JP7029385B2 - Learning equipment, learning methods and learning programs - Google Patents

Description

The present invention relates to a learning device, a learning method and a learning program that are resistant to data poisoning.

One of the threats to supervised learning is a data poisoning attack that mixes malicious data into training data. As a countermeasure against this attack, there is a learning algorithm called TRIM (see, for example, Non-Patent Document 1).
In general supervised learning, when learning a model that represents the correspondence between inputs and outputs from training data, the parameters of the model that minimizes the loss function are determined by solving the optimization problem. On the other hand, in TRIM, in order to minimize the influence of data poisoning, the number of normal training data out of N training data mixed with malignant data is set to n (<N) and the optimization problem is solved. Determine the parameters of the model. Specifically, in TRIM, by alternately optimizing the training data and the parameters of the model by the alternate minimization method, n training data that minimize the loss function are extracted from the N training data. At the same time, determine the parameters of the model that minimizes the loss function.

M. Jagielski et al. , "Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning," IEEE S & P 2018.

The loss function is generally expressed as the average of the degree of loss for each training data. Therefore, in TRIM, when selecting n training data that minimizes the loss function using the parameters of the current model, the loss degree is calculated for the N training data, and the loss degree is calculated from the one with the smallest loss degree. Select n training data. Therefore, it is necessary to calculate at least order N.
Also, when selecting the parameters of the model that minimizes the loss function using the current n training data, it is necessary to calculate the degree of loss for the n training data. Therefore, it is necessary to calculate the order n.
Therefore, when N and n are large, the calculation cost of TRIM is enormous.

An object of the present invention is to provide a learning device, a learning method and a learning program capable of learning even a large-scale training data at high speed while minimizing the influence of data poisoning in supervised learning.

The learning device according to the present invention is a learning device that determines a function parameter value by supervised learning, and has an extraction unit that randomly extracts one from a set of training data and a training data extracted by the extraction unit. On the other hand, a calculation unit that calculates the gradient of the loss function based on the current parameter value and updates the gradient recording data storing the gradient corresponding to each of the training data, and a predetermined number of the gradient recording data from the smaller one. The parameter value converges on the processing by the extraction unit, the calculation unit, and the update unit. Repeat until you do.

When the number of repetitions is less than the predetermined number of times, the updating unit may extract a predetermined ratio of gradients according to the number of repetitions from the smaller of the non-zero gradients.

When the extracted non-zero gradient is less than a predetermined number, the update unit may calculate the average value by setting the insufficient number of gradients to zero.

The learning method according to the present invention is a learning method in which a parameter value of a function is determined by supervised learning, and is an extraction step of randomly extracting one from a set of training data and a training data extracted in the extraction step. On the other hand, a calculation step of calculating the gradient of the loss function based on the current parameter value and updating the gradient recording data storing the gradient corresponding to each of the training data, and a predetermined number of the gradient recording data from the smaller one. The computer repeatedly executes an update step of extracting the gradients of the above and updating the parameter values based on the average value of the predetermined number of gradients until the parameter values converge.

The learning program according to the present invention is a learning program for determining the parameter value of a function by supervised learning, and is extracted in an extraction step of randomly extracting one from a set of training data and the extraction step. For the training data, the calculation step of calculating the gradient of the loss function according to the current parameter value and updating the gradient recording data storing the gradient corresponding to each of the training data, and the gradient recording data from the smaller one. This is for causing a computer to repeatedly execute an update step of extracting a predetermined number of gradients and updating the parameter values based on the average value of the predetermined number of gradients until the parameter values converge.

According to the present invention, in supervised learning, even a large-scale training data can be learned at high speed while minimizing the influence of data poisoning.

It is a block diagram which shows the functional structure of the learning apparatus which concerns on embodiment. It is a flowchart which shows the process of the learning apparatus which concerns on embodiment.

Hereinafter, an example of the embodiment of the present invention will be described.
In the learning method according to the present embodiment, the influence of the malignant data is suppressed in the supervised learning using the training data mixed with the malignant data.
It should be noted that the malignant data is assumed to be mixed in a predetermined ratio, for example, 20% of the total, and the training data in the predetermined ratio is removed from the whole.

In supervised learning, the parameter _w of the function fw indicating the correspondence between the input x and the output y is derived from the set of training data.
Here, D1 is a set of training data consisting of n data. Further, let l _i (w) be a function that outputs the degree of loss for the i-th training data with w as an input. In supervised learning, the parameter w of the function f _w that minimizes the loss function L is derived by solving the following optimization problem.
min _w L (D1, w) = min _w (1 / n) ・ Σ i _{∈ [n]} l _i (w)

In a data poisoning attack, an attacker deliberately manipulates the function _fw by mixing a set of malicious data into a set of training data.
Here, D2 is a union of a set of training data D1 and a set of malignant data D1', and D2 is composed of N elements. Also, let R be a utility function. The utility function R outputs the utility of the attack by inputting the parameter w and the set D3 of the test data prepared by the attacker. The attacker derives a set of malicious data D1'that maximizes the utility function R, for example, by solving the following optimization problem.
max _D1'R (D3, w')
s. t. w'∈ argmin _w L (D2, w)

In the learning method of this embodiment, D1 ”is a subset of D2 consisting of n (<N) elements, and the parameter w that minimizes the influence of the set of malignant data by solving the following optimization problem. Is derived.
min _{w, D1 "} L (D1", w)

FIG. 1 is a block diagram showing a functional configuration of the learning device 1 according to the present embodiment.
The learning device 1 is an information processing device (computer) such as a server device or a personal computer, and includes a control unit 10 and a storage unit 20, as well as various data input / output devices and communication devices.

The control unit 10 is a part that controls the entire learning device 1, and realizes each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

The storage unit 20 is a storage area for various programs and various data for making the hardware group function as the learning device 1, and may be a ROM, RAM, flash memory, hard disk (HDD), or the like. Specifically, the storage unit 20 stores data such as a program (learning program) for causing the control unit 10 to execute each function of the present embodiment, a parameter group of a function as a learning model, and gradient recording data described later. Remember.

The control unit 10 includes an extraction unit 11, a calculation unit 12, and an update unit 13. The control unit 10 determines the parameter value of the function by supervised learning by repeatedly operating these functional units.

The extraction unit 11 randomly extracts one training data from a set of training data used for supervised learning.

The calculation unit 12 calculates the gradient of the loss function based on the current parameter value for the training data extracted by the extraction unit 11, and updates the gradient recording data.
The gradient recording data is vector data that stores the gradient of the loss function corresponding to each training data. When the same training data is extracted by the extraction unit 11, the value of the same index in the gradient recording data is overwritten and updated.

The update unit 13 extracts a predetermined number of gradients from the smaller of the gradient recording data, and updates the parameter value based on the average value of the predetermined number of gradients.
In the initial stage where the number of learning repetitions is less than the number of training data, the update unit 13 extracts a predetermined ratio of gradients according to the number of learning repetitions from the smaller of the non-zero gradients. .. Then, when the non-zero gradient is less than a predetermined number, the update unit 13 calculates the average value with the gradient of the insufficient number as zero.

The control unit 10 repeats the processing by the extraction unit 11, the calculation unit 12, and the update unit 13 until the parameter values converge.

FIG. 2 is a flowchart showing the processing of the learning device 1 according to the present embodiment.
The learning device 1 learns the parameter w of the function f _w while removing the malignant data by solving the above-mentioned optimization problem by applying the stochastic gradient descent method.

In step S1, the control unit 10 sets an N-dimensional vector (gradient recording data) Z ⁽⁰⁾ = (z ₁ ⁽⁰⁾ , ..., Z _N ⁽⁰⁾ ) for recording the gradient in the subsequent iterative processing. prepare. However, z _i ⁽⁰⁾ = 0 for all i.
Further, the control unit 10 sets the initial value w ⁽⁰⁾ of the parameter w before learning and the initial value 0 of the number of times of learning t.

In step S2, the control unit 10 (extraction unit 11) counts up the number of times of learning t, and from the set D2 of N training data in which normal data and malignant data are mixed for the t-th learning. One training data (x _c , y _c ) is randomly extracted.

In step S3, the control unit 10 (calculation unit 12) has a gradient ∇ l _c (w (t-1)) of the loss function l _c (w ^(t-1) ) corresponding to the training data (x _c , y _c ) extracted in step S2. w ^(t-1) ) is calculated, and only the c-th element of the vector Z is overwritten and updated as follows.
z _c (t) ← ∇l _c (w ^(t-1) )

In step S4, the control unit 10 (update unit 13) determines whether or not the number of times of learning repetition t is less than N. If this determination is YES (t <N), the process proceeds to step S5, and if the determination is NO (t ≧ N), the process proceeds to step S6.

In step S5, the control unit 10 (update unit 13) extracts nt / N elements from the non-zero elements of the vector Z having a small value, and creates an index set I (t) of these elements.

In step S6, the control unit 10 (update unit 13) extracts n elements from the elements having small values in the vector Z, and creates an index set I (t) of these elements.

In step S7, the control unit 10 (update unit 13) updates the parameter w using the following update formula. Where λ is the step size.
w ^(t) ← w ^(t-1) -(λ / n) ・ Σ i _{∈ I} z _i ^(t)

In step S8, the control unit 10 determines whether or not the value of the parameter w has converged. If this determination is YES, the process ends, if the determination is NO, the process returns to step S2, and the control unit 10 repeats the processes from step S2 to step S7 until the value of the parameter w converges.
When the value of the parameter w converges, the index set I also converges to a specific set. This particular set is benign training data, excluding a set of presumed malignant data.

As described above, according to the present embodiment, the learning device 1 randomly extracts one training data in each iterative process and calculates the gradient of the loss function with respect to the parameter w of the model (function f _w ). Then, the parameter w is updated using the average of the past gradients. As a result, the calculation related to the update of the parameter w in the iterative process is reduced from order n in the case of TRIM to order 1.
Further, when calculating the average of the past gradients, the learning device 1 selects not the average of all the gradients but the gradients of a part (n) having a small value and calculates the average value. This excludes outliers with large gradients, that is, training data that are likely to be malignant data, so that training data optimization is achieved at the same time. In this case, the amount of calculation related to the optimization of training data is reduced from order N in the case of TRIM to order 1.
As described above, the learning device 1 can learn even a large-scale training data at high speed while minimizing the influence of data poisoning in supervised learning.

When the number of repetitions is less than the predetermined number of times, for example, the number of training data, the learning device 1 has a gradient of a predetermined ratio (nt / N) according to the number of repetitions from the smaller of the recorded non-zero gradients. To extract. As a result, the learning device 1 can learn the parameter w while appropriately excluding malignant data even in the initial stage of learning.

When the extracted non-zero gradient is less than the predetermined number n, the learning device 1 calculates the average value with the gradient of the insufficient number as zero. As a result, the learning device 1 can make the degree of influence of each training data on learning uniform even in the initial stage of learning.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely a list of the most suitable effects resulting from the present invention, and the effects according to the present invention are not limited to those described in the embodiments.

In the above-described embodiment, when the number of non-zero gradients used when updating the parameter w is less than n, the learning device 1 divides the insufficient number of gradients by n in order to make it zero. The average value was calculated, but it is not limited to this. For example, instead of n, the number nt / N of the extracted gradients may be used.

In the above-described embodiment, the learning device 1 extracts nt / N elements from the gradient recording data according to the number of repetitions t in the initial stage of learning in which the number of repetitions t is less than the number N of training data. However, it is not limited to this. For example, the number obtained by multiplying the number of non-zero elements existing in the gradient recording data by a predetermined ratio (n / N) may be extracted.

In the above-described embodiment, the training data is randomly selected, but the training data is not limited to this. For example, all training data may be uniformly selected, such as the order of indexes.

The learning method by the learning device 1 is realized by software. When realized by software, the programs that make up this software are installed in the information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

1 Learning device 10 Control unit 11 Extraction unit 12 Calculation unit 13 Update unit 20 Storage unit

Claims (5)

It is a learning device that determines the parameter value of a function by supervised learning.
An extractor that randomly extracts one from the set of training data,
A calculation unit that calculates the gradient of the loss function based on the current parameter value for the training data extracted by the extraction unit and updates the gradient recording data that stores the gradient corresponding to each of the training data.
It is provided with an update unit that extracts a predetermined number of gradients from the smaller of the gradient recording data and updates the parameter value based on the average value of the predetermined number of gradients.
A learning device that repeatedly executes processing by the extraction unit, the calculation unit, and the update unit until the parameter values converge. The learning device according to claim 1, wherein the updating unit extracts a predetermined ratio of gradients according to the number of repetitions from the smaller of the non-zero gradients when the repetition is less than a predetermined number of times. The learning device according to claim 2, wherein when the extracted non-zero gradient is less than a predetermined number, the update unit calculates the average value with the insufficient number of gradients as zero. It is a learning method that determines the parameter value of a function by supervised learning.
An extraction step that randomly extracts one from a set of training data,
For the training data extracted in the extraction step, the gradient of the loss function according to the current parameter value is calculated, and the gradient recording data storing the gradient corresponding to each of the training data is updated.
An update step of extracting a predetermined number of gradients from the smaller of the gradient recording data and updating the parameter value based on the average value of the predetermined number of gradients.
A learning method in which a computer repeatedly executes the above until the parameter values converge. A learning program for determining function parameter values by supervised learning.
An extraction step that randomly extracts one from a set of training data,
For the training data extracted in the extraction step, the gradient of the loss function according to the current parameter value is calculated, and the gradient recording data storing the gradient corresponding to each of the training data is updated.
An update step of extracting a predetermined number of gradients from the smaller of the gradient recording data and updating the parameter value based on the average value of the predetermined number of gradients.
Is a learning program for causing a computer to repeatedly execute the above parameters until the parameter values converge.

Images