Machine learning with feature obfuscation

Abstract

A system having multiple devices that can host different versions of an artificial neural network (ANN). In the system, inputs to the ANN can be obfuscated to concentrate training of a master version of the ANN at a first computing device. A second computing device in the system includes memory that stores a local version of the ANN and user data for input into the local version. The second computing device includes a processor that extracts features from the user data and obfuscates the extracted features to generate obfuscated user data. The second device includes a transceiver that transmits the obfuscated user data. The first computing device includes memory that stores the master version of the ANN, a transceiver that receives obfuscated user data transmitted from the second computing device, and a processor that trains the master version based on the received obfuscated user data using machine learning.

Description

[0001] Related applications

[0002] This application claims priority to U.S. Patent Application Serial No. 16 / 545,837, filed August 20, 2019, entitled "Machine Learning with Feature Obfuscation," the entire disclosure of which is hereby incorporated herein by reference. Technical Field

[0003] At least some of the embodiments disclosed herein generally relate to distributed machine learning with data privacy protection, and more specifically, to distributed artificial neural networks with data privacy protection. Background Technology

[0004] Artificial neural networks (ANNs) are computational systems that can learn to perform tasks without being programmed with instructions for specific operations. An ANN is based on a set of connected nodes, or artificial neurons, somewhat analogous to neurons in a biological brain. Each connection between nodes transmits a signal from one artificial neuron to another, and the receiving artificial neuron processes the signal.

[0005] Typically, an ANN is implemented using real-valued signals at the connections (or edges) between artificial neurons, and the output of each artificial neuron is calculated as a nonlinear function of the sum of its inputs. The artificial neurons and edges typically have weights that adjust as the ANN or its training progresses. Weights increase or decrease the strength of the signal at the edges. Artificial neurons may also have thresholds, where signals are sent from the artificial neuron only if the aggregated signal exceeds a threshold. Typically, artificial neurons are grouped into multiple layers (e.g., an input layer, one or more intermediate layers, and an output layer), and each layer may provide a different transformation for the inputs to that layer.

[0006] With the increasing use of complex artificial neural networks (e.g., deep neural networks) and the need to increase the effectiveness of such networks, distributing the training of artificial neural networks using multiple processors and / or distributed computing has addressed the complexity and challenges. However, using multiple processors or distributed computing presents data privacy issues (e.g., data reliability issues) and network performance issues (e.g., network performance limiting the ability of neural networks to meet the performance requirements of applications). Attached Figure Description

[0007] This disclosure will be more fully understood in light of the detailed description provided below and the accompanying drawings of various embodiments thereof.

[0008] Figure 1 and2 The present invention describes an example computer network 100 that implements a configuration for obfuscating the inputs of a master version of an ANN for centralized training, according to some embodiments of the present disclosure.

[0009] Figure 3 and 4 This describes example methods performed by an instance portion of a computer network 100, which can implement obfuscation of the inputs for centralized training of a master version of an ANN, according to some embodiments of this disclosure.

[0010] Figure 5 This describes an instance computing device for a primary version of a managed ANN or another version of a managed ANN according to some embodiments of this disclosure. Detailed Implementation

[0011] At least some aspects of this disclosure relate to distributed machine learning with data privacy protection, and more specifically, to distributed artificial neural networks with data privacy protection. Furthermore, at least some aspects of this disclosure relate to computer networks that can be configured to implement obfuscation of inputs used for centralized training of a master version of an artificial neural network (ANN).

[0012] This document discloses a system with multiple computing devices having different versions of an ANN that can be managed. Each computing device in the system can manage its own version of the ANN. For example, a first device can manage a major version of the ANN, and a second device and other devices in the system can manage local versions of the ANN.

[0013] In the system, the inputs used for centralized training of the master version of the ANN can be obfuscated. Obfuscation can occur at any of multiple computing devices hosting different versions of the ANN (e.g., a device hosting a local version of the ANN). For example, a second computing device in the system may include a memory configured to store a local version of the ANN and user data for input into the local version of the ANN. The second computing device may also include a processor configured to extract features from the user data and obfuscate the extracted features to generate obfuscated user data. The second device may also include a transceiver configured to transmit the obfuscated user data to, for example, a first computing device. The first computing device may include: a memory configured to store the master version of the ANN; a transceiver configured to receive obfuscated user data transmitted from the second computing device or another device in the system hosting a local version of the ANN; and a processor configured to train the master version using machine learning based on the received obfuscated user data.

[0014] Because user data is obfuscated at the user data source, it is protected from intrusion by the recipient of the obfuscated user data. When the data source (e.g., a second computing device) transmits data to the device hosting the master version of the ANN (e.g., a first computing device), the transmitted data is obfuscated, and thus data privacy protection occurs to some extent. However, the obfuscated user data is not obfuscated to the extent that it is no longer used as input for training the master version of the ANN via machine learning. This is particularly useful when the first computing device is in or part of a cloud computing environment and data privacy is a concern.

[0015] However, it should be understood that the input data is obfuscated to a certain extent in the disclosed system to train the master version of the ANN; therefore, the accuracy of training may be slightly affected. This is an example of a trade-off in the system. In some embodiments, the obfuscation level can be selected or modified to adjust the level of accuracy in training the master version of the ANN relative to the level of privacy protection of the user data used as training input.

[0016] The data obfuscation described in this paper prevents another party from accessing and interpreting user data hosted on the user's device. For example, obfuscation can prevent a cloud computing environment or a centralized computer or a peer computer hosting the master version of an ANN from accessing and subsequently interpreting sensitive user data stored on the user's device. However, obfuscation still allows the use of obfuscated user data as input for training an ANN.

[0017] Obfuscation can be accomplished in various ways. This paper describes some of these methods in further detail. For example, data obfuscation can be achieved through scrambling or encryption algorithms. It should be understood that the obfuscation techniques described in this paper allow data points that are oriented close to each other (to a certain extent) to remain close to each other after obfuscation. Otherwise, the correlation between the obfuscated input and output would prevent the ANN from being trained to make feasible predictions. Therefore, for example, hashing algorithms used for data encryption would not be an effective method for obfuscating data in a system, as hashing amplifies the differences between the original data points. Clusters of original data points are mapped to unrelated hashed data points. Therefore, hashing cannot be used for feature obfuscation in a system. However, many other obfuscation methods can be used, such as replacement, shuffling, numerical variance methods, scrambling, masking characters, some other types of encryption that do not use hashing, and deleting some values ​​from specific fields.

[0018] In some embodiments, obfuscation can be achieved by combining different sets of inputs and / or by randomizing the inputs. For example, suppose X is the input and Y is the expected or desired output to be predicted by an ANN. Suppose A represents a function of the ANN. The prediction made by the ANN may be Yp = A(X). Training an ANN through supervised machine learning can be represented as adjusting A to minimize the difference between Y and Yp (e.g., min |A(X) - Y|). When a user device has two sets of inputs {X1, Y1} and {X2, Y2}, the user device can obfuscate the inputs by combining the sets and requesting a computer hosting the master version of the ANN to train the master version on {Xf, Yf}, where Xf = f(X1, X2) and Yf ​​= f(Y1, Y2). For example, Xf = X1 - X2; and Yf ​​= Y1 - Y2; or Xf = W1 X1 + W2 X2; and Yf ​​= W1Y1 + W2 Y2, where W1 and W2 are weights that can be customized to adjust the degree of obfuscation.

[0019] In some embodiments, when the input is Xf = f(X1, X2), the expected output may not necessarily be Yf = f(Y1, Y2). Therefore, Yf is an estimate. The computer hosting the primary version of the ANN cannot guess or compute X1 and / or X2 from Xf; these are hosted by one of the other computing devices hosting the local version of the ANN. Therefore, what is actually experienced on the user's device is not revealed to the computer hosting the primary version of the ANN. Yf is a good estimate. The server can improve A by training on {Xf, Yf}.

[0020] Furthermore, the aforementioned obfuscation scheme can be extended to combinations of more than two sets of inputs (e.g., {X1,Y1}, {X2,Y2}, {X3,Y3}, ...). When the weights are adjusted so that Xf approaches one of the input sets (e.g., X1), Yf is expected to be a good estimate of what is actually expected from Xf. As Xf moves closer to X1, the accuracy of the estimate Yf increases, but the obfuscation effect decreases (because it becomes easier to guess X1 from Xf). Therefore, in some embodiments, the weights can be configured to obfuscation preferences to balance the need for accuracy and privacy.

[0021] Furthermore, in some embodiments, X2 can be a random input. The user device can estimate Y2 by using the current ANN prediction Y2=A(X2). This can further improve the effectiveness of obfuscation at the expense of accuracy.

[0022] In some embodiments, one of the devices hosting a local version of the ANN can feed user data stored in its memory into the local version of the ANN to use and train the local version of the ANN. For example, this can happen on a user's mobile device. User data, which may contain sensitive or private information, is not shared with other devices when used with the ANN. In other words, machine learning with the ANN can occur locally and privately because the user data is not shared with other devices and is protected within the user's device. However, when user data is shared with other devices to train other versions of the ANN (e.g., the main version), the user data can be obfuscated before sharing.

[0023] In some embodiments, one or more devices hosting the master version of the ANN may be part of a cloud computing environment. Furthermore, in such embodiments, user data can remain private on cloud devices by obfuscating it only on the user's device. However, the cloud can still benefit from the obfuscated data because it can be used to train the master version of the ANN in the cloud. Obfuscated user data is not sent to the cloud to protect user privacy. However, unmasked user data can be used to train a local version of the ANN locally on the user's device. For example, user data may only be used to train a local version of the ANN on the user's mobile device (e.g., the user's smartphone, tablet, etc.). When user data is shared within the system to train other versions of the ANN, it is always obfuscated by the system.

[0024] In some embodiments, a master version of the ANN can be downloaded to a user's individual device to update and improve the local version of the ANN stored on the device. This can improve the accuracy of the locally stored version of the ANN in regions of the ANN that may not have been improved by training it separately locally. Furthermore, the downloaded master version of the ANN can be further trained locally for a customized version of the user's ANN. The benefit of this is that when the ANN is trained locally on the user's device, there is no need to obfuscate the data input.

[0025] Generally, in a computer network configurable to implement obfuscation of inputs used for centralized training of a master version of an ANN, devices hosting different training versions of the ANN can perform local training to avoid the transmission of user data unless the user data is obfuscated before transmission. This is because only obfuscated user data can be transmitted over the network of the communication-coupled network devices. A central device, server, or cloud can then receive the obfuscated user data via the network and use this data to train the master version of the ANN without compromising data privacy. Since the central device, server, or cloud does not have the original user data (e.g., the input of the local version of the ANN), user data exposure to the central device, server, or cloud and the network is avoided. It should also be understood that, in some embodiments, obfuscation of user data can even be used against the input data to train the local version of the ANN to enhance privacy protection for the user device.

[0026] Computer networks that can be configured to obfuscate the inputs used to centrally train the master version of an ANN can protect user privacy while still retaining the benefits of training the ANN using data from different users. However, in some embodiments, less sensitive data can be sent to a central device, server, or cloud without obfuscation. Furthermore, sensitive data can be sent after obfuscation.

[0027] In computer networks, updated ANNs can take the form of updating neuron properties and / or connectivity. Versions of the ANN can be modified by training with compatible machine learning techniques, where the input is obfuscated user data or at least contains obfuscated user data. However, the obfuscated user data should not be obfuscated to the extent that updating neuron properties and / or connectivity with obfuscated input would be detrimental to the ANN's effectiveness in making the expected predictions.

[0028] Figure 1 and 2 The present disclosure describes a computer network 100 configured to obfuscate the inputs of a master version of an ANN for centralized training, according to some embodiments of the present disclosure.

[0029] exist Figure 1 The image illustrates a computer network 100 comprising a set of computing devices 102. The set of computing devices 102 may include one or more of any type of computing devices capable of hosting and executing versions of ANNs, such as any type of mobile device, personal computer, or smart device capable of hosting and executing versions of ANNs (e.g., see second computing device 104a and Nth computing device 104b). Each computing device in the set of computing devices 102 may host and execute a local version of an ANN (e.g., see second computing device 104a and Nth computing device 104b having corresponding local versions of ANNs 106a and 106b).

[0030] The computer network 100, which includes a first computing device 108, is also shown. The first computing device 108 may be a single computing device or multiple computing devices distributed over a network (e.g., distributed over a network in a cloud computing environment). The single computing device or multiple computing devices implemented by the first computing device 108 may include a major version of ANN 110. Depending on the implementation of the computer network 100, the first computing device 108 may be a central device, a server, or a selected device in a cloud or peer-to-peer computing network.

[0031] in other words, Figure 1 The description describes a computer network 100 comprising a group of computing devices 102 with networked computing devices (e.g., see computing devices 104a and 104b), wherein each networked computing device stores and uses a separate local version of an ANN (e.g., see local versions of ANN 106a and 106b). The computer network 100 also includes a first computing device 108 (which may be part of a cloud or another type of distributed computing network). The first computing device 108 contains a master version of ANN 110.

[0032] Local versions of the ANN (e.g., see local versions of ANN 106a and 106b) can be used with user data (e.g., see user data 120a and 120b). Furthermore, local versions of the ANN (e.g., see local versions of ANN 106a and 106b) can be used with obfuscated user data (e.g., see obfuscated 124a and 124b, and obfuscated user data 130a and 130b). Moreover, user data (whether obfuscated or not) can be used to train local versions of the ANN (e.g., see extracted features 122a and 122b).

[0033] The obfuscated user data can also be used, for example, to train the master version of ANN 110 (e.g., see sending obfuscated user data 130a and 130b to machine learning 112 in the first computing device 108). An updated master version of the ANN can then be downloaded via one or more of the devices in the set of computing devices 102 (e.g., see downloads 132a and 132b). The downloaded master version can replace the local version of the ANN or be combined with a local version of the ANN hosted by one of the devices in the set of computing devices 102.

[0034] The master version of the ANN (e.g., see the master version of ANN 110) can be repeatedly trained using machine learning (e.g., see machine learning 112) on received obfuscated data (e.g., see obfuscated user data 130a and 130b), making the master version general and increasingly accurate over time. Obfuscated data can be received from different users' devices with different and local versions of the ANN (e.g., see local versions of ANN 106a and 106b) and different stored user data (e.g., see user data 120a and 120b). The master version of the ANN (e.g., see the master version of ANN 110) can be downloaded (e.g., see downloads 132a and 132b) to individual user devices (e.g., see computing devices 104a and 104b) to update the user device's capabilities to benefit from improvements in areas that may not have been trained locally. Moreover, the downloaded ANN can be further trained locally for a customized version of the user's ANN.

[0035] Figure 1 and 2 Not shown, computer network 100 includes a communication network, which includes wide area networks (WANs), local area networks (LANs), intranets, extranets, the Internet, and / or any combination thereof. The communication network can communicatively couple devices in a group of computing devices 102 to each other and to other devices in computer network 100 (e.g., to the first computing device 108). Obfuscated user data and downloads of the master version of the ANN mentioned herein can be transmitted or transferred via the communication network of computer network 100 (e.g., see obfuscated user data 130a and 130b, and downloads 132a and 132b).

[0036] In some embodiments, the system (e.g., computer network 100) includes a second computing device (e.g., computing device 104a or 104b) that includes memory configured to store local versions of ANNs (e.g., local versions of ANN 106a or 106b). Figure 5 The main memory 508 and / or storage system 512 shown in the figure. In such embodiments, the second computing device includes a processing device (e.g., Figure 5The processor 506 shown is configured to train a local version of the ANN. The processing unit is also configured to extract multiple features from user data (e.g., see extracted features 122a and 122b, and user data 120a and 120b), and obfuscate the extracted features to generate obfuscated user data (e.g., see obfuscation 124a and 124b, and obfuscated user data 130a and 130b). Furthermore, the second computing unit may include a transceiver (e.g., network interface 510) configured to transmit the obfuscated user data (e.g., see obfuscated user data 130a and 130b).

[0037] In such embodiments, the system (e.g., computer network 100) further includes a first computing device (e.g., first computing device 108) that includes a memory configured to store a major version of the ANN (e.g., a major version of ANN 110). Figure 5 The main memory 508 and / or storage system 512 shown in the diagram). The first computing device may also include a transceiver (e.g., a network interface 510) configured to receive obfuscated user data transmitted from the second computing device. Furthermore, the first computing device may also include a processing unit (e.g., Figure 5 The processor 506 shown is configured to train the main version of the ANN based on the received scrambled user data using machine learning (e.g., see Machine Learning 112).

[0038] The second computing device may be one of multiple computers hosting different versions of the ANN and different user datasets (e.g., see the set of computing devices 102 and 104a and 104b). The second computing device may extract multiple features from the corresponding user datasets hosted on the computers (e.g., see extracted features 122a and 122b). The second computing device may obfuscate the extracted features to generate obfuscated user data (e.g., see obfuscation 124a and 124b). The second computing device may also transfer the obfuscated user data to a selected computer hosting the master version of the ANN (e.g., see obfuscated user data 130a and 130b). The selected computer may use machine learning to train the master version of the ANN based on the obfuscated user data (e.g., see the first computing device 108 and its machine learning 112).

[0039] Generally, data obfuscation (also referred to herein as obfuscation) is the process of disguising data by modifying it. Obfuscation can be applied to user data stored on a user device (e.g., see user data 120a and 120b), for example, to one or more data fields of the user data to protect data classified as sensitive, such as personally identifiable data, personally sensitive data, or commercially sensitive data. However, obfuscated data can remain a version that can be used to train an ANN (e.g., see the main version of ANN 110), so that the results produced by training an ANN with obfuscated data are as expected. In some embodiments, obfuscated user data appears unmodified.

[0040] Obfuscation of multiple extracted features may involve combining different sets of inputs from the multiple extracted features using one or more arithmetic operations to combine different sets (e.g., see Obfuscation 124a and 124b and...). Figure 3 Step 312 described herein. Feature extraction (e.g., see extracted features 122a and 122b) may involve randomly selecting different sets of inputs to combine different sets. Alternatively, feature extraction may involve intentionally selecting different sets of inputs to combine different sets.

[0041] Furthermore, the obfuscation of multiple extracted features (e.g., see obfuscation 124a and 124b) may include the use of substitutions (e.g., see... Figure 3 (Step 314 as described in the document). The replacement may involve replacing the data in the extracted multiple features with data that is related to the data in the extracted multiple features.

[0042] Obfuscation of multiple extracted features (e.g., see obfuscation 124a and 124b) may include the use of shuffling (e.g., see... Figure 3 (See step 316 described in the document). Reorganization may include rearranging the order or position of data from the extracted multiple features.

[0043] The obfuscation of the extracted multiple features (e.g., see obfuscation 124a and 124b) may include numerical variance methods (e.g., see Figure 3 (Step 318 as described in the document). The numerical variance method may involve varying the values ​​within the data of the extracted multiple features to a predetermined range. For example, the numerical variance method may involve changing the values ​​within the data of the extracted multiple features by adding or subtracting a certain percentage or percentage range for each value, such as changing by adding or subtracting up to 10%.

[0044] Obfuscation of the extracted features (e.g., see Obfuscation 124a and 124b) may include the use of data encryption (e.g., see Figure 3 Step 320 as described in the document.

[0045] It should be understood that the obfuscation techniques described in this paper allow data points that are oriented close to each other (to a certain extent) to remain close to each other after obfuscation. Otherwise, the correlation between the obfuscated inputs and outputs would prevent the ANN from being trained to make feasible predictions. Therefore, for example, cryptographic hashing algorithms would not be an effective method for obfuscating data in a system, as hashing amplifies the differences between the original data points, mapping clusters of original data points to unrelated hashed data points. Therefore, hashing cannot be used for feature obfuscation in a system.

[0046] Obfuscation of the extracted features (e.g., see obfuscation 124a and 124b) may also include eliminating or deleting at least a portion of the data in the extracted features (e.g., see Figure 3 (See step 322 described in the document). For example, obfuscation may involve randomly eliminating or deleting at least a portion of the data in the extracted multiple features. Alternatively, at least a portion of the data in the extracted multiple features may be intentionally eliminated or deleted.

[0047] Obfuscation of the extracted features (e.g., see Obfuscation 124a and 124b) may include the use of masking or character scrambling methods (e.g., see Figure 3 (Step 324 as described in the document). The masking or character scrambling method may include a portion of the data from multiple features extracted by masking or character scrambling.

[0048] The first computing device (e.g., see first computing device 108) may be one of a plurality of computers (e.g., computers in a cloud computing environment) or a single computer. In some embodiments, the first computing device may be or include a cloud computing environment (e.g., see...). Figure 2 The first computing device may host a major version of the ANN (e.g., see major version of ANN 110). The first computing device may also receive obfuscated user data from a second computer (e.g., see obfuscated user data 130a and 130b).

[0049] The obfuscated user data may include multiple obfuscated features, for example, obtained from obfuscation in a second computer (e.g., see obfuscation 124a and 124b). The second computer may extract multiple features from user data locally stored on the second computer (e.g., see extracted features 122a and 122b), and obfuscate the extracted features to generate multiple obfuscated features before transmitting the obfuscated user data to the first computer (e.g., see transmitting obfuscated user data 130a and 130b to the first computing device 108). The second device may obfuscate the extracted features by combining different sets of inputs using one or more arithmetic operations. The extracted features may include portions of user data marked as obfuscated in the data storage system of the second computing device. Furthermore, the second device may use substitution, shuffling, numerical variance methods, encryption, or combinations thereof to obfuscate the extracted features. Additionally, the second device may use elimination or deletion of at least a portion of the extracted features (e.g., randomly or intentionally) or use masking or character heating methods to obfuscate the extracted features.

[0050] The first computer can also use machine learning (e.g., see Machine Learning 112) to train a master version of the ANN based on the received obfuscated user data (e.g., see the master version of ANN 110).

[0051] Figure 2 and Figure 1 It is somewhat similar, as it demonstrates a computer network 100 that implements a configuration that obfuscates the inputs for training the master version of the ANN. However, with Figure 1 different, Figure 2 Specifically, a set of computing devices 102 depicting mobile devices (e.g., mobile devices 105a and 105b) that include corresponding local versions of managed ANNs (e.g., see local versions of ANN 106a and 106b). Furthermore, in Figure 2 The example shows a cloud computing environment (e.g., cloud computing environment 109) hosting a major version of ANN (e.g., see major version 110 of ANN). In other words, Figure 2 yes Figure 1 A more specific implementation of the computer network shown herein, wherein the first device 108 is a cloud computing environment 109 or part of a cloud computing environment 109, and the devices in a set of computing devices 102 are specifically mobile devices (e.g., see mobile devices 105a and 105b).

[0052] Figure 3 and 4 This describes example methods performed by an instance portion of a computer network 100, which can implement obfuscation of the inputs for centralized training of a master version of an ANN, according to some embodiments of this disclosure.

[0053] Figure 3 Method 300 is demonstrated by a computing device (e.g., see computing devices 104a and 104b and mobile devices 105a and 105b) configured to obfuscate the inputs for centrally training a master version of an ANN, the computing device communicating with one or more other computing devices (e.g., see first computing device 108 and cloud computing environment 109) capable of hosting, executing, and training the master version of the ANN. Method 300 begins at step 302 with corresponding different versions of the ANN and corresponding different user datasets hosted by multiple computers.

[0054] At step 304, one of the computers labels portions of the user data to be obfuscated before extracting multiple features. In some embodiments, the computer labeling of portions of the user data may include randomly labeling portions such that the labeled portions are random samples of portions of the user data. In some other embodiments, the computer labeling of portions of the user data may include intentionally labeling portions such that the labeled portions are intentionally samples of portions of the user data.

[0055] At step 306, the computer extracts multiple features based on the labeled portion of the user data. The extracted features may include the labeled portion of the user data.

[0056] At step 308, the computer obfuscates the extracted features to generate obfuscated user data.

[0057] Furthermore, in step 310, the computer transfers the obfuscated user data to a selected computer hosting the master version of the ANN. The selected computer can then use machine learning to train the master version of the ANN based on the obfuscated user data.

[0058] At step 312, the extracted features can be obfuscated at step 308 by combining different sets of inputs from the extracted features using one or more arithmetic operations to combine different sets. In some embodiments, obfuscation may include randomly selecting different sets of inputs to combine different sets. In some other embodiments, obfuscation may include intentionally selecting different sets of inputs to combine different sets.

[0059] For example, for training the master version of ANN 110, suppose X is the input (e.g., see extracted features 122a and 122b) and Y is the expected or desired output to be predicted by the ANN. Suppose A represents a function of the master version of ANN 110. The prediction made by the master version of ANN 110 can be Yp = A(X). Training the master version of ANN 110 by supervised machine learning, such as machine learning 112, can be expressed as adjusting A to minimize the difference between Y and Yp (e.g., min |A(X) - Y|). When a user device has two sets of inputs {X1,Y1} and {X2,Y2} in user data (e.g., see extracted features 122a and 122b), the user device (e.g., see computing devices 104a and 104b) can obfuscate the inputs by combining the sets and requesting a computer (e.g., see first computing device 108) to train a master version on {Xf,Yf}, where Xf=f(X1,X2) and Yf=f(Y1,Y2). For example, Xf=X1-X2; and Yf=Y1-Y2; or Xf=W1X1+W2X2; and Yf=W1Y1+W2Y2, where W1 and W2 are weights that can be customized to adjust the degree of obfuscation.

[0060] In some embodiments, when the input is Xf = f(X1, X2) (e.g., see extracted features 122a and 122b), the expected output may not necessarily be Yf = f(Y1, Y2). Therefore, Yf is an estimate. The computer hosting the primary version of ANN 110 (e.g., see first computing device 108) cannot guess or compute X1 and / or X2 from Xf, which is hosted by one of the other computing devices hosting the local version of ANN (e.g., see computing devices 104a and 104b). Therefore, what is actually experienced on the user device (e.g., see computing devices 104a and 104b) is not revealed to the computer hosting the primary version of ANN (e.g., see first computing device 108). However, Yf is a good estimate, and the computer hosting the primary version of ANN 110 can improve A by training a scrambled version of the user data on {Xf, Yf} (e.g., see scrambled user data 130a and 130b).

[0061] Furthermore, the aforementioned obfuscation scheme can be extended to combinations of more than two sets of inputs (e.g., {X1,Y1}, {X2,Y2}, {X3,Y3}, ...). In other words, the extracted features (e.g., extracted features 122a and 122b) can be included in obfuscations (e.g., see obfuscations 124a and 124b) that combine more than two sets of inputs. When the weights are adjusted such that Xf approaches one of the input sets (e.g., X1) in the obfuscation (e.g., see obfuscations 124a and 124b), Yf is expected to be a good estimate of what is actually expected from Xf. As Xf moves closer to X1, the accuracy of the estimate Yf increases, but the obfuscation effect decreases (because it becomes easier to guess X1 from Xf). Therefore, in some embodiments, the weights can be configured to obfuscation preferences to balance the need for accuracy and privacy. Moreover, in some embodiments, X2 can be a random input. The user device can estimate Y2 by using the current ANN prediction Y2=A(X2). This can further increase the effectiveness of the obfuscation.

[0062] At step 314, the obfuscation of the extracted multiple features at step 308 can occur through substitution. Furthermore, the substitution may involve replacing the data in the extracted multiple features with data related to the data in the extracted multiple features.

[0063] The replacement at step 314 can apply data masking and preserve the authentic look and feel of the obfuscated user data. The replacement at step 314 involves replacing existing values ​​in the extracted features of the user data with authentic appearance values. For example, the user data may contain customer records, personally identifiable information, and other types of sensitive information, which may be randomly or intentionally replaced, for example, with fake customer records, personally identifiable information, etc., supplied from a lookup file. For example, the replacement may involve replacing the name in the user data with a fake name stored in memory (e.g., a lookup file). Furthermore, for example, a fake Social Security number may be used instead of a Social Security number in the replacement.

[0064] Replacement can maintain the formatting of fields in the data structure and user data, but it can also obfuscate the data to protect the privacy of sensitive user information. Replacement can be applied to various other fields in user data, including email addresses, phone numbers, physical mailing addresses, postal codes, credit card numbers, social security numbers, and other personally identifiable numbers that can meet checksum tests (e.g., Luhn's checksum test).

[0065] At step 316, the confusion of the extracted features at step 308 can occur through reorganization. Moreover, reorganization may involve rearranging the order or position of the data in the extracted features.

[0066] The shuffling at step 316 is somewhat similar to substitution, but shuffling uses data from the same data source or obfuscated columns of the same data for substitution. For example, if the data source or user data column has usernames in the first row, Social Security numbers in the second row, and email addresses in the third row, shuffling could move usernames to a different row than the first row and Social Security numbers to the first row, and so on. As suspected, the aforementioned examples of shuffling may not be effective at obfuscating the data to prevent snooping; however, in situations where the order of information in the extracted features of user data must be hidden, shuffling may be an effective obfuscation method that does not disrupt the input for training the ANN. Moreover, shuffling can be even more effective when combined with substitution. The obfuscation at step 308 can be effective when using both substitution and shuffling simultaneously, and both methods can be used together without significantly interfering with the training of the ANN.

[0067] At step 318, the obfuscation of the extracted features at step 308 can be achieved using a numerical variance method. Furthermore, the numerical variance method may involve varying the values ​​within the data of the extracted features to a predetermined range. For example, the numerical variance method may involve changing the values ​​within the data of the extracted features by adding or subtracting a certain percentage or percentage range from each value, such as adding or subtracting up to 10%.

[0068] The numerical variance method at step 318 can be useful when obfuscating performance or financial data, or other data driven by numbers and quantities. For example, the numerical variance method can be used, and the result of this obfuscation can still leave meaningful data available for use, such as for training an ANN. For instance, if this method is used to partially obfuscate payroll data, the privacy of the information is maintained, but the masked data can still be used, for example, for inference through an ANN. The numerical variance method at step 318 can also be applied to dates in user data to obfuscate the data. For example, if a certain degree of integrity needs to be maintained for the entire dataset, applying a random numerical variance of + / - days to the date field will preserve the date distribution but will still prevent traceability back to known entities.

[0069] At step 320, the obfuscation of the extracted features, which occurred at step 308, can be achieved through encryption. Data encryption at step 320 cannot use hashing algorithms as described herein because this method would corrupt the input used to train the ANN. The encryption method at step 320 can use the key to be applied to view the data based on user permissions. Furthermore, a format that maintains encryption can be used at step 320 because this method preserves the validity of the masked data for training the ANN.

[0070] At step 322, the obfuscation of the extracted features at step 308 can occur by eliminating or deleting at least a portion of the data in the extracted features. For example, obfuscation may include randomly eliminating or deleting at least a portion of the data in the extracted features. Alternatively, at least a portion of the data in the extracted features may be intentionally eliminated or deleted.

[0071] The masking at step 322 is a simple method of obfuscation by simply applying null values ​​to a specific field. The null value method can be used to prevent the visibility of data elements in the extracted features, and in some implementations, it may unintentionally disrupt ANN training. In some cases, the masking at step 322 can be used to train the ANN without interfering with ANN training.

[0072] At step 324, the obfuscation of the extracted multiple features at step 308 can occur through masking or character scrambling methods. The masking or character scrambling method may include a portion of the data from the extracted multiple features obtained through masking or character scrambling.

[0073] The masking or scrambling method at step 324 is also a simple way to prevent viewing of sensitive information; however, it effectively protects privacy and preserves the structure and format of user data, which helps maintain its usefulness when training the ANN. Masking or scrambling can be useful when applied to credit card data or other numeric identifiers in user data. For example, a bill reference with the last five digits of a card as XXXX XXXXXX 53495 might be the result of obfuscating the complete credit card number. Once the data is transmitted from the user's device, a third party may only see the last five digits of the card number, but this data, along with other useful data used to train the ANN, remains intact.

[0074] Figure 4 The display is made up of the major version configured to host and execute ANN (see, for example, see the following). Figure 1 and 2 Method 400 is performed by a computing device (the first computing device 108 and cloud computing environment 109 depicted herein) and a computing device configured to host and execute other versions of ANN (e.g., see computing devices 104a and 104b or mobile devices 105a and 105b). Method 400 may include the operation of method 300.

[0075] Method 400 begins at step 402 by extracting multiple features from user data stored on a second computing device (e.g., see computing devices 104a and 104b or mobile devices 105a and 105b) through a second computing device hosting one of the other versions of the ANN.

[0076] At step 404, the second computing device (e.g., see computing devices 104a and 104b or mobile devices 105a and 105b) obfuscates multiple features from the user data. The obfuscation at step 404 may include... Figure 3 One or more of steps 308 and 312 to 324 as described herein.

[0077] At step 406, the second computing device (e.g., see computing devices 104a and 104b or mobile devices 105a and 105b) transmits obfuscated user data with obfuscating features.

[0078] At step 408, the first computing device (e.g., see first computing device 108 and cloud computing environment 109) receives obfuscated user data.

[0079] At step 410, the first computing device trains a master version of the ANN using machine learning based on the received obfuscated user data. The training performed at step 410 includes updating the master version of the ANN. Training the master version of the ANN at step 410, as well as training other versions of the ANN, may take the form of updating the neuronal properties and / or connectivity of the ANN.

[0080] At step 412, the first computing device transmits the updated master version of the ANN updated from the training at step 410.

[0081] At step 414, the second computing device receives the updated major version of the ANN. In the case of the updated major version of the ANN, the second computing device can update its local version of the ANN according to the updated major version. For example, the second computing device can replace its local version of the ANN with the received updated major version of the ANN.

[0082] Not in Figure 4 The example demonstrates that a local version of an ANN can be trained or retrained by combining an updated master version with the current local version of the ANN on the user's device. Furthermore, the combination during training or retraining can include updating the neuron properties of the local version of the ANN based on the average corresponding properties of the updated master version and the "current" or previous local version of the ANN.

[0083] Out of Figure 4 As is the purpose of this disclosure and in steps 402 to 414, it should be understood that at step 406, from the user device (e.g., see [link to relevant documentation]). Figure 2The obfuscated user data (e.g., obfuscated user data 130a and 30b) transmitted from computing devices 104a and 104b or mobile devices 105a and 105b to a central device, server, or cloud (e.g., see first computing device 108 or cloud computing environment 109) hosting the master version of the ANN may be in the form of all the extracted features extracted in step 402 or a portion of the extracted features extracted in step 402 obfuscated at step 404. Furthermore, in some embodiments, the central device, server, or cloud hosting the master version of the ANN may restrict what the user device can extract at step 402 and obfuscate at step 404 to adjust for privacy protection provided by obfuscation and, on the other hand, to use the obfuscated user data as training input to adjust the training accuracy of the ANN version (e.g., the master version).

[0084] Furthermore, it should be understood that method 400 can be implemented on a peer-to-peer network. In such an instance, a first selected device hosts a major version of the ANN for processing, and other devices on the peer network host other versions of the ANN (e.g., local versions) for processing. In such an instance, the first selected device performs steps 408 to 412, and other devices on the peer network perform steps 402 to 406 and 414.

[0085] Regarding the method 300, method 400, or any other method, process, or operation described herein, in some embodiments, non-transitory computer-readable storage media stores instructions, said instructions being processed by at least one processing device (e.g., Figure 5 When the processor 506 shown is executed, it causes the at least one processing device to perform the method 300, method 400 or any other method, process or operation and / or any combination thereof described herein.

[0086] Figure 5 This section describes an example portion of an example computing device 500 according to some embodiments of the present disclosure. The computing device 500 can be accessed via, for example... Figure 5The computer network 100 shown is communicatively coupled to other computing devices. In some embodiments, computing device 500 is one or more computing devices of a first computing device 108 or a cloud computing environment 109. In such embodiments, another example of computing device 500 is one of a group of computing devices 102 (e.g., see computing devices 104a and 104b and mobile devices 105a and 105b). Computing device 500 includes at least a bus 504, a processor 506 (e.g., CPU), main memory 508, a network interface 510, and a data storage system 512. Bus 504 communicatively couples processor 506, main memory 508, network interface 510, and data storage system 512. The computing device 500 includes a computer system comprising at least a processor 506, a main memory 508 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), static random access memory (SRAM), etc.), and a data storage system 512, which communicate with each other via a bus 504 (which may include multiple buses).

[0087] in other words, Figure 5 This is a block diagram of an instance computing device 500 having a computer system, embodiments of which are operable. In some embodiments, the computer system may include a set of instructions for causing the machine to perform any or more of the methods discussed herein when executed. In such embodiments, the machine may be connected (e.g., networked via network interface 510) to other machines in a LAN, intranet, extranet, and / or the Internet. The machine may operate as a peer machine in a peer-to-peer (or distributed) network environment (e.g., a peer-to-peer network as described herein) or as a server or client machine in a cloud computing infrastructure or environment, or within the capacity of a server or client machine in a client-server network environment.

[0088] Processor 506 represents one or more general-purpose processing devices, such as microprocessors, central processing units, etc. More specifically, the processing device may be a Complex Instruction Set Computing (CISC) microprocessor, a Reduced Instruction Set Computing (RISC) microprocessor, a Very Long Instruction Word (VLIW) microprocessor, or a processor implementing other instruction sets, or a combination of instruction sets. Processor 506 may also be one or more special-purpose processing devices, such as application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), network processors, processors in memory (PIMs), etc. Processor 506 is configured to execute instructions for performing the operations and steps discussed herein. Processor 506 may further include network interface means, such as network interface 510, for communication via one or more communication networks.

[0089] Data storage system 512 may include machine-readable storage media (also referred to as computer-readable media) storing one or more sets of instructions or software embodying any one or more methods or functions described herein. Instructions may also reside wholly or at least partially within main memory 508 and / or processor 506 during execution by a computer system, which also constitute machine-readable storage media. Although the memory, processor, and data storage portions are shown as separate portions in the exemplary embodiments, each portion should be considered to include one or more portions capable of storing instructions and performing their respective operations. The term "machine-readable storage media" should also be considered to include any media capable of storing or encoding a set of instructions executable by a machine and causing the machine to perform any one or more of the methods of this disclosure. Therefore, the term "machine-readable storage media" should be considered to include, but is not limited to, solid-state memory, optical media, and magnetic media.

[0090] In some embodiments, the peer-to-peer network may be a collection of nodes and peer connections. For example, one of the computing devices in the first computing device 108 or a group of computing devices 102 may be a node in a peer-to-peer network supported by computing devices connected via computer network 100.

[0091] Some parts of the previously described algorithms and symbolic representations of operations on data bits within computer memory have been presented. These algorithmic descriptions and representations are the means by which those skilled in the art of data processing most effectively communicate the essence of their work to others skilled in the art. In this document, and generally in general, an algorithm is conceived as a self-consistent sequence of operations that produce a desired result. An operation is an operation that requires physical manipulation of a physical quantity. Typically (but not always), these quantities take the form of electrical or magnetic signals that can be stored, combined, compared, and otherwise manipulated. It has been shown that it is sometimes convenient to refer to these signals as bits, values, elements, symbols, characters, items, numbers, etc., primarily for common use.

[0092] However, it should be remembered that all these and similar terms will be associated with appropriate physical quantities and are merely convenient notations for application to those quantities. This disclosure may refer to the actions and processes of a computer system or similar electronic computing device that manipulate and transform data represented as physical (electronic) quantities in the registers and memories of a computer system, or other data similarly represented as physical quantities in the computer system's memory or registers or other such information storage systems.

[0093] This disclosure also relates to apparatus for performing the operations described herein. Such apparatus may be specifically constructed for the desired purpose, or may comprise a general-purpose computer selectively activated or reconfigured by a computer program stored in a computer. This computer program may be stored in a computer-readable storage medium, such as, but not limited to, any type of disk, including floppy disks, optical disks, CD-ROMs and magneto-optical disks, read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic cards or optical cards, or any type of media suitable for storing electronic instructions, each connected to a computer system bus.

[0094] The algorithms and displays presented herein are not inherently related to any particular computer or other device. Various general-purpose systems can be used with the programs taught herein, or it may prove convenient to construct more specialized devices for performing the methods described herein. The structures of various such systems will be presented as set forth in the description below. Furthermore, this disclosure is described without reference to any particular programming language. It should be understood that the teachings of this disclosure as described herein can be implemented using various programming languages.

[0095] This disclosure may be provided as a computer program product or software, which may include machine-readable media on which instructions are stored for programming a computer system (or other electronic device) to perform processes according to this disclosure. Machine-readable media includes any mechanism for storing information in a machine-readable (e.g., computer-readable) form. In some embodiments, machine-readable (e.g., computer-readable) media includes machine-readable storage media, such as read-only memory (“ROM”), random access memory (“RAM”), disk storage media, optical storage media, flash memory components, etc.

[0096] In the foregoing description, embodiments of this disclosure have been described with reference to specific example embodiments thereof. It will be apparent that various modifications may be made to this disclosure without departing from the broader spirit and scope of the embodiments set forth in the appended claims. Therefore, the description and drawings should be viewed in an illustrative rather than restrictive sense.

Claims

1. A method for training an artificial neural network, comprising: hosting, by a plurality of computers, respective different versions of an artificial neural network (ANN) and respective different user data sets; extracting, by a computer of the plurality of computers, a plurality of features from a respective user data set hosted on the computer; obfuscating, by the computer, the extracted plurality of features to generate obfuscated user data; and transmitting, by the computer, the obfuscated user data to a selected computer hosting a master version of the ANN, wherein the selected computer trains the master version of the ANN based on the obfuscated user data using machine learning, and wherein the selected computer restricts features extracted and obfuscated by the computer of the plurality of computers.

2. The method of claim 1, wherein obfuscating the extracted plurality of features comprises combining different sets of inputs in the extracted plurality of features using one or more arithmetic operations.

3. The method of claim 2, comprising randomly selecting, by the computer, the different sets of inputs for the combining of the different sets of inputs.

4. The method of claim 2, comprising intentionally selecting, by the computer, the different sets of inputs for the combining of the different sets of inputs.

5. The method of claim 1, further comprising: prior to extracting the plurality of features, marking, by the computer, portions of the respective user data set to be obfuscated; and extracting, by the computer, the plurality of features from the marked portions of the respective user data set, wherein the extracted plurality of features comprises the marked portions of the respective user data set.

6. The method of claim 5, wherein marking portions of the respective user data set comprises randomly marking the portions such that the marked portions are a random sampling of portions of the respective user data set.

7. The method of claim 5, wherein marking portions of the respective user data set comprises intentionally marking the portions such that the marked portions are an intentional sampling of portions of the respective user data set.

8. The method of claim 1, wherein obfuscating the extracted plurality of features comprises using substitution, and wherein the substitution comprises replacing data in the extracted plurality of features with data related to the data in the extracted plurality of features.

9. The method of claim 1, wherein obfuscating the extracted plurality of features comprises using permutation, and wherein the permutation comprises rearranging an order or position of data in the extracted plurality of features.

10. The method of claim 1, wherein the extracted plurality of features comprises using a numerical variance method, wherein the numerical variance method comprises varying values within data in the extracted plurality of features to a predetermined range.

11. The method of claim 1, wherein obfuscating the extracted plurality of features comprises using data encryption.

12. The method of claim 1, wherein obfuscating the extracted plurality of features comprises using elimination or deletion of at least a portion of data in the extracted plurality of features.

13. The method of claim 1, wherein obfuscating the extracted plurality of features comprises using a masking or character scrambling method, and wherein the masking or the character scrambling method comprises masking or character scrambling a portion of data in the extracted plurality of features.

14. A method for training an artificial neural network, comprising: hosting, by a first computer, a master version of an artificial neural network (ANN); receiving, by the first computer, obfuscated user data from a second computer, wherein the obfuscated user data comprises a plurality of obfuscated features, and wherein the second computer extracts a plurality of features from user data stored locally on the second computer and obfuscates the extracted plurality of features to generate the plurality of obfuscated features prior to transmitting the obfuscated user data to the first computer; and training, by the first computer, the master version of the ANN based on the received obfuscated user data using machine learning, wherein the first computer restricts features extracted and obfuscated by the second computer.

15. The method of claim 14, wherein the second computer obfuscates the extracted plurality of features by combining different sets of inputs using one or more arithmetic operations.

16. The method of claim 14, wherein the extracted plurality of features comprises a portion of the user data that is marked for obfuscation in a data storage system of the second computer.

17. The method of claim 14, wherein the second computer obfuscates the extracted plurality of features using substitution, shuffling, numerical variance methods, encryption, or a combination thereof.

18. The method of claim 14, wherein the second computer obfuscates the extracted plurality of features using elimination or deletion of at least a portion of the extracted plurality of features.

19. The method of claim 14, wherein the second computer obfuscates the extracted plurality of features using a masking method or a character scrambling method.

20. A system for training an artificial neural network, comprising a second computing device comprising: a memory configured to store a local version of an artificial neural network (ANN) and user data for input into the local version of the ANN; a processor configured to extract a plurality of features from the user data and obfuscate the extracted plurality of features to generate obfuscated user data; and a transceiver configured to transmit the obfuscated user data; and a first computing device comprising: a memory configured to store a master version of the ANN; a transceiver configured to receive obfuscated user data transmitted from the second computing device; and a processor configured to train the master version of the ANN based on the received obfuscated user data using machine learning, wherein the first computing device restricts features extracted and obfuscated by the second computing device.

Images