KR20200005003A - Privacy-preserving machine learning method using one-way data transformation - Google Patents

Abstract

According to an embodiment of the present invention, a privacy guaranteed machine learning method performed in a server may comprise the steps of: performing machine learning on converted data received from a client; receiving a request for a service from the client; and providing a classification result of classifying service data related to the request for the service received based on the machine learning.

Description

PRIVACY-PRESERVING MACHINE LEARNING METHOD USING ONE-WAY DATA TRANSFORMATION}

The following description relates to machine learning techniques, and to a privacy guaranteed machine learning method using one-way data conversion.

With the development of machine learning technology, machine learning technology has been applied to existing applications in various fields. As the machine learning technology is applied, many applications appear to have a better effect than the existing technology. Therefore, the machine learning is applied to various fields of research and is evaluated as an important technology.

Machine learning can be applied to applications that require regression, classification, prediction, and so on. To this end, machine learning trains a model of a problem to be solved based on various inputs of an application, and the learned model operates in a format that provides an output corresponding to a new input.

As an example of a machine learning model, consider a model that performs machine learning and provides remote services on a remote server based on client data. In such a machine learning model, a problem may occur that violates the client's privacy when the server performs malicious operations. For example, consider a typical home where a client has a smart meter and the server provides machine learning services to predict future power usage based on historical power usage patterns measured and transmitted from the client's meter. The client may analyze the power usage pattern provided by the client to obtain information such as whether the resident is currently living in the house and what household appliances the resident is using. Various studies have proved that various problems may exist, and methods for ensuring machine privacy and performing machine learning on servers are being studied to prevent such threats.

Reference: Non-Patent Document 1 <Ratha, N. K., Chikkerur, S., Connell, J. H., & Bolle, R. M. (2007). Generating cancelable fingerprint templates. IEEE Transactions on pattern analysis and machine intelligence, 29 (4), 561-572.>,

Non Patent Literature 2 <Hartigan, John A., and Manchek A. Wong. "Algorithm AS 136: A k-means clustering algorithm." Journal of the Royal Statistical Society. Series C (Applied Statistics) 28.1 (1979): 100-108.>

Non-Patent Document 3 <Shin, S. W., Lee, M. K., Moon, D., & Moon, K. (2009). Dictionary Attack on Functional Transform-Based Cancelable Fingerprint Templates. ETRI journal, 31 (5), 628-630.>,

Non-Patent Document 4 <Alvarez, F. M., Troncoso, A., Riquelme, J. C., & Ruiz, J. S. A. (2011). Energy time series forecasting based on pattern sequence similarity. IEEE Transactions on Knowledge and Data Engineering, 23 (8), 1230-1243.>

Privacy guaranteed machine learning method and server using one-way data conversion can be provided.

We present a way to provide useful services based on machine learning while protecting client data.

The privacy guarantee machine learning method performed in the server may include performing machine learning on transformed data D received from a client; Receiving a request for service from the client; And providing a classification result of classifying service data s' related to the request of the received service based on the machine learning.

The client includes generating the transform data D using the original data d and the transform parameter p in a transform function F , and performs machine learning on the transform data received from the client. The step of performing a machine learning by receiving the conversion data (D) is generated, the generated conversion data ( D ) is transmitted as the conversion to the original data ( d ) is performed in the client, Can be.

The performing of the machine learning on the converted data received from the client may include performing machine learning on the converted data D in place of the original data d . As an example of the machine learning, deep learning, which is a machine learning technology built on the basis of k-means clustering or an artificial neural network, may be performed.

The data conversion performed by the client is based on the position, direction or size of the data using a specific parameter p to the original data d . A conversion function for converting at least one of the two is used.

Receiving a request for a service from the client, another converted data s' is generated using the transform function F on the original service data s for the service at the client, and the generated And receiving other transformed data s' .

Providing a classification result of classifying service data related to the request of the received service based on the machine learning may further include converting original service data s related to the request of the service received from the client. And delivering the classification result obtained by classifying the data s' based on the machine learning to the client.

Server for privacy-type machine learning, the learning unit for performing the machine learning on the transform data ( D ) received from the client; Receiving unit for receiving a request of the service from the client; And a providing unit providing a classification result of classifying service data s' related to the request of the received service based on the machine learning.

The present invention enables privacy guaranteed machine learning that is safe from the threat of dictionary attacks, protects the client's original data, and can perform remote machine learning on the server.

1 is a diagram for describing a privacy guaranteed machine learning model, according to an exemplary embodiment.
2 is a diagram for describing a configuration of a server, according to an exemplary embodiment.
3 is a diagram illustrating a privacy-guaranteed machine learning protocol according to an exemplary embodiment.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings.

1 is a diagram for describing a privacy guaranteed machine learning model, according to an exemplary embodiment.

The server 100 may be implemented as a computer device or a plurality of computer devices that communicate with a client through a network to provide commands, codes, files, contents, services, and the like. For example, the server 100 may be a cloud server, and may store a data in a central computer connected to the Internet, and provide a cloud service to use the data anytime and anywhere by simply accessing the Internet.

The client 110 may be a fixed terminal or a mobile terminal implemented with a computer device. Examples of the client 110 include a smart phone, a mobile phone, navigation, a computer, a notebook computer, a digital broadcasting terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a tablet PC, a smart meter, and the like. . For example, the client 110 may communicate with other electronic devices and / or the server 100 through a network by using a wireless or wired communication scheme.

1 illustrates a machine learning model for privacy guaranteed machine learning. The machine learning provided in the embodiment is applied to a service for classifying which class of input data after training the class to which the class belongs based on the known data. In the machine learning model of FIG. 1, a client protects original data and performs a machine learning process on a server as follows.

First, the client can set a function that satisfies the following constraint.

1. Locally smooth to ensure that small changes in the original data result in small changes in the data after conversion.

2. Smoothed locally by ①, but not globally smooth (Globally not smooth).

3. Meet the constraints of ① and ② and must be many-to-one so that it is impossible to restore original data from converted data converted from original data. In other words, it is noninvertible.

When F is a function that satisfies these constraints (hereinafter, referred to as a transform function), in the training process, the client uses the client's original data d and the transform parameter p in the transform function F ,

D = F (d, p)

The converted converted data D may be derived, and the derived converted data D may be transmitted to the server. After the machine learning is completed, the client may perform a transformation on the service data to receive the classification service. Specifically, the client may convert the original service data s for the service into another converted data s ' using the transform function F , and transmit the converted another converted data s' to the server. The server may deliver the classification result r for another converted data s' to the client. This process may be expressed in six steps of FIG. 3, which will be described in detail with reference to FIG. 3.

2 is a diagram for describing a configuration of a server, according to an exemplary embodiment.

The processor of the server 100 may include a learner 210, a receiver 220, and a provider 230. The components of such a processor may be representations of different functions performed by the processor in accordance with control instructions provided by program code stored in the server. In this case, the processor and the components of the processor may be implemented to execute instructions according to code of an operating system included in the memory and code of at least one program.

The learner 210 may perform machine learning on the converted data received from the client. Learning unit 210 has a conversion data (D) is generated in accordance with a conversion is performed to the original data (d) from the client, the created translation data (D) to receive the transferred perform machine learning. The learning unit 210 may perform machine learning on the transform data, and for example, may perform deep learning, which is a machine learning technique built on k-means clustering or an artificial neural network.

The receiver 220 may receive a request for a service from a client. The receiving unit 220 generates another converted data s ' using the conversion function F to the original service data s for the classification service on the client, and then generates another converted data s' . Can be received.

The provider 230 may provide a classification result obtained by classifying service data related to the request of the received service based on machine learning. The provider 230 may provide a classification result obtained by classifying another converted data s' obtained by converting original service data s related to a request for a service received from a client based on machine learning.

3 is a diagram illustrating a privacy-guaranteed machine learning protocol according to an exemplary embodiment.

Through the operation between the client 110 and the server 100 will be described a privacy guaranteed machine learning protocol. The privacy guarantee machine learning protocol may include a setup step 310, a transform step 320, a transfer step 330, a training step 340, a request step 350, and a response step 360.

In operation 310, the client 110 may generate a parameter p to be used in the transformation function F. In operation 320, the client may convert the original data d into the transform data D using the parameter p in the transform function F. At this time, as an example of the deformation function F for modifying the original data, Non Patent Literature 1 <Ratha, NK, Chikkerur, S., Connell, JH, & Bolle, RM (2007). Generating cancelable fingerprint templates. Conversion functions introduced in IEEE Transactions on pattern analysis and machine intelligence, 29 (4), 561-572.> Can be used. In Non-Patent Document 1, a conversion function for converting a position and a direction by using a specific parameter in original fingerprint data (for example, coordinates and direction vectors of feature points of a fingerprint) has been introduced to generate a reversible fingerprint template. The conversion method proposed by the present invention is a modification of the data conversion function of the non-patent document 1, and may use the following function for converting at least one or more of the position, direction, or size of the original data d .

D = F (d, p)

In this case, p is a parameter used for the conversion, F is a conversion function.

In operation 330, the client may transmit the converted data D to the server 100. The server 100 may receive the conversion data D received from the client 110. In operation 340, the server 100 may perform machine learning using the converted data D received from the client 110. Machine learning is an area of artificial intelligence that allows students to learn new information, acquire knowledge that is tied to their ability to use the information efficiently as they learn, and to obtain results by performing tasks repeatedly. The process of improvement of technology. Machine learning using the transformed data can be applied to any machine learning method for a service (eg, a classification service). For example, Non-Patent Document 2 <Hartigan, John A., and Manchek A. Wong. "Algorithm AS 136: A k-means clustering algorithm." Journal of the Royal Statistical Society. Series C (Applied Statistics) 28.1 (1979): 100-108.> Relates to k-means clustering. Privacy-based machine learning using one-way data transformation according to the embodiment is applied to k-means clustering, so that the server 100 performs clustering on the transformed data D instead of performing clustering on the original data d . can do. This allows k-means clustering to perform machine learning on transformed data ( D ). For example, Non-Patent Document 4 <Alvarez, FM, Troncoso, A., Riquelme, JC, & Ruiz, JSA (2011). Energy time series forecasting based on pattern sequence similarity. In the various applications using k-means clustering, such as the Pattern Sequence-based Forecasting (PSF) proposed in IEEE Transactions on Knowledge and Data Engineering, 23 (8), 1230-1243. Protect your data and perform machine learning.

As another example of machine learning using the converted data, the server 100 performs deep learning, which is a machine learning technology based on an artificial neural network, to enable a computer to learn by itself like a human being using various data. can do. Deep learning mimics the information processing method that separates objects after the human brain discovers patterns in a lot of data, and then makes machine learning so that computers can distinguish things. By applying deep learning technology, a computer can recognize, reason, and judge on its own, even if a person does not set all the criteria. Therefore, the server 100 may perform machine learning using artificial neural networks such as CNN and RNN as an example of deep learning, and instead of performing deep learning on the original data d , the server 100 may receive the information from the client 110. Deep learning may be performed using the transform data D.

In operation 350, the client 110 may transmit service data s ′ that is intended to receive the classification service to the server 100. In detail, the client may transfer another converted data s' generated by converting the original service data s for the classification service to the server 100. Here, the service data s ' means another converted data s' obtained by converting the original service data s . As the service data is delivered, the server 100 may receive another converted data s' from the client 110.

In operation 360, the server 100 may transmit the classification result obtained by classifying the service data s' related to the request of the service received from the client 110 based on the machine learning, to the client 110. At this time, the server 100 may configure a privacy-guaranteed machine learning model using one-way data conversion. For example, the server 100 may derive the classification result r by comparing the service data s' received from the client 110 with the clustering result of performing clustering through machine learning. Alternatively, the server 100 may derive the classification result r by machine learning the service data s' .

As an example of deep learning using the converted data, detection of abnormality of the power system may be considered. For example, when the original data d is the power pattern of the power system, the power system may convert the original data d into the converted converted data D in step 320. Next, the transformed converted data is transferred to the server in step 330, and the server may learn a model for detecting an abnormal state of the power system by performing deep learning in step 340. Thereafter, in step 350, the power system may convert the state s of the current system to s' using a conversion function and then transfer it to the server. Finally, in step 360, the state of the current power system classified according to the converted service data s ′ received for the model learned in step 340 may be transmitted to the power system.

The method of transforming the original data proposed in the embodiment depends on the irreversible nature of the conversion function. In other words, even if a malicious server or an attacker obtains the client's transformed training data, it is not the client's original data, but the converted data, which does not help to identify the client's sensitive information.

On the other hand, Non Patent Literature 3 <Shin, SW, Lee, MK, Moon, D., & Moon, K. (2009). Dictionary Attack on Functional Transform-Based Cancelable Fingerprint Templates. According to ETRI journal, 31 (5), 628-630.>, If a malicious attacker acquires both the conversion parameter ( p ) and the conversion data ( D ) of the client used in the conversion method, a kind of dictionary attack ) Can be performed. In other words, when fixing the conversion equation D = F parameter (p) in the (d, p) and the obtained potential by applying the high source data (d) successively converting the data (D) is a way to find out that the source data (d) . Although the data conversion method of Non-Patent Document 1 has been attacked through this, a dictionary attack is not applied to the machine learning model proposed in the embodiment. The client uses the conversion parameter ( p ) to transform the original data ( d ), and the server performs machine learning with only the conversion data ( D ), so unless the attacker attacks the client and server at the same time, the conversion parameter ( p ) Since and D are not known at the same time, a dictionary attack cannot be performed and thus is safe from the threat.

Accordingly, the present invention enables privacy guaranteed machine learning that is safe from the threat of dictionary attacks, protects the client's original data, and can perform remote machine learning on the server.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the devices and components described in the embodiments are, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors, microcomputers, field programmable gate arrays (FPGAs). Can be implemented using one or more general purpose or special purpose computers, such as a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of explanation, one processing device may be described as being used, but one of ordinary skill in the art will appreciate that the processing device includes a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of the above, and configure the processing device to operate as desired, or process it independently or collectively. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or to provide instructions or data to the processing device. It can be embodied in. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored on one or more computer readable recording media.

The method according to the embodiment may be embodied in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the media may be those specially designed and constructed for the purposes of the embodiments, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

Although the embodiments have been described by the limited embodiments and the drawings as described above, various modifications and variations are possible to those skilled in the art from the above description. For example, the described techniques may be performed in a different order than the described method, and / or components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different form than the described method, or other components. Or even if replaced or substituted by equivalents, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are within the scope of the claims that follow.

Claims (8)

In the privacy guarantee machine learning method performed in the server,
Performing machine learning on the transformed data D received from the client;
Receiving a request for service from the client; And
Providing a classification result of classifying service data s' related to the request of the received service based on the machine learning;
Machine learning method comprising a. The method of claim 1,
The client generates the conversion data D using the original data d and the conversion parameter p in the conversion function F.
That includes,
The step of performing machine learning on the converted data received from the client,
Machine learning method comprising the step of performing the machine learning by receiving the conversion data (D) is generated, the generated conversion data ( D ) is delivered as the conversion to the original data ( d ) is performed in the client . The method of claim 2,
The step of performing machine learning on the converted data received from the client,
Performing k-means clustering on the transform data D
Machine learning method comprising a. The method of claim 2,
The step of performing machine learning on the converted data received from the client,
Performing deep learning on the converted data D
Machine learning method comprising a. The method of claim 2,
The client,
Position, direction by using a specific parameter to the original data ( d ) Or size Machine learning method comprising the use of a transform function to transform at least one of the following : The method of claim 1,
Receiving a request for service from the client,
The client receives another conversion data s ' generated using the conversion function F in the original service data s for the service, and receives the generated another converted data s' . step
Machine learning method comprising a. The method of claim 1,
Providing a classification result of classifying the service data related to the request of the received service based on the machine learning,
Delivering to the client a classification result obtained by classifying another converted data s' converted from original service data s related to the request of the service received from the client based on the machine learning.
Machine learning method comprising a. In the server for privacy guaranteed machine learning,
A learning unit which performs machine learning on the converted data D received from the client;
Receiving unit for receiving a request of the service from the client; And
Providing unit for providing a classification result of classifying the service data ( s' ) related to the request of the received service based on the machine learning
Server comprising.

Images