WO2024095420A1

WO2024095420A1 - Learning device, estimating device, learning method, estimating method, and program

Info

Publication number: WO2024095420A1
Application number: PCT/JP2022/041070
Authority: WO
Inventors: 友貴山中; 浩義瀧口; 正紀篠原; 拓也南; 泰典和田; 楊鐘本; 啓仁野村
Original assignee: 日本電信電話株式会社
Priority date: 2022-11-02
Filing date: 2022-11-02
Publication date: 2024-05-10

Abstract

A processing device (10) has: a data acquiring unit (11) that acquires learning data; a converting unit (12) that executes a predetermined conversion based on confidential information, on the learning data; and a training unit (14) that trains an estimation model (131) on the basis of the learning data subjected to the conversion by the converting unit (12).

Description

Learning device, estimation device, learning method, estimation method, and program

The present invention relates to a learning device, an estimation device, a learning method, an estimation method, and a program.

As machine learning models become more widespread, several attacks have been reported, such as Model Inversion Attack, Membership Inference, and CopyCat CNN, which extract information (e.g., training data) from trained models in operation, as well as methods to replicate the models themselves. These attacks pose a threat from the perspective of privacy protection and intellectual property protection.

　Measures proposed to counter these attacks include improving the robustness of the model itself, limiting the number of queries to the machine learning model, and adding noise to the information output by the model, but none of these methods provide a complete defense.

The present invention has been made in consideration of the above, and aims to provide a learning device, an estimation device, a learning method, an estimation method, and a program that can reduce the risk of information leakage from a trained machine learning model and the risk of cloning the model.

In order to solve the above-mentioned problems and achieve the objective, the learning device according to the present invention is characterized by having an acquisition unit that acquires learning data, a conversion unit that performs a predetermined conversion based on secret information on the learning data, and a learning unit that performs learning of an estimation model based on the learning data converted by the conversion unit.

The estimation device according to the present invention is characterized by having an acquisition unit that acquires data to be processed, a conversion unit that performs a predetermined conversion based on secret information on the data to be processed, and an estimation unit that performs estimation processing based on the data to be processed that has been converted by the conversion unit using an estimation model that has been trained based on training data that has been subjected to the predetermined conversion based on the secret information.

The present invention can reduce the risk of information leakage from trained machine learning models and the risk of cloning models.

FIG. 1 is a diagram for explaining an outline of the process according to the embodiment. FIG. 2 is a diagram illustrating an example of a configuration of a processing device according to an embodiment. FIG. 3 is a diagram illustrating an example of the conversion process executed by the conversion unit. FIG. 4 is a diagram illustrating an example of a processing procedure of the learning process according to the embodiment. FIG. 5 is a diagram illustrating an example of a processing procedure of the estimation process according to the embodiment. FIG. 6 is a diagram illustrating an example of a computer that realizes a learning device by executing a program.

Below, the learning device, estimation device, learning method, estimation method, and program according to the present application will be described in detail with reference to the drawings. Furthermore, the present invention is not limited to the embodiments described below.

[Embodiment]
[Overview of Processing of the Embodiment]
1 is a diagram for explaining an outline of the process according to the embodiment. In the learning phase, first, learning data (e.g., original data Dp) is transformed in accordance with a specific rule based on secret information Kc ((1) in FIG. 1).

Then, in the learning phase, the estimation model 131 (machine learning model) is trained using only the training data that has been transformed according to this rule ((2) in FIG. 1). In this way, in the embodiment, a trained model is generated that can correctly recognize only data that has been transformed according to a specific rule based on the secret information ((3) in FIG. 1).

In the operation phase, the data to be processed is converted according to specific rules based on the secret information Kc, just like in the learning phase, and then input to the estimation model 131 for estimation processing. In this case, only users or devices that have the secret information and are capable of converting data according to the specific rules can use the estimation model 131 with high accuracy.

In other words, the estimation model 131 is a model with insufficient detection and classification accuracy for data that has not been converted based on secret information or data that has been converted according to rules other than specific rules, and is a model of no value to other users or devices.

[Processing device]
2 is a diagram showing an example of the configuration of a processing device according to an embodiment. The processing device 10 is realized by, for example, loading a predetermined program into a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. The processing device 10 also has a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc.

The processing device 10 has a data acquisition unit 11 (acquisition unit), a conversion unit 12, an estimation unit 13, and a learning unit 14.

The data acquisition unit 11 acquires data to be processed by the processing device 10. In the learning phase, learning data is acquired. The learning data is, for example, a labeled image data set or a labeled table data set. In the operation phase, data to be processed in the estimation process is acquired. The data acquisition unit 11 acquires various types of data, for example, via a communication interface.

The conversion unit 12 performs a predetermined conversion based on secret information on the learning data acquired by the data acquisition unit 11 or on the data to be processed. The conversion unit 12 performs conversion based on the same secret information and according to the same rules in the learning phase and the operation phase.

The secret information is, for example, a secret key stored in a module of the processing device 10. Specifically, the conversion unit 12 uses, as the secret information, for example, a secret key stored in a TPM (Trusted Platform Module) or the like. This makes it possible, in the embodiment, to generate an estimation model 131 that operates accurately only on a specific device.

The predetermined transformation is a transformation that follows a specific rule. Fig. 3 is a diagram for explaining an example of a transformation process executed by the transformation unit 12. As shown in Fig. 3, when the data acquired by the data acquisition unit 11 is a labeled image data set (e.g., Cifar10), the transformation unit 12 performs, for example, Jigsaw transformation (Reference 1) in which a transformation pattern is fixed by a seed value (secret information). The Jigsaw transformation is a transformation method in which an image is cut into patches and then the positions of the patches are rearranged.
Reference 1: “aleju/imgaug”, [online], [searched on October 28, 2022], Internet <URL: https://github.com/aleju/imgaug>

When the data is image data, the transformation unit 12 may perform, in addition to the Jigsaw transformation, color tone transformation, affine transformation, or a combination of two or more of the Jigsaw transformation, color tone transformation, and affine transformation using transformation rules set using secret information. For example, color tone transformation is a grayscale transformation of a color image. An affine transformation is a transformation that combines linear transformations such as rotation, scaling (enlargement, reduction), and skew with parallel translation.

When the data is table data, the conversion unit 12 performs conversion using, for example, shuffling features, applying noise, or a combination of shuffling features and applying noise, using conversion rules set using secret information. These conversion methods are examples, and the conversion unit 12 can apply various conversion methods in accordance with the type of data.

The estimation unit 13 uses the estimation model 131 to perform estimation processing based on the data converted by the conversion unit 12. The estimation model 131 is a machine learning model that, when data converted by the conversion unit 12 is input, performs predetermined estimation processing such as detection processing, classification processing, and matching processing, and outputs the estimation result.

In the learning phase, the estimation unit 13 inputs the learning data converted by the conversion unit 12 to the estimation model 131, and outputs the estimation result output from the estimation model 131 to the learning unit 14.

In the operation phase, the estimation unit 13 inputs the data to be processed that has been converted by the conversion unit 12 to the estimation model 131, and outputs the estimation result output from the estimation model 131 to an output device, an external device, etc. In the operation phase, the estimation model 131 that has been trained based on training data that has been subjected to a predetermined conversion based on secret information is used.

The learning unit 14 performs learning of the estimation model 131 based on the learning data converted by the conversion unit 12. The learning unit 14 performs learning of the estimation model 131 using machine learning such as supervised learning, unsupervised learning, reinforcement learning, and deep learning.

[Learning process]
Next, a description will be given of the learning process executed by the processing device 10. Fig. 4 shows an example of a processing procedure of the learning process according to the embodiment.

As shown in FIG. 4, in the processing device 10, the data acquisition unit 11 acquires learning data (step S11), and the conversion unit 12 performs a predetermined conversion based on the secret information on the learning data acquired in step S11 (step S12).

The estimation unit 13 uses the estimation model 131 to perform estimation processing based on the learning data converted by the conversion unit 12 (step S13), and outputs the estimation result to the learning unit 14.

The learning unit 14 executes a learning process for the estimation model 131 based on the learning data converted by the conversion unit 12 (step S14). For example, when labeled learning data is used, the learning unit 14 optimizes the parameters of the estimation model 131 so that the estimation result output from the estimation unit 13 in step S13 approaches the label of the learning data.

[Estimation process]
A description will now be given of the estimation process executed by the processing device 10. Fig. 5 shows an example of a processing procedure of the estimation process according to the embodiment.

In the processing device 10, the data acquisition unit 11 acquires the data to be processed (step S21), and the conversion unit 12 performs a predetermined conversion based on the secret information on the data to be processed acquired in step S21 (step S22).

The estimation unit 13 uses the estimation model 131 to perform estimation processing based on the data to be processed that has been converted by the conversion unit 12 (step S23). As shown in FIG. 4, the estimation model 131 is a model that has been trained based on training data that has been subjected to a predetermined conversion based on secret information. In the processing device 10, the estimation unit 13 outputs the estimation result (step S24) and ends the estimation processing.

[Evaluation experiment]
An evaluation experiment was conducted on the processing device 10. In the evaluation experiment, a first CNN (Convolutional Neural Network) model was generated by applying the learning method according to the embodiment. Specifically, the first CNN model was trained using training data obtained by performing a first Jigsaw transformation of a transformation pattern fixed by a seed value (secret information) on a labeled image data set Cifar10.

The classification accuracy of this first CNN model was 71.15% for the first evaluation data, which underwent the same first Jigsaw transformation as used during training.

In contrast, the classification accuracy of the first CNN model was 42.36% for the second evaluation data, which did not undergo Jigsaw transformation, and 41.00% for the third evaluation data, which underwent a Jigsaw transformation with a different pattern from the first Jigsaw transformation.

Therefore, it can be seen that in the first CNN model, the classification accuracy of the second evaluation data and the third evaluation data is significantly degraded compared to the classification accuracy of the first evaluation data.

As a result, it was experimentally confirmed that by training a machine learning model using only data that has undergone a specified transformation (first transformation) based on secret information, a model with insufficient accuracy can be generated for data that has not undergone the first transformation, or data that has undergone a second transformation that follows different rules from the first transformation.

When a second CNN model with the same configuration as the first CNN model used in this evaluation experiment was used and classification accuracy was measured using normal training, that is, without any conversion of the training data, and without any conversion during evaluation, the accuracy was 74.63%.

In this evaluation experiment, a small model with a small number of parameters was used as the CNN model, so the accuracy is lower than that of general Resnet etc., but the accuracy of the first CNN model (71.15%) can be said to be close to that of the second CNN model. Therefore, the accuracy degradation of the first CNN model is slight compared to the second CNN model, so the first CNN model is also fully suitable for practical operation.

[Effects of the embodiment]
In this manner, the processing device 10 according to the present embodiment trains the estimation model 131 using only the training data that has been subjected to a predetermined transformation based on the secret information. The predetermined transformation is a transformation that uses the secret information and follows a specific rule.

As shown in the evaluation experiment, with the processing device 10, only users or devices that have secret information and are capable of converting data according to specific rules can use the estimation model 131 with correct accuracy. In other words, the estimation model 131 is merely a model with insufficient detection accuracy and classification accuracy for data that has not been converted based on secret information or data that has been converted according to rules other than the specific rules.

Therefore, the estimation model 131 is a worthless model for users or devices that do not have the secret information or the rules for data conversion.

Even if an attacker were to carry out an attack (such as a model inversion attack or membership inference) to extract training data from this estimation model 131, it would be difficult to accurately predict the original data from the converted data, so there would be no point in carrying out such an attack. Similarly, even if an attacker were to carry out an attack to extract parameters from this estimation model 131 or to generate a duplicate model at the attacker's own hand, to a user who does not have the confidential information, it would only be a low-precision model, so there would be no point in stealing it in the first place.

In this embodiment, by generating an inference model 131 that is valuable to a user or device that has confidential information and is capable of converting data according to specific rules, but is worthless to a user or device that does not have the confidential information or a user or device that does not have the rules for data conversion, it is possible to reduce the risk of information leakage from the inference model 131 and the risk of duplication of the inference model 131.

[System configuration of the embodiment]
Each component of the processing device 10 shown above is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the processing device 10 is not limited to that shown in the figure, and all or part of it can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

Furthermore, each process performed by the processing device 10 may be realized, in whole or in part, by a CPU and a program analyzed and executed by the CPU. Furthermore, each process performed by the processing device 10 may be realized as hardware using wired logic.

Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using known methods. In addition, the information including the processing procedures, control procedures, specific names, various data, and parameters described above and illustrated can be modified as appropriate unless otherwise specified.

[program]
6 is a diagram showing an example of a computer in which a program is executed to realize the processing device 10. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

The hard disk drive 1090 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define each process of the processing device 10 are implemented as program modules 1093 in which code executable by the computer 1000 is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to the functional configuration of the processing device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

Furthermore, the setting data used in the processing of the above-mentioned embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes it.

The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN (Local Area Network), WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

The above describes an embodiment of the invention made by the inventor, but the present invention is not limited to the description and drawings that form part of the disclosure of the present invention according to this embodiment. In other words, all other embodiments, examples, and operational techniques made by those skilled in the art based on this embodiment are included in the scope of the present invention.

REFERENCE SIGNS LIST 10 Processing device 11 Data acquisition unit 12 Conversion unit 13 Estimation unit 14 Learning unit 131 Estimation model

Claims

An acquisition unit for acquiring learning data;
A conversion unit that performs a predetermined conversion based on secret information on the learning data;
a learning unit that learns an estimation model based on the learning data converted by the conversion unit;
A learning device comprising:
The learning device according to claim 1, characterized in that the secret information is a secret key stored in a module of the learning device.
The learning device according to claim 1, characterized in that the predetermined transformation is a transformation that follows a specific rule.
The learning device according to claim 3, characterized in that, when the learning data is image data, the transformation unit performs a Jigsaw transformation, a color tone transformation, an affine transformation, or a transformation that combines two or more of the Jigsaw transformation, the color tone transformation, and the affine transformation, and, when the learning data is table data, performs a transformation that shuffles features, applies noise, or a transformation that combines the shuffling of features and the application of noise.
An acquisition unit that acquires data to be processed;
a conversion unit that performs a predetermined conversion based on secret information on the data to be processed;
an estimation unit that performs an estimation process based on the data to be processed that has been converted by the conversion unit, using an estimation model that has been trained based on training data that has been subjected to a predetermined conversion based on the secret information;
An estimation device comprising:
A learning method executed by a learning device, comprising:
Obtaining training data;
performing a predetermined transformation on the training data based on secret information;
a step of executing learning of an estimation model based on the learning data that has been converted in the executing step;
A learning method comprising:
An estimation method executed by an estimation device, comprising:
obtaining data to be processed;
performing a predetermined transformation on the data to be processed based on secret information;
performing an estimation process on the data to be processed that has been subjected to the conversion in the performing the conversion process, using an estimation model that has been trained on training data that has been subjected to a predetermined conversion based on the secret information;
The estimation method according to claim 1, further comprising:
A program for causing a computer to function as a learning device according to any one of claims 1 to 3, or as an estimation device according to claim 5.