Neural network model training method and apparatus
View Patent ↗A neural network model training method and apparatus are provided. The method includes a first training operation of training the neural network model with original data, the first training operation including generating a first feature map for the original data, and generating a first class activation map for the original data from the generated first feature map, and a second training operation of training the neural network model with adversarial data transformed from the original data, the second training operation including generating a second feature map for the adversarial data, generating a second class activation map for the adversarial data from the generated second feature map, and training the neural network model so that the second class activation map follows the first class activation map based on logit pairing for the first and second class activation maps.
1 . A processor-implemented neural network model training method against adversarial attack, the method comprising:
performing a first training operation of training the neural network model with original data, the first training operation comprising:
generating a first feature map for the original data, and
generating a first class activation map for the original data from the generated first feature map; and
performing a second training operation of training the neural network model with adversarial data transformed from the original data such that the neural network model identifies a class of the adversarial data same as a class of the original data, wherein training the neural network model comprises determining and updating weights and biases between layers or a plurality of nodes that belong to different layers of adjacent layers, the second training operation comprising:
generating a second feature map for the adversarial data,
generating a second class activation map for the adversarial data from the generated second feature map, and
training the neural network model so that the second class activation map from the generated second feature map follows the first class activation map from the generated first feature map based on logit pairing for the first class activation map and the second class activation map,
wherein the first training operation generates a first set of activation values from the first class activation map, and wherein training the neural network model in the second training operation comprises using the first set of activation values as a target for aligning a second set of activation values generated from the second class activation map such that a difference between the first set of activation values and the second set of activation values is minimized.
2 . The method of claim 1 , wherein the adversarial data is acquired by applying a projected gradient descent (PGD) algorithm to the original data.
3 . The method of claim 1 , wherein, in the second training operation of the training of the neural network model, a loss function indicating a loss of the second class activation map with respect to the first class activation map is defined based on the logit pairing, and the neural network model is trained so that an output value of the loss function is minimized.
4 . The method of claim 3 , wherein the loss function indicates a difference between an activation value of the first class activation map and an activation value of the second class activation map.
5 . The method of claim 3 , wherein the loss function is a combined loss function (Loss) that includes a first component representing the loss of the second class activation map with respect to the first class activation map, and a second component representing a cross-entropy loss for classification of the original data.
6 . A neural network model training apparatus against adversarial attack, comprising:
one or more processors, configured to:
performing a first training operation by training the neural network model with original data, the first training operation comprising:
generating a first feature map for the original data, and
generating a first class activation map for the original data from the generated first feature map,
performing a second training operation by training the neural network model with adversarial data transformed from the original data such that the neural network model identifies a class of the adversarial data same as a class of the original data, wherein the training the neural network model comprises determining and updating weights and biases between layers or a plurality of nodes that belong to different layers of adjacent layers, the second training operation comprising:
generating a second feature map for the adversarial data,
generating a second class activation map for the adversarial data from the generated second feature map, and
training the neural network model so that the second class activation map from the generated second feature map follows the first class activation map from the generated first feature map based on logit pairing for the first class activation map and the second class activation map,
wherein the first training operation generates a first set of activation values from the first class activation map, and wherein training the neural network model in the second training operation comprises using the first set of activation values as a target for aligning a second set of activation values generated from the second class activation map such that a difference between the first set of activation values and the second set of activation values is minimized.
7 . The apparatus of claim 6 , wherein, the one or more processors are configured to define a loss function indicating a loss of the second class activation map with respect to the first class activation map based on the logit pairing, and train the neural network model so that an output value of the loss function is minimized.
8 . The apparatus of claim 7 , wherein the loss function indicates a difference between an activation value of the first class activation map and an activation value of the second class activation map.
9 . The apparatus of claim 6 , further comprising a memory storing instructions that, when executed by the one or more processors, configure the one or more processors to perform the generating of the first feature map, the generating of the first class activation map, the generating of the second feature map, the generating of the second class activation map, and the training of the neural network model.
10 . The apparatus of claim 6 , wherein the apparatus is any one of a personal computer (PC), a personal digital assistant (PDA), a server device, a mobile device, a smart phone, an autonomous vehicle, a robotics device, a tablet device, an augmented reality (AR) device, and an internet-of-things (IoT) device.
11 . The apparatus of claim 6 , further comprising implementing the trained neural network for captured original data.
12 . A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to:
perform a first training operation of training a neural network model with original data, the first training operation comprising:
generating a first feature map for the original data, and
generating a first class activation map for the original data from the generated first feature map; and
perform a second training operation of training the neural network model with adversarial data transformed from the original data such that the neural network model identifies a class of the adversarial data same as a class of the original data, wherein training the neural network model comprises determining and updating weights and biases between layers or a plurality of nodes that belong to different layers of adjacent layers, the second training operation comprising:
generating a second feature map for the adversarial data,
generating a second class activation map for the adversarial data from the generated second feature map, and
training the neural network model so that the second class activation map from the generated second feature map follows the first class activation map from the generated first feature map based on logit pairing for the first class activation map and the second class activation map,
wherein the first training operation generates a first set of activation values from the first class activation map, and wherein training the neural network model in the second training operation comprises using the first set of activation values as a target for aligning a second set of activation values generated from the second class activation map such that a difference between the first set of activation values and the second set of activation values is minimized.