WO2022244256A1

WO2022244256A1 - Adversarial attack generation device and risk evaluation device

Info

Publication number: WO2022244256A1
Application number: PCT/JP2021/019409
Authority: WO
Inventors: インダージートシング
Original assignee: 日本電気株式会社
Priority date: 2021-05-21
Filing date: 2021-05-21
Publication date: 2022-11-24
Also published as: JPWO2022244256A1

Abstract

The purpose of the present invention is to provide an adversarial attack generation device capable of generating an adversarial example robust to a non-linear change in brightness. An adversarial attack generation device 71 comprises a non-linear brightness conversion means 73. The non-linear brightness conversion means 73 non-linearly updates brightness of a training image during execution of an attack generation process that generates an adversarial example.

Description

Hostile attack generator and risk evaluator

The present invention relates to a hostile attack generation device, a hostile attack generation method, and a hostile attack generation program that generate hostile cases, and a risk evaluation device and risk evaluation method that perform risk evaluation regarding attacks based on hostile cases.

Recent advances in Adversarial Machine Learning (AML) have shown that state-of-the-art deep learning models are vulnerable to well-designed input examples, called Adversarial Examples. rice field.

　The vulnerability to adversarial cases is a serious risk when applying deep neural networks to environments where safety is important, such as Face Verification Systems. Face authentication is the process of verifying a claimed identity based on images of faces. Face recognition systems, by current definition, include one-to-one and many-to-one facial image matching. In general machine learning-based risk assessment, a common approach has been to focus on attacks with strong adversarial examples. An adversary with complete information can launch powerful adversarial attacks against the system. Complete information includes the architecture of the machine learning model, all model parameters, the loss function used for training, the distribution of the training data, and the entire preprocessing pipeline of the target system. This type of attack is called a white-box attack.

Adversaries can conveniently attack practical deep learning-based applications, such as facial recognition systems, from the physical world in scenarios such as person re-recognition and automatic ID (IDentification) matching systems. Adversaries use physical adversarial instances to attack systems in the physical world. Adversarial examples generated in the digital world are transferred to the physical world, such as by printing or painting, and used to attack targeted systems such as facial recognition systems and surveillance systems. Adversarial cases after being captured by a camera are called physical adversarial cases. Adversarial instances in the form of eyeglass frames, hats, stickers, etc., or adversarial instances representing cross-sections of predefined physical objects are some examples of printed physical adversarial attacks. “Physical transferability,” the ability of a well-crafted digital adversarial instance to succeed in the physical realm, is the most important parameter for achieving physical adversarial attacks. General research mainly concentrates on attacking deep learning-based systems from the digital world. Attacks in the physical world are less powerful, but require fewer privileges on the victim system, and most practical facial recognition systems are affected by them.

The original image has various digital and physical environment parameters that cause perturbations. Perturbations can be present in color correction, contrast changes, hue changes, brightness changes. These perturbations in the input image change the performance of the machine learning model. Also, since adversarial cases are regular images with a small number of adversarial features that are highly correlated with predictions of targeted machine learning models, these perturbations significantly reduce the strength of adversarial attacks. A slight perturbation of these adversarial features can cause complete failure of the adversarial case. Brightness variation is one of the most important parameters among these, resulting in large variations in adversarial case performance.

A practical risk assessment process for face recognition systems scans for possible vulnerabilities in machine learning models used in face recognition systems in various types of adversarial cases. Adversarial image brightness variations due to digital and physical parameters can frustrate adversarial cases and are not suitable for practical risk assessment of targeted systems. Therefore, for practical risk assessment of face recognition systems in various lighting conditions, it is necessary to use strong adversarial cases that are robust to changes in brightness.

An adversarial case that succeeds even in environments where the brightness changes is called a Brightness Agnostic Adversarial Example. The overall brightness of the hostile image can vary linearly. However, in the real world, brightness changes are non-linear. Changes in image brightness in the digital world are primarily due to the use of image correction techniques in the pre-processing pipeline of the targeted system. Practical face recognition and verification systems use image enhancement techniques to improve performance. Most of the well-known image correction techniques perform non-linear brightness adjustments in digital images. Non-linear brightness adjustment causes different brightness changes in different areas of the image.

Changes in the brightness of physical hostile cases are caused not only by physical factors, but also by digital factors. The digital factor is the use of image correction techniques. Physical factors include the lighting conditions of the environment, the capabilities of the printers used to print the adversarial examples, the types of printing papers and surfaces used, and the paintings used to transfer the adversarial examples to the physical world. quality of the paint, etc. The angle of the light source with respect to the face results in different levels of light illuminating areas within the face. Depending on the capabilities of the printer, the brightness of the hostile patch and its surroundings may vary non-linearly due to the inability to accurately reproduce the digital image. Particular care must be taken when only patches need to be printed for adversarial attacks, for example when an adversary wears adversarial glasses to fool a face recognition system. High-performance cameras can shoot well even in extreme lighting conditions, resulting in better representation of dark and bright areas and less perturbation in the image. Print quality is also affected by the characteristics of printing paper. Surface reflectivity can also affect how bright a patch appears.

Non-Patent Document 1 proposes a method of generating adversarial examples based on random transformation of image brightness. The goal of the technique described in Non-Patent Document 1 is to eliminate overfitting from the generated attack by a well-known gradient-based approach. The technique described in Non-Patent Document 1 randomly changes the brightness of the image within a predefined range in each learning iteration. Note that in the context of adversarial machine learning, learning means the attack generation process. By randomly transforming the brightness at each learning step, the optimization prospects are smoothed. Elimination of overfitting improved the empirical transferability to ImageNet data by 23.5%. The technique described in Non-Patent Document 1 uses an ImageNet classifier for empirical evaluation.

In addition, Non-Patent Document 2 describes Projected Gradient Descent (PGD).

However, the method described in Non-Patent Document 1 only considers linear brightness changes in adversarial cases. However, in the real world, brightness changes non-linearly. The technique described in Non-Patent Document 1 cannot be applied to non-linear (including piece-wise linear) brightness changes of an image during the attack generation process. Therefore, the adversarial cases generated by the technique described in Non-Patent Document 1 are not robust to non-linear brightness changes.

It is also preferable to be able to enable attack optimization during the attack generation process.

Therefore, an object of the present invention is to enable the generation of robust adversarial cases against nonlinear changes in brightness.

It also aims to enable attack optimization during the attack generation process.

A hostile attack generation device according to the present invention is a hostile attack generation device for generating hostile cases, wherein the brightness of learning images is nonlinearly updated during the attack generation process for generating hostile cases. It is characterized by comprising conversion means.

The adversarial attack generator according to the present invention is an adversarial attack generator for generating adversarial cases, wherein during the attack generation process for generating adversarial cases, the difficulty level of learning is controlled based on curriculum learning. It is characterized by comprising a degree control means.

A risk evaluation apparatus according to the present invention is a risk evaluation apparatus that performs risk evaluation against attacks by hostile cases, and is a nonlinear brightness that nonlinearly updates the brightness of learning images during an attack generation process that generates hostile cases. It comprises conversion means and difficulty control means for controlling the difficulty of learning on a curriculum learning basis during the attack generation process.

The adversarial attack generation method according to the present invention is characterized by nonlinearly updating the brightness of learning images during the attack generation process that generates adversarial cases.

The adversarial attack generation method according to the present invention is characterized by controlling the difficulty of learning on a curriculum learning basis during the attack generation process of generating adversarial cases.

A computer-readable recording medium according to the present invention provides an adversarial attack generation for causing a computer to perform a nonlinear brightness conversion process that nonlinearly updates the brightness of a learning image during an attack generation process that generates adversarial examples. A computer-readable recording medium recording a program.

A computer-readable recording medium according to the present invention provides an adversarial attack for causing a computer to perform a difficulty control process for controlling the difficulty of learning on a curriculum learning basis during an attack generation process for generating adversarial examples. A computer-readable recording medium recording a generating program.

According to the present invention, it is possible to generate adversarial cases that are robust to nonlinear changes in brightness.

Also, according to the present invention, attack optimization can be enabled during the attack generation process.

It is a block diagram showing an example of a risk assessment device of an embodiment of the present invention. It is a schematic diagram which shows the algorithm which a risk-evaluation apparatus employ|adopts. It is a flowchart which shows the example of process progress of a risk-evaluation apparatus. It is a flowchart which shows the example of the more concrete process progress of a risk-evaluation apparatus. It is a flowchart which shows the example of the more concrete process progress of a risk-evaluation apparatus. 1 is a schematic block diagram showing a configuration example of a computer relating to a hostile attack generation device and a risk evaluation device according to an embodiment of the present invention; FIG. 1 is a block diagram showing an example of an outline of a hostile attack generation device of the present invention; FIG. FIG. 4 is a block diagram showing another example of the outline of the hostile attack generation device of the present invention;

The apparatus of the present invention operates with an attack generation algorithm that allows non-linear, including piecewise linear, variations in brightness during the attack generation process. During the attack generation process, the algorithm of the apparatus of the present invention changes the brightness of specific regions by a different amount than the change in brightness of the entire image. This nonlinear brightness change during learning makes the generated adversarial cases robust to nonlinear brightness changes.

However, nonlinear brightness changes make optimization difficult during the learning process. To solve this optimization difficulty, the above algorithms provide automatic updating of curriculum-learning-based parameters.

In the context of machine learning, curriculum learning means classifying learning cases according to the difficulty of learning, giving easy learning cases in the early phase of learning, and facilitating sufficient fine-tuning of the machine learning model with easy learning cases. It is an approach to make the learning of the machine learning model appropriate by giving learning examples of gradually increasing difficulty later. Curriculum-learning-based parameter updating in the present invention classifies training images with the same brightness as before the start of the training and attack generation process as low difficulty. Training images whose brightness changes linearly are classified as medium difficulty. Learning images whose brightness changes non-linearly are classified as high difficulty.

The above algorithm starts the learning process for attack generation without changing the brightness of the learning image. As the loss decreases, the algorithm automatically begins gradually increasing the difficulty of the training images. If the difficulty increases too much, the attack generation process automatically lowers the difficulty of the training images.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing an example of a risk assessment device according to an embodiment of the present invention. FIG. 2 is a schematic diagram showing an algorithm adopted by the risk assessment device. FIG. 3 is a flow chart showing an example of the process progress of the risk assessment device of this embodiment. 4 and 5 are flow charts showing an example of a more specific process progress of the risk assessment device of this embodiment.

The risk evaluation device 1 includes a hostile attack generation device 2 that generates hostile cases, and an evaluation unit 6. The hostile attack generation device 2 also includes a nonlinear brightness conversion unit 3 , a difficulty control unit 4 , and a determination unit 5 .

The nonlinear brightness transformation unit 3 nonlinearly updates the brightness of the learning image during the attack generation process that generates hostile cases.

The difficulty control unit 4 controls the difficulty of learning on a curriculum learning basis during the attack generation process that generates hostile examples.

The determination unit 5 determines the end of the learning process.

The evaluation unit 6 evaluates the risk of the target face authentication system against the attack by the hostile instance generated by the hostile attack generation device 2.

The adversarial attack generator 2 of the present invention includes a curriculum-learning-based algorithm for generating brightness-independent adversarial cases. The generated brightness-independent adversarial examples are used to attack targeted facial recognition systems from the digital and physical worlds and assess their vulnerabilities. FIG. 2 shows an example of a brightness-independent adversarial instance generation method. The generation method can generate adversarial cases that are robust to real-world nonlinear brightness variations.

With this algorithm, a nonlinear brightness transformer 3 is applied to the training images in the attack generation process. This is shown in process 206 of FIG. The definition of the mask M _p shown in operation 206 of FIG. 2 can be updated for each training iteration, allowing the brightness to vary in any number of regions within the training image. As can be seen from equation (1), at each training iteration, the updated mask defines an arbitrary number of pixels in the training image and changes the brightness of that pixel to be different from the rest of the pixels. can be done. The combination of these masks results in non-linear brightness variations.

The mask M _p ⁱ can be defined at each learning iteration as follows.

“(selected pixels) ⁱ ” represent the coordinates of pixels selected to change brightness by a different amount than the rest of the pixels in each learning iteration. Equation (1), which expresses the nonlinear change in brightness, can also be expressed by Equations (2) and (3) shown below. The purpose of the mask M _p is to select the desired pixel values for brightness variations.

An ensemble of brightness transformations can be taken by setting N _b >1 to smooth the gradient update ensuring the gradient descent direction to the global minimum. However, the non-linear brightness update at each learning iteration greatly increases the optimization difficulty. To solve the optimization difficulty, the difficulty control unit 4 performs curriculum-learning-based parameter update in the non-linear brightness transform function during the learning process. This is illustrated in

operations

206, 208, 209, 211 and 212 of FIG. A random brightness transfer function RT depends on a uniform random variable and a random parameter p.

The difficulty control unit 4 controls the difficulty of optimizing the learning images by controlling the range of uniform random variables and changing the value of the parameter p based on the curriculum learning. A uniform random variable controls the degree of brightness variation applied to subregions in the training image during the training process. A uniform random variable range is gradually increased using a predefined function (g) to increase the difficulty of the task. The parameter p determines the non-linear brightness transform on the training images. The higher the frequency of brightness conversion, the higher the learning difficulty. The parameter p is updated based on learning loss after a certain period of time. This is illustrated by

operations

210, 211 and 212 in FIG. When the learning loss is large, the difficulty level control unit 4 decreases the value of the parameter p to lower the learning difficulty level. This is shown in process 211 of FIG.

The method proposed in Non-Patent Document 1 cannot apply nonlinear brightness transformation in the real world. Embodiments of the present invention perform a non-linear brightness transformation and use the concept of curriculum learning to solve the optimization difficulty, resulting in brightness-independent, robust to linear and non-linear brightness changes. Adversarial cases can be generated.

The risk assessment device 1 generates hostile cases that do not depend on brightness, and can effectively assess the risks of a practical face recognition system based on the hostile cases. Brightness-independent adversarial cases are robust to linear and non-linear brightness changes due to various digital and physical factors.

The risk assessment device 1 of the embodiment of the present invention assesses the risk of a target face recognition system due to digital and physical, brightness-independent adversarial instances. Targeted face recognition systems can use feature extractor-based machine learning models and machine learning classifiers. Feature extractor-based face recognition systems use similarity-based or distance-based functions for verification and classification of input images.

The adversary selects a facial image called a source image and generates an attack (step S301 in FIG. 3). Adversarial noise is added to this facial image in the form of patches of arbitrary shape (step S402 in FIG. 4). The type of patch noise initialization depends on the type of gradient-based optimization method used. A PGD (Projected Gradient Descent) attack takes the same range of pixel values as the face image and initializes patch noise using a Gaussian distribution. Add this initialized noise to the source image. Then, the hyperparameters of the algorithm shown in FIG. 2 are initialized as in process 203 of FIG.

A learning loop is then started, and at each learning iteration a non-linear brightness transform is applied to the training images (step S303 in FIG. 3). This is shown in process 206 of FIG.

If the parameter N _b is greater than 1, nonlinear brightness transformation is performed on the training image N _b times (processing 205 and processing 206 shown in FIG. 2), and the difficulty control unit 4 reduces the patch noise in each learning iteration. For the update of , we use the sum of the gradients of all the transformed images (process 207 shown in FIG. 2, step S304 in FIG. 3).

The parameter loss _t+1 ^cum automatically updates the parameter p, which causes a brightness change in only some regions of the training image, resulting in non-uniform brightness changes in the training data. The larger the value of the parameter p, the higher the learning difficulty of the image. When the learning loss decreases, after a certain number of iterations, the averaged parameter loss _t+1 ^cum increases the value of the parameter p, which increases the difficulty of learning (

processes

208, 210, and 210 shown in FIG. See process 211 and process 212).

The step function g also controls the difficulty of learning by controlling the range of the uniform random variable X _u (process 209 shown in FIG. 2). The step function g increases the learning difficulty during the learning process by gradually increasing the range of X _u .

The learning process continues up to a predetermined number of learning steps T (process 204 shown in FIG. 2, step S305 in FIG. 3), or other stopping criteria are used to stop the learning process. A determination unit 5 determines the timing for ending the learning process. By the end of the learning process, the adversarial cases have been sufficiently learned to achieve the adversary's goals.

All input parameters required for the algorithm are shown in input 201 in FIG. In the example shown in FIG. 2, Gaussian random variables _Yi are responsible for linear brightness variations. The parameter p, the uniform random variable X _u , the step function g, and the margin hyperparameter K are responsible for the non-linear brightness variation of the image during the attack generation process. In this algorithm, all parameters that enable step-by-step control of the difficulty of training images are based on curriculum learning, and automating them during learning realizes curriculum-learning-based automatic processing. .

For the risk assessment of the target face recognition system for digital attacks, the generated adversarial examples are fed from the digital world by passing through the target face recognition system's preprocessing pipeline, and the evaluator 6 , to check whether adversarial cases cheat or degrade performance (step S307 in FIG. 3).

For risk assessment against attacks from the physical world, the generated attacks are forwarded to the physical world (step S308 in FIG. 3) and presented to the camera of the targeted facial recognition system (step S413 in FIG. 5). . The captured physical adversarial instances are passed through the pre-processing pipeline of the target face recognition system, and then finally predicted by the machine learning model of that face recognition system. At this time, the evaluation unit 6 checks the performance of the face authentication system.

The vulnerability of the facial recognition system, which is targeted by digital and physical attacks, is evaluated by the evaluation unit 6 based on its performance against hostile cases that do not depend on brightness. A robust face recognition system does not mispredict or degrade performance due to brightness-independent adversarial cases.

The nonlinear brightness conversion unit 3, the difficulty level control unit 4, the determination unit 5, and the evaluation unit 6 are realized, for example, by a CPU (Central Processing Unit) of a computer that operates according to a risk evaluation program. For example, the CPU reads a risk evaluation program from a program recording medium such as a computer program storage device, and operates as a nonlinear brightness conversion unit 3, a difficulty control unit 4, a determination unit 5, and an evaluation unit 6 according to the program. do it. A portion of the risk evaluation program that causes the CPU to operate as the nonlinear brightness conversion unit 3, the difficulty control unit 4, and the determination unit 5 corresponds to the hostile attack generation program.

[Example]
A risk assessment apparatus 1 shown in FIG. Used.

Two baselines were performed to demonstrate the effectiveness of the device of the present invention.

The first baseline is a simple method in which a simple PGD patch attack is generated. The second baseline is the method proposed in Non-Patent Document 1. The method described in [1] was implemented in the setting of PGD adversarial patch generation for face recognition systems.

In this experiment, we assumed a face recognition system equipped with a ResNet50 feature extractor pre-trained with face data as a face matcher. The attack was generated in a white-box setting assuming the adversary had full access to the targeted facial recognition system. The adversary has access to the model architecture, learned parameters, training data distribution, and loss function of the targeted facial recognition system's machine learning model.

The purpose of the adversary in this experiment was to impersonate the target identity in the face data of the given source image. A loss function used to generate a spoofing attack is represented by Equation (4) below.

The function SIM computes the similarity of features predicted by the face matcher _f between the training adversarial image ^{Xt adv} and the target image ^Xt . In this experiment, a cosine similarity function was used as the function SIM.

The function CLT is a linear function in the simple method, a random linear brightness transformation function in the method described in Non-Patent Document 1, and a curriculum-learning-based transformation function in the method of the present invention. .

In the experiment, we first selected 5 pairs of source and target images from the face dataset. Also, for a fair evaluation, the same images were prepared not only for the method of the present invention, but also for all baselines. A ResNet50 feature extractor trained on face datasets was used as a face matcher in a targeted face recognition system. Then, all methods generated PGD attacks against this feature extractor, assuming white-box knowledge.

The patch noise ε was initialized with a mean of 0.5 and a variance of 0.1. To classify the input samples and check whether the generated adversarial examples impersonate their respective target identities, we kept the cosine similarity threshold τ at 0.5. The mask M _p is of the same dimensions as the input image, taking values of 1 at the positions of the spectacle frames and 0 in the rest of the image. In this experiment, the maximum number of iterations T was set to 10000 in all methods. The step function g of the method of the invention is defined as follows.

The batch constant N was set to 50. The loss at each training iteration was normalized to the range [0,1]. However, the loss can take any range of values depending on how the loss function is defined. The similarity constant K and constant h were set to one. The value of K is chosen such that the value of p does not exceed one. In this experiment, the number of brightness ensembles _Nb in the algorithm of the present invention was set to five. For all methods, the learning rate for PGD updates was set to 0.01.

After initializing the parameters of each method in this experiment, we generated spoofed adversarial examples for the five selected pairs (pairs of source and target images). All adversarial cases generated were evaluated in the digital and physical domains to examine the adversarial success rate.

For the digital evaluation of the generated adversarial cases against changes in brightness, we generated 99 transformed images with nonlinear brightness for each adversarial case. For digital evaluation, the equations used for random non-linear brightness transformation are given below.

X _G is a Gaussian random variable with X _G ˜N(0.8,0.2). X _U is a uniform random variable with X _U ˜U(0.7,1). All images generated for all adversarial cases are fed to the targeted face matcher to check the attack success rate.

For the evaluation in the physical world where the brightness varies non-linearly, considering physical constraints, we chose three adversarial cases for evaluation. For the adversarial case, nine transformed images with non-linear brightness variations were printed, including the original image. The nine combinations were generated by selecting values for _XG and _XU from the set {0.5, 1, 1.5}. All transformed images for adversarial cases are captured using a camera for transfer to the digital domain for evaluation. To capture the effect of attack surface reflectivity, the camera was moved in a horizontal arc of radius approximately 15 cm, and a short movie was captured at an angle of approximately 45° to the center of the captured image. About 20 images were extracted from each image taken. After that, based on face detection and registration, MTCNN (Multi-Task Cascaded Convolutional Neural Networks) was used to clean up and trim the captured data. The preprocessed images are fed to the target system's face matcher to assess the attack success rate of brightness-independent adversarial cases from the physical world. A threshold based on cosine similarity is then used to determine success or failure.

As a result of this experimental analysis, it was observed that the method of the present invention outperforms the two baselines described above for adversarial cases that do not depend on brightness. The method of the present invention resulted in 26.78% and 24.69% higher average spoofing success rates than the method described in Non-Patent Document 1 in the digital domain and the physical domain, respectively. The apparatus of embodiments of the present invention produces adversarial cases that are robust to real-world lighting changes.

FIG. 6 is a schematic block diagram showing a configuration example of a computer related to the hostile attack generation device 2 and the risk evaluation device 1 of the embodiment of the present invention. A computer 1000 includes a CPU 1001 , a main memory device 1002 , an auxiliary memory device 1003 and an interface 1004 .

The hostile attack generation device 2 and the risk evaluation device 1 of the embodiment of the present invention are realized by the computer 1000, for example. Operations of the hostile attack generation device 2 and the risk evaluation device 1 are stored in the auxiliary storage device 1003 in the form of programs. The CPU 1001 reads the program, develops the program in the main storage device 1002, and executes the processing described in the above embodiment according to the program.

The auxiliary storage device 1003 is an example of a non-temporary tangible medium. Other examples of non-transitory tangible media include magnetic disks, magneto-optical disks, CD-ROMs (Compact Disk Read Only Memory), DVD-ROMs (Digital Versatile Disk Read Only Memory), connected via interface 1004, A semiconductor memory and the like are included. Further, when a program is distributed to the computer 1000 via a communication line, the computer 1000 receiving the distribution may develop the program in the main storage device 1002 and execute the processing described in the above embodiments according to the program. .

Also, part or all of each component may be realized by a general-purpose or dedicated circuit, processor, etc., or a combination thereof. These may be composed of a single chip, or may be composed of multiple chips connected via a bus. A part or all of each component may be implemented by a combination of the above-described circuit or the like and a program.

When part or all of each component is realized by a plurality of information processing devices, circuits, etc., the plurality of information processing devices, circuits, etc. may be centrally arranged or distributed. For example, the information processing device, circuits, and the like may be implemented as a client-and-server system, a cloud computing system, or the like, each of which is connected via a communication network.

Next, the outline of the present invention will be explained. FIG. 7 is a block diagram showing an example of the outline of the hostile attack generation device of the present invention. The hostile attack generation device 71 comprises nonlinear brightness conversion means 73 . The non-linear brightness transforming means 73 (for example, the non-linear brightness transforming unit 3) non-linearly updates the brightness of the learning images during the attack generation process that generates the hostile cases.

With such a configuration, it is possible to generate adversarial cases that are robust to nonlinear changes in brightness.

Also, FIG. 8 is a block diagram showing another example of the outline of the hostile attack generation device of the present invention. The hostile attack generation device 71 includes difficulty level control means 74 . The difficulty control means 74 (eg, difficulty control unit 4) controls the difficulty of learning on a curriculum learning basis during the attack generation process of generating adversarial examples.

Such a configuration can enable attack optimization during the attack generation process.

Although the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

Possibility of industrial use

The present invention is suitably applied to a hostile attack generation device that generates hostile instances and a risk evaluation device that performs risk assessment regarding attacks by hostile instances.

REFERENCE SIGNS LIST 1 risk evaluation device 2 hostile attack generation device 3 nonlinear brightness converter 4 difficulty control unit 5 determination unit 6 evaluation unit

Claims

An adversarial attack generator for generating adversarial instances, comprising:
A hostile attack generating apparatus, comprising nonlinear brightness conversion means for nonlinearly updating brightness of a learning image during the attack generation process for generating the hostile example.
An adversarial attack generator for generating adversarial instances, comprising:
A hostile attack generation device, comprising difficulty level control means for controlling the difficulty level of learning on a curriculum learning basis during the attack generation process for generating the hostile case examples.
A hostile attack generation device according to claim 1 or claim 2,
A risk evaluation device comprising evaluation means for performing risk evaluation against an attack by a hostile instance generated by the hostile attack generation device.
A risk assessment device for performing risk assessment against attacks by hostile instances,
Non-linear brightness conversion means for non-linearly updating the brightness of training images during the attack generation process for generating the adversarial examples;
a difficulty level control means for controlling the difficulty level of learning on a curriculum learning basis during the attack generation process.
An adversarial attack generation method characterized by non-linearly updating the brightness of learning images during the attack generation process for generating adversarial examples.
An adversarial attack generation method characterized by controlling learning difficulty on a curriculum learning basis during an attack generation process for generating adversarial examples.
A method for generating an adversarial attack according to claim 5 or claim 6,
A risk evaluation method for performing a risk evaluation against an attack by the hostile instance generated by the hostile attack generation method.
to the computer,
A computer-readable recording medium recording a hostile attack generation program for executing nonlinear brightness conversion processing for nonlinearly updating the brightness of a learning image during an attack generation process for generating hostile examples.
to the computer,
A computer-readable recording medium recording an adversarial attack generation program for executing difficulty control processing for controlling the difficulty of learning on a curriculum learning basis during an attack generation process for generating adversarial examples.