Adversarial example detection device, adversarial example detection method, and program

An adversarial example detection method comprising:

• extracting first features with respect to input data and comparison data in a first calculation method;
• extracting second features with respect to the input data and the comparison data in a second calculation method different from the first calculation method;
• and
• determining whether or not at least one piece of the input data and the comparison data is an adversarial example through calculation using the first features and the second features,
• wherein the determining includes calculating a degree of similarity (DoS) score between features of the input data and the comparison data,
• wherein:
• when an authentication based on the first features succeeds by calculating the DoS score as less than a detection threshold, the second features are extracted as extract features of processed data of the input data and the comparison data,
• the first calculation method and the second calculation method are calculation methods based on a calculation model created in machine learning,
• the first calculation method comprises calculating the first features by inputting the input data and the comparison data into a first model, the first model being a trained neural network model,
• the second calculation method comprises:
• calculating the second features by inputting the input data and the comparison data as a vector into a second model and converting the vector input into a low-dimensional feature vector for classification, the second model being a neural network model in which a value of a specific neuron among a plurality of neurons constituting the first model is changed, wherein neurons of the plurality of neurons having a strong correlation are examined from the neural network model, and values of the neurons are emphasized among machine learning models;
• generating process data by reducing a color depth of each pixel of the input data and the comparison data or by spatially smoothing the input data and the comparison data;
• and
• calculating features of the process data by the first calculation method.

A non-transitory computer-readable recording medium storing a program configured to cause a computer to:

• extract first features with respect to input data and comparison data in a first calculation method;
• extract second features with respect to the input data and the comparison data in a second calculation method different from the first calculation method;
• and
• determine whether or not at least one piece of the input data and the comparison data is an adversarial example through calculation using the first features and the second features, wherein the determine includes calculating a degree of similarity (DoS) score between features of the input data and the comparison data,
• wherein:
• when an authentication based on the first features succeeds by calculating the DoS score as less than a detection threshold, the second features are extracted as extract features of processed data of the input data and the comparison data,
• wherein the first calculation method and the second calculation method are calculation methods based on a calculation model created in machine learning,
• the first calculation method comprises calculating the first features by inputting the input data and the comparison data into a first model, the first model being a trained neural network model,
• the second calculation method comprises:
• calculating the second features by inputting the input data and the comparison data as a vector into a second model and converting the vector input into a low-dimensional feature vector for classification, the second model being a neural network model in which a value of a specific neuron among a plurality of neurons constituting the first model is changed, wherein neurons of the plurality of neurons having a strong correlation are examined from the neural network model, and values of the neurons are emphasized among machine learning models;
• generating process data by reducing a color depth of each pixel of the input data and the comparison data or by spatially smoothing the input data and the comparison data;
• and
• calculating features of the process data by the first calculation method.