JP7290596B2 - Determination device, determination method and determination program - Google Patents

Description

The present invention relates to a determination device, determination method, and determination program using machine learning.

Conventionally, one of the threats in deep learning inference is an attack using adversarial samples. An attacker adds a small perturbation to some input data and feeds it into a trained model with the aim of intentionally inducing misclassification. In supervised learning, a discriminative boundary surface is formed based on data given during training, ie, training data. Since the discriminative boundary plane depends on the training data, it may be formed away from the true spatial structure of the data. Adversarial samples take advantage of this divergence to induce misclassification with only a small perturbation.

As a countermeasure against attacks using adversarial samples, there is a learning method called adversarial learning. In adversarial learning, the training data is deliberately perturbed to produce a discriminative model that is robust against adversarial samples. For example, the algorithm proposed in Non-Patent Document 1 is known to have high robustness against this attack.

A. Madry et al. , "Towards Deep Learning Models Resistant to Adversarial Attacks," ICLR 2018.

However, since adversarial learning requires input of training data corresponding to adversarial samples, it is not always suitable for actual attack techniques. In addition, modification of processing is required for existing learning algorithms, increasing the load.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a determination device, a determination method, and a determination program that can easily provide resistance to an attack that induces an erroneous determination of a trained model.

A determination apparatus according to the present invention includes a conversion unit that performs a conversion process on input data and generates a plurality of different post-conversion data; a learning unit that generates separate trained models using the transformed data of the above; and an input unit for obtaining a plurality of individual determination results, and a determination unit for outputting a comprehensive determination result based on the distribution of the plurality of individual determination results.

The determination unit may output a comprehensive determination result based on a majority decision of the individual determination results.

The transform unit may transform the one-dimensional vector as the input data by each of a plurality of matrices.

The matrix may be obtained by replacing some 0s in a unit matrix with 1s.

A determination method according to the present invention includes a conversion step of performing a conversion process on input data to generate a plurality of different post-conversion data; a learning step of generating separate trained models using the transformed data of the above; to obtain a plurality of individual determination results; and a determination step of outputting a comprehensive determination result based on the distribution of the plurality of individual determination results.

A determination program according to the present invention is for causing a computer to function as the determination device.

According to the present invention, it is possible to easily provide resistance to an attack that induces an erroneous determination of a trained model.

It is a figure which shows the functional structure of the determination apparatus in embodiment. It is a figure which illustrates the matrix in embodiment. It is a figure which shows the flow of the determination method in embodiment.

An example of an embodiment of the present invention will be described below.
FIG. 1 is a diagram showing the functional configuration of a determination device 1 according to this embodiment.
The determination device 1 is an information processing device (computer) such as a server or a personal computer, and includes a control unit 10 and a storage unit 20, input/output devices for various data, communication devices, and the like.

The control unit 10 is a part that controls the entire determination device 1, and implements each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. FIG. The control unit 10 may be a CPU.

The storage unit 20 is a storage area for various programs, various data, and the like for causing the hardware group to function as the determination device 1, and may be a ROM, RAM, flash memory, hard disk (HDD), or the like. Specifically, the storage unit 20 stores a program (determination program) for causing the control unit 10 to execute each function of the present embodiment, a learning model, and the like.

The control unit 10 includes a conversion unit 11 , a learning unit 12 , an input unit 13 and a determination unit 14 .
The control unit 10 uses these functional units to output determination results using machine learning for input data.

The conversion unit 11 performs conversion processing on input data, that is, machine learning training data or determination target data, and generates a plurality of different post-conversion data.
Input data may be a one-dimensional vector. The conversion unit 11 converts, for example, a one-dimensional vector a as input data to a′ _i =H _i ·a using each of the plurality of matrices H _i .

FIG. 2 is a diagram illustrating the matrix H _i in this embodiment.
The matrix H _i may be, for example, a unit matrix in which some 0s are replaced with 1s.
In addition, 1 may be replaced with 0, rows may be replaced, etc., but it is preferable to retain the elements of the unit matrix, so that the characteristics of the original input data are retained even after conversion. , the inclusion of nonlinear terms enhances resistance to attacks.

Note that the conversion process is not limited to matrix conversion. A predetermined conversion rule is defined for each learning model (AI), and common conversion processing is performed on training data and determination target data.

The learning unit 12 uses a plurality of different post-transformation data obtained by transforming training data for machine learning by the transforming unit 11, and prepares a trained model by a separate DNN (Deep Neural Network) or the like. to generate
Note that the learning algorithm may be common to a plurality of learning models, or may be different.

The input unit 13 inputs a plurality of different post-conversion data obtained by converting the determination target data by the conversion unit 11 into the corresponding learned models, and obtains a plurality of individual determination results.

The determination unit 14 outputs a comprehensive determination result based on the distribution of the individual determination results.
At this time, the determination unit 14 may output the overall determination result based on the majority of the individual determination results. For example, when judging two types of classification, the classification with the largest number of individual judgment results is judged, and when judging three or more classifications, the classification with the largest number of individual judgment results is taken as the overall judgment result. .

FIG. 3 is a diagram showing the flow of the determination method in this embodiment.
First, the conversion unit 11 converts the same training data X (vector group) according to different conversion rules (for example, matrix H _i ) corresponding to a plurality of (for example, three or more) learning models AI _i , A plurality of transformed data _X'i are generated (1).

Subsequently, the learning unit 12 performs independent machine learning for each learning model AI _i using the converted data X′ _i (2).
As a result, a plurality of different trained models AI _i learned from the same training data are constructed.

After that, when the determination target data a is input to the determination device 1, the conversion unit 11 generates a plurality of post-conversion data _a'i according to the same conversion rules as those used during learning (3).

Next, the input unit 13 obtains a plurality of individual judgment results by inputting the generated post-conversion data a′ _i to the corresponding learned models AI _i (4).

Then, based on these individual determination results, the determination unit 14 outputs a comprehensive determination result by majority vote (5).

According to the present embodiment, the determination device 1 generates separate learned models using a plurality of different post-transformation data obtained by performing the transformation process on training data for machine learning, A plurality of different post-transformation data obtained by subjecting the data to the same transformation process are input to the corresponding learned models. Then, the determination device 1 outputs a comprehensive determination result based on the distribution of the individual determination results.

As a result, even if an erroneous judgment occurs in one of the trained models due to the hostile sample, the judging device 1 cannot easily make an erroneous judgment in most of the independent trained models. By synthesizing, a judgment result with high accuracy can be output. Therefore, the determination device 1 is easily resistant to attacks that induce erroneous determination of the trained model.

The determination device 1 can easily make a highly accurate determination by outputting the overall determination result based on the majority of the individual determination results.

The determination device 1 transforms a one-dimensional vector as input data by each of a plurality of matrices, thereby reducing the load on the transformation process. Therefore, the determination device 1 can easily improve resistance to attacks by only performing light preprocessing.

A matrix used for conversion processing may be obtained by replacing some 0s in a unit matrix with 1s. As a result, the determination device 1 can increase resistance to attacks by adding nonlinear terms without impairing the characteristics of the input data.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely enumerations of the most suitable effects produced by the present invention, and the effects of the present invention are not limited to those described in the embodiments.

The determination method by the determination device 1 is realized by software. When it is implemented by software, a program constituting this software is installed in an information processing device (computer). Further, these programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to users' computers via a network. Furthermore, these programs may be provided to the user's computer as a web service through the network without being downloaded.

1 determination device 10 control unit 11 conversion unit 12 learning unit 13 input unit 14 determination unit 20 storage unit

Claims (5)

a conversion unit that performs conversion processing on input data and generates a plurality of different post-conversion data;
a learning unit that generates separate trained models using a plurality of different post-transformation data obtained by subjecting the training data for machine learning to the transformation process;
an input unit for obtaining a plurality of individual determination results by inputting a plurality of different converted data obtained by performing the conversion processing on the determination target data to the corresponding trained models;
a determination unit that outputs a comprehensive determination result based on the distribution of the plurality of individual determination results ;
The transform unit is a determination device that transforms the one-dimensional vector as the input data by each of a plurality of matrices . 2. The determination device according to claim 1, wherein the determination unit outputs a comprehensive determination result based on a majority decision of the individual determination results. 3. The determination device according to claim 1 , wherein the matrix is obtained by replacing some 0s in a unit matrix with 1s. a conversion step of performing conversion processing on input data to generate a plurality of different post-conversion data;
a learning step of generating separate trained models using a plurality of different post-transformation data obtained by subjecting the training data for machine learning to the transformation process;
an input step of obtaining a plurality of individual determination results by inputting a plurality of different converted data obtained by performing the conversion process on the determination target data into the corresponding learned models;
A computer executes a judgment step of outputting a comprehensive judgment result based on the distribution of the plurality of individual judgment results,
The determination method , wherein in the transforming step, the one-dimensional vector as the input data is transformed by each of a plurality of matrices . A determination program for causing a computer to function as the determination device according to any one of claims 1 to 3 .

Images