Information processing system, inference method, attack detection method, inference execution program and attack detection program

An inference method that improves an ability of a neural network to withstand and detect latent attacks, the method comprising:

• storing position information in a latent space database, wherein the position information is in a latent space in which first output vectors are output vectors of a hidden layer of the neural network that are embedded with input data used for learning of the neural network, comprising:
• obtaining a second output vector which is an output vector of the hidden layer included in the neural network with input data to be inferred;
• inferring the input data based on a positional relationship between the second output vector and the first output vectors in the latent space;
• detecting an attack by an Adversarial Example via at least one of a plurality of attack detection modes which compare the inference made by the neural network with the inference based on the positional relationship between the second output vector and the first output vectors in the latent space;
• and
• displaying an attack alert notification when the attack by Adversarial Example is detected.

An attack detection method for improving an ability of a neural network to withstand and detect latent attacks, the method comprising:

• determining which label among a plurality of labels is applicable to input data or select any one of a plurality of options to maximize reward for input data;
• storing position information in a latent space database, wherein the position information is in a latent space in which first output vectors of a hidden layer included in the neural network are embedded with input data used for learning of the neural network;
• obtaining a second output vector which is an output vector of the hidden layer included in the neural network with input data to be inferred;
• detecting an attack by an Adversarial Example via at least one of a plurality of attack detection modes which compare a first inference made by the neural network and a second inference based on a positional relationship between the second output vector and the first output vectors in the latent space;
• and
• displaying an attack alert notification when the attack by Adversarial Example is detected.

A non-transitory computer readable storage medium that stores an inference execution program that improves an ability of a neural network to withstand and detect latent attacks and that when executed by a processor causes the processor to execute a method comprising:

• storing position information in a latent space database, wherein the position information is in a latent space in which first output vectors are output vectors of a hidden layer of the neural network that embeds input data used for learning of the neural network
• obtaining a second output vector which is an output vector of the hidden layer included in the neural network concerning input data to be inferred, and
• inferring the input data based on a positional relationship between the second output vector and the first output vectors in the latent space;
• detecting an attack by an Adversarial Example via at least one of a plurality of attack detection modes which compare the inference made by the neural network with the inference based on the positional relationship between the second output vector and the first output vectors in the latent space;
• and
• displaying an attack alert notification when the attack by Adversarial Example is detected.

A non-transitory computer readable storage medium that stores an attack detection program for improving an ability of a neural network to withstand and detect latent attacks, the attack detection program when executed by a processor cause the processor to execute a method comprising:

• determining which label among a plurality of labels is applicable to input data or select any one of a plurality of options to maximize reward for input data by using the neural network, wherein the neural network includes a plurality of hidden layers;
• storing position information in a latent space database, wherein the position information is in a latent space in which first output vectors that are output vectors of a predetermined hidden layer included in the neural network and, are embedded with input data used for learning of the neural network;
• obtaining a second output vector which is an output vector of the predetermined hidden layer included in the neural network concerning input data to be inferred,
• detecting an attack by an Adversarial Example via at least one of a plurality of attack detection modes which compare a first inference made by the neural network with a second inference based on a positional relationship between the second output vector and the first output vectors in the latent space, and
• displaying an attack alert notification when the attack by Adversarial Example is detected.