METHOD FOR TRAINING A VEIL NETWORK THAT CONCEIVES THE ORIGINAL DATA TO BE USED FOR MACHINE LEARNING, AND FOR TRAINING A SUBSTITUTE NETWORK THAT USES THE VEIL DATA GENERATED BY THE VEIL NETWORK, AND METHOD FOR TESTING A TRAINED VEIL NETWORK AND LEARNING DEVICE WITH IT

Description

[0001] This application claims the benefit of priority to U.S. Non-Provisional Patent Application No. 16 / 910,021, filed on June 23, 2020.

[0002] The present disclosure relates to a method for training an obfuscation network which conceals original data to be used for machine learning and training a surrogate network which uses obfuscated data generated by the obfuscation network and a learning device using the same, and a method for testing the trained obfuscation network which is trained to conceal the original data to be used for the machine learning and a testing device using the same.

[0003] Big data refers to data including all of unstructured data and semi-structured data not utilized so far, like e-commerce data, metadata, web log data, radio frequency identification (RFID) data, sensor network data, social network data, data of Internet text and documents, Internet search indexing data, as well as all of structured data used by conventional enterprises or public institutions. Data as such is referred to as the big data in the sense that common software tools and computer systems cannot easily handle such a huge volume of data.

[0004] And, although such a big data may have no meaning by itself, it can be useful for generation of new data, judgment, or prediction in various fields through machine learning on patterns and the like.

[0005] Recently, due to the strengthening of a personal information protection act, it is required to delete information, that can be used for identifying individuals, from the data or to acquire consent of the individuals in order to trade or share such a big data. However, it is not easy to check if any information that can be used for identifying the individuals is present in such a large amount of the big data, and it is impossible to obtain the consent of every individual. Therefore, various techniques for such purposes have emerged.

[0006] As an example of a related prior art, a technique is disclosed in Korean Patent Registration No. 1861520. According to this technique, a face-concealing method, e.g., a face-anonymizing method, is provided which includes a detection step of detecting a facial region of a person in an input image to be transformed, a first concealing step of transforming the detected facial region into a distorted first image that does not have a facial shape of the person so that the person in the input image is prevented from being identified, and a second concealing step of generating a second image having a predetermined facial shape based on the first image, transforming the first image into the second image, where the second image is generated to have a facial shape different from that of the facial region detected in the detection step.

[0007] However, according to conventional techniques as well as the technique described above, it is determined whether identification information such as faces, text, etc. is included in the data, and then a portion corresponding to the identification information is masked or blurred. As a result, a machine learning algorithm cannot utilize such data due to distortion of original data. Also, in some cases, the data may contain unexpected identification information which cannot be concealed, e.g., anonymized. In particular, a conventional security camera performs an anonymizing process by blurring every pixel changed between frames due to a target to be anonymized moving between the frames in a video image, and if the anonymizing process is performed in this manner, critical information such as facial expression of an anonymized face becomes different from information contained in an original video image, and also, personal identification information overlooked during face detection may remain on the original video image.

[0008] Accordingly, the applicant of the present disclosure proposes a method for generating obfuscated data by obfuscating the original data such that the obfuscated data is different from the original data, while a result of inputting the original data into a learning model and a result of inputting the obfuscated data into the learning model are same as or similar to each other.

[0009] PRANEETH VEPAKOMMA ET AL: "Split learning for health: Distributed deep learning without sharing raw patient data", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, 3 December 2018 (2018-12-03) discusses whether health entities collaboratively can train deep learning models without sharing sensitive raw data? This paper proposes several configurations of a distributed deep learning method called SplitNN to facilitate such collaborations. SplitNN does not share raw data or model details with collaborating institutions. The proposed configurations of splitNN cater to practical settings of i) entities holding different modalities of patient data, ii) centralized and local health entities collaborating on multiple tasks and iii) learning without sharing labels. The authors compare performance and resource efficiency trade-offs of splitNN and other distributed deep learning methods like federated learning, large batch synchronous stochastic gradient descent and show highly encouraging results for splitNN.

[0010] It is an object of the present disclosure to solve all the aforementioned problems.

[0011] It is another object of the present disclosure to perform concealment, i.e., anonymization, in a simple and accurate way, since processes of searching data for personal identification information are eliminated.

[0012] It is still another object of the present disclosure to protect privacy and security of original data by generating anonymized data through irreversibly obfuscating the original data.

[0013] It is still yet another object of the present disclosure to generate data recognized as similar or same by a computer, but recognized as different by a human.

[0014] It is still yet another object of the present disclosure to stimulate a big data trade market.

[0015] In order to accomplish the objects above, distinctive structures of the present disclosure are described as follows.

[0016] In accordance with one aspect of the present disclosure, there is provided a computer implemented method for training an obfuscation network which conceals original data to be used for machine learning, performed by a 1-st learning device, and for training a surrogate network which uses obfuscated data generated by the obfuscation network, performed by a 2-nd learning device, the method comprising:inputting, by the 1-st learning device the original data of a 1-st party into the obfuscation network,generating, by the 1-st learning device, the obfuscated data by obfuscating the original data by the obfuscation network, wherein the 1-st party corresponds to the 1-st learning device and wherein the 1-st party is a party who is determined as an owner of the original data and its corresponding ground truth or is an entity to whom the original data and its corresponding ground truth are relegated by the owner;receiving, by the 1-st learning device, 1-st losses, wherein the 1-st losses are obtained by: transmitting, by the 1-st learning device, the obfuscated data and the ground truth to a 2-nd learning device corresponding to a 2-nd party wherein the 2-nd party is a party who is determined as having an intention to train the surrogate network by using the original data and the ground truth of the 1-st party, inputting, by the 2-nd learning device, the obfuscated data into the surrogate network, generating, by the 2-nd learning device, characteristic information by applying at least one learning operation of the surrogate network to the obfuscated data, calculating, by the 2-nd learning device, one or more 1-st losses based on the ground truth and at least one of the characteristic information and a task specific output created by using the characteristic information, training, by the 2-nd learning device, the surrogate network such that the 1-st losses are minimized, and transmitting, by the 2-nd learning device, the 1-st losses to the 1-st learning device; and training, by the 1-st learning device, the obfuscation network such that the 1-st losses are minimized and such that one or more 2-nd losses calculated based on the original data and the obfuscated data are maximized,wherein the steps of training the obfuscation network and the surrogate network are performed iteratively.

[0017] As one example, the surrogate network includes a 1-st surrogate network to an n-th surrogate network wherein n is an integer greater than 0, wherein, at the step of (b), the 1-st learning device performs a process of transmitting the obfuscated data and the ground truth to be transmitted to the 2-nd learning device, to thereby allow the 2-nd learning device to (i) input the obfuscated data respectively into the 1-st surrogate network to the n-th surrogate network, and thus instruct the 1-st surrogate network to the n-th surrogate network to respectively generate 1-st characteristic information to n-th characteristic information by applying corresponding learning operation of the 1-st surrogate network to the n-th surrogate network to the obfuscated data, (ii) calculate (ii-1) one or more (1_1)-st losses by referring to the ground truth and at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information to (ii-2) one or more (1_n)-th losses by referring to the ground truth and at least one of the n-th characteristic information and an n-th task specific output created by using the n-th characteristic information, (iii) train the 1-st surrogate network to the n-th surrogate network respectively such that (iii-1) the (1_1)-st losses to the (1_n)-th losses are respectively minimized or (iii-2) at least one average loss, which is averaged over the (1_1)-st losses to the (1_n)-th losses, is minimized, and (iv) transmit to the 1-st learning device (iv-1) at least part of the (1_1)-st losses to the (1_n)-th losses as the 1-st losses or (iv-2) the average loss as the 1-st losses, and wherein, at the step of (c), the 1-st learning device performs or supports another device to perform one of (i) a process of training the obfuscation network such that at least part of the (1_1)-st losses to the (1_n)-th losses are minimized and such that the 2-nd losses are maximized, and (ii) a process of training the obfuscation network such that the average loss is minimized and such that the 2-nd losses are maximized.

[0018] As one example, the surrogate network includes a 1-st surrogate network to an n-th surrogate network wherein n is an integer greater than 0, wherein, at the step of (a), the 1-st learning device performs a process of inputting the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate 1-st obfuscated data, wherein, at the step of (b), the 1-st learning device allows the 1-st obfuscated data and the ground truth to be transmitted to the 2-nd learning device, to thereby allow the 2-nd learning device to (i) input the 1-st obfuscated data into the 1-st surrogate network, and thus instruct the 1-st surrogate network to generate 1-st characteristic information by applying at least one learning operation of the 1-st surrogate network to the 1-st obfuscated data, (ii) calculate one or more (1_1)-st losses by referring to the ground truth and at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information, (iii) train the 1-st surrogate network such that the (1_1)-st losses are minimized, and (iv) transmit the (1_1)-st losses to the 1-st learning device, wherein, at the step of (c), the 1-st learning device performs a process of training the obfuscation network such that the (1_1)-st losses are minimized and such that one or more (2_1)-st losses calculated by referring to the original data and the 1-st obfuscated data are maximized, to thereby allow the obfuscation network to be a 1-st trained obfuscation network, and wherein, while increasing an integer k from 2 to n, the 1-st learning device performs a process of inputting the original data into a (k-1)-th trained obfuscation network, to thereby allow the (k-1)-th trained obfuscation network to generate k-th obfuscated data by obfuscating the original data, (II) a process of allowing the k-th obfuscated data to be transmitted to the 2-nd learning device, to thereby instruct the 2-nd learning device to (i) input the k-th obfuscated data into a k-th surrogate network, and thus allow the k-th surrogate network to generate k-th characteristic information by applying the learning operation of the k-th surrogate network to the k-th obfuscated data, (ii) calculate one or more (1_k)-th losses by referring to the ground truth and at least one of the k-th characteristic information and a k-th task specific output created by using the k-th characteristic information, and (iii) train the k-th surrogate network such that the (1_k)-th losses are minimized, and transmit the (1_k)-th losses to the 1-st learning device, and (III) a process of training the (k-1)-th trained obfuscation network such that the (1_k)-th losses are minimized and such that one or more (2_k)-th losses calculated by referring to the original data and the k-th obfuscated data are maximized, and thus allowing the (k-1)-th trained obfuscation network to be a k-th trained obfuscation network.

[0019] As one example, at the step of (c), on condition that one or more obfuscated data scores have been acquired as the 2-nd losses wherein the obfuscated data scores correspond to the obfuscated data inputted into a discriminator capable of determining whether data inputted thereto is real or fake, the 1-st learning device performs (i) a process of training the obfuscation network such that the 1-st losses are minimized and such that the 2-nd losses are maximized, and (ii) a process of training the discriminator such that one or more modified data scores or one or more modified obfuscated data scores, respectively corresponding to modified data or modified obfuscated data inputted into the discriminator, are maximized and such that the obfuscated data scores are minimized, wherein the modified data or the modified obfuscated data is generated by respectively modifying the original data or the obfuscated data.

[0020] As one example, the surrogate network includes a 1-st surrogate network to an n-th surrogate network wherein n is an integer greater than 0, wherein, at the step of (b), the 1-st learning device performs a process of allowing the obfuscated data and the ground truth to be transmitted to the 2-nd learning device, to thereby allow the 2-nd learning device to (i) input the obfuscated data respectively into the 1-st surrogate network to the n-th surrogate network, and thus instruct the 1-st surrogate network to the n-th surrogate network to respectively generate 1-st characteristic information to n-th characteristic information by applying corresponding learning operation of the 1-st surrogate network to the n-th surrogate network to the obfuscated data, (ii) calculate (ii-1) one or more (1_1)-st losses by referring to the ground truth and at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information to (ii-2) one or more (1_n)-th losses by referring to the ground truth and at least one of the n-th characteristic information and an n-th task specific output created by using the n-th characteristic information, (iii) train the 1-st surrogate network to the n-th surrogate network respectively such that (iii-1) the (1_1)-st losses to the (1_n)-th losses are respectively minimized or (iii-2) at least one average loss, which is averaged over the (1_1)-st losses to the (1_n)-th losses, is minimized, and (iv) transmit to the 1-st learning device (iv-1) at least part of the (1_1)-st losses to the (1_n)-th losses as the 1-st losses or (iv-2) the average loss as the 1-st losses, and wherein, at the step of (c), the 1-st learning device performs (i) one of (i-1) a process of training the obfuscation network such that at least part of the (1_1)-st losses to the (1_n)-th losses are minimized and such that the 2-nd losses, which are the obfuscated data scores corresponding to the obfuscated data inputted into the discriminator, are maximized, and (i-2) a process of training the obfuscation network such that the average loss is minimized and such that the 2-nd losses are maximized, and (ii) a process of training the discriminator such that the modified data scores or the modified obfuscated data scores, respectively corresponding to the modified data or the modified obfuscated data inputted into the discriminator, are maximized, and such that the obfuscated data scores are minimized.

[0021] As one example, the surrogate network includes a 1-st surrogate network to an n-th surrogate network wherein n is an integer greater than 0, wherein, at the step of (a), the 1-st learning device performs a process of inputting the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate 1-st obfuscated data, wherein, at the step of (b), the 1-st learning device allows the 1-st obfuscated data and the ground truth to be transmitted to the 2-nd learning device, to thereby allow the 2-nd learning device to (i) input the 1-st obfuscated data into the 1-st surrogate network, and thus instruct the 1-st surrogate network to generate 1-st characteristic information by applying at least one learning operation of the 1-st surrogate network to the 1-st obfuscated data, (ii) calculate one or more (1_1)-st losses by referring to the ground truth and at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information, (iii) train the 1-st surrogate network such that the (1_1)-st losses are minimized, and (iv) transmit the (1_1)-st losses to the 1-st learning device, wherein, at the step of (c), the 1-st learning device performs (i) a process of training the obfuscation network such that the (1_1)-st losses are minimized and such that one or more (2_1)-st losses, which are one or more 1-st obfuscated data scores corresponding to the 1-st obfuscated data inputted into the discriminator, are maximized, to thereby allow the obfuscation network to be a 1-st trained obfuscation network, and (ii) a process of training the discriminator such that one or more 1-st modified data scores or one or more 1-st modified obfuscated data scores, respectively corresponding to the modified data or 1-st modified obfuscated data created by modifying the 1-st obfuscated data, inputted into the discriminator are maximized and such that the 1-st obfuscated data scores are minimized, to thereby allow the discriminator to be a 1-st trained discriminator, and wherein, while increasing an integer k from 2 to n, the 1-st learning device performs (I) a process of inputting the original data into a (k-1)-th trained obfuscation network, to thereby allow the (k-1)-th trained obfuscation network to generate k-th obfuscated data by obfuscating the original data, (II) a process of allowing the k-th obfuscated data to be transmitted to the 2-nd learning device, to thereby allow the 2-nd learning device to (i) input the k-th obfuscated data into a k-th surrogate network, and thus instruct the k-th surrogate network to generate k-th characteristic information by applying the learning operation of the k-th surrogate network to the k-th obfuscated data, (ii) calculate one or more (1_k)-th losses by referring to the ground truth and at least one of the k-th characteristic information and a k-th task specific output created via using the k-th characteristic information, and (iii) train the k-th surrogate network such that the (1_k)-th losses are minimized, and transmit the (1_k)-th losses to the 1-st learning device, and (III) (III-1) a process of training the (k-1)-th trained obfuscation network such that the (1_k)-th losses are minimized and such that one or more (2_k)-th losses, which are one or more k-th obfuscated data scores corresponding to the k-th obfuscated data inputted into a (k-1)-th trained discriminator, data are maximized, and thus allowing the (k-1)-th trained obfuscation network to be a k-th trained obfuscation network, (III-2) a process of training the (k-1)-th trained discriminator such that one or more k-th modified data scores or one or more k-th modified obfuscated data scores, respectively corresponding to the modified data or k-th modified obfuscated data created by modifying the k-th obfuscated data inputted into the (k-1)-th trained discriminator and such that the k-th obfuscated data scores are minimized, to thereby allow the (k-1)-th trained discriminator to be a k-th trained discriminator.

[0022] As one example, a maximum of the modified data scores or the modified obfuscated data scores, respectively corresponding to the modified data or the modified obfuscated data inputted into the discriminator, is 1 as a value for determining the modified data or the modified obfuscated data as real, and a minimum of the obfuscated data scores, corresponding to the obfuscated data inputted into the discriminator, is 0 as a value for determining the obfuscated data as fake.

[0023] As one example, at the step of (c), the 1-st learning device (i) measures at least one quality by referring to at least part of an entropy and a degree of noise of the obfuscated data, and (ii) trains the obfuscation network such that the 1-st losses are minimized by further referring to the measured quality.

[0024] In accordance with another aspect of the present disclosure, there is provided a computer implemented method for testing an obfuscation network, trained according any of the methods described above, the method for testing comprising steps of: acquiring, by a testing device, original data for testing to be concealed; and inputting, by the testing device, the original data for testing into the obfuscation network, to thereby allow the obfuscation network to generate obfuscated data for testing by obfuscating the original data for testing.

[0025] In accordance with still another aspect of the present disclosure, there is provided a 1-st learning device for training an obfuscation network which conceals original data to be used for machine learning, and for allowing a 2-nd learning device to train a surrogate network which uses obfuscated data generated by the obfuscation network, the 1-st and 2-nd learning devices for training each comprising: a memory that stores instructions to perform corresponding steps of any of the training methods described above; and a processor configured to execute the instructions.

[0026] The above and other objects and features of the present disclosure will become apparent from the following description of preferred embodiments given in conjunction with the accompanying drawings, in which: Fig. 1 is a drawing schematically illustrating a 1-st learning device for training an obfuscation network which conceals, i.e., anonymizes, original data and for allowing a 2-nd learning device to train a surrogate network which uses obfuscated data generated by the obfuscation network in accordance with one example embodiment of the present disclosure. Fig. 2 is a drawing schematically illustrating a learning method for training the obfuscation network and for allowing the surrogate network to be trained in accordance with one example embodiment of the present disclosure. Fig. 3 is a drawing schematically illustrating another learning method for training the obfuscation network and for allowing surrogate networks which use the obfuscated data to be trained in accordance with one example embodiment of the present disclosure. Fig. 4 is a drawing schematically illustrating a learning method for training the obfuscation network and for allowing the surrogate network to be trained in accordance with another example embodiment of the present disclosure. Fig. 5 is a drawing schematically illustrating another learning method for training the obfuscation network and for allowing the surrogate networks to be trained in accordance with another example embodiment of the present disclosure. Fig. 6 is a drawing schematically illustrating a testing device for testing the obfuscation network trained in accordance with one example embodiment of the present disclosure. Fig. 7 is a drawing schematically illustrating a testing method for testing the obfuscation network trained in accordance with one example embodiment of the present disclosure.

[0027] In the following detailed description, reference is made to the accompanying drawings that show, by way of illustration, specific embodiments in which the present disclosure may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present disclosure. It is to be understood that the various embodiments of the present disclosure, although different, are not necessarily mutually exclusive. For example, a particular feature, structure, or characteristic described herein may be implemented as being changed from an embodiment to other embodiments without departing from the scope of the present disclosure. In addition, it is to be understood that the position or arrangement of individual elements within each embodiment may be modified without departing from the scope of the present disclosure. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present disclosure is described as including the appended claims, along with the full range of equivalents to which the claims are entitled. In the drawings, like numerals refer to the same or similar components throughout the several aspects.

[0028] For reference, throughout the present disclosure, the phrase "for training" or "training" is added for terms related to training processes, and the phrase "for testing" or "testing" is added for terms related to testing processes, to avoid possible confusion.

[0029] The headings and abstract of the present disclosure provided herein are for convenience only and do not limit or interpret the scope or meaning of the embodiments.

[0030] To allow those skilled in the art to carry out the present disclosure easily, the example embodiments of the present disclosure will be explained in detail as shown below by referring to attached drawings.

[0031] Fig. 1 is a drawing schematically illustrating a 1-st learning device for (i) training an obfuscation network which conceals, i.e., anonymizes, original data and (ii) allowing a 2-nd learning device to train a surrogate network which uses obfuscated data generated by the obfuscation network in accordance with one example embodiment of the present disclosure.

[0032] By referring to Fig. 1, the 1-st learning device 100 in accordance with one example embodiment of the present disclosure may include a memory 110 for storing instructions to train the obfuscation network for obfuscating the original data such that the surrogate network outputs a 1-st result calculated by using the obfuscated data as an input, same or similar to a 2-nd result calculated by using the original data as an input, and further storing instructions to interact with the 2-nd learning device which trains the surrogate network by using the obfuscated data generated from the obfuscation network, and a processor 120 for performing processes to train the obfuscation network and interact with the 2-nd learning device according to the instructions in the memory 110.

[0033] Specifically, the 1-st learning device 100 may typically achieve a desired system performance by using combinations of at least one computing device and at least one computer software, e.g., a computer processor, a memory, a storage, an input device, an output device, or any other conventional computing components, an electronic communication device such as a router or a switch, an electronic information storage system such as a network-attached storage (NAS) device and a storage area network (SAN) as the computing device and any instructions that allow the computing device to function in a specific way as the computer software.

[0034] Also, the processors of such devices may include hardware configuration of MPU (Micro Processing Unit) or CPU (Central Processing Unit), cache memory, data bus, etc. Additionally, the computing device may further include OS and software configuration of applications that achieve specific purposes.

[0035] Such description of the computing device does not exclude an integrated device including any combination of a processor, a memory, a medium, or any other computing components for implementing the present disclosure.

[0036] Meanwhile, if the original data and its corresponding ground truth are acquired from a 1-st party, the processor 120 inputs the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate the obfuscated data, according to the instructions stored in the memory 110. And the processor 120 performs a process of allowing the obfuscated data to be transmitted to the 2-nd learning device corresponding to a 2-nd party, to thereby instruct the 2-nd learning device to (i) input the obfuscated data into the surrogate network, and thus instruct the surrogate network to generate characteristic information by applying at least one learning operation of the surrogate network to the obfuscated data, (ii) calculate one or more 1-st losses by referring to (ii-1) the ground truth and (ii-2) at least one of the characteristic information and a task specific output created by using the characteristic information, (iii) train the surrogate network such that the 1-st losses are minimized, and (iv) transmit the 1-st losses to the 1-st learning device 100. Thereafter, when the 1-st losses are acquired from the 2-nd learning device, the processor 120 performs a process of training the obfuscation network such that the 1-st losses are minimized and such that one or more 2-nd losses, calculated by referring to the original data and the obfuscated data, are maximized. Herein, the 1-st party corresponds to the 1-st learning device 100 and the 1-st party is a party who is determined as an owner of the original data and its corresponding ground truth or is an entity to whom the original data and its corresponding ground truth are relegated by the owner, and the 2-nd party is a party who is determined as having an intention to train the surrogate network by using the original data and the ground truth of the 1-st party.

[0037] Also, on condition that one or more obfuscated data scores have been acquired as the 2-nd losses where the obfuscated data scores correspond to the obfuscated data inputted into a discriminator capable of determining whether data inputted thereto is real or fake, the processor 120 may perform or support another device to perform (i) a process of training the obfuscation network such that the 1-st losses are minimized and such that the 2-nd losses are maximized, and (ii) a process of training the discriminator such that one or more modified data scores or one or more modified obfuscated data scores, respectively corresponding to modified data or modified obfuscated data inputted into the discriminator, are maximized and such that the obfuscated data scores are minimized. Herein, the modified data or the modified obfuscated data may be generated by respectively modifying the original data or the obfuscated data.

[0038] And, the 2-nd learning device may include a memory (not illustrated) for storing instructions to train the surrogate network by using the obfuscated data from the 1-st learning device 100 and storing instructions to interact with the 1-st learning device 100, and a processor (not illustrated) for performing processes to train the surrogate network and interact with the 1-st learning device 100 according to the instructions in the memory.

[0039] Specifically, the 2-nd learning device may typically achieve a desired system performance by using combinations of at least one computing device and at least one computer software, e.g., a computer processor, a memory, a storage, an input device, an output device, or any other conventional computing components, an electronic communication device such as a router or a switch, an electronic information storage system such as a network-attached storage (NAS) device and a storage area network (SAN) as the computing device and any instructions that allow the computing device to function in a specific way as the computer software.

[0040] Also, the processors of such devices may include hardware configuration of MPU (Micro Processing Unit) or CPU (Central Processing Unit), cache memory, data bus, etc. Additionally, the computing device may further include OS and software configuration of applications that achieve specific purposes.

[0041] Such description of the computing device does not exclude an integrated device including any combination of a processor, a memory, a medium, or any other computing components for implementing the present disclosure.

[0042] A method of the 1-st learning device 100 for training the obfuscation network which conceals, i.e., anonymizes, the original data to be used for machine learning, and for allowing the 2-nd learning device to train the surrogate network which uses the obfuscated data generated from the obfuscation network, in accordance with one example embodiment of the present disclosure is described by referring to Figs. 2 to 5 as follows.

[0043] Fig. 2 is a drawing schematically illustrating a learning method for training the obfuscation network which conceals, i.e., anonymizes, the original data and for allowing the surrogate network to be trained by using the obfuscated data in accordance with one example embodiment of the present disclosure.

[0044] First, if the original data and its corresponding ground truth of the 1-st party are acquired, the 1-st learning device 100 may input the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate the obfuscated data.

[0045] Herein, the 1-st party is a party who is determined as an owner of the original data and its corresponding ground truth or is an entity to whom the original data and its corresponding ground truth are relegated by the owner.

[0046] As another example, the 1-st learning device 100 may input modified data, created by modifying the original data, into the obfuscation network, to thereby allow the obfuscation network to generate the obfuscated data, as the case may be. For example, the modified data may be generated by adding random noise created through a random noise generating network (not illustrated) to the original data. As one example, the random noise generating network may be instructed to generate the random noise having a normal distribution N(0, σ), and the generated noise may be added to the original data, to thereby generate the modified data. Also, the modified data may be generated by blurring the original data, or changing a resolution of the original data, as well as using the random noise, but the scope of the present disclosure is not limited thereto, and various ways of modifying the original data may be used.

[0047] And, the obfuscated data may be recognized as different from the original data by humans, but may be recognized as similar to or same as the original data by the surrogate network.

[0048] Meanwhile, as one example, the obfuscation network may include at least one encoder having one or more convolutional layers for applying one or more convolution operations to the inputted original data X, and at least one decoder having one or more deconvolutional layers for applying one or more deconvolution operations to at least one feature map outputted from the encoder and thus for generating the obfuscated data, but the scope of the present disclosure is not limited thereto, and may include any learning networks having various structures capable of obfuscating the inputted original data.

[0049] Next, the 1-st learning device 100 allows the obfuscated data and the ground truth, corresponding to the original data, to be transmitted to the 2-nd learning device 200 corresponding to the 2-nd party.

[0050] Herein, the 2-nd party is a party who is determined as having an intention to train the surrogate network by using the original data and the ground truth of the 1-st party.

[0051] Then, when the obfuscated data and the ground truth are acquired from the 1-st learning device 100, the 2-nd learning device inputs the obfuscated data into the surrogate network, to thereby allow the surrogate network to apply the learning operation to the obfuscated data and thus to generate the characteristic information corresponding to the obfuscated data.

[0052] Herein, the surrogate network may include a machine learning network, but the scope of the present disclosure is not limited thereto, and may include any learning networks capable of generating the characteristic information by applying its learning operation to the inputted obfuscated data. And, the machine learning network may include at least one of a k-Nearest Neighbors, a Linear Regression, a Logistic Regression, a Support Vector Machine (SVM), a Decision Tree and Random Forest, a Neural Network, a Clustering, a Visualization and a Dimensionality Reduction, an Association Rule Learning, a Deep Belief Network, a Reinforcement Learning, and a Deep learning algorithm, but the machine learning network is not limited thereto and may include various learning algorithms. Also, a subject to be concealed, e.g., a subject to be anonymized, may be personal information included in the original data. Herein, the personal information may include any information related to a person, such as personal identification information, personal medical information, personal biometric information, personal behavioral information, etc.

[0053] And, the characteristic information may be features corresponding to the original data. Also, the characteristic information may be feature values related to certain features in the original data, or the logits including values related to at least one of vectors, matrices, and coordinates related to the certain features. For example, if the original data are facial image data, the result above may be classes, facial features, e.g., laughing expressions, coordinates of facial landmark points, e.g., both end points on far sides of an eye, to be used for face recognition.

[0054] Thereafter, the 2-nd learning device 200 calculates the 1-st losses by referring to (i) the ground truth and (ii) at least one of (ii-1) the characteristic information and (ii-2) a task specific output created by using the characteristic information.

[0055] Herein, the ground truth may be one of (i) referential characteristic information in the original data and (ii) a referential task specific output corresponding to the referential characteristic information. Also, the 1-st losses may be calculated by referring to (i) the characteristic information and the referential characteristic information or (ii) the task specific output and the referential task specific output.

[0056] Also, the 2-nd learning device 200 may calculate the 1-st losses by referring to at least part of (i) difference between the characteristic information and its corresponding ground truth and (ii) at least one difference between the task specific output and its corresponding ground truth. As one example, the 2-nd learning device 200 may calculate the 1-st losses by referring to a norm or a cosine similarity between the characteristic information and its corresponding ground truth, i.e., the referential characteristic information, but the scope of the present disclosure is not limited thereto, and any various algorithms capable of calculating difference between the characteristic information and the referential characteristic information F(X) may be used.

[0057] Meanwhile, the task specific output may be an output of a task to be performed by the surrogate network, and may have various results according to the task by the surrogate network, such as a probability of a class for classification, coordinates resulting from regression for location detection, etc., and an activation function of an activation unit may be applied to the characteristic information outputted from the surrogate network, to thereby generate the task specific output according to the task to be performed by the surrogate network. Herein, the activation functions may include a sigmoid function, a linear function, a softmax function, an rlinear function, a square function, a sqrt function, an srlinear function, an abs function, a tanh function, a brlinear function, etc. but the scope of the present disclosure is not limited thereto.

[0058] As one example, when the surrogate network performs the task for the classification, the 2-nd learning device 200 may map the characteristic information outputted from the surrogate network onto each of classes, to thereby generate one or more probabilities of the obfuscated data, for each of the classes. Herein, the probabilities for each of the classes may represent probabilities of the characteristic information, outputted for each of the classes from the surrogate network, being correct. For example, if the inputted data are the facial image data, a probability of the face having a laughing expression may be outputted as 0.75, and a probability of the face not having the laughing expression may be outputted as 0.25, and the like. Herein, a softmax algorithm may be used for mapping the characteristic information outputted from the surrogate network onto each of the classes, but the scope of the present disclosure is not limited thereto, and various algorithms may be used for mapping the characteristic information onto each of the classes.

[0059] Next, the 2-nd learning device 200 trains the surrogate network such that the 1-st losses are minimized, and transmits the 1-st losses to the 1-st learning device 100.

[0060] Herein, the surrogate network is trained by using the 1-st losses. That is, one or more parameters of the surrogate network may be updated via backpropagation using gradient descent, such that the surrogate network recognizes the obfuscated data as the original data.

[0061] Meanwhile, a process of training the surrogate network using the 1-st losses and a process of transmitting the 1-st losses to the 1-st learning device 100 may occur in a different order and may occur independently of each other.

[0062] Next, when the 1-st losses are acquired from the 2-nd learning device 200, the 1-st learning device 100 performs a process of training the obfuscation network such that the 1-st losses are minimized and such that one or more 2-nd losses, calculated by referring to the original data and the obfuscated data, are maximized.

[0063] That is, the 1-st learning device 100 may train the obfuscation network, such that the obfuscation network generates the obfuscated data which is (i) different from the original data and (ii) recognized as the original data by the surrogate network.

[0064] Also, the 1-st learning device 100 may measure at least one quality by referring to at least part of an entropy and a degree - of noise of the obfuscated data, and may train the obfuscation network by using the 1-st losses to which the measured quality is added. That is, the 1-st learning device 100 may train the obfuscation network, such that the quality of the obfuscated data is minimized, for example, such that at least part of the entropy, the noise, etc. of the obfuscated data is maximized.

[0065] Supposing that processes of respectively training the obfuscation network and the surrogate network by using a same piece of the original data is a single iteration, then by repeating the iteration over a set of the original data, the obfuscation network which conceals, i.e., anonymizes, the original data to be used for machine learning and the surrogate network which uses the obfuscated data generated by the obfuscation network may be trained.

[0066] Fig. 3 is a drawing schematically illustrating another learning method for training the obfuscation network which conceals, i.e., anonymizes, the original data and allowing multiple surrogate networks to be trained by using the obfuscated data generated by the obfuscation network in accordance with one example embodiment of the present disclosure. Herein, the surrogate network as shown in Fig. 2 is configured as the multiple surrogate networks. Herein, each of the multiple surrogate networks may perform each of tasks different from one another. In the description below, the part easily deducible from the explanation of Fig. 2 will be omitted.

[0067] First, if the original data and its corresponding ground truth of the 1-st party are acquired, the 1-st learning device 100 may input the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate the obfuscated data.

[0068] As another example, the 1-st learning device 100 may input the modified data, created by modifying the original data, into the obfuscation network, to thereby allow the obfuscation network to generate the obfuscated data, as the case may be.

[0069] Next, the 1-st learning device 100 allows the obfuscated data and the ground truth, corresponding to the original data, to be transmitted to the 2-nd learning device 200 corresponding to the 2-nd party.

[0070] Then, when the obfuscated data and the ground truth are acquired from the 1-st learning device 100, the 2-nd learning device may input the obfuscated data respectively into a 1-st surrogate network to an N-th surrogate network, to thereby allow the 1-st surrogate network to the n-th surrogate network to respectively generate 1-st characteristic information to n-th characteristic information by applying corresponding learning operation of the 1-st surrogate network to the n-th surrogate network to the obfuscated data.

[0071] Thereafter, the 2-nd learning device 200 may calculate (i) one or more (1_1)-st losses by referring to (i-1) the ground truth and (i-2) at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information to (ii) one or more (1_n)-th losses by referring to (ii-1) the ground truth and (ii-2) at least one of the n-th characteristic information and an n-th task specific output created by using the n-th characteristic information.

[0072] Next, the 2-nd learning device 200 may train the 1-st surrogate network to the n-th surrogate network respectively such that (i) the (1_1)-st losses to the (1_n)-th losses are respectively minimized or (ii) at least one average loss, which is averaged over the (1_1)-st losses to the (1_n)-th losses, is minimized.

[0073] And, the 2-nd learning device 200 may transmit to the 1-st learning device 100 (i) at least part of the (1_1)-st losses to the (1_n)-th losses as the 1-st losses or (ii) the average loss as the 1-st losses.

[0074] Meanwhile, a process of training the 1-st surrogate network to the n-th surrogate network by the 2-nd learning device 200 and a process of transmitting the 1-st losses from the 2-nd learning device 200 to the 1-st learning device 100 may occur in a different order and may occur independently of each other.

[0075] Next, if the 1-st losses are acquired from the 2-nd learning device 200, the 1-st learning device 100 may perform or support another device to perform a process of training the obfuscation network such that the 1-st losses are minimized and such that one or more 2-nd losses, calculated by referring to the original data and the obfuscated data, are maximized.

[0076] That is, the 1-st learning device 100 may perform one of (i) a process of training the obfuscation network such that at least part of the (1_1)-st losses to the (1_n)-th losses acquired from the 2-nd learning device 200 are minimized and such that the 2-nd losses are maximized, and (ii) a process of training the obfuscation network such that the average loss acquired from the 2-nd learning device 200 is minimized and such that the 2-nd losses are maximized.

[0077] Also, the 1-st learning device 100 may measure at least one quality by referring to at least part of an entropy and a degree of noise of the obfuscated data, and may train the obfuscation network by using the 1-st losses to which the measured quality is added. That is, the 1-st learning device 100 may train the obfuscation network, such that the quality of the obfuscated data is minimized, for example, such that at least part of the entropy, the noise, etc. of the obfuscated data is maximized.

[0078] Meanwhile, in the above, the 2-nd learning device 200 is described as transmitting to the 1-st learning device 100 (i) at least part of the (1_1)-st losses to the (1_n)-th losses as the 1-st losses or (ii) the average loss as the 1-st losses, and the 1-st learning device 100 is described as training the obfuscation network by using the 1-st losses and the 2-nd losses, however, as another example, the 2-nd learning device 200 may sequentially transmit each of the (1_1)-st losses to the (1_n)-th losses to the 1-st learning device 100 as the 1-st losses, to thereby allow the 1-st learning device 100 to train the obfuscation network sequentially using each of the (1_1)-st losses to the (1_n)-th losses.

[0079] That is, the 1-st learning device 100 may input the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate 1-st obfuscated data.

[0080] And, the 1-st learning device 100 may allow the 1-st obfuscated data and the ground truth to be transmitted to the 2-nd learning device 200.

[0081] Then, the 2-nd learning device 200 may input the 1-st obfuscated data into the 1-st surrogate network, to thereby allow the 1-st surrogate network to generate the 1-st characteristic information by applying the learning operation to the 1-st obfuscated data, and may calculate the (1_1)-st losses by referring to (i) the ground truth and (ii) at least one of (ii-1) the 1-st characteristic information and (ii-2) a 1-st task specific output created by using the 1-st characteristic information.

[0082] And, the 2-nd learning device 200 may train the 1-st surrogate network such that the (1_1)-st losses are minimized, and may transmit the (1_1)-st losses to the 1-st learning device 100.

[0083] Then, the 1-st learning device 100 may perform or support another device to perform a process of training the obfuscation network such that the (1_1)-st losses are minimized and such that one or more (2_1)-st losses, calculated by referring to the original data and the 1-st obfuscated data, are maximized, to thereby allow the obfuscation network to be a 1-st trained obfuscation network.

[0084] Thereafter, while increasing an integer k from 2 to n, the 1-st learning device 100 may repeat the processes above, to thereby acquire an n-th trained obfuscation network, by training a previous trained obfuscation network using the (1_n)-th losses calculated from the n-th surrogate network.

[0085] That is, the 1-st learning device 100 may input the original data into a (k-1)-th trained obfuscation network, to thereby allow the (k-1)-th trained obfuscation network to obfuscate the original data and thus to generate k-th obfuscated data, and may transmit the k-th obfuscated data to the 2-nd learning device 200.

[0086] Then, the 2-nd learning device 200 may input the k-th obfuscated data into a k-th surrogate network, to thereby allow the k-th surrogate network to generate k-th characteristic information by applying the learning operation to the k-th obfuscated data, and may calculate one or more (1_k)-th losses by referring to (i) the ground truth and (ii) at least one of (ii-1) the k-th characteristic information and (ii-2) a k-th task specific output created by using the k-th characteristic information.

[0087] And, the 2-nd learning device 200 may train the k-th surrogate network such that the (1_k)-th losses are minimized, and may transmit the (1_k)-th losses to the 1-st learning device 100.

[0088] Then, the 1-st learning device 100 may perform a process of training the (k-1)-th trained obfuscation network such that the (1_k)-th losses are minimized and such that one or more (2_k)-th losses, calculated by referring to the original data and the k-th obfuscated data, are maximized, to thereby allow the (k-1)-th trained obfuscation network to be a k-th trained obfuscation network. As a result of repeating the processes as such, the n-th trained obfuscation network may be generated.

[0089] Fig. 4 is a drawing schematically illustrating a learning method for training the obfuscation network which conceals, i.e., anonymizes, the original data and allowing the surrogate network to be trained by using the obfuscated data generated by the obfuscation network in accordance with another example embodiment of the present disclosure. In the description below, the part easily deducible from the explanation of Figs. 2 and 3 will be omitted.

[0090] First, if the original data and its corresponding ground truth of the 1-st party are acquired, the 1-st learning device 100 may input the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate the obfuscated data.

[0091] As another example, the 1-st learning device 100 may input the modified data, created by modifying the original data, into the obfuscation network, to thereby allow the obfuscation network to generate the obfuscated data, as the case may be.

[0092] Next, the 1-st learning device 100 allows the obfuscated data and the ground truth, corresponding to the original data, to be transmitted to the 2-nd learning device 200 corresponding to the 2-nd party.

[0093] Then, when the obfuscated data and the ground truth are acquired from the 1-st learning device 100, the 2-nd learning device inputs the obfuscated data into the surrogate network, to thereby allow the surrogate network to apply the learning operation to the obfuscated data and thus to generate the characteristic information corresponding to the obfuscated data.

[0094] Thereafter, the 2-nd learning device 200 calculates the 1-st losses by referring to (i) the ground truth and (ii) at least one of (ii-1) the characteristic information and (ii-2) a task specific output created by using the characteristic information.

[0095] And, the 2-nd learning device 200 trains the surrogate network such that the 1-st losses are minimized, and transmits the 1-st losses to the 1-st learning device 100.

[0096] Next, on condition that one or more obfuscated data scores have been acquired as the 2-nd losses where the obfuscated data scores correspond to the obfuscated data inputted into the discriminator capable of determining whether data inputted thereto is real or fake, the 1-st learning device 100 may perform (i) a process of training the obfuscation network such that the 1-st losses are minimized and such that the 2-nd losses, which are the obfuscated data scores, are maximized, and (ii) a process of training the discriminator such that one or more modified data scores or one or more modified obfuscated data scores, respectively corresponding to modified data or modified obfuscated data inputted into the discriminator, are maximized and such that the obfuscated data scores are minimized. Herein, the modified data or the modified obfuscated data may be respectively generated by adding the random noise created through the random noise generating network (not illustrated) to the original data or the obfuscated data. As one example, the random noise generating network may be instructed to generate the random noise having the normal distribution N(0, σ), and the generated noise may be added to the original data or the obfuscated data, to thereby generate the modified data or the modified obfuscated data. Also, the modified data or the modified obfuscated data may be respectively generated by blurring the original data or the obfuscated data, or changing a resolution of the original data or the obfuscated data, as well as using the random noise, but the scope of the present disclosure is not limited thereto, and various ways of modifying the original data or the obfuscated data may be used.

[0097] Herein, a maximum of the modified data scores or the modified obfuscated data scores, respectively corresponding to the modified data or the modified obfuscated data inputted into the discriminator, may be 1 as a value for determining the modified data or the modified obfuscated data as real, and a minimum of the obfuscated data scores, corresponding to the obfuscated data inputted into the discriminator, may be 0 as a value for determining the obfuscated data as fake. That is, the discriminator may be trained to recognize the obfuscated data as the modified data or as the modified obfuscated data.

[0098] Fig. 5 is a drawing schematically illustrating a learning method for training the obfuscation network which conceals, i.e., anonymizes, the original data in accordance with another example embodiment of the present disclosure. Also, the surrogate network as shown in Fig. 4 is configured as the multiple surrogate networks. In the description below, the part easily deducible from the explanation of Figs. 2 to 4 will be omitted.

[0099] First, if the original data and its corresponding ground truth of the 1-st party are acquired, the 1-st learning device 100 may input the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate the obfuscated data.

[0100] As another example, the 1-st learning device 100 may input the modified data, created by modifying the original data, into the obfuscation network, to thereby allow the obfuscation network to generate the obfuscated data, as the case may be.

[0101] Next, the 1-st learning device 100 may allow the obfuscated data and the ground truth, corresponding to the original data, to be transmitted to the 2-nd learning device 200 corresponding to the 2-nd party.

[0102] Then, when the obfuscated data and the ground truth are acquired from the 1-st learning device 100, the 2-nd learning device may input the obfuscated data respectively into a 1-st surrogate network to an n-th surrogate network, to thereby allow the 1-st surrogate network to the n-th surrogate network to respectively generate 1-st characteristic information to n-th characteristic information by applying corresponding learning operation of the 1-st surrogate network to the n-th surrogate network to the obfuscated data.

[0103] Thereafter, the 2-nd learning device 200 may calculate (i) one or more (1_1)-st losses by referring to (i-1) the ground truth and (i-2) at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information to (ii) one or more (1_n)-th losses by referring to (ii-1) the ground truth and (ii-2) at least one of the n-th characteristic information and an n-th task specific output created by using the n-th characteristic information.

[0104] Next, the 2-nd learning device 200 may train the 1-st surrogate network to the n-th surrogate network respectively such that (i) the (1_1)-st losses to the (1_n)-th losses are respectively minimized or (ii) at least one average loss, which is averaged over the (1_1)-st losses to the (1_n)-th losses, is minimized.

[0105] And, the 2-nd learning device 200 may transmit to the 1-st learning device 100 (i) at least part of the (1_1)-st losses to the (1_n)-th losses as the 1-st losses or (ii) the average loss as the 1-st losses.

[0106] Meanwhile, a process of training the 1-st surrogate network to the n-th surrogate network by the 2-nd learning device 200 and a process of transmitting the 1-st losses from the 2-nd learning device 200 to the 1-st learning device 100 may occur in a different order and may occur independently of each other.

[0107] Next, if the 1-st losses are acquired from the 2-nd learning device 200, the 1-st learning device 100 may perform (i) a process of training the obfuscation network such that the 1-st losses are minimized and such that the 2-nd losses, which are the obfuscated data scores corresponding to the obfuscated data inputted into the discriminator, are maximized, and (ii) a process of training the discriminator such that one or more modified data scores or one or more modified obfuscated data scores, respectively corresponding to modified data or modified obfuscated data inputted into the discriminator, are maximized and such that the obfuscated data scores are minimized.

[0108] That is, the 1-st learning device 100 may perform (i) one of (i-1) a process of training the obfuscation network such that at least part of the (1_1)-st losses to the (1_N)-th losses are minimized and such that the 2-nd losses, which are the obfuscated data scores corresponding to the obfuscated data inputted into the discriminator, are maximized, and (i-2) a process of training the obfuscation network such that the average loss is minimized and such that the 2-nd losses are maximized, and (ii) a process of training the discriminator such that the modified data scores or the modified obfuscated data scores, respectively corresponding to the modified data or the modified obfuscated data inputted into the discriminator, are maximized, and such that the obfuscated data scores are minimized.

[0109] Meanwhile, in the above, the 2-nd learning device 200 is described as transmitting to the 1-st learning device 100 (i) at least part of the (1_1)-st losses to the (1_n)-th losses as the 1-st losses or (ii) the average loss as the 1-st losses, and the 1-st learning device 100 is described as training the obfuscation network by using the 1-st losses and the 2-nd losses, however, as another example, the 2-nd learning device 200 may sequentially transmit each of the (1_1)-st losses to the (1_n)-th losses to the 1-st learning device 100 as the 1-st losses, to thereby allow the 1-st learning device 100 to train the obfuscation network sequentially using each of the (1_1)-st losses to the (1_n)-th losses.

[0110] That is, the 1-st learning device 100 may input the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate 1-st obfuscated data.

[0111] And, the 1-st learning device 100 may allow the 1-st obfuscated data and the ground truth to be transmitted to the 2-nd learning device 200.

[0112] Then, the 2-nd learning device 200 may input the 1-st obfuscated data into the 1-st surrogate network, to thereby allow the 1-st surrogate network to generate the 1-st characteristic information by applying the learning operation to the 1-st obfuscated data, and may calculate the (1_1)-st losses by referring to (i) the ground truth and (ii) at least one of (ii-1) the 1-st characteristic information and (ii-2) a 1-st task specific output created by using the 1-st characteristic information.

[0113] And, the 2-nd learning device 200 may train the 1-st surrogate network such that the (1_1)-st losses are minimized, and may transmit the (1_1)-st losses to the 1-st learning device 100.

[0114] Then, the 1-st learning device 100 may perform (i) a process of training the obfuscation network such that the (1_1)-st losses are minimized and such that one or more (2_1)-st losses, which are one or more 1-st obfuscated data scores corresponding to the 1-st obfuscated data inputted into the discriminator, are maximized, to thereby allow the obfuscation network to be a 1-st trained obfuscation network, and (ii) a process of training the discriminator such that one or more 1-st modified data scores or one or more 1-st modified obfuscated data score, respectively corresponding to the modified data or 1-st modified obfuscated data created by modifying the 1-st obfuscated data, inputted into the discriminator are maximized and such that the 1-st obfuscated data scores are minimized, to thereby allow the discriminator to be a 1-st trained discriminator.

[0115] Thereafter, while increasing an integer k from 2 to n, the 1-st learning device 100 may repeat the processes above, to thereby acquire an n-th trained obfuscation network, by training a previous trained obfuscation network using the (1_n)-th losses calculated from the n-th surrogate network.

[0116] That is, the 1-st learning device 100 may input the original data into a (k-1)-th trained obfuscation network, to thereby allow the (k-1)-th trained obfuscation network to obfuscate the original data and thus to generate k-th obfuscated data, and may transmit the k-th obfuscated data to the 2-nd learning device 200.

[0117] Then, the 2-nd learning device 200 may input the k-th obfuscated data into the k-th surrogate network, to thereby allow the k-th surrogate network to generate the k-th characteristic information by applying the learning operation to the k-th obfuscated data, and may calculate the (1_k)-th losses by referring to (i) the ground truth and (ii) at least one of (ii-1) the k-th characteristic information and (ii-2) a k-th task specific output created by using the k-th characteristic information.

[0118] And, the 2-nd learning device 200 may train the k-th surrogate network such that the (1_k)-th losses are minimized, and may transmit the (1_k)-th losses to the 1-st learning device 100.

[0119] Then, the 1-st learning device 100 may perform or support another device to perform (i) a process of training the (k-1)-th trained obfuscation network such that the (1_k)-th losses are minimized and such that the (2_k)-th losses, which are one or more k-th obfuscated data scores corresponding to the k-th obfuscated data inputted into the (k-1)-th trained discriminator, are maximized, to thereby allow the (k-1)-th trained obfuscation network to be a k-th trained obfuscation network, and (ii) a process of training the (k-1)-th trained discriminator such that one or more k-th modified data scores or one or more k-th modified obfuscated data scores, respectively corresponding to the modified data or k-th modified obfuscated data created by modifying the k-th obfuscated data, inputted into the (k-1)-th trained discriminator are maximized and such that the k-th obfuscated data scores are minimized, to thereby allow the (k-1)-th trained discriminator to be a k-th trained discriminator. As a result of repeating the processes as such, an n-th trained obfuscation network may be generated.

[0120] Fig. 6 is a drawing schematically illustrating a testing device for testing a trained obfuscation network in accordance with one example embodiment of the present disclosure.

[0121] By referring to Fig. 6, the testing device 300 in accordance with one example embodiment of the present disclosure may include a memory 310 for storing instructions to test the trained obfuscation network which has been trained to obfuscate original data for testing and generate obfuscated data for testing, such that the surrogate network outputs a 1-st result calculated by using the obfuscated data for testing, same or similar to a 2-nd result calculated by using the original data for testing, and a processor 320 for performing processes to test the trained obfuscation network according to the instructions in the memory 310.

[0122] Specifically, the testing device 300 may typically achieve a desired system performance by using combinations of at least one computing device and at least one computer software, e.g., a computer processor, a memory, a storage, an input device, an output device, or any other conventional computing components, an electronic communication device such as a router or a switch, an electronic information storage system such as a network-attached storage (NAS) device and a storage area network (SAN) as the computing device and any instructions that allow the computing device to function in a specific way as the computer software.

[0123] Also, the processors of such devices may include hardware configuration of MPU (Micro Processing Unit) or CPU (Central Processing Unit), cache memory, data bus, etc. Additionally, the computing device may further include OS and software configuration of applications that achieve specific purposes.

[0124] Such description of the computing device does not exclude an integrated device including any combination of a processor, a memory, a medium, or any other computing components for implementing the present disclosure.

[0125] Meanwhile, on condition that the obfuscation network has been trained in accordance with the learning method by referring to Figs. 2 to 5, if the original data for testing to be used for concealing, i.e., anonymizing, is inputted, according to the instructions stored in the memory 310, the processor 320 of the testing device 300 may input the original data for testing into the obfuscation network, to thereby allow the obfuscation network to generate the obfuscated data for testing by obfuscating the original data for testing.

[0126] As one example, on condition that the 1-st learning device has performed (i) a process of inputting original data for training of the 1-st party into the obfuscation network, to thereby allow the obfuscation network to generate obfuscated data for training by obfuscating the original data for training, (ii) a process of allowing the obfuscated data for training and the ground truth corresponding to the original data for training to be transmitted to the 2-nd learning device corresponding to the 2-nd party, to thereby instruct the 2-nd learning device to (ii-1) input the obfuscated data for training into the surrogate network, and thus instruct the surrogate network to generate characteristic information for training by applying the learning operation of the surrogate network to the obfuscated data for training, (ii-2) calculate the 1-st losses by referring to the ground truth and at least one of the characteristic information for training and a task specific output for training created by using the characteristic information for training, (ii-3) train the surrogate network such that the 1-st losses are minimized, and (ii-4) transmit the 1-st losses to the 1-st learning device, and (iii) if the 1-st losses are acquired from the 2-nd learning device, a process of training the obfuscation network such that the 1-st losses are minimized and such that the 2-nd losses calculated by referring to the original data for training and the obfuscated data for training are maximized, the processor 320 of the testing device 300 may perform or support another device to perform a process of acquiring original data for testing to be used for concealing, i.e., anonymizing.

[0127] And, according to the instructions stored in the memory 310, the processor 320 of the testing device 300 may input the original data for testing into the obfuscation network, to thereby allow the obfuscation network to generate the obfuscated data for testing by obfuscating the original data for testing.

[0128] Fig. 7 is a drawing schematically illustrating a testing method for testing the obfuscation network trained in accordance with one example embodiment of the present disclosure.

[0129] By referring to Fig. 7, the testing device 300 may input the original data for testing, for example, original images on a left side of Fig. 7, into the obfuscation network which has been trained to obfuscate the original data such that the surrogate network outputs a 1-st result calculated by using the obfuscated data, same or similar to a 2-nd result calculated by using the original data, and allow the obfuscation network to obfuscate the original data for testing and thus to output the obfuscated data for testing, e.g., obfuscated images on a right side of Fig. 7.

[0130] For reference, the left side of Fig. 7 is a drawing exemplarily illustrating 64 image samples selected from the CIFAR-10 dataset which includes images collected and labeled by Canadian Institute for Advanced Research (CIFAR) for image classification.

[0131] The obfuscated data generated by concealing, i.e., anonymizing, the image samples on the left side of Fig. 7 used as the original data, in accordance with the present disclosure, are shown on the right side of Fig. 7.

[0132] By referring to Fig. 7, the 64 obfuscated data on the right side of Fig. 7 which are concealed in accordance with the present disclosure are visually different from the 64 original data on the left side of Fig. 7, but if the 64 obfuscated data are inputted into the surrogate network, the surrogate network outputs the 1-st result same or similar to the 2-nd result created by inputting the original data into the surrogate network.

[0133] Meanwhile, the trained obfuscation network may have been trained beforehand by processes similar to those in description of Figs. 2 to 5.

[0134] Meanwhile, the obfuscated data which are concealed, i.e., anonymized, by the trained obfuscation network in accordance with the present disclosure may be provided or sold to a buyer of image big data.

[0135] Also, in accordance with the present disclosure, when the concealed image data are provided or sold to the buyer, the testing method of the trained obfuscation network may be provided as implemented in a form of program instructions executable by a variety of computer components and recorded to computer readable media. In accordance with one example embodiment of the present disclosure, the buyer may execute the program instructions recorded in the computer readable media by using the computer devices, to thereby generate concealed data from the original data owned by the buyer or acquired from other sources, and use the concealed data for his / her own surrogate network. Also, the buyer may use at least two of the concealed data, the original image data owned by the buyer or acquired from other sources, and the concealed image data provided or sold to the buyer, together for the buyer's surrogate network.

[0136] Meanwhile, if the testing method of the trained obfuscation network is implemented as the program instructions that can be executed by a variety of computer components then computational overhead may occur in the computing devices of the buyer when the accuracy is set as high, thus, in accordance with one example embodiment of the present disclosure, the buyer is allowed to lower the accuracy to prevent the computational overhead.

[0137] The present disclosure has an effect of performing concealment, i.e., anonymization, in a simple and accurate way, since a process of searching general data for personal identification information is eliminated.

[0138] The present disclosure has another effect of protecting privacy and security of the original data by generating concealed data, i.e., anonymized data through irreversibly obfuscating the original data.

[0139] The present disclosure has still another effect of generating the obfuscated data recognized as similar or same by a computer but recognized as different by humans.

[0140] The present disclosure has still yet another effect of stimulating a big data trade market.

[0141] The embodiments of the present disclosure as explained above can be implemented in a form of executable program command through a variety of computer means recordable in computer readable media. The computer readable media may include solely or in combination, program commands, data files, and data structures. The program commands recorded to the media may be components specially designed for the present disclosure or may be usable to those skilled in the art of computer software. Computer readable media include magnetic media such as hard disk, floppy disk, and magnetic tape, optical media such as CD-ROM and DVD, magneto-optical media such as floptical disk and hardware devices such as ROM, RAM, and flash memory specially designed to store and carry out program commands. Program commands may include not only a machine language code made by a complier but also a high level code that can be used by an interpreter etc., which may be executed by a computer. The aforementioned hardware device can work as more than a software module to perform the action of the present disclosure and vice versa.

[0142] As seen above, the present disclosure has been explained by specific matters such as detailed components, limited embodiments, and drawings. They have been provided only to help more general understanding of the present disclosure. It, however, will be understood by those skilled in the art that various changes and modification may be made from the description without departing from the scope of the disclosure as defined in the following claims.

[0143] Accordingly, the thought of the present disclosure must not be confined to the explained embodiments, and the following patent claims as well as everything including variations equal or equivalent to the patent claims pertain to the category of the thought of the present disclosure.

Claims

1. A computer implemented method for training an obfuscation network which conceals original data to be used for machine learning, performed by a 1-st learning device (100), and for training a surrogate network which uses obfuscated data generated by the obfuscation network, performed by a 2-nd learning device (200), the method comprising: inputting, by the 1-st learning device (100) the original data of a 1-st party into the obfuscation network, generating, by the 1-st learning device (100), the obfuscated data by obfuscating the original data by the obfuscation network, wherein the 1-st party corresponds to the 1-st learning device (100) and wherein the 1-st party is a party who is determined as an owner of the original data and its corresponding ground truth or is an entity to whom the original data and its corresponding ground truth are relegated by the owner; receiving, by the 1-st learning device (100), 1-st losses, wherein the 1-st losses are obtained by: transmitting, by the 1-st learning device (100), the obfuscated data and the ground truth to a 2-nd learning device (200) corresponding to a 2-nd party wherein the 2-nd party is a party who is determined as having an intention to train the surrogate network by using the original data and the ground truth of the 1-st party, inputting, by the 2-nd learning device (200), the obfuscated data into the surrogate network, generating, by the 2-nd learning device (200), characteristic information by applying at least one learning operation of the surrogate network to the obfuscated data, calculating, by the 2-nd learning device (200), one or more 1-st losses based on the ground truth and at least one of the characteristic information and a task specific output created by using the characteristic information, training, by the 2-nd learning device (200), the surrogate network such that the 1-st losses are minimized, and transmitting, by the 2-nd learning device (200), the 1-st losses to the 1-st learning device (100); and training, by the 1-st learning device (100), the obfuscation network such that the 1-st losses are minimized and such that one or more 2-nd losses calculated based on the original data and the obfuscated data are maximized, wherein the steps of training the obfuscation network and the surrogate network are performed iteratively.

2. The method of Claim 1, wherein the surrogate network includes a 1-st surrogate network to an n-th surrogate network wherein n is an integer greater than 0, and wherein the method further comprises: receiving, by the 1-st learning device, at least part of (1_1)-st losses to (1_n)-th losses as the 1-st losses or an average loss as the 1-st losses, wherein the at least part of the (1_1)-st losses to the (1_n)-th losses or the average loss are obtained by:transmitting, by the 1-st learning device, the obfuscated data and the ground truth to the 2-nd learning device, inputting, by the 2-nd learning device, the obfuscated data respectively into the 1-st surrogate network to the n-th surrogate network, generating, by the 2-nd learning device, 1-st characteristic information to n-th characteristic information by applying corresponding learning operation of the 1-st surrogate network to the n-th surrogate network to the obfuscated data, calculating, by the 2-nd learning device, one or more (1_1)-st losses based on the ground truth and at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information to (ii-2) one or more (1_n)-th losses based on the ground truth and at least one of the n-th characteristic information and an n-th task specific output created by using the n-th characteristic information, training, by the 2-nd learning device, the 1-st surrogate network to the n-th surrogate network respectively such that (iii-1) the (1_1)-st losses to the (1_n)-th losses are respectively minimized or (iii-2) at least one average loss, which is averaged over the (1_1)-st losses to the (1_n)-th losses, is minimized, and transmitting, by the 2-nd learning device, at least part of the (1_1)-st losses to the (1_n)-th losses as the 1-st losses or the average loss as the 1-st losses to the 1-st learning device, and training, by the 1-st learning device, the obfuscation network such that (i) at least part of the (1_1)-st losses to the (1_n)-th losses are minimized and the 2-nd losses are maximized, or (ii) the average loss is minimized and the 2-nd losses are maximized.

3. The method of Claim 1, wherein the surrogate network includes a 1-st surrogate network to an n-th surrogate network wherein n is an integer greater than 0, and wherein the method further comprises: inputting, by the 1-st learning device, the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate 1-st obfuscated data, receiving, by the 1-st learning device, (1_1)-st losses, wherein the (1_1)-st losses are obtained by: transmitting, by the 1-st learning device, to the 2-nd learning device, the obfuscated data and the ground truth, inputting, by the 2-nd learning device, the 1-st obfuscated data into the 1-st surrogate network, generating, by the 2-nd learning device, 1-st characteristic information by applying at least one learning operation of the 1-st surrogate network to the 1-st obfuscated data, calculating, by the 2-nd learning device, one or more (1_1)-st losses based on the ground truth and at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information, training, by the 2-nd learning device, the 1-st surrogate network such that the (1_1)-st losses are minimized, and transmitting, by the 2-nd learning device, the (1_1)-st losses to the 1-st learning device, training, by the 1-st learnin device, the obfuscation network such that the (1_1)-st losses are minimized and such that one or more (2_1)-st losses calculated by referring to the original data and the 1-st obfuscated data are maximized, to thereby allow the obfuscation network to be a 1-st trained obfuscation network, and wherein, while increasing an integer k from 2 to n, the method further comprises: inputting, by the 1-st learning device, the original data into a (k-1)-th trained obfuscation network, to thereby allow the (k-1)-th trained obfuscation network to generate k-th obfuscated data by obfuscating the original data, receiving, by the 1-st learning device, a (1_k)-th losses, wherein the (1_k)-th losses are obtained by: transmitting, by the 1-st learning device, the obfuscated data to the 2-nd learning device, inputting, by the 2-nd learning device, the k-th obfuscated data into a k-th surrogate network, generating, by the 2-nd learning device, k-th characteristic information by applying the learning operation of the k-th surrogate network to the k-th obfuscated data, calculating, by the 2-nd learning device, one or more (1_k)-th losses based on the ground truth and at least one of the k-th characteristic information and a k-th task specific output created by using the k-th characteristic information, training, by the second learning device, the k-th surrogate network such that the (1_k)-th losses are minimized, and transmitting, by the 2-nd learning device, the (1_k)-th losses to the 1-st learning device, and training, by the 1-st learning device, the (k-1)-th trained obfuscation network such that the (1_k)-th losses are minimized and such that one or more (2_k)-th losses calculated by referring to the original data and the k-th obfuscated data are maximized, and thus allowing the (k-1)-th trained obfuscation network to be a k-th trained obfuscation network.

4. The method of Claim 1, further comprising: acquiring, by the 1-st learning device, one or more obfuscated data scores as the 2-nd losses wherein the obfuscated data scores correspond to the obfuscated data inputted into a discriminator capable of determining whether data inputted thereto is real or fake, training, by the 1-st learning device, the obfuscation network such that the 1-st losses are minimized and such that the 2-nd losses are maximized, and training, by the 1-st learning device, the discriminator such that one or more modified data scores or one or more modified obfuscated data scores, respectively corresponding to modified data or modified obfuscated data inputted into the discriminator, are maximized and such that the obfuscated data scores are minimized, wherein the modified data or the modified obfuscated data is generated by respectively modifying the original data or the obfuscated data.

5. The method of Claim 4, wherein the surrogate network includes a 1-st surrogate network to an n-th surrogate network wherein n is an integer greater than 0, and wherein the method further comprises: receiving, by the 1-st learning device, at least part of (1_1)-st losses to (1_n)-th losses as the 1-st losses or an average loss as the 1-st losses, wherein the at least part of the (1_1)-st losses to the (1_n)-th losses or the average loss are obtained by: transmitting, by the 1-st learning device, the obfuscated data and the ground truth to the 2-nd learning device, inputting, by the 2-nd learning device, the obfuscated data respectively into the 1-st surrogate network to the n-th surrogate network, generating, by the 2-nd learning device, 1-st characteristic information to n-th characteristic information by applying corresponding learning operation of the 1-st surrogate network to the n-th surrogate network to the obfuscated data, calculating, by the 2-nd learning device, one or more (1_1)-st losses by referring to the ground truth and at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information to one or more (1_n)-th losses by referring to the ground truth and at least one of the n-th characteristic information and an n-th task specific output created by using the n-th characteristic information, training, by the 2-nd learning device, the 1-st surrogate network to the n-th surrogate network respectively such that (iii-1) the (1_1)-st losses to the (1_n)-th losses are respectively minimized or (iii-2) at least one average loss, which is averaged over the (1_1)-st losses to the (1_n)-th losses, is minimized, and transmitting, by the 2-nd learning device, to the 1-st learning device at least part of the (1_1)-st losses to the (1_n)-th losses as the 1-st losses or the average loss as the 1-st losses, training, by the 1-st learning device, the obfuscation network such that: (i) at least part of the (1_1)-st losses to the (1_n)-th losses are minimized and the 2-nd losses, which are the obfuscated data scores corresponding to the obfuscated data inputted into the discriminator, are maximized, or (ii) the average loss is minimized and the 2-nd losses are maximized, and training, by the 1-st learning device, the discriminator such that the modified data scores or the modified obfuscated data scores, respectively corresponding to the modified data or the modified obfuscated data inputted into the discriminator, are maximized, and such that the obfuscated data scores are minimized.

6. The method of Claim 4, wherein the surrogate network includes a 1-st surrogate network to an n-th surrogate network wherein n is an integer greater than 0, and wherein the method further comprises: inputting, by the 1-st learning device, the original data into the obfuscation network, to thereby allow the obfuscation network to obfuscate the original data and thus to generate 1-st obfuscated data, receiving, by the 1-st learning device, (1_1)-st losses, wherein the (1_1)-st losses are obtained by: transmitting, by the 1-st learning device, the obfuscated data and the ground truth to the 2-nd learning device, inputting, by the 2-nd learning device, the 1-st obfuscated data into the 1-st surrogate network, generating, by the second learning device, 1-st characteristic information by applying at least one learning operation of the 1-st surrogate network to the 1-st obfuscated data, calculating, by the second learning device, one or more (1_1)-st losses based on the ground truth and at least one of the 1-st characteristic information and a 1-st task specific output created by using the 1-st characteristic information, training, by the 2-nd learning device, the 1-st surrogate network such that the (1_1)-st losses are minimized, and transmitting, by the 2-nd learning device, the (1_1)-st losses to the 1-st learning device, training, by the 1-st learning device, the obfuscation network such that the (1_1)-st losses are minimized and such that one or more (2_1)-st losses, which are one or more 1-st obfuscated data scores corresponding to the 1-st obfuscated data inputted into the discriminator, are maximized, to thereby allow the obfuscation network to be a 1-st trained obfuscation network, training, by the 1-st learning device, the discriminator such that one or more 1-st modified data scores or one or more 1-st modified obfuscated data scores, respectively corresponding to the modified data or 1-st modified obfuscated data created by modifying the 1-st obfuscated data, inputted into the discriminator are maximized and such that the 1-st obfuscated data scores are minimized, to thereby allow the discriminator to be a 1-st trained discriminator, and wherein, while increasing an integer k from 2 to n, the method further comprises: inputting, by the 1-st learning device, the original data into a (k-1)-th trained obfuscation network, to thereby allow the (k-1)-th trained obfuscation network to generate k-th obfuscated data by obfuscating the original data, receiving, by the 1-st learning device, (1_k)-th losses, wherein the (1_k)-th losses are obtained by: transmitting, by the 1-st learning device, the k-th obfuscated data to the 2-nd learning device, inputting, by the second learning device, the k-th obfuscated data into a k-th surrogate network, generating, by the 2-nd learning device, k-th characteristic information by applying the learning operation of the k-th surrogate network to the k-th obfuscated data, calculating, by the 2-nd learning device, one or more (1_k)-th losses by referring to the ground truth and at least one of the k-th characteristic information and a k-th task specific output created via using the k-th characteristic information, training, by the 2-nd learning device, the k-th surrogate network such that the (1_k)-th losses are minimized, and transmitting, by the 2-nd learning device, the (1_k)-th losses to the 1-st learning device, training, by the 1-st learning device, the (k-1)-th trained obfuscation network such that the (1_k)-th losses are minimized and such that one or more (2_k)-th losses, which are one or more k-th obfuscated data scores corresponding to the k-th obfuscated data inputted into a (k-1)-th trained discriminator, data are maximized, and thus allowing the (k-1)-th trained obfuscation network to be a k-th trained obfuscation network, and training, by the 1-st learning device, the (k-1)-th trained discriminator such that one or more k-th modified data scores or one or more k-th modified obfuscated data scores, respectively corresponding to the modified data or k-th modified obfuscated data created by modifying the k-th obfuscated data inputted into the (k-1)-th trained discriminator and such that the k-th obfuscated data scores are minimized, to thereby allow the (k-1)-th trained discriminator to be a k-th trained discriminator.

7. The method of Claim 4, wherein a maximum of the modified data scores or the modified obfuscated data scores, respectively corresponding to the modified data or the modified obfuscated data inputted into the discriminator, is 1 as a value for determining the modified data or the modified obfuscated data as real, and a minimum of the obfuscated data scores, corresponding to the obfuscated data inputted into the discriminator, is 0 as a value for determining the obfuscated data as fake.

8. The method of Claim 1, further comprising: measuring, by the 1-st learning device, at least one quality based on at least part of an entropy and a degree of noise of the obfuscated data, and training, by the 1-st learning device, the obfuscation network such that the 1-st losses, to which the measured quality is added, are minimized.

9. A computer implemented method for testing an obfuscation network, trained according to the method of any of the claims 1 to 8, the method for testing comprising steps of: acquiring, by a testing device, original data for testing to be concealed; and inputting, by the testing device, the original data for testing into the obfuscation network, to thereby allow the obfuscation network to generate obfuscated data for testing by obfuscating the original data for testing.

10. A 1-st learning device for training an obfuscation network which conceals original data to be used for machine learning, and a 2-nd learning device for training a surrogate network which uses obfuscated data generated by the obfuscation network, the 1-st and 2-nd learning devices for training each comprising: a memory that stores instructions to perform corresponding steps of the method according to any of the claims 1 to 8; and a processor configured to execute the instructions.