TRAINING DEVICE, TRAINING METHOD, AND TRAINING PROGRAM

A learning device includes processing circuitry configured to calculate a degree of deviation between a first output obtained by inputting first training data to a learned first model and a second output obtained by inputting second training data created by giving noise to the first training data to a second model, and a degree of deviation between an intermediate representation of the first model generated in a process of obtaining the first output and an intermediate representation of the second model generated in a process of obtaining the second output, and update a parameter of the second model so that the degree of deviation between the first output and the second output and the degree of deviation between the intermediate representation of the first model and the intermediate representation of the second model are reduced.

TECHNICAL FIELD

The present invention relates to a learning device, a learning method, and a learning program.

BACKGROUND ART

In the related art, adversarial training is known as a technique for creating deep learning models that are robust against adversarial examples (adversarial samples).

An adversarial example is created by adding a small artificial perturbation that cannot be perceived by humans to a certain sample (clean sample). Adversarial examples may be used as adversarial input samples to perturb the output of deep learning.

For example, in image classification, an adversarial example image is created by applying an artificial perturbation to a certain image.

Such an image causes the classification result of deep learning to be erroneously classified as that of a different image while maintaining the appearance of the original image.

For example, in a case where the type of sign recognized by a vehicle that automatically drives is changed from the original one to another, it is conceivable that the vehicle erroneously recognizes the sign.

Non Patent Literature 1 describes adversarial training that enhances robustness of a deep learning model by incorporating an adversarial example into training data in advance.

CITATION LIST

Non Patent Literature

SUMMARY OF INVENTION

Technical Problem

However, the related art has a problem in that accuracy for the clean sample may be reduced when enhancing robustness of the model to the adversarial example.

For example, a deep learning model trained by adversarial training described in Non Patent Literature 1 shows a certain degree of robustness to the adversarial example, but the accuracy for the clean sample may decrease.

Solution to Problem

In order to solve the above-described problems and achieve the object, a learning device includes: a calculation unit configured to calculate a degree of deviation between a first output obtained by inputting first training data to a learned first model and a second output obtained by inputting second training data created by giving noise to the first training data to a second model, and a degree of deviation between an intermediate representation of the first model generated in a process of obtaining the first output and an intermediate representation of the second model generated in a process of obtaining the second output; and an update unit configured to update a parameter of the second model so that the degree of deviation between the first output and the second output and the degree of deviation between the intermediate representation of the first model and the intermediate representation of the second model are reduced.

Advantageous Effects of Invention

According to the present invention, it is possible to suppress a decrease in accuracy for a clean sample when enhancing robustness of a model to an adversarial example.

DESCRIPTION OF EMBODIMENTS

Hereinafter, embodiments of a learning device, a learning method, and a learning program according to the present application will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiments described below.

Here, in the conventional adversarial training, for example, minimization of an error function Lee as illustrated in Formula (1) is performed.

Furthermore, noise n (adversarial noise) is set as in Formula (2) so that the error function is maximized under a constraint S of the noise magnitude.

Here, x is an input training sample. y is a label attached to the sample. The training data is a combination of x and y. In addition, φθis a model having a parameter θ (for example, a deep learning model).

Note that x corresponds to a clean sample. In addition, x+η corresponds to an adversarial example.

When x+η in Formula (1) is replaced with x, an error function for learning the clean sample is obtained. Therefore, it can be said that the adversarial example is learned in the same way as the clean sample in the conventional adversarial training.

In other words, in conventional adversarial training, there is only a constraint that the adversarial example is classified into the same label as the clean sample that is the source. For this reason, in the related art, an adversarial example, which is a special input, may be learned as another data having the same label as the clean sample.

As a result, a learned model may fail to extract a feature used for classification of clean samples, or may perform classification using special noise n when creating an adversarial example. In this way, in the conventional adversarial training, the performance of the model may deteriorate.

One object of the present embodiment is to suppress a decrease in accuracy for a clean sample when enhancing robustness of a model to an adversarial example. [Configuration of First Embodiment] First, a configuration of a learning device according to a first embodiment will be described with reference toFIG.1.FIG.1is a diagram illustrating an example of the configuration of the learning device according to the first embodiment.

A learning device10receives inputs of clean samples and adversarial examples, and outputs a learned deep learning model. The learning device10may create adversarial examples from clean samples without receiving an input of adversarial examples.

As illustrated inFIG.1, the learning device10includes a communication unit11, an input unit12, an output unit13, a storage unit14, and a control unit15.

The communication unit11performs data communication with other devices via a network. For example, the communication unit11is a network interface card (NIC).

The input unit12receives an input of data from a user. The input unit12is, for example, an input device such as a mouse or a keyboard.

The output unit13outputs data by displaying a screen or the like. The output unit13is, for example, a display device such as a display.

The storage unit14is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), or an optical disc. Note that the storage unit14may be a semiconductor memory capable of rewriting data, such as a random access memory (RAM), a flash memory, or a non volatile static random access memory (NVSRAM).

The storage unit14stores an operating system (OS) and various programs executed by the learning device10.

The storage unit14stores teacher model information141and learning model information142.

For example, the teacher model information141and the learning model information142are weights and biases of a teacher model which is a deep learning model and a neural network constituting the learning model, respectively. The teacher model and the learning model will be described later.

The control unit15controls the entire learning device10. The control unit15is, for example, an electronic circuit such as a central processing unit (CPU), a micro processing unit (MPU), or a graphics processing unit (GPU), or an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

Further, the control unit15includes an internal memory for storing programs and control data defining various processing procedures, and executes each processing operation using the internal memory.

Furthermore, the control unit15functions as various processing units by operating various programs. For example, the control unit15includes a classification unit151, a calculation unit152, and an update unit153.

Learning processing performed by the classification unit151, the calculation unit152, and the update unit153will be described with reference toFIG.2.FIG.2is a diagram illustrating learning processing.

The classification unit151classifies an input sample into classes on the basis of an output obtained by inputting the input sample into the model. For example, the model may recognize an object appearing in an image and output a score for each class. At that time, the sample is an image.

In addition, the classification unit151is not limited to the classification task, and may perform inference using a learned model.

Here, the teacher model is a learned deep learning model, and is constructed on the basis of the teacher model information141. Note that the teacher model may be a deep learning model trained using only clean samples.

Furthermore, the learning model is a deep learning model to be trained by the learning device10, and is constructed on the basis of the learning model information142.

As illustrated inFIG.2, the classification unit151inputs a clean sample x to the teacher model and executes classification. In addition, the classification unit151inputs an adversarial example x+n to the learning model and executes classification.

Note that the classification unit151can calculate the noise n by a method described in the following reference literature.

The calculation unit152calculates a degree of deviation Lcebetween an output φt(x) obtained by inputting a clean sample x to a learned teacher model and an output φθ(x) obtained by inputting an adversarial example x+n created by giving noise n to the clean sample x to a learning model, and a degree of deviation D between an intermediate representation φt,m(x) of the teacher model generated in the process of obtaining the output (t (x) and an intermediate representation φθ,m(x+η) of the learning model generated in the process of obtaining the output φθ(x).

The teacher model is an example of a first model. Also, the clean sample x is an example of first training data. φt(x) is an example of a first output. t is a parameter of the teacher model. The learning model is an example of a second model. The adversarial example x+n is an example of second training data. φθ(x) is an example of a second output. θ is a parameter of the learning model. Note that x may be an image or a feature amount extracted from the image.

In addition, it is assumed that φα, β(γ) is a vector representing the output of the β-th layer when γ is input to the neural network constructed from the parameter α. In addition, it is assumed that φα(γ) is a vector representing an output of a final layer when γ is input to the neural network constructed from the parameter α.

In addition, it is assumed that the number of layers and the number of nodes in each layer are the same between the neural network of the teacher model and the neural network of the learning model. Therefore, the intermediate representation φt,m(x) and the intermediate representation φθ,m(x+η) are vectors of the same size.

At this time, the calculation unit152calculates a degree of deviation between the output φt(x), which is an output of a final layer of the teacher model that is a neural network, and the output φθ(x), which is an output of a final layer of the learning model that is a neural network having the same topology as the teacher model, and a degree of deviation between the intermediate representation φt,m(X), which is an output of an intermediate layer of the teacher model, and the intermediate representation φθ,m(x+η), which is an output of an intermediate layer of the learning model in the same layer (m-th layer) as the intermediate layer.

The calculation unit152can calculate an error function as in Formula (3).

The update unit153updates the parameter of the learning model so that the degree of deviation Lcebetween the output φt(x) and the output de (x) and the degree of deviation between the intermediate representation φt,m(x) of the teacher model and the intermediate representation φθ,m(x+η) of the learning model are reduced.

The update unit153updates the parameter of the learning model, that is, the learning model information142so that the error function of Formula (3) is minimized. For example, the update unit153updates the parameter by backpropagation.

In this manner, the learning device10can optimize the learning model for both the output and the intermediate representation.

Processing of First Embodiment

FIG.3is a flowchart illustrating a flow of processing of the learning device according to the first embodiment. As illustrated inFIG.3, first, the learning device10inputs a clean sample to the teacher model (step S101). It is assumed that the teacher model has been learned by the clean sample or another clean sample input in step S101.

Next, the learning device10inputs an adversarial example to the learning model (step S102). The adversarial example is created by giving noise to the clean sample in step S101.

Here, the learning device10calculates an error function for optimizing both the error of the intermediate representation between the teacher model and the learning model and the error of the output (step S103). For example, the learning device10calculates an error function shown in Formula (3).

Then, the learning device10updates the learning model so that the error function is optimized (step S104). For example, the learning device10updates the learning model information142. The learning device10can output the updated learning model information142.

Effects of First Embodiment

As described above, the calculation unit152calculates a degree of deviation between a first output obtained by inputting first training data to the learned first model and a second output obtained by inputting second training data created by giving noise to the first training data to the second model, and a degree of deviation between an intermediate representation of the first model generated in the process of obtaining the first output and an intermediate representation of the second model generated in the process of obtaining the second output. The update unit153updates the parameter of the second model so that the degree of deviation between the first output and the second output and the degree of deviation between the intermediate representation of the first model and the intermediate representation of the second model are reduced.

In this manner, the learning device10can perform training so that the intermediate representation is optimized in addition to the output of the model. Thus, according to the present embodiment, it is possible to suppress a decrease in accuracy for the clean sample when enhancing the robustness of the model to the adversarial example.

The calculation unit152calculates a degree of deviation between the first output, which is an output of a final layer of the first model that is a neural network, and the second output, which is an output of a final layer of the second model that is a neural network having the same topology as the first model, and a degree of deviation between a first intermediate representation, which is an output of an intermediate layer of the first model, and a second intermediate representation, which is an output of an intermediate layer of the second model in the same layer as the intermediate layer.

Accordingly, since the output and the intermediate representation can be acquired as vectors of the same size from each model, the degree of deviation can be easily calculated.

The calculation unit152calculates a degree of deviation between the first output obtained by inputting the first training data that is an image to the first model and the second output obtained by inputting the second training data that is an image created by giving noise to the first training data to the second model.

Accordingly, it is possible to reduce damage of an attack on a system that performs image recognition by deep learning (for example, a sign classification system to be described later).

[Test Results] Tests performed using the present embodiment will be described with reference toFIGS.4and5.FIGS.4and5are diagrams illustrating test results.

The deep learning model (teacher model and learning model) in the test is ResNet18 (reference literature:https://arxiv.org/abs/1512.03385). Further, it is cifar10 (reference literature:https://www.cs.toronto.edu/˜kriz/cifar.html).

In addition, methods for creating the adversarial example in the test (attack method) are projected gradient descent (PGD) (reference literature: Non Patent Literature 1) and Auto Attack (reference literature:https://arxiv.org/abs/2003.01690).

The degree of deviation D of the intermediate representation in the test is LPIPS distance (reference literature: https://arxiv.org/abs/1801.03924).

In each of the graphs inFIG.4, the vertical axis represents accuracy (image classification accuracy), and the horizontal axis represents the number of epochs (progress of learning). In addition, a broken line inFIG.4indicates the accuracy of the model in a case where learning is performed using the embodiment. In addition, a solid line inFIG.4indicates the accuracy of the model in a case where learning is performed using the related art.

test_clean_accuracy is accuracy for the clean sample. In addition, test_robust_accuracy is accuracy for the adversarial example created by PGD. FromFIG.4, it can be said that the present embodiment tends to be higher than the related art in terms of any accuracy.

Furthermore,FIG.5illustrates a result of performance measurement performed on a model having the highest test_robust_accuracy. “Standard adversarial training” corresponds to the related art. Also, “proposed” corresponds to the present embodiment.

FromFIG.5, it can be said that the present embodiment exhibits higher accuracy than the related art in terms of any case.

In addition, from the results of tests, it can be said that in the present embodiment, not only the accuracy but also the robustness to the adversarial example are improved as compared with the related art.

Example

The deep learning model trained by the learning device10according to the present embodiment is used in, for example, a vehicle control system including a sign classification system.

FIG.6is a diagram illustrating a configuration example of a vehicle control system. As illustrated inFIG.6, a vehicle control system2includes a vehicle21, a sign classification system22, and a driving control system23.

The vehicle21is an automated vehicle. In addition, the vehicle21is provided with an in-vehicle camera that captures an image. Further, the sign classification system22and the driving control system23are implemented by an electronic control unit (ECU) or the like provided in the vehicle21.

The sign classification system22can classify a sign appearing in an image on the basis of image information regarding the image captured by the vehicle21using the learned model221that is a deep learning model trained by the learning device10.

The sign classification system22inputs sign information that is a classification result of a sign to the driving control system23. The driving control system23controls acceleration, deceleration, steering, and the like of the vehicle21according to the input sign information.

Here, the learned model221is robust to adversarial example attacks. Therefore, a risk that the sign classification system22erroneously recognizes a sign, and as a result, the driving control system23performs erroneous control, and an accident or the like occurs is reduced.

According to the present embodiment, not only the driving control system but also various products can be protected from adversarial examples.

System Configuration and Others

In addition, each component of each illustrated device is functionally conceptual, and does not necessarily need to be physically configured as illustrated. That is, a specific form of distribution and integration of the respective devices is not limited to the illustrated form, and all or some of the devices can be functionally or physically distributed or integrated in any unit, depending on various loads, usage conditions, and the like. Furthermore, all or an arbitrary part of each processing function performed in each device can be implemented by a central processing unit (CPU) and a program analyzed and executed by the CPU, or can be implemented as hardware by wired logic. Note that the program may be executed not only by a CPU but also by another processor such as a GPU.

Further, among processing operations described in the present embodiment, all or some of processing operations described as being automatically performed can be manually performed, or all or some of processing operations described as being manually performed can be automatically performed by a known method. In addition, processing procedures, control procedures, specific name, and information including various kinds of data and parameters illustrated in the specification and the drawings can be arbitrarily changed unless otherwise specified.

[Program] As an embodiment, the learning device10can be implemented by installing a learning program for executing the above learning processing as packaged software or online software in a desired computer. For example, an information processing device can be caused to function as the learning device10by causing the information processing device to execute the above learning program. The information processing device mentioned here includes a desktop or a laptop personal computer. Moreover, the information processing device also includes a mobile communication terminal such as a smartphone, a mobile phone, and a personal handyphone system (PHS), a slate terminal such as a personal digital assistant (PDA), and the like.

Moreover, the learning device10can also be implemented as a learning server device that uses a terminal device used by the user as a client and provides the client with a service related to the learning processing described above. For example, the learning server device is implemented as a server device that provides a learning service having clean sample as an input and a learned model as an output. In this case, the learning server device may be implemented as a web server, or may be implemented as a cloud that provides a service related to the learning processing by outsourcing.

FIG.7is a diagram illustrating an example of a computer that executes the learning program. A computer1000includes, for example, a memory1010and a CPU1020. Further, the computer1000also includes a hard disk drive interface1030, a disk drive interface1040, a serial port interface1050, a video adapter1060, and a network interface1070. These units are connected to each other by a bus1080.

The memory1010includes a read only memory (ROM)1011and a random access memory (RAM)1012. The ROM1011stores, for example, a boot program such as a basic input output system (BIOS). The hard disk drive interface1030is connected to a hard disk drive1090. The disk drive interface1040is connected to a disk drive1100. For example, a removable storage medium such as a magnetic disk or an optical disc is inserted into the disk drive1100. The serial port interface1050is connected to, for example, a mouse1110and a keyboard1120. The video adapter1060is connected to, for example, a display1130.

The hard disk drive1090stores, for example, an OS1091, an application program1092, a program module1093, and program data1094. That is, the program that defines each processing operation of the learning device10is implemented as the program module1093in which codes executable by a computer are described. The program module1093is stored in, for example, the hard disk drive1090. For example, the program module1093for executing processing similar to the functional configuration in the learning device10is stored in the hard disk drive1090. Note that the hard disk drive1090may be replaced with a solid state drive (SSD).

In addition, setting data used in the processing of the above-described embodiment is stored, for example, in the memory1010or the hard disk drive1090as the program data1094. Then, the CPU1020reads the program module1093and the program data1094stored in the memory1010and the hard disk drive1090to the RAM1012as necessary, and executes the processing of the above-described embodiment.

Note that the program module1093and the program data1094are not limited to being stored in the hard disk drive1090, and may be stored in, for example, a removable storage medium and read by the CPU1020via the disk drive1100or the like. Alternatively, the program module1093and the program data1094may be stored in another computer connected via a network (a local area network (LAN), a wide area network (WAN), or the like). Then, the program module1093and the program data1094may be read by the CPU1020from another computer via the network interface1070.

REFERENCE SIGNS LIST