IP Library › Granted Patent US 12,254,678
Granted Patent B2
US 12,254,678 · App. 17/711,951 · Granted Mar 18, 2025

Training a neural network using outputs of a corruption neural network

Inventors: Dan-Andrei Calian (London, GB); Sven Adrian Gowal (Cambridge, GB); Timothy Arthur Mann (Harpenden, GB); András György (London, GB)
Assignee: DeepMind Technologies Limited
G06V10/7747G06V10/776G06V10/82
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,254,678
App. No.
17/711,951
Granted
Mar 18, 2025
Kind
B2
Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media for processing a network input using a trained neural network with network parameters to generate an output for a machine learning task. The training includes: receiving a set of training examples each including a training network input and a reference output; for each training iteration, generating a corrupted network input for each training network input using a corruption neural network; updating perturbation parameters of the corruption neural network using a first objective function based on the corrupted network inputs; generating an updated corrupted network input for each training network input based on the updated perturbation parameters; and generating a network output for each updated corrupted network input using the neural network; for each training example, updating the network parameters using a second objective function based on the network output and the reference output.

Claims (75)

1. A method comprising:

receiving a network input; and

processing the network input using a first neural network to generate an output for a machine learning task, wherein the first neural network comprises a plurality of first neural network parameters and has been trained on training examples, the training comprising:

receiving the training examples for training the first neural network, wherein each training example comprises a training network input and a reference output;

for each training iteration in a set of training iterations:

generating, for each training example of a set of the training examples and using a corruption neural network, a respective corrupted network input for the training network input in the training example, wherein the corruption neural network has a plurality of corruption neural network parameters and a plurality of perturbation parameters;

updating, based on the respective corrupted network inputs, the plurality of perturbation parameters of the corruption neural network using a first objective function;

generating, for each training example of the set of training examples and using the corruption neural network with the updated perturbation parameters, a respective updated corrupted network input for the training network input in the training example; and

generating, by processing the respective updated corrupted network inputs using at least the first neural network, corresponding respective network outputs; and

for each training example in the set of training examples, based on (i) the corresponding respective network output for the respective updated corrupted network input and (ii) the reference output in the training example, updating the plurality of first neural network parameters using a second objective function.

2. The method of claim 1 , wherein updating the plurality of perturbation parameters of the corruption neural network using the first objective function comprises updating the plurality of perturbation parameters while constraining the plurality of perturbation parameters to satisfy a constraint based on a perturbation radius threshold.

3. The method of claim 2 , wherein updating the plurality of perturbation parameters of the corruption neural network comprises repeatedly updating the plurality of perturbation parameters for a plurality of iterations, wherein for each iteration of the plurality of iterations:

generating, using the corruption neural network, a respective corrupted network input for each training network input in the set of training examples for the iteration; and

updating, based on the respective corrupted network inputs for the iteration, the plurality of perturbation parameters of the corruption neural network by optimizing the first objective function.

4. The method of claim 3 , wherein the corruption neural network comprises one or more network layers, wherein each layer of the one or more network layers has respective one or more corruption neural network parameters of the plurality of corruption neural network parameters and respective one or more perturbation parameters of the plurality of perturbation parameters, wherein constraining the plurality of perturbation parameters to satisfy the constraint based on the perturbation radius threshold comprises:

for each iteration of the plurality of iterations:

determining, for each layer of the one or more network layers, that the respective one or more perturbation parameters for the layer do not satisfy the constraint based on the perturbation radius threshold;

generating a respective coefficient for the respective one or more perturbation parameters; and

further updating, using the respective coefficient, the respective one or more perturbation parameters of the layer.

5. The method of claim 4 , wherein determining that the respective one or more perturbation parameters for the layer do not satisfy the constraint based on the perturbation radius threshold comprises:

generating a first magnitude for the one or more perturbation parameters for the layer;

generating a second magnitude for the respective one or more corruption neural network parameters for the layer;

generating a ratio between the first magnitude and the second magnitude; and

determining that the ratio does not satisfy the constraint based on the perturbation radius threshold.

6. The method of claim 5 , wherein the respective coefficient is generated based on the ratio.

7. The method of claim 1 , wherein updating the plurality of perturbation parameters of the corruption neural network using the first objective function comprises:

determining a gradient of the first objective function with respect to the plurality of perturbation parameters for the training network input; and

updating, based on the gradient and the plurality of perturbation parameters, the plurality of perturbation parameters for the training network input.

8. The method of claim 1 , wherein the plurality of corruption neural network parameters are static during the training of the first neural network.

9. The method of claim 1 , wherein the corruption neural network has been pre-trained with the plurality of perturbation parameters being set to respective values that do not impact inference operations of the corruption neural network.

10. The method of claim 1 , wherein the corruption neural network comprises one or more network layers, wherein each layer of the one or more network layers has respective one or more corruption neural network parameters of the plurality of corruption neural network parameters and respective one or more perturbation parameters of the plurality of perturbation parameters, wherein for processing an input to at least one network layer of the one or more network layers, the method further comprises:

determining, for the at least one network layer, respective one or more corrupted network parameters for the at least one network layer based on the respective one or more corruption neural network parameters and the respective one or more perturbation parameters; and

processing, using the determined respective one or more corrupted network parameters, the input to the at least one network layer.

11. The method of claim 1 , wherein after generating, for each training example of the set of training examples and using the corruption neural network with the updated perturbation parameters, the respective updated corrupted network input for the training network input, the method further comprises:

for each of the respective updated corrupted network inputs, determining a similarity measure between the network input and the respective updated corrupted network input;

determining that the similarity measure does not satisfy a threshold similarity measure; and

in response to determining that the similarity measure does not satisfy the threshold similarity measure, further updating the respective updated corrupted network input based on an interpolation weight to satisfy the threshold similarity measure.

12. The method of claim 11 , wherein the similarity measure is a structural similarity index measure (“SSIM”).

13. The method of claim 11 , further comprising determining the interpolation weight, wherein determining the interpolation weight comprises:

generating a plurality of candidate interpolation weights;

for each candidate interpolation weight of the candidate interpolation weights:

generating a candidate corrupted network input from the respective updated corrupted network input using the candidate interpolation;

determining a respective similarity measure between the network input and the candidate corrupted network input;

generating a polynomial based on the respective similarity measures and the threshold similarity measure;

determining roots to the polynomial; and

selecting, as the interpolation weight, a root from the roots to the polynomial.

14. The method of claim 1 , wherein the output for the machine learning task comprises a score distribution over a set of object classes, wherein each score in the score distribution represents a predicted likelihood that the network input represents an object from a corresponding object class from the set of object classes.

15. A system comprising one or more computers and one or more storage devices storing instructions that, when executed by the one or more computers, cause the one or more computers to perform operations, the operations comprising:

receiving a network input; and

processing the network input using a first neural network to generate an output for a machine learning task, wherein the first neural network comprises a plurality of first neural network parameters and has been trained on training examples, the training comprising:

receiving the training examples for training the first neural network, wherein each training example comprises a training network input and a reference output;

for each training iteration in a set of training iterations:

generating, for each training example of a set of the training examples and using a corruption neural network, a respective corrupted network input for the training network input in the training example, wherein the corruption neural network has a plurality of corruption neural network parameters and a plurality of perturbation parameters;

updating, based on the respective corrupted network inputs, the plurality of perturbation parameters of the corruption neural network using a first objective function;

generating, for each training example of the set of training examples and using the corruption neural network with the updated perturbation parameters, a respective updated corrupted network input for the training network input in the training example; and

generating, by processing the respective updated corrupted network inputs using at least the first neural network, corresponding respective network outputs; and

for each training example in the set of training examples, based on (i) the corresponding respective network output for the respective updated corrupted network input and (ii) the reference output in the training example, updating the plurality of first neural network parameters using a second objective function.

16. The system of claim 15 , wherein updating the plurality of perturbation parameters of the corruption neural network using the first objective function comprises updating the plurality of perturbation parameters while constraining the plurality of perturbation parameters to satisfy a constraint based on a perturbation radius threshold.

17. The system of claim 16 , wherein updating the plurality of perturbation parameters of the corruption neural network comprises repeatedly updating the plurality of perturbation parameters for a plurality of iterations, wherein for each iteration of the plurality of iterations:

generating, using the corruption neural network, a respective corrupted network input for each training network input in the set of training examples for the iteration; and

updating, based on the respective corrupted network inputs for the iteration, the plurality of perturbation parameters of the corruption neural network by optimizing the first objective function.

18. One or more non-transitory computer storage media storing instructions that, when executed by one or more computers, cause the one or more computers to perform operations, the operations comprising:

receiving a network input; and

processing the network input using a first neural network to generate an output for a machine learning task, wherein the first neural network comprises a plurality of first neural network parameters and has been trained on training examples, the training comprising:

receiving the training examples for training the first neural network, wherein each training example comprises a training network input and a reference output;

for each training iteration in a set of training iterations:

generating, for each training example of a set of the training examples and using a corruption neural network, a respective corrupted network input for the training network input in the training example, wherein the corruption neural network has a plurality of corruption neural network parameters and a plurality of perturbation parameters;

updating, based on the respective corrupted network inputs, the plurality of perturbation parameters of the corruption neural network using a first objective function;

generating, for each training example of the set of training examples and using the corruption neural network with the updated perturbation parameters, a respective updated corrupted network input for the training network input in the training example; and

generating, by processing the respective updated corrupted network inputs using at least the first neural network, corresponding respective network outputs; and

for each training example in the set of training examples, based on (i) the corresponding respective network output for the respective updated corrupted network input and (ii) the reference output in the training example, updating the plurality of first neural network parameters using a second objective function.

19. The one or more non-transitory computer storage media of claim 18 , wherein updating the plurality of perturbation parameters of the corruption neural network using the first objective function comprises updating the plurality of perturbation parameters while constraining the plurality of perturbation parameters to satisfy a constraint based on a perturbation radius threshold.

20. The one or more non-transitory computer storage media of claim 19 , wherein updating the plurality of perturbation parameters of the corruption neural network comprises repeatedly updating the plurality of perturbation parameters for a plurality of iterations, wherein for each iteration of the plurality of iterations:

generating, using the corruption neural network, a respective corrupted network input for each training network input in the set of training examples for the iteration; and

updating, based on the respective corrupted network inputs for the iteration, the plurality of perturbation parameters of the corruption neural network by optimizing the first objective function.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 6, 2025
From: DEEPMIND TECHNOLOGIES LIMITED
To: GDM HOLDING LLC
Reel/Frame 071498/0210 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 7, 2022
From: CALIAN, DAN-ANDREI; GOWAL, SVEN ADRIAN; MANN, TIMOTHY ARTHUR; GYÖRGY, ANDRÁS
To: DEEPMIND TECHNOLOGIES LIMITED
Reel/Frame 060425/0372 →
Continuity (1)
Related Publication 20230316729A1 · Oct 5, 2023
References Cited (75)
US 20220108132A1 · Zhang · 2022 [cited by examiner]
Arjovsky et al., “Invariant risk minimization,” CoRR, Jul. 5, 2019, arXiv:1907.02893, 31 pages. [cited by applicant]
Baluja et al., “Adversarial transformation networks: Learning to generate adversarial examples,” CoRR, Mar. 28, 2017, arXiv:1703.09387, 13 pages. [cited by applicant]
Carlini et al., “Adversarial examples are not easily detected: Bypassing ten detection methods,” Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, Nov. 3, 2017, pp. 3-14. [cited by applicant]
Carlini et al., “Towards evaluating the robustness of neural networks,” 2017 IEEE Symposium on Security and Privacy, 2017, 19 pages. [cited by applicant]
Chen et al., “End to end learning for self-driving cars,” 2017 IEEE Intelligent Vehicles Symposium (IV), Jun. 11-14, 2017, pp. 1856-1860. [cited by applicant]
Covington et al., “Deep neural networks for YouTube recommendations,” Proceedings of the 10th ACM Conference on Recommender Systems, Sep. 2016, pp. 191-198. [cited by applicant]
Croce et al., “Robustbench: a standardized adversarial robustness benchmark,” CoRR, Oct. 19, 2020, arxiv.org/abs/2010.09670, 29 pages. [cited by applicant]
Cubuk et al., “Autoaugment: Learning augmentation policies from data,” CoRR, May 24, 2018, arxiv.org/abs/1805.09501, 14 pages. [cited by applicant]
Cubuk et al., “Randaugment: Practical automated data augmentation with a reduced search space,” Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, 2020, 10 pages. [cited by applicant]
De Fauw et al., “Clinically applicable deep learning for diagnosis and referral in retinal disease,” Nature Medicine, Aug. 13, 2018, 24(9):1342-1350. [cited by applicant]
Devries et al., “Improved regularization of convolutional neural networks with cutout,” CoRR, Aug. 15, 2017, arXiv:1708.04552, 8 pages. [cited by applicant]
Foret et al., “Sharpness-aware minimization for efficiently improving generalization,” CoRR, Oct. 3, 2020, arxiv.org/abs/2010.01412, 20 pages. [cited by applicant]
Geirhos et al., “Generalisation in humans and deep neural networks,” Advances in Neural Information Processing Systems 31 (NeurIPS 2018), 2018, 13 pages. [cited by applicant]
Geirhos et al., “Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness,” CoRR, Nov. 29, 2018, arxiv.org/abs/1811.12231, 22 pages. [cited by applicant]
Goodfellow et al., “Explaining and harnessing adversarial examples,” CoRR, Dec. 20, 2014, arxiv.org/abs/1412.6572, 11 pages. [cited by applicant]
Gowal et al., “Achieving Robustness in the Wild via Adversarial Mixing with Disentangled Representations,” Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 1211-1220. [cited by applicant]
Gowal et al., “Uncovering the limits of adversarial training against norm-bounded adversarial examples,” CoRR, Oct. 7, 2020, arXiv:2010.03593, 33 pages. [cited by applicant]
Goyal et al., “Accurate, large minibatch sgd: Training imagenet in 1 hour,” CoRR, Jun. 8, 2017, arXiv:1706.02677, 12 pages. [cited by applicant]
Guo et al., “Mixup as locally linear out-of-manifold regularization,” Proceedings of the AAAI Conference on Artificial Intelligence, Jul. 17, 2019, 33(1):3714-3722. [cited by applicant]
Hameed et al., “Perceptually constrained adversarial attacks,” CoRR, Feb. 14, 2021, arxiv.org/abs/2102.07140, 17 pages. [cited by applicant]
Hameed, “New quality measures for adversarial attacks with applications to secure communication,” Thesis for the degree of Doctor of Philosophy, Imperial College of Science, Technology and Medicine, Jul. 2020, 103 pages. [cited by applicant]
He et al., “Deep residual learning for image recognition,” Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 770-778. [cited by applicant]
He et al., “Identity mappings in deep residual networks,” European Conference on Computer Vision, Sep. 17, 2016, pp. 630-645. [cited by applicant]
Hendrycks et al., “Augmix: A simple data processing method to improve robustness and uncertainty,” CoRR, Dec. 5, 2019, arxiv.org/abs/1912.02781, 15 pages. [cited by applicant]
Hendrycks et al., “Benchmarking neural network robustness to common corruptions and perturbations,” CoRR, Mar. 28, 2019, arxiv.org/abs/1903.12261, 16 pages. [cited by applicant]
Hendrycks et al., “Natural adversarial examples,” Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021, pp. 15262-15271. [cited by applicant]
Hendrycks et al., “The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization,” Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 8340-8349. [cited by applicant]
Hinton et al., “Deep neural networks for acoustic modeling in speech recognition: The shared views of four research groups,” IEEE Signal processing magazine, Nov. 2012, 29(6):82-97. [cited by applicant]
Jaderberg et al., “Spatial transformer networks,” Advances in Neural Information Processing Systems 28, 2015, 9 pages. [cited by applicant]
Kingma et al., “Adam: A method for stochastic optimization,” CoRR, Dec. 22, 2014, arXiv:1412.6980, 15 pages. [cited by applicant]
Kireev et al., “On the effectiveness of adversarial training against common corruptions,” Proceedings of the Thirty-Eighth Conference on Uncertainty in Artificial Intelligence, 2022, 180:1012-1021. [cited by applicant]
Krizhevsky et al., “Imagenet classification with deep convolutional neural networks,” In Adv. Neural Inform. Process. Syst. 25, 2012, 9 pages. [cited by applicant]
Kuehlkamp et al., “Gender-from-iris or gender-from-mascara?,” 2017 IEEE Winter Conference on Applications of Computer Vision (WACV), Mar. 24-31, 2017, pp. 1151-1159. [cited by applicant]
Kurakin et al., “Adversarial examples in the physical world,” CoRR, Jul. 8, 2016, arxiv.org/abs/1607.02533, 14 pages. [cited by applicant]
Laidlaw et al., “Perceptual adversarial robustness: Defense against unseen threat models,” International Conference on Learning Representations, 2021, 25 pages. [cited by applicant]
Lee et al., “Compounding the performance improvements of assembled techniques in a convolutional neural network,” CoRR, Jan. 17, 2020, arxiv.org/abs/2001.06268, 12 pages. [cited by applicant]
Lim et al., “Enhanced deep residual networks for single image super-resolution,” Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017, pp. 136-144. [cited by applicant]
Lopes et al., “Improving robustness without sacrificing accuracy with patch Gaussian augmentation,” CoRR, Jun. 6, 2019, arXiv:1906.02611, 18 pages. [cited by applicant]
Loshchilov et al., “SGDR: stochastic gradient descent with warm restarts,” CoRR, Aug. 13, 2016, arxiv.org/abs/1608.03983, 16 pages. [cited by applicant]
Madry et al., “Towards deep learning models resistant to adversarial attacks,” Int. Conf. Learn. Represent., 2018, 23 pages. [cited by applicant]
Nesterov, “A method of solving a convex programming problem with convergence rate o(1/k2),” Doklady Akademii Nauk SSSR, 1983, 269(3):543-547 (with English abstract). [cited by applicant]
Neyshabur et al., “Exploring generalization in deep learning,” Advances in Neural Information Processing Systems, 2017, 10 pages. [cited by applicant]
Papernot et al., “Distillation as a defense to adversarial perturbations against deep neural networks,” IEEE Symposium on Security and Privacy, Mar. 14, 2016, 16 pages. [cited by applicant]
Polyak, “Some methods of speeding up the convergence of iteration methods,” USSR Computational Mathematics and Mathematical Physics, Nov. 26, 1962, 4(5):1-17. [cited by applicant]
Qin et al., “Adversarial Robustness through Local Linearization,” CoRR, Jul. 4, 2019, arxiv.org/abs/1907.02610, 17 pages. [cited by applicant]
Qiu et al., “SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing,” CoRR, Jul. 2, 2020, arXiv:1906.07927v4, 33 pages. [cited by applicant]
Raghunathan et al., “Adversarial training can hurt generalization,” ICML 2019 Workshop on Identifying and Understanding Deep Learning Phenomena, 2019, 11 pages. [cited by applicant]
Recht et al., “Do ImageNet Classifiers Generalize to ImageNet?,” Proceedings of the 36th International Conference on Machine Learning, 2019, 97:5389-5400. [cited by applicant]
Rice et al., “Overfitting in adversarially robust deep learning,” roceedings of the 37th International Conference on Machine Learning, 2020, 119:8093-8104. [cited by applicant]
Richardson et al., “The surprising effectiveness of linear unsupervised image-to-image translation,” 2020 25th International Conference on Pattern Recognition (ICPR), Jan. 10-15, 2021, pp. 7855-7861. [cited by applicant]
Ronneberger et al., “U-net: Convolutional networks for biomedical image segmentation,” Medical Image Computing and Computer-Assisted Intervention—MICCAI 2015: 18th International Conference, Oct. 5-9, 2015, 8 pages. [cited by applicant]
Rusak et al., “A simple way to make neural networks robust against diverse image corruptions,” CoRR, Jan. 16, 2020, arxiv.org/abs/2001.06057, 34 pages. [cited by applicant]
Seyed-Mohsen et al., “Robustness via curvature regularization, and vice versa,” Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019, pp. 9078-9086. [cited by applicant]
Song et al., “Constructing unrestricted adversarial examples with generative models,” Advances in Neural Information Processing Systems 31, 2018, 12 pages. [cited by applicant]
Sugiyama et al., “Covariate shift adaptation by importance weighted cross validation,” Journal of Machine Learning Research, May 2007, 8(5):985-1005. [cited by applicant]
Szegedy et al., “Intriguing properties of neural networks,” CoRR, Dec. 21, 2013, arxiv.org/abs/1312.6199, 10 pages. [cited by applicant]
Taori et al., “Measuring robustness to natural distribution shifts in image classification,” Advances in Neural Information Processing Systems 33, 2020, 17 pages. [cited by applicant]
Theis et al., “Lossy image compression with compressive autoencoders,” CoRR, Mar. 1, 2017, arxiv.org/abs/1703.00395, 19 pages. [cited by applicant]
Tokozume et al., “Between-class learning for image classification,” Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018, pp. 5486-5494. [cited by applicant]
Torralba et al., “Unbiased look at dataset bias,” CVPR, Jun. 20-25, 2011, 8 pages. [cited by applicant]
Van den Oord et al., “Neural discrete representation learning,” Adv. Neural Inform. Process. Syst., 2017, 10 pages. [cited by applicant]
Vasiljevic et al., “Examining the impact of blur on recognition by convolutional networks,” CoRR, Nov. 17, 2016, arXiv:1611.05760, 10 pages. [cited by applicant]
Wang et al., “Image quality assessment: from error visibility to structural similarity,” IEEE Transactions on Image Processing, Apr. 2004, 13(4):600-612. [cited by applicant]
Wong et al., “Fast is better than free: Revisiting adversarial training,” CoRR, Jan. 12, 2020, arxiv.org/abs/2001.03994, 17 pages. [cited by applicant]
Wong et al., “Learning perturbation sets for robust machine learning.,” CoRR, Jul. 16, 2020, arxiv.org/abs/2007.08450, 32 pages. [cited by applicant]
Wu et al., “Adversarial weight perturbation helps robust generalization,” Advances in Neural Information Processing Systems 33 (NeurIPS 2020), 2020, 12 pages. [cited by applicant]
Xiao et al., “Generating adversarial examples with adversarial networks,” CoRR, Jan. 8, 2018, arXiv:1801.02610, 8 pages. [cited by applicant]
Xie et al., “Aggregated residual transformations for deep neural networks,” CoRR, Nov. 16, 2016, arXiv:1611.05431, 10 pages. [cited by applicant]
Yin et al., “A fourier perspective on model robustness in computer vision,” Advances in Neural Information Processing Systems 32 (NeurIPS 2019), 11 pages. [cited by applicant]
Yun et al., “Cutmix: Regularization strategy to train strong classifiers with localizable features,” CoRR, May 13, 2019, arxiv.org/abs/1905.04899, 14 pages. [cited by applicant]
Zhang et al., “mixup: Beyond empirical risk minimization,” CoRR, Oct. 25, 2017, arxiv.org/abs/1710.09412, 13 pages. [cited by applicant]
Zhang et al., “The unreasonable effectiveness of deep features as a perceptual metric,” Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018, pp. 586-595. [cited by applicant]
Zhang et al., “Theoretically Principled Trade-off between Robustness and Accuracy,” Proceedings of the 36th International Conference on Machine Learning, 2019, 97:7472-7482. [cited by applicant]
Zhang et al., “Understanding deep learning requires rethinking generalization,” CoRR, Nov. 10, 2016, arXiv:1611.03530, 15 pages. [cited by applicant]
Cited By (1)
US 12,547,717