WO2024078411A1 - 一种数据处理方法及其装置 - Google Patents

一种数据处理方法及其装置 Download PDF

Info

Publication number
WO2024078411A1
WO2024078411A1 PCT/CN2023/123373 CN2023123373W WO2024078411A1 WO 2024078411 A1 WO2024078411 A1 WO 2024078411A1 CN 2023123373 W CN2023123373 W CN 2023123373W WO 2024078411 A1 WO2024078411 A1 WO 2024078411A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
disturbance
rank
training
loss
Prior art date
Application number
PCT/CN2023/123373
Other languages
English (en)
French (fr)
Inventor
王奕森
王启讯
王一飞
祝宏
李璟洁
Original Assignee
华为技术有限公司
北京大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司, 北京大学 filed Critical 华为技术有限公司
Publication of WO2024078411A1 publication Critical patent/WO2024078411A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/0464—Convolutional networks [CNN, ConvNet]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/048—Activation functions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G06N3/084—Backpropagation, e.g. using gradient descent
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/764—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using classification, e.g. of video objects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/77—Processing image or video features in feature spaces; using data integration or data reduction, e.g. principal component analysis [PCA] or independent component analysis [ICA] or self-organising maps [SOM]; Blind source separation
    • G06V10/774—Generating sets of training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/77—Processing image or video features in feature spaces; using data integration or data reduction, e.g. principal component analysis [PCA] or independent component analysis [ICA] or self-organising maps [SOM]; Blind source separation
    • G06V10/80—Fusion, i.e. combining data from various sources at the sensor level, preprocessing level, feature extraction level or classification level
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/82—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using neural networks

Definitions

  • the present application relates to the field of artificial intelligence, and in particular to a data processing method and device thereof.
  • Artificial Intelligence is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.
  • artificial intelligence is a branch of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence.
  • Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that machines have the functions of perception, reasoning and decision-making.
  • ODD out-of-distribution
  • a common assumption in machine learning is that the training set and the test set (or the data set processed during actual recommendation) are independent and identically distributed, but in real business scenarios, the data distribution of the training set and the test set is often inconsistent. The shift in data distribution will cause the model to be unable to adapt well from the training set to the test set, thereby reducing the generalization ability on the test set.
  • the present application provides a data processing method that can increase the robustness of a trained model to false features in the data, thereby achieving good OOD performance.
  • the present application provides a data processing method, comprising: obtaining a first disturbance, the rank of the first disturbance being smaller than the rank of training data; the first disturbance being used to fuse with the training data to obtain first data; based on the first data, a loss is obtained through a machine learning model, and the loss is used to update the first disturbance to obtain a second disturbance; the second disturbance is used to fuse with the training data to obtain second data; and the second data is used to update the machine learning model.
  • This application introduces a low-rank structure in the disturbance, which helps to better capture and filter out low-rank false information (or false features), where false information can be understood as information that has a negative impact on the tasks implemented by the model. This is because false information is mostly distributed in a low-dimensional subspace. Taking image data as an example, background, style information, etc. are mostly distributed in a low-dimensional subspace.
  • This application can effectively perturb the false features in the training samples by setting the disturbance applied to the training samples to low-rank data, thereby increasing the robustness of the trained model to the false features in the data, thereby achieving good OOD performance.
  • the rank of the first disturbance is less than half of the rank of the training data.
  • the training data includes multiple samples; the first perturbation is used to fuse with the training data to obtain first data, including: the first perturbation is used to fuse with each sample of the multiple samples respectively to obtain first data, and the first data includes multiple fused data.
  • the rank of the first disturbance may be lower than 1/2 of the rank of the sample, for example, the rank of the first disturbance may be 1/10 of the rank of the sample or close to 1/10, for example, the rank of the first disturbance may be 1/20 of the rank of the sample or close to 1/20, for example, the rank of the first disturbance may be 1/9 of the rank of the sample or close to 1/9, for example, the rank of the first disturbance may be 1/8 of the rank of the sample or close to 1/8, for example, the rank of the first disturbance may be 1/7 of the rank of the sample or close to 1/7, for example, the rank of the first disturbance may be 1/6 of the rank of the sample or close to 1/6, for example, the rank of the first disturbance may be 1/5 of the rank of the sample or close to 1/5, for example, the rank of the first disturbance may be 1/4 of the rank of the sample or close to 1/4, for example, the rank of the first disturbance may be 1/3 or close to 1/3 of the rank of the sample, for example, the rank of the first disturbance may be 1/3 or
  • the training sample may include multiple samples, and the multiple samples may be samples of the same field.
  • the so-called same field may be understood as the distribution of the multiple samples being similar or consistent, and the distribution may be a random Gaussian distribution, etc.
  • images including cats as an example, cartoon-type images including cats may be considered to be in the same field, and images including cats obtained by photographing real objects may be considered to be in the same field.
  • each sample in the plurality of samples has the same size as the first disturbance.
  • the rank of the first disturbance is smaller than the rank of each sample in the multiple samples compared to each sample in the multiple samples, that is, in addition to the number of disturbances being much lower than the number of samples in the quantity dimension, the rank of the disturbance is also lower than the rank of each sample in the spatial dimension.
  • the first disturbance is specifically obtained by fusing multiple disturbance data, and the rank of each disturbance data is less than or equal to the rank of each sample in the multiple samples; the loss is used to update the first disturbance, including: the loss is used to update each disturbance data in the multiple disturbance data.
  • the perturbation data is a matrix
  • the fusion is a matrix product operation.
  • the perturbation is constructed by the product of multiple low-rank matrices. Since the parameters of multiple low-rank matrices are updated during subsequent updates, the complexity of the perturbation construction can be increased, thereby increasing the effectiveness of the perturbation.
  • the perturbation data is a matrix
  • the fusion is a weighted convex combination.
  • the loss is used to update each disturbance data in the plurality of disturbance data, including: the loss is used to update each disturbance data in the plurality of disturbance data and the weight.
  • the training data is a single sample.
  • the training data is one or more of the following:
  • One or more image samples, one or more text samples, one or more video samples, and target data related to recommendation wherein the target data includes attribute information of the user, attribute information of the item, and information related to the recommendation scenario.
  • the loss is used to update the first disturbance, including: the loss is used to update the first disturbance based on gradient ascent.
  • the present application provides a data processing method, the method comprising:
  • the first disturbance is used to apply the disturbance to a background information and/or style information region in an image sample; and the first disturbance is used to be fused with the image sample to obtain first data;
  • a loss is obtained through a machine learning model, and the loss is used to update the first disturbance to obtain a second disturbance; the second disturbance is used to fuse with the training data to obtain second data; the second data is used to update the machine learning model.
  • the rank of the first disturbance is smaller than the rank of the image samples.
  • the rank of the first disturbance is less than half of the rank of the image samples.
  • the image sample includes multiple samples; the first perturbation is used to fuse with the image sample to obtain first data, including: the first perturbation is used to fuse with each sample of the multiple samples respectively to obtain first data, and the first data includes multiple fused data.
  • the different data in the multiple samples are data in the same field.
  • each sample in the plurality of samples has the same size as the first disturbance.
  • a rank of the first perturbation is smaller than a rank of each sample in the multiple samples.
  • the first disturbance is specifically obtained by fusing multiple disturbance data, and the rank of each disturbance data is less than or equal to the rank of each sample in the multiple samples; the loss is used to update the first disturbance, including: the loss is used to update each disturbance data in the multiple disturbance data.
  • the disturbance data is a matrix
  • the fusion is a matrix product operation
  • the perturbation data is a matrix
  • the fusion is a weighted convex combination.
  • the loss is used to update each disturbance data in the plurality of disturbance data, including:
  • the loss is used to update each perturbation data in the plurality of perturbation data and the weight.
  • the image sample is a single sample.
  • the loss is used to update the first disturbance, including:
  • the loss is used to perform a gradient ascent based update on the first perturbation.
  • the present application provides a data processing device, the device comprising:
  • a processing module used for obtaining a first disturbance, wherein the rank of the first disturbance is smaller than the rank of the training data; the first disturbance is used for fusing with the training data to obtain first data;
  • a loss is obtained through a machine learning model, and the loss is used to update the first disturbance to obtain a second disturbance; the second disturbance is used to fuse with the training data to obtain second data; the second data is used to update the machine learning model.
  • a first perturbation of the training sample can be obtained, and the rank of the first perturbation is less than the rank of the training data.
  • a low-rank structure is introduced in the perturbation, which helps to better capture and filter out low-rank false information (or false features), where false information can be understood as information that has a negative impact on the task achieved by the model. This is because most false information is distributed in a low-dimensional subspace. Taking image data as an example, background, style information, etc. are mostly distributed in a low-dimensional subspace.
  • This application can effectively perturb the false features in the training sample by setting the perturbation applied to the training sample to low-rank data, thereby increasing the robustness of the trained model to false features in the data.
  • the perturbation in adversarial training in the prior art usually simply uses a random perturbation with the same dimension as the picture, and does not take advantage of the fact that the false information is low-rank, so it cannot effectively perturb the false features in the training sample.
  • the rank of the first disturbance is less than half of the rank of the training data.
  • the training data includes multiple samples; the first perturbation is used to fuse with the training data to obtain first data, including: the first perturbation is used to fuse with each sample of the multiple samples respectively to obtain first data, and the first data includes multiple fused data.
  • the different data in the multiple samples are data in the same field.
  • each sample in the plurality of samples has the same size as the first disturbance.
  • a rank of the first perturbation is smaller than a rank of each sample in the multiple samples.
  • the first disturbance is specifically obtained by fusing multiple disturbance data, and the rank of each disturbance data is less than or equal to the rank of each sample in the multiple samples; the loss is used to update the first disturbance, including: the loss is used to update each disturbance data in the multiple disturbance data.
  • the disturbance data is a matrix
  • the fusion is a matrix product operation
  • the perturbation data is a matrix
  • the fusion is a weighted convex combination.
  • the loss is used to update each disturbance data in the plurality of disturbance data, including:
  • the loss is used to update each perturbation data in the plurality of perturbation data and the weight.
  • the training data is a single sample.
  • the training data is one or more of the following:
  • One or more image samples, one or more text samples, one or more video samples, and target data related to recommendation wherein the target data includes attribute information of the user, attribute information of the item, and information related to the recommendation scenario.
  • the loss is used to update the first disturbance, including:
  • the loss is used to perform a gradient ascent based update on the first perturbation.
  • the present application provides a data processing device, the device comprising:
  • a processing module used for obtaining a first disturbance, wherein the first disturbance is used for applying the disturbance to a background information and/or style information region in an image sample; the first disturbance is used for fusing with the image sample to obtain first data;
  • a loss is obtained through a machine learning model, and the loss is used to update the first disturbance to obtain a second disturbance; the second disturbance is used to fuse with the training data to obtain second data; the second data is used to update the machine learning model.
  • the rank of the first disturbance is smaller than the rank of the image samples.
  • the rank of the first disturbance is less than half of the rank of the image samples.
  • the image sample includes multiple samples; the first perturbation is used to fuse with the image sample to obtain first data, including: the first perturbation is used to fuse with each sample of the multiple samples respectively to obtain first data, and the first data includes multiple fused data.
  • the different data in the multiple samples are data in the same field.
  • each sample in the plurality of samples has the same size as the first disturbance.
  • a rank of the first perturbation is smaller than a rank of each sample in the multiple samples.
  • the first disturbance is specifically obtained by fusing multiple disturbance data, and the rank of each disturbance data is less than or equal to the rank of each sample in the multiple samples; the loss is used to update the first disturbance, including: the loss is used to update each disturbance data in the multiple disturbance data.
  • the disturbance data is a matrix
  • the fusion is a matrix product operation
  • the perturbation data is a matrix
  • the fusion is a weighted convex combination.
  • the loss is used to update each disturbance data in the plurality of disturbance data, including:
  • the loss is used to update each perturbation data in the plurality of perturbation data and the weight.
  • the image sample is a single sample.
  • the loss is used to update the first disturbance, including:
  • the loss is used to perform a gradient ascent based update on the first perturbation.
  • an embodiment of the present application provides a data processing device, which may include a memory, a processor, and a bus system, wherein the memory is used to store programs, and the processor is used to execute the programs in the memory to execute the first aspect and any optional method thereof, or the second aspect and any optional method thereof.
  • an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored.
  • the computer-readable storage medium When the computer-readable storage medium is run on a computer, the computer executes the above-mentioned first aspect and any optional method thereof, and the above-mentioned second aspect and any optional method thereof.
  • an embodiment of the present application provides a computer program which, when executed on a computer, enables the computer to execute the above-mentioned first aspect and any optional method thereof, and the above-mentioned second aspect and any optional method thereof.
  • the present application provides a chip system, which includes a processor for supporting the execution of a data processing device to implement the functions involved in the above aspects, such as sending or processing the data involved in the above methods; or information.
  • the chip system also includes a memory, which is used to store program instructions and data necessary for the execution device or training device.
  • the chip system can be composed of chips, or it can include chips and other discrete devices.
  • FIG1 is a schematic diagram of a structure of an artificial intelligence main framework
  • FIGS. 2a and 2b are schematic diagrams of the application system framework of the present invention.
  • FIG3 is a schematic diagram of an application scenario of the present application.
  • Figures 4a and 4b are schematic diagrams of application scenarios of the present application.
  • FIG5 is a schematic diagram of a system architecture of the present application.
  • FIG6 is a schematic diagram of the structure of a neural network in an embodiment of the present application.
  • FIG7 is a schematic diagram of the structure of a neural network in an embodiment of the present application.
  • FIG8 is a flowchart of a data processing method provided in an embodiment of the present application.
  • FIG9 is a schematic diagram of a structure of a data processing device provided in an embodiment of the present application.
  • FIG10 is a schematic diagram of a structure of an execution device provided in an embodiment of the present application.
  • FIG11 is a schematic diagram of a structure of a training device provided in an embodiment of the present application.
  • FIG. 12 is a schematic diagram of the structure of a chip provided in an embodiment of the present application.
  • the terms “substantially,” “about,” and the like are used as terms of approximation, not as terms of degree, and are intended to take into account the inherent deviations of measurements or calculations that one of ordinary skill in the art would know.
  • the use of “may” when describing embodiments of the present invention means “possible one or more embodiments.”
  • the terms “use,” “using,” and “used” may be considered synonymous with the terms “utilize,” “utilizing,” and “utilized,” respectively.
  • the term “exemplary” is intended to refer to an example or illustration.
  • Figure 1 shows a structural diagram of the main framework of artificial intelligence.
  • the following is an explanation of the above artificial intelligence theme framework from the two dimensions of "intelligent information chain” (horizontal axis) and “IT value chain” (vertical axis).
  • the "intelligent information chain” reflects a series of processes from data acquisition to processing. For example, it can be a general process of intelligent information perception, intelligent information representation and formation, intelligent reasoning, intelligent decision-making, intelligent execution and output. In this process, the data has undergone a condensation process of "data-information-knowledge-wisdom".
  • the "IT value chain” reflects the value that artificial intelligence brings to the information technology industry from the underlying infrastructure of human intelligence, information (providing and processing technology implementation) to the industrial ecology process of the system.
  • the infrastructure provides computing power support for the artificial intelligence system, enables communication with the outside world, and is supported by the basic platform. It communicates with the outside world through sensors; computing power is provided by smart chips (CPU, NPU, GPU, ASIC, FPGA and other hardware acceleration chips); the basic platform includes distributed computing frameworks and networks and other related platform guarantees and support, which can include cloud storage and computing, interconnection and interoperability Network, etc. For example, sensors communicate with the outside world to obtain data, which is then provided to the smart chips in the distributed computing system provided by the basic platform for calculation.
  • smart chips CPU, NPU, GPU, ASIC, FPGA and other hardware acceleration chips
  • the basic platform includes distributed computing frameworks and networks and other related platform guarantees and support, which can include cloud storage and computing, interconnection and interoperability Network, etc.
  • sensors communicate with the outside world to obtain data, which is then provided to the smart chips in the distributed computing system provided by the basic platform for calculation.
  • the data on the upper layer of the infrastructure is used to represent the data sources in the field of artificial intelligence.
  • the data involves graphics, images, voice, text, and IoT data of traditional devices, including business data of existing systems and perception data such as force, displacement, liquid level, temperature, and humidity.
  • Data processing usually includes data training, machine learning, deep learning, search, reasoning, decision-making and other methods.
  • machine learning and deep learning can symbolize and formalize data for intelligent information modeling, extraction, preprocessing, and training.
  • Reasoning refers to the process of simulating human intelligent reasoning in computers or intelligent systems, using formalized information to perform machine thinking and solve problems based on reasoning control strategies. Typical functions are search and matching.
  • Decision-making refers to the process of making decisions after intelligent information is reasoned, usually providing functions such as classification, sorting, and prediction.
  • some general capabilities can be further formed based on the results of the data processing, such as an algorithm or a general system, for example, translation, text analysis, computer vision processing, speech recognition, image recognition, etc.
  • Smart products and industry applications refer to the products and applications of artificial intelligence systems in various fields. They are the encapsulation of the overall artificial intelligence solution, which productizes intelligent information decision-making and realizes practical applications. Its application areas mainly include: smart terminals, smart transportation, smart medical care, autonomous driving, smart cities, etc.
  • the embodiments of the present application can be applied in computer vision-related fields such as driving assistance, autonomous driving, and mobile phone terminals.
  • the application system framework of the embodiment of the present application is shown in Figures 2a and 2b.
  • the video is extracted to obtain a single picture (or an image collected by other means), and the picture is sent to the machine learning model shown in Figure 2a or 2b in the embodiment of the present application to obtain 2D, 3D, Mask, key points and other information of the object of interest in the picture.
  • These detection results are output to the post-processing module for processing, such as being sent to the planning control unit for decision-making in the autonomous driving system and being sent to the beauty algorithm in the mobile phone terminal for processing to obtain the beautified picture.
  • the post-processing module for processing, such as being sent to the planning control unit for decision-making in the autonomous driving system and being sent to the beauty algorithm in the mobile phone terminal for processing to obtain the beautified picture.
  • Application scenario 1 ADAS/ADS visual perception system
  • the machine learning model in the embodiment of the present application can detect the mask and key points of the human body, and can enlarge and reduce the corresponding parts of the human body, such as performing waist-tightening and buttocks-beautifying operations, thereby outputting beauty pictures.
  • Application scenario 3 Image classification scenario:
  • the machine learning model in the embodiment of the present application can classify the images to be classified. For example, for a photographer, a lot of photos are taken every day, including animals, people, and plants.
  • the method of the present application can quickly classify the photos according to the content in the photos, which can be divided into photos containing animals, photos containing people, and photos containing plants.
  • the machine learning model in the embodiment of the present application can classify images including commodities. For a wide variety of commodities in large shopping malls or supermarkets, the classification of commodities can be completed quickly using the machine learning model.
  • the embodiments of the present application can also be applied to the field of information recommendation, which includes but is not limited to scenarios involving e-commerce product recommendations, search engine result recommendations, application market recommendations, music recommendations, video recommendations, etc.
  • the recommended items in various application scenarios can also be called "objects" to facilitate subsequent descriptions, that is, in different recommendation scenarios, the recommended object can be an APP, or a video, or music, or a certain product (such as the presentation interface of an online shopping platform, which will display different products for presentation according to different users, which can actually be presented through the recommendation results of the recommendation model).
  • These recommendation scenarios usually involve user behavior log collection, log data preprocessing (for example, quantization, sampling, etc.), sample set training to obtain a recommendation model, and analyze and process the objects involved in the scene corresponding to the training sample items (such as APP, music, etc.) according to the recommendation model.
  • the samples selected in the recommendation model training link come from the operation behavior of users in the mobile application market for the recommended APP, and the recommendation model trained thereby is applicable to the above-mentioned mobile APP application market, or can be used in the APP application market of other types of terminals to recommend terminal APPs.
  • the recommendation model will eventually calculate the recommendation probability or score of each recommended object.
  • the recommendation system selects the recommendation results according to certain selection rules, such as sorting them by recommendation probability or score, presenting them to users through corresponding applications or terminal devices, and users operating on the objects in the recommendation results to generate user behavior logs.
  • a recommendation request is triggered.
  • the recommendation system inputs the request and its related feature information into the deployed recommendation model, and then predicts the user's click-through rate for all candidate objects. Subsequently, the candidate objects are sorted in descending order according to the predicted click-through rate, and the candidate objects are displayed in order at different positions as the recommendation results for the user.
  • the user browses the displayed items and performs user behaviors, such as browsing, clicking, and downloading. These user behaviors will be stored in the log as training data, and the parameters of the recommendation model will be updated from time to time through the offline training module to improve the recommendation effect of the model.
  • the recommendation module of the app market predicts the possibility of the user downloading each given candidate application based on the user's historical download records, user click records, the application's own characteristics, time, location and other environmental characteristics. Based on the prediction results, the app market displays them in descending order of likelihood to increase the probability of application download. Specifically, applications that are more likely to be downloaded are ranked at the front, and applications that are less likely to be downloaded are ranked at the back.
  • the user's behavior will also be stored in the log and the parameters of the prediction model will be trained and updated through the offline training module.
  • Lifelong companions can record past events of users based on system data and application data, understand the user's current intentions, predict the user's future actions or behaviors, and ultimately realize intelligent services.
  • the user's behavior data including end-side text messages, photos, email events, etc.
  • a user portrait system is built, and on the other hand, a learning and memory module based on user information filtering, association analysis, cross-domain recommendations, causal reasoning, etc. is implemented to build a user's personal knowledge graph.
  • ODD out-of-distribution
  • this application provides a data processing method, which can be applied to the training process of the model.
  • the trained model has high processing accuracy for data with different data distributions.
  • This method can also be used to provide training samples for model training.
  • the steps related to the model reasoning process in the embodiment of the present application involve AI-related operations.
  • the system architecture provided in the embodiment of the present application is introduced in detail below in conjunction with Figure 5.
  • FIG5 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • a system architecture 500 includes an execution device 510 , a training device 520 , a database 530 , a client device 540 , a data storage system 550 , and a data acquisition system 560 .
  • the execution device 510 includes a calculation module 511, an I/O interface 512, a preprocessing module 513 and a preprocessing module 514.
  • the calculation module 511 may include a target model/rule 501, and the preprocessing module 513 and the preprocessing module 514 are optional.
  • the data acquisition device 560 is used to collect training samples.
  • the training samples may be image data, text data, video data, etc.
  • the data acquisition device 560 stores the training samples in the database 530 .
  • the training device 520 can train the neural network (such as the machine learning model in the embodiment of the present application) to obtain the target model/rule 501 based on the training samples maintained in the database 530.
  • the neural network such as the machine learning model in the embodiment of the present application
  • the training device 520 can perform a pre-training process on the neural network to be trained based on the training samples maintained in the database 530, or fine-tune the model based on the pre-training.
  • the training samples maintained in the database 530 may not all come from the data acquisition device 560, but may also be received from other devices. It should also be noted that the training device 520 may not train the target model/rule 501 entirely based on the training samples maintained in the database 530, but may also obtain training samples from the cloud or other places for model training. The above description should not be used as a limitation on the embodiments of the present application.
  • the target model/rule 501 trained by the training device 520 can be applied to different systems or devices, such as the execution device 510 shown in Figure 5.
  • the execution device 510 can be a terminal, such as a mobile phone terminal, a tablet computer, a laptop computer, an augmented reality (AR)/virtual reality (VR) device, a vehicle terminal, etc., and can also be a server, etc.
  • AR augmented reality
  • VR virtual reality
  • the training device 520 may transfer the trained model to the execution device 510 .
  • the execution device 510 is configured with an input/output (I/O) interface 512 for data interaction with an external device.
  • the user can input data (such as images in the embodiments of the present application) into the I/O interface 512 through the client device 540.
  • the preprocessing module 513 and the preprocessing module 514 are used to preprocess the input data received by the I/O interface 512. It should be understood that there may be no preprocessing module 513 and the preprocessing module 514 or only one preprocessing module. When there is no preprocessing module 513 and the preprocessing module 514, the computing module 511 may be directly used to process the input data.
  • the execution device 510 When the execution device 510 preprocesses the input data, or when the computing module 511 of the execution device 510 performs calculations and other related processing, the execution device 510 can call the data, code, etc. in the data storage system 550 for corresponding processing, and can also store the data, instructions, etc. obtained from the corresponding processing into the data storage system 550.
  • the I/O interface 512 provides the processing results to the client device 540 and thus to the user.
  • the user can manually give input data, and the “manually given input data” can be operated through the interface provided by the I/O interface 512.
  • the client device 540 can automatically send input data to the I/O interface 512. If the client device 540 is required to automatically send input data and needs to obtain the user's authorization, the user can set the corresponding authority in the client device 540. The user can view the results output by the execution device 510 on the client device 540, and the specific presentation form can be a specific method such as display, sound, action, etc.
  • the client device 540 can also be used as a data acquisition terminal to collect the input data of the input I/O interface 512 and the output results of the output I/O interface 512 as shown in the figure as new sample data, and store them in the database 530.
  • the I/O interface 512 directly stores the input data of the input I/O interface 512 and the output results of the output I/O interface 512 as new sample data in the database 530.
  • FIG. 5 is only a schematic diagram of a system architecture provided by an embodiment of the present application, and the positional relationship between the devices, components, modules, etc. shown in the figure does not constitute any limitation.
  • the data storage system 550 is an external memory relative to the execution device 510. In other cases, the data storage system 550 can also be placed in the execution device 510. It should be understood that the above-mentioned execution device 510 can be deployed in the client device 540.
  • the computing module 511 of the execution device 520 can obtain the code stored in the data storage system 550 to implement The steps related to the model reasoning process in the embodiments of the present application are now described.
  • the computing module 511 of the execution device 520 may include a hardware circuit (such as an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a general-purpose processor, a digital signal processor (DSP), a microprocessor or a microcontroller, etc.), or a combination of these hardware circuits.
  • the training device 520 may be a hardware system with an execution instruction function, such as a CPU, a DSP, etc., or a hardware system without an execution instruction function, such as an ASIC, an FPGA, etc., or a combination of the above-mentioned hardware systems without an execution instruction function and hardware systems with an execution instruction function.
  • the computing module 511 of the execution device 520 can be a hardware system with an execution instruction function, and the steps related to the model reasoning process provided in the embodiment of the present application can be software codes stored in the memory.
  • the computing module 511 of the execution device 520 can obtain the software code from the memory and execute the obtained software code to implement the steps related to the model reasoning process provided in the embodiment of the present application.
  • the computing module 511 of the execution device 520 can be a combination of a hardware system that does not have the function of executing instructions and a hardware system that has the function of executing instructions. Some of the steps related to the model reasoning process provided in the embodiments of the present application can also be implemented by the hardware system that does not have the function of executing instructions in the computing module 511 of the execution device 520, which is not limited here.
  • the above-mentioned training device 520 can obtain the code stored in the memory (not shown in Figure 5, which can be integrated into the training device 520 or deployed separately from the training device 520) to implement the steps related to model training in an embodiment of the present application.
  • the training device 520 may include a hardware circuit (such as an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a general-purpose processor, a digital signal processor (DSP), a microprocessor or a microcontroller, etc.), or a combination of these hardware circuits.
  • the training device 520 may be a hardware system with an instruction execution function, such as a CPU, DSP, etc., or a hardware system without an instruction execution function, such as an ASIC, FPGA, etc., or a combination of the above-mentioned hardware systems without an instruction execution function and hardware systems with an instruction execution function.
  • the training device 520 can be a combination of a hardware system that does not have the function of executing instructions and a hardware system that has the function of executing instructions. Some of the steps related to the model training provided in the embodiments of the present application can also be implemented by the hardware system that does not have the function of executing instructions in the training device 520, which is not limited here.
  • a neural network may be composed of neural units, and a neural unit may refer to an operation unit that takes xs (i.e., input data) and intercept 1 as input, and the output of the operation unit may be:
  • n is a natural number greater than 1
  • Ws is the weight of xs
  • b is the bias of the neural unit.
  • f is the activation function of the neural unit, which is used to introduce nonlinear characteristics into the neural network to convert the input signal in the neural unit into the output signal.
  • the output signal of the activation function can be used as the input of the next convolutional layer, and the activation function can be a sigmoid function.
  • a neural network is a network formed by connecting multiple single neural units mentioned above, that is, the output of one neural unit can be the input of another neural unit.
  • the input of each neural unit can be connected to the local receptive field of the previous layer to extract the characteristics of the local receptive field.
  • the local receptive field can be an area composed of several neural units.
  • Convolutional neural network is a deep neural network with a convolutional structure.
  • Convolutional neural network contains a feature extractor composed of a convolution layer and a subsampling layer, which can be regarded as a filter.
  • the convolution layer refers to the neuron layer in the convolutional neural network that performs convolution processing on the input signal.
  • a neuron can be connected to only some neurons in the adjacent layers.
  • a convolutional layer usually contains several feature planes, and each feature plane can be composed of some neural units arranged in a rectangular shape. The neural units in the same feature plane share weights, and the shared weights here are the convolution kernels.
  • Shared weights can be understood as the way of extracting features is independent of position.
  • the convolution kernel can be formalized as a matrix of random size, which is used in the training of convolutional neural networks. During the training process, the convolution kernel can obtain reasonable weights through learning. In addition, the direct benefit of shared weights is to reduce the connections between the layers of the convolutional neural network, while reducing the risk of overfitting.
  • CNN is a very common neural network.
  • convolutional neural network is a deep neural network with a convolution structure and a deep learning architecture.
  • Deep learning architecture refers to multiple levels of learning at different abstract levels through machine learning algorithms.
  • CNN is a feed-forward artificial neural network in which each neuron can respond to the image input into it.
  • a convolutional neural network (CNN) 200 may include an input layer 210 , a convolutional layer/pooling layer 220 (wherein the pooling layer is optional), and a fully connected layer 230 .
  • the convolution layer/pooling layer 220 may include layers 221-226, for example: in one implementation, layer 221 is a convolution layer, layer 222 is a pooling layer, layer 223 is a convolution layer, layer 224 is a pooling layer, layer 225 is a convolution layer, and layer 226 is a pooling layer; in another implementation, layers 221 and 222 are convolution layers, layer 223 is a pooling layer, layers 224 and 225 are convolution layers, and layer 226 is a pooling layer. That is, the output of a convolution layer can be used as the input of a subsequent pooling layer, or as the input of another convolution layer to continue the convolution operation.
  • the convolution layer 221 may include a plurality of convolution operators, which are also called kernels.
  • the convolution operator is equivalent to a filter that extracts specific information from the input image matrix in image processing.
  • the convolution operator may be essentially a weight matrix, which is usually predefined. In the process of performing convolution operations on the image, the weight matrix is usually processed one pixel after another (or two pixels after two pixels... depending on the value of the stride) in the horizontal direction on the input image, thereby completing the work of extracting specific features from the image.
  • the size of the weight matrix should be related to the size of the image. It should be noted that the depth dimension of the weight matrix is the same as the depth dimension of the input image.
  • the weight matrix In the process of performing convolution operations, the weight matrix extends to the entire depth of the input image. Therefore, convolution with a single weight matrix will produce a convolution output with a single depth dimension, but in most cases, a single weight matrix is not used, but multiple weight matrices of the same size (row ⁇ column), that is, multiple isotype matrices, are applied.
  • the output of each weight matrix is stacked to form the depth dimension of the convolved image, and the dimension here can be understood as being determined by the "multiple" mentioned above.
  • Different weight matrices can be used to extract different features in the image, for example, one weight matrix is used to extract image edge information, another weight matrix is used to extract specific colors of the image, and another weight matrix is used to blur unwanted noise in the image, etc.
  • the multiple weight matrices have the same size (rows ⁇ columns), and the feature maps extracted by the multiple weight matrices of the same size are also the same size. The extracted feature maps of the same size are then merged to form the output of the convolution operation.
  • weight values in these weight matrices need to be obtained through a lot of training in practical applications.
  • the weight matrices formed by the weight values obtained through training can be used to extract information from the input image, so that the convolutional neural network 200 can make correct predictions.
  • the initial convolutional layer (for example, 221) often extracts more general features, which can also be called low-level features.
  • the features extracted by the later convolutional layers (for example, 226) become more and more complex, such as high-level semantic features. Features with higher semantics are more suitable for the problem to be solved.
  • a convolution layer may be followed by a pooling layer, or multiple convolution layers may be followed by one or more pooling layers.
  • the pooling layer may include an average pooling operator and/or a maximum pooling operator to sample the input image to obtain an image of smaller size.
  • the average pooling operator may calculate the pixel values in the image within a specific range to generate an average value as the result of average pooling.
  • the maximum pooling operator may take the pixel with the largest value in the range within a specific range as the result of maximum pooling.
  • the operator in the pooling layer should also be related to the image size.
  • the size of the image output after processing by the pooling layer may be smaller than the size of the image input to the pooling layer, and each pixel in the image output by the pooling layer represents the average value or maximum value of the corresponding sub-region of the image input to the pooling layer.
  • the convolution neural network 200 After being processed by the convolution layer/pooling layer 220, the convolution neural network 200 is still insufficient to output the required output information. As described above, the convolution layer/pooling layer 220 only extracts features and reduces the parameters brought by the input image. However, in order to generate the final output information (the required class information or other related information), the convolution neural network 200 needs to use the fully connected layer 230 to generate one or a group of outputs of the required number of classes. Therefore, the fully connected layer 230 may include multiple hidden layers (such as 231, 232 to 23n as shown in Figure 6), and the parameters contained in the multiple hidden layers can be pre-trained according to the relevant training data of the specific task type. For example, the task type may include image recognition, image classification, image super-resolution reconstruction, etc.
  • the output layer 240 After the multiple hidden layers in the fully connected layer 230, that is, the last layer of the entire convolutional neural network 200 is the output layer 240, which has a loss function similar to the classification cross entropy, which is specifically used to calculate the prediction error.
  • the forward propagation of the entire convolutional neural network 200 (as shown in FIG. 6, the propagation from 210 to 240 is the forward propagation) is completed, the back propagation (as shown in FIG. 6, the propagation from 240 to 210 is the back propagation) will begin to update the weight values and biases of the aforementioned layers to reduce the loss of the convolutional neural network 200 and the error between the result output by the convolutional neural network 200 through the output layer and the ideal result.
  • the convolutional neural network 200 shown in Figure 6 is only an example of a convolutional neural network.
  • the convolutional neural network may also exist in the form of other network models, for example, including only a part of the network structure shown in Figure 6.
  • the convolutional neural network used in the embodiment of the present application may only include an input layer 210, a convolution layer/pooling layer 220 and an output layer 240.
  • the convolutional neural network 100 shown in FIG6 is only an example of a convolutional neural network.
  • the convolutional neural network can also exist in the form of other network models. For example, multiple convolutional layers/pooling layers are used in parallel as shown in FIG7, and the extracted features are input into the fully connected layer 230 for processing.
  • Deep Neural Network also known as multi-layer neural network
  • DNN Deep Neural Network
  • the neural network inside DNN can be divided into three categories: input layer, hidden layer, and output layer.
  • the first layer is the input layer
  • the last layer is the output layer
  • the layers in between are all hidden layers.
  • the layers are fully connected, that is, any neuron in the i-th layer must be connected to any neuron in the i+1-th layer.
  • the coefficients from the kth neuron in the L-1th layer to the jth neuron in the Lth layer are defined as It should be noted that the input layer does not have a W parameter.
  • W the weight parameter
  • more hidden layers allow the network to better describe complex situations in the real world. Theoretically, the more parameters a model has, the higher its complexity and the greater its "capacity", which means it can complete more complex learning tasks.
  • Training a deep neural network is the process of learning the weight matrix, and its ultimate goal is to obtain the weight matrix of all layers of the trained deep neural network (a weight matrix formed by many layers of vectors W).
  • Convolutional neural networks can use the error back propagation (BP) algorithm to correct the size of the parameters in the initial super-resolution model during the training process, so that the reconstruction error loss of the super-resolution model becomes smaller and smaller.
  • BP error back propagation
  • the forward transmission of the input signal to the output will generate error loss, and the error loss information is back-propagated to update the parameters in the initial super-resolution model, so that the error loss converges.
  • the back propagation algorithm is a back propagation movement dominated by error loss, which aims to obtain the optimal parameters of the super-resolution model, such as the weight matrix.
  • the present application provides a data processing method.
  • the data processing method of the present application is described in detail below with reference to the accompanying drawings.
  • Figure 8 is a flow chart of a data processing method provided in an embodiment of the present application. As shown in Figure 8, a data processing method provided in an embodiment of the present application may include steps 801 to 803, and these steps are described in detail below.
  • the training samples can be image data, text data, video data or target data related to the recommendation field.
  • the target data can be the user's attribute information, the item's attribute information and information related to the recommendation scenario, such as information related to the user's operation bias, such as information on the recommendation interface, the recommended location of the item, and other information that will affect the user's operation behavior.
  • the execution subject of step 801 may be a terminal device, and the terminal device may be a portable mobile device, such as but not limited to a mobile or portable computing device (such as a smart phone), a personal computer, a server computer, a handheld device (such as a tablet) or a laptop device, a multi-processor system, a game console or controller, a microprocessor-based system, a set-top box, a programmable consumer electronic product, a mobile phone, a mobile computing and/or communication device with a wearable or accessory form factor (such as a watch, glasses, a headset or earplugs), a network PC, a minicomputer, a mainframe computer, a distributed computing environment including any of the above systems or devices, and the like.
  • a mobile or portable computing device such as a smart phone
  • a personal computer such as a server computer
  • a handheld device such as a tablet
  • a laptop device such as a laptop device
  • a multi-processor system such as a game
  • the execution entity of step 801 may be a server on the cloud side, and the server may receive the user's operation data sent from the terminal device, and then the server may obtain the user's operation data.
  • the machine learning model can implement computer vision-related tasks such as object detection, image classification, image segmentation, etc.
  • the machine learning model may be a recommendation model
  • the tasks implemented by the recommendation model may be a combination of the following tasks: purchase behavior prediction, shopping cart addition behavior prediction, sharing behavior prediction, browsing behavior prediction, completion rate prediction, like prediction, collection prediction, click prediction, and click conversion prediction.
  • the training samples may include attribute information of users and items, and the attribute information may be user operation data.
  • the user's operation data can be obtained based on the interaction record between the user and the item (such as the user's behavior log), and the operation data may include the user's actual operation record on each item.
  • the operation data may include the user's attribute information, the attribute information of each item, and the operation type (such as click, download, etc.) of the user's operation on the multiple items.
  • the user's attribute information can be an attribute related to the user's preference characteristics, at least one of gender, age, occupation, income, hobbies and education level, among which gender can be male or female, age can be a number between 0-100, occupation can be teacher, programmer, chef, etc., hobbies can be basketball, tennis, running, etc., and education level can be elementary school, junior high school, high school, university, etc.; this application does not limit the specific type of user's attribute information.
  • the items can be physical items or virtual items, such as applications (APP), audio and video, web pages, news and information, etc.
  • the attribute information of the items can be at least one of the item name, developer, installation package size, category and popularity.
  • the category of the item can be chatting, parkour games, office, etc.
  • the popularity can be a score, comment, etc. for the item; the present application does not limit the specific type of the attribute information of the item.
  • the trained model can have better robustness when processing data with the imposed perturbations.
  • the present invention improves the existing adversarial training. Specifically, perturbations can be applied to the features in the training samples that will have a negative impact on the model processing tasks, so that the model has a higher resistance to interference with these false features.
  • a first perturbation of the training sample can be obtained, the rank of the first perturbation is smaller than the rank of the training data, and the first perturbation is
  • the low-rank structure introduced in the motion helps to better capture and filter out low-rank false information (or false features), where false information can be understood as information that has a negative impact on the tasks achieved by the model. This is because most false information is distributed in a low-dimensional subspace. Taking image data as an example, background, style information, etc. are mostly distributed in a low-dimensional subspace.
  • This application can effectively perturb the false features in the training samples by setting the perturbations applied to the training samples as low-rank data, thereby increasing the robustness of the trained model to the false features in the data.
  • the perturbations in adversarial training in the prior art usually simply use a random perturbation with the same dimension as the picture, and do not take advantage of the fact that the false information is low-rank, so it cannot effectively perturb the false features in the training samples.
  • the first perturbation may be data with the same size as each training sample, for example, a matrix or tensor with the same size as the training sample.
  • the rank of the first perturbation is smaller than the rank of the training sample.
  • the training sample may include multiple samples, and the multiple samples may be samples of the same field.
  • the so-called same field may be understood as the distribution of the multiple samples being similar or consistent, and the distribution may be a random Gaussian distribution, etc.
  • images including cats as an example, cartoon-type images including cats may be considered to be in the same field, and images including cats obtained by photographing real objects may be considered to be in the same field.
  • the training data includes multiple samples
  • the first perturbation can be used as a perturbation shared by multiple samples, that is, the first perturbation can be applied to multiple samples respectively.
  • the first perturbation can be used as a perturbation shared by multiple samples, that is, the first perturbation can be applied to multiple samples respectively.
  • the first perturbation is used to be fused with the training data to obtain first data, that is, the first perturbation is used to be fused with each sample of the multiple samples respectively to obtain first data, and the first data includes multiple fused data.
  • the rank of the first disturbance is smaller than the rank of each sample in the multiple samples compared to each sample in the multiple samples, that is, in addition to the number of disturbances being much lower than the number of samples in the quantity dimension, the rank of the disturbance is also lower than the rank of each sample in the spatial dimension.
  • the rank of the first perturbation may be lower than 1/2 of the rank of the sample, for example, the rank of the first perturbation may be 1/10 or close to 1/10 of the rank of the sample, for example, the rank of the first perturbation may be 1/20 or close to 1/20 of the rank of the sample, for example, the rank of the first perturbation may be 1/9 or close to 1/9 of the rank of the sample, for example, the rank of the first perturbation may be 1/8 or close to 1/8 of the rank of the sample, for example, the rank of the first perturbation may be 1/7 or close to 1/7 of the rank of the sample, for example, the rank of the first perturbation may be 1/6 or close to 1/6 of the rank of the sample, for example, the rank of the first perturbation may be 1/5 or close to 1/5 of the rank of the sample, for example, the rank of the first perturbation may be 1/4 or close to 1/4 of the rank of the sample, for example, the rank of the first perturbation may be 1/3 or close to 1/3 of the rank of the sample
  • the first disturbance is specifically obtained by fusing a plurality of disturbance data, and the rank of each of the disturbance data is less than or equal to the rank of each sample in the plurality of samples.
  • the perturbation data is a matrix
  • the fusion is a matrix product operation.
  • the perturbation is constructed by the product of multiple low-rank matrices. Since the parameters of multiple low-rank matrices are updated during subsequent updates, the complexity of the perturbation construction can be increased, thereby increasing the effectiveness of the perturbation.
  • training data (x, y) from different domains.
  • the ranks of A and B are both less than or equal to l, where l is the rank of the training data.
  • Calculate the adversarial sample x adv x + ⁇ , and use the adversarial sample to calculate the loss function L (f (x adv ), y).
  • the perturbation data is a matrix
  • the fusion is a weighted convex combination.
  • labeled training data (x, y) from different domains can be obtained.
  • the following operations are performed: k perturbations ⁇ i and their coefficients ⁇ i are randomly initialized in each training domain, and their linear convex combinations are calculated
  • k perturbations ⁇ i and their coefficients ⁇ i are randomly initialized in each training domain, and their linear convex combinations are calculated
  • the training data is a single sample, such as an image, that is, a corresponding perturbation is constructed for each single training sample, but the rank of the perturbation is smaller than the rank of the training sample.
  • a loss is obtained through a machine learning model, and the loss is used to update the first disturbance to obtain a second disturbance; the second disturbance is used to fuse with the training data to obtain second data; the second data is used to update the machine learning model.
  • a loss can be obtained based on the first data through a machine learning model, and the loss is used to update the first disturbance to obtain a second disturbance, wherein the update can be a gradient ascent.
  • the loss when the first loss is constructed using a plurality of perturbation data, the loss is used to update each perturbation data in the plurality of perturbation data.
  • the perturbation parameters can be updated by performing PGD gradient ascent:
  • update the model Repeat the above steps until the model converges or reaches the predetermined number of training iterations.
  • the second disturbance (or the second data obtained by fusing the second disturbance and training data) can be used as a training sample and delivered to the user.
  • the embodiment of the present application being able to act as a provider of training samples, and to construct more effective optimized training samples based on the original training samples specified by the user and the model to be trained, and to feed back to the user.
  • the embodiment of the present application provides a data processing method, including: obtaining a first disturbance, the rank of the first disturbance is less than the rank of the training data; the first disturbance is used to fuse with the training data to obtain the first data; according to the first data, through the machine learning model, the loss is obtained, and the loss is used to update the first disturbance to obtain the second disturbance; the second disturbance is used to fuse with the training data to obtain the second data; the second data is used to update the machine learning model.
  • the introduction of a low-rank structure in the disturbance helps to better capture and filter out low-rank false information (or false features), where false information can be understood as information that has a negative impact on the task achieved by the model. This is because most false information is distributed in a low-dimensional subspace.
  • the present application sets the disturbance applied to the training sample as low-rank data, which can effectively apply disturbance to the false features in the training sample, thereby increasing the robustness of the trained model to the false features in the data, and thus achieving good OOD performance.
  • the introduction is divided into two parts. The first part is the dataset introduction, and the second part is the algorithm implementation process introduction.
  • the PACS dataset includes data from four fields: P (Photos), A (Arts), C (Cartoon), and S (Sketch).
  • the images in these four fields have different field style characteristics: (1) Field P: pictures taken in the real world.
  • Field A art paintings.
  • Field C cartoon drawings.
  • Field S black and white sketches.
  • the dataset contains 7 categories.
  • Step 1 Preprocess the data: Use the data from the three selected fields as training sets and use the Python deep learning framework Pytorch to standardize the images: the mean and standard deviation of the three RGB channels are [0.229, 0.224, 0.225] and [0.485, 0.456, 0.406] (from the large visual image dataset ImageNet). At the same time, perform data enhancement such as random cropping, color jittering, and horizontal flipping to increase the robustness and generalization performance of the model.
  • Step 2 For data from different training domains, perform the following operations:
  • Scheme A Multi-perturbation linear combination adversarial training MAT: Use the torch.randn() function to randomly initialize k perturbations ⁇ i and their coefficients ⁇ i in each training domain, and calculate their linear convex combination After random initialization, ⁇ i needs to be converted to a non-negative weight interval [0,1] by using the torch.softmax() function.
  • the loss function is the cross entropy loss function.
  • Step 4 Perform PGD gradient ascent and update the perturbation parameters: Scheme A: Option B: In this step, the differentiation operation is implemented using Pytorch's torch.autograd.grad() function.
  • L(f(x′ adv ), y) cross entropy loss function.
  • the optimizer used for training is the Adam optimizer.
  • Step 6. Repeat Step 1. to 5. until the predetermined number of iterations is reached.
  • Step 7. Test the classification performance on the fourth domain.
  • an embodiment of the present application further provides a data processing method, the method comprising: obtaining a first disturbance, the first disturbance being used to apply the disturbance to the background information and/or style information area in the image sample; the first disturbance being used to fuse with the image sample to obtain first data; according to the first data, a loss is obtained through a machine learning model, the loss is used to update the first disturbance to obtain a second disturbance; the second disturbance is used to fuse with the training data to obtain second data; the second data is used to update the machine learning model The learning model is updated.
  • a first perturbation of the training sample can be obtained, and the rank of the first perturbation is less than the rank of the training data.
  • a low-rank structure is introduced in the perturbation, which helps to better capture and filter out low-rank false information (or false features), where false information can be understood as information that has a negative impact on the task implemented by the model. This is because false information is mostly distributed in a low-dimensional subspace. Taking image data as an example, background, style information, etc. are mostly distributed in a low-dimensional subspace.
  • This application can effectively perturb the false features in the training samples by setting the perturbation applied to the training samples to low-rank data, thereby increasing the robustness of the trained model to false features in the data.
  • the perturbation in adversarial training in the prior art usually simply uses a random perturbation with the same dimension as the picture, and does not take advantage of the fact that the false information is low-rank, so it cannot effectively perturb the false features in the training samples.
  • the rank of the first disturbance is smaller than the rank of the image samples.
  • the rank of the first disturbance is less than half of the rank of the image samples.
  • the image sample includes multiple samples; the first perturbation is used to fuse with the image sample to obtain first data, including: the first perturbation is used to fuse with each sample of the multiple samples respectively to obtain first data, and the first data includes multiple fused data.
  • the different data in the multiple samples are data in the same field.
  • each sample in the plurality of samples has the same size as the first disturbance.
  • a rank of the first perturbation is smaller than a rank of each sample in the multiple samples.
  • the first disturbance is specifically obtained by fusing multiple disturbance data, and the rank of each disturbance data is less than or equal to the rank of each sample in the multiple samples; the loss is used to update the first disturbance, including: the loss is used to update each disturbance data in the multiple disturbance data.
  • the disturbance data is a matrix
  • the fusion is a matrix product operation
  • the perturbation data is a matrix
  • the fusion is a weighted convex combination.
  • the loss is used to update each disturbance data in the plurality of disturbance data, including:
  • the loss is used to update each perturbation data in the plurality of perturbation data and the weight.
  • the image sample is a single sample.
  • the loss is used to update the first disturbance, including:
  • the loss is used to perform a gradient ascent based update on the first perturbation.
  • FIG. 9 is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application.
  • a data processing device 900 provided in an embodiment of the present application includes:
  • a processing module 901 is used to obtain a first disturbance, where the rank of the first disturbance is smaller than the rank of the training data; the first disturbance is used to be fused with the training data to obtain first data;
  • a loss is obtained through a machine learning model, and the loss is used to update the first disturbance to obtain a second disturbance; the second disturbance is used to fuse with the training data to obtain second data; the second data is used to update the machine learning model.
  • processing module 901 may refer to the description of step 801 in the above embodiment, which will not be repeated here.
  • a first perturbation of the training sample can be obtained, and the rank of the first perturbation is less than the rank of the training data.
  • a low-rank structure is introduced in the perturbation, which helps to better capture and filter out low-rank false information (or false features), where false information can be understood as information that has a negative impact on the task implemented by the model. This is because false information is mostly distributed in a low-dimensional subspace. Taking image data as an example, background, style information, etc. are mostly distributed in a low-dimensional subspace.
  • This application can effectively perturb the false features in the training samples by setting the perturbation applied to the training samples to low-rank data, thereby increasing the robustness of the trained model to false features in the data.
  • the perturbation in adversarial training in the prior art usually simply uses a random perturbation with the same dimension as the picture, and does not take advantage of the fact that the false information is low-rank, so it cannot effectively perturb the false features in the training samples.
  • the rank of the first disturbance is less than half of the rank of the training data.
  • the training data includes multiple samples; the first perturbation is used to fuse with the training data to obtain first data, including: the first perturbation is used to fuse with each sample of the multiple samples respectively to obtain first data, and the first data includes multiple fused data.
  • the different data in the multiple samples are data in the same field.
  • each sample in the plurality of samples has the same size as the first disturbance.
  • a rank of the first perturbation is smaller than a rank of each sample in the multiple samples.
  • the first disturbance is specifically obtained by fusing multiple disturbance data, and the rank of each disturbance data is less than or equal to the rank of each sample in the multiple samples; the loss is used to update the first disturbance, including: the loss is used to update each disturbance data in the multiple disturbance data.
  • the disturbance data is a matrix
  • the fusion is a matrix product operation
  • the perturbation data is a matrix
  • the fusion is a weighted convex combination.
  • the loss is used to update each disturbance data in the plurality of disturbance data, including:
  • the loss is used to update each perturbation data in the plurality of perturbation data and the weight.
  • the training data is a single sample.
  • the training data is one or more of the following:
  • One or more image samples, one or more text samples, one or more video samples, and target data related to recommendation wherein the target data includes attribute information of the user, attribute information of the item, and information related to the recommendation scenario.
  • the loss is used to update the first disturbance, including:
  • the loss is used to perform a gradient ascent based update on the first perturbation.
  • the present application also provides a data processing device, the device comprising:
  • a processing module used for obtaining a first disturbance, wherein the first disturbance is used for applying the disturbance to a background information and/or style information region in an image sample; the first disturbance is used for fusing with the image sample to obtain first data;
  • a loss is obtained through a machine learning model, and the loss is used to update the first disturbance to obtain a second disturbance; the second disturbance is used to fuse with the training data to obtain second data; the second data is used to update the machine learning model.
  • a first perturbation of the training sample can be obtained, and the rank of the first perturbation is less than the rank of the training data.
  • a low-rank structure is introduced in the perturbation, which helps to better capture and filter out low-rank false information (or false features), where false information can be understood as information that has a negative impact on the task achieved by the model. This is because most false information is distributed in a low-dimensional subspace. Taking image data as an example, background, style information, etc. are mostly distributed in a low-dimensional subspace.
  • This application can effectively perturb the false features in the training sample by setting the perturbation applied to the training sample to low-rank data, thereby increasing the robustness of the trained model to false features in the data.
  • the perturbation in adversarial training in the prior art usually simply uses a random perturbation with the same dimension as the picture, and does not take advantage of the fact that the false information is low-rank, so it cannot effectively perturb the false features in the training sample.
  • the rank of the first disturbance is smaller than the rank of the image samples.
  • the rank of the first disturbance is less than half of the rank of the image samples.
  • the image sample includes multiple samples; the first perturbation is used to fuse with the image sample to obtain first data, including: the first perturbation is used to fuse with each sample of the multiple samples respectively to obtain first data, and the first data includes multiple fused data.
  • the different data in the multiple samples are data in the same field.
  • each sample in the plurality of samples has the same size as the first disturbance.
  • a rank of the first perturbation is smaller than a rank of each sample in the multiple samples.
  • the first disturbance is specifically obtained by fusing multiple disturbance data, and the rank of each disturbance data is less than or equal to the rank of each sample in the multiple samples; the loss is used to update the first disturbance, including: the loss is used to update each disturbance data in the multiple disturbance data.
  • the disturbance data is a matrix
  • the fusion is a matrix product operation
  • the perturbation data is a matrix
  • the fusion is a weighted convex combination.
  • the loss is used to update each disturbance data in the plurality of disturbance data, including:
  • the loss is used to update each perturbation data in the plurality of perturbation data and the weight.
  • the image sample is a single sample.
  • the loss is used to update the first disturbance, including:
  • the loss is used to perform a gradient ascent based update on the first perturbation.
  • FIG. 10 is a structural schematic diagram of an execution device provided in an embodiment of the present application.
  • the execution device 1000 can be specifically manifested as a virtual reality VR device, a mobile phone, a tablet, a laptop, a smart wearable device, a monitoring data processing device or a server, etc., which is not limited here.
  • the execution device 1000 includes: a receiver 1001, a transmitter 1002, a processor 1003 and a memory 1004 (wherein the number of processors 1003 in the execution device 1000 can be one or more, and one processor is taken as an example in Figure 10), wherein the processor 1003 may include an application processor 10031 and a communication processor 10032.
  • the receiver 1001, the transmitter 1002, the processor 1003 and the memory 1004 may be connected via a bus or other means.
  • the memory 1004 may include a read-only memory and a random access memory, and provides instructions and data to the processor 1003. A portion of the memory 1004 may also include a non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 1004 stores processor and operation instructions, executable modules or data structures, or subsets thereof, or extended sets thereof, wherein the operation instructions may include various operation instructions for implementing various operations.
  • the processor 1003 controls the operation of the execution device.
  • the various components of the execution device are coupled together through a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus, and a status signal bus, etc.
  • the bus system includes not only a data bus but also a power bus, a control bus, and a status signal bus, etc.
  • various buses are referred to as bus systems in the figure.
  • the method disclosed in the above embodiment of the present application can be applied to the processor 1003, or implemented by the processor 1003.
  • the processor 1003 can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 1003 or the instruction in the form of software.
  • the above processor 1003 can be a general processor, a digital signal processor (digital signal processing, DSP), a microprocessor or a microcontroller, and can further include an application specific integrated circuit (application specific integrated circuit, ASIC), a field programmable gate array (field-programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the processor 1003 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application.
  • the general processor can be a microprocessor or the processor can also be any conventional processor, etc.
  • the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to be executed, or a combination of hardware and software modules in the decoding processor can be executed.
  • the software module may be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc.
  • the storage medium is located in the memory 1004, and the processor 1003 reads the information in the memory 1004 and completes the steps of the model reasoning process in the above method in combination with its hardware.
  • the receiver 1001 can be used to receive input digital or character information and generate signal input related to the relevant settings and function control of the execution device.
  • the transmitter 1002 can be used to output digital or character information through the first interface; the transmitter 1002 can also be used to send instructions to the disk group through the first interface to modify the data in the disk group; the transmitter 1002 can also include a display device such as a display screen.
  • FIG 11 is a structural diagram of the training device provided by the embodiment of the present application, specifically, the training device 1100 is implemented by one or more servers, and the training device 1100 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 1111 (for example, one or more processors) and memory 1132, one or more storage media 1130 (for example, one or more mass storage devices) storing application programs 1142 or data 1144.
  • the memory 1132 and the storage medium 1130 can be short-term storage or permanent storage.
  • the program stored in the storage medium 1130 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the training device. Furthermore, the central processor 1111 can be configured to communicate with the storage medium 1130 to execute a series of instruction operations in the storage medium 1130 on the training device 1100.
  • the training device 1100 may also include one or more power supplies 1126, one or more wired or wireless network interfaces 1150, one or more input and output interfaces 1158; or, one or more operating systems 1141, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.
  • the central processing unit 1111 is used to execute actions related to model training in the above-mentioned embodiment.
  • Also provided in an embodiment of the present application is a computer program product which, when executed on a computer, enables the computer to execute the steps executed by the aforementioned execution device, or enables the computer to execute the steps executed by the aforementioned training device.
  • a computer-readable storage medium is also provided in an embodiment of the present application, which stores a program for signal processing.
  • the computer-readable storage medium When the computer-readable storage medium is run on a computer, it enables the computer to execute the steps executed by the aforementioned execution device, or enables the computer to execute the steps executed by the aforementioned training device.
  • the execution device, training device or terminal device provided in the embodiments of the present application may specifically be a chip, and the chip includes: a processing unit and a communication unit, wherein the processing unit may be, for example, a processor, and the communication unit may be, for example, an input/output interface, a pin or a circuit, etc.
  • the processing unit may execute the computer execution instructions stored in the storage unit so that the chip in the execution device executes the data processing method described in the above embodiment, or so that the chip in the training device executes the data processing method described in the above embodiment.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit located outside the chip in the wireless access device end, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.
  • ROM read-only memory
  • RAM random access memory
  • FIG. 12 is a schematic diagram of a structure of a chip provided in an embodiment of the present application, wherein the chip may be a neural network processor NPU 1200, which is mounted on the host CPU (Host CPU) as a coprocessor and is assigned tasks by the Host CPU.
  • the core part of the NPU is the operation circuit 1203, which is controlled by the controller 1204 to extract matrix data from the memory and perform multiplication operations.
  • the operation circuit 1203 includes multiple processing units (Process Engine, PE) inside.
  • the operation circuit 1203 is a two-dimensional systolic array.
  • the operation circuit 1203 can also be a one-dimensional systolic array or other electronic circuits capable of performing mathematical operations such as multiplication and addition.
  • the operation circuit 1203 is a general-purpose matrix processor.
  • the operation circuit takes the corresponding data of matrix B from the weight memory 1202 and caches it on each PE in the operation circuit.
  • the operation circuit takes the matrix A data from the input memory 1201 and performs matrix operation with matrix B, and the partial result or final result of the matrix is stored in the accumulator 1208.
  • the unified memory 1206 is used to store input data and output data.
  • the weight data is directly transferred to the weight memory 1202 through the direct memory access controller (DMAC) 1205.
  • the input data is also transferred to the unified memory 1206 through the DMAC.
  • DMAC direct memory access controller
  • BIU stands for Bus Interface Unit, that is, the bus interface unit 1210, which is used for the interaction between AXI bus and DMAC and instruction fetch buffer (IFB) 1209.
  • IOB instruction fetch buffer
  • the bus interface unit 1210 (Bus Interface Unit, BIU for short) is used for the instruction fetch memory 1209 to obtain instructions from the external memory, and is also used for the storage unit access controller 1205 to obtain the original data of the input matrix A or the weight matrix B from the external memory.
  • BIU Bus Interface Unit
  • DMAC is mainly used to transfer input data in the external memory DDR to the unified memory 1206 or to transfer weight data to the weight memory 1202 or to transfer input data to the input memory 1201.
  • the vector calculation unit 1207 includes multiple operation processing units, which further process the output of the operation circuit 1203 when necessary, such as vector multiplication, vector addition, exponential operation, logarithmic operation, size comparison, etc. It is mainly used for non-convolutional/fully connected layer network calculations in neural networks, such as Batch Normalization, pixel-level summation, upsampling of feature planes, etc.
  • the vector calculation unit 1207 can store the processed output vector to the unified memory 1206.
  • the vector calculation unit 1207 can apply a linear function; or a nonlinear function to the output of the operation circuit 1203, such as linear interpolation of the feature plane extracted by the convolution layer, and then, for example, a vector of accumulated values to generate an activation value.
  • the vector calculation unit 1207 generates a normalized value, a pixel-level summed value, or both.
  • the processed output vector can be used as an activation input to the operation circuit 1203, for example, for use in a subsequent layer in a neural network.
  • An instruction fetch buffer 1209 connected to the controller 1204 is used to store instructions used by the controller 1204;
  • Unified memory 1206, input memory 1201, weight memory 1202 and instruction fetch memory 1209 are all on-chip memories. External memories are private to the NPU hardware architecture.
  • the processor mentioned in any of the above places may be a general-purpose central processing unit, a microprocessor, an ASIC, or one or more integrated circuits for controlling the execution of the above program.
  • the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.
  • the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.
  • the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.
  • a computer device which can be a personal computer, a training device, or a network device, etc.
  • all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof.
  • all or part of the embodiments may be implemented in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center.
  • the computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations.
  • the available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.
  • a magnetic medium e.g., a floppy disk, a hard disk, a tape
  • an optical medium e.g., a DVD
  • a semiconductor medium e.g., a solid-state drive (SSD)

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Evolutionary Computation (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Artificial Intelligence (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Databases & Information Systems (AREA)
  • Multimedia (AREA)
  • Medical Informatics (AREA)
  • Computational Linguistics (AREA)
  • Mathematical Physics (AREA)
  • Biophysics (AREA)
  • Biomedical Technology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Molecular Biology (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Image Processing (AREA)
  • Filters That Use Time-Delay Elements (AREA)
  • Instructional Devices (AREA)
  • Image Analysis (AREA)

Abstract

一种数据处理方法，应用于模型的对抗训练，所述方法包括：获取第一扰动，所述第一扰动的秩小于训练数据的秩；所述第一扰动用于和所述训练数据融合得到第一数据；根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。本申请在扰动中引入了低秩的结构，有助于更好地捕捉并滤除低秩的虚假信息(或者可以称之为虚假特征)，可以有效的对训练样本中的虚假特征施加扰动，进而可以增加训练后的模型对于数据中虚假特征的鲁棒性，进而实现良好的OOD性能。

Description

一种数据处理方法及其装置
本申请要求于2022年10月11日提交国家知识产权局、申请号为202211243792.6、发明名称为“一种数据处理方法及其装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及人工智能领域，尤其涉及一种数据处理方法及其装置。
背景技术
人工智能(Artificial Intelligence，AI)是利用数字计算机或者数字计算机控制的机器模拟、延伸和扩展人的智能，感知环境、获取知识并使用知识获得最佳结果的理论、方法、技术及应用系统。换句话说，人工智能是计算机科学的一个分支，它企图了解智能的实质，并生产出一种新的能以人类智能相似的方式作出反应的智能机器。人工智能也就是研究各种智能机器的设计原理与实现方法，使机器具有感知、推理与决策的功能。
在计算机视觉相关的场景中，尤其在目标检测、图像分类、图像分割等任务中，常常存在分布外泛化(out-of-distribution，ODD)的问题。
机器学习常用假设是训练集和测试集(或者是实际推荐时处理的数据集)的独立同分布，但真实业务场景往往存在训练集和测试集数据分布不一致的情况。数据分布的偏移会造成模型无法较好地从训练集适应到测试集，从而在测试集上的泛化能力下降。
在信息推荐相关的场景中，也存在ODD的问题。各种数据分布的不一致是导致推荐系统线上线下分布不一致的主要原因(存在未知、用户选择偏置等)，例如推荐系统线上分布未知，同时节假日、早晚高峰、新内容上线等导致线上分布变化频繁；此外，产品展示界面变化，往往造成巨大的线上分布变化。
因此，亟需提供一种能够解决ODD问题的方法。
发明内容
本申请提供了一种数据处理方法，可以增加训练后的模型对于数据中虚假特征的鲁棒性，进而实现良好的OOD性能。
第一方面，本申请提供了一种数据处理方法，所述方法包括：获取第一扰动，所述第一扰动的秩小于训练数据的秩；所述第一扰动用于和所述训练数据融合得到第一数据；根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
本申请在扰动中引入了低秩的结构，有助于更好地捕捉并滤除低秩的虚假信息(或者可以称之为虚假特征)，其中，虚假信息可以理解为对模型实现的任务存在负向影响的信息。这是因为虚假信息大多分布在一个低维子空间中，以图像数据为例，背景、风格信息等大多分布在一个低维子空间中，本申请通过将施加到训练样本上的扰动设置为低秩数据，可以有效的对训练样本中的虚假特征施加扰动，进而可以增加训练后的模型对于数据中虚假特征的鲁棒性，进而实现良好的OOD性能。
在一种可能的实现中，所述第一扰动的秩小于训练数据的秩的二分之一。
在一种可能的实现中，所述训练数据包括多个样本；所述第一扰动用于和训练数据融合得到第一数据，包括：所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
在一种可能的实现中，第一扰动的秩可以低于样本的秩的1/2，例如第一扰动的秩可以为样本的秩的1/10或者接近于1/10，例如第一扰动的秩可以为样本的秩的1/20或者接近于1/20，例如第一扰动的秩可以为样本的秩的1/9或者接近于1/9，例如第一扰动的秩可以为样本的秩的1/8或者接近于1/8，例如第一扰动的秩可以为样本的秩的1/7或者接近于1/7，例如第一扰动的秩可以为样本的秩的1/6或者接近于1/6，例如第一扰动的秩可以为样本的秩的1/5或者接近于1/5，例如第一扰动的秩可以为样本的秩的1/4或者接近于 1/4，例如第一扰动的秩可以为样本的秩的1/3或者接近于1/3，例如第一扰动的秩可以为样本的秩的1/2或者接近于1/2。
在一种可能的实现中，训练样本可以包括多个样本，该多个样本可以为同一个领域的样本，所谓同一个领域，可以理解为多个样本的分布相似或者一致，分布可以为随机高斯分布等。以包括猫的图像为例，卡通类型的包括猫的图像可以认为是同一个领域，而对实物拍摄得到的包括猫的图像可以认为是同一个领域。
在一种可能的实现中，所述多个样本中的每个样本与所述第一扰动的尺寸相同。
在一种可能的实现中，第一扰动相比于所述多个样本中每个样本来说，第一扰动的秩小于多个样本中每个样本的秩，也就是说，除了在数量维度上扰动的数量远远低于样本的数量，在空间维度上，扰动的秩也是低于每个样本的秩的。
在一种可能的实现中，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩；所述损失用于对所述第一扰动进行更新，包括：所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。通过多个低秩矩阵的乘积来构建扰动，由于后续更新时是对多个低秩矩阵的参数进行更新，可以增加扰动构建的复杂性，从而可以增加扰动的有效性。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为基于权重的凸组合。通过多个低秩矩阵的基于权重的凸组合来构建扰动，由于后续更新时是对多个低秩矩阵的参数进行更新(可选的，还可以更新权重)，可以增加扰动构建的复杂性，从而可以增加扰动的有效性。
在一种可能的实现中，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新，包括：所述损失用于对所述多个扰动数据中的每个扰动数据以及所述权重进行更新。
在一种可能的实现中，所述训练数据为单一的样本。
在一种可能的实现中，所述训练数据为如下的一种或多种：
一个或多个图像样本、一个或多个文本样本、一个或多个视频样本、和推荐相关的目标数据，所述目标数据包括用户的属性信息、物品的属性信息、和推荐场景相关的信息。
在一种可能的实现中，所述损失用于对所述第一扰动进行更新，包括：所述损失用于对所述第一扰动进行基于梯度上升的更新。
第二方面，本申请提供了一种数据处理方法，所述方法包括：
获取第一扰动，所述第一扰动用于将扰动作用于图像样本中的背景信息和/或风格信息区域；所述第一扰动用于和所述图像样本融合得到第一数据；
根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
在一种可能的实现中，所述第一扰动的秩小于图像样本的秩。
在一种可能的实现中，所述第一扰动的秩小于图像样本的秩的二分之一。
在一种可能的实现中，所述图像样本包括多个样本；所述第一扰动用于和图像样本融合得到第一数据，包括：所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
在一种可能的实现中，所述多个样本中不同的数据为相同领域的数据。
在一种可能的实现中，所述多个样本中的每个样本与所述第一扰动的尺寸相同。
在一种可能的实现中，所述第一扰动的秩小于所述多个样本中每个样本的秩。
在一种可能的实现中，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩；所述损失用于对所述第一扰动进行更新，包括：所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为基于权重的凸组合。
在一种可能的实现中，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新，包括：
所述损失用于对所述多个扰动数据中的每个扰动数据以及所述权重进行更新。
在一种可能的实现中，所述图像样本为单一的样本。
在一种可能的实现中，所述损失用于对所述第一扰动进行更新，包括：
所述损失用于对所述第一扰动进行基于梯度上升的更新。
第三方面，本申请提供了一种数据处理装置，所述装置包括：
处理模块，用于获取第一扰动，所述第一扰动的秩小于训练数据的秩；所述第一扰动用于和所述训练数据融合得到第一数据；
根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
在一种可能的实现中，可以获取到训练样本的第一扰动，该第一扰动的秩小于训练数据的秩，在扰动中引入了低秩的结构，有助于更好地捕捉并滤除低秩的虚假信息(或者可以称之为虚假特征)，其中，虚假信息可以理解为对模型实现的任务存在负向影响的信息。这是因为虚假信息大多分布在一个低维子空间中，以图像数据为例，背景、风格信息等大多分布在一个低维子空间中，本申请通过将施加到训练样本上的扰动设置为低秩数据，可以有效的对训练样本中的虚假特征施加扰动，进而可以增加训练后的模型对于数据中虚假特征的鲁棒性。现有技术中的对抗训练中的扰动通常只是简单地使用一个与图片维度相同的随机扰动，并没有利用虚假信息是低秩的这一特点，因此并不能有效的对训练样本中的虚假特征施加扰动。
在一种可能的实现中，所述第一扰动的秩小于训练数据的秩的二分之一。
在一种可能的实现中，所述训练数据包括多个样本；所述第一扰动用于和训练数据融合得到第一数据，包括：所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
在一种可能的实现中，所述多个样本中不同的数据为相同领域的数据。
在一种可能的实现中，所述多个样本中的每个样本与所述第一扰动的尺寸相同。
在一种可能的实现中，所述第一扰动的秩小于所述多个样本中每个样本的秩。
在一种可能的实现中，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩；所述损失用于对所述第一扰动进行更新，包括：所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为基于权重的凸组合。
在一种可能的实现中，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新，包括：
所述损失用于对所述多个扰动数据中的每个扰动数据以及所述权重进行更新。
在一种可能的实现中，所述训练数据为单一的样本。
在一种可能的实现中，所述训练数据为如下的一种或多种：
一个或多个图像样本、一个或多个文本样本、一个或多个视频样本、和推荐相关的目标数据，所述目标数据包括用户的属性信息、物品的属性信息、和推荐场景相关的信息。
在一种可能的实现中，所述损失用于对所述第一扰动进行更新，包括：
所述损失用于对所述第一扰动进行基于梯度上升的更新。
第四方面，本申请提供了一种数据处理装置，所述装置包括：
处理模块，用于获取第一扰动，所述第一扰动用于将扰动作用于图像样本中的背景信息和/或风格信息区域；所述第一扰动用于和所述图像样本融合得到第一数据；
根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
在一种可能的实现中，所述第一扰动的秩小于图像样本的秩。
在一种可能的实现中，所述第一扰动的秩小于图像样本的秩的二分之一。
在一种可能的实现中，所述图像样本包括多个样本；所述第一扰动用于和图像样本融合得到第一数据，包括：所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
在一种可能的实现中，所述多个样本中不同的数据为相同领域的数据。
在一种可能的实现中，所述多个样本中的每个样本与所述第一扰动的尺寸相同。
在一种可能的实现中，所述第一扰动的秩小于所述多个样本中每个样本的秩。
在一种可能的实现中，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩；所述损失用于对所述第一扰动进行更新，包括：所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为基于权重的凸组合。
在一种可能的实现中，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新，包括：
所述损失用于对所述多个扰动数据中的每个扰动数据以及所述权重进行更新。
在一种可能的实现中，所述图像样本为单一的样本。
在一种可能的实现中，所述损失用于对所述第一扰动进行更新，包括：
所述损失用于对所述第一扰动进行基于梯度上升的更新。
第五方面，本申请实施例提供了一种数据处理装置，可以包括存储器、处理器以及总线系统，其中，存储器用于存储程序，处理器用于执行存储器中的程序，以执行如上述第一方面及其任一可选的方法、或者如上述第二方面及其任一可选的方法。
第六方面，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，当其在计算机上运行时，使得计算机执行上述第一方面及其任一可选的方法、以及上述第二方面及其任一可选的方法。
第七方面，本申请实施例提供了一种计算机程序，当其在计算机上运行时，使得计算机执行上述第一方面及其任一可选的方法、以及上述第二方面及其任一可选的方法。
第八方面，本申请提供了一种芯片系统，该芯片系统包括处理器，用于支持执行数据处理装置实现上述方面中所涉及的功能，例如，发送或处理上述方法中所涉及的数据；或，信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存执行设备或训练设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
附图说明
图1为人工智能主体框架的一种结构示意图；
图2a和图2b为本发明的应用系统框架示意；
图3为本申请的一种应用场景示意；
图4a和图4b为本申请的应用场景示意；
图5为本申请的一种系统架构示意；
图6为本申请实施例的神经网络的结构示意；
图7为本申请实施例的神经网络的结构示意；
图8为本申请实施例提供的一种数据处理方法的流程示意；
图9为本申请实施例提供的数据处理装置的一种结构示意图；
图10为本申请实施例提供的执行设备的一种结构示意图；
图11为本申请实施例提供的训练设备一种结构示意图；
图12为本申请实施例提供的芯片的一种结构示意图。
具体实施方式
下面结合本发明实施例中的附图对本发明实施例进行描述。本发明的实施方式部分使用的术语仅用于对本发明的具体实施例进行解释，而非旨在限定本发明。
下面结合附图，对本申请的实施例进行描述。本领域普通技术人员可知，随着技术的发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的术语在适当情况下可以互换，这仅仅是描述本申请的实施例中对相同属性的对象在描述时所采用的区分方式。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，以便包含一系列单元的过程、方法、系统、产品或设备不必限于那些单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它单元。
本文中所用用语“基本(substantially)”、“大约(about)”及类似用语用作近似用语、而并非用作程度用语，且旨在考虑到所属领域中的普通技术人员将知的测量值或计算值的固有偏差。此外，在阐述本发明实施例时使用“可(may)”是指“可能的一个或多个实施例”。本文中所用用语“使用(use)”、“正使用(using)”、及“被使用(used)”可被视为分别与用语“利用(utilize)”、“正利用(utilizing)”、及“被利用(utilized)”同义。另外，用语“示例性(exemplary)”旨在指代实例或例示。
首先对人工智能系统总体工作流程进行描述，请参见图1，图1示出的为人工智能主体框架的一种结构示意图，下面从“智能信息链”(水平轴)和“IT价值链”(垂直轴)两个维度对上述人工智能主题框架进行阐述。其中，“智能信息链”反映从数据的获取到处理的一列过程。举例来说，可以是智能信息感知、智能信息表示与形成、智能推理、智能决策、智能执行与输出的一般过程。在这个过程中，数据经历了“数据—信息—知识—智慧”的凝练过程。“IT价值链”从人智能的底层基础设施、信息(提供和处理技术实现)到系统的产业生态过程，反映人工智能为信息技术产业带来的价值。
(1)基础设施
基础设施为人工智能系统提供计算能力支持，实现与外部世界的沟通，并通过基础平台实现支撑。通过传感器与外部沟通；计算能力由智能芯片(CPU、NPU、GPU、ASIC、FPGA等硬件加速芯片)提供；基础平台包括分布式计算框架及网络等相关的平台保障和支持，可以包括云存储和计算、互联互通 网络等。举例来说，传感器和外部沟通获取数据，这些数据提供给基础平台提供的分布式计算系统中的智能芯片进行计算。
(2)数据
基础设施的上一层的数据用于表示人工智能领域的数据来源。数据涉及到图形、图像、语音、文本，还涉及到传统设备的物联网数据，包括已有系统的业务数据以及力、位移、液位、温度、湿度等感知数据。
(3)数据处理
数据处理通常包括数据训练，机器学习，深度学习，搜索，推理，决策等方式。
其中，机器学习和深度学习可以对数据进行符号化和形式化的智能信息建模、抽取、预处理、训练等。
推理是指在计算机或智能系统中，模拟人类的智能推理方式，依据推理控制策略，利用形式化的信息进行机器思维和求解问题的过程，典型的功能是搜索与匹配。
决策是指智能信息经过推理后进行决策的过程，通常提供分类、排序、预测等功能。
(4)通用能力
对数据经过上面提到的数据处理后，进一步基于数据处理的结果可以形成一些通用的能力，比如可以是算法或者一个通用系统，例如，翻译，文本的分析，计算机视觉的处理，语音识别，图像的识别等等。
(5)智能产品及行业应用
智能产品及行业应用指人工智能系统在各领域的产品和应用，是对人工智能整体解决方案的封装，将智能信息决策产品化、实现落地应用，其应用领域主要包括：智能终端、智能交通、智能医疗、自动驾驶、智慧城市等。
接下来介绍本申请实施例的应用场景。
1、计算机视觉
本申请实施例可以应用在驾驶辅助、自动驾驶、手机终端等计算机视觉相关的领域。
以计算机视觉为例，本申请实施例的应用系统框架如图2a和图2b所示，视频经过抽帧得到单张图片(或者是通过其他方式采集得到的图像)，该图片送入到本申请实施例中图2a或图2b所示的机器学习模型，得到该图片中感兴趣物体的2D、3D、Mask(掩膜)、关键点等信息。这些检测结果输出到后处理模块进行处理，比如在自动驾驶系统中送入规划控制单元进行决策、在手机终端中送入美颜算法进行处理得到美颜后的图片。下面分别对几个示例性的应用场景进行介绍。
应用场景1：ADAS/ADS视觉感知系统
如图3所示，在ADAS和ADS中，需要实时进行多类型的2D目标检测，包括：动态障碍物(行人(Pedestrian)、骑行者(Cyclist)、三轮车(Tricycle)、轿车(Car)、卡车(Truck)、公交车(Bus))，静态障碍物(交通锥标(TrafficCone)、交通棍标(TrafficStick)、消防栓(FireHydrant)、摩托车(Motocycle)、自行车(Bicycle))，交通标志(TrafficSign、导向标志(GuideSign)、广告牌(Billboard)、红色交通灯(TrafficLight_Red)/黄色交通灯(TrafficLight_Yellow)/绿色交通灯(TrafficLight_Green)/黑色交通灯(TrafficLight_Black)、路标(RoadSign))。另外，为了准确获取动态障碍物的在3维空间所占的区域，还需要对动态障碍物进行3D估计，输出3D框。为了与激光雷达的数据进行融合，需要获取动态障碍物的Mask，从而把打到动态障碍物上的激光点云筛选出来；为了进行精确的泊车位，需要同时检测出泊车位的4个关键点；为了进行构图定位，需要检测出静态目标的关键点。本申请实施例中的机器学习模型可以完成上述的全部或一部分功能。
应用场景2：手机美颜功能
在手机中，本申请实施例中的机器学习模型可以检测出人体的Mask和关键点，可以对人体相应的部位进行放大缩小，比如进行收腰和美臀操作，从而输出美颜的图片。
应用场景3：图像分类场景：
对于图像数量比较庞大的情况，人工分类的方式效率比较低下，并且人在长时间处理同一件事情时很容易产生疲劳感，此时分类的结果会有很大的误差。
本申请实施例中的机器学习模型可以对待分类图像进行分类。例如，对于摄影师来说，每天会拍很多照片，有动物的，有人物，有植物的。采用本申请的方法可以快速地将照片按照照片中的内容进行分类，可分成包含动物的照片、包含人物的照片和包含植物的照片。
应用场景4：商品分类：
本申请实施例中的机器学习模型可以对包括商品的图像进行分类。对于大型商场或超市中种类繁多的商品，利用机器学习模型可以快速完成商品的分类。
2、信息推荐
本申请实施例还可以应用于信息推荐领域，该场景包括但不限于涉及电商产品推荐、搜索引擎结果推荐、应用市场推荐、音乐推荐、视频推荐等场景，各种不同应用场景中被推荐的物品也可以称为“对象”以方便后续描述，即在不同的推荐场景中，推荐对象可以是APP，或者视频，或者音乐，或者某款商品(如线上购物平台的呈现界面，会根据用户的不同而显示不同的商品进行呈现，这实质也可以是通过推荐模型的推荐结果来进行呈现)。这些推荐场景通常涉及用户行为日志采集、日志数据预处理(例如，量化、采样等)、样本集训练以获得推荐模型、根据推荐模型对训练样本项对应的场景中所涉及的对象(如APP、音乐等)进行分析处理、例如，推荐模型训练环节中所选择的样本来自于手机应用市场用户对于所推荐APP的操作行为，则由此所训练出来的推荐模型则适用于上述手机APP应用市场，或者可以用于其它的类型的终端的APP应用市场进行终端APP的推荐。推荐模型将最终计算出各个待推荐对象的推荐概率或者分值，推荐系统根据一定的选择规则选定的推荐结果，例如按照推荐概率或者分值进行排序，通过相应的应用或者终端设备呈现给用户、用户对推荐结果中的对象进行操作以生成用户行为日志等环节。
参照图3，在推荐过程中，当一个用户与推荐系统进行交互会触发一个推荐请求，推荐系统会将该请求及其相关的特征信息输入到部署的推荐模型中，然后预测用户对所有候选对象的点击率。随后，根据预测的点击率对候选对象进行降序排列，按顺序将候选对象展示在不同的位置作为对用户的推荐结果。用户对展示的项目进行浏览并发生用户行为，如浏览、点击和下载等。这些用户行为会被存入日志中作为训练数据，通过离线训练模块不定期地更新推荐模型的参数，提高模型的推荐效果。
比如，用户打开手机应用市场即可触发应用市场的推荐模块，应用市场的推荐模块会根据用户的历史下载记录、用户点击记录，应用的自身特征，时间、地点等环境特征信息，预测用户对给定的各个候选应用的下载可能性。根据预测的结果，应用市场按照可能性降序展示，达到提高应用下载概率的效果。具体来说，将更有可能下载的应用排在靠前的位置，将不太可能下载的应用排列在靠后的位置。而用户的行为也会存入日志并通过离线训练模块对预测模型的参数进行训练和更新。
又比如，在终身伴侣相关的应用中，可以基于用户在视频、音乐、新闻等域的历史数据，通过各种模型和算法，仿照人脑机制，构建认知大脑，搭建用户终身学习系统框架。终身伴侣可以根据系统数据和应用数据等来记录用户过去发生的事件，理解用户的当前意图，预测用户未来的动作或行为，最终实现智能服务。在当前第一阶段，根据音乐APP、视频APP和浏览器APP等获取用户的行为数据(包含端侧短信、照片、邮件事件等信息)，一方面构建用户画像系统，另一方面实现基于用户信息过滤、关联分析、跨域推荐、因果推理等的学习与记忆模块，构建用户个人知识图谱。
在计算机视觉相关的场景中，尤其在目标检测、图像分类、图像分割等任务中，常常存在分布外泛化(out-of-distribution，ODD)的问题。
机器学习常用假设是训练集和测试集(或者是实际推荐时处理的数据集)的独立同分布，但真实业务场景往往存在训练集和测试集数据分布不一致的情况。图4a所示的是测试集和训练集数据服从不同分布的情况，图4b是对数据分布不同的直观解释：猫所处的背景以及猫的图像风格在测试时相比训练时发生变化。值得注意的是，猫的本质特征，比如形状轮廓，在测试和训练时是保持稳定不变的，变化的只有背景、风格这类虚假特征。数据分布的偏移会造成模型无法较好地从训练集适应到测试集，从而在测试集上的泛化能力下降。
在信息推荐相关的场景中，也存在ODD的问题。各种数据分布的不一致是导致推荐系统线上线下分布不一致的主要原因(存在未知、用户选择偏置等)，例如推荐系统线上分布未知，同时节假日、早晚高峰、新内容上线等导致线上分布变化频繁；此外，产品展示界面变化，往往造成巨大的线上分布变化。
为了解决上述问题，本申请提供了一种数据处理方法，该方法可以应用于模型的训练过程，可以使 得训练后的模型针对于不同数据分布的数据都具备较高的处理精度，该方法还可以用于提供模型训练时使用的训练样本。
本申请实施例中的和模型推理过程相关的步骤涉及AI相关的运算，下面结合图5对本申请实施例提供的系统架构进行详细的介绍。
图5为本申请实施例提供的系统架构示意图。如图5所示，系统架构500包括执行设备510、训练设备520、数据库530、客户设备540、数据存储系统550以及数据采集系统560。
执行设备510包括计算模块511、I/O接口512、预处理模块513和预处理模块514。计算模块511中可以包括目标模型/规则501，预处理模块513和预处理模块514是可选的。
数据采集设备560用于采集训练样本。训练样本可以为图像数据、文本数据、视频数据等。在采集到训练样本之后，数据采集设备560将这些训练样本存入数据库530。
训练设备520可以基于数据库530中维护训练样本，对待训练的神经网络(例如本申请实施例中的机器学习模型)，以得到目标模型/规则501。
应理解，训练设备520可以基于数据库530中维护训练样本，对待训练的神经网络进行预训练过程，或者是在预训练的基础上进行模型的微调。
需要说明的是，在实际应用中，数据库530中维护的训练样本不一定都来自于数据采集设备560的采集，也有可能是从其他设备接收得到的。另外需要说明的是，训练设备520也不一定完全基于数据库530维护的训练样本进行目标模型/规则501的训练，也有可能从云端或其他地方获取训练样本进行模型训练，上述描述不应该作为对本申请实施例的限定。
根据训练设备520训练得到的目标模型/规则501可以应用于不同的系统或设备中，如应用于图5所示的执行设备510，该执行设备510可以是终端，如手机终端，平板电脑，笔记本电脑，增强现实(augmented reality，AR)/虚拟现实(virtual reality，VR)设备，车载终端等，还可以是服务器等。
具体的，训练设备520可以将训练后的模型传递至执行设备510。
在图5中，执行设备510配置输入/输出(input/output，I/O)接口512，用于与外部设备进行数据交互，用户可以通过客户设备540向I/O接口512输入数据(例如本申请实施例中的图像等)。
预处理模块513和预处理模块514用于根据I/O接口512接收到的输入数据进行预处理。应理解，可以没有预处理模块513和预处理模块514或者只有的一个预处理模块。当不存在预处理模块513和预处理模块514时，可以直接采用计算模块511对输入数据进行处理。
在执行设备510对输入数据进行预处理，或者在执行设备510的计算模块511执行计算等相关的处理过程中，执行设备510可以调用数据存储系统550中的数据、代码等以用于相应的处理，也可以将相应处理得到的数据、指令等存入数据存储系统550中。
最后，I/O接口512将处理结果提供给客户设备540，从而提供给用户。
在图5所示情况下，用户可以手动给定输入数据，该“手动给定输入数据”可以通过I/O接口512提供的界面进行操作。另一种情况下，客户设备540可以自动地向I/O接口512发送输入数据，如果要求客户设备540自动发送输入数据需要获得用户的授权，则用户可以在客户设备540中设置相应权限。用户可以在客户设备540查看执行设备510输出的结果，具体的呈现形式可以是显示、声音、动作等具体方式。客户设备540也可以作为数据采集端，采集如图所示输入I/O接口512的输入数据及输出I/O接口512的输出结果作为新的样本数据，并存入数据库530。当然，也可以不经过客户设备540进行采集，而是由I/O接口512直接将如图所示输入I/O接口512的输入数据及输出I/O接口512的输出结果，作为新的样本数据存入数据库530。
值得注意的是，图5仅是本申请实施例提供的一种系统架构的示意图，图中所示设备、器件、模块等之间的位置关系不构成任何限制，例如，在图5中，数据存储系统550相对执行设备510是外部存储器，在其它情况下，也可以将数据存储系统550置于执行设备510中。应理解，上述执行设备510可以部署于客户设备540中。
从模型的推理侧来说：
本申请实施例中，上述执行设备520的计算模块511可以获取到数据存储系统550中存储的代码来实 现本申请实施例中的和模型推理过程相关的步骤。
本申请实施例中，执行设备520的计算模块511可以包括硬件电路(如专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field-programmable gate array，FPGA)、通用处理器、数字信号处理器(digital signal processing，DSP)、微处理器或微控制器等等)、或这些硬件电路的组合，例如，训练设备520可以为具有执行指令功能的硬件系统，如CPU、DSP等，或者为不具有执行指令功能的硬件系统，如ASIC、FPGA等，或者为上述不具有执行指令功能的硬件系统以及具有执行指令功能的硬件系统的组合。
具体的，执行设备520的计算模块511可以为具有执行指令功能的硬件系统，本申请实施例提供的和模型推理过程相关的步骤可以为存储在存储器中的软件代码，执行设备520的计算模块511可以从存储器中获取到软件代码，并执行获取到的软件代码来实现本申请实施例提供的和模型推理过程相关的步骤。
应理解，执行设备520的计算模块511可以为不具有执行指令功能的硬件系统以及具有执行指令功能的硬件系统的组合，本申请实施例提供的和模型推理过程相关的步骤的部分步骤还可以通过执行设备520的计算模块511中不具有执行指令功能的硬件系统来实现，这里并不限定。
从模型的训练侧来说：
本申请实施例中，上述训练设备520可以获取到存储器(图5中未示出，可以集成于训练设备520或者与训练设备520分离部署)中存储的代码来实现本申请实施例中和模型训练相关的步骤。
本申请实施例中，训练设备520可以包括硬件电路(如专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field-programmable gate array，FPGA)、通用处理器、数字信号处理器(digital signal processing，DSP)、微处理器或微控制器等等)、或这些硬件电路的组合，例如，训练设备520可以为具有执行指令功能的硬件系统，如CPU、DSP等，或者为不具有执行指令功能的硬件系统，如ASIC、FPGA等，或者为上述不具有执行指令功能的硬件系统以及具有执行指令功能的硬件系统的组合。
应理解，训练设备520可以为不具有执行指令功能的硬件系统以及具有执行指令功能的硬件系统的组合，本申请实施例提供的中和模型训练相关的部分步骤还可以通过训练设备520中不具有执行指令功能的硬件系统来实现，这里并不限定。
由于本申请实施例涉及大量神经网络的应用，为了便于理解，下面先对本申请实施例涉及的相关术语及神经网络等相关概念进行介绍。
(1)神经网络
神经网络可以是由神经单元组成的，神经单元可以是指以xs(即输入数据)和截距1为输入的运算单元，该运算单元的输出可以为：
其中，s＝1、2、……n，n为大于1的自然数，Ws为xs的权重，b为神经单元的偏置。f为神经单元的激活函数(activation functions)，用于将非线性特性引入神经网络中，来将神经单元中的输入信号转换为输出信号。该激活函数的输出信号可以作为下一层卷积层的输入，激活函数可以是sigmoid函数。神经网络是将多个上述单一的神经单元联结在一起形成的网络，即一个神经单元的输出可以是另一个神经单元的输入。每个神经单元的输入可以与前一层的局部接受域相连，来提取局部接受域的特征，局部接受域可以是由若干个神经单元组成的区域。
(2)卷积神经网络(convolutional neuron network，CNN)是一种带有卷积结构的深度神经网络。卷积神经网络包含了一个由卷积层和子采样层构成的特征抽取器，该特征抽取器可以看作是滤波器。卷积层是指卷积神经网络中对输入信号进行卷积处理的神经元层。在卷积神经网络的卷积层中，一个神经元可以只与部分邻层神经元连接。一个卷积层中，通常包含若干个特征平面，每个特征平面可以由一些矩形排列的神经单元组成。同一特征平面的神经单元共享权重，这里共享的权重就是卷积核。共享权重可以理解为提取特征的方式与位置无关。卷积核可以以随机大小的矩阵的形式化，在卷积神经网络的训 练过程中卷积核可以通过学习得到合理的权重。另外，共享权重带来的直接好处是减少卷积神经网络各层之间的连接，同时又降低了过拟合的风险。
CNN是一种非常常见的神经网络，下面结合图6重点对CNN的结构进行详细的介绍。如前文的基础概念介绍所述，卷积神经网络是一种带有卷积结构的深度神经网络，是一种深度学习(deep learning)架构，深度学习架构是指通过机器学习的算法，在不同的抽象层级上进行多个层次的学习。作为一种深度学习架构，CNN是一种前馈(feed-forward)人工神经网络，该前馈人工神经网络中的各个神经元可以对输入其中的图像作出响应。
如图6所示，卷积神经网络(CNN)200可以包括输入层210，卷积层/池化层220(其中池化层为可选的)，以及全连接层(fully connected layer)230。
卷积层/池化层220：
卷积层：
如图6所示卷积层/池化层220可以包括如示例221-226层，举例来说：在一种实现中，221层为卷积层，222层为池化层，223层为卷积层，224层为池化层，225为卷积层，226为池化层；在另一种实现方式中，221、222为卷积层，223为池化层，224、225为卷积层，226为池化层。即卷积层的输出可以作为随后的池化层的输入，也可以作为另一个卷积层的输入以继续进行卷积操作。
下面将以卷积层221为例，介绍一层卷积层的内部工作原理。
卷积层221可以包括很多个卷积算子，卷积算子也称为核，其在图像处理中的作用相当于一个从输入图像矩阵中提取特定信息的过滤器，卷积算子本质上可以是一个权重矩阵，这个权重矩阵通常被预先定义，在对图像进行卷积操作的过程中，权重矩阵通常在输入图像上沿着水平方向一个像素接着一个像素(或两个像素接着两个像素……这取决于步长stride的取值)的进行处理，从而完成从图像中提取特定特征的工作。该权重矩阵的大小应该与图像的大小相关，需要注意的是，权重矩阵的纵深维度(depth dimension)和输入图像的纵深维度是相同的，在进行卷积运算的过程中，权重矩阵会延伸到输入图像的整个深度。因此，和一个单一的权重矩阵进行卷积会产生一个单一纵深维度的卷积化输出，但是大多数情况下不使用单一权重矩阵，而是应用多个尺寸(行×列)相同的权重矩阵，即多个同型矩阵。每个权重矩阵的输出被堆叠起来形成卷积图像的纵深维度，这里的维度可以理解为由上面所述的“多个”来决定。不同的权重矩阵可以用来提取图像中不同的特征，例如一个权重矩阵用来提取图像边缘信息，另一个权重矩阵用来提取图像的特定颜色，又一个权重矩阵用来对图像中不需要的噪点进行模糊化等。该多个权重矩阵尺寸(行×列)相同，经过该多个尺寸相同的权重矩阵提取后的特征图的尺寸也相同，再将提取到的多个尺寸相同的特征图合并形成卷积运算的输出。
这些权重矩阵中的权重值在实际应用中需要经过大量的训练得到，通过训练得到的权重值形成的各个权重矩阵可以用来从输入图像中提取信息，从而使得卷积神经网络200进行正确的预测。
当卷积神经网络200有多个卷积层的时候，初始的卷积层(例如221)往往提取较多的一般特征，该一般特征也可以称之为低级别的特征；随着卷积神经网络200深度的加深，越往后的卷积层(例如226)提取到的特征越来越复杂，比如高级别的语义之类的特征，语义越高的特征越适用于待解决的问题。
池化层：
由于常常需要减少训练参数的数量，因此卷积层之后常常需要周期性的引入池化层，在如图6中220所示例的221-226各层，可以是一层卷积层后面跟一层池化层，也可以是多层卷积层后面接一层或多层池化层。在图像处理过程中，池化层的唯一目的就是减少图像的空间大小。池化层可以包括平均池化算子和/或最大池化算子，以用于对输入图像进行采样得到较小尺寸的图像。平均池化算子可以在特定范围内对图像中的像素值进行计算产生平均值作为平均池化的结果。最大池化算子可以在特定范围内取该范围内值最大的像素作为最大池化的结果。另外，就像卷积层中用权重矩阵的大小应该与图像尺寸相关一样，池化层中的运算符也应该与图像的大小相关。通过池化层处理后输出的图像尺寸可以小于输入池化层的图像的尺寸，池化层输出的图像中每个像素点表示输入池化层的图像的对应子区域的平均值或最大值。
全连接层230：
在经过卷积层/池化层220的处理后，卷积神经网络200还不足以输出所需要的输出信息。因为如前所 述，卷积层/池化层220只会提取特征，并减少输入图像带来的参数。然而为了生成最终的输出信息(所需要的类信息或其他相关信息)，卷积神经网络200需要利用全连接层230来生成一个或者一组所需要的类的数量的输出。因此，在全连接层230中可以包括多层隐含层(如图6所示的231、232至23n)，该多层隐含层中所包含的参数可以根据具体的任务类型的相关训练数据进行预先训练得到，例如该任务类型可以包括图像识别，图像分类，图像超分辨率重建等等……
在全连接层230中的多层隐含层之后，也就是整个卷积神经网络200的最后层为输出层240，该输出层240具有类似分类交叉熵的损失函数，具体用于计算预测误差，一旦整个卷积神经网络200的前向传播(如图6由210至240方向的传播为前向传播)完成，反向传播(如图6由240至210方向的传播为反向传播)就会开始更新前面提到的各层的权重值以及偏差，以减少卷积神经网络200的损失，及卷积神经网络200通过输出层输出的结果和理想结果之间的误差。
需要说明的是，如图6所示的卷积神经网络200仅作为一种卷积神经网络的示例，在具体的应用中，卷积神经网络还可以以其他网络模型的形式存在，例如，仅包括图6中所示的网络结构的一部分，比如，本申请实施例中所采用的卷积神经网络可以仅包括输入层210、卷积层/池化层220和输出层240。
需要说明的是，如图6所示的卷积神经网络100仅作为一种卷积神经网络的示例，在具体的应用中，卷积神经网络还可以以其他网络模型的形式存在，例如，如图7所示的多个卷积层/池化层并行，将分别提取的特征均输入给全连接层230进行处理。
(3)深度神经网络
深度神经网络(Deep Neural Network，DNN)，也称多层神经网络，可以理解为具有很多层隐含层的神经网络，这里的“很多”并没有特别的度量标准。从DNN按不同层的位置划分，DNN内部的神经网络可以分为三类：输入层，隐含层，输出层。一般来说第一层是输入层，最后一层是输出层，中间的层数都是隐含层。层与层之间是全连接的，也就是说，第i层的任意一个神经元一定与第i+1层的任意一个神经元相连。虽然DNN看起来很复杂，但是就每一层的工作来说，其实并不复杂，简单来说就是如下线性关系表达式：其中，是输入向量，是输出向量，是偏移向量，W是权重矩阵(也称系数)，α()是激活函数。每一层仅仅是对输入向量经过如此简单的操作得到输出向量由于DNN层数多，则系数W和偏移向量的数量也就很多了。这些参数在DNN中的定义如下所述：以系数W为例：假设在一个三层的DNN中，第二层的第4个神经元到第三层的第2个神经元的线性系数定义为上标3代表系数W所在的层数，而下标对应的是输出的第三层索引2和输入的第二层索引4。总结就是：第L-1层的第k个神经元到第L层的第j个神经元的系数定义为需要注意的是，输入层是没有W参数的。在深度神经网络中，更多的隐含层让网络更能够刻画现实世界中的复杂情形。理论上而言，参数越多的模型复杂度越高，“容量”也就越大，也就意味着它能完成更复杂的学习任务。训练深度神经网络的也就是学习权重矩阵的过程，其最终目的是得到训练好的深度神经网络的所有层的权重矩阵(由很多层的向量W形成的权重矩阵)。
(4)反向传播算法
卷积神经网络可以采用误差反向传播(back propagation，BP)算法在训练过程中修正初始的超分辨率模型中参数的大小，使得超分辨率模型的重建误差损失越来越小。具体地，前向传递输入信号直至输出会产生误差损失，通过反向传播误差损失信息来更新初始的超分辨率模型中参数，从而使误差损失收敛。反向传播算法是以误差损失为主导的反向传播运动，旨在得到最优的超分辨率模型的参数，例如权重矩阵。
(5)损失函数
在训练深度神经网络的过程中，因为希望深度神经网络的输出尽可能的接近真正想要预测的值，所以可以通过比较当前网络的预测值和真正想要的目标值，再根据两者之间的差异情况来更新每一层神经网络的权重向量(当然，在第一次更新之前通常会有初始化的过程，即为深度神经网络中的各层预先配置参数)，比如，如果网络的预测值高了，就调整权重向量让它预测低一些，不断地调整，直到深度神经网络能够预测出真正想要的目标值或与真正想要的目标值非常接近的值。因此，就需要预先定义“如何比较预测值和目标值之间的差异”，这便是损失函数(loss function)或目标函数(objective function)，它们 是用于衡量预测值和目标值的差异的重要方程。其中，以损失函数举例，损失函数的输出值(loss)越高表示差异越大，那么深度神经网络的训练就变成了尽可能缩小这个loss的过程。
为了解决上述问题，本申请实施例提供了一种数据处理方法。下面结合附图对本申请实施例的数据处理方法进行详细的介绍。
参照图8，图8为本申请实施例提供的一种数据处理方法的流程示意，如图8所示，本申请实施例提供的一种数据处理方法，可以包括步骤801至803，下面分别对这些步骤进行详细的描述。
801、获取第一扰动，所述第一扰动的秩小于训练数据的秩；所述第一扰动用于和所述训练数据融合得到第一数据。
其中，训练样本可以为图像数据、文本数据、视频数据或者是推荐领域相关的目标数据，目标数据可以为用户的属性信息、物品的属性信息以及和推荐场景相关的信息，例如可以为用户的操作偏置相关的信息，例如推荐界面的信息、物品的推荐位置等会对用户的操作行为造成影响的信息。
本申请实施例中，步骤801的执行主体可以为终端设备，终端设备可以为便携式移动设备，例如但不限于移动或便携式计算设备(如智能手机)、个人计算机、服务器计算机、手持式设备(例如平板)或膝上型设备、多处理器系统、游戏控制台或控制器、基于微处理器的系统、机顶盒、可编程消费电子产品、移动电话、具有可穿戴或配件形状因子(例如，手表、眼镜、头戴式耳机或耳塞)的移动计算和/或通信设备、网络PC、小型计算机、大型计算机、包括上面的系统或设备中的任何一种的分布式计算环境等等。
本申请实施例中，步骤801的执行主体可以为云侧的服务器，服务器可以接收来自终端设备发送的用户的操作数据，进而服务器可以获取到用户的操作数据。
为了方便描述，以下不对执行主体的形态进行区分，都描述为训练设备。
在一种可能的实现中，机器学习模型可以实现计算机视觉相关的任务，例如目标检测、图像分类、图像分割等。
在一种可能的实现中，机器学习模型可以为推荐模型，推荐模型实现的任务可以为如下任务的多种：购买行为预测、加购物车行为预测、分享行为预测、浏览行为预测、完播率预测、点赞预测、收藏预测、点击预测以及点击转化预测。
在一种可能的实现中，在对推荐模型进行训练时，需要获取到训练样本，以推荐模型为例，所述训练样本可以包括用户和物品的属性信息，属性信息可以为用户的操作数据。
其中，用户的操作数据可以基于用户与物品之间的交互记录(例如用户的行为日志)得到，该操作数据可以包括用户对各个物品的真实操作记录，操作数据可以包括用户的属性信息、各个物品的属性信息信息以及所述用户对所述多个物品进行的操作的操作类型(例如点击、下载等等)。
其中，用户的属性信息可以为与用户喜好特征相关的属性，性别、年龄、职业、收入、爱好以及受教育程度中的至少一种，其中，性别可以为男或者女，年龄可以为0-100之间的数字，职业可以为教师、程序员、厨师等等，爱好可以为篮球、网球、跑步等等，受教育程度可以为小学、初中、高中、大学等等；本申请并不限定用户的属性信息的具体类型。
其中，物品可以为实体物品，或者是虚拟物品，例如可以为应用程序(application，APP)、音视频、网页以及新闻资讯等物品，物品的属性信息可以为物品名称、开发者、安装包大小、品类以及好评度中的至少一种，其中，以物品为应用程序为例，物品的品类可以为聊天类、跑酷类游戏、办公类等等，好评度可以为针对于物品的打分、评论等；本申请并不限定物品的属性信息的具体类型。
在对抗训练中，通过在训练样本上增加有效的扰动，使得训练后的模型在处理针对于施加的扰动的数据时具备较好的鲁棒性。
以图像数据为例，在图片中，常常存在一些虚假特征，也就是会对模型处理结果造成负面影响的特征，例如在图像分类的任务中，与物体的类别无关信息通常出现在背景当中；其次，不同训练域的虚假特征通常也是该训练域中样本的共有虚假特征。基于此观察，本发明对现有的对抗训练进行改进。具体的，可以特别对训练样本中会对模型处理任务造成负面影响的特征施加扰动，进而使得模型对于这部分虚假特征具备较高的抗干扰性。
在一种可能的实现中，可以获取到训练样本的第一扰动，该第一扰动的秩小于训练数据的秩，在扰 动中引入了低秩的结构，有助于更好地捕捉并滤除低秩的虚假信息(或者可以称之为虚假特征)，其中，虚假信息可以理解为对模型实现的任务存在负向影响的信息。这是因为虚假信息大多分布在一个低维子空间中，以图像数据为例，背景、风格信息等大多分布在一个低维子空间中，本申请通过将施加到训练样本上的扰动设置为低秩数据，可以有效的对训练样本中的虚假特征施加扰动，进而可以增加训练后的模型对于数据中虚假特征的鲁棒性。现有技术中的对抗训练中的扰动通常只是简单地使用一个与图片维度相同的随机扰动，并没有利用虚假信息是低秩的这一特点，因此并不能有效的对训练样本中的虚假特征施加扰动。
接下来介绍第一扰动：
在一种可能的实现中，第一扰动可以为和每个训练样本尺寸一致的数据，例如可以为和训练样本尺寸一致的矩阵或者张量。第一扰动的秩小于训练样本的秩。
在一种可能的实现中，训练样本可以包括多个样本，该多个样本可以为同一个领域的样本，所谓同一个领域，可以理解为多个样本的分布相似或者一致，分布可以为随机高斯分布等。以包括猫的图像为例，卡通类型的包括猫的图像可以认为是同一个领域，而对实物拍摄得到的包括猫的图像可以认为是同一个领域。
在一种可能的实现中，所述训练数据包括多个样本，第一扰动可以作为多个样本共享的扰动，也就是说，第一扰动可以分别施加到多个样本上，通过令同一训练域的样本共享相同的扰动，有助于捕捉到领域中数据所共有的领域虚假特征，领域内共享多个扰动，有助于建模更为复杂的虚假领域特征。而普通对抗训练对不同的样本使用不同的扰动，忽略了领域虚假特征在领域内的普遍性。由于多个样本仅使用一个共同的扰动(第一扰动)，相比于现有技术中每个样本使用各自的扰动，除了可以有助于捕捉到领域中数据所共有的领域虚假特征之外，还大大降低了扰动的秩的数值。
在一种可能的实现中，所述第一扰动用于和所述训练数据融合得到第一数据，也就是说，所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
在一种可能的实现中，第一扰动相比于所述多个样本中每个样本来说，第一扰动的秩小于多个样本中每个样本的秩，也就是说，除了在数量维度上扰动的数量远远低于样本的数量，在空间维度上，扰动的秩也是低于每个样本的秩的。
在一种可能的实现中，第一扰动的秩可以低于样本的秩的1/2，例如第一扰动的秩可以为样本的秩的1/10或者接近于1/10，例如第一扰动的秩可以为样本的秩的1/20或者接近于1/20，例如第一扰动的秩可以为样本的秩的1/9或者接近于1/9，例如第一扰动的秩可以为样本的秩的1/8或者接近于1/8，例如第一扰动的秩可以为样本的秩的1/7或者接近于1/7，例如第一扰动的秩可以为样本的秩的1/6或者接近于1/6，例如第一扰动的秩可以为样本的秩的1/5或者接近于1/5，例如第一扰动的秩可以为样本的秩的1/4或者接近于1/4，例如第一扰动的秩可以为样本的秩的1/3或者接近于1/3，例如第一扰动的秩可以为样本的秩的1/2或者接近于1/2。
接下来介绍如何构建第一扰动。
在一种可能的实现中，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。通过多个低秩矩阵的乘积来构建扰动，由于后续更新时是对多个低秩矩阵的参数进行更新，可以增加扰动构建的复杂性，从而可以增加扰动的有效性。
例如可以为多个尺寸相同的矩阵的乘积，接下来以两个矩阵进行乘积运算来构建扰动为例进行说明：
首先可以获取获取不同领域的带标签的训练数据(x,y)。对于每个训练域的数据，执行如下操作：在每个训练域随机初始化两个低秩矩阵A和B，并计算它们的乘积δ＝AB。其中A和B的秩均小于等于l，l为训练数据的秩。计算对抗样本xadv＝x+δ，并利用对抗样本计算损失函数L(f(xadv),y)。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为基于权重的凸组合。通过多个低秩矩阵的基于权重的凸组合来构建扰动，由于后续更新时是对多个低秩矩阵的参数进行更新(可选的，还可以更新权重)，可以增加扰动构建的复杂性，从而可以增加扰动的有效性。
在一种可能的实现中，可以获取不同领域的带标签的训练数据(x,y)。对于每个训练域的数据，执行如下操作：在每个训练域随机初始化k个扰动δi及其系数αi，并计算它们的线性凸组合计算对抗样本xadv＝x+δ，并利用对抗样本计算损失函数L(f(xadv),y)。
在一种可能的实现中，所述训练数据为单一的样本，例如可以为一张图像。也就是对每个单一的训练样本均构建对应的扰动，但是该扰动的秩小于训练样本的秩。
802、根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
在一种可能的实现中，可以根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动，其中，更新可以为梯度上升。
在一种可能的实现中，在通过多个扰动数据构建第一损失时，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
示例性的，以通过基于权重的凸组合对多个扰动数据进行融合来构建第一损失为例，可以通过进行PGD梯度上升，来更新扰动参数：将更新后的扰动重新注入到训练样本上，得到新的对抗样本x′adv＝x+δ′，并计算损失函数L(f(x′adv),y)。并更新模型重复上述步骤直至模型收敛或达到预定的训练迭代次数。
示例性的，以通过基于矩阵乘积的方式对多个扰动数据进行融合来构建第一损失为例，可以通过进行PGD梯度上升，更新扰动参数：Step 5.将更新后的扰动δ′＝A′B′重新注入到样本上，得到新的对抗样本x′adv＝x+δ′，并计算损失函数L(f(x′adv),y)。更新模型重复上述步骤，直至模型收敛或达到预定的训练迭代次数。
在一种可能的实现中，在得到第二扰动之后，除了可以直接更新机器学习模型之外，还可以将第二扰动(或者是将第二扰动和训练数据融合得到第二数据)作为训练样本，传递至用户，相当于本申请实施例可作为训练样本的提供方，基于用户指定的原始训练样本和待训练的模型，来构建更有效的优化后的训练样本，并反馈至用户。
本申请实施例提供了一种数据处理方法，包括：获取第一扰动，所述第一扰动的秩小于训练数据的秩；所述第一扰动用于和所述训练数据融合得到第一数据；根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。在扰动中引入了低秩的结构，有助于更好地捕捉并滤除低秩的虚假信息(或者可以称之为虚假特征)，其中，虚假信息可以理解为对模型实现的任务存在负向影响的信息。这是因为虚假信息大多分布在一个低维子空间中，以图像数据为例，背景、风格信息等大多分布在一个低维子空间中，本申请通过将施加到训练样本上的扰动设置为低秩数据，可以有效的对训练样本中的虚假特征施加扰动，进而可以增加训练后的模型对于数据中虚假特征的鲁棒性，进而实现良好的OOD性能。
接下来结合一个具体的示例介绍本申请实施例中的数据处理方法：
以经典的分布外泛化数据集PACS上的分类任务为例，对本发明的实施进行详细介绍。介绍分为两个部分。第一部分为数据集介绍，第二部分为算法实施流程介绍。
数据集介绍：
PACS数据集包括P(Photos)、A(Arts)、C(Cartoon)、S(Sketch)四个领域的数据，这四个领域的图片分别具有不同的领域风格特征：(1)领域P：现实世界中拍摄的图片。(2)领域A：艺术绘画作品。(3)领域C：卡通绘图作品。(4)领域S：黑白简笔画。该数据集包含7个类别。
算法实施流程介绍
为了验证模型的OOD性能，在P/A/C/S四个领域中取出三个领域作为训练域，将第四个领域作为测试域测试分类性能。重复以下步骤直至测出在所有四个领域上的分类性能。
Step 1.对数据进行预处理：将所选的三个领域的数据作为训练集，使用Python深度学习框架Pytorch对图片进行标准化：RGB三通道的均值和标准差分别采用[0.229,0.224,0.225]和[0.485,0.456,0.406](来自视觉图片大数据集ImageNet)。同时，进行随机裁剪、颜色抖动、水平翻转等数据增强，以增加模型的鲁棒性和泛化性能。
Step 2.对不同训练域的数据，执行如下操作：
方案A：多扰动线性组合对抗训练MAT：在每个训练域使用torch.randn()函数随机初始化k个扰动δi及其系数αi，并计算它们的线性凸组合其中αi在随机初始化后还需通过torch.softmax()函数来将随机生成的取值区间[-1,1]变为非负的权重区间[0,1]。方案B：低秩分解对抗训练LDAT：在每个训练域使用torch.randn()函数随机初始化两个低秩矩阵A和B，并计算它们的乘积δ＝AB。其中A和B的秩均小于等于l。
Step 3.计算对抗样本xadv＝x+δ，并利用对抗样本计算损失函数L(f(xadv),y)。损失函数为交叉熵损失函数。
Step 4.进行PGD梯度上升，更新扰动参数：方案A： 方案B：在此步骤中，求微分操作利用Pytorch的torch.autograd.grad()函数实现。
Step 5.将更新后的扰动δ′重新注入到样本上，得到新的对抗样本x′adv＝x+δ′，并计算损失函数L(f(x′adv),y)(交叉熵损失函数)。同时利用Pytorch的自动求微分和反向传播函数loss.backward()和optimizer.step()实现对模型的更新。训练采用的优化器为Adam优化器。
Step 6.重复Step 1.～5.，直至达到预定的迭代次数。
Step 7.在第四个领域上测试分类性能。
在上述实例中，通过引入并求解具有低秩结构的扰动，对不同领域的领域虚假特征(如风格、背景信息)进行了建模，同时通过使用注入了这种低秩扰动的对抗样本进行对抗训练，实现了对领域虚假特征的滤除，从而使得模型能够捕捉物体的真正特征(如形状、轮廓信息)，进而实现良好的OOD性能。参照表1，表1为在PACS、OfficeHome、VLCS、NICO、Colored MNIST数据集上的测试准确率及与现有算法的比较。
表1
此外，本申请实施例还提供了一种数据处理方法，所述方法包括：获取第一扰动，所述第一扰动用于将扰动作用于图像样本中的背景信息和/或风格信息区域；所述第一扰动用于和所述图像样本融合得到第一数据；根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学 习模型进行更新。
在一种可能的实现中，可以获取到训练样本的第一扰动，该第一扰动的秩小于训练数据的秩，在扰动中引入了低秩的结构，有助于更好地捕捉并滤除低秩的虚假信息(或者可以称之为虚假特征)，其中，虚假信息可以理解为对模型实现的任务存在负向影响的信息。这是因为虚假信息大多分布在一个低维子空间中，以图像数据为例，背景、风格信息等大多分布在一个低维子空间中，本申请通过将施加到训练样本上的扰动设置为低秩数据，可以有效的对训练样本中的虚假特征施加扰动，进而可以增加训练后的模型对于数据中虚假特征的鲁棒性。现有技术中的对抗训练中的扰动通常只是简单地使用一个与图片维度相同的随机扰动，并没有利用虚假信息是低秩的这一特点，因此并不能有效的对训练样本中的虚假特征施加扰动。
在一种可能的实现中，所述第一扰动的秩小于图像样本的秩。
在一种可能的实现中，所述第一扰动的秩小于图像样本的秩的二分之一。
在一种可能的实现中，所述图像样本包括多个样本；所述第一扰动用于和图像样本融合得到第一数据，包括：所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
在一种可能的实现中，所述多个样本中不同的数据为相同领域的数据。
在一种可能的实现中，所述多个样本中的每个样本与所述第一扰动的尺寸相同。
在一种可能的实现中，所述第一扰动的秩小于所述多个样本中每个样本的秩。
在一种可能的实现中，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩；所述损失用于对所述第一扰动进行更新，包括：所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为基于权重的凸组合。
在一种可能的实现中，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新，包括：
所述损失用于对所述多个扰动数据中的每个扰动数据以及所述权重进行更新。
在一种可能的实现中，所述图像样本为单一的样本。
在一种可能的实现中，所述损失用于对所述第一扰动进行更新，包括：
所述损失用于对所述第一扰动进行基于梯度上升的更新。
参照图9，图9为本申请实施例提供的一种数据处理装置的结构示意，如图9所示，本申请实施例提供的一种数据处理装置900，包括：
处理模块901，用于获取第一扰动，所述第一扰动的秩小于训练数据的秩；所述第一扰动用于和所述训练数据融合得到第一数据；
根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
其中，关于处理模块901的具体描述可以参照上述实施例中步骤801的描述，这里不再赘述。
在一种可能的实现中，可以获取到训练样本的第一扰动，该第一扰动的秩小于训练数据的秩，在扰动中引入了低秩的结构，有助于更好地捕捉并滤除低秩的虚假信息(或者可以称之为虚假特征)，其中，虚假信息可以理解为对模型实现的任务存在负向影响的信息。这是因为虚假信息大多分布在一个低维子空间中，以图像数据为例，背景、风格信息等大多分布在一个低维子空间中，本申请通过将施加到训练样本上的扰动设置为低秩数据，可以有效的对训练样本中的虚假特征施加扰动，进而可以增加训练后的模型对于数据中虚假特征的鲁棒性。现有技术中的对抗训练中的扰动通常只是简单地使用一个与图片维度相同的随机扰动，并没有利用虚假信息是低秩的这一特点，因此并不能有效的对训练样本中的虚假特征施加扰动。
在一种可能的实现中，所述第一扰动的秩小于训练数据的秩的二分之一。
在一种可能的实现中，所述训练数据包括多个样本；所述第一扰动用于和训练数据融合得到第一数据，包括：所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
在一种可能的实现中，所述多个样本中不同的数据为相同领域的数据。
在一种可能的实现中，所述多个样本中的每个样本与所述第一扰动的尺寸相同。
在一种可能的实现中，所述第一扰动的秩小于所述多个样本中每个样本的秩。
在一种可能的实现中，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩；所述损失用于对所述第一扰动进行更新，包括：所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为基于权重的凸组合。
在一种可能的实现中，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新，包括：
所述损失用于对所述多个扰动数据中的每个扰动数据以及所述权重进行更新。
在一种可能的实现中，所述训练数据为单一的样本。
在一种可能的实现中，所述训练数据为如下的一种或多种：
一个或多个图像样本、一个或多个文本样本、一个或多个视频样本、和推荐相关的目标数据，所述目标数据包括用户的属性信息、物品的属性信息、和推荐场景相关的信息。
在一种可能的实现中，所述损失用于对所述第一扰动进行更新，包括：
所述损失用于对所述第一扰动进行基于梯度上升的更新。
此外，本申请还提供了一种数据处理装置，所述装置包括：
处理模块，用于获取第一扰动，所述第一扰动用于将扰动作用于图像样本中的背景信息和/或风格信息区域；所述第一扰动用于和所述图像样本融合得到第一数据；
根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
在一种可能的实现中，可以获取到训练样本的第一扰动，该第一扰动的秩小于训练数据的秩，在扰动中引入了低秩的结构，有助于更好地捕捉并滤除低秩的虚假信息(或者可以称之为虚假特征)，其中，虚假信息可以理解为对模型实现的任务存在负向影响的信息。这是因为虚假信息大多分布在一个低维子空间中，以图像数据为例，背景、风格信息等大多分布在一个低维子空间中，本申请通过将施加到训练样本上的扰动设置为低秩数据，可以有效的对训练样本中的虚假特征施加扰动，进而可以增加训练后的模型对于数据中虚假特征的鲁棒性。现有技术中的对抗训练中的扰动通常只是简单地使用一个与图片维度相同的随机扰动，并没有利用虚假信息是低秩的这一特点，因此并不能有效的对训练样本中的虚假特征施加扰动。
在一种可能的实现中，所述第一扰动的秩小于图像样本的秩。
在一种可能的实现中，所述第一扰动的秩小于图像样本的秩的二分之一。
在一种可能的实现中，所述图像样本包括多个样本；所述第一扰动用于和图像样本融合得到第一数据，包括：所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
在一种可能的实现中，所述多个样本中不同的数据为相同领域的数据。
在一种可能的实现中，所述多个样本中的每个样本与所述第一扰动的尺寸相同。
在一种可能的实现中，所述第一扰动的秩小于所述多个样本中每个样本的秩。
在一种可能的实现中，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩；所述损失用于对所述第一扰动进行更新，包括：所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。
在一种可能的实现中，所述扰动数据为矩阵，所述融合为基于权重的凸组合。
在一种可能的实现中，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新，包括：
所述损失用于对所述多个扰动数据中的每个扰动数据以及所述权重进行更新。
在一种可能的实现中，所述图像样本为单一的样本。
在一种可能的实现中，所述损失用于对所述第一扰动进行更新，包括：
所述损失用于对所述第一扰动进行基于梯度上升的更新。
接下来介绍本申请实施例提供的一种执行设备，请参阅图10，图10为本申请实施例提供的执行设备的一种结构示意图，执行设备1000具体可以表现为虚拟现实VR设备、手机、平板、笔记本电脑、智能穿戴设备、监控数据处理设备或服务器等，此处不做限定。具体的，执行设备1000包括：接收器1001、发射器1002、处理器1003和存储器1004(其中执行设备1000中的处理器1003的数量可以一个或多个，图10中以一个处理器为例)，其中，处理器1003可以包括应用处理器10031和通信处理器10032。在本申请的一些实施例中，接收器1001、发射器1002、处理器1003和存储器1004可通过总线或其它方式连接。
存储器1004可以包括只读存储器和随机存取存储器，并向处理器1003提供指令和数据。存储器1004的一部分还可以包括非易失性随机存取存储器(non-volatile random access memory，NVRAM)。存储器1004存储有处理器和操作指令、可执行模块或者数据结构，或者它们的子集，或者它们的扩展集，其中，操作指令可包括各种操作指令，用于实现各种操作。
处理器1003控制执行设备的操作。具体的应用中，执行设备的各个组件通过总线系统耦合在一起，其中总线系统除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都称为总线系统。
上述本申请实施例揭示的方法可以应用于处理器1003中，或者由处理器1003实现。处理器1003可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1003中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1003可以是通用处理器、数字信号处理器(digital signal processing，DSP)、微处理器或微控制器，还可进一步包括专用集成电路(application specific integrated circuit，ASIC)、现场可编程门阵列(field-programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。该处理器1003可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1004，处理器1003读取存储器1004中的信息，结合其硬件完成上述方法中涉及模型推理过程的步骤。
接收器1001可用于接收输入的数字或字符信息，以及产生与执行设备的相关设置以及功能控制有关的信号输入。发射器1002可用于通过第一接口输出数字或字符信息；发射器1002还可用于通过第一接口向磁盘组发送指令，以修改磁盘组中的数据；发射器1002还可以包括显示屏等显示设备。
本申请实施例还提供了一种训练设备，请参阅图11，图11是本申请实施例提供的训练设备一种结构示意图，具体的，训练设备1100由一个或多个服务器实现，训练设备1100可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器(central processing units，CPU)1111(例如，一个或一个以上处理器)和存储器1132，一个或一个以上存储应用程序1142或数据1144的存储介质1130(例如一个或一个以上海量存储设备)。其中，存储器1132和存储介质1130可以是短暂存储或持久存储。存储在存储介质1130的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对训练设备中的一系列指令操作。更进一步地，中央处理器1111可以设置为与存储介质1130通信，在训练设备1100上执行存储介质1130中的一系列指令操作。
训练设备1100还可以包括一个或一个以上电源1126，一个或一个以上有线或无线网络接口1150，一个或一个以上输入输出接口1158；或，一个或一个以上操作系统1141，例如Windows ServerTM，Mac OS XTM，UnixTM,LinuxTM，FreeBSDTM等等。
本申请实施例中，中央处理器1111，用于执行上述实施例中和模型训练相关的动作。
本申请实施例中还提供一种包括计算机程序产品，当其在计算机上运行时，使得计算机执行如前述执行设备所执行的步骤，或者，使得计算机执行如前述训练设备所执行的步骤。
本申请实施例中还提供一种计算机可读存储介质，该计算机可读存储介质中存储有用于进行信号处理的程序，当其在计算机上运行时，使得计算机执行如前述执行设备所执行的步骤，或者，使得计算机执行如前述训练设备所执行的步骤。
本申请实施例提供的执行设备、训练设备或终端设备具体可以为芯片，芯片包括：处理单元和通信单元，所述处理单元例如可以是处理器，所述通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指令，以使执行设备内的芯片执行上述实施例描述的数据处理方法，或者，以使训练设备内的芯片执行上述实施例描述的数据处理方法。可选地，所述存储单元为所述芯片内的存储单元，如寄存器、缓存等，所述存储单元还可以是所述无线接入设备端内的位于所述芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。
具体的，请参阅图12，图12为本申请实施例提供的芯片的一种结构示意图，所述芯片可以表现为神经网络处理器NPU 1200，NPU 1200作为协处理器挂载到主CPU(Host CPU)上，由Host CPU分配任务。NPU的核心部分为运算电路1203，通过控制器1204控制运算电路1203提取存储器中的矩阵数据并进行乘法运算。
在一些实现中，运算电路1203内部包括多个处理单元(Process Engine,PE)。在一些实现中，运算电路1203是二维脉动阵列。运算电路1203还可以是一维脉动阵列或者能够执行例如乘法和加法这样的数学运算的其它电子线路。在一些实现中，运算电路1203是通用的矩阵处理器。
举例来说，假设有输入矩阵A，权重矩阵B，输出矩阵C。运算电路从权重存储器1202中取矩阵B相应的数据，并缓存在运算电路中每一个PE上。运算电路从输入存储器1201中取矩阵A数据与矩阵B进行矩阵运算，得到的矩阵的部分结果或最终结果，保存在累加器(accumulator)1208中。
统一存储器1206用于存放输入数据以及输出数据。权重数据直接通过存储单元访问控制器(Direct Memory Access Controller，DMAC)1205，DMAC被搬运到权重存储器1202中。输入数据也通过DMAC被搬运到统一存储器1206中。
BIU为Bus Interface Unit即，总线接口单元1210，用于AXI总线与DMAC和取指存储器(Instruction Fetch Buffer，IFB)1209的交互。
总线接口单元1210(Bus Interface Unit，简称BIU)，用于取指存储器1209从外部存储器获取指令，还用于存储单元访问控制器1205从外部存储器获取输入矩阵A或者权重矩阵B的原数据。
DMAC主要用于将外部存储器DDR中的输入数据搬运到统一存储器1206或将权重数据搬运到权重存储器1202中或将输入数据数据搬运到输入存储器1201中。
向量计算单元1207包括多个运算处理单元，在需要的情况下，对运算电路1203的输出做进一步处理，如向量乘，向量加，指数运算，对数运算，大小比较等等。主要用于神经网络中非卷积/全连接层网络计算，如Batch Normalization(批归一化)，像素级求和，对特征平面进行上采样等。
在一些实现中，向量计算单元1207能将经处理的输出的向量存储到统一存储器1206。例如，向量计算单元1207可以将线性函数；或，非线性函数应用到运算电路1203的输出，例如对卷积层提取的特征平面进行线性插值，再例如累加值的向量，用以生成激活值。在一些实现中，向量计算单元1207生成归一化的值、像素级求和的值，或二者均有。在一些实现中，处理过的输出的向量能够用作到运算电路1203的激活输入，例如用于在神经网络中的后续层中的使用。
控制器1204连接的取指存储器(instruction fetch buffer)1209，用于存储控制器1204使用的指令；
统一存储器1206，输入存储器1201，权重存储器1202以及取指存储器1209均为On-Chip存储器。外部存储器私有于该NPU硬件架构。
其中，上述任一处提到的处理器，可以是一个通用中央处理器，微处理器，ASIC，或一个或多个用于控制上述程序执行的集成电路。
另外需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本申请提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过专用硬件包括专用集成电路、专用CPU、专用存储器、专用元器件等来实现。一般情况下，凡由计算机程序完成的功能都可以很容易地用相应的硬件来实现，而且，用来实现同一功能的具体硬件结构也可以是多种多样的，例如模拟电路、数字电路或专用电路等。但是，对本申请而言更多情况下软件程序实现是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘、U盘、移动硬盘、ROM、RAM、磁碟或者光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，训练设备，或者网络设备等)执行本申请各个实施例所述的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、训练设备或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、训练设备或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的训练设备、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。

Claims (31)

  1. 一种数据处理方法，其特征在于，所述方法包括：
    获取第一扰动，所述第一扰动的秩小于训练数据的秩；所述第一扰动用于和所述训练数据融合得到第一数据；
    根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
  2. 根据权利要求1所述的方法，其特征在于，所述第一扰动的秩小于训练数据的秩的二分之一。
  3. 根据权利要求1或2所述的方法，其特征在于，所述训练数据包括多个样本；所述第一扰动用于和训练数据融合得到第一数据，包括：
    所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
  4. 根据权利要求3所述的方法，其特征在于，所述多个样本中不同的数据为相同领域的数据。
  5. 根据权利要求3或4所述的方法，其特征在于，所述多个样本中的每个样本与所述第一扰动的尺寸相同。
  6. 根据权利要求2至5任一所述的方法，其特征在于，所述第一扰动的秩小于所述多个样本中每个样本的秩。
  7. 根据权利要求2至6任一所述的方法，其特征在于，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩；所述损失用于对所述第一扰动进行更新，包括：
    所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
  8. 根据权利要求7所述的方法，其特征在于，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。
  9. 根据权利要求7所述的方法，其特征在于，所述扰动数据为矩阵，所述融合为基于权重的凸组合。
  10. 根据权利要求9所述的方法，其特征在于，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新，包括：
    所述损失用于对所述多个扰动数据中的每个扰动数据以及所述权重进行更新。
  11. 根据权利要求1所述的方法，其特征在于，所述训练数据为单一的样本。
  12. 根据权利要求1至11任一所述的方法，其特征在于，所述训练数据为如下的一种或多种：
    一个或多个图像样本、一个或多个文本样本、一个或多个视频样本、和推荐相关的目标数据，所述目标数据包括用户的属性信息、物品的属性信息、和推荐场景相关的信息。
  13. 根据权利要求1至12任一所述的方法，其特征在于，所述损失用于对所述第一扰动进行更新，包括：
    所述损失用于对所述第一扰动进行基于梯度上升的更新。
  14. 一种数据处理方法，其特征在于，所述方法包括：
    获取第一扰动，所述第一扰动用于将扰动作用于图像样本中的背景信息和/或风格信息；所述第一扰动用于和所述图像样本融合得到第一数据；
    根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
  15. 一种数据处理装置，其特征在于，所述装置包括：
    处理模块，用于获取第一扰动，所述第一扰动的秩小于训练数据的秩；所述第一扰动用于和所述训练数据融合得到第一数据；
    根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
  16. 根据权利要求15所述的装置，其特征在于，所述第一扰动的秩小于训练数据的秩的二分之一。
  17. 根据权利要求15或16所述的装置，其特征在于，所述训练数据包括多个样本；所述第一扰动用于和训练数据融合得到第一数据，包括：
    所述第一扰动用于和所述多个样本中的每个样本分别进行融合，得到第一数据，所述第一数据包括多个融合后的数据。
  18. 根据权利要求17所述的装置，其特征在于，所述多个样本中不同的数据为相同领域的数据。
  19. 根据权利要求17或18所述的装置，其特征在于，所述多个样本中的每个样本与所述第一扰动的尺寸相同。
  20. 根据权利要求17至19任一所述的装置，其特征在于，所述第一扰动的秩小于所述多个样本中每个样本的秩。
  21. 根据权利要求17至20任一所述的装置，其特征在于，所述第一扰动具体为通过将多个扰动数据进行融合得到的，每个所述扰动数据的秩小于或等于所述多个样本中每个样本的秩；所述损失用于对所述第一扰动进行更新，包括：
    所述损失用于对所述多个扰动数据中的每个扰动数据进行更新。
  22. 根据权利要求21所述的装置，其特征在于，所述扰动数据为矩阵，所述融合为矩阵的乘积运算。
  23. 根据权利要求21所述的装置，其特征在于，所述扰动数据为矩阵，所述融合为基于权重的凸组合。
  24. 根据权利要求23所述的装置，其特征在于，所述损失用于对所述多个扰动数据中的每个扰动数据进行更新，包括：
    所述损失用于对所述多个扰动数据中的每个扰动数据以及所述权重进行更新。
  25. 根据权利要求16所述的装置，其特征在于，所述训练数据为单一的样本。
  26. 根据权利要求16至25任一所述的装置，其特征在于，所述训练数据为如下的一种或多种：
    一个或多个图像样本、一个或多个文本样本、一个或多个视频样本。
  27. 根据权利要求16至26任一所述的装置，其特征在于，所述损失用于对所述第一扰动进行更新，包括：
    所述损失用于对所述第一扰动进行基于梯度上升的更新。
  28. 一种数据处理装置，其特征在于，所述装置包括：
    处理模块，用于获取第一扰动，所述第一扰动用于将扰动作用于图像样本中的背景信息和/或风格信息区域；所述第一扰动用于和所述图像样本融合得到第一数据；
    根据所述第一数据，通过机器学习模型，得到损失，所述损失用于对所述第一扰动进行更新，得到第二扰动；所述第二扰动用于和所述训练数据融合得到第二数据；所述第二数据用于对所述机器学习模型进行更新。
  29. 一种计算机存储介质，其特征在于，所述计算机存储介质存储有一个或多个指令，所述指令在由一个或多个计算机执行时使得所述一个或多个计算机执行权利要求1至14中任一项所述方法的操作。
  30. 一种计算机程序产品，其特征在于，包括计算机可读指令，当所述计算机可读指令在计算机设备上运行时，使得所述计算机设备执行如权利要求1至14任一所述的方法。
  31. 一种系统，包括至少一个处理器，至少一个存储器；所述处理器、所述存储器通过通信总线连接并完成相互间的通信；
    所述至少一个存储器用于存储代码；
    所述至少一个处理器用于执行所述代码，以执行如权利要求1至14任一所述的方法。
PCT/CN2023/123373 2022-10-11 2023-10-08 一种数据处理方法及其装置 WO2024078411A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211243792.6 2022-10-11
CN202211243792.6A CN115641490A (zh) 2022-10-11 2022-10-11 一种数据处理方法及其装置

Publications (1)

Publication Number Publication Date
WO2024078411A1 true WO2024078411A1 (zh) 2024-04-18

Family

ID=84944831

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/123373 WO2024078411A1 (zh) 2022-10-11 2023-10-08 一种数据处理方法及其装置

Country Status (2)

Country Link
CN (1) CN115641490A (zh)
WO (1) WO2024078411A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115641490A (zh) * 2022-10-11 2023-01-24 华为技术有限公司 一种数据处理方法及其装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109272031A (zh) * 2018-09-05 2019-01-25 宽凳（北京）科技有限公司 一种训练样本生成方法及装置、设备、介质
CN112434213A (zh) * 2020-10-15 2021-03-02 中国科学院深圳先进技术研究院 网络模型的训练方法、信息推送方法及相关装置
CN113486736A (zh) * 2021-06-21 2021-10-08 南京航空航天大学 一种基于活跃子空间与低秩进化策略的黑盒对抗攻击方法
WO2022178815A1 (en) * 2021-02-26 2022-09-01 Robert Bosch Gmbh Method and apparatus for deep neural networks having ability for adversarial detection
CN115146055A (zh) * 2022-04-18 2022-10-04 重庆邮电大学 一种基于对抗训练的文本通用对抗防御方法及系统
CN115641490A (zh) * 2022-10-11 2023-01-24 华为技术有限公司 一种数据处理方法及其装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109272031A (zh) * 2018-09-05 2019-01-25 宽凳（北京）科技有限公司 一种训练样本生成方法及装置、设备、介质
CN112434213A (zh) * 2020-10-15 2021-03-02 中国科学院深圳先进技术研究院 网络模型的训练方法、信息推送方法及相关装置
WO2022178815A1 (en) * 2021-02-26 2022-09-01 Robert Bosch Gmbh Method and apparatus for deep neural networks having ability for adversarial detection
CN113486736A (zh) * 2021-06-21 2021-10-08 南京航空航天大学 一种基于活跃子空间与低秩进化策略的黑盒对抗攻击方法
CN115146055A (zh) * 2022-04-18 2022-10-04 重庆邮电大学 一种基于对抗训练的文本通用对抗防御方法及系统
CN115641490A (zh) * 2022-10-11 2023-01-24 华为技术有限公司 一种数据处理方法及其装置

Also Published As

Publication number Publication date
CN115641490A (zh) 2023-01-24

Similar Documents

Publication Publication Date Title
JP7289918B2 (ja) 物体認識方法及び装置
WO2022083536A1 (zh) 一种神经网络构建方法以及装置
WO2022042713A1 (zh) 一种用于计算设备的深度学习训练方法和装置
CN111507378A (zh) 训练图像处理模型的方法和装置
US20220215227A1 (en) Neural Architecture Search Method, Image Processing Method And Apparatus, And Storage Medium
CN112183577A (zh) 一种半监督学习模型的训练方法、图像处理方法及设备
CN111368972B (zh) 一种卷积层量化方法及其装置
WO2021147325A1 (zh) 一种物体检测方法、装置以及存储介质
CN111401517B (zh) 一种感知网络结构搜索方法及其装置
CN112446398A (zh) 图像分类方法以及装置
US20220130142A1 (en) Neural architecture search method and image processing method and apparatus
WO2021218786A1 (zh) 一种数据处理系统、物体检测方法及其装置
CN110222718B (zh) 图像处理的方法及装置
WO2023221928A1 (zh) 一种推荐方法、训练方法以及装置
CN113570029A (zh) 获取神经网络模型的方法、图像处理方法及装置
CN112580720A (zh) 一种模型训练方法及装置
CN113191241A (zh) 一种模型训练方法及相关设备
WO2024078411A1 (zh) 一种数据处理方法及其装置
WO2024002167A1 (zh) 一种操作预测方法及相关装置
CN113537462A (zh) 数据处理方法、神经网络的量化方法及相关装置
CN111738403A (zh) 一种神经网络的优化方法及相关设备
CN113516227A (zh) 一种基于联邦学习的神经网络训练方法及设备
CN115375781A (zh) 一种数据处理方法及其装置
US20220222934A1 (en) Neural network construction method and apparatus, and image processing method and apparatus
CN113627163A (zh) 一种注意力模型、特征提取方法及相关装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23876613

Country of ref document: EP

Kind code of ref document: A1