JP7672655B2 - Learning device, learning method, and learning program - Google Patents

Description

The present invention relates to a learning device, a learning method, and a learning program.

In recent years, there has been a remarkable improvement in the accuracy of machine learning techniques, particularly techniques using convolutional neural networks (CNNs), for identifying and detecting subjects in images, and for segmenting areas. Technologies that use these machine learning techniques to promote the automation of visual inspection processes in various business processes are attracting attention.

For example, when automating the visual inspection process of a business by processing captured images, it is desirable for the CNN image processing to be processing that is in line with the intuition of the person performing the visual inspection process. It is desirable for the CNN image processing to have a property such that, for example, the classification results remain unchanged even if some noise, etc. is added to the classification target during image classification.

CNN is known as a model with a mechanism similar to the human visual structure, and has been thought to have the same invariance to noise as humans.

However, in recent years, it has become clear that CNN image processing is not invariant to minute noise that humans cannot perceive. In particular, it has become clear that a vulnerability attack called adversarial perturbation can cause CNN to make image classification errors with almost 100% probability, even when the noise is so minute that humans cannot perceive it, if no countermeasures are taken. In other words, it can make CNN identify an image as a car even though it appears to be a dog from a human perspective.

The behavior of CNNs in response to such adversarial perturbations that differ from human intuition can be a major practical challenge. Therefore, building a CNN model that is robust against adversarial perturbations is an important challenge for the practical use of CNNs.

Here, various methods have been proposed to build CNNs that are robust against attacks using adversarial perturbations. However, many of these methods have been found to be vulnerable to new attack methods that were developed later.

However, among the methods for building a robust CNN, a method called adversarial learning (Non-Patent Document 1) is known as a methodology for creating a robust CNN model without significantly reducing classification accuracy even against the latest attack methods.

Adversarial learning creates adversarial perturbations that attack the CNN model to the maximum extent possible, and trains the model to correctly identify images to which the perturbations have been added. By repeating this learning process, adversarial learning builds a robust CNN model.

M A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial Attacks”, [online], arXiv:1706.06083v4 [stat.ML], September 2019, [Retrieved June 2, 2022], Internet <URL: https://arxiv.org/pdf/1706.06083.pdf＞

While adversarial learning has been empirically proven to be an effective method for increasing robustness, it has the problem that its classification accuracy for images to which no adversarial perturbation has been applied (hereafter, clean images) is significantly lower than that of a CNN trained only on clean images (hereafter, normal training CNN).

For example, when using the WideResNet-34-10 architecture on the CIFAR-10 image dataset, a normal CNN model achieves around 95% accuracy for normal images, while a model that has undergone adversarial learning achieves around 85% accuracy. The model that has undergone adversarial learning is 10 points less accurate than a normal CNN model.

While improving robustness against attacks by adversarial perturbations from malicious third parties is an important issue, the accuracy of normal images is also very important in practical terms. For this reason, significantly reducing the accuracy of normal images in order to increase robustness is not desirable in practical terms.

The present invention has been made in consideration of the above, and aims to provide a learning device, a learning method, and a learning program that provide an image recognition model that has improved robustness through adversarial learning while maintaining accuracy for clean images.

In order to solve the above-mentioned problems and achieve the object, the learning device according to the present invention has a generation unit that generates a perturbation based on a first clean image to which a correct answer label is attached and generates a superimposed image by superimposing the generated perturbation on the first clean image; a first image discrimination unit that performs image discrimination on the first clean image using a first NN (Neural Network) that has learned image discrimination using a plurality of clean images as learning data and outputs an intermediate output of the first NN as a first intermediate output; a second image discrimination unit that performs image discrimination on the superimposed image using a second NN in which model parameters of the first NN are set as initial parameters and outputs an intermediate output of the second NN as a second intermediate output; and a learning unit that executes learning of the second NN by optimizing parameters of the second NN so that the difference between the image discrimination result for the superimposed image by the second image discrimination unit and the correct answer label of the first clean image is small and the difference between the first intermediate output and the second intermediate output is small.

The present invention provides an image recognition model that maintains accuracy for clean images while improving robustness through adversarial learning.

FIG. 1 is a diagram illustrating the output of the intermediate layer in a CNN trained only on clean images with correct labels, and a CNN that has undergone adversarial training. FIG. 2 is a diagram for explaining the learning method according to the first embodiment. FIG. 3 is a diagram illustrating an example of the configuration of the learning device according to the first embodiment. FIG. 4 is a flowchart illustrating a processing procedure of the learning process according to the first embodiment. FIG. 5 is a flowchart showing the procedure of the adversarial image generation process shown in FIG. FIG. 6 is a flowchart showing the procedure of the image identification process shown in FIG. FIG. 7 is a flowchart showing the procedure of the optimization process shown in FIG. FIG. 8 is a flowchart showing the procedure of the schedule process shown in FIG. FIG. 9 is a flowchart showing another processing procedure of the adversarial image generation processing shown in FIG. FIG. 10 is a diagram illustrating a learning method according to the second embodiment. FIG. 11 is a diagram illustrating an example of the configuration of a learning device according to the second embodiment. As shown in FIG. FIG. 12 is a flowchart illustrating a processing procedure of the learning process according to the second embodiment. FIG. 13 is a flowchart showing the processing procedure of the image identification processing shown in FIG. FIG. 14 is a flowchart showing the processing procedure of the original image identification processing shown in FIG. FIG. 15 is a flowchart showing the procedure of the optimization process shown in FIG. FIG. 16 is a diagram illustrating an example of the configuration of a learning device according to the third embodiment. As shown in FIG. FIG. 17 is a flowchart illustrating a processing procedure of the learning process according to the third embodiment. FIG. 18 is a diagram illustrating an example of a computer that realizes a learning device by executing a program.

One embodiment of the present invention will be described in detail below with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the drawings, the same parts are denoted by the same reference numerals.

[First embodiment]
In the first embodiment, a description will be given of learning of a Convolutional Neural Network (CNN) that has improved robustness through adversarial learning while maintaining image classification accuracy for an image not superimposed with adversarial perturbation (hereinafter, a clean image). A CNN is an image classification model.

Figure 1 is a diagram explaining the output of the intermediate layers in a CNN trained only on clean images with correct labels (hereinafter referred to as a normal training CNN) (first NN) and a CNN that has undergone adversarial training (AT). Figure 1 shows the results of a survey using the CIFAR-10 dataset and the 27th layer representation of WideResNet28-10.

As shown in Figure 1, the output of the intermediate layer (feature representation) obtained by the normal learning CNN model (Figure 1 (1)) and the output of the intermediate layer obtained by the CNN model that has undergone adversarial learning only matched at about 0.2546 in terms of Cos similarity, indicating a large difference.

This result suggests that feature extraction that was successful with a normal training CNN is no longer possible with a CNN model that has undergone AT, resulting in a significant drop in accuracy. In the first embodiment, constraints are imposed so that AT can acquire feature representations equivalent to those for clean images acquired during normal training, in other words, so that feature extraction similar to that of a normal training CNN can be performed.

2 is a diagram for explaining a learning method in the first embodiment. In the first embodiment, when learning an adversarial image x ^adv (x+δ) (superimposed image) in which an adversarial perturbation δ is superimposed on a clean image x ^clean (x) with a correct answer label, curriculum learning based on the magnitude of the adversarial perturbation δ is performed ((1) in FIG. 2). In other words, in the first embodiment, the adversarial perturbation δ is generated so that the magnitude of the adversarial perturbation δ increases stepwise, thereby performing curriculum learning of an AT-CNN (second NN) for the adversarial image x ^adv .

For example, we use equation (1) as the loss function to optimize the parameters of AT-CNN.

Here, f(θ, x+δ) represents the label output by AT-CNN (model parameter θ) when (x+δ) (adversarial image x ^adv ) is input. Equation (1) is a loss function that indicates the error between the label output by AT-CNN and the correct label attached to the clean image x ^clean (x).

Then, by performing a Taylor expansion on equation (1), we can approximate it as equation (2).

As shown in equation (2), the first term on the right-hand side is a loss function that indicates the error between the label output by AT-CNN when a clean image x is input and the correct label y of the clean image. The first term on the right-hand side is a term that indicates the error between the classification result for the clean image and the correct label of the clean image.

The second and subsequent terms on the right-hand side of equation (2) are terms related to the adversarial perturbation δ, and can be said to indicate the degree of influence on the error between the classification result for the clean image and the correct label of the clean image. In other words, the magnitude of the influence of the second and subsequent terms on the right-hand side of equation (2) is dominated by the adversarial perturbation δ, and can be said to be terms specific to AT.

In the first embodiment, curriculum learning is performed with the magnitude |δ| _∞ of the adversarial perturbation δ. In other words, in the first embodiment, a constraint is imposed that |δ| _∞ is gradually increased from the magnitude 0 (δ=0 is the same value as normal learning). That is, in the first embodiment, the adversarial perturbation δ is generated so that the influence of the adversarial perturbation δ on the error between the classification result for the clean image and the correct label of the clean image in the second and subsequent terms on the right side of the formula (2) increases stepwise.

As a result, in the first embodiment, curriculum learning is performed by executing step-by-step learning of the influence of the adversarial perturbation δ of the AT-CNN (second NN) on the adversarial image x ^adv .

[Learning device]
Next, a description will be given of the learning device according to embodiment 1. Fig. 3 is a diagram illustrating an example of the configuration of the learning device according to embodiment 1.

The learning device 10 according to the embodiment is realized, for example, by loading a specific program into a computer including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the specific program. The learning device 10 also has a communication interface for sending and receiving various information to and from other devices connected via a network, etc. The learning device 10 is realized by a general-purpose computer such as a workstation or a personal computer.

As shown in FIG. 3, the learning device 10 has an image storage unit 11, an initialization unit 12, an adversarial perturbation generation unit 13 (generation unit), an image classification unit 14, an optimization unit 15 (learning unit), and a schedule unit 16 (control unit).

The image storage unit 11 stores multiple pairs of clean images and correct labels that indicate the category of the subject of the clean images.

The initialization unit 12 holds the initial parameters of the CNN 141, which is an image recognition model. The initial parameters are model parameters of a CNN (first NN) that has previously learned image recognition using clean images as learning data. Note that the initial parameters need only be model parameters of a model that can appropriately recognize clean images.

The adversarial perturbation generation unit 13 generates an adversarial perturbation (perturbation) based on the clean image (first clean image) output from the image storage unit 11 as the processing target, and generates a superimposed image by superimposing the generated adversarial perturbation on the first clean image.

The adversarial perturbation generation unit 13 generates an adversarial perturbation for the first clean image based on the schedule result by the schedule unit 16, the model parameters of the CNN 141 (described later) optimized by the optimization unit 15, the first clean image, and the ground truth label of the first clean image. The adversarial perturbation generation unit 13 outputs the generated superimposed image to the image classification unit 14 as an adversarial image.

The schedule result is set to generate adversarial perturbations so that the magnitude of the adversarial perturbations increases stepwise according to the learning stage of CNN141. The schedule result is, for example, control information that controls parameters such as the perturbation norm of the adversarial perturbation. The control target of the schedule result is not limited to the perturbation norm as long as it is a parameter that does not significantly impair the feature representation learning of CNN141.

The image classification unit 14 receives the adversarial image to be classified from the adversarial perturbation generation unit 13, and performs image classification on the adversarial image using the CNN 141. First, at the start of learning, the model parameters of a CNN that has previously learned image classification using clean images as training data are set as initial parameters in the CNN 141. Then, as learning progresses, the model parameters of the CNN 141 optimized by the optimization unit 15 are set in the CNN 141. The image classification unit 14 outputs the obtained output (image classification result) to the optimization unit 15 as a model output.

The optimization unit 15 evaluates the CNN 141 and optimizes the model parameters of the CNN 141 based on the model output and the correct label. The optimization unit 15 optimizes the model parameters of the CNN 141 so that the model output for the adversarial image approaches the correct label of the first clean image, thereby performing learning of the CNN 141.

The optimization unit 15 optimizes the parameters of the CNN 141 using the loss function of the above-mentioned formula (2). As described above, formula (2) has a term indicating the error between the classification result for the first clean image and the correct label of the first clean image, and a term indicating the influence of adversarial perturbation on this error. Under the control of the schedule unit 16, the optimization unit 15 performs step-by-step learning of the influence of adversarial perturbation on the error between the classification result for the first clean image of the CNN 141 and the correct label of the first clean image.

The optimization unit 15 outputs the evaluation results of the CNN 141 to the schedule unit 16. The optimization unit 15 outputs the model parameters of the optimized CNN 141 to the adversarial perturbation generation unit 13 and the image classification unit 14.

The scheduler 16 determines the generation parameters of the adversarial perturbation generated by the adversarial perturbation generator 13 based on the evaluation results of the CNN 141. The scheduler 16 outputs the determined generation parameters to the adversarial perturbation generator 13 as the schedule result.

The scheduler 16 causes the adversarial perturbation generator 13 to generate the adversarial perturbation so that the magnitude of the adversarial perturbation increases stepwise. The scheduler 16 causes the adversarial perturbation generator 13 to generate the adversarial perturbation so that the magnitude of the adversarial perturbation increases stepwise according to the learning stage of the CNN 141, and causes the optimizer 15 to perform stepwise learning on the influence of the adversarial perturbation on the error between the classification result of the CNN for the first clean image and the correct label of the first clean image.

When the schedule unit 16 determines that learning is to be terminated, it outputs the model parameters of the CNN 141 optimized by the optimization unit 15 as learned parameters.

[Learning process]
Next, a description will be given of the learning process according to the embodiment 1. Fig. 4 is a flowchart showing the processing procedure of the learning process according to the embodiment 1.

As shown in FIG. 4, in the learning device 10, first, the initialization unit 12 outputs the initial parameters of the CNN 141 to the adversarial perturbation generation unit 13 and the image classification unit 14 to initialize the parameters of the CNN 141 (step S1).

The learning device 10 extracts a set of first clean images and a correct label corresponding to the first clean images from the image storage unit 11, transmits the first clean images and the correct label to the adversarial perturbation generation unit 13, and transmits the correct label to the optimization unit 15 (step S2).

The adversarial perturbation generation unit 13 performs an adversarial image generation process (step S3). The adversarial image is an image in which the adversarial perturbation is superimposed on the first clean image.

The image classification unit 14 uses the CNN 141 to perform image classification processing on the adversarial image generated by the adversarial perturbation generation unit 13 (step S4).

The optimization unit 15 performs an optimization process to evaluate the CNN 141 and optimize the model parameters of the CNN 141 based on the model output and the correct label (step S5).

Based on the evaluation results of CNN141, the scheduler 16 performs a schedule process to determine the generation parameters of the adversarial perturbation so that the magnitude of the adversarial perturbation generated by the adversarial perturbation generator 13 increases stepwise according to the learning stage of CNN141 (step S6).

The learning device 10 determines whether or not to end the learning process (step S7). If it is determined that the learning process should not be ended (step S7: No), the learning device 10 returns to step S2 and continues learning the CNN 141. If it is determined that the learning process should be ended (step S7: Yes), the learning device 10 acquires the model parameters of the optimized CNN 141 as learned parameters via the scheduler 16 (step S8).

[Adversarial image generation processing]
Next, the adversarial image generation process (step S3) will be described with reference to a flowchart shown in FIG.

First, the adversarial perturbation generator 13 determines whether or not it is the start of learning (step S11).

When learning starts (step S11: Yes), the adversarial perturbation generator 13 obtains initial parameters from the initialization unit 12 (step S12). The initial parameters are model parameters of a CNN that has previously learned image recognition using clean images as training data, but any model parameters of a model that can appropriately recognize clean images will suffice. The adversarial perturbation generator 13 initializes the schedule result (step S13).

If it is not the start of learning (step S11: No), the adversarial perturbation generator 13 obtains a schedule result from the scheduler 16 (step S14). The schedule result is control information that controls parameters such as the perturbation norm of the adversarial perturbation, but is not limited to the perturbation norm as long as the parameters do not significantly impair the feature representation learning of the CNN 141. The adversarial perturbation generator 13 obtains the model parameters of the optimized CNN 141 from the optimizer 15 (step S15), and thereafter uses them as image identification parameters.

The adversarial perturbation generator 13 obtains the first clean image to be processed and the correct label of the first clean image from the image storage unit 11 (step S16).

The adversarial perturbation generator 13 generates an adversarial perturbation based on the schedule result, the ground truth label of the first clean image, the first clean image, and the model parameters of the CNN 141 acquired in step S12 or step S15 (step S17). Here, a method that maximizes the loss for the ground truth label is generally used to generate the adversarial perturbation. In addition, it is assumed that Projected Gradient Descent (Non-Patent Document 1) is used as a method for generating the adversarial perturbation, but other methods may be used as long as they can generate the adversarial perturbation appropriately.

The adversarial perturbation generation unit 13 superimposes the generated adversarial perturbation on the first clean image and outputs it to the image classification unit 14 as an adversarial image (step S18).

[Image Identification Processing]
Next, the image identification process (step S4) will be described with reference to a flowchart shown in FIG.

As shown in FIG. 6, the image identification unit 14 determines whether or not learning has started (step S21).

When learning starts (step S21: Yes), the image classification unit 14 acquires initial parameters from the initialization unit 12 (step S22). These initial parameters are assumed to be similar to the initial parameters acquired by the adversarial perturbation generation unit 13 in step S12, but similar effects can be obtained even if the parameters are different.

If it is not the start of learning (step S21: No), the image identification unit 14 obtains the optimized model parameters of the CNN 141 from the optimization unit 15 (step S23) and uses them as image identification parameters thereafter.

The image identification unit 14 acquires the adversarial image output by the processing of step S18 from the adversarial perturbation generation unit 13 (step S24). The image identification unit 14 applies image identification based on the model parameters of the optimized CNN 141 to the adversarial image (step S25). The image identification unit 14 executes image identification processing on the adversarial image using the CNN 141 to which the model parameters acquired in step S22 or step S23 are set.

The image identification unit 14 outputs the output distribution obtained by the processing of step S25 to the optimization unit 15 as a model output (step S26).

[Optimization process]
Next, the optimization process (step S5) will be described with reference to the flowchart of FIG.

As shown in FIG. 7, the optimization unit 15 determines whether or not learning has started (step S31).

If learning has started (step S31: Yes), the optimization unit 15 obtains initial parameters from the initialization unit 12 (step S32).

If it is not the start of learning (step S31: No), or after step S32 is completed, the optimization unit 15 acquires the correct label of the first clean image to be processed from the image storage unit 11 (step S33). The optimization unit 15 outputs the model output from the image classification unit 14 (step S34).

The optimization unit 15 optimizes the model parameters of the CNN 141 so as to reduce the difference between the model output x and the correct label y, and outputs the optimized parameters (step S35). The optimization unit 15 optimizes the parameters using the loss function shown in equation (2).

The optimization unit 15 may also optimize the image classification parameters using an image classification loss that reduces the difference between the model output x and the correct label y, and output the optimized parameters. Note that, for this image classification loss, the cross entropy shown in formula (3) or the like is generally used, but the mean squared error or the like can also have a similar effect as long as it is an appropriate objective function for the desired classification task.

The optimization unit 15 evaluates how close the model output is to the correct label, and outputs the evaluation result (step S36). This evaluation may be performed using any appropriate evaluation index, such as whether or not the result of taking the argmax of the model output matches the correct label.

[Schedule Processing]
Next, the schedule process (step S6) will be described with reference to a flow chart shown in FIG.

As shown in FIG. 8, the schedule unit 16 acquires the evaluation result output by the optimization unit 15 in step S36 (step S41). The schedule unit 16 determines whether the evaluation result acquired in step S41 is equal to or greater than a reference value (step S42).

If the evaluation result is equal to or greater than the reference value (step S42: Yes), the schedule unit 16 determines whether or not to terminate the learning of the CNN 141 based on a predetermined termination condition (step S43). The termination condition for the learning is, for example, when the parameters generating the adversarial perturbation reach a desired value, when the number of updates of the parameters of the CNN 141 reaches a predetermined number, when the amount of parameter updates falls below a predetermined threshold, when the loss calculated by the optimization unit 15 falls below a predetermined threshold, etc.

If the schedule unit 16 determines that the learning of CNN 141 is to be terminated (step S43: Yes), the learning device 10 terminates the learning of CNN 141.

If the scheduler 16 determines that the learning of the CNN 141 is not to be terminated (step S43: No), it outputs parameters for generating new adversarial perturbations, which are updated from the parameters used up to that point, as the schedule result to the adversarial perturbation generator 13 (step S44).

In order to allow CNN 141 to learn the degree of influence of the adversarial perturbation in stages, the adversarial perturbation is set to become larger in stages according to the learning stage. For this reason, when the accuracy of image classification for the adversarial image to be verified saturates for 10 epochs, for example, the schedule unit 16 outputs a schedule result in which the norm of the perturbation of the adversarial perturbation is increased from the current stage to the size of the stage next to the current stage.

If the evaluation result is less than the reference value (step S42: No), the scheduler 16 outputs a schedule result for generating the adversarial perturbation to the adversarial perturbation generator 13 that maintains the current parameters (step S45).

[Effects of the First Embodiment]
In this way, in the first embodiment, the CNN 141 is trained with the constraint that the magnitude of the adversarial perturbation is gradually increased so that the feature representation does not deviate significantly from that of a normal CNN that has already trained on clean images.

As a result, in embodiment 1, by having CNN 141 gradually learn the degree of influence of adversarial perturbation, it is possible to provide an image recognition model that maintains accuracy for clean images while improving robustness through adversarial learning.

[Modification of the first embodiment]
Moreover, the adversarial perturbation generation unit 13 may apply a most confusing attack in generating the adversarial perturbation. Fig. 9 is a flowchart showing another processing procedure of the adversarial image generation processing shown in Fig. 4 .

Steps S51 to S56 in FIG. 9 are the same processes as steps S11 to S16 shown in FIG. 5.

The adversarial perturbation generator 13 performs image classification processing on the first clean image using a CNN based on the optimized model parameters obtained in step S55, and searches for the most confusing category other than the correct label of the first clean image from the output result (step S57). Note that since it is sufficient for the adversarial perturbation generator 13 to obtain an image classification result for the first clean image using a CNN based on the optimized model parameters, this CNN is not limited to a configuration possessed by the adversarial perturbation generator 13, and may be possessed by another component.

The adversarial perturbation generator 13 creates adversarial perturbations based on the schedule results, the first clean image, the Most confusing category acquired in step S57, and the model parameters of the CNN 141 (step S58). At this time, the adversarial perturbation generator 13 generates the adversarial perturbations so as to minimize the loss for the Most confusing category. As a generation method, it is assumed that Projected Gradient Descent (Non-Patent Document 1) will be used, but other methods may be used as long as they can generate appropriate adversarial perturbations.

Step S59 shown in FIG. 9 is the same process as step S18 shown in FIG. 5.

The Most confusing category is the class that shows the highest confidence level other than the correct label, so the adversarial perturbation generated based on this Most confusing category corresponds to the data point of the closest decision boundary, and therefore, even if it is superimposed on the first clean image, it is an attack that does not significantly change the feature representation of the first clean image. For example, while the cosine similarity between the feature representation of the adversarial perturbation image generated by the processing procedure shown in Figure 5 and the first clean image is 0.3896, the cosine similarity between the feature representation of the adversarial image generated based on the Most confusing category and the first clean image is close to 0.4485.

According to a modification of the first embodiment, by having the CNN 141 learn adversarial images generated based on the most confusing category, it is possible to realize more gradual learning of the degree of influence of adversarial perturbation.

[Embodiment 2]
Next, a description will be given of a second embodiment of the present invention. Fig. 10 is a diagram for explaining a learning method in the second embodiment of the present invention.

In the second embodiment, by imposing constraints so that the feature representation of the AT-CNN (second NN) does not change from the feature representation of the normal training CNN (first NN), the AT-CNN is prevented from acquiring feature representations different from those of the normal training CNN.

Specifically, in the second embodiment, knowledge distillation is performed for learning the AT-CNN using a normal learning CNN as a teacher ((1) in FIG. 10). Here, knowledge distillation from the output layer of the CNN has only a regularization effect. For this reason, in the second embodiment, learning is performed so that the AT-CNN can perform feature extraction similar to that of a normal learning CNN by directly constraining the output of the intermediate layer. In the second embodiment, learning is performed using, for example, cos similarity as the loss function for constraints.

[Learning device]
Next, a description will be given of a learning device according to embodiment 2. Fig. 11 is a diagram illustrating an example of the configuration of the learning device according to embodiment 2.

As shown in FIG. 11, the learning device 210 according to the second embodiment has a configuration in which the schedule unit 16 has been removed, compared to the learning device 10 shown in FIG. 3. Moreover, compared to the learning device 10, the learning device 210 has an image discrimination unit 214 (second image discrimination unit) and an optimization unit 215 instead of the image discrimination unit 14 and the optimization unit 15. The learning device 210 further has an original image discrimination unit 216 (first image discrimination unit).

The original image classification unit 216 performs image classification on the first clean image using a first CNN 2161 (first NN) that has learned image classification using multiple clean images as training data. The original image classification unit 216 outputs the intermediate output of the first CNN 2161 to the optimization unit 215 as an original image intermediate output (first intermediate output). Note that the intermediate output is assumed to be a numerical value of the processing result of a layer other than the final layer of the first CNN 2161, but any other output may be used as long as it is an appropriate feature representation for image classification.

The image identification unit 214 has a second CNN 2141 to be learned, and has the same functions as the image identification unit 14. The model parameters of the first CNN 2161 are set as the initial parameters of the second CNN 2141. The image identification unit 214 outputs the intermediate output of the second CNN 2141 (second intermediate output) to the optimization unit 15 together with the model output of the second CNN 2141. The intermediate output is a numerical value of the processing result at the same processing level as the original image intermediate output. Also, like the original image intermediate output, the intermediate output may be any other output as long as it is an appropriate feature representation for image identification.

The optimization unit 215 performs learning of the second CNN 2141 by optimizing the parameters of the second CNN 2141 so that the difference between the image classification result for the adversarial image by the image classification unit 214 and the correct label of the first clean image is small, and the difference between the intermediate output of the original image and the intermediate output of the second CNN 2141 is small.

The optimization unit 215 optimizes the parameters of the second CNN 2141 using a loss function L which is a weighted sum of a _first loss function _L1 and a second loss function L2 as shown in equation (4).

In formula (4), the first loss function _L1 is a loss function indicating the difference between the image classification result for the adversarial image by the image classification unit 214 and the correct label of the first clean image. The second loss function _L2 is a loss function indicating the difference between the intermediate output of the original image and the intermediate output of the second CNN 2141. α is a hyperparameter.

[Learning process]
Next, a description will be given of the learning process according to the embodiment 2. Fig. 12 is a flowchart showing the processing procedure of the learning process according to the embodiment 2.

Steps S201 to S203 shown in FIG. 12 are the same processes as steps S1 to S3 shown in FIG. 4. Note that in step S203, the adversarial perturbation generator 13 may generate adversarial perturbations by applying the Most confusing attack (FIG. 9).

The image classification unit 214 uses the second CNN 2141 to perform image classification processing on the adversarial image generated by the adversarial perturbation generation unit 13 (step S204), and outputs the model output and intermediate output to the optimization unit 215.

The original image classification unit 216 uses the first CNN 2161 to perform an original image classification process for image classification of the first clean image (step S205), and outputs the original image intermediate output to the optimization unit 215.

The optimization unit 215 performs an optimization process to optimize the parameters of the second CNN 2141 so that the difference between the image classification result for the adversarial image by the image classification unit 214 and the correct label of the first clean image is reduced, and the difference between the intermediate output of the original image and the intermediate output of the second CNN 2141 is reduced (step S206).

Steps S207 and S208 are the same processes as steps S7 and S8 shown in FIG. 4.

[Image Identification Processing]
Next, the image identification process (step S204) will be described with reference to a flowchart shown in FIG.

Steps S211 to S215 shown in FIG. 13 are the same processes as steps S21 to S25 shown in FIG. 6. The image identification unit 214 outputs the model output obtained by the process of step S215 and the intermediate output of the second CNN 2141 to the optimization unit 15 (step S216).

[Original image identification process]
Next, the original image identification process (step S205) will be described with reference to a flowchart shown in FIG.

The original image identification unit 216 determines whether or not it is the start of learning (step S221). If it is the start of learning (step S221: Yes), the original image identification unit 216 acquires initial parameters from the initialization unit 12 (step S222).

If it is not the start of learning (step S221: No), or after step S222 is completed, the original image classification unit 216 acquires a first clean image (step S223) and applies image classification based on the model parameters (initialization parameters) to the clean image (step S224). In step S224, the original image classification unit 216 performs image classification on the first clean image using the first CNN 2161.

The original image identification unit 216 outputs the intermediate output of the first CNN 2161 to the optimization unit 215 as an original image intermediate output (step S225).

[Optimization process]
Next, the optimization process (step S206) will be described with reference to a flowchart shown in FIG.

Steps S231 to S233 shown in Fig. 15 are the same processes as steps S31 to S33 shown in Fig. 7. The optimization unit 15 obtains the model output and intermediate output from the image classification unit 214 (step S234), and obtains the original image intermediate output from the original image classification unit 216 (step S235).

Then, the optimization unit 215 optimizes the model parameters of the second CNN 2141 so that the difference between the model output output from the image classification unit 214 and the correct label of the first clean image is reduced, and the difference between the intermediate output of the original image and the intermediate output of the second CNN 2141 is reduced, and outputs the optimized parameters to the adversarial perturbation generation unit 13 and the image classification unit 214 (step S236).

The optimization unit 215 optimizes the image classification parameters using an image classification loss that reduces the difference between the model output x and the correct label y, and an intermediate output loss that reduces the difference between the intermediate output of the second CNN 2141 and the original image intermediate output, as shown in equation (4), and outputs the optimized parameters.

For image classification loss, cross entropy shown in equation (4) is generally used, but mean squared error or other functions can also have a similar effect as long as they are an appropriate objective function for the desired classification task. The intermediate output loss is also assumed to be a least squared error function or a cosine distance function, but any appropriate objective function will do.

The optimization unit 215 evaluates how close the model output is to the correct label and outputs the evaluation result (step S237). This evaluation may be performed using any appropriate evaluation index, such as whether or not the result of taking the argmax of the model output matches the correct label.

[Effects of the second embodiment]
In this way, in the second embodiment, by directly constraining the output of the intermediate layer so that the feature representation of the second CNN 2141 does not change from the feature representation of the first CNN 2161, it is possible to provide an image recognition model that maintains accuracy for clean images while improving robustness through adversarial learning.

[Embodiment 3]
Next, a description will be given of a third embodiment. In the third embodiment, a combination of the first and second embodiments will be described.

Figure 16 is a diagram showing a schematic example of the configuration of a learning device according to embodiment 3. As shown in Figure 16, compared to the learning device 10 shown in Figure 3, the learning device 310 according to embodiment 3 has a configuration that further includes an original image classification unit 216. Moreover, compared to the learning device 10 shown in Figure 3, the learning device 310 has an image classification unit 214 and an optimization unit 215 instead of the image classification unit 14 and optimization unit 15.

Fig. 17 is a flowchart showing the processing steps of the learning process according to the third embodiment. Steps S301 to S303 shown in Fig. 17 are the same processes as steps S1 to S3 shown in Fig. 4. Note that in step S303, the adversarial perturbation generator 13 may generate adversarial perturbations by applying the Most confusing attack (Fig. 9).

Steps S304 to S306 shown in FIG. 17 are the same processes as steps S204 to S206 shown in FIG. 12. Steps S307 to S309 shown in FIG. 17 are the same processes as steps S6 to S8 shown in FIG. 4.

As shown in this third embodiment, while performing curriculum learning to generate adversarial perturbations such that the magnitude of the adversarial perturbations increases stepwise, the parameters of the second CNN 2141 may be optimized so that the difference between the image classification result for the adversarial image by the image classification unit 214 and the correct label of the first clean image becomes small, and the difference between the intermediate output of the second CNN 2141 and the intermediate output of the original image becomes small. Learning of the second NN is executed.

[Evaluation Results]
Table 1 shows the results of evaluating the image classification performance of the CNN141 and the second CNN2141 trained in the first to third embodiments. For comparison, the evaluation results of a CNN (Standard) trained only on clean images and a CNN (AT) trained only on adversarial images are also shown. Clean is the result for clean images. FGSM, BIM (7), PGC (20), and CW (20) are methods for generating adversarial images.

As shown in Table 1, CNN141 and the second CNN2141 trained using the learning methods according to the first to third embodiments both show higher image classification accuracy for clean images than the CNN (AT) that has trained only on adversarial images. And, CNN141 and the second CNN2141 trained using the learning methods according to the first to third embodiments both show higher image classification accuracy for adversarial images than the CNN (Standard) that has trained only on clean images and the CNN (AT) that has trained only on adversarial images. Therefore, it was found that by using the learning methods according to the first to third embodiments, it is possible to realize an image classification model that maintains accuracy for clean images while improving robustness through adversarial learning.

Furthermore, the second CNN2141 trained using the learning method according to embodiment 3 exhibits higher image recognition accuracy for both clean and adversarial images compared to the CNN141 and the second CNN2141 trained using the learning methods according to embodiments 1 and 2. Therefore, it was found that by combining curriculum learning and knowledge distillation, which directly constrains the output of the intermediate layer, as in embodiment 3, it is possible to realize an image recognition model that maintains accuracy for clean images while improving robustness through adversarial learning.

The learning device according to this embodiment provides certain improvements over conventional learning methods such as those described in Non-Patent Document 1, and represents an advancement in the technical field of image recognition.

[System Configuration of the Embodiment]
Each component of the learning devices 10, 210, and 310 is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the learning devices 10, 210, and 310 is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

Furthermore, each process performed in the learning devices 10, 210, and 310 may be realized, in whole or in part, by a CPU, a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and GPU. Furthermore, each process performed in the learning devices 10, 210, and 310 may be realized as hardware using wired logic.

Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the information including the processing procedures, control procedures, specific names, various data, and parameters described above and illustrated in the drawings can be changed as appropriate unless otherwise specified.

[program]
18 is a diagram showing an example of a computer in which a program is executed to realize the learning devices 10, 210, 310. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes of the learning devices 10, 210, and 310 are implemented as program modules 1093 in which code executable by the computer 1000 is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to the functional configurations of the learning devices 10, 210, and 310 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

The setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes it.

The program module 1093 and the program data 1094 may not necessarily be stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)). The program module 1093 and the program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

The following notes are further provided with respect to the above embodiment.

(Additional Note 1)
Memory,
at least one processor coupled to the memory;
Including,
The processor,
A perturbation is generated based on a first clean image to which a correct answer label is attached, and a superimposed image is generated by superimposing the generated perturbation on the first clean image;
performing image classification on the first clean image using a first NN (Neural Network) that has learned image classification using a plurality of clean images as training data, and outputting an intermediate output of the first NN as a first intermediate output;
performing image classification on the superimposed image using a second NN in which the model parameters of the first NN are set as initial parameters, and outputting an intermediate output of the second NN as a second intermediate output;
A learning device that performs learning of the second NN by optimizing parameters of the second NN so that a difference between an image classification result for the superimposed image and a correct label of the first clean image is reduced, and a difference between the first intermediate output and the second intermediate output is reduced.

(Additional Note 2)
The learning device according to claim 1,
The learning device optimizes parameters of the second NN using a loss function that is a weighted sum of a first loss function indicating the difference between an image classification result for the superimposed image by the second image classification unit and a correct label of the first clean image, and a second loss function indicating the difference between the first intermediate output and the second intermediate output.

(Additional Note 3)
The learning device according to claim 1,
The generating step searches for a category other than a correct label that has the largest output value from an image classification result for the first clean image, and generates the perturbation so as to minimize a loss for the searched category.

(Additional Note 5)
A storage medium storing a learning program for causing a computer to function as the learning device described in appendix 1 to 3.

The above describes an embodiment of the invention made by the inventor, but the present invention is not limited to the description and drawings that form part of the disclosure of the present invention according to this embodiment. In other words, other embodiments, examples, operational techniques, etc. made by those skilled in the art based on this embodiment are all included in the scope of the present invention.

10, 210, 310 Learning device 11 Image storage unit 12 Initialization unit 13 Adversarial perturbation generation unit 14, 214 Image classification unit 15, 215 Optimization unit 16 Schedule unit 141 CNN
216 Original image identification unit 2141 Second CNN
2161 CNN 1

Claims (5)

A generating unit that generates a perturbation based on a first clean image to which a correct answer label is attached, and generates a superimposed image by superimposing the generated perturbation on the first clean image;
A first image classification unit that performs image classification on the first clean image using a first NN (Neural Network) that has learned image classification using a plurality of clean images as learning data, and outputs an intermediate output of the first NN as a first intermediate output;
a second image classification unit that performs image classification on the superimposed image using a second NN in which model parameters of the first NN are set as initial parameters, and outputs an intermediate output of the second NN as a second intermediate output;
a learning unit that executes learning of the second NN by optimizing parameters of the second NN so that a difference between an image classification result for the superimposed image by the second image classification unit and a correct label of the first clean image is reduced, and a difference between the first intermediate output and the second intermediate output is reduced;
A learning device comprising: The learning device according to claim 1, characterized in that the learning unit optimizes the parameters of the second NN using a loss function that is a weighted sum of a first loss function indicating the difference between the image classification result for the superimposed image by the second image classification unit and the correct label of the first clean image, and a second loss function indicating the difference between the first intermediate output and the second intermediate output. The learning device according to claim 1, characterized in that the generation unit searches for a category other than the correct label that has the largest output value from the image classification result for the first clean image, and generates the perturbation so as to minimize the loss for the searched category. A learning method executed by a learning device, comprising:
generating a perturbation based on a first clean image to which a correct answer label has been added, and generating a superimposed image by superimposing the generated perturbation on the first clean image;
performing image classification on the first cleaned image using a first neural network (NN) that has learned image classification using a plurality of cleaned images as training data, and outputting an intermediate output of the first NN as a first intermediate output;
performing image classification on the superimposed image using a second NN in which model parameters of the first NN are set as initial parameters, and outputting an intermediate output of the second NN as a second intermediate output;
Optimizing parameters of the second NN so that a difference between an image classification result for the superimposed image and a correct label of the first clean image is reduced, and a difference between the first intermediate output and the second intermediate output is reduced, thereby executing learning of the second NN;
A learning method comprising: A step of generating a perturbation based on a first clean image to which a correct answer label is attached, and generating a superimposed image by superimposing the generated perturbation on the first clean image;
performing image classification on the first cleaned image using a first NN (Neural Network) that has learned image classification using a plurality of cleaned images as training data, and outputting an intermediate output of the first NN as a first intermediate output;
performing image classification on the superimposed image using a second NN in which model parameters of the first NN are set as initial parameters, and outputting an intermediate output of the second NN as a second intermediate output;
Optimizing parameters of the second NN so that a difference between an image classification result for the superimposed image and a correct label of the first clean image is reduced, and a difference between the first intermediate output and the second intermediate output is reduced, thereby executing learning of the second NN;
A learning program for a computer to execute the above.

Images