Deliberate conditional poison training for generative models

Patent metadata

Field	Value
Publication number	US-11087170-B2
Application number	US-201816208384-A
Country	US
Kind code	B2
Filing date	Dec 3, 2018
Priority date	Dec 3, 2018
Publication date	Aug 10, 2021
Grant date	Aug 10, 2021

Abstract

A generator for generating artificial data, and training for the same. Data corresponding to a first label is altered within a reference labeled data set. A discriminator is trained based on the reference labeled data set to create a selectively poisoned discriminator. A generator is trained based on the selectively poisoned discriminator to create a selectively poisoned generator. The selectively poisoned generator is tested for the first label and tested for the second label to determine whether the generator is sufficiently poisoned for the first label and sufficiently accurate for the second label. If it is not, the generator is retrained based on the data set including the further altered data. The generator includes a first ANN to input first information and output a set of artificial data that is classifiable using a first label and not classifiable using a second label of the set of labeled data.

First claim

What is claimed is:

1. A method for training a generator in a generative adversarial network (GAN), the method comprising:
inputting a labeled data set to a processor;
altering, within the labeled data set, data corresponding to a first label;
training a discriminator based on the labeled data set to create a poisoned discriminator;
training a generator based on the poisoned discriminator to create a poisoned generator;
testing the poisoned generator for the first label to determine whether the poisoned generator is inaccurate for the first label to a threshold inaccuracy;
testing the poisoned generator for a second label corresponding to unaltered data within the labeled data set to determine whether the poisoned generator is accurate for the second label to a threshold accuracy;
if the poisoned generator is both inaccurate for the first label to a threshold inaccuracy, and accurate for the second label to a threshold accuracy, ending training of the generator; and
if the poisoned generator is not inaccurate for the first label to a threshold inaccuracy or not accurate for the second label to a threshold accuracy, further altering the data corresponding to the first label and retraining the generator based on the labeled data set.

2. The method of claim 1 , wherein altering the data corresponding to the first label comprises perturbing the data corresponding to the first label.

3. The method of claim 1 , wherein altering the data corresponding to the first label comprises relabeling the data corresponding to the first label.

4. The method of claim 1 , wherein altering the data corresponding to the first label comprises non-bijectively altering the data corresponding to the first label.

5. The method of claim 1 , wherein a detectability of the alteration of the data corresponding to the first label is more difficult than a threshold difficulty.

6. The method of claim 1 , wherein a reversibility of the alteration of the data corresponding to the first label is more difficult than a threshold reversibility.

7. The method of claim 1 , wherein the generator is inaccurate for the first label to a threshold inaccuracy if an output image generated by the generator is perturbed to a threshold Perturbation as compared with a reference image.

8. The method of claim 1 , wherein the generator is inaccurate for the first label to a threshold inaccuracy if output images generated by the generator are misclassified by the discriminator with respect to the first label with a threshold frequency.

9. The method of claim 1 , wherein the generator is accurate for the second label to a threshold accuracy if output images generated by the generator are correctly classified by the discriminator with respect to the second label with a threshold frequency.

10. A processor configured to train a generator in a generative adversarial network (GAN), the processor comprising:
circuitry configured to input a labeled data set;
circuitry configured to alter, within the labeled data set, data corresponding to a first label;
circuitry configured to train a discriminator based on the labeled data set to create a poisoned discriminator;
circuitry configured to train a generator based on the poisoned discriminator to create a poisoned generator;
circuitry configured to test the poisoned generator for the first label to determine whether the poisoned generator is inaccurate for the first label to a threshold inaccuracy;
circuitry configured to test the poisoned generator for a second label corresponding to unaltered data within the labeled data set to determine whether the poisoned generator is accurate for the second label to a threshold accuracy;
circuitry configured to, if the poisoned generator is inaccurate for the first label to a threshold inaccuracy, and accurate for the second label to a threshold accuracy, end training of the generator; and
circuitry configured to, if the poisoned generator is not inaccurate for the first label to a threshold inaccuracy or not accurate for the second label to a threshold accuracy, further alter the data corresponding to the first label and retrain the generator based on the labeled data set.

11. The processor of claim 10 , wherein altering the data corresponding to the first label comprises perturbing the data corresponding to the first label.

12. The processor of claim 10 , wherein altering the data corresponding to the first label comprises relabeling the data corresponding to the first label.

13. The processor of claim 10 , wherein altering the data corresponding to the first label comprises non-bijectively altering the data corresponding to the first label.

14. The processor of claim 10 , wherein a detectability of the alteration of the data corresponding to the first label is more difficult than a threshold difficulty.

15. The processor of claim 10 , wherein a reversibility of the alteration of the data corresponding to the first label is more difficult than a threshold reversibility.

16. The processor of claim 10 , wherein the generator is inaccurate for the first label to a threshold inaccuracy if an output image generated by the generator is perturbed to a threshold perturbation as compared with a reference image.

17. The processor of claim 10 , wherein the generator is inaccurate for the first label to a threshold inaccuracy if output images generated by the generator are misclassified by the discriminator with respect to the first label with a threshold frequency.

18. The processor of claim 10 , wherein the generator is accurate for the second label to a threshold accuracy if output images generated by the generator are correctly classified by the discriminator with respect to the second label with a threshold frequency.

Assignees

• Advanced Micro Devices Inc

Inventors

• Malaya Nicholas

Classifications

• G06N3/084 Primary

  Backpropagation, e.g. using gradient descent · CPC title

• G06V10/774

  Generating sets of training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• G06V10/82

  using neural networks · CPC title

• G06V10/764

  using classification, e.g. of video objects · CPC title

• G06F18/28

  Determining representative reference patterns, e.g. by averaging or distorting; Generating dictionaries · CPC title