言語処理学会 第24回年次大会 発表論文集 (2018年3月)

ࣗવ‫ॲޠݴ‬ཧʹ͓͚ΔղऍՄೳͳఢରతઁಈͷֶशࠤ౻ ‫ لݩ‬1ླ໦ ५ 2,3ਐ౻ ༟೭ 1,3দຊ ༟࣏ 1,31ಸྑઌ୺Պֶٕज़େֶӃେֶ ৘ใՊֶ‫ڀݚ‬Պ2NTT ίϛϡχέʔγϣϯՊֶ‫ॴڀݚૅج‬3ཧԽֶ‫৽ֵ ॴڀݚ‬஌ೳ૯߹‫ڀݚ‬ηϯλʔ{sato.motoki.sa7, shindo, matsu}@is.naist.jp
suzuki.jun@lab.ntt.co.jp

1 ͸͡ΊʹχϡʔϥϧωοτϫʔΫ͸ɼը૾ɼԻ੠ɼࣗવ‫ॲޠݴ‬ཧͷ෼໺Ͱ޿࣮͘༻Խ͕ਐΜͰ͍ΔɽχϡʔϥϧωοτϫʔΫͷ‫ڀݚ‬୊ࡐͷҰͭͱͯ͠ɼೖྗʹରͯ͠খ͞ͳઁಈʢϊΠζϕΫτϧʣΛ༩͑Δ͜ͱͰɼֶशࡁΈɼ
͋Δ͍͸ֶशதͷχϡʔϥϧωοτΛ‫ޡ‬෼ྨͤ͞Δఢ
ରతαϯϓϧ (Adversarial Example) Λ༻͍ͨํ๏࿦͕
ۙ೥ଟ͘ͷ‫ʹऀڀݚ‬஫໨͞Ε͍ͯΔ [15, 4]ɽྫ͑͹ը૾ೝࣝͷ෼໺Ͱ͸ɼਖ਼͘͠෼ྨͰ͖͍ͯΔύϯμͷը૾ʹରͯ͠ઁಈΛՃ͑ɼؒҧͬͨ෼ྨΛͤ͞Δ͜ͱ͕ใࠂ͞Ε͍ͯΔ [4]ɽ͜ͷઁಈ͸χϡʔϥϧωοτϫʔΫͷଛࣦؔ਺ͷޯ഑Λ༻͍ͯ‫ٻ‬ΊΔ͜ͱ͕Ͱ͖Δɽ͞Βʹɼఢରతֶश (Adversarial Training) ͱ‫ݺ‬͹ΕΔઁಈΛՃ͑ͨը૾Λਖ਼͘͠෼ྨ͢Δଛࣦؔ਺Λ௥Ճ͢Δ͜ͱͰ൚Խੑೳ͕ߴ·Δ͜ͱ΋ใࠂ͞Ε͍ͯΔ [4]ɽࣗવ‫ॲޠݴ‬ཧͷ෼໺Ͱ΋ఢରతֶशͷద༻͸‫ݕ‬౼͞Ε͓ͯΓɼ൚Խੑೳ͕޲্͢Δ͜ͱ͕ใࠂ͞Ε͍ͯΔ[11]ɽ͔͠͠ɼࣗવ‫ॲޠݴ‬ཧͱը૾ͷ෼໺ͷେ͖ͳҧ͍ͱͯ͠ɼը૾ͷ෼໺Ͱ͸ೖྗ͸࿈ଓత (ྫ:RGB ஋)Ͱ͋Δͷʹରͯ͠ɼࣗવ‫ॲޠݴ‬ཧͷ෼໺͸ೖྗ͸཭ࢄత (ྫ:୯‫͋Ͱ )ޠ‬Δ఺͕‫͛ڍ‬ΒΕΔɽ͜ͷҧ͍͔Βɼը૾ͷ৔߹͸ɼೖྗը૾ʹઁಈΛՃ͑ͨը૾͸ RGB ͷൣғ (0-255) ͰਓؒʹղऍͰ͖Δ‫Ͱܗ‬ද‫͢ݱ‬Δ͜ͱ͕
Ͱ͖Δ͕ɼࣗવ‫ॲޠݴ‬ཧͷ৔߹ɼೖྗͷ୯‫ޠ‬ϕΫτϧʹઁಈΛՃ͑ͨϕΫτϧ͕ͲͷΑ͏ͳγϯϘϧʹରԠ͢Δͷ͔ղऍ͢Δ͜ͱ͸೉͍͠ɽ͜Ε͸ɼ୯‫ޠ‬ϕΫτϧ͕ுΔ D ࣍‫ݩ‬ͷ୯‫ޠ‬ϕΫτϧۭؒதͰɼ֤୯‫ޠ‬͸1 ఺ʹ૬౰͢ΔͨΊɼͨͱ͑਺ඦສ୯‫ޠ‬Λ༻͍ͨͱͯ͠΋ɼͦͷۭؒதʹ·͹Βʹ͔͠ϕΫτϧ͕෼෍͠ͳ͍ঢ়ଶͰ͋Δ͜ͱʹ‫ى‬Ҽ͢Δɽͦ͜Ͱຊ‫Ͱڀݚ‬͸ɼࣗવ‫ॲޠݴ‬ཧʹ͓͚Δఢରతֶशͷख๏ͱͯ͠ɼ୯‫ޠ‬ϕΫτϧʹઁಈΛՃ͑Δࡍʹ࣮ࡍʹγϯϘϧʢ୯‫ޠ‬ʣ͕ଘࡏ͢Δํ޲ʹ‫ݶ‬ఆͯ͠ઁಈΛՃ͑Δख๏ΛఏҊ͢Δ (ਤ 1)ɽఏҊख๏ʹ͸ɼগͳ͘ͱ΋ҎԼͷ 2 ͭͷར఺͕͋Δͱߟ͑ΒΕΔ:• ઁಈͷ޲͖ͱେ͖͞Λ୯‫ޠ‬ͷํ޲ʹ‫͍ͯج‬ՄࢹԽ͢Δ͜ͱ͕Ͱ͖Δɽ• ઁಈΛՃ͑ͨ͜ͱʹΑΓੜ੒͞ΕΔٖࣅσʔλΛਓ͕ؒղऍՄೳͳγϯϘϧʹ෮‫͢ݩ‬Δ͜ͱ͕Ͱ͖Δɽͭ·ΓɼఏҊ๏͸ɼը૾ॲཧͷ෼໺Ͱ‫͕ڀݚ‬੝ΜʹਐΜͰ͍Δఢରతֶश๏Λɼೖྗ͕཭ࢄγϯϘϧʹͳΔͱ͍͏ࣗવ‫ॲޠݴ‬ཧ෼໺ͷಛੑΛؑΈͯɼΑΓਓؒͷղऍੑ͕޲্͢ΔΑ͏ʹվྑͨ͠औΓ૊ΈͰ͋ΔɽຊߘͰ͸ɼ‫ۃ‬ੑ෼ྨ໰୊Λ༻͍ͯఏҊ๏ͷ༗ޮੑΛ‫ূݕ‬͢Δɽਤ 1: ैདྷख๏ (ࠨ) ͱఏҊख๏ (ӈ) ͷҧ͍Λࣔ͢ɽैདྷख๏Ͱ͸ɼ୯‫ޠ‬ϕΫτϧ͕ଘࡏ͠ͳ͍ํ޲ʹઁಈΛՃ͑Δ͜ͱ͕Ͱ͖Δ͕ɼఏҊख๏͸ઁಈ͕୯‫ޠ‬ϕΫτϧํ޲΁‫ݶ‬ఆ͢Δ͜ͱΛ໨తͱ͢Δɽ

2 ؔ࿈‫ڀݚ‬෼ྨ‫ث‬ͷग़ྗΛ‫ޡ‬ΒͤΔઁಈ͸ɼจ‫[ ݙ‬15] ʹΑͬͯ໰୊ఏ‫͞ى‬Εͨ. ͜ͷઁಈ͸ޯ഑Λ༻͍ͯ‫ٻ‬ΊΒΕΔ[15, 4]ɽఢରతαϯϓϧΛਖ਼͘͠෼ྨ͢ΔΑ͏ͳଛࣦؔ਺Λ༻͍Δఢରతֶश [4] ΋ఏҊ͞Εͨɽࣗવ‫ॲޠݴ‬ཧʹ͓͚Δఢରతαϯϓϧɼ‫ͼٴ‬ఢରతֶशͷ‫ͯ͠ͱڀݚ‬ɼಡղγεςϜ [7] ΍ɼχϡʔϥϧ‫ػ‬ց຋༁γεςϜ (NMT)[1, 6] ͷग़ྗΛม͑ΔఢରతͳೖྗจΛ࡞ΔࢼΈ͕ߦΘΕ͍ͯΔɽఢରతͳೖྗจΛ࡞Δ͜ͱͰɼϞσϧͷੑ࣭Λਓ͕ؒཧղ͢Δ͜ͱ͕Ͱ͖Δͱ͍͏ར఺͕͋Δɽఢରతͳೖྗจͷ࡞੒͸ɼਓखͰ࡞Δख๏ [7] ΍ɼೖྗจͷ୯‫ޠ‬Λಉٛ‫ʹޠ‬ஔ͖‫͑׵‬ͨจΛେྔʹ࡞੒͠ɼ༧ଌ͕‫ޡ‬Δ͔୳ࡧ͢Δ΋ͷ [13]ͳͲ͕͋Δ͕ɼ‫ࢉܭ‬ίετ͕ߴ͍ͱ͍͏໰୊͕͋Δɽจ‫[ ݙ‬11] Ͱ͸ɼจॻ෼ྨλεΫʹ͓͍ͯɼ୯‫ޠ‬ϕΫτϧʹઁಈΛՃ͑Δख๏͕ఏҊ͞Ε͍ͯΔɽ·ͨɼେ͖͘൚Խੑೳ͕޲্͢Δ͜ͱΛࣔͨ͠ɽ͜ͷΑ͏ʹࣗવ‫ॲޠݴ‬ཧͷ෼໺Ͱ΋ঃʑʹఢରతֶशͷ࿮૊ΈΛ༻͍Δ͜ͱͷ༗ޮੑ͕ࣔ͞ΕΔΑ͏ʹͳ͖ͬͯͨɽҰํɼ࣮ࡍʹ୯‫ޠ‬ϕΫτϧʹઁಈ͕ՃΘͬͨ͜ͱʹΑͬͯͲ͏͍ͬͨޮՌ͕ಘΒΕ͍ͯΔͷ͔Λࣗવ‫ॲޠݴ‬ཧλεΫͰఆੑతʹղऍ͢Δ͜ͱ͸ɼը૾ॲཧλεΫ΄Ͳ༰қͰ͸ͳ͍ɽը૾ॲཧλεΫͷ৔߹͸ɼઁಈΛՃ͑ͨσʔλΛը૾ͱٖͯ͠ࣅతʹ෮‫͢ݩ‬Δ͜ͱ͕ൺֱత༰қͰ͋Δɽ͔͠͠ɼࣗવ‫ॲޠݴ‬ཧλεΫͰ͸ɼઁಈΛՃٖ͑ͨࣅσʔλΛ‫࣮ݱ‬ͷ୯‫ޠ‬΍จষʹରԠͤͯ͞෮‫͢ݩ‬Δ͜ͱ͸ࠔ೉Ͱ͋Δɽ͜Ε͸ઁಈ͕ՃΘͬͨϕΫτϧ͕‫࣮ݱ‬ͷσʔλ఺ͱҰக͢Δ͜ͱ͕΄΅‫͜ى‬Βͳ͍͜ͱʹ‫ى‬Ҽ͢Δɽ

― 955 ―

Copyright(C) 2018 The Association for Natural Language Processing.
All Rights Reserved.

͜ͷΑ͏ʹઁಈΛσʔλʹՃ͑ͯ൚Խੑೳ্͕͕Δ͜ͱΛٞ࿦͍ͯ͠Δ‫ڀݚ‬͸ଘࡏ͢Δ͕ɼͦͷղऍੑΛٞ࿦ͨ͠‫ڀݚ‬͸ɼචऀΒͷ஌Δ‫ݶ‬Γ‫Ͱ఺࣌ݱ‬͸ใࠂ͞Ε͍ͯͳ͍1 ɽ3 ఢରతઁಈຊߘͰ͸ɼ؆୯ͳྫͱͯ͠ೋΫϥε෼ྨ໰୊Λର৅ʹٞ࿦Λߦ͏ɽ͜͜Ͱ͸ɼೖྗΛจষɼग़ྗΛਖ਼(Positive) ·ͨ͸ෛ (Negative) ͷೋΫϥεͱԾఆ͢Δɽೖྗจ X ͸ T ‫ݸ‬ͷ୯‫ߏͰྻܥޠ‬੒͞ΕΔͱ͢Δɽ
·ͨɼೖྗจதʹग़‫͢ݱ‬Δ୯‫ޠ( ߹ूޠ‬ኮ) Λ V ͱ͠ɼx(t) ∈ V Λ t ൪໨ͷ୯‫͢ͱޠ‬Δɽ͜ͷ࣌ɼೖྗจ X ͸X = (x(1) , . . . , x(T ) ) ͱද͢͜ͱ͕Ͱ͖Δɽ؆୯ͷͨΊɼ‫( ྻܥ‬x(1) , . . . , x(T ) ) Λ୹ॖͯ͠ (x(t) )Tt=1 ͱ‫ه‬ड़͢Δɽ࣍ʹɼೖྗจ X ʹର͢Δਖ਼ղϥϕϧΛ y ͱ͢Δɽx(t) ʹରԠ͢Δ୯‫ޠ‬ϕΫτϧΛ w(t) ∈ RD ͱ͢ΔɽҎ߱ɼೖྗ X ′ ͸ϕΫτϧͷ‫͑ߟͱྻܥ‬Δ͜ͱͱ
͢Δɽͭ·ΓɼX ′ = (w(t) )Tt=1 Ͱ͋Δɽ(t)͜͜Ͱɼ֤୯‫ޠ‬ϕΫτϧʹઁಈϕΫτϧ radv ΛՃ͑(t)Δ͜ͱΛߟ͑Δɽradv ͸ɼ୯‫ޠ‬ϕΫτϧͱಉ͡ D ࣍‫͢ͱݩ‬Δɽ

3.1 ैདྷ๏͜͜Ͱ͸ɼఏҊ๏ͷϕʔεͱͳΔจ‫[ ݙ‬11] Ͱड़΂Β
Ε͍ͯΔख๏ͷུ֓Λड़΂Δɽจ‫[ ݙ‬11] Ͱ͸ɼ֤Ґஔ(t)t ͷ୯‫ޠ‬ϕΫτϧ w(t) ʹରԠ͢ΔઁಈϕΫτϧ r adv ΛҎԼͷࣜΛ༻͍ͯ‫͢ࢉܭ‬Δɽ(t)r advL(t)∇w(t) L!
"= log p y | (w(t) )Tt=1=(1)(2)r adv ͸ɼ෼ྨ‫ث‬ͷଛࣦؔ਺ L ͕૿େ͢Δํ޲ͷޯ഑(t)ʹ૬౰͢Δɽͭ·Γɼ‫ٻ‬ΊͨઁಈϕΫτϧ r adv ΛೖྗʹՃ͑ͨ΋ͷ͸ɼ෼ྨ‫ث‬ͷଛࣦؔ਺Λ૿େͤ͞ɼ‫ޡ‬෼ྨΛൃੜͤ͞΍͘͢ͳΔͱղऍͰ͖Δɽͦ͜ͰֶशͷࡍʹɼઁಈϕΫτϧΛՃ͑ͨೖྗΛਖ਼͘͠෼ྨ͢ΔΑ͏ͳଛࣦؔ਺ΛՃ͑Δ͜ͱͰɼ෼ྨ‫ث‬ͷ൚Խੑೳ͕޲্͢Δ͜ͱ͕‫ظ‬଴Ͱ͖ΔɽΑΓ۩ମతʹ͸ɼҎԼͷଛࣦؔ਺Λ༻͍Δɽ
Jadv = −N!
"1 #(t)log p y | (w(t) + ϵr adv )Tt=1N n=1(3)͍ͯ͠Δͷ͔෼͔Βͳ͍. ͦΕʹରͯ͠ɼఏҊ๏Ͱ͸ɼ࣮ࡍʹଘࡏ͢Δ୯‫ޠ‬ϕΫτϧͷํ޲͔Βɼํ޲Λબ୒͠ઁಈϕΫτϧͱ͢ΔɽͦͷͨΊʹɼ͋Δ୯‫ ޠ‬x(t) ΛͲͷ୯‫ʹޠ‬ஔ‫͢׵‬Δͱؒҧ͍͕‫͜ى‬Γ΍͍͔͢Λߟྀ͠ͳ͕ΒઁಈΛ‫͢ࢉܭ‬Δํ๏ΛఏҊ͢ΔɽఏҊख๏͸3 ͭͷ͜ͱΛߟྀ͢Δඞཁ͕͋Δ. (i) ‫ޠ‬ኮͷબ୒ (ii)ઁಈͷํ޲ (iii) ઁಈͷେ͖͞ʹ͍ͭͯड़΂Δɽ(i) ‫ޠ‬ኮͷબ୒͜͜Ͱɼ|V | ‫ݸ‬ͷશͯͷ୯‫ޠ‬Λߟྀͯ͠ઁಈϕΫτϧΛ‫͢ࢉܭ‬Δͱɼ࠷ѱ |V |2 ͷ‫͕ྔࢉܭ‬ඞཁͱͳΓɼ‫ࢉܭ‬ίετ͕େ͖͘ͳΓ͗͢Δ໰୊͕͋Δɽͦ͜Ͱɼ‫ྔࢉܭ‬Λ‫ݮ‬Βͨ͢Ίʹɼ෦෼୯‫ ߹ूޠ‬V ′ Λߟ͑Δ (|V| > |V ′ |)ɽ
ຊ‫Ͱڀݚ‬͸ɼ୯‫ ޠ‬x(t) ͦΕͧΕʹର͢Δपล୯‫ޠ‬ΛɼίαΠϯྨࣅ౓ʹ‫͠ࢉܭ͍ͯج‬ɼ্Ґ |V ′ | ‫ݸ‬ͷ෦෼୯(t)‫{ ߹ूޠ‬wk |k = 1 . . . |V ′ |} Λ V ͷ୅ΘΓʹ༻͍Δ (࣮′‫Ͱݧ‬͸ |V | = 10 ͱͨ͠)(t)୯‫ޠ‬ϕΫτϧ w(t) ͔Β୯‫ޠ‬ϕΫτϧ wk ΁ͷํ޲(t)ϕΫτϧ͸ dk = wk − w(t) Ͱ͋Δ.
(ii) ઁಈͷํ޲ͷબ୒·ͣɼ|V ′ | ࣍‫ݩ‬ͷϕΫτϧ α Λఆٛ͢Δɽ·ͣɼα ͷk ൪໨ͷཁૉ αk ͸ɼࣄલʹબ୒͞Εͨ |V ′ | ‫ݸ‬ͷ֤पล୯‫ޠ‬தͷ k ൪໨ͷ୯‫΁ޠ‬ͷํ޲ϕΫτϧʹର͢ΔॏΈ෇͚είΞͱ͢Δɽ͜ͷͱ͖ɼఏҊख๏ʹ͓͚Δઁ(t)ಈϕΫτϧ r adv ΛҎԼͷΑ͏ʹఆٛ͢Δɽ′(t)r adv =3.2 ఏҊख๏(t)લઅͰड़΂ͨઁಈϕΫτϧ r adv ͸ɼࣜ (1) ͔Β΋Θ͔ΔΑ͏ʹɼ࣮ࡍͷσʔλ఺ͱ͸ແؔ܎ʹ‫͞ࢉܭ‬ΕΔɽΑͬͯɼ୯‫ޠ‬ϕΫτϧʹઁಈΛՃ͑ͨσʔλ఺(t)(w(t) + r adv ) ͕ɼ࣮σʔλ఺ͰͲͷΑ͏ͳ୯‫ʹޠ‬ରԠ
1 ࣗવ‫ॲޠݴ‬ཧʹ͓͚Δఢରతαϯϓϧͷੜ੒ʹؔ͢Δ‫[ ڀݚ‬3]

͕͋Δ͕ɼOne-hot ͳϕΫτϧͷޯ഑ʹ஫໨͠ɼఢରతαϯϓϧͷੜ੒͸෯༏ઌ୳ࡧΛߦ͍ͬͯΔͨΊɼ‫͍ߴ͕ྔࢉܭ‬ɽ·ͨɼզʑͷઁಈ͸ఢରతͳઁಈΛ࿈ଓ஋ͷ··ѻ͍ͬͯΔ͕ɼจ‫[ ݙ‬3] ͸཭ࢄతͳγϯϘϧʹม‫ֶͯ͠׵‬शʹՃ͍͑ͯΔ఺΋ҟͳΔɽ

f (α, k)dk(4)k=1͜͜Ͱɼઌߦ‫[ ڀݚ‬11] ͕ઁಈΛޯ഑Ͱ‫ͨ͠ࢉܭ‬ͷͱಉ༷ʹ α ͸࣍ͷࣜΛ༻͍ͯ‫͢ࢉܭ‬Δɽ!
"(t)α = ∇α log p y | (w(t) + r adv−Rand )Tt=1(5)(t)͜͜Ͱɼαk Λಋग़͢Δࡍ r adv−Rand ͸ࣜ 4 ʹ͓͚Δαk ΛϥϯμϜʹॳ‫ظ‬Խͨ͠΋ͷͱ͢Δɽ࣍ʹɼείΞؔ਺ f ʹ͍ͭͯઆ໌͢ΔɽείΞؔ਺ f ͷఆٛʹΑͬͯɼੑ࣭ͷҟͳΔઁಈΛߟ͑Δ͜ͱ
͕Ͱ͖Δɽྫ͑͹ɼຊߘͰ͸ҎԼͷ 2 छྨͷؔ਺Λ༻͍Δɽ
$1α if max(α) = αkUniq∥α∥22 kɹɹ f(α, k) =(6)0otherwise
ɹɹ f Sum (α, k)ϵ ͸ϋΠύʔύϥϝʔλͰ͋Γɼจ‫[ ݙ‬11] Ͱ͸‫ݻ‬ఆͷ஋ ϵ = 5.0 Λ༻͍͍ͯͨɽ

|V |#=1αk|V ′ |∥α∥22(7)είΞؔ਺ʹ f Uniq Λ༻͍ͨ৔߹ɼઁಈϕΫτϧ͸ 1ͭͷ୯‫ޠ‬Λબ୒͠ɼͦͷํ޲ϕΫτϧΛར༻͢Δͱ͍͏ղऍʹͳΓɼf Sum Λ༻͍ͨ৔߹ɼશͯͷ୯‫޲ํޠ‬ͷฏ‫ۉ‬తͳํ޲ͷઁಈΛ࢖͏ͱղऍͰ͖ΔɽͦΕͧΕͷఏҊख๏Λ UniqɼSum ͱ‫Ϳݺ‬ɽ(iii) ઁಈͷϊϧϜैདྷ๏ʢࣜ 3ʣͰ͸ɼઁಈΛՃ͑Δࡍʹ‫ݻ‬ఆͷϋΠύʔύϥϝʔλ ϵ Λ༻͍͍ͯͨɽఏҊख๏͸ɼઁಈΛ࠷΋͍ۙ୯‫ޠ‬ϕΫτϧʹ͚ۙͮΔΑ͏ʹՃ͑Δɽઁಈ͸࣮σʔλํ޲Λ޲͍͍ͯΔͨΊɼઁಈͷϊϧϜΛࣗಈܾ(t)
ఆ͢Δ͜ͱ͕Ͱ͖Δɽઁಈ r adv ͱɼίαΠϯྨࣅ౓͕― 956 ―

Copyright(C) 2018 The Association for Natural Language Processing.
All Rights Reserved.

ਤ 2: ఢରֶशΛ LSTM ʹదԠͨ͠ਤɽ
MethodBaseline
Adversarial [11](Ours) Adversarial-Real (Uniq)(Ours) Adversarial-Real (Sum)
Virtual Adversarial [11](Ours) Virtual Adversarial-Real (Uniq)(Ours) Virtual Adversarial-Real (Sum)
Full+Unlabeled+BoW [10]Paragraph Vectors [9]SA-LSTM [2]One-hot bi-LSTM [8]Test error rate
7.05 (%)
6.02 (%)
6.34 (%)
5.89 (%)
5.69 (%)
6.15 (%)
5.66 (%)
11.11 (%)
7.42 (%)
7.24 (%)
5.94 (%)

ද 1: ࣮‫݁ݧ‬Ռ (IMDB ʹ͓͚Δ‫ۃ‬ੑ෼ྨλεΫ)ɽ
࠷΋ߴ͍ํ޲ϕΫτϧΛ dmost ͱ͢Δɽ(t)ϵ=dmost · r advREAL
dmost · dmost(8)Ҏ্ͷΑ͏ʹ (i)ʙ(iii) Λߟ͑Δ͜ͱͰɼղऍՄೳͳઁಈΛ‫͢ࢉܭ‬Δ͜ͱ͕Ͱ͖Δɽैདྷ๏ (ࣜ 3) ͱಉ༷ʹɼଛࣦؔ਺ʹఏҊ๏ͷઁಈΛՃ͑ɼఢରֶशʹ༻͍Δɽ4 ࣮‫ݧ‬
4.1 ࣮‫ݧ‬ઃఆจॻ෼ྨʹ͓͍ͯఏҊख๏ͷ༗ޮੑΛ‫ͨ͠ূݕ‬ɽσʔληοτͱͯ͠ɼӳ‫ޠ‬ͷ 2 Ϋϥε‫ۃ‬ੑ෼ྨ (Positive/Negative) ͷσʔληοτ IMDB[10] Λ༻͍ͨɽ‫܇‬࿅σʔλ 21,246 จɼ։ൃσʔλ 3,754 จɼςετσʔ
λ 25,000 จɼϥϕϧͳ͠σʔλ 50,000 จͰ͋Δɽઌߦ‫[ ڀݚ‬11] ʹै͍ɼલॲཧͱͯ͠খจࣈԽ͸ͤͣɼ‫ޠ‬ኮͷ࡞੒͸‫܇‬࿅σʔλͱϥϕϧͳ͠σʔλ͔Βߏங͠ɼ‫ޠ‬ኮ਺͸ 86,935 ͱͳͬͨɽಉ༷ʹઌߦ‫[ ڀݚ‬11] ʹै͍ɼ෼ྨ‫ ͯ͠ͱث‬1 ૚ͷ୯ํ޲ LSTM[5] Λ༻͍ͨʢਤ 2ʣɽLSTM ͸ࣄલʹϥϕϧͳ͠σʔλͰ‫ޠݴ‬ϞσϧΛ‫܇‬࿅ͨ͠ɽ։ൃσʔλΛ༻͍ͯ Early Stopping Λߦ͍ɼ։ൃσʔλͰ࠷΋ߴ͍ਖ਼ղ཰ΛಘͨϞσϧΛςετσʔλͰධՁͨ͠ɽ‫͋ࢣڭ‬Γֶशͱ൒‫͋ࢣڭ‬Γֶशͷ 2 ͭͷઃఆΛࢼͨ͠ɽ‫͋ࢣڭ‬ΓֶशͰ͸ Adversarial Training(Adv)[11]ͱɼఏҊख๏ (Adversarial-Real) Λൺֱ͠ɼ൒‫͋ࢣڭ‬ΓֶशͰ͸ Virtual Adversarial Training(VAT)[12, 11] ͱɼఏҊख๏ (Virtual Adversarial-Real) Λൺֱͨ͠ɽ

ਤ 3: Positive → Negative ਤ 4: Negative → Positive

4.2 ࣮‫݁ݧ‬Ռ
ද 1 ʹఏҊख๏ͱ‫ط‬ଘख๏ͷ IMDB ʹ͓͚ΔΤϥʔ
཰ (%) Λࣔ͢ɽ2 ͭͷఏҊख๏ (Uniq, Sum) Ͱ Baseline Λ௒͑Δ൚ԽੑೳΛಘΔ͜ͱ͕Ͱ͖Δ͜ͱ͕Ͱ͖
ͨɽ·ͨσʔλ఺Λߟྀ͠ͳ͍‫ط‬ଘख๏ΑΓ΋ Adversarial Ͱ͸ߴ͍൚ԽੑೳΛಘΔ͜ͱ͕Ͱ͖ɼVirtualAdversarial-Real Ͱ͸ಉఔ౓ͷੑೳΛಘΔ͜ͱ͕Ͱ͖
ͨɽAdversarial ‫ ͼٴ‬Virtual Adversarial ͷ྆ํͰ Sum͕ߴ͍൚ԽੑೳΛಘΔ͜ͱ͕Θ͔ͬͨ. ΑΓෳࡶͳωοτϫʔΫߏ଄Λ༻͍ͨઌߦ‫ڀݚ‬ͷଞͷख๏ [8] ΑΓ΋ྑ͍݁ՌΛಘΔ͜ͱ͕Ͱ͖ͨɽൺֱख๏ͷ Adversarial‫ ͼٴ‬Virtual Adversarial[11] ͷ࣮‫݁ݧ‬Ռ͸ɼ࠶࣮૷͠ఏҊ๏ͱಉ͡৚݅ͰֶशΛߦͬͨ݁ՌͰ͋Δɽຊߘͷ࣮‫݁ݧ‬Ռ͸ɼจ‫ݙ‬தͷใࠂ݁ՌΑΓྑ͍είΞΛಘΒΕ͍ͯΔɽ
ʢAdv:6.21%, Vat:5.91%ʣ

― 957 ―

Copyright(C) 2018 The Association for Natural Language Processing.
All Rights Reserved.

จ࣮ࡍͷςετσʔλจThis movie turned out to be better than I had expected it to be Some parts were pretty funny It was nice to have a movie෼ྨ‫ث‬ͷ༧ଌ
Positivewith a new plot <eos>ఢରతαϯϓϧ

This movie turned out to be worse than I had expected it to be Some parts were pretty funny It was nice to have a movie

Negativewith a new plot <eos>࣮ࡍͷςετσʔλจ

There is really but one thing to say about this sorry movie It should never have been made The first one one of myNegative

favourites An American Werewolf in London is a great movie with a good plot good actors and good FX But this one It
stinks to heaven with a cry of helplessness <eos>ఢରతαϯϓϧ

There is really but one thing to say about that sorry movie It should never have been made The first one one of myPositive

favourites An American Werewolf in London is a great movie with a good plot good actors and good FX But this one It
stinks to heaven with a cry of helplessness <eos>ද 2: ɹֶशࡁΈ෼ྨ‫ث‬ͷ༧ଌΛ‫ޡ‬ΒͤΔೖྗจ (ఢରతαϯϓϧ) ͷੜ੒ྫɽ্෦ͷྫ͸ better→worse ΁ͷஔ͖‫͑׵‬ɼthis→that ΁ͷஔ͖‫ʹ͑׵‬Αͬͯ༧ଌ݁Ռ͕൓స͍ͯ͠Δɽ

5 Ϟσϧͷ෼ੳ
5.1 ઁಈͷՄࢹԽਤ 3ɼ4 ʹઁಈϕΫτϧΛՄࢹԽͨ͠ɽ͜ͷՄࢹԽʹ͸ɼఏҊख๏ͷ Uniq Λ༻͍͍ͯΔɽೋྻͷ୯‫ޠ‬͸ɼࠨྻ͕ςετσʔλͷ࣮ࡍͷจͰ͋Γɼӈྻͷ୯‫ޠ‬͸ఏҊख๏ (Uniq) ͷ࠷େ αk ͱͳΔपล୯‫͋Ͱޠ‬Δɽ৭ʢ੨·ͨ͸੺ʣͷೱ୶͸ఏҊ๏ʹΑΓ‫͞ࢉܭ‬ΕͨઁಈϕΫτϧͷେ͖͞Ͱ͋ΓɼͦΕͧΕͷ୯‫΁ޠ‬ஔ͖‫͑׵‬Δͨࡍʹɼ෼ྨ‫͕ؒث‬ҧ͑қ͍͔Ͳ͏͔ͷ౓߹͍Λ͍ࣔͯ͠ΔͱղऍͰ͖Δɽͨͩ͠ɼೱ୶͸จશମͰਖ਼‫ن‬Խͨ͠஋Ͱ͋Δɽਤ 3 ͸ɼਖ਼ղ͕ Positive ΫϥεͷจͰ͋ΓɼจશମͰ better→worse ʹஔ͖‫͑׵‬Δͱ෼ྨ‫͕ؒث‬ҧ͑΍͍͢͜ͱΛଊ͍͑ͯΔɽಉ༷ʹਤ
4 ͸ Negative ΫϥεͷจͰ͋Γɼ࠷΋େ͖͍ઁಈϕΫτϧͷํ޲͸ bad→good ͷஔ͖‫͋Ͱ޲ํ͑׵‬Δ͜ͱ͕෼͔Δɽ

5.2 ఢରతͳೖྗจͷ࡞੒ఏҊ๏Ͱ͸ɼલઆͰࣔͨ͠Α͏ʹɼͲͷ୯‫ޠ‬ΛผͷͲͷ୯‫ʹޠ‬ஔ͖‫͑׵‬Δͱ෼ྨ‫ޡ͕ث‬ೝࣝ͠΍͍͔͢ɼͱ͍͏ͷΛ‫͢ࢉܭ‬Δ͜ͱ͕Ͱ͖Δɽ͜ΕΛԠ༻͠ɼਓ͕ؒղऍ͠΍͍࣮͢ࡍͷ୯‫΁ޠ‬ஔ͖‫ࣅٖͨ͑׵‬σʔλΛ࡞੒͢Δ͜ͱ΋ՄೳͰ͋Δɽैདྷ๏Ͱ͸ɼઁಈํ޲ͱ୯‫ޠ‬ϕΫτϧํ޲͸ແؔ܎ʹ‫͞ࢉܭ‬Ε͍ͯΔͨΊɼ୯‫ޠ‬ϕΫτϧʹઁಈΛՃ͑ͨσʔλ఺͕ɼͲͷΑ͏ͳ୯‫ʹޠ‬ରԠ͍ͯ͠Δͷ͔Λղऍ͢Δ͜ͱ͕Ͱ͖ͳ͍ɽҰํͰɼఏҊ๏͸ɼ࣮ࡏ͢Δ୯‫ޠ‬ϕΫτϧͷํ޲ʹઁಈΛ‫ݶ‬ఆ͢Δ͜ͱͰɼઁಈํ޲ͱ୯‫ޠ‬ͷஔ͖‫͑׵‬ΛରԠ෇͚Δ͜ͱ͕Ͱ͖ΔΑ͏ʹͳͬͨɽͦͷੑ࣭Λར༻ͯ͠ɼςετจͷ୯‫ޠ‬Λɼ࠷΋‫͍ڧ‬ઁಈͷ୯‫΁ޠ‬ஔ͖‫͑׵‬Δ͜ͱͰɼ‫ݩ‬จͷ༧ଌ݁ՌΛؒҧ͑ΔఢରతͳೖྗจΛ࡞੒͢Δ͜ͱΛߟ͑Δɽද 2ʹ࣮ࡍʹ࡞੒ͨ͠ఢରతαϯϓϧͷྫΛࣔ͢ɽ͜͜Ͱ༻͍ͨςετσʔλ͸ɼֶशࡁΈ෼ྨ‫( ث‬Baseline) ͕ਖ਼͘͠෼ྨͰ͖ͨจͷத͔ΒαϯϓϦϯάͨ͠ɽࠓճͷࣄྫ͔Βɼ෼ྨ‫͕ؒث‬ҧ͑Δೖྗʹ͸େ͖͘
෼͚ͯ 2 छྨ͋Δ͜ͱ͕෼͔Δɽ

1. จͷҙຯ͕มΘΓɼ༧ଌ͕൓స͢Δ (ද 2 ্෦)ɽ2. จͷҙຯ͸มΘΒͣɼ༧ଌ͕൓స͢Δ (ද 2 Լ෦)ɽ͜ͷΑ͏ʹ෼ྨ‫͕ؒث‬ҧ͑ΔఢରతαϯϓϧΛੜ੒͢Δ͜ͱͰɼ෼ྨ‫ث‬ͷੑ࣭Λ஌Δ͜ͱ͕Ͱ͖Δɽ·ͨຊߘͷ࣮‫Ͱݧ‬͸୯‫ޠ‬ϕΫτϧΛೖྗͱ͍ͯ͠Δ͕ɼจࣈϕΫτϧΛ༻͍ΔϞσϧʹదԠ͢Δ͜ͱͰɼจࣈϨϕϧͷఢରతͳೖྗʢλΠϙʣΛੜ੒͢Δ͜ͱ΋ՄೳʹͳΔɽ͜ͷԠ༻ઌͱͯ͠Τϥʔగਖ਼λεΫͰؒҧ͑΍͍͢σʔλͷੜ੒΍ɼ‫͜ى‬Γ΍͍͢λΠϙ෼ੳ΁ͷԠ༻ʹ༻͍Δ͜ͱ͕Ͱ͖Δɽ

6 ͓ΘΓʹຊ‫Ͱڀݚ‬͸ɼࣗવ‫ॲޠݴ‬ཧʹ͓͚Δ෼ྨ‫ث‬Λ᱐͢ઁಈΛՃ͑ΔࡍʹɼઁಈΛ࣮σʔλํ޲ʹ‫ݶ‬ఆ͢Δख๏ΛఏҊͨ͠ɽఏҊख๏Λ༻͍Δ͜ͱͰɼਓؒʹղऍՄೳͳઁಈΛ‫͢ࢉܭ‬Δ͜ͱ͕Ͱ͖Δ͜ͱΛࣔͨ͠ɽ͞ΒʹɼఢରతͳจΛੜ੒͢Δ͜ͱͰɼ෼ྨ‫ث‬ͷੑ࣭ΛਓؒʹղऍՄೳͱͳΔɽຊߘͰ͸ɼ࠷ॳͷऔΓ૊Έͱͯ͠ɼ؆୯ͳೋΫϥε෼ྨλεΫͰఏҊ๏ͷ༗ޮੑΛ‫ݕ‬ূ͕ͨ͠ɼΤϯίʔμσίʔμϞσϧ [14] ΁ͷ֦ு΋ɼੜ੒ଆͷೖྗΛؒҧ͑ΔΫϩεΤϯτϩϐʔϩεΛ࠷େԽ͢ΔΑ͏ͳઁಈΛߟ͑Δ͜ͱͰɼ೚ҙͷग़ྗΛ͢ΔΑ͏ͳೖྗจͷੜ੒͕ߦ͑ΔՄೳੑ΋͋Δɽࠓ‫ޙ‬͸ɼ༷ʑͳλεΫɼϞσϧ΁ͷద༻Λߟ͍͖͍͑ͯͨɽࢀߟจ‫ݙ‬[1] Yonatan Belinkov and Yonatan Bisk. Synthetic and natural noise both breakneural machine translation. CoRR, abs/1711.02173, 2017.
[2] Andrew M. Dai and Quoc V. Le. Semi-supervised sequence learning. InNIPS, 2015.
[3] Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: Whitebox adversarial examples for nlp. arXiv preprint arXiv:1712.06751, 2017.
[4] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining andharnessing adversarial examples. CoRR, abs/1412.6572, 2014.
[5] Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. Neuralcomputation, 9(8):1735–1780, 1997.
[6] Hossein Hosseini, Sreeram Kannan, Baosen Zhang, and Radha Poovendran. Deceiving google’s perspective api built for detecting toxic comments.
CoRR, abs/1702.08138, 2017.
[7] Robin Jia and Percy Liang. Adversarial examples for evaluating reading
comprehension systems. In EMNLP, 2017.
[8] Rie Johnson and Tong Zhang. Supervised and semi-supervised text categorization using lstm for region embeddings. In ICML, 2016.
[9] Quoc V. Le and Tomas Mikolov. Distributed representations of sentencesand documents. In ICML, 2014.
[10] Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y.
Ng, and Christopher Potts. Learning word vectors for sentiment analysis.
In ACL, 2011.
[11] Takeru Miyato, Andrew M Dai, and Ian Goodfellow. Adversarial training
methods for semi-supervised text classification. ICLR, 2016.
[12] Takeru Miyato, Shin ichi Maeda, Masanori Koyama, Ken Nakae, and ShinIshii. Distributional smoothing with virtual adversarial training. 2015.
[13] Suranjana Samanta and Sameep Mehta. Towards crafting text adversarial
samples. arXiv preprint arXiv:1707.02812, 2017.
[14] Ilya Sutskever, Oriol Vinyals, and Quoc V Le. Sequence to sequence learning with neural networks. In Advances in neural information processing
systems, pages 3104–3112, 2014.
[15] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru
Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neuralnetworks. CoRR, abs/1312.6199, 2013.

― 958 ―

Copyright(C) 2018 The Association for Natural Language Processing.
All Rights Reserved.