WO2023062742A1

WO2023062742A1 - Training device, training method, and training program

Info

Publication number: WO2023062742A1
Application number: PCT/JP2021/037843
Authority: WO
Inventors: 真徳山田
Original assignee: 日本電信電話株式会社
Priority date: 2021-10-13
Filing date: 2021-10-13
Publication date: 2023-04-20
Also published as: JPWO2023062742A1

Abstract

According to the present invention, every time noise is added to the weight of a model during Adversarial Training, a training device (10) recalculates an Adversarial Example for the weight to which the noise was added. Then the training device (10) creates a loss landscape for a loss function for the model using the recalculated Adversarial Example and flattens (regularizes) the loss landscape using Adversarial Weight Perturbation (AWP). The training device (10) adjusts the strength of the regularization of the loss landscape using a hyperparameter β. Then the training device trains the model using the loss function for which the loss landscape was regularized.

Description

LEARNING DEVICE, LEARNING METHOD AND LEARNING PROGRAM

The present invention relates to a learning device, a learning method, and a learning program.

Conventionally, there is an attack called Adversarial Example that causes the classifier to misjudge by adding noise to the data to be classified. As a countermeasure against this Adversarial Example, for example, there is Adversarial Training, which trains a model (classifier) using Adversarial Examples.

However, the model trained by Adversarial Training has the problem of low generalization performance for Adversarial Examples. Here, it is known that the flatter the loss landscape (in the form of the loss function) for the weight of the model, the smaller the generalization gap. This generalization gap is the difference between train acc (learning data identification accuracy) and test acc (test data identification accuracy). In adversarial training, there is a technique to flatten the loss landscape for model weights to reduce the generalization gap and improve the generalization performance of adversarial examples.

However, there are some points that are not sufficient to create a loss landscape with the above technology (AWP), so even if the loss landscape is flattened, the generalization performance of the Adversarial Example may not improve. Therefore, an object of the present invention is to solve the above-described problem and to learn a model with high generalization performance for Adversarial Examples.

In order to solve the above-described problems, the present invention recalculates the Adversarial Example for the weight each time the weight of the model is shifted in learning a model for predicting the label of input data containing Adversarial Examples. a calculator, using the recalculated Adversarial Example to create a loss landscape of the loss function of the model, flattening the created loss landscape; a second calculator, flattening the loss landscape and a learning processing unit that performs learning of the model using the loss function obtained.

According to the present invention, it is possible to learn a model with high generalization performance for Adversarial Examples.

FIG. 1 is a diagram showing a configuration example of a learning device. FIG. 2 is a flow chart showing an example of the processing procedure of the learning device. FIG. 3 is a flow chart showing an example of a processing procedure of the learning device. FIG. 4 is a diagram showing an application example of the learning device. FIG. 5 is a diagram showing the correlation between the loss landscape used in AWP (Adversarial Weight Perturbation) and the loss landscape created by the learning device and their respective robust gaps. FIG. 6 is a diagram showing experimental results for the model learned by the learning device. FIG. 7 is a diagram showing experimental results for the model learned by the learning device. FIG. 8 is a diagram showing a configuration example of a computer that executes the learning program.

Embodiments (embodiments) of the present invention will be described below with reference to the drawings. In addition, the present invention is not limited to the embodiments described below.

[Overview of learning device]
As mentioned above, even if the loss landscape for the weight of the model is flattened by AWP (Adversarial Weight Perturbation) (even if normalization is performed), there are cases where the generalization performance of the Adversarial Example of the model does not improve.

Therefore, the learning device of this embodiment is designed so that the flatter the loss landscape in adversarial training, the smaller the generalization gap (= the size of the loss landscape sharpness correlates with the size of the generalization gap). n) Create a loss landscape. Then, the learning device performs normalization on the loss landscape.

For example, every time the weight of the model is shifted, the learning device recalculates the Adversarial Example for that weight and creates a loss landscape using the recalculated Adversarial Example. The learning device then normalizes the created loss landscape. The learning device learns the model using the loss function having the loss landscape normalized as described above. As a result, the learning device can learn a model with high generalization performance for Adversarial Examples.

[Configuration example of learning device]
A configuration example of the learning device 10 will be described with reference to FIG. The learning device 10 includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15, for example.

The input unit 11 is an interface that receives input of various data. For example, the input unit 11 receives input of data used for learning processing and prediction processing, which will be described later. The output unit 12 is an interface that outputs various data. For example, the output unit 12 outputs the label of data predicted by the control unit 15 .

The communication control unit 13 is realized by a NIC (Network Interface Card) or the like, and controls communication between an external device such as a server and the control unit 15 via a network. For example, the communication control unit 13 controls communication between the control unit 15 and a management device (see FIG. 4) that manages learning target data.

The storage unit 14 is realized by a semiconductor memory device such as RAM (Random Access Memory) and flash memory, or a storage device such as a hard disk and an optical disk, and stores the parameters of the model learned by the learning process described later. remembered.

The control unit 15 is implemented using, for example, a CPU (Central Processing Unit) or the like, and executes a processing program stored in the storage unit 14 . Thereby, the control unit 15 functions as an acquisition unit 15a, a learning unit 15b, and a prediction unit 15c, as illustrated in FIG.

The acquisition unit 15a acquires data used for learning processing and prediction processing, which will be described later, via the input unit 11 or the communication control unit 13.

The learning unit 15b performs model learning (adversarial training) for predicting the label of input data including adversarial examples. The learning unit 15 b includes a first calculation unit 151 , a second calculation unit 152 and a learning processing unit 153 .

The first calculation unit 151 recalculates the Adversarial Example for the weight each time the weight of the model is shifted in learning the model for predicting the label of the input data including the Adversarial Example. For example, the first calculation unit 151 adds noise (v) to the weight of the model and recalculates the Adversarial Example for the noise-added weight.

Also, the second calculation unit 152 uses the Adversarial Example recalculated by the first calculation unit 151 to create a loss landscape for the weight of the model, and flattens the created loss landscape.

The learning processing unit 153 uses the loss function whose loss landscape is flattened by the second calculation unit 152 to learn the model. For example, the learning processing unit 153 obtains the parameter (weight) of the model.

Here, an adversarial example for the weight of the model above is defined as in formula (1).

l in formula (1) is the loss function. Also, B(x, ε) is a set within a distance ε from x, and is a constraint used to make noise imperceptible to the human eye. Typically the L∞ norm is used.

Also, adversarial training performed by the learning unit 15b is defined as in the following equation (2).

Furthermore, the loss landscape sharpness is calculated by the following formula (3).

v in Equation (3) is Gaussian noise randomly sampled from within the region shown in Equation (4). l of w ^l is calculated for each layer, and the norm of the matrix is measured by the Frobenius norm.

Here, in conventional technology, in order to improve the generalization performance of Adversarial Examples of models, regularization has been performed to flatten the loss landscape based on Equations (5-1) to (5-3).

It should be noted that the first item on the left side of equation (5-1) is a term indicating normal Adversarial Training, and the second and third items are regularization terms that flatten the loss landscape. For v, for example, worst noise for weight(w) is used (see equation (5-3)).

Here, the Adversarial Example in the conventional technology (AWP) is not the optimal attack against w+v. Therefore, the learning unit 15b recalculates the Adversarial Example such that the Adversarial Example is the optimal attack against w+v. Then, the learning unit 15b normalizes (flattens) the loss landscape evaluated by the recalculated Adversarial Example (optimal Adversarial Example).

In addition, since the conventional technology (AWP) normalizes the loss landscape too strongly, it is difficult to improve the value of train acc even if the model is trained repeatedly, and as a result, there is little room to improve the generalization gap. Therefore, the learning unit 15b adjusts the strength of the loss landscape normalization term in the loss function using the hyperparameter β. As a result, the learning unit 15b can appropriately adjust the normalization of the loss landscape, and it becomes easier to improve the generalization gap by repeating model learning.

The first calculation unit 151 of the learning unit 15b creates v, which is the worst noise for weight (w) (equation (5-3)), and generates Adversarial Example (η _n (w+v)) for w+v. Calculate (formula (6-3)). Then, the second calculation unit 152 uses the calculated Adversarial Example (η _n (w+v)) to create a loss landscape of the loss function of the model and flattens the loss landscape (formula ( 6-1), formula (6-2)). At this time, the second calculation unit 152 calculates the term for flattening the loss landscape in the loss function (the normalization term (ρ _AWP(renoise) (w+v)−ρ _AWP(renoise) ( w))) is adjusted by the hyperparameter β.

Then, the learning processing unit 153 uses the loss function having the above loss landscape to learn the model. For example, the learning processing unit 153 uses the learning data acquired by the acquisition unit 15a to obtain the weight of the model that minimizes the loss value of the above loss function.

The prediction unit 15c uses the model learned by the learning unit 15b to predict the label of the input data. For example, the prediction unit 15c uses the learned model to calculate the probability of each label of newly acquired data, and outputs the label with the highest probability. As a result, the learning device 10 can output a correct label even when the input data is Adversarial Example, for example.

[Learning processing]
Next, with reference to FIG. 2, an example of a learning processing procedure by the learning device 10 will be described. The processing shown in FIG. 2 is started, for example, when an operation input instructing the start of learning processing is performed.

First, the acquisition unit 15a acquires learning data including Adversarial Examples (S1). Next, the learning unit 15b learns a model representing the probability distribution of the label of the input data using the learning data and the loss function (S2). Note that this loss function is a loss function whose loss landscape has been flattened by the above equations (6-1) to (6-3). The learning unit 15b stores the model parameters learned in S2 in the storage unit 14 .

[Prediction processing]
Next, an example of the input data label prediction processing by the learning device 10 will be described with reference to FIG. The processing shown in FIG. 3 is started, for example, when an operation input instructing the start of prediction processing is performed.

First, the acquisition unit 15a acquires label prediction target data (S11). Next, the prediction unit 15c uses the model learned by the learning unit 15b to predict the label of the data acquired in S11 (S12). For example, the prediction unit 15c uses the learned model to calculate p(x') of the data x' acquired in S11, and outputs the label with the highest probability.

As a result, even if the data x' is an Adversarial Example, the learning device 10 can output a correct label.

[Example of application of learning device]
The learning device 10 described above may be applied to data anomaly detection. An application example in this case will be described with reference to FIG. Here, a case where the detection device 20 is equipped with the function of the prediction unit 15c will be described as an example.

For example, the learning device 10 learns a model using teacher data (learning data) acquired from a data acquisition device and the loss function described above. After that, when the detection device 20 acquires new data x' from the data acquisition device, it calculates p(x') of the data x' using the trained model. Then, the detection device 20 outputs a report as to whether or not the data x' is abnormal data based on the label with the highest probability.

[Experimental result]
Next,

Experiments

1 and 2 were conducted to evaluate the model learned by the learning device 10 . Note that landscape(noise) is obtained by creating a loss landscape while generating v of ρ _AWP with Gaussian noise, and calculating the sharpness of the loss landscape based on the above equation (3). Landscape(renoise) is obtained by creating a loss landscape while generating v of ρ _AWP(renoise) with Gaussian noise, and calculating the sharpness of the loss landscape based on the above equation (3).

[Experimental conditions]
Image dataset: Cifar10
Deep learning model: Resnet18
Adversarial Example: PGD
PGD parameters: eps=8/255, train_iter=7, eval_iter=20, eps_iter=0.01, rand_init=True, clip_min=0.0, clip_max=1.0

[Experiment 1]
Experiment 1 will be described with reference to FIG. The purpose of Experiment 1 is that the sharpness of the loss landscape (landscape (renoise)) created by the learning device 10 is more robust than the sharpness of the loss landscape (landscape (noise)) of AWP. (train robust acc - test robust acc)).

In this experiment, we plotted the relationship between the sharpness of the loss landscape and the Robust Gap every 10 epochs for the Adversarial Trained model, as shown in Figure 5. The loss landscape here is landscape(noise) and landscape(renoise). The numbers in parentheses in FIG. 5 are the correlation coefficients between sharpness of landscape (noise) and landscape (renoise) and Robust Gap. As shown in FIG. 5, it can be seen that the sharpness of landscape (renoise) correlates better with the robust gap than the sharpness of landscape (noise).

From this, it can be seen that the loss landscape created by the learning device 10 can lower the robust gap as the sharpness value is lowered (the loss landscape is made flatter) than the AWP loss landscape. It could be confirmed.

[Experiment 2]
Next, Experiment 2 will be described with reference to FIGS. 6 and 7. FIG. The purpose of Experiment 2 is to perform Test Robust Acc on the model trained by the existing method (AWP) and the model trained by the learning device 10 (the model trained by AWP (renoise)). It is to confirm the generalization performance of the Adversarial Example of the model trained in .

In this experiment, in order to show not only the effectiveness of introducing β, but also the effectiveness of renoise alone, β was also introduced into the existing method AWP, and Test Robust Acc was evaluated.

In addition, the attack methods used for the evaluation of this experiment were PGD (Projected Gradient Descent), which was used for model learning, and Auto Attack, which is currently the most powerful attack. As shown in Figures 6 and 7, it was confirmed that the model trained by AWP (renoise) had a higher Test Robust Acc than the model trained by AWP. Therefore, it was confirmed that both the introduction of renoise and the introduction of β contributed to the improvement of the generalization performance of the Adversarial Example of the model.

[System configuration, etc.]
Also, each constituent element of each part shown in the figure is functionally conceptual, and does not necessarily need to be physically configured as shown in the figure. In other words, the specific forms of distribution and integration of each device are not limited to those illustrated, and all or part of them can be functionally or physically distributed and integrated in arbitrary units according to various loads and usage conditions. Can be integrated and configured. Furthermore, all or any part of each processing function performed by each device can be implemented by a CPU and a program executed by the CPU, or implemented as hardware based on wired logic.

Further, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or the processes described as being performed manually can be performed manually. All or part of this can also be done automatically by known methods. In addition, information including processing procedures, control procedures, specific names, and various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified.

[program]
The learning device 10 described above can be implemented by installing a program on a desired computer as package software or online software. For example, the information processing device can function as the learning device 10 by causing the information processing device to execute the above program. The information processing apparatus referred to here includes a desktop or notebook personal computer. In addition, information processing devices include mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone Systems), and terminals such as PDAs (Personal Digital Assistants).

The learning device 10 can also be implemented as a server device that uses a terminal device used by a user as a client and provides the client with services related to the above processing. In this case, the server device may be implemented as a web server, or may be implemented as a cloud that provides services related to the above processing by outsourcing.

FIG. 8 is a diagram showing an example of a computer that executes a learning program. The computer 1000 has a memory 1010 and a CPU 1020, for example. Computer 1000 also has hard disk drive interface 1030 , disk drive interface 1040 , serial port interface 1050 , video adapter 1060 and network interface 1070 . These units are connected by a bus 1080 .

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012 . The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). Hard disk drive interface 1030 is connected to hard disk drive 1090 . A disk drive interface 1040 is connected to the disk drive 1100 . A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100 . Serial port interface 1050 is connected to mouse 1110 and keyboard 1120, for example. Video adapter 1060 is connected to display 1130, for example.

The hard disk drive 1090 stores, for example, an OS 1091, application programs 1092, program modules 1093, and program data 1094. That is, the program that defines each process executed by the learning device 10 is implemented as a program module 1093 in which computer-executable code is described. Program modules 1093 are stored, for example, on hard disk drive 1090 . For example, the hard disk drive 1090 stores a program module 1093 for executing processing similar to the functional configuration of the learning device 10 . The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

Also, the data used in the processes of the above-described embodiments are stored as program data 1094 in the memory 1010 or the hard disk drive 1090, for example. Then, the CPU 1020 reads out the program modules 1093 and program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as necessary and executes them.

The program modules 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program modules 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Program modules 1093 and program data 1094 may then be read by CPU 1020 through network interface 1070 from other computers.

10 learning device 11 input unit 12 output unit 13 communication control unit 14 storage unit 15 control unit 15a acquisition unit

15b learning unit

15c prediction unit 20 detection device 151 first calculation unit 152 second calculation unit 153 learning processing unit

Claims

a first calculation unit that recalculates the Adversarial Example for the weight each time the weight of the model is shifted in learning a model for predicting the label of input data including the Adversarial Example;
a second calculator that uses the recalculated Adversarial Example to create a loss landscape of the loss function of the model and flattens the created loss landscape;
a learning processing unit that performs learning of the model using a loss function in which the loss landscape is flattened.
The second calculation unit
2. The learning device according to claim 1, wherein the strength of flattening the loss landscape is adjusted by a hyperparameter.
2. The learning device according to claim 1, further comprising a prediction unit that predicts a label of input data using the learned model.
A learning method performed by a learning device,
recalculating the Adversarial Example for the weight each time the weight of the model is shifted in learning a model for predicting the label of input data containing Adversarial Examples;
creating a loss landscape of the loss function of the model using the recomputed Adversarial Example and flattening the created loss landscape;
training the model using a loss function in which the loss landscape has been flattened.
recalculating the Adversarial Example for the weight each time the weight of the model is shifted in learning a model for predicting the label of input data containing Adversarial Examples;
creating a loss landscape of the loss function of the model using the recomputed Adversarial Example, flattening the created loss landscape;
a training program for causing a computer to perform the steps of: training said model using said loss landscape flattened loss function.