The step of generating the above final adversarial example placement is A step comprising selecting both the above positive set and the above negative set from the original training batch. Adversarial contrast learning method for encoders.
5. In Paragraph 1, The loss function per anchor data within the above adversarial example batch is calculated based on the anchor data of the adversarial example batch, a positive set selected from the original training batch having the same class label as the anchor data of the adversarial example batch, and a negative set selected from the original training batch having a different class label as the anchor data of the adversarial example batch. Adversarial contrast learning method for encoders.
6. In Paragraph 1, The loss function per anchor data within the above adversarial example batch is an adversarial contrast learning method for an encoder expressed by the following Equation 1. [Mathematical Formula 1] L AFA : Adversarial feature alignment loss X i ': Anchor data of the adversarial example batch generated from the original training batch P: Selected from the original training batch X i A positive set of items with class labels like ' N: Selected from the original training batch X i A negative set with class labels different from ' 7. In Paragraph 1, The above second loss function is calculated based on an anchor sample of the original training batch, a set of positive data selected from the original training batch having the same class label as the anchor sample of the original training batch, and a set of negative data selected from the original training batch having a different class label as the anchor sample of the original training batch. Adversarial contrast learning method for encoders.
8. In Paragraph 1, The above second loss function is an adversarial contrast learning method for an encoder expressed by the following mathematical formula 2. [Mathematical Formula 2] L SUP : General map contrast loss X i : Anchor samples of the original training batch P: Selected from the original training batch X i A set of positive values with class labels such as N: Selected from the original training batch X i A negative set with different class labels 9. In Paragraph 1, The step of measuring the above loss function is: A step of extracting feature values of input data from the output layer of the encoder of a deep learning model; and The step of inputting the extracted feature values into a projection layer to extract a feature embedding vector; Adversarial contrast learning method for encoders.
10. In Paragraph 1, The method further comprises the step of applying the gradient of the minimized final loss function to all layers of the encoder of the deep learning model. Adversarial contrast learning method for encoders.
11. A computer program stored on a computer-readable, non-transient recording medium to execute an adversarial contrast learning method for an encoder according to paragraph 1.
12. Memory storing an adversarial contrast learning program for training the encoder; Communication module; and It includes a processor that controls the above memory, and The above processor is, Generate an adversarial example batch based on the previously saved original training batch, and A loss function for each anchor data within the above adversarial example batch is measured, and based on this, noise is added to the adversarial example batch to generate a final adversarial example batch, and Measure the first contrast loss function per anchor sample within the above final adversarial example batch and the second contrast loss function per anchor sample within the original training batch, and A final loss function is generated by combining the first comparison loss function and the second comparison loss function, and the final loss function is minimized. Adversarial contrast learning device for encoders.