JP6695595B2 - Inference device and inference method - Google Patents

Description

  The present invention relates to an inference device and an inference method.

  In the server / client model, there is known a technique for transmitting / receiving encrypted data between the server / client in order to prevent leakage of highly confidential information such as personal information when processing data on the server side. There is.

In the server / client model, data is encrypted and transmitted / received between the server device and the client device. In this case, the server device executes various processes after decrypting the encrypted data received from the client device. Then, the server device encrypts the processing result and sends it to the client device. Client device to obtain a processing result of the plaintext by decoding processing result of the encrypted received from the server apparatus.

Furthermore, in order to prevent the leakage of information, the server device is processing the data that has been encrypted without decrypting it. Homomorphic encryption is known as a technique for processing data while it is encrypted.

  By using the homomorphic encryption, the server device can process the data in the encrypted state. Further, the client device acquires the processed encrypted data from the server device and decrypts the acquired encrypted data. As a result, the client device can obtain the same processing result as when processing the data in plain text. In the following description, the encrypted state is also simply referred to as an encrypted state.

  One of the technical fields in which processing using a server / client model is required is inference processing using a neural network (NN). This is because the scale of the parameters of the learned model of the neural network becomes large and it becomes difficult to execute the operation executed in the inference processing with the resource of the client device. Therefore, by using the server-client model, it is required to execute the inference processing in the server device by utilizing the resources of the server device capable of large-scale calculation.

  The neural network is a network in which a plurality of neurons are connected to form an input layer, an intermediate layer, and an output layer. The neural network may include a plurality of intermediate layers. Machine learning using a neural network that includes multiple intermediate layers is called deep learning. Deep learning is used for recognition processing of images, characters, sounds, and the like.

  As a related technique, the ciphertext processing device obtains a first polynomial in which the first text data is polynomialized in the first order and encrypted with the first public key. Further, the ciphertext processing device generates a first squared value polynomial in which the squared value vector data of each component of the first text data is polynomialized in the first order and encrypted with the first public key. get. Further, the ciphertext processing device uses a second polynomial in which the second text data is polynomialized in the second order and encrypted with the first public key, and the square of each component of the second text data. Value vector data is polynomialized in the second order to obtain a second squared value polynomial encrypted with the first public key. Then, the ciphertext processing device uses the first polynomial and the first squared polynomial, and the second polynomial and the second squared polynomial to convert the second text data to the first text data. There is known a technique for determining whether or not it is included in.

As another related technique, the server device executes an operation for an operation part other than the activation function while encrypting the data using homomorphic encryption. Also, the client device decodes the data and executes the operation for the operation portion related to the activation function. There is known a technique in which the server device inquires the client of the calculation result every time the activation function is calculated.

As another related technology, there is a type called Somewhat homomorphic encryption (SHE) among the homomorphic encryptions. Somewhat homomorphic encryption is a homomorphic encryption in which addition and multiplication of a predetermined number of times are established in an encrypted state. For example, since the calculation of the inner product of vectors is composed of first-order multiplication and additions thereof, Somewhathat homomorphic encryption can be used. Therefore, the non-linear function included in the neural network is approximated to a linear function expressed by addition and multiplication of the number of times that can be calculated by Somewhat homomorphic encryption. Thus, various processes performed by the neural network, data technique is known that can be executed in an encrypted state (e.g., Patent Document 1, Patent Document 2, and Non-Patent Document 1 reference).

JP, 2005-184594, A U.S. Patent Application Publication No. 2016/0350648

C. Orlandi, A. Piva, and M. Barni, Research Article Oblivious Neural Network Computing via Homomorphic Encryption, Internet <http://clem.dii.unisi.it/~vipp/files/publications/S1687416107373439.pdf>

  In the above-described inference technique, in a system using a neural network, an operation is executed using homomorphic encryption, so the amount of operation may increase and the system load may increase.

  The present invention, as one aspect, provides a technique of suppressing a system load in a neural network system using homomorphic encryption.

  One of the inference devices disclosed in this specification is an inference device including an acquisition unit, a setting unit, and an inference unit. The acquisition unit acquires a learned model in which a parameter including at least one of a connection weight and a bias between neurons included in the neural network is adjusted by using the first neural network that employs a nonlinear function as an activation function. .. The setting unit sets parameters in the second neural network that employs an approximate polynomial of a non-linear function as the activation function according to the learned model. When the encrypted data is input, the inference unit uses the second neural network to execute the inference process with the encrypted data encrypted.

  According to one embodiment, in a neural network system using homomorphic encryption, system load can be suppressed.

It is a figure which shows the structure of one Example of a neural network. It is a functional block diagram which shows one Example of the system of a neural network. It is a flow chart which shows an example of processing in a system of a neural network. It is a figure which shows one Example of the neuron contained in a neural network. It is a figure which shows one Example of the approximate polynomial of a nonlinear function. FIG. 3 is a block diagram showing an example of a computer device. It is a figure which shows the correct answer rate of the image recognition process using a neural network.

[Embodiment]
The inference apparatus of the embodiment will be described.

FIG. 1 is a diagram showing the configuration of an embodiment of a neural network.
The arithmetic processing performed by the neural network will be described with reference to FIG.

The outputs of the neurons in the input layer are weighted by the weighting factor w1 and input to the neurons in the intermediate layer. The neurons in the middle layer calculate a1, a2, and a3 by taking the sum of the input weighted values. For example, a1 is calculated by Expression (1).
a1 = x1 × w1 (11) + x2 × w1 (12) (1)

The outputs of the neurons in the intermediate layer are weighted by the weighting coefficient w2 and input to the output layers. Each neuron in the output layer calculates y1 and y2 by summing the input weighted values. For example, y1 is calculated by equation (2).
y1 = σ (a1) × w2 (11) + σ (a2) × w2 (12)
+ Σ (a3) × w2 (13) (2)

  In each neuron of the intermediate layer, as shown in FIG. 1, a predetermined operation is performed on the operation results a1, a2, a3 by using the activation function σ. The activation function is a function that converts the sum of input signals into an output signal.

  In the neural network, a nonlinear function is used as the activation function. This means that when a linear function is used as the activation function, the output is in the form of linear combination. Then, a neural network including a plurality of intermediate layers becomes equivalent to a neural network without an intermediate layer.

The types of activation functions include a sigmoid function shown in Expression (3) and a ReLU (Rectified Linear Unit) function shown in Expression (4).
σ (u) = 1 / (1 + exp (−u)) (3)
σ (u) = u (u> 0), 0 (u ≦ 0) (4)

In inference processing using a neural network system, it is possible to process data in an encrypted state by using homomorphic encryption in order to prevent information leakage.
However, as described above, the calculation of the neural network includes the calculation of the nonlinear function. Therefore, the homomorphic encryption that can only perform multiplication and addition cannot execute the arithmetic processing of the neural network.

  Therefore, it is conceivable to execute the operation of the neural network on homomorphic encryption by using an approximate polynomial of a non-linear function for the activation function included in the neural network. However, in the system of the neural network including the learning device and the inference device, there is a problem that the system load increases when the homomorphic encryption is used for the activation function.

  In order to solve the above-mentioned problem, the inference device of the embodiment employs the parameters of a trained model adjusted using a neural network that employs a nonlinear function as an activation function, and employs an approximate polynomial of the nonlinear function as an activation function. Set to the neural network. Then, the inference apparatus executes inference processing. In the following description, a neural network that uses an approximate polynomial of a non-linear function as an activation function is also simply referred to as a second neural network.

  As a result, the inference device of the embodiment reduces the load of machine learning executed by the learning device. That is, the inference apparatus of the embodiment can suppress system load in a neural network system that uses homomorphic encryption for inference processing in order to prevent information leakage.

  The homomorphic encryption method may be any homomorphic encryption capable of calculating an approximate polynomial. When the approximate polynomial includes four arithmetic operations, Somewhat homomorphic encryption or complete homomorphic encryption capable of performing multiplication and addition of ciphertexts may be used. When the approximate polynomial includes only multiplication and addition, addition homomorphic encryption, Somewhat homomorphic encryption, or complete homomorphic encryption capable of calculating addition of ciphertexts may be used.

  It should be noted that because Somewhat homomorphic encryption or full homomorphic encryption is capable of multiplication and addition, it is possible to execute arbitrary operations. In addition, in the additive homomorphic encryption, it is possible to execute multiplication by performing addition processing a plurality of times.

FIG. 2 is a functional block diagram showing an embodiment of the neural network system.
A system (inference system) of the neural network of the embodiment will be described with reference to FIG. In the following description, a neural network used for image recognition processing will be described as an example. Not limited to this, the neural network system of the embodiment is applicable to other processes such as conversation, driving support, and prediction.

The neural network system 100 includes a learning device 1, an inference device 2, and a client device 3. The learning device 1 is, for example, an information processing device possessed by a service provider of inference processing. The inference apparatus 2 is, for example, an information processing apparatus used as a server device in a server / client model. The client device 3 is, for example, an information processing device owned by a user who uses the inference process.
The learning device 1, the inference device 2, and the client device 3 are communicably connected to each other, for example, via a network.

The learning device 1 includes a reception unit 11 and a creation unit 12.
The reception unit 11 receives, for example, an input of a learning set in which a set of combinations indicating target values corresponding to input values is stored.

  The creating unit 12 uses the first neural network in which the activation function is a non-linear function, and uses the first neural network to adjust the learned model 40 in which the parameters including at least one of the connection weight and the bias between the neurons included in the neural network are adjusted. create. The parameters included in the trained model 40 include at least one of the weight of the coupling between the neurons for weighting the input value and the bias for biasing the activation of the output signal. In the following description, the first neural network that employs a non-linear function as the activation function is also simply referred to as the first neural network.

  The creating unit 12 executes supervised learning for adjusting the parameters of the first neural network using the learning set whose input is accepted by the accepting unit 11. For example, when performing learning processing using a learning set, the creation unit 12 repeatedly adjusts the parameters of the neural network using error back propagation so that the target value corresponding to the input value is output. As a result, the creation unit 12 outputs the adjusted parameters as the learned model 40.

The creating unit 12 may create unlearned models 40 by reading data without correct answers and executing unsupervised learning for adjusting the parameters of the first neural network. Further, the creating unit 12 may create the learned model 40 by executing the reinforcement learning for adjusting the parameters of the first neural network so as to maximize the future value. The learning device 1 may perform at least one of supervised learning, unsupervised learning, and reinforcement learning.

  As described above, in the learning device 1, in the creating unit 12, the learning process is executed by using the first neural network that employs the nonlinear function as the activation function. This is because the machine learning is processed by the learning device 1 and does not transmit information to the network and the server device. Therefore, the learning device 1 gives priority to reducing the amount of calculation in the learning process, rather than preventing the leakage of information on the network and the server device.

  That is, in the neural network system according to the embodiment, the learning amount is reduced by using the first neural network in the learning process. Since the learning process executes the calculation of repeating the parameter adjustment using the error back propagation, the calculation amount becomes larger than that of the inference process processed by the forward propagation. Therefore, in the neural network system of the embodiment, the first neural network is used in the learning process. As a result, the neural network system according to the embodiment reduces the amount of calculation per iteration and efficiently suppresses the system load of the neural network.

The inference apparatus 2 includes an acquisition unit 21, a setting unit 22, an inference unit 23, an output unit 24, and a storage unit 25. The storage unit 25 stores the learned model 40.
The acquisition unit 21 uses the first neural network that employs a non-linear function as the activation function, and uses the first neural network to adjust the parameter including at least one of the weight and the bias of the coupling between the neurons included in the neural network. get. Then, the acquisition unit 21 may store the acquired learned model 40 in the storage unit 25.

  According to the learned model 40, the setting unit 22 sets parameters in the second neural network that uses an approximate polynomial of a non-linear function as the activation function. That is, the setting unit 22 sets at least one of the connection weight and the bias between the neurons included in the second neural network.

  When the encrypted data is input, the inference unit 23 uses the second neural network to execute the inference process with the encrypted data encrypted. At this time, the inference unit 23 executes the inference process by performing the homomorphic encryption operation using the encrypted data as it is encrypted. The encrypted data is input from the client device 3 that executes the encryption process and the decryption process using the homomorphic encryption.

  The first neural network and the second neural network are, for example, convolutional neural networks (CNN) that execute convolutional operations. The convolutional neural network uses a convolutional layer that extracts a feature of input data by performing a convolutional process with a filter on a two-dimensional input, a pooling layer that performs a compression process, and a fully connected layer at the final stage. To execute inference processing. The convolutional neural network is mainly used for image recognition.

The inference unit 23 executes a calculation using a convolutional neural network. The convolution operation can be expressed by addition and multiplication in digital signal processing. As a result, the inference unit 23 can execute the inference process using the homomorphic encryption that can execute only addition and multiplication. The inference unit 23 is not limited to the convolutional neural network, and may execute an operation using another neural network within a range that can be calculated by the homomorphic encryption.

  Other neural networks include, for example, supervised neural networks such as the Recurrent Neural Network (RNN) and the fully connected (feedforward) type. Other neural networks include autoencoders and unsupervised neural networks such as Boltzmann machines.

  As described above, there are various types of homomorphic encryption, such as additive homomorphic encryption, somewhat homomorphic encryption, and complete homomorphic encryption. Additive homomorphic ciphers can only be added. Somewhat homomorphic encryption can perform additions and a finite number of multiplications. Full homomorphic encryption can perform addition and multiplication. Therefore, the perfect homomorphic encryption can perform arbitrary processing by combining addition and multiplication. The processing speed is highest in the additive homomorphic encryption, and slower in the order of somewhat homomorphic encryption and complete homomorphic encryption.

  When the additive homomorphic encryption is used in order to give priority to improvement of the processing speed of inference processing and suppression of processing load, the inference unit 23 may execute addition a plurality of times instead of multiplication. Thereby, the inference unit 23 can execute the convolutional neural operation using the additive homomorphic encryption.

The inference unit 23 may use somewhat homomorphic encryption when executing the convolutional neural network and other neural networks. When the somewhat homomorphic encryption is used, the inference unit 23 determines whether the nonlinear function included in the operation of the second neural network has priority depending on which of the improvement of the processing speed of the inference processing, the suppression of the processing load, and the processing accuracy is prioritized. the following number and the number of additions of the approximate polynomial may be adjusted.

  That is, the approximation polynomial of the non-linear function included in the calculation of the second neural network has at least one of decreasing the order and decreasing the number of additions when giving priority to the improvement of the processing speed of the inference processing and the suppression of the processing load. Adjustments are made. Further, the approximation polynomial of the non-linear function included in the calculation of the second neural network is adjusted in at least one of increasing the order and increasing the number of additions when giving priority to the improvement of the processing accuracy of the inference processing. When the degree of the approximation polynomial is increased and the number of additions is increased, the approximation polynomial approximates the original non-linear function, so that the accuracy of the inference process is improved.

  The inference unit 23 may use the perfect homomorphic encryption when executing another neural network including a complicated operation as compared with the convolutional neural network. Further, the inference unit 23 may use the perfect homomorphic encryption even when executing the convolutional neural network.

The inference unit 23 outputs the inference result in the encrypted state as a result of executing the inference process with the encrypted data encrypted. Since the inference unit 23 performs the inference process with the data encrypted using the homomorphic encryption encrypted, the inference result is also output in the encrypted state.
The output unit 24 outputs the encrypted inference result obtained by the inference process to the client device 3.

The client device 3 includes an acquisition unit 31, an encryption unit 32, a decryption unit 33, an output unit 34, and a storage unit 35. The storage unit 35 stores the inference result 50.
The acquisition unit 31 acquires data to be inferred. The data to be inferred is, for example, data to be recognized such as images, characters, and sounds.
The encryption unit 32 performs homomorphic encryption on the data to be inferred. As a result, the encryption unit 32 outputs the encrypted data.

When the encrypted inference result is input, the decryption unit 33 executes a homomorphic encryption decryption process on the encrypted inference result. Then, the decoding unit 33 may store the decoded inference result 50 in the storage unit 35.
The output unit 34 outputs the encrypted data obtained by the encryption unit 32 to the inference device 2. The output unit 34 may output the inference result 50 to the outside.

  FIG. 3 is a flowchart showing an example of processing in the neural network system. FIG. 4 is a diagram showing an embodiment of neurons included in the neural network. FIG. 5 is a diagram showing an example of an approximate polynomial of a non-linear function.

  The processing in the neural network system will be described with reference to FIGS. The processing in the system of the neural network is executed by the processors of the learning device 1, the inference device 2, and the client device 3, for example. In the following description, the processor of the learning process 1, the processor of the inference process 2, and the processor of the client device 3 are also simply referred to as the learning device 1, the inference device 2, and the client device 3.

This will be described with reference to FIG.
When the learning set is input (S101), the learning device 1 receives the input of the learning set (S102). Then, the learning device 1 uses the first neural network in which the activation function is a non-linear function, and adjusts the parameters including at least one of the connection weight and the bias between the neurons included in the neural network, and the learned model. 40 is acquired (S103). Then, the learning device 1 outputs the created learned model 40 to the inference device (S104).

This will be described with reference to FIGS. 4 and 5.
In the process of creating the learned model 40 in the learning device 1, non-encrypted learning set data is used. Therefore, the learning device 1 can adopt a non-linear function as the activation function σ of each neuron, for example, as shown in FIG. For example, when the sigmoid function is adopted as the activation function σ, the learning device 1 creates the learned model 40 using the function indicated by the dotted line in FIG. 5A corresponding to the equation (3). When the ReLU function is adopted as the activation function σ, the learning device 1 creates the learned model 40 using the function indicated by the dotted line in FIG. 5B corresponding to the equation (4).

This will be described with reference to FIG.
The inference apparatus 2 acquires the learned model 40 (S105). At this time, the inference apparatus 2 may store the learned model 40 in the storage unit 25. Then, the inference apparatus 2 sets the parameters of the second neural network in which the activation function is an approximate polynomial of a non-linear function according to the learned model 40 (S106). The inference apparatus 2 notifies the client apparatus 3 that the inference processing can be executed (S107).

  When the inference apparatus 2 notifies that the inference is possible, the client apparatus 3 accepts the input of the data of the inference processing target. Then, when the data to be inferred is input (S108), the client device 3 acquires the data to be inferred (S109). The data that is the target of the inference process is, for example, an image, a character, and a sound. The data to be subjected to the inference process may be input by the user using a photographing device such as a camera, an input device such as a keyboard, and a sound collecting device such as a microphone. In the following description, the target data of the inference process is also simply referred to as the target data.

The client device 3 executes a homomorphic encryption process on the target data (S110). Then, the client procedure 3 outputs the encrypted target data to the inference apparatus 2 (S111). In the following description, the encrypted target data is also simply referred to as encrypted data.
When the encrypted data is input, the inference apparatus 2 uses the second neural network to execute the inference process with the encrypted data being encrypted (S112). Then, the inference device 2 outputs the encrypted inference result obtained by the inference process to the client device (S113).

This will be described with reference to FIGS. 4 and 5.
In the inference processing in the inference apparatus 2, the encrypted data is operated while being encrypted. Therefore, the inference apparatus 2 adopts, for example, as shown in FIG. 4B, an approximate polynomial f of the activation function σ which is a non-linear function as the activation function of each neuron. For example, when the approximate polynomial f of the sigmoid function is adopted as the activation function, the inference apparatus 2 executes the inference process using the function indicated by the solid line in FIG. 5A corresponding to the following expression (5). ..

f _sig (x) = 8 * 10 ⁻¹⁵ x ⁶ + 2 * 10 ⁻⁵ x ⁵ −1 * 10 ⁻¹² x ⁴ −0.0028x ³ + 4 * 10 ⁻¹¹ x ² + 0.1672x + 0.5 (5 )

When the approximate polynomial f of the ReLU function is adopted as the activation function, the inference apparatus 2 executes the inference process using the function indicated by the solid line in FIG. 5B corresponding to the following equation (6).
f _re (x) = 5 * 10 ⁻⁸ x ⁶ −9 * 10 ⁻²⁰ x ⁵ −8 * 10 ⁻⁵ x ⁴ + 9 * 10 ⁻¹⁷ x ³ + 0.0512x ² + 0.5x (6)
As described above, by approximating the activation function to a polynomial, the inference apparatus 2 can perform inference processing while encrypting target data using homomorphic encryption.

This will be described with reference to FIG.
When the encrypted inference result is input, the client device 3 executes a homomorphic encryption decryption process on the encrypted inference result (S114). Then, the client device 3 outputs the inference result to, for example, a display device (S115).

  Note that S108 to S111 may be performed before S101 to S107. In this case, the inference apparatus 2 may store the encrypted data in the storage unit 25 when the encrypted data is acquired. Then, the inference apparatus 2 executes the inference process using the encrypted data stored in the storage unit 25 when executing the inference process in S112. In this case, in step S107, the inference device 2 does not have to notify the client device 3 that the inference can be executed.

FIG. 6 is a block diagram showing an embodiment of a computer device.
The configuration of the computer device 100 will be described with reference to FIG.
The computer device 100 includes an information processing device including a control circuit 101, a storage device 102, a reading device 103, a recording medium 104, a communication interface 105, an input / output interface 106, an input device 107, and a display device 108. Is. The communication interface 105 is also connected to the network 109. And each component is connected by the bus 110. The learning device 1, the inference device 2, and the client device 3 can be configured by appropriately selecting some or all of the components described in the computer device 100.

  The control circuit 101 controls the entire computer device 100. The control circuit 101 is a processor such as a CPU (Central Processing Unit), an FPGA (Field Programmable Gate Array), and a PLD (Programmable Logic Device).

The control circuit 101 functions as, for example, the receiving unit 11 and the creating unit 12 in the learning device 1 of FIG. The control circuit 101 functions as, for example, the acquisition unit 21, the setting unit 22, the inference unit 23, and the output unit 24 in the inference apparatus 2 of FIG. Furthermore, the control circuit 101 functions as, for example, the acquisition unit 31, the encryption unit 32, the decryption unit 33, and the output unit 34 in the client device 3 of FIG.

  The storage device 102 stores various data. The storage device 102 is, for example, a memory such as a ROM (Read Only Memory) and a RAM (Random Access Memory), an HD (Hard Disk), or the like. Further, the storage device 102 functions as the storage unit 25 in the inference device 2 of FIG. 2, for example. Further, the storage device 102 functions as the storage unit 35 in the client device 3 of FIG. 2, for example.

  Further, the ROM stores a program such as a boot program. The RAM is used as a work area for the control circuit 101. The HD stores an OS, application programs, programs such as firmware, and various data.

The storage device 102 may store a learning program that causes the control circuit 101 to function as, for example, the receiving unit 11 and the creating unit 12 of the learning device 1. The storage device 102 may store an inference program that causes the control circuit 101 to function as, for example, the acquisition unit 21, the setting unit 22, the inference unit 23, and the output unit 24 of the inference device 2. Then, the storage device 102 may store a client program that causes the control circuit 101 to function as, for example, the acquisition unit 31, the encryption unit 32, the decryption unit 33, and the output unit 34 of the client device 3.

  The learning device 1, the inference device 2, and the client device 3 read the program stored in the storage device 102 into the RAM when performing various processes. By executing the program read into the RAM by the control circuit 101, the learning device 1, the inference device 2, and the client device 3 execute the learning process, the inference process, and the client process, respectively.

The learning process includes, for example, an acceptance process executed by the learning device 1 and a creation process. The inference process includes, for example, an acquisition process, a setting process, an inference process, and an output process executed by the inference apparatus 2. The client process includes, for example, an acquisition process, an encryption process, a decryption process, and an output process executed by the client device 3.

  Note that each program described above may be stored in a storage device included in a server on the network 109 as long as the control circuit 101 can access the communication interface 105.

  The reading device 103 is controlled by the control circuit 101 and reads / writes data from / in the removable recording medium 104. The reading device 103 is, for example, various Disk Drives and USBs (Universal Serial Bus).

  The recording medium 104 stores various data. The recording medium 104 stores, for example, at least one of a learning program, an inference program, and a client program. Further, the recording medium 104 may store at least one of the learning set, the learned model 40, and the inference result 50 shown in FIG. The inference result 50 may be stored in the recording medium 104 in an encrypted state. The recording medium 104 is connected to the bus 110 via the reading device 103, and the control circuit 101 controls the reading device 103 to read / write data.

  When the learned model 40 is recorded in the recording medium 104, the inference apparatus 2 may acquire the learned model by reading the learned model from the recording medium 104. When the inference result 50 is recorded in the recording medium 104, the client device 3 may acquire the inference result 50 by reading the inference result 50 from the recording medium 104.

  The recording medium 104 is, for example, an SD memory card (SD Memory Card), an FD (Floppy Disk), a CD (Compact Disc), a DVD (Digital Versatile Disk), a BD (Blu-ray Disk: registered trademark), and a flash. A non-transitory recording medium such as a memory.

  The communication interface 105 communicatively connects the computer apparatus 100 and another apparatus via the network 109. The communication interface 105 may include an interface having a wireless LAN function and an interface having a short-range wireless communication function. The wireless LAN interface may support Wi-Fi (registered trademark) as a wireless LAN standard, for example. The short-range wireless interface may support, for example, Bluetooth (registered trademark) as a short-range wireless communication standard. LAN is an abbreviation for Local Area Network.

  The communication interface 105 functions, for example, as the acquisition unit 21 and the output unit 24 in the inference apparatus 2 of FIG. Furthermore, the communication interface 105 functions as the acquisition unit 31 and the output unit 34 in the client device 3 of FIG. 2, for example.

  The input / output interface 106 is connected to an input device 107 such as a keyboard, a mouse, and a touch panel, and when a signal indicating various information is input from the connected input device 107, a signal input via the bus 110. Is output to the control circuit 101. Further, when the signal indicating various information output from the control circuit 101 is input via the bus 110, the input / output interface 106 outputs the signal to various connected devices.

  The input / output interface 106 functions as the reception unit 11 in the learning device 1 in FIG. 2, for example. Further, the input / output interface 106 functions as the acquisition unit 21 and the output unit 24 in the inference apparatus 2 of FIG. 2, for example. Furthermore, the input / output interface 106 functions as the acquisition unit 31 and the output unit 34 in the client device 3 of FIG. 2, for example.

  The learning device 1 may receive an input such as a learning set via the input device 107. The inference apparatus 2 may accept an input such as a request to execute inference processing via the input device 107. The client device 3 may accept input of data to be inferred by the input device 107.

The display device 108 displays various information. The display device 108 may display information for accepting an input on the touch panel. The display device 108 may be connected to the output unit 34 of FIG. 2, for example, and may display information corresponding to the inference result 50 decoded by the decoding unit 33.

Further, the input / output interface 106, the input device 107, and the display device 108 may function as a GUI (Graphical User Interface). Thereby, the computer device 100 accepts an intuitive operation using a touch panel, a mouse, or the like.
The network 109 is, for example, a LAN, wireless communication, or the Internet, and communicatively connects the computer device 100 and another device. The learning device 1, the inference device 2, and the client device 3 may be communicatively connected to each other via the network 109.

As described above, the inference apparatus 2 uses the learned model obtained by the operation of the neural network that employs the non-linear function as the activation function, and uses the learned model of the neural network that employs the recent polynomial of the non-linear function as the activation function. Inference processing is executed by calculation. Since the inference device 2 employs the approximate polynomial as the activation function in the inference process, the inference process can be performed by the operation of the homomorphic encryption. As a result, the inference apparatus 2 can reduce the processing load on the learning apparatus and the system load in the neural network system using the homomorphic encryption.

The inference device 2 executes the inference process while the encrypted data input from the client device 3 that executes the homomorphic encryption encryption process and the decryption process remains encrypted. Then, the inference device 2 outputs the encrypted inference result obtained by the inference process to the client device. As a result, the inference apparatus 2 executes the inference process while the encryption is performed using the homomorphic encryption in the neural network system using the homomorphic encryption, so that the leakage of information can be prevented.

The inference device 2 executes an operation using a convolutional neural network. The convolution operation can be expressed by addition and multiplication in digital signal processing. As a result, the inference apparatus 2 can perform the inference process using the homomorphic encryption that can perform at least one of addition and multiplication, which has a relatively high processing speed among the homomorphic encryptions.

FIG. 7 is a diagram showing a correct answer rate of image recognition processing using a neural network.
The correct answer rate of the inference processing in the neural network system according to the embodiment will be described with reference to FIG. 7.
The correct answer rate table 200 is a table showing the relationship between the correct answer rate and the activation function adopted in each of the learning process and the inference process in the image recognition process using the convolutional neural network. The correct answer rate table 200 shows an average value, a minimum value, and a maximum value of the correct answer rates obtained by performing an experiment in which the image recognition processing is performed a plurality of times.

  The polynomial-polynomial column of the correct answer rate table 200 shows a correct answer rate when an approximate polynomial of the Relu function which is a non-linear function is adopted as an activation function in the learning process and the inference process. The Relu-Relu column of the correct answer rate table 200 shows the correct answer rate when the Relu function which is a non-linear function is adopted as the activation function in the learning process and the inference process. The Relu-polynomial column of the correct answer rate table 200 indicates the correct answer rate when the Relu function which is a non-linear function is adopted as the activation function in the learning process and the approximate polynomial of the Relu function is adopted as the activation function in the inference process. ..

  Referring to the column of Relu-polynomial, the correct answer rate when the image recognition processing is performed using the Relu function for learning processing and the approximate polynomial for inference processing is 85.2% on average, 79.5% at minimum, and 92.0 at maximum. You can see that it was%. Therefore, the experiment result shown in the correct answer rate table 200 indicates that the image can be recognized by using the neural network system using the Relu function for the learning process and the approximate polynomial for the inference process.

  It should be noted that the present embodiment is not limited to the above-described embodiments, and various configurations or embodiments can be adopted without departing from the gist of the present embodiment.

1 Learning Device 2 Inference Device 3 Client Device 100 Computer Device 101 Control Circuit 102 Storage Device 103 Reading Device 104 Recording Medium 105 Communication I / F
106 Input / output I / F
107 input device 108 display device 109 network 110 bus

Claims (7)

An acquisition unit for acquiring a learned model in which a parameter including at least one of weight and bias of connection between neurons included in the neural network is adjusted by using the first neural network that employs a nonlinear function as an activation function;
A setting unit that sets parameters in a second neural network that employs an approximation polynomial of the nonlinear function as an activation function according to the learned model;
An inference unit that performs inference processing using the second neural network when the encrypted data is input, while the encrypted data is being encrypted;
An inference device comprising: The encrypted data is
Input from the client device that executes the encryption and decryption processing of homomorphic encryption,
The inference unit is
Performing the inference process using the operation of the homomorphic encryption,
The reasoning device further comprises:
The inference apparatus according to claim 1, further comprising: an output unit that outputs an encrypted inference result obtained by the inference processing to the client device. The inference device according to claim 1 or 2, wherein the first neural network and the second neural network are convolutional neural networks. An inference system comprising a learning device and an inference device,
The learning device is
A first neural network that employs a nonlinear function as an activation function is used, and a preparation unit is provided that creates a trained model in which parameters including at least one of connection weight and bias between neurons included in the neural network are adjusted. ,
The inference device is
An acquisition unit that acquires a model that has been trained in the previous term,
A setting unit that sets parameters in a second neural network that employs an approximation polynomial of the nonlinear function as an activation function according to the learned model;
An inference unit that performs inference processing using the second neural network when the encrypted data is input, while the encrypted data is being encrypted;
An inference system comprising: The inference system further comprises a client device,
The reasoning device further comprises:
A first output unit for outputting the encrypted inference result obtained by the inference process to the client device;
The inference unit is
By using an arithmetic homomorphic encryption, it performs the inference process,
The client device is
An encryption unit that executes homomorphic encryption on the data that is the target of inference processing,
A second output unit for outputting the encrypted data obtained by the encryption unit to the inference device;
When the encrypted inference result is input for the encrypted inference result, a decoding unit that performs decoding processing of the homomorphic encryption,
The inference system according to claim 4, further comprising: A computer-implemented inference method, comprising:
Using a first neural network that employs a nonlinear function as an activation function, a trained model in which parameters including at least one of connection weights and biases between neurons included in the neural network are adjusted is acquired,
According to the learned model, parameters are set in a second neural network that employs an approximate polynomial of the nonlinear function as an activation function,
When the encrypted data is input, the second neural network is used to execute the inference processing while the encrypted data is encrypted.
An inference method characterized by that. Using a first neural network that employs a nonlinear function as an activation function, a trained model in which parameters including at least one of connection weights and biases between neurons included in the neural network are adjusted is acquired,
According to the learned model, parameters are set in a second neural network that employs an approximate polynomial of the nonlinear function as an activation function,
When the encrypted data is input, the second neural network is used to execute the inference processing while the encrypted data is encrypted.
An inference program characterized by causing a computer to execute processing.

Images