Adversarial neural network training
A neural network is trained to recognize an object based on a first portion trained adversarially and a second portion trained non-adversarially. During adversarial training, the first portion encodes input to a set of latent variables, and the second portion reconstructs the input by decoding the variables. The first portion is trained based on an error signal generated from the decoded output of the second portion, whose configuration is kept fixed during the adversarial training.
1 . A processor, comprising:
one or more arithmetic logic units (ALUs) to identify an object in an image based, at least in part, on one or more neural networks including one or more non-adversarially trained portions and one or more adversarially trained portions, wherein the one or more adversarially trained portions are trained, at least in part, using adversarial training comprising:
calculating an error signal using an output of the one or more non-adversarially trained portions;
backpropagating the error signal through the one or more non-adversarially trained portions to modulate the error signal by the one or more non-adversarially trained portions, wherein configuration of the one or more non-adversarially trained portions is fixed during the adversarial training and not adjusted based on the back-propagated error signal; and
providing the modulated error signal to update the one or more adversarially trained portions.
2 . The processor of claim 1 , wherein the one or more adversarially trained portions comprise an encoder and the one or more non-adversarially trained portions comprise a decoder.
3 . The processor of claim 1 , wherein the one or more adversarially trained portions map input data to a set of variables comprising a variable indicative of a probability of membership in a class and a variable indicative of appearance.
4 . The processor of claim 1 , wherein the one or more neural networks learn a manifold by training the encoder until a regulation threshold is met.
5 . The processor of claim 1 , wherein the one or more adversarially trained portions are trained based at least in part on an error signal calculated based on a difference between an adversarial example and a reconstruction of the adversarial example by the one or more non-adversarially trained portions.
6 . The processor of claim 5 , wherein the error signal is backpropagated to the one or more adversarially trained portions.
7 . The processor of claim 1 , wherein the non-adversarially trained portions comprise a decoder pre-trained to reconstruct examples based on a non-adversarial dataset representing objects to be identified.
8 . The processor of claim 1 , wherein the adversarially trained portions comprise an encoder trained using input from a decoder, the decoder pre-trained to reconstruct examples based on a non-adversarial dataset representing objects to be identified.
9 . A system, comprising:
one or more computers including one or more processors to train one or more neural networks to identify an object in an image, the one or more neural networks comprising one or more non-adversarially trained portions and one or more adversarially trained portions, wherein the one or more adversarially trained portions are trained, at least in part, using adversarial training comprising:
calculating an error signal using an output of the one or more non-adversarially trained portions;
backpropagating the error signal through the one or more non-adversarially trained portions to modulate the error signal by the one or more non-adversarially trained portions, wherein configuration of the one or more non-adversarially trained portions is fixed during the adversarial training and not adjusted based on the back-propagated error signal; and
providing the modulated error signal to update the one or more adversarially trained portions.
10 . The system of claim 9 , wherein the one or more adversarially trained portions comprise an encoder and the one or more non-adversarially trained portions comprise a decoder.
11 . The system of claim 9 , wherein the one or more adversarially trained portions map input data to variables comprising a variable indicative of class membership and variable indicative of an appearance code.
12 . The system of claim 11 , wherein the one or more non-adversarially trained portions reconstruct the input data based at least in part on the variables.
13 . The system of claim 9 , wherein the one or more neural networks learn a manifold regularized by training the encoder until a regulation criteria is met.
14 . The system of claim 9 , wherein the one or more adversarially trained portions are trained based at least in part on an error comprising a difference between an adversarially generated input and a reconstruction of the adversarially generated input by the non-adversarially trained portion.
15 . The system of claim 14 , wherein the error signal is modulated and back-propagated to the one or more adversarially trained portions.
16 . A non-transitory machine-readable medium having stored thereon a set of instructions, which if performed by one or more processors, cause the one or more processors to at least:
cause one or more neural networks to be trained to identify an object in an image, the one or more neural networks including one or more non-adversarially trained portions and one or more adversarially trained portions, wherein the one or more adversarially trained portions are trained, at least in part, using adversarial training comprising:
calculating an error signal using an output of the one or more non-adversarially trained portions;
backpropagating the error signal through the one or more non-adversarially trained portions to modulate the error signal by the one or more non-adversarially trained portions, wherein configuration of the one or more non-adversarially trained portions is fixed during the adversarial training and not adjusted based on the back-propagated error signal; and
providing the modulated error signal to update the one or more adversarially trained portions.
17 . The non-transitory machine-readable medium of claim 16 , wherein the one or more adversarially trained portions comprise an encoder and the one or more non-adversarially trained portions comprise a decoder.
18 . The non-transitory machine-readable medium of claim 16 , wherein the one or more adversarially trained portions map input data to a first variable indicative of class and a second variable indicative of appearance.
19 . The non-transitory machine-readable medium of claim 18 , wherein the one or more non-adversarially trained portions reconstruct the input data based at least in part on the first and second variables.
20 . The non-transitory machine-readable medium of claim 16 , wherein the one or more neural networks learn a regularized manifold, wherein the regularized manifold is regularized by training the encoder until a regulation criteria is met.
21 . The non-transitory machine-readable medium of claim 16 , wherein the one or more adversarially trained portions are trained based at least in part on an error signal calculated based on a difference between an adversarially generated input and a reconstruction of the adversarially generated input by the non-adversarially train portion.
22 . The non-transitory machine-readable medium of claim 21 , wherein the error signal is back-propagated to the one or more adversarially trained portions.
23 . A system, comprising:
a camera; and
at least one processor to identify a road sign based on input from the camera, the road sign identified based, at least in part, on one or more neural networks including one or more non-adversarially trained portions and one or more adversarially trained portions, wherein the one or more adversarially trained portions are trained, at least in part, using adversarial training comprising:
calculating an error signal using an output of the one or more non-adversarially trained portions;
backpropagating the error signal through the one or more non-adversarially trained portions to modulate the error signal by the one or more non-adversarially trained portions, wherein configuration of the one or more non-adversarially trained portions is fixed during the adversarial training and not adjusted based on the back-propagated error signal; and
providing the modulated error signal to update the one or more adversarially trained portions.
24 . The system of claim 23 , wherein the identification of the road sign is resistant to an adversarial example comprising at least a threshold amount of difference from a corresponding non-adversarial example.
25 . The system of claim 23 , wherein the one or more non-adversarially trained portions are trained with images of the road sign.
26 . The system of claim 23 , wherein the one or more adversarially trained portions comprise an encoder and the one or more non-adversarially trained portions comprise a decoder.
27 . The system of claim 23 , wherein the one or more adversarially trained portions map input data to a set of latent variables comprising a probability variable and an appearance variable.
28 . The system of claim 23 , wherein the one or more adversarially trained portions are trained based at least in part on an error signal calculated based on a difference between an adversarially generated input and a reconstruction of the adversarially generated input by the non-adversarially trained portion.
29 . The system of claim 28 , wherein the error signal is backpropagated to the one or more adversarially trained portions.
30 . The system of claim 23 , wherein an adversarial attack is detected based at least in part on a comparison of an input to the one or more neural networks and the output of the one or more neural networks.