JP7042414B2 - Learning equipment, learning systems, learning methods and learning programs - Google Patents

Description

The present invention relates to a learning device, a learning system, a learning method and a learning program capable of proving the validity of a learning result.

Non-Patent Document 1 proposes a technique in which a client can verify whether or not the result of an arithmetic operation is correct when the server executes the four arithmetic operations. This technology also has the feature that communication between the server and the client is not required during the verification process.
Further, when the process requested from the client to the server is a polynomial operation, a protocol called sum-check, which is characterized by being lightweight, is a non-patent document, although communication occurs between the server and the client during the verification process. Proposed in 2. Further, a technique in which sum-check is applied to the inference phase of machine learning is proposed in Non-Patent Document 3.

B. Parno, C.I. Gentry, J.M. Howell and M. Raykova. “Pinoccio: Nearly Practical Verifiable Computation.” 2013 IEEE Symposium on Security and Privacy (2013). C. Lund, L. Fortnow, H. et al. Karloff and N. Nisan. "Algebraic Methods for Interactive Proof Systems." Journal of the Association for Computing Machinery, Vol. 39, No. 4 (1992). Z. Goodsi, T.M. Gu and S. Garg. "SafetyNets: Verifiable Exhibition of Deep Natural Networks on an Untrusted Cloud." NIPS (2017).

All of the above-mentioned techniques are techniques that enable the verifier to prove whether or not the certifier has executed the process correctly. However, Non-Patent Document 1 has a problem that the calculation cost is high, and it is difficult to apply it to machine learning. In addition, the technology of Non-Patent Document 2 or 3 that limits the types of corresponding calculations and reduces the calculation cost by communicating at the time of verification does not correspond to the calculations required in the learning phase of machine learning. There was a problem.

An object of the present invention is to provide a learning device, a learning system, a learning method, and a learning program that enable high-speed verification of processing in the learning phase of machine learning.

The learning device according to the present invention converts a model before training by machine learning, a request receiving unit that receives training data from a terminal, and a biased derivative obtained by partially differentiating the loss function from the machine learning operations into a polynomial. The learning execution unit that calculates the data, the certification generation unit that generates the certification data for verifying the validity of the calculation result by the learning execution unit, the model after the training by the machine learning, and the certification data are used in the terminal. A result transmission unit for transmitting to the terminal and a first result verification unit for verifying the certification data between the terminal and the terminal are provided.

The machine learning includes a process of selecting a subset of the training data that minimizes the value of the loss function in order to remove malicious data contained in the training data, and the learning execution unit includes the loss due to the selection. After calculating the amount of decrease in the value of the function, the proof generator excludes the condition for minimizing the value of the loss function from the process of selecting a subset of the training data that minimizes the value of the loss function. The proof data may be generated.

The learning system according to the present invention is a learning system including the learning device and a terminal that requests the learning device to perform the machine learning, and the terminal uses the pre-training model and the training data. A second result verification for verifying the certification data between the request transmission unit for transmitting to the learning device, the model after training, the result receiving unit for receiving the certification data from the learning device, and the learning device. It is equipped with a department.

The second result verification unit may confirm that the amount of decrease in the value of the loss function is positive.

In the learning method according to the present invention, a model before training by machine learning, a request reception step for receiving training data from a terminal, and a partial derivative of a loss function among the machine learning operations are converted into a polynomial. The learning execution step to be calculated, the proof generation step to generate the proof data for verifying the validity of the calculation result in the learning execution step, the model after the training by the machine learning, and the proof data to the terminal. The computer executes a result transmission step of transmitting to the terminal and a first result verification step of verifying the certification data with the terminal.

The learning program according to the present invention is for making a computer function as the learning device.

According to the present invention, processing in the learning phase of machine learning can be verified at high speed.

It is a block diagram which shows the functional structure of the learning system which concerns on embodiment. It is a sequence diagram which shows the processing procedure of the learning method which concerns on embodiment. It is a figure which shows the algorithm of TRIM which concerns on embodiment. It is a figure which shows the algorithm of the selection processing of the subset which concerns on embodiment.

Hereinafter, an example of the embodiment of the present invention will be described.
FIG. 1 is a block diagram showing a functional configuration of the learning system 1 according to the present embodiment.
The learning system 1 includes a server 10 (learning device) and a client 20 (terminal), both of which are communicably connected. The server 10 is requested by the client 20 to execute machine learning.

The server 10 is an information processing device (computer) provided with various data input / output devices, communication devices, and the like, in addition to the control unit 11 and the storage unit 12.

The control unit 11 is a part that controls the entire server 10, and realizes each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 12. The control unit 11 may be a CPU.

The storage unit 12 is a storage area for various programs and various data for making the hardware group function as the server 10, and may be a ROM, RAM, flash memory, hard disk (HDD), or the like. Specifically, the storage unit 12 stores a program (learning program) for causing the control unit 11 to execute each function of the present embodiment, a model to be learned, training data, certification data described later, and the like.

The control unit 11 includes a request reception unit 111, a learning execution unit 112, a proof generation unit 113, a result transmission unit 114, and a result verification unit 115 (first result verification unit). The control unit 11 performs machine learning of linear regression using the training data received from the client 20 by these functional units, and provides the client 20 with a verification function for verifying the validity of the learning result.

The request receiving unit 111 receives the model before training by machine learning and the training data from the client 20.

The learning execution unit 112 calculates the partial derivative obtained by partially differentiating the loss function by converting it into a polynomial among the machine learning operations.
Further, in machine learning, when a process of selecting a subset of training data that minimizes the value of the loss function is included in order to remove malicious data included in the training data, the learning execution unit 112 causes a loss due to the selection of the subset. Calculate the amount of decrease in the value of the function.
The details of the calculation by the learning execution unit 112 will be described later.

The proof generation unit 113 generates proof data for verifying the validity of the calculation result by the learning execution unit. The proof data is generated by the sum-check proposed in Non-Patent Document 2 described above.
At this time, the proof generation unit 113 generates proof data excluding the condition of minimizing the value of the loss function from the process of selecting a subset of training data that minimizes the value of the loss function. In order to prove the condition that the value of the loss function is minimized, the proof generation unit 113 includes the decrease amount of the value of the loss function calculated by the learning execution unit 112 in the proof data.

The result transmission unit 114 transmits the model after training by machine learning and the proof data to the client 20.

The result verification unit 115 verifies the certification data with the client 20 through a predetermined procedure of sum-check including communication between the server 10 and the client 20.
The amount of decrease in the value of the loss function included in the proof data is used by the client 20 to verify the validity of the selection of the subset of the training data.

The client 20 is an information processing device (computer) such as a personal computer, a smartphone or a tablet terminal, and includes a control unit 21 and a storage unit 22, as well as various data input / output devices and communication devices.

The control unit 21 is a part that controls the entire client 20, and realizes each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 22. The control unit 21 may be a CPU.

The storage unit 22 is a storage area for various programs and various data for making the hardware group function as the client 20, and may be a ROM, RAM, flash memory, hard disk (HDD), or the like.

The control unit 21 includes a request transmission unit 211, a result reception unit 212, and a result verification unit 213 (second result verification unit). The control unit 21 provides training data to the server 10 to perform machine learning of linear regression by these functional units, and verifies the validity of the obtained learning result.

The request transmission unit 211 transmits the model before training to be trained by the server 10 and the training data to the server 10.

The result receiving unit 212 receives the model after training and the proof data for verifying the validity of the calculation result from the server 10.

The result verification unit 213 verifies the certification data with the server 10 through a predetermined procedure of sum-check including communication between the server 10 and the client 20.
At this time, the result verification unit 213 also confirms that the amount of decrease in the value of the loss function included in the proof data is positive.

FIG. 2 is a sequence diagram showing a processing procedure of a learning method in the learning system 1 according to the present embodiment.
In step S1, the client 20 transmits the training data (input x and output y) and the model before the update to the server 10.

In step S2, the server 10 uses the training data received in step S1 to execute the learning phase process on the model before update, and generates proof data π for verifying this process.

In step S3, the server 10 transmits the model F updated by the learning phase and the proof data π to the client 20.
In step S4, the client 20 collaborates with the server 10 to verify the certification data π.

Here, the calculation by the learning execution unit 112 of the server 10 will be described in detail.
When the client 20 provides the training data to the server 10, the server 10 proves to the client 20 that the learning process is correctly executed when the learning process is performed. At this time, the learning execution unit 112 performs learning processing using a polynomial that can be verified by sum-check.

First, the partial differential required in the learning process can be treated as follows.
The polynomial is P _a (x _k , x _k-1 , ..., x ₀ ) = a _k x _k + a _k-1 x _k-1 + ... + a ₁ x ₁ + a ₀ x ₀ , and the coefficients and variables are as follows. It is expressed by the variables A and X of.

Then, the partial derivative with respect to x _i of the polynomial P _a (x _k , x _k-1 , ..., X ₀ ) has a vector X _i in which the i-th element of X is 1 and the other elements are 0. It can be expressed as ^ATX _i by using it. As a result, the learning execution unit 112 executes the verifiable calculation as follows.

と表現できる。損失関数として、ｍ個の訓練データに対して、

を利用すれば、損失関数の偏微分は、

となる。ここで、∂Ｌ／∂ｗ_ｊは、ｗについての多項式と考えることができるため、ｃを定数として、

と表すことが可能である。サーバ１０は、これにｓｕｍ－ｃｈｅｃｋを適用することで、処理が正しく実行されていることを証明できる。 Assuming that the loss function is L and the learning rate is η, the batch learning phase performs n learning processes.

Can be expressed as. As a loss function, for m training data

If you use, the partial derivative of the loss function is

Will be. Here, since ∂L / ∂w _j can be considered as a polynomial for w, c is a constant.

Can be expressed as. The server 10 can prove that the process is executed correctly by applying the sum-check to this.

となる。これもｗについての多項式となるため、ｓｕｍ－ｃｈｅｃｋを適用することで、サーバ１０は、処理が正しく実行されていることを証明できる。 Furthermore, if the entire loop processing of the batch learning phase is expressed by an expression,

Will be. Since this is also a polynomial for w, the server 10 can prove that the process is executed correctly by applying the sum-check.

を計算する。したがって、ｍ個のデータに対する学習処理は、

と表すことができる。これもｗについての多項式となるため、ｓｕｍ－ｃｈｅｃｋを適用することで、サーバ１０は、処理が正しく実行されていることを証明できる。 Further, in the case of online learning, the learning execution unit 112 receives for each training data.

To calculate. Therefore, the learning process for m data is

It can be expressed as. Since this is also a polynomial for w, the server 10 can prove that the process is executed correctly by applying the sum-check.

Next, the learning process when malignant data is mixed in the training data will be described.
For example, when a plurality of clients 20 provide training data and a server 10 builds one model, a malicious client 20 may provide training data including malicious data. Therefore, the server 10 needs to perform a process of removing malicious data before constructing the model.

The learning execution unit 112 uses an algorithm called TRIM proposed in the following document A as a method for removing malicious data. At this time, even if TRIM is executed, it is difficult for the server 10 to prove the processing result to the client 20, so the server 10 is proved by combining with the sum-check.
Reference A: M. Jagielski, A. Oprea, B. Biggio, C.I. Liu, C.I. Nita-Rotalu and B. Li. "Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Regression." 2018 IEEE Symposium on Security and Privy.

FIG. 3 is a diagram showing an algorithm A of TRIM according to the present embodiment.
The N training data D include normal data D _tr and malignant data D _p . In the algorithm A, it is assumed that p = α × n pieces of malignant data are included with respect to n pieces of normal data, and the model θ ⁽ⁱ⁾ is output by repeating the learning i times.

In step 1, n pieces are randomly selected from N pieces of training data, and an index set I ⁽⁰⁾ is generated.
In step 2, a model θ ⁽⁰⁾ that minimizes the loss L (DI ⁽⁰⁾ , θ) is obtained.
In step 3, the number of repetitions i of learning is initialized to 0, and steps 4 to 9 are repeatedly executed.

In step 5, the number of times i is counted up, and subsequent steps 6 to 8 are executed as the i-th learning.
In step 6, the index set I ⁽ⁱ⁾ is updated by selecting the subset of data that minimizes the loss L (DI ⁽ⁱ⁾ , θ ^(i-1) ). As a result, the data presumed to be malignant data _Dp contained in the training data D is removed.
In step 7, a model θ ⁽ⁱ⁾ that minimizes the loss L (DI ⁽ⁱ⁾ , θ ⁽ⁱ⁾ ) is obtained.
In step 8, the loss R ⁽ⁱ⁾ = L (DI ⁽ⁱ⁾ , θ ⁽ⁱ⁾ ) in the current model θ ⁽ⁱ ) is obtained.

In step 9, when the loss converges and R (i) = R (i-1), the learning repetition ends.
In step 10, the model θ ⁽ⁱ⁾ is output as a learning result.

In this TRIM algorithm A, the malicious data contained in the training data is removed by selecting the subset of data that minimizes the loss in the process of step 8, but the sum-check cannot generate the proof data for this process. .. Therefore, in the present embodiment, the processing in the loop of TRIM is modified as follows.

FIG. 4 is a diagram showing an algorithm B of a verifiable subset selection process according to the present embodiment.
The algorithm B corresponds to the repeating portion of steps 4 to 9 in FIG. 3, and the proof generation unit 113 generates proof data for this process.

Compared to Algorithm A in FIG. 3, Algorithm B removes the condition of minimizing losses when selecting a subset of data. Therefore, from the perspective of the client 20, the server 10 does not always select the subset that minimizes the loss. However, the client 20 receives the comparison result d ⁽ⁱ⁾ = R ⁽ⁱ⁾ −R ^(i-1) with the loss obtained in the previous process, so that the loss decreases with each repetition. You can confirm that.
Therefore, the client 20 can verify that the TRIM of FIG. 2 is executed on the server 10 and the learning is correctly performed using the data set excluding the malicious data.

According to the present embodiment, the server 10 can execute the learning process of linear regression by a calculation that can be verified by sum-check by converting the partial derivative obtained by partially differentiating the loss function into a polynomial and performing the calculation. Proof data for verifying the validity of the result can be provided to the client 20.
As a result, the client 20 can verify the processing in the learning phase of machine learning on the server 10 at high speed.
As a result, when the client 20 repeatedly learns on the server 10 using a large amount of learning data, it is possible to verify that the server 10 correctly executed the process without executing the same process on the client 20. It will be possible.

Further, the server 10 replaces the process of removing malicious data by TRIM with a calculation that can be verified by sum-check, and instead of the excluded condition of minimizing the value of the loss function, the amount of decrease in the value of the loss function Add a calculation to calculate.
As a result, the client 20 confirms that the amount of decrease in the value of the loss function is positive, thereby verifying that the server 10 has selected a subset of the training data whose loss is reduced in order to remove the malicious data. can.
As a result, for example, when the server 10 collects training data from a plurality of clients 20 and builds one model, even if some of the clients 20 provide training data including malicious data, the server 10 will receive training data. It is possible to prove to the client 20 that the process of removing the malicious data is being carried out.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely a list of the most suitable effects resulting from the present invention, and the effects according to the present invention are not limited to those described in the embodiments.

In the above-described embodiment, the learning system 1 uses the sum-check as the verification protocol, but instead of the sum-check, the zero-knowledge sum-check proposed in the following document B may be used.
Reference B: E. Ben-Sasson, A. Chiesa, M. Forbes, A. Gabizon, M.D. Riabzev, and N. et al. Speaker. "Zero Knowledge Protocols from Protocol Detection." Proceedings of the 15th Theory of Cryptography Conference (2017).

In the case of a normal sum-check, it is known that some information about the processing performed by the server 10 in the verification process is leaked to the client 20, and when training data is collected from a plurality of clients 20, the training data is collected. There is concern that part of the training data will be leaked to another client 20.
On the other hand, by using the zero-knowledge sum-check, the server 10 can prove that the processing is performed correctly without leaking the information to the client 20. Therefore, the server 10 can protect the training data provided by the client 20 by using the zero-knowledge sum-check when collecting the training data from the plurality of clients 20 and constructing the model.

The learning method by the learning system 1 is realized by software. When realized by software, the programs that make up this software are installed in the information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

1 Learning system 10 Server (learning device)
11 Control unit 12 Storage unit 20 Client (terminal)
21 Control unit 22 Storage unit 111 Request reception unit 112 Learning execution unit 113 Proof generation unit 114 Result transmission unit 115 Result verification unit (first result verification unit)
211 Request transmission unit 212 Result reception unit 213 Result verification unit (second result verification unit)

Claims (6)

A model before training by machine learning, a request receiver that receives training data from the terminal, and
Among the machine learning operations, the learning execution unit that converts the partial derivative obtained by partially differentiating the loss function into a polynomial and calculates it.
A proof generation unit that generates proof data for verifying the validity of the calculation result by the learning execution unit, and a proof generation unit.
The model after training by machine learning, the result transmission unit that transmits the certification data to the terminal, and the
A learning device including a first result verification unit for verifying the certification data with the terminal. The machine learning includes a process of selecting a subset of the training data that minimizes the value of the loss function in order to remove the malicious data contained in the training data.
The learning execution unit calculates the amount of decrease in the value of the loss function due to the selection.
According to claim 1, the proof generation unit generates the proof data excluding the condition for minimizing the value of the loss function from the process of selecting a subset of the training data that minimizes the value of the loss function. The learning device described. A learning system including the learning device according to claim 1 and a terminal that requests the learning device to perform machine learning.
The terminal is
The model before training, the request transmission unit that transmits the training data to the learning device, and
The model after the training, the result receiving unit for receiving the certification data from the learning device, and the result receiving unit.
A learning system including a second result verification unit that verifies the certification data with the learning device. A learning system including the learning device according to claim 2 and a terminal that requests the learning device to perform machine learning.
The terminal is
The model before training, the request transmission unit that transmits the training data to the learning device, and
The model after the training, the result receiving unit for receiving the certification data from the learning device, and the result receiving unit.
A second result verification unit for verifying the certification data with the learning device is provided.
The second result verification unit is a learning system that confirms that the amount of decrease in the value of the loss function is positive. A model before training by machine learning, a request reception step to receive training data from the terminal, and
Among the machine learning operations, the learning execution step of converting the partial derivative obtained by partially differentiating the loss function into a polynomial and calculating it,
A proof generation step for generating proof data for verifying the validity of the calculation result in the learning execution step, and a proof generation step.
The model after training by machine learning, the result transmission step of transmitting the certification data to the terminal, and
A learning method in which a computer executes a first result verification step of verifying the certification data with the terminal. A learning program for operating a computer as the learning device according to claim 1 or 2.

Images