Information processing device, information processing method, and computer-readable recording medium

Abstract

Whenever a calculation execution timing for executing a calculation using a learning parameter whose value is adjusted by machine learning arrives, a calculation step changing unit (100) irregularly changes the calculation step to a calculation step different from the calculation step before the change so as to obtain the same calculation result as the calculation result obtained by executing the calculation step before the change. Whenever a calculation execution timing arrives, a calculation execution unit (101) executes the calculation using the learning parameter using the calculation step changed by the calculation step changing unit (100).

Description

Technical Field

[0001] The present invention relates to an information processing device, an information processing method, and a computer-readable recording medium. Background Art

[0002] In recent years, with the popularization of the Internet, a variety of services using the Internet have been provided. Among them, financial services, search engines, pattern recognition and other services using machine learning represented by deep learning are increasing.

[0003] On the other hand, a large number of security incidents such as information leakage due to cyber attacks have been reported. In order to prevent the leakage of information assets caused by security incidents, security measures against cyber attacks such as data encryption are taken.

[0004] In services using machine learning, learning model information such as the model architecture of the learning model of machine learning and the learning parameters whose values ​​are adjusted through learning are important information that determines the quality of the service and is an information asset with industrial value. In addition, cyber attacks aimed at stealing this learning model information have been pointed out. Therefore, security measures to protect learning model information from cyber attacks are being studied.

[0005] For example, Patent Document 1 discloses a method of storing learning model information in a tamper-resistant secure element and further scrambling the learning model information for storage, thereby protecting the learning model information from a network attack.

[0006] Prior art literature

[0007] Patent Literature

[0008] Patent Document 1: Japanese Patent Application Publication No. 2019-101807 Summary of the invention

[0009] Problems to be solved by the invention

[0010] In the method of Patent Document 1, the learning model information is scrambled and stored in a secure element, but when a calculation is performed, the learning model information is descrambled and read out to a processor for use in the calculation.

[0011] Therefore, there is a problem that the learning model information is analyzed based on side channel information such as power consumption and leakage electromagnetic waves generated when executing operations, and the learning model information cannot be protected from the influence of Model Reverse-Engineering attack methods that imitate the learning model.

[0012] The main object of the present invention is to solve the above-mentioned problems. Specifically, the main object of the present invention is to protect learning parameters, which are learning model information, from the influence of the Model Reverse-Engineering attack method.

[0013] Means for solving problems

[0014] The information processing device of the present invention comprises: an operation step changing unit which, whenever the timing for executing an operation using a learning parameter whose value is adjusted by machine learning arrives, irregularly changes the operation step to an operation step different from the operation step before the change, which obtains the same operation result as the operation result obtained by executing the operation by the operation step before the change; and an operation executing unit which, whenever the timing for executing the operation arrives, executes the operation using the learning parameter by using the operation step changed by the operation step changing unit.

[0015] Effects of the Invention

[0016] According to the present invention, learning parameters can be protected from Model Reverse-Engineering attack methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a diagram showing a hardware configuration example of the information processing device according to the first embodiment.

[0018] Figure 2 This is a diagram showing an example of a functional configuration of an information processing device according to Embodiment 1.

[0019] Figure 3 This is a flowchart showing an example of the operation of the information processing device according to the first embodiment.

[0020] Figure 4 This is a flowchart showing the calculation process of the information processing device according to the first embodiment.

[0021] Figure 5 This is a diagram showing the calculation steps of the units of the learning model according to the first embodiment.

[0022] Figure 6 This is a diagram showing a change in the calculation steps of the first embodiment.

[0023] Figure 7 This is a diagram showing changes in the calculation steps of Modification 1 of Implementation Example 1.

[0024] Figure 8 This is a diagram showing changes in the calculation steps of Modification 2 of Implementation Example 1.

[0025] Fig. 9 This is a diagram showing changes in the calculation steps of Modification 3 of Implementation Example 1.

[0026] Fig.10 This is a flowchart showing the calculation process of the information processing device according to the second embodiment.

[0027] Fig.11 This is a diagram showing changes in the calculation steps of the second embodiment.

[0028] Fig.12 This is a flowchart showing the calculation process of the information processing device according to the third embodiment.

[0029] Fig.13 This is a diagram showing changes in the calculation steps of the third embodiment. DETAILED DESCRIPTION

[0030] Hereinafter, embodiments of the present invention will be described using the drawings. In the following description of the embodiments and the drawings, parts with the same reference numerals represent the same parts or corresponding parts.

[0031] In the following embodiments, a method using a neural network is described as an example of a machine learning method that is the basis of a learning model.

[0032] Implementation Method 1

[0033] ***Description of the structure***

[0034] Figure 1 A hardware configuration example of the information processing device 1 according to the present embodiment is shown.

[0035] The information processing device 1 is a computer.

[0036] The information processing device 1 is an information processing device that performs learning processing and inference processing using a learning model 110 described later.

[0037] The learning process is, for example, a process of adjusting the learning parameter 220 described later by providing training data in trained learning. The inference process is a process of predicting or identifying unknown data based on the learning parameter 220 adjusted by the learning process.

[0038] The information processing device 1 includes a processor 10 , a memory 11 , an auxiliary storage device 12 , an input / output I / F 13 , a communication device 14 , and a random number generator 15 , which are mutually connected via signal lines.

[0039] The operation procedure of the information processing device 1 corresponds to the information processing method. The program for realizing the operation of the information processing device 1 corresponds to the information processing program.

[0040] The processor 10 is an IC (Integrated Circuit) that performs processing. As a specific example, the processor 10 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or the like.

[0041] The memory 11 is a storage device for temporarily storing data. As a specific example, the memory 11 is a RAM (Random Access Memory).

[0042] The auxiliary storage device 12 is an auxiliary storage device that stores a program for realizing the functions of the later-described operation procedure changing unit 100 and the operation executing unit 101. As a specific example, the auxiliary storage device 12 is a hard disk.

[0043] In addition, the auxiliary storage device 12 can also be a mobile recording medium such as an SSD (registered trademark, Solid State Drive), an SD (registered trademark, Secure Digital) memory card, a CF (registered trademark, CompactFlash), a NAND flash memory, a floppy disk, an optical disk, a high-density disk, a Blu-ray (registered trademark) disk, or a DVD (registered trademark, Digital Versatile Disk).

[0044] The program for realizing the functions of the calculation procedure changing unit 100 and the calculation executing unit 101 stored in the auxiliary storage device 12 is loaded from the memory 11. The program is read to the processor 10 and executed.

[0045] Furthermore, the auxiliary storage device 12 also stores an OS (Operating System).

[0046] Furthermore, at least a part of the OS is executed by the processor 10 .

[0047] The processor 10 executes a program that realizes the functions of the calculation step changing unit 100 and the calculation executing unit 101 while executing at least a part of the OS.

[0048] The processor 10 executes the OS, thereby performing task management, storage management, file management, communication control, and the like.

[0049] In addition, at least any one of the information, data, signal values ​​and variable values ​​representing the processing results of the operation step changing unit 100 and the operation executing unit 101 is stored in at least any one of the registers and cache memories in the processor 10, the memory 11, and the auxiliary storage device 12.

[0050] In addition, the program that implements the functions of the operation step change unit 100 and the operation execution unit 101 can also be stored in a mobile recording medium such as a hard disk, SSD (registered trademark), SD (registered trademark) memory card, CF (registered trademark), NAND flash memory, floppy disk, optical disk, high-density disk, Blu-ray (registered trademark) disk, and DVD (registered trademark).

[0051] Furthermore, a program that realizes the functions of the calculation step changing unit 100 and the calculation executing unit 101 may be distributed.

[0052] The communication device 14 is an electronic circuit that performs data communication processing with a connection destination via a signal line. As a specific example, the communication device 14 is a communication chip or NIC (Network Interface Card) for Ethernet (registered trademark).

[0053] The random number generator 15 is an electronic circuit that generates random numbers. Alternatively, the random number generator 15 may be a program implemented by the processor 10 .

[0054] Figure 2 It is a diagram showing a functional configuration example of the information processing device 1 according to the present embodiment.

[0055] The information processing device 1 includes a calculation procedure changing unit 100 , a calculation executing unit 101 , and a storage unit 200 .

[0056] The calculation procedure changing unit 100 changes the calculation procedure using a learning parameter 220 described later.

[0057] Specifically, the operation step changing unit 100 irregularly changes the operation step every time the operation execution timing for executing the operation using the learning parameter 220 arrives. In addition, the operation step changing unit 100 changes the operation step to an operation step different from the operation step before the change, which obtains the same operation result as the operation result obtained by executing the operation in the operation step before the change.

[0058] The processing performed by the calculation procedure changing unit 100 corresponds to the calculation procedure changing processing.

[0059] The calculation execution unit 101 executes the calculation according to the calculation procedure determined by the learning model 110 and changed by the calculation procedure changing unit 100 .

[0060] Specifically, every time a calculation execution timing comes, the calculation execution unit 101 executes a calculation using the learning parameter 220 according to the calculation procedure changed by the calculation procedure changing unit 100 .

[0061] The processing performed by the calculation execution unit 101 corresponds to the calculation execution processing.

[0062] The learning model 110 is a model that specifies a calculation procedure based on machine learning. The learning model 110 is determined by learning model information described later.

[0063] In addition, in this embodiment, the learning model 110 is a neural network.

[0064] The storage unit 200 is a storage area for storing learning model information used in the learning process and the inference process of the information processing device 1. Specifically, the learning model information is a model structure 210 and a learning parameter 220.

[0065] Specifically, the model architecture 210 is a parameter such as the number of units, the number of layers, or the activation function in the neural network that is not adjusted through the learning process.

[0066] exist Figure 2 In FIG. 1 , the circles of the learning model 110 represent units. In addition, the columns of circles represent layers. Therefore, the number of units and the number of layers of the model architecture 210 are 14 and 4, respectively.

[0067] Specifically, the learning parameter 220 is a parameter such as a weight or bias in a neural network whose value is adjusted through a learning process.

[0068] The storage unit 200 is implemented by the memory 11 and the auxiliary storage device 12 .

[0069] In addition, the model architecture 210 and the learning parameters 220 can also be stored in mobile recording media such as a hard disk, SSD (registered trademark), SD (registered trademark) memory card, CF (registered trademark), NAND flash memory, floppy disk, optical disk, high-density disk, Blu-ray (registered trademark) disk, and DVD (registered trademark).

[0070] In addition, the model structure 210 and the learning parameters 220 may also be stored in the connection destination via the communication device 14 .

[0071] Furthermore, the “unit” in the calculation procedure changing unit 100 , the calculation executing unit 101 , and the storage unit 200 may be rewritten as “circuit”, “process”, “step”, or “processing”.

[0072] Furthermore, the information processing device 1 may be realized by a processing circuit such as a logic IC (Integrated Circuit), a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or a FPGA (Field-Programmable Gate Array).

[0073] In this case, the calculation procedure changing unit 100 , the calculation executing unit 101 , and the storage unit 200 are each realized as a part of a processing circuit.

[0074] In addition, in this specification, a processor and a processing circuit are collectively referred to as a "processing circuit".

[0075] That is, a processor and a processing circuit are each specific examples of a “processing circuit”.

[0076] ***Description of the action***

[0077] Next, use Figure 3 The flowchart will be used to explain an operation example of the information processing device 1 according to the present embodiment.

[0078] In addition, in the present embodiment, an inference process is used as an example of a machine learning process for explanation.

[0079] First, in step S100 , the calculation execution unit 101 obtains input data via the input / output I / F 13 .

[0080] Next, in step S110 , the calculation execution unit 101 loads the learning model information stored in the storage unit 200 , namely, the model structure 210 and the learning parameters 220 .

[0081] Next, in step S120, the calculation execution unit 101 executes the calculation according to the loaded learning model information through the calculation steps determined by the learning model 110 and changed by the calculation step changing unit 100. In addition, the timing when the calculation step changing unit 100 executes the calculation is the calculation execution timing. The details of the calculation processing will be described later.

[0082] Then, in step S130 , the calculation execution unit 101 outputs the calculation result via the input / output I / F 13 .

[0083] Figure 4 This is a flowchart showing an example of arithmetic processing by the information processing device 1 according to the present embodiment.

[0084] In the present embodiment, the value of the learning parameter 220 is the weight of each unit determined by the learning model 110 . The calculated value calculated with the value of the learning parameter 220 is the input value of each unit determined by the learning model 110 .

[0085] First, in step S200 , the calculation execution unit 101 specifies one unit of the neural network determined by the learning model 110 .

[0086] Specifically, the calculation execution unit 101 specifies the unspecified units in order from the units in the second layer. If all the units in each layer have been specified, the calculation execution unit 101 specifies the units in the next layer. As a specific example, if all the units in the second layer have been specified, the calculation execution unit 101 specifies any unit in the third layer.

[0087] Next, in step S210 , the calculation procedure changing unit 100 performs masking.

[0088] Specifically, the calculation execution unit 101 notifies the calculation procedure changing unit 100 of a plurality of input values ​​and a plurality of weights input to the designated unit.

[0089] The calculation procedure changing unit 100 receives the notification from the calculation executing unit 101 and obtains a random number from the random number generator 15. Then, the calculation procedure changing unit 100 masks the value notified from the calculation executing unit 101 using the random number obtained from the random number generator 15. The details of masking will be described later.

[0090] Furthermore, the calculation procedure changing unit 100 calculates and stores a value used in the non-masking process based on the random number obtained from the random number generator 15 and the value notified from the calculation executing unit 101 .

[0091] No masking is a process that makes the result of a calculation using masked values ​​the same as the result of a calculation without masking.

[0092] Then, the calculation procedure changing unit 100 notifies the calculation executing unit 101 of the masked value.

[0093] Next, in step S220, the calculation execution unit 101 executes calculation using the masked value notified from the calculation procedure change unit 100. Details of the masked calculation will be described later.

[0094] Then, the calculation execution unit 101 notifies the calculation step changing unit 100 of the calculation result.

[0095] Next, in step S230, the calculation procedure changing unit 100 performs unmasking on the calculation result notified from the calculation executing unit 101. The details of unmasking will be described later.

[0096] The calculation result obtained by this unmasking is the same as the calculation result using the weights and input values ​​before the masking is applied.

[0097] Then, the calculation procedure changing unit 100 notifies the calculation execution unit 101 of the calculation result obtained by the non-masking.

[0098] Next, in step S240 , the calculation execution unit 101 sequentially performs addition of a bias and calculation of an activation function on the calculation result notified from the calculation procedure changing unit 100 .

[0099] In addition, the result of the operation of executing the activation function becomes the value input to the lower layer unit, or, in the case of no lower layer unit, becomes the operation result to be output.

[0100] The operation procedure changing unit 100 masks the input value to the unit, causes the operation executing unit 101 to perform an operation using the masked value, unmasks the operation result of the operation executing unit 101, and causes the operation executing unit 101 to perform addition of a bias and an operation of an activation function using the unmasked value, thereby changing the operation procedure. The operation result before the operation procedure is changed (the operation result of the activation function) and the operation result after the operation procedure is changed (the operation result of the activation function) are the same.

[0101] In this way, the operation step changing unit 100 changes the operation step while maintaining the identity of the operation result of the operation using the activation function. Then, the operation execution unit 101 performs the operation through the changed operation step. Specifically, the operation execution unit 101 does not perform the operation on the input value for the unit, but on the value masked by the operation step changing unit 100. In addition, the operation execution unit 101 does not perform the operation of the activation function on the operation result of the input value for the unit, but outputs the operation result of the masked value to the operation step changing unit 100, and performs the addition of the bias and the operation of the activation function on the value not masked by the operation step changing unit 100.

[0102] Next, in step S250 , the calculation execution unit 101 determines whether the calculation is completed.

[0103] Specifically, the calculation execution unit 101 checks whether all the units except the first-layer units determined by the learning model 110 have been designated.

[0104] Then, when the calculation execution unit 101 confirms that all the units except the units in the first layer determined by the learning model 110 have been specified, the calculation processing ends.

[0105] On the other hand, if the calculation execution unit 101 confirms that there is an unspecified unit among the units other than the units in the first layer determined by the learning model 110 , the process returns to step S200 .

[0106] Next, use Figure 5 and Figure 6 Masking, operations after masking, and unmasking examples are explained.

[0107] Figure 5 The figure shows an example of a calculation procedure of one unit of the learning model 110 .

[0108] The input values ​​are x0, x1, x2. In addition, the weights are w0, w1, w2.

[0109] The input values ​​x0, x1, x2 and the weights w0, w1, w2 are multiplied in combinations of the same subscript value. Then, the sum of these individual multiplication values ​​is calculated. The sum is x0w0+x1w1+x2w2.

[0110] Then, the bias b0 is added to the sum. Then, the value after adding the bias b0 is operated by the activation function and output as output y0.

[0111] Figure 6 The diagram shows Figure 5 An example of a calculation step in which a change is made by performing masked and unmasked processing based on addition in a calculation step.

[0112] The weights w0, w1, and w2 are first added to the random number m and masked. In this way, the process of concealing at least one of the value of the learning parameter 220 and the calculated value by adding or multiplying the random number generated by the random number generator 15 is masking.

[0113] Then, the input values ​​x0, x1, x2 and the masked weights w0+m, w1+m, w2+m are multiplied in combinations of the same subscript values. Then, the sum of these individual multiplication values ​​is calculated. The sum is x0w0+x1w1+x2w2+m(x0+x1+x2).

[0114] Then, the sum is added to the value -m(x0+x1+x2) used in the unmasking operation calculated and stored by the operation procedure changing unit 100. Due to this unmasking operation, the operation result before adding the bias b0 becomes x0w0+x1w1+x2w2, which is the same as the operation result before adding the bias b0 when no masking is performed.

[0115] In addition, in the case of masking based on addition, it is also possible to implement no masking after adding the bias b0.

[0116] ***Description of the Effects of the Implementation Method***

[0117] As described above, in this embodiment, masked processing and unmasked processing using random numbers are added to the operation steps determined by the learning model. Therefore, the operation steps are irregularly changed every time the operation is executed. As a result, the side channel information generated when the operation is executed changes irregularly. Therefore, it is possible to prevent the analysis of the learning model, that is, the learning parameters.

[0118] In addition, in this embodiment, as an example of a machine learning method that is the basis of a learning model, a method using a neural network is described, but it is not limited to this, and a learning model based on a method such as deep learning, regression, decision tree learning, Bayesian method, clustering, etc. may also be used.

[0119] Furthermore, the processing of machine learning is not limited to inference processing, but can also be applied to learning processing.

[0120] ***Other structures***

[0121] <Modification 1>

[0122] In the first embodiment, a random number is added to the weight, which is the value of the learning parameter 220, and masking is performed. However, the weight may be multiplied by a random number and masking may be performed. Regarding this modification example 1, the differences from the first embodiment are described.

[0123] Figure 7 The diagram shows Figure 5 An example of a calculation step in which a masked process based on multiplication of weights and a maskless process are changed in the calculation step.

[0124] The weights w0, w1, and w2 are first multiplied by the random number m and then masked.

[0125] Then, the input values ​​x0, x1, x2 and the masked weights mw0, mw1, mw2 are multiplied in combinations of the same subscript values. Then, the sum of these individual multiplication values ​​is calculated. The sum is mx0w0+mx1w1+mx2w2.

[0126] Then, the sum is unmasked by multiplying the value 1 / m used in the unmasking operation calculated and stored by the operation procedure changing unit 100. Due to this unmasking operation, the operation result before adding the offset b0 becomes x0w0+x1w1+x2w2, which is the same as the operation result before adding the offset b0 when no masking is performed.

[0127] <Modification 2>

[0128] As a second modification, a random number may be added to the calculated value, that is, the input value, to perform masking.

[0129] Figure 8 The diagram shows Figure 5 An example of a calculation step in which a masked process based on adding an input value and a maskless process are changed in the calculation step.

[0130] The input values ​​x0, x1, and x2 are first added to the random number m and masked.

[0131] Then, the masked input values ​​x0+m, x1+m, x2+m and weights w0, w1, w2 are multiplied by the same subscript value combination. Then, the sum of these individual multiplication values ​​is calculated. The sum is x0w0+x1w1+x2w2+m(w0+w1+w2).

[0132] Then, the sum is added to the value -m(w0+w1+w2) used in the unmasking operation calculated and stored by the operation procedure changing unit 100. Due to the unmasking operation, the operation result before adding the bias b0 becomes x0w0+x1w1+x2w2, which is the same as the operation result before adding the bias b0 when no masking is performed.

[0133] In addition, in the case of masking based on addition, it is also possible to implement no masking after adding the bias b0.

[0134] <Variation 3>

[0135] As a third modification, the calculated value, that is, the input value, may be multiplied by a random number and masked.

[0136] Fig. 9 The diagram shows Figure 5 An example of a calculation step in which a masked process and a non-masked process based on multiplication of an input value are performed and a change is made in the calculation step.

[0137] The input values ​​x0, x1, and x2 are first multiplied by the random number m and then masked.

[0138] Then, the masked input values ​​mx0, mx1, mx2 and weights w0, w1, w2 are multiplied by the same subscript value combination. Then, the sum of these individual multiplication values ​​is calculated. The sum is mx0w0+mx1w1+mx2w2.

[0139] Then, the sum is unmasked by multiplying the value 1 / m used in the unmasking operation calculated and stored by the operation procedure changing unit 100. Due to this unmasking operation, the operation result before adding the offset b0 becomes x0w0+x1w1+x2w2, which is the same as the operation result before adding the offset b0 when no masking is performed.

[0140] Implementation Method 2

[0141] In the configuration of this embodiment, an example of processing in which the operation order is changed will be described.

[0142] In this embodiment, the differences from Embodiment 1 are mainly described.

[0143] In addition, matters not described below are the same as those in Implementation 1.

[0144] Fig.10 1 is a flowchart showing an example of arithmetic processing by the information processing device 1 of this embodiment. Note that the same operations as those in the first embodiment are denoted by the same reference numerals and their descriptions are omitted.

[0145] After step S200 is completed, in step S300 , the calculation procedure changing unit 100 changes the order of calculation.

[0146] Specifically, the calculation execution unit 101 notifies the calculation procedure changing unit 100 of the calculation order of calculations using a plurality of input values ​​input to a designated unit and a plurality of weights.

[0147] Next, the operation step changing unit 100 obtains a random number from the random number generator 15 and determines the changed operation order. As a specific example, the operation step changing unit 100 uses the Fisher-Yates shuffle to determine the operation order. In addition, in determining the changed operation order, it is not limited to the Fisher-Yates shuffle, and other shuffle algorithms such as the Sattolo algorithm may also be used.

[0148] Then, the calculation procedure changing unit 100 notifies the calculation executing unit 101 of the determined changed calculation order.

[0149] Next, in step S310 , the calculation execution unit 101 executes the calculation according to the changed calculation order notified from the calculation procedure change unit 100 .

[0150] Then, the calculation execution unit 101 sequentially performs the addition of the bias and the calculation of the activation function.

[0151] Next, use Fig.11 A modified example of the calculation steps of this embodiment is shown.

[0152] exist Fig.11 In FIG. 1 , the column on the left shows the order of operations. In addition, the order before and after the change is shown.

[0153] The order before the change is shown as operation 1: x0×w0, operation 2: x1×w1, and operation 3: x2×w2.

[0154] In addition, the changed operation order is shown to be operation 1: x2×w2, operation 2: x0×w0, and operation 3: x1×w1.

[0155] As described above, in this embodiment, a process of changing the order of operations using random numbers is added to the operation steps determined by the learning model. Therefore, the operation steps are irregularly changed every time the operation is executed. As a result, the side channel information generated when the operation is executed changes irregularly. Therefore, it is possible to prevent the analysis of the learning model information, that is, the learning parameters.

[0156] Implementation 3

[0157] In this embodiment, an example of performing secret sharing processing for concealing the value of the learning parameter 220 and a calculated value calculated with the learning parameter 220 according to Shamir's secret sharing scheme will be described.

[0158] In the present embodiment, the value of the learning parameter 220 is the weight of each unit determined by the learning model 110 . The calculated value calculated with the value of the learning parameter 220 is the input value of each unit determined by the learning model 110 .

[0159] In this embodiment, the differences from Embodiment 2 are mainly described.

[0160] In addition, matters not described below are the same as those in Implementation 2.

[0161] Fig.12 1 is a flowchart showing an example of arithmetic processing by the information processing device 1 of this embodiment. Note that the same operations as those in Embodiment 2 are denoted by the same reference numerals and their descriptions are omitted.

[0162] After step S200 is completed, in step S400 , the calculation procedure changing unit 100 performs secret sharing processing according to the Shamir secret sharing method.

[0163] Specifically, the calculation execution unit 101 notifies the calculation procedure changing unit 100 of a plurality of input values ​​and a plurality of weights input to the designated unit.

[0164] The calculation procedure changing unit 100 receives the notification from the calculation executing unit 101 and obtains a random number from the random number generator 15 .

[0165] Then, the calculation procedure changing unit 100 generates five shares each from each of the plurality of input values ​​and each of the plurality of weights notified from the calculation executing unit 101 , using the random number obtained from the random number generator 15 .

[0166] Then, the calculation procedure changing unit 100 notifies the generated share to the calculation executing unit 101. The details of the secret distribution process will be described later.

[0167] Next, in step S410, the calculation execution unit 101 performs calculation using the sharing notified from the calculation procedure changing unit 100. The details of the calculation using the sharing will be described later.

[0168] Then, the calculation execution unit 101 notifies the calculation step changing unit 100 of the calculation result using sharing.

[0169] Next, in step S420, the calculation procedure changing unit 100 performs a restoration process of restoring the multiplication result of each of the plurality of input values ​​and each of the plurality of weights using the shared calculation result notified from the calculation executing unit 101. The details of the restoration process will be described later.

[0170] The calculation result obtained by this restoration process is the same as the calculation result using the weights and input values ​​before the secret sharing process is performed.

[0171] Then, the calculation procedure changing unit 100 notifies the calculation executing unit 101 of the restored multiplication result.

[0172] Next, in step S430, the calculation execution unit 101 obtains the sum of the restored multiplication results notified from the calculation procedure changing unit 100. Then, the addition of the bias and the calculation of the activation function are sequentially performed.

[0173] The operation procedure changing unit 100 performs secret distribution processing on the input value for the unit, causes the operation executing unit 101 to perform operation using the value after secret distribution processing, restores the operation result of the operation executing unit 101, and causes the operation executing unit 101 to perform addition of bias and operation of activation function using the restored value, thereby changing the operation procedure. The operation result before the operation procedure is changed (the operation result of the activation function) and the operation result after the operation procedure is changed (the operation result of the activation function) are the same.

[0174] In this way, the operation step changing unit 100 changes the operation step while maintaining the identity of the operation result of the operation using the activation function. Then, the operation execution unit 101 performs the operation through the changed operation step. Specifically, the operation execution unit 101 does not operate on the input value for the unit, but operates on the value after the secret distribution processing by the operation step changing unit 100. In addition, the operation execution unit 101 does not perform the operation of the activation function on the operation result of the input value for the unit, but outputs the operation result of the restored value to the operation step changing unit 100, and performs the addition of the bias and the operation of the activation function on the value restored by the operation step changing unit 100.

[0175] Next, use Fig.13 Detailed instructions for performing secret distributed processing, using shared computation and recovery processing.

[0176] Fig.13 A modified example of the calculation steps of this embodiment is shown.

[0177] exist Fig.13 In FIG. 1 , it is shown that secret distribution processing and restoration processing are respectively performed by calculating each of a plurality of input values ​​and each of a plurality of weights.

[0178] More specifically, an example of secret sharing processing and restoration processing involving multiplication of the input value x0 and the weight w0 is shown.

[0179] The calculation procedure changing unit 100 generates an identifier using the random number generated by the random number generator 15. Furthermore, the calculation procedure changing unit 100 distributes the input value and the weight to a share using the generated identifier.

[0180] exist Fig.13 The identifiers are 0, 1, 2, 3, and 4.

[0181] Furthermore, the calculation procedure changing unit 100 distributes the input value x0 to five shared x values ​​corresponding to the five identifiers. 0-0 、x 0-1 、x 0-2 、x 0-3 、x 0-4 middle.

[0182] In addition, the calculation procedure changing unit 100 distributes the weight w0 to five shared weights w0 corresponding to the five identifiers. 0-0 、w 0-1 、w 0-2 、w 0-3 、w 0-4 middle.

[0183] As described above, the five identifiers use random numbers generated by the random number generator 15, so that the identifiers and the values ​​corresponding to the identifiers are irregular values ​​each time the operation is executed. As a specific example, the five identifiers may be 1, 10, 5, 9, and 3. In this case, the five shared values ​​corresponding to the five identifiers of the input value x0 become x. 0-1 、x 0-10 、x 0-5 、x 0-9 、x 0-3 In addition, the five shares corresponding to the five identifiers of weight w0 become w 0-1 、w 0-10 、w 0-5 、w 0-9 、w 0-3 .

[0184] Next, the calculation execution unit 101 multiplies each of the five generated shares by two shares with the same subscript. 0-0 With w 0-0 Multiply. In addition, x 0-1 With w 0-1 Multiply.

[0185] Then, each multiplied value obtained by multiplication is used for restoration processing.

[0186] Next, in the restoration process, the calculation procedure changing unit 100 restores the product value of the input value x0 and the weight w0 based on each of the five identifiers and each product value.

[0187] In addition, in the present embodiment, the number of identifiers is set to 5, but the present invention is not limited thereto and may be any value greater than 3.

[0188] As described above, in this embodiment, in the operation steps determined by the learning model, a secret distribution process using random numbers is added according to the Shamir secret distribution method. Therefore, the operation steps are irregularly changed every time the operation is executed. As a result, the side channel information generated when the operation is executed changes irregularly. Therefore, it is possible to prevent the analysis of the learning model information, that is, the learning parameters.

[0189] Although the embodiments of the present invention have been described above, two or more of these embodiments may be combined and implemented.

[0190] Alternatively, one of these embodiments may be partially implemented.

[0191] Alternatively, two or more of these embodiments may be partially combined and implemented.

[0192] In addition, the present invention is not limited to these embodiments, and various changes can be made as needed.

[0193] Description of symbols

[0194] 1: information processing device; 10: processor; 11: memory; 12: auxiliary storage device; 13: input and output I / F; 14: communication device; 15: random number generator; 100: operation step changing unit; 101: operation execution unit; 110: learning model; 200: storage unit; 210: model architecture; 220: learning parameters.

Claims

1. An information processing device, comprising: an operation step changing unit that irregularly changes the operation step to an operation step different from the operation step before the change, each time when an operation execution timing for executing an operation using a learning parameter whose value is adjusted by machine learning arrives, so as to obtain the same operation result as the operation result obtained by executing the operation in the operation step before the change; and an operation execution unit that executes the operation using the learning parameter according to the operation procedure changed by the operation procedure changing unit every time the operation execution timing arrives, The calculation step changing unit changes the calculation step using the value of the learning parameter and the value calculated with the learning parameter, i.e., the calculated value, so that the value of the learning parameter and the calculated value are concealed, and changes the calculation order in the calculation step using a shuffle algorithm. The calculation procedure changing unit changes the calculation procedure by adding a value of the learning parameter and a value other than the calculated value.

2. The information processing device according to claim 1, wherein: The calculation step changing unit changes the calculation step by additionally using the addition of the other value.

3. The information processing device according to claim 1, wherein: The calculation step changing unit changes the calculation step by adding a multiplication using the other value.

4. The information processing device according to claim 1, wherein: The calculation procedure changing unit changes the value of the learning parameter and the calculated value according to the Shamir secret sharing method.

5. The information processing device according to claim 1, wherein: The operation step changing unit uses Fisher-Yates shuffling or Sattolo algorithm as the shuffling algorithm.

6. The information processing device according to claim 1 or 5, wherein: The calculation step changing unit changes the calculation step using a random number.

7. An information processing device, comprising: an operation step changing unit that irregularly changes the operation step to an operation step different from the operation step before the change, each time when an operation execution timing for executing an operation using a learning parameter whose value is adjusted by machine learning arrives, so as to obtain the same operation result as the operation result obtained by executing the operation in the operation step before the change; and an operation execution unit that executes the operation using the learning parameter through the operation procedure changed by the operation procedure changing unit every time the operation execution timing arrives, The calculation step changing unit changes the value of the learning parameter and the value calculated with the learning parameter, i.e., the calculated value, according to the Shamir secret sharing method. The calculation procedure changing unit changes the calculation procedure by adding a value of the learning parameter and a value other than the calculated value.

8. An information processing method, wherein: Whenever a calculation execution timing for executing a calculation using a learning parameter whose value is adjusted by machine learning comes, the computer irregularly changes a calculation step to a calculation step different from the calculation step before the change so as to obtain the same calculation result as the calculation result obtained by executing the calculation step before the change, Whenever the calculation execution timing arrives, the computer executes the calculation using the learning parameter through the changed calculation steps, When the computer changes to the operation step different from the operation step before the change, the computer changes the operation step using the value of the learning parameter and the value to be operated on the learning parameter, i.e., the value to be operated, so that the value of the learning parameter and the value to be operated are concealed, and changes the order of operations in the operation step using a shuffling algorithm, When the computer changes to the calculation step different from the calculation step before the change, the computer changes the calculation step by adding a value of the learning parameter and a value other than the calculated value.

9. A computer-readable recording medium having an information processing program recorded thereon, the information processing program causing a computer to execute the following processing: an operation step changing process of irregularly changing the operation step to an operation step different from the operation step before the change, each time when an operation execution timing for executing an operation using a learning parameter whose value is adjusted by machine learning comes, so as to obtain the same operation result as the operation result obtained by executing the operation step before the change; and an operation execution process for executing the operation using the learning parameter by the operation step changed in the operation step change process every time the operation execution timing comes, In the calculation step change processing, the calculation step using the value of the learning parameter and the value calculated with the learning parameter, i.e., the calculated value, is changed so that the value of the learning parameter and the calculated value are concealed, and the calculation order in the calculation step is changed using a shuffle algorithm, In the calculation procedure change processing, the calculation procedure is changed by adding the value of the learning parameter and other values ​​other than the calculated value.

10. An information processing method, wherein: Whenever a calculation execution timing for executing a calculation using a learning parameter whose value is adjusted by machine learning comes, the computer irregularly changes a calculation step to a calculation step different from the calculation step before the change so as to obtain the same calculation result as the calculation result obtained by executing the calculation step before the change, Whenever the calculation execution timing arrives, the computer executes the calculation using the learning parameter through the changed calculation steps, When the computer changes to the operation step different from the operation step before the change, the computer changes the value of the learning parameter and the value calculated with the learning parameter, i.e., the calculated value, according to the Shamir secret sharing method, When the computer changes to the calculation step different from the calculation step before the change, the computer changes the calculation step by adding a value of the learning parameter and a value other than the calculated value.

11. A computer-readable recording medium having an information processing program recorded thereon, the information processing program causing a computer to execute the following processing: an operation step changing process of irregularly changing the operation step to an operation step different from the operation step before the change, each time when an operation execution timing for executing an operation using a learning parameter whose value is adjusted by machine learning comes, so as to obtain the same operation result as the operation result obtained by executing the operation step before the change; and an operation execution process for executing the operation using the learning parameter by the operation step changed in the operation step change process every time the operation execution timing comes, In the calculation step change processing, the value of the learning parameter and the value calculated with the learning parameter, i.e., the calculated value, are changed according to the Shamir secret sharing method. In the calculation procedure change processing, the calculation procedure is changed by adding the value of the learning parameter and other values ​​other than the calculated value.

Images