Model building apparatus, model building method, computer program and recording medium
A model building apparatus includes: a building unit that builds a generation model that outputs an adversarial example, which causes misclassification by a learned model, when a source sample is entered into the generation model; and a calculating unit that calculates a first evaluation value and a second evaluation value, wherein the first evaluation value is smaller as a difference is smaller between an actual visual feature of the adversarial example outputted from the generation model and a target visual feature of the adversarial example that are set to be different from a visual feature of the source sample, and the second evaluation value is smaller as there is a higher possibility that the learned model misclassifies the adversarial example outputted from the generation model. The building unit builds the generation model by updating the generation model such that an index value based on the first and second evaluation values is smaller.
1. A model building apparatus comprising a controller,
the controller being programmed to:
build a generation model that outputs an adversarial example, which causes misclassification by a learned model, when a source sample is entered into the generation model; and
calculate a first evaluation value and a second evaluation value, wherein the first evaluation value is smaller as a difference is smaller between an actual visual feature of the adversarial example outputted from the generation model and a target visual feature of the adversarial example that are set to be different from a visual feature of the source sample, and the second evaluation value is smaller as there is a higher possibility that the learned model misclassifies the adversarial example outputted from the generation model,
wherein
the controller is programmed to build the generation model by updating the generation model such that an index value based on the first and second evaluation values is smaller,
the controller is further programmed to generate an approximate model for approximating the learned model, and
the controller is programmed to calculate the second evaluation value on the basis of a parameter for defining the approximate model.
2. The model building apparatus according to claim 1 , wherein
the controller is programmed to (i) calculate the second evaluation value on the basis of a parameter for defining the learned model when it is possible to obtain the parameter for defining the learned model, and (ii) calculate the second evaluation value on the basis of the parameter for defining the approximate model when it is impossible to obtain the parameter for defining the learned model.
3. The model building apparatus according to claim 1 , wherein
the controller is further programmed to generate the adversarial example by entering the source sample into the generation model built by the building unit.
4. The model building apparatus according to claim 1 , wherein
the controller is further programmed to evaluate the adversarial examples outputted from the generation model.
5. A model building method comprising:
building a generation model that outputs an adversarial example, which causes misclassification by a learned model, when a source sample is entered into the generation model; and
calculating a first evaluation value and a second evaluation value, wherein the first evaluation value is smaller as a difference is smaller between an actual visual feature of the adversarial example outputted from the generation model and a target visual feature of the adversarial example that are set to be different from a visual feature of the source sample, and the second evaluation value is smaller as there is a higher possibility that the learned model misclassifies the adversarial example outputted from the generation model, wherein
building includes building the generation model by updating the generation model such that an index value based on the first and second evaluation values is smaller,
the method further comprising:
generating an approximate model for approximating the learned model, and
calculating the second evaluation value on the basis of a parameter for defining the approximate model.
6. A non-transitory recording medium on which a computer program that allows a computer to execute a model building method comprising:
building a generation model that outputs an adversarial example, which causes misclassification by a learned model, when a source sample is entered into the generation model; and
calculating a first evaluation value and a second evaluation value, wherein the first evaluation value is smaller as a difference is smaller between an actual visual feature of the adversarial example outputted from the generation model and a target visual feature of the adversarial example that are set to be different from a visual feature of the source sample, and the second evaluation value is smaller as there is a higher possibility that the learned model misclassifies the adversarial example outputted from the generation model, wherein
building includes building the generation model by updating the generation model such that an index value based on the first and second evaluation values is smaller,
the method further comprising:
generating an approximate model for approximating the learned model, and
calculating the second evaluation value on the basis of a parameter for defining the approximate model.
7. The model building apparatus according to claim 1 , wherein the parameter includes at least one of variables and coefficients used to determine at least one of behavior, structure, and properties of an approximation model, and the parameter includes at least one of weighting and biases, hyperparameters, and decision thresholds.
8. The non-transitory recording medium according to claim 6 , wherein the parameter includes at least one of variables and coefficients used to determine at least one of behavior, structure, and properties of an approximation model, and the parameter includes at least one of weighting and biases, hyperparameters, and decision thresholds.