Transformer Attention Weight Perturbation for Adversarial Training
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing adversarial training methods for machine translation models, particularly those based on Transformer, do not fully leverage the Self-Attention mechanism, leading to inadequate robustness against adversarial attacks and generalization issues.
Innovation Solution
A method and apparatus that disturb the attention weights captured by the attention layer of a machine learning model to generate adversarial samples, focusing on the Self-Attention mechanism, and train the model based on the difference between predicted and labeled characters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional adversarial training methods are used for machine translation models, then the model can be trained to resist adversarial attacks, but the model does not fully leverage the Self-Attention mechanism, leading to inadequate robustness and generalization issues
Solution Approach 1:
The patent applies parameter changes by perturbing the attention weights in the Self-Attention mechanism during adversarial training. Specifically, the attention weights are modified by adding noise or applying transformations to create adversarial examples that challenge the model's robustness while maintaining the structural integrity of the attention mechanism, thereby improving both robustness and generalization simultaneously
Solution Approach 2:
The patent converts the harmful effect of adversarial attacks into a beneficial training signal. By intentionally introducing adversarial perturbations to the attention weights and using these perturbed versions for training, the model learns to resist adversarial attacks while improving its generalization capability through exposure to diverse attention weight configurations
2Reliability
If attention weights are disturbed to generate adversarial samples, then the model's ability to resist adversarial attacks improves, but the training process becomes more complex
Solution Approach 1:
The patent applies preliminary action by pre-computing the attention weights from the source sequence before applying adversarial perturbations. This allows the adversarial training process to reuse these pre-computed weights across different perturbation scenarios, reducing redundant computations and simplifying the overall training process while maintaining robustness improvements
Data Source
AI summary
The present application discloses a method and an apparatus for adversarial training of a machine learning (ML) model and a medium. The method includes: obtaining input information in a training sample; extracting features of a plurality of input characters in the input information; inputting the features of the plurality of input characters to the ML model, to capture an attention weight on an input character of the plurality of input characters by an attention layer of the ML model; disturbing the attention weight captured by the attention layer, so that the ML model outputs a predicted character according to the attention weight disturbed; and training the ML model according to a difference between the predicted character and a labeled character in the training sample.