KR20190061446A - Apparatus for generating adversarial example in deep learning environment and method thereof, computer program - Google Patents

Abstract

The present invention relates to an apparatus for generating an adversarial example in a deep running environment and a method thereof and a computer program thereof. According to the present invention, the apparatus comprises: first and second classifiers learned in accordance with deep learning to identify a class of input data through a neural network; and a converter for separately inputting adversarial data (adversarial example) converted from original data into the first and second classifiers, obtaining, by the first and second classifiers, each identification result obtained by separately identifying a class of the original data on the basis of the input adversarial data, normally identifying, by the first classifier, the class of the original data on the basis of the adversarial data, and optimizing, by the second classifier, the adversarial data to misidentify the class of the original data on the input adversarial data.

Description

[0001] APPARATUS FOR GENERATING EXAMPLES IN DEEP LEARNING ENVIRONMENT AND METHOD THEREOF, COMPUTER PROGRAM [0002]

The present invention relates to an apparatus and method for generating a hostile example in a deep learning environment, and more particularly to an adversarial example in which the result of discrimination of a class of original data differs according to a neural network To a hostile example generating device and method in a deep learning environment, and to a computer program.

Deep Learning is an artificial intelligence (AI) technology that allows a machine to think and learn like a human being, and it enables a machine to learn and solve complex nonlinear problems based on artificial neural network theory. The application of this deep learning technology enables a computer to perceive, reason, and judge itself without having to set all judgment criteria, and is widely applied in the field of pattern analysis.

Deep Neural Network (DNN) means an artificial neural network (ANN) composed of a plurality of hidden layers between an input layer and an output layer, Linear fitting and nonlinear transformation or activation are repeatedly performed.

The depth of neural network has been applied to a wide range of fields such as image recognition, speech recognition, Intrusion Tolerance System, and Natural Language Processing. Specifically, even when a human being can not perceive the minute modulation caused by the input data, the input data in which the minute modulation occurs may cause a problem that the in-depth neural network erroneously classifies the input data. For example, in an autonomous vehicle that recognizes a road sign through an in-depth network, there is a problem in that an unintended operation of the autonomous vehicle is caused by micro-modifying the road sign image input to the deep core network (For example, when a slight change in the left turn display image causes a right turn of the autonomous vehicle). The above-mentioned input data that is slightly modulated is referred to as an adversarial example, and it is referred to as Evasion Attack so as to be recognized as a class different from the class of the original image through minimum image modulation.

The background art of the present invention is disclosed in Korean Patent Laid-Open Publication No. 10-2017-0095582 (published on Aug. 23, 2017).

The above-mentioned hostile examples may be useful depending on the application field. For example, a case may be considered in which a malfunction of an enemy autonomous vehicle to which an in-depth core network is applied by generating a hostile example by slightly modulating a road display image in a battle field can be considered. In this case, if the allied and enemy forces are in the same battlefield, the original data is misidentified for the defense-in-depth neural network applied to the enemy autonomous vehicles, and the hostile example applied to the defense- Lt; / RTI >

Accordingly, it is an object of the present invention to provide a deep learning environment in which a hostile example in which original data is normally identified for one of the deep neural networks and source data is misidentified for another deep neural network An apparatus and method for generating hostile examples, and a computer program.

A hostile example generating apparatus in a deep learning environment according to an aspect of the present invention includes first and second classifiers learned according to Deep Learning to identify a class of input data through a Neural Network, The first classifier and the second classifier input antialiased data (adversarial example) transformed from the data into the first classifier and the second classifier, respectively, and classify the class of the original data based on the hostile data inputted by the first classifier and the second classifier The first classifier normally identifies the class of the original data on the basis of the inputted hostile data based on each of the obtained identification results after acquiring the respective identification results, And a converter for optimizing the hostile data to misidentify the class of the original data.

In the present invention, the converter optimizes the hostile data while further considering the degree of distortion from the original data.

In the present invention, the original data and the hostile data are each image data, and the degree of distortion represents a pixel distance between the original data and the hostile data.

In the present invention, the transformer increases the probability that the first classifier normally identifies the class of the original data based on the inputted hostile data, and when the second classifier detects the class of the original data The probability of misidentifying the class increases, and the hostile data is optimized so as to reduce the degree of distortion from the original data.

In the present invention, the converter optimizes the hostile data using a method of minimizing the output value of the total loss function by summing the first to third loss functions, wherein the first loss function is a function of And outputs the lower value as the probability of normally identifying the class of the original data based on the data is higher, and the second loss function outputs the lower value of the class of the original data based on the hostile data inputted by the second classifier The third loss function outputs a lower value as the degree of distortion of the hostile data is lower than the original data.

In the present invention, the converter updates enemy data based on the obtained identification results and inputs them to the first and second classifiers. The first and second classifiers are updated based on the updated hostile data And acquiring each identification result that identifies each of the classes of the original data and updating the hostile data is repeatedly performed to optimize the hostile data.

In the present invention, the converter optimizes the hostile data so that the second classifier identifies any one class other than the class of the original data based on the hostile data inputted.

In the present invention, the converter optimizes the hostile data so as to identify one or more unspecified classes other than the class of the original data based on the hostile data inputted by the second classifier.

A hostile example generation method in a deep learning environment according to an aspect of the present invention is characterized in that the converter includes a first classifier and a second classifier that are learned according to Deep Learning to identify a class of input data through a Neural Network Inputting, respectively, antialiased data (adversarial example) transformed from original data, wherein the transformer identifies the class of the original data based on the hostile data inputted by the first and second classifiers, Wherein the first classifier normally identifies the class of the original data on the basis of the hostile data inputted, and the second classifier identifies the class of the original data on the basis of the inputted identification result, And updating the hostile data so as to erroneously identify the class of the original data based on the hostile data do.

A hostile example generating apparatus in a deep learning environment according to an aspect of the present invention is a first and a second classification model that are learned according to Deep Learning to identify a class of input data through a Neural Network, Inputting the converted anti-host data (adversarial example) from the original data, and acquiring each identification result that identifies the class of the original data based on the hostile data inputted by the first and second classification models The first classification model normally identifies the class of the original data on the basis of the input hostile data and the second classification model identifies the original data on the basis of the input hostile data, To optimize hostile data so as to misidentify the class of the host.

A computer program according to an aspect of the present invention is a first and a second classification model, each of which is machine-learned to identify a class of input data through a neural network, Obtaining antidotal data (hostile example, adversarial example), obtaining each identification result that identifies each class of the original data based on the hostile data inputted by the first and second classification models, and The first classification model normally identifies the class of the original data on the basis of the input hostile data and the second classification model identifies the class of the original data based on the input hostile data, And updating the hostile data to erroneously identify the hostile data.

According to an aspect of the present invention, a method of generating a hostile example in which original data is normally identified for a friendly neural network in the battlefield, and the original data is misidentified for the enemy's neural network, It can contribute to the development of industry.

1 is a block diagram illustrating an apparatus for generating a hostile example in a deep learning environment according to an embodiment of the present invention.
FIG. 2 and FIG. 3 are diagrams illustrating a Targeted Scheme algorithm and an Untargeted Scheme algorithm in a hostile example generating apparatus in a deep learning environment according to an embodiment of the present invention.
FIGS. 4 to 7 are diagrams illustrating examples of application of Targeted Scheme in a hostile example generating apparatus in a deep learning environment according to an embodiment of the present invention. FIG.
FIG. 8 and FIG. 9 illustrate examples of applying the untargeted scheme in a hostile example generating apparatus in a deep learning environment according to an embodiment of the present invention.
10 is a flowchart illustrating a method for generating a hostile example in a deep learning environment according to an embodiment of the present invention.
11 is a flowchart illustrating a process of optimizing hostile data in a hostile example generation method in a deep learning environment according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of an apparatus and method for generating a hostile example in a deep learning environment and a computer program according to the present invention will be described with reference to the accompanying drawings. In this process, the thicknesses of the lines and the sizes of the components shown in the drawings may be exaggerated for clarity and convenience of explanation. In addition, the terms described below are defined in consideration of the functions of the present invention, which may vary depending on the intention or custom of the user, the operator. Therefore, definitions of these terms should be made based on the contents throughout this specification.

FIG. 1 is a block diagram illustrating an apparatus for generating a hostile example in a deep learning environment according to an exemplary embodiment of the present invention. FIGS. 2 and 3 illustrate a hostile example generation in a deep learning environment according to an exemplary embodiment of the present invention. FIGS. 4 to 7 are diagrams illustrating a result of applying a Targeted Scheme in an apparatus for generating a hostile example in a deep learning environment according to an embodiment of the present invention. FIG. And FIGS. 8 and 9 are views illustrating the result of applying an untargeted scheme in a hostile example generating apparatus in a deep learning environment according to an embodiment of the present invention.

The Adversarial Example Generator (AEG) in the deep learning environment according to the present embodiment is an adversarial example generator in which the original data is normally identified for one of the deep neural networks and the original data is misidentified for the other neural network In order to implement the configuration for generating the example, a network architecture including a transformer, a Discriminator _friend (D _friend ), and a second classifier (Discriminator _enemy : D _enemy ) I suggest. Converter (Transformer), the first classifier (D _friend) and the second classifier (D _enemy) may be implemented in a given computing device (computing device), such as a microprocessor (microprocessor) or a micro controller (microcontroller).

For convenience of explanation, in the present embodiment, the first classifier (D _friend ) is a classifier for normally identifying the class of the original data (for example, a friend in an autonomous driving vehicle when the host enemy data (adversarial example) And the second classifier (D _enemy ) is described as a classifier (eg, a classifier applied to enemy autonomous vehicles) that misidentifies the class of original data when hostile data is entered.

The first and second classifiers (D _friend , D _enemy ) can function as a classifier learned according to Deep Learning to identify the class of input data through a Neural Network, and the first and second classifiers The neural network applied to the classifier (D _friend , D _enemy ) may be a Convolutional Neural Network (CNN). If the operation functions of the first and second classifiers (D _friend and D _enemy ) are f _friend (x) and f _enemy (x), respectively, the first and second classifiers (D _friend , D _enemy ) Can be learned to satisfy the following equation (1).

In Equation (1), x denotes input data, X denotes a whole set of input data, y denotes a class of input data, and Y denotes a whole set of classes of input data.

The transformer inputs the transformed antivirus data (adversarial example) from the original data into the first and second classifiers (D _friend and D _enemy ), and classifies the original data based on the inputted hostile data the first and second classifiers (D _friend, D _enemy) is then obtained for each identification result of identifying, respectively, the first classifier (D _friend) on the basis of each of the obtained identification result is the original data based on the antagonistic data input , And the second classifier (D _enemy ) can optimize the hostile data to misidentify the class of original data based on the incoming hostile data.

At this time, the transformer can optimize the hostile data in consideration of the degree of distortion from the original data. Specifically, the hostile data can be optimized such that the degree of distortion from the original data is minimized.

That is, the present embodiment allows a first classifier (D _friend ) to normally identify a class of original data based on hostile data, and a second classifier (D _enemy ) to identify, via a transformer, The enemy data is optimized so as to minimize the degree of distortion from the original data in the range of misidentifying the class of the enemy data.

Here, the second classifier (D _enemy) is configured to optimize the antagonistic data to misidentification the class of the original data based on the antagonistic data, ⅰ) a second sorter (original data in the base hostile data input D _enemy) (Targeted Scheme) for optimizing the hostile data so as to identify any one specific class (Targeted Class) other than the class of the original data based on the hostile data to which the second classifier (D _enemy ) is input And an untargeted scheme that optimizes the hostile data to identify one or more untargeted classes of the host.

The operations of the transformer for performing the Targeted Scheme and Untargeted Scheme are expressed by Equations (2) and (3), respectively.

In Equations 2 and 3, x denotes original data, x denotes a class of original data, x * denotes hostile data, y * denotes a specific class (Targeted Class), L (·) denotes original data x and hostile data x * Denotes a function for calculating the pixel distance between original data and hostile data that can be implemented with image data as a mean square error (MSE) and outputting the distortion distance.

Based on the above-described configuration, a configuration in which a transformer optimizes hostile data will be described in detail below.

First, the transformer can initially input the original data and the class of the original data (hereinafter referred to as the original class), and generate the hostile data. In this embodiment, the transformer can generate hostile data by the following equation (4).

In Equation (4), w is a modifier, and the hostile data can be updated and optimized in accordance with the update of the w value as will be described later.

When the original data and the original class are first input and hostile data is generated by the transformer, the transformer inputs the generated hostile data to the first and second classifiers (D _friend and D _enemy ) 1 and the second classifier (D _friend , D _enemy ), and updating the above-described modifier (w) is repeated to optimize the hostile data.

At this time, the transformer increases the probability that the first classifier (D _friend ) normally identifies the original class based on the inputted hostile data, and the second classifier (D _enemy ) And it is possible to optimize the hostile data such that the degree of distortion from the original data decreases. To this end, the present embodiment employs a configuration using the first through third loss functions.

That is, the transformer can optimize the hostile data using a method of minimizing the output value of the total loss function by summing the first to third loss functions. In this case, the first loss function first classifier (D _friend) the higher the probability that normal identify the original class based on the antagonistic data input output a lower value, and the second loss function of the second classifier (D _enemy ) Outputs a lower value as the probability of misidentifying the original class based on inputted hostile data is higher, and the third loss function is a function designed to output a lower value as the degree of distortion of hostile data is lower than that of original data .

Specifically, the transformer can update the hostile data by determining a modifier w that minimizes the output value of the total loss function according to Equation (5).

In Equation 5, Loss _T denotes a total loss function, Loss _friend denotes a first loss function, Loss _enemy denotes a second loss function, and Loss _distortion denotes a third loss function.

First, to describe the first loss function, it is necessary to minimize the output value of the first loss function in order to satisfy f _friend (x *) = y term in Equation 2 or 3. [ The first loss function can be expressed by the following equation (6).

In Equation (6), org represents the original class, and Z (k) _i represents the probability that the first classifier (D _friend ) identifies the class of input data k as i. Therefore, when the first loss function according to Equation (6), i.e., the output value of the loss _friend is minimized, the probability that f _friend (x *) = y is satisfied is increased.

The second loss function can be divided into two cases: Targeted Scheme and Untargeted Scheme.

In the case of Targeted Scheme, it is necessary to minimize the output value of the second loss function in order to satisfy f _enemy (x *) = y * term in Equation (2). In the case of the targeted scheme, the second loss function can be expressed by Equation (7).

In Equation (7), t represents a specific class (i.e., y *), Z (k) _i represents the probability that the second classifier (D _enemy ) identifies the class of input data k as i. Therefore, when the second loss function according to Equation (7), i.e., the output value of the loss _enemy is minimized, the probability that f _enemy (x *) = y * is satisfied is increased.

In the case of the untargeted scheme, it is necessary to minimize the output value of the second loss function in order to satisfy f _enemy (x *) ≠ y term in Equation (3). In the case of the targeted scheme, the second loss function can be expressed by the following equation (8).

In Equation (8), org denotes the original class, and Z (k) _i denotes the probability that the second classifier (D _enemy ) identifies the class of the input data k as i. Therefore, when the second loss function according to Equation (8), i.e., the output value of the loss _enemy is minimized, the probability that f _enemy (x *)? Y is satisfied is increased.

The third loss function is designed to output a lower value as the distortion degree of the hostile data is lower than the original data, and can be expressed by the following equation (9).

In summary, when the output value of the total loss function of Equation (5) according to Equations (6) to (9) is minimized, the first classifier (D _friend ) normally identifies the class of the original data based on the hostile data, It is possible to generate hostile data in which the degree of distortion from the original data is minimized within a range in which the _{enemy enemy} misidentifies the class of the original data based on the hostile data so that the transformer calculates the total loss It is possible to determine the modifier w that minimizes the output value of the function and update the hostile data.

The transformer of the present embodiment can repeatedly perform the above-described process, that is, it can repeatedly perform the process of updating the hostile data to optimize the hostile data. That is, the converter (Transformer) are respectively input to the first and second classifier first and second classifiers (D _friend, D _enemy) The updates the hostile data on the basis of each of the identification result obtained from (D _friend, D _enemy) And the first and second classifiers (D _friend and D _enemy ) acquire each identification result that identifies the original class based on the updated hostile data, and repeatedly perform the process of updating the hostile data, It can be optimized. FIG. 2 and FIG. 3 show the algorithms performed by the transformer by dividing them into a targeted scheme and an untargeted scheme. 2 and 3, x denotes an original sample, y denotes an original class, y * denotes a targeted class, and n denotes a number of intervening updates of hostile data.

Figs. 4 to 9 show the results of applying the configuration of the present embodiment described above using MNIST, which has classes of " 0 " to " 9 " and handwritten digit images of 0 to 9, Respectively. The first _friend classifier accuracy (D _friend accuracy) indicates the concordance rate between the class and the original class that the first classifier (D _friend ) outputs based on the hostile data, and the attack success rate is the target class (D _enemy ) based on the hostile data and the original class (Targeted Class) in the case of the untargeted scheme, and the second classifier (D _enemy ) And the distortion is defined as meaning the pixel distance between the original data and the hostile data calculated by a method such as a mean square error (MSE).

FIGS. 4 to 7 show results of applying the Targeted Scheme.

FIG. 4 shows an example of hostile data optimized by applying Targeted Scheme by setting a specific class (Targeted Class) to "0" to "9" for original data 0 to 9, And the enemy data for the data 7 together with the average of the degree of _distortion thereof (loss _distortion ).

6 shows a result obtained by applying Targeted Scheme to original data 7 having an original class of " 7 " with a specific class (Targeted Class) set to " 0 ". The second classifier (D _enemy ) (The target class score 694) is slightly larger than the score 693 of the original class (i.e., the score of the target class) by repeating the update procedure of the hostile data can lead to misidentification of the source class of the second classifier (D _enemy) while minimizing the distortion degree from the original data) until it has a first sorter (D _friend) is hostile Based on the data, the original class is normally identified with a class "7" having a maximum score of 10.5.

FIG. 7 is a graph showing the change of the first classifier accuracy, the attack success rate and the distortion amount according to the repetition times of the hostile data. As the number of repetitions increases, the accuracy of the first classifier and the attack success rate are increased and the amount of distortion is decreased .

Figures 8 and 9 show the results of applying the Untargeted Scheme.

FIG. 8 shows the number of times that 100 enemy data are input to the second classifier (D _enemy ) for each of original data 0 to 9 having original classes "0" to "9" In the case of the original data 0 having the original class "0", there are 35 cases of misidentification as class "9" as a result of inputting 100 hostile data into the second classifier (D _enemy ) If it is identified, it can be confirmed that 0 is displayed.

FIG. 9 is a graph showing the change of the first classifier accuracy, the attack success rate and the distortion amount according to the repetition times of the hostile data. As the number of repetition increases, the accuracy of the first classifier and the attack success rate are increased, .

Table 1 shows Interation count, Max distortion, Min distortion and Mean distortion of the hostile data updating procedure in each of the Targeted Scheme and Untargeted Scheme.

Description
Targeted Scheme Untargeted Scheme Attack success rate
(Attack Success Rate) 1st _friend accuracy (D _friend accuracy) Attack success rate
(Attack Success Rate) 1st _friend accuracy (D _friend accuracy) Number of repetitions
(Iteration count)
500
500
300
400 Maximum distortion amount
(Max distortion)
6.645
6.645
4.016
3.440 Minimum distortion amount
(Min distortion)
0.232
0.232
0.249
0.234 Average distortion amount
(Mean distortion)
2.183
2.183
1.788
1.536

7 and 9, the untargeted scheme is different from the target scheme in that it is identified as a target class (Targeted Scheme) It can be seen that the accuracy of the first classifier and the attack success rate reach 100% more quickly due to the absence of the restriction, and that the distortion is also lower in the untargeted scheme than in the targeted scheme. Thus, the user can optimize the hostile data according to the Untargeted Scheme of the present embodiment when the second classifier (D _enemy ) is not required to identify a class and minimization of distortion from the original data is required.

On the other hand, when the second classifier (D _enemy ) intends to misidentify the original class with a specific class desired by the user, the hostile data can be optimized according to the Targeted Scheme of the present embodiment.

In the above description, the hostile example generator (AEG) in the deep learning environment according to the present embodiment has been described as being divided into the transformer and the first and second classifiers (D _friend and D _enemy ) May be implemented in an integrated configuration that optimizes hostile data based on first and second classification models (i.e., composite neural networks) that are used to identify classes of input data.

In other words, the hostile example generating apparatus AEG in the deep learning environment of the present embodiment is divided into the first and second classification models that are learned according to Deep Learning to identify the class of the input data through the Neural Network The first and second classification models are respectively input with converted antagonistic data (hostile example) from the original data, and after obtaining each identification result which identifies each class of the original data based on the hostile data inputted, Based on the obtained identification results, the first classification model normally identifies the class of the original data based on the inputted hostile data, and the second classification model identifies the class of the original data based on the inputted hostile data. Or may be implemented in a configuration that optimizes the data.

FIG. 10 is a flowchart for explaining a hostile example generation method in a deep learning environment according to an embodiment of the present invention. FIG. 11 is a flowchart illustrating a hostile example generation method in a deep learning environment according to an embodiment of the present invention. Is optimized.

Referring to FIG. 10, a method of generating a hostile example in a deep learning environment according to an embodiment of the present invention will be described. First, a transformer performs Deep Learning (Deep Learning) to identify a class of input data through a Neural Network The _enemy data (adversarial example) transformed from the original data is input to the first and second classifiers (D _friend and D _enemy ) learned in accordance with the learning (step S100). In step S100, the transformer first receives the original data and the original class, transforms it through Equation (4), generates hostile data, and inputs the data to the first and second classifiers (D _friend and D _enemy ) .

Then, the transformer obtains each identification result in which the first and second classifiers (D _friend , D _enemy ) respectively identify the class of the original data based on the inputted hostile data (S200).

Then, the converter (Transformer) is based on the respective identification result obtained in step S200, the first classifier (D _friend) identifies the normal classes of the original data based on the antagonistic data input, and the second classifier (D _enemy) is The hostile data is updated so as to misidentify the class of the original data based on the hostile data to be input (S300).

In step S300, the transformer can update the hostile data with further consideration of the degree of distortion from the original data, and the first classifier (D- _friend ) can identify the class of the original data based on the entered hostile data , The probability that the second classifier (D _enemy ) misidentifies the class of the original data based on the inputted hostile data increases, and the hostile data can be updated such that the degree of distortion from the original data decreases Specifically, the hostile data can be updated using a method of minimizing the output value of the total loss function by summing the first to third loss functions. The description thereof has been given above, so a detailed description thereof will be omitted.

11, in step S300, the transformer inputs the hostile data updated in step S300 to the first and second classifiers (D _friend and D _enemy ), respectively, as shown in FIG. 11 So that the transformer can perform the steps S200, S300, and S400 repeatedly to optimize the hostile data.

In step S300, the transformer may update the hostile data so that the second classifier (D _enemy ) identifies any one specific class (Targeted Class) other than the class of the original data based on the inputted hostile data Scheme, and the second classifier (D _enemy ) may update the hostile data to identify one or more untargeted classes other than the class of original data based on the incoming hostile data.

This embodiment, on the other hand, combines with the hardware to generate hostile data (hostile data) converted from original data into first and second classification models, respectively, which are machine learned to identify classes of input data through a neural network The first classification model, the second classification model, and the adversarial example), obtaining each identification result that identifies the class of the original data based on the hostile data inputted by the first and second classification models, The first classification model normally identifies the class of the original data based on the input hostile data and the second classification model updates the hostile data to misidentify the class of the original data based on the input hostile data Or may be stored in a computer-readable recording medium, It may be implemented in a general purpose digital computer for operating the computer program. Examples of the computer readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk and an optical data storage device, and a carrier wave (for example, transmission via the Internet) . The computer readable recording medium may also be distributed over a networked computer system so that computer readable code in a distributed manner may be stored and executed.

As described above, the present embodiment applies a method of generating a hostile example in which the original data is normally identified for the ally in-depth neural network and the original data is misidentified for the enemy in-depth neural network, It can contribute to development.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of limitation, I will understand. Accordingly, the true scope of the present invention should be determined by the following claims.

AEG: Hostile Example Generator
Transformer: Converter
D _friend : 1st classifier
D _enemy : 2nd classifier
Targeted Class: Specific class
Untargeted Class: Unspecified Class

Claims (17)

A first classifier and a second classifier learned according to Deep Learning to identify a class of input data through a Neural Network; And
The first and second classifiers are respectively inputted into the first classifier and the second classifier, and the classifier classifies the class of the original data based on the hostile data inputted by the first classifier and the second classifier, The first classifier normally identifies the class of the original data on the basis of the inputted hostile data, and the second classifier identifies the hostile data to be inputted on the basis of the acquired identification results, A translator for optimizing hostile data to misidentify the class of original data based on the host data;
Wherein the host computer generates a hostile example in the deep learning environment.
The method according to claim 1,
Wherein the converter optimizes the hostile data in consideration of the degree of distortion from the original data.
3. The method of claim 2,
Wherein the original data and the hostile data are image data, respectively, and the distortion degree indicates a pixel distance between the original data and the hostile data.
3. The method of claim 2,
The transcoder further includes a second classifier for classifying the class of the original data based on the hostile data inputted by the second classifier, wherein the probability that the first classifier normally identifies the class of the original data based on the inputted hostile data increases, And the hostile data is optimized so as to reduce the degree of distortion from the original data.
5. The method of claim 4,
Wherein the converter optimizes the hostile data using a method of minimizing the output of the total loss function summing the first through third loss functions, wherein the first loss function is based on the hostile data input by the first classifier The second loss function outputs a higher probability that the second classifier misidentifies the class of the original data based on the hostile data inputted by the second classifier, And the third loss function outputs a lower value as the degree of distortion of hostile data with respect to the original data is lower.
The method according to claim 1,
Updating the antagonistic data based on the obtained identification results and inputting the updated anti-host data to the first and second classifiers, respectively; Classifying the antagonistic data by obtaining each identification result for each class and updating the hostile data is repeatedly performed to optimize the hostile data.
The method according to claim 1,
Wherein the converter optimizes the hostile data so that the second classifier identifies any one class other than the class of the original data based on the hostile data inputted.
The method according to claim 1,
Wherein the translator optimizes the hostile data so as to identify one or more unspecified classes other than the class of the original data based on hostile data inputted by the second classifier.
The transformer transforms the adversarial data (adversarial example) from the original data into first and second classifiers that are learned according to Deep Learning to identify the class of input data through the Neural Network Respectively;
The transducer obtaining each identification result that identifies the class of the original data based on the hostile data inputted by the first and second classifiers; And
The first classifier normally identifies the class of the original data on the basis of the inputted hostile data based on each of the obtained identification results, and the second classifier classifies the original data Updating the hostile data to misidentify the class of the host;
The method comprising the steps of: generating a hostile example in a deep learning environment;
10. The method of claim 9,
In the step of updating the hostile data,
And the hostile data is updated in consideration of the degree of distortion from the original data.
11. The method of claim 10,
In the step of updating the hostile data,
The probability that the first classifier normally identifies the class of the original data increases based on the inputted hostile data and the probability that the second classifier misidentifies the class of the original data based on the inputted hostile data increases And the hostile data is updated so as to reduce the degree of distortion from the original data.
12. The method of claim 11,
In the step of updating the hostile data,
Updating the hostile data by using a method of minimizing an output value of a total loss function obtained by summing the first to third loss functions, wherein the first loss function is a function of the first classifier, The first loss function outputs a lower value as the probability of normally identifying the class is higher and the second loss function has a lower value as the probability that the second classifier misidentifies the class of the original data based on the inputted hostile data is higher, Wherein the third loss function outputs a lower value as the degree of distortion of the hostile data with respect to the original data is lower.
10. The method of claim 9,
Further comprising the step of the converter translating the updated hostile data into the first and second classifiers, respectively, after the step of updating the hostile data,
Wherein said converter optimizes hostile data by repeatedly performing the steps of acquiring the respective identification results, updating the hostile data, and inputting the updated hostile data. How to create a hostile example.
10. The method of claim 9,
In the step of updating the hostile data,
Wherein the second classifier updates the hostile data so as to identify any one class other than the class of the original data based on the hostile data to which the second classifier is input.
10. The method of claim 9,
In the step of updating the hostile data,
Wherein the second classifier updates the hostile data so as to identify one or more unspecified classes other than the class of the original data based on the hostile data to which the second classifier is input.
The adversarial data (adversarial example) transformed from the original data is input to the first and second classification models learned in accordance with Deep Learning to identify the class of the input data through the neural network Wherein the first classification model is obtained by obtaining each identification result that identifies the class of the original data on the basis of the hostile data inputted by the first and second classification models, Wherein the second classification model normally identifies the class of the original data based on the hostile data to be input and optimizes the hostile data to misidentify the class of the original data based on the hostile data inputted, A hostile example generator in the environment.
Combined with hardware,
Inputting converted hostile data (adversarial example) from the original data into first and second classification models, respectively, which are machine learning to identify classes of input data through a neural network (Neural Network) ;
Obtaining each identification result that identifies the class of the original data based on the hostile data inputted by the first and second classification models; And
The first classification model normally identifies the class of the original data on the basis of the input hostile data and the second classification model identifies the class of the original data based on the input hostile data, Updating the hostile data to misidentify the hostile data;
A computer program stored on a medium for executing the program.

Images