Method, apparatus and computer program for generating robust automated learning systems and testing trained automated learning systems

A method for determining a largest modification magnitude of a modification to a test input value to an input layer of a first automated learning system that does not cause an output layer of the first automated learning system to output a predefined target output value that is different than a correct output value that is assigned to the test input value, the first automated learning system being a neural network having (i) the input layer, (ii) hidden layers, and (iii) the output layer, the method comprising:

• determining a second output value based on (i) the predefined target output value and (ii) a reference output value that is one of the correct output value and a first output value of the first automated learning system;
• propagating the second output value through a second automated learning system, the second automated learning system being a neural network having (i) an input layer configured to perform a transformation that is a conjugate of a transformation performed by the output layer of the first automated learning system and being configured to receive the second output value, (ii) hidden layers each corresponding to a respective layer of the hidden layers of the first automated learning system but being arranged in reverse order compared to the corresponding hidden layers of the first automated learning system, each of the hidden layers of the second automated learning system being configured to perform a transformation that is a conjugate of a transformation performed by the corresponding respective layer of the hidden layers of the first automated learning system, and (iii) an output layer configured to perform a transformation that is a conjugate of a transformation performed by the input layer of the first automated learning system and being configured to output a third output value;
• determining an objective function based on (i) the test input value, (ii) the third output value that results from the propagation of the second output value through the second automated learning system, and (iii) the modification magnitude;
• and
• determining the largest modification magnitude depending on the objective function such that the objective function does not become smaller than a predetermined threshold.

A method for training a first automated learning system, the first automated learning system being a neural network having (i) an input layer, (ii) hidden layers, and (iii) an output layer, the method comprising:

• providing (i) a predetermined modification magnitude and (ii) training data including both training input values and corresponding training output values;
• providing a second automated learning system based on the automated learning system, the second automated learning system being a neural network having (i) an input layer configured to perform a respective second transformation that is a conjugate of a respective first transformation performed by the output layer of the first automated learning system, (ii) hidden layers each corresponding to a respective layer of the hidden layers of the first automated learning system but being arranged in reverse order compared to the corresponding hidden layers of the first automated learning system, each of the hidden layers of the second automated learning system being configured to perform a respective second transformation that is a conjugate of a respective first transformation performed by the corresponding respective layer of the hidden layers of the first automated learning system, and (iii) an output layer configured to perform a respective second transformation that is a conjugate of a respective first transformation performed by the input layer of the first automated learning system;
• determining, for each training input value, a corresponding second output value based on (i) a predefined target output value and (ii) the training output value that corresponds to the respective training input value;
• propagating the corresponding second output values through the second automated learning system to yield corresponding third output values of the second automated learning system;
• determining at least an objective function based on (i) the predetermined modification magnitude, (ii) at least one of the training input values, and (iii) at least one of the corresponding third output values of the second automated learning system;
• determining a loss function which depends on the determined objective function and which also depends on at least the training output value which corresponds to the at least one of the training input values;
• and
• optimizing the determined loss function by adjusting parameters of the first automated learning system.