Estimation system, estimation method and estimation program

Abstract

To share one model among a large number of users, and reduce calculation costs.SOLUTION: An estimation system 100 has a user terminal 20i, an estimation device 40 and a converter 30. The user terminal 20i has a first conversion unit 21 which executes first conversion out of the first conversion and second conversion obtained by dividing predetermined conversion, on the basis of first secret information out of the first secret information and second secret information obtained by dividing predetermined secret information, to input data to be estimated, and creates first converted data. The converter 30 has a second conversion unit 31 which executes the second conversion based on the second secret information, to the first converted data, and creates second converted data. The estimation device 40 has an estimation unit 41 which executes estimation processing based on the second converted data, by using an estimation model 411 executed based on learning data in which the predetermined conversion based on the predetermined secret information is executed.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to an estimation system, an estimation method, and an estimation program. [Background technology]

[0002] In recent years, machine learning technology has made remarkable progress, and services using machine learning models have become increasingly popular. Accordingly, many attack methods targeting machine learning models have been proposed.

[0003] For example, model inversion attacks, which restore the data used for learning from the input and output data of a model, and model extraction attacks, which infer the model itself (Non-Patent Document 1), are known and pose a threat in terms of privacy protection and intellectual property protection. There are no perfect countermeasures against such attacks.

[0004] Therefore, there is a need for a new defense method based on the concept of defense in depth, which ensures safety through multiple measures.

[0005] As a defense technique from a new perspective, a method has been proposed in which a model is trained using data that has been converted based on secret information (Non-Patent Document 2).

[0006] Even if learning data is restored from a model created by the method described in Non-Patent Document 2, only converted data can be obtained, which is useful from the viewpoint of privacy protection. In addition, the method described in Non-Patent Document 2 provides a model that is inaccurate for users who do not have the secret information, so it is robust against model estimation. [Prior art documents] [Non-patent literature]

[0007] [Non-Patent Document 1] Reza Shokri et al., “Membership Inference Attacks Against Machine Learning Models”, [Retrieved May 1, 2023], Internet<URL:https: / / arxiv.org / pdf / 1610.05820.pdf> [Non-Patent Document 2] Aprilpyone Maungmaung and Hitoshi Kiya, “A protection method of trained CNN model with a secret key from unauthorized access”, 2021. Summary of the Invention [Problem to be solved by the invention]

[0008] However, the method described in Non-Patent Document 2 has a feature that a model and a user who has secret information correspond one-to-one. Therefore, when providing models to a large number of users, it is necessary to create trained models for each user, which poses a problem of high computational cost.

[0009] The present invention has been made in consideration of the above, and aims to provide an estimation system, an estimation method, and an estimation program that enable a single model to be shared by a large number of users, thereby reducing calculation costs. [Means for solving the problem]

[0010] In order to solve the above-mentioned problems and achieve the object, the estimation system of the present invention includes a learning device that performs learning of an estimation model, a user terminal that makes an estimation request for data, an estimation device that performs estimation for the data, and a conversion device that is capable of communicating with the learning device, the user terminal, and the estimation device, wherein the learning device includes a conversion unit that performs a predetermined conversion based on secret information on learning data, a learning unit that performs learning of the estimation model based on the learning data converted by the conversion unit, and a division unit that divides the secret information into first secret information to be used for the first conversion and second secret information to be used for the second conversion when the predetermined conversion is divided into two stages, a first conversion and a second conversion, and the user terminal includes a first conversion unit that performs the first conversion based on the first secret information on input data to be estimated and generates first converted data, and the conversion device includes a second conversion unit that performs the second conversion based on the second secret information on the first converted data and generates second converted data, and the estimation device includes an estimation unit that uses the estimation model to perform an estimation process based on the second converted data and transmits the estimation result to the user terminal.

[0011] Moreover, an estimation system according to the present invention is an estimation system having a user terminal that makes an estimation request for data, an estimation device that makes an estimation for the data, and a conversion device that is capable of communicating with the user terminal and the estimation device, wherein the user terminal has a first conversion unit that performs the first conversion of a first conversion and a second conversion obtained by dividing a predetermined conversion based on the first secret information of first secret information and second secret information obtained by dividing a predetermined secret information, on input data to be estimated, to generate first-converted data, the conversion device has a second conversion unit that performs the second conversion based on the second secret information on the first-converted data to generate second-converted data, and the estimation device has an estimation unit that performs an estimation process based on the second-converted data using an estimation model performed based on learning data on which the predetermined conversion based on the predetermined secret information has been performed, and transmits the estimation result to the user terminal. Effect of the Invention

[0012] According to the present invention, it becomes possible to share one model among many users, thereby reducing the calculation cost. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram for explaining a conventional method. [Diagram 2] FIG. 2 is a diagram for explaining an outline of the embodiment. [Diagram 3] FIG. 3 is a diagram for explaining an outline of the embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of a configuration of an estimation system according to an embodiment. [Diagram 5] FIG. 5 is a diagram for explaining an example of division of the SHF conversion process using secret information. [Figure 6] FIG. 6 is a diagram for explaining an example of division of the NP transformation process using secret information. [Figure 7] FIG. 7 is a sequence diagram showing a processing procedure of the processing executed by the estimation system shown in FIG. [Figure 8] FIG. 8 is a sequence diagram showing a procedure of the process executed by the estimation system shown in FIG. [Figure 9] FIG. 9 is a diagram illustrating an example of a computer that implements each of the components of the estimation system by executing a program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of an estimation system, an estimation method, and an estimation program according to the present application will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiment described below.

[0015] [Conventional method] First, the conventional method will be described. Fig. 1 is a diagram for explaining the conventional method. A method has been proposed in the past in which an estimation model is trained using a training data set d' in which a training data set d is subjected to a transformation (t(x,K)) based on secret information K.

[0016] According to the method shown in Figure 1, training is performed using the transformed training data set d'. Therefore, even if training data is restored from a trained estimation model, only worthless transformed data can be obtained.

[0017] Therefore, this method is effective as a countermeasure against model inversion attacks.In addition, since the accuracy of estimation models trained by conventional methods decreases when data is converted using secret information different from that used during training, this method is also effective as a countermeasure against model extraction attacks.

[0018] However, in conventional methods, the estimation model and the secret information K have a one-to-one correspondence, so if different secret information is distributed to different users, the model needs to be retrained for each user.

[0019] [Outline of the embodiment] 2 and 3 are diagrams for explaining an outline of the embodiment.

[0020] In the embodiment, as shown in FIG. 2, the conversion process (t(x,K)) ((A) of FIG. 2) for the learning data set d is divided into two stages of conversion processes (t(x,K i1 ),t(x´,K i2 In the embodiment, the secret information K used for the conversion is also divided into two pieces of secret information (first secret information K i1 , 2nd secret information K i2 ) (Figure 2 (B)). Note that after the transformation process (t(x,K)) and after the two-stage transformation process (t(x,K i1 ),t(x´,K i2 )) the same conversion result can be obtained (Figure 2 (2)).

[0021] The learning of an estimation model (machine learning model) will be described. First, the model creator performs a transformation (t(x,K)) on the labeled learning dataset d based on the secret information K. The model creator then uses the transformed learning dataset d' to train the estimation model (arrow Y1 in FIG. 3). The model creator transmits the trained estimation model parameters to the service provider (arrow Y5 in FIG. 3). The estimation model can perform highly accurate estimation if the data has been transformed (t(x,K)) based on the secret information K. On the other hand, the estimation model cannot maintain a highly accurate estimation for data that has not been transformed (t(x,K)) based on the secret information K.

[0022] Then, the model creator divides the secret information K into two pieces of secret information (first secret information K i1 , 2nd secret information K i2 ), the transformation (t(x,K)) according to the secret information K is divided into the first secret information K i1 , 2nd secret information K i2 Two-step transformation (t(x,K i1 ),t(x´,K i2 )) (Figure 3).

[0023] Next, the model creator i1 The service user i (i = 1,...,I) holds the second secret information K i2 The image is stored in the server (image converter) (arrow Y4 in FIG. 3).

[0024] Next, the usage of the estimation service will be described. First, the service user i applies the first secret information K i1 The first transformation (t(x,K i1 )) and transmits the encrypted first converted image x' to the image converter (arrow Y11 in FIG. 3).

[0025] The server on the image converter side encrypts the first converted image x' and then converts it into the second secret information K i2The second transformation based on (t(x',K i2 )) and transmits the encrypted second converted image x″ to the image converter (arrow Y12 in FIG. 3).

[0026] On the service provider side, the encrypted second transformed image x″ is input to the estimation model and the estimation process is performed. The service provider outputs the estimation result to the service user i (arrow Y13 in Fig. 3). i1 ),t(x´,K i2 )) Since the same conversion result can be obtained after the estimation, the estimation accuracy of the estimation model can be maintained.

[0027] In addition, since the secret information division patterns are diverse, a different secret information pair (first secret information K i1 , 2nd secret information K i2 ) can be distributed. Therefore, according to the embodiment, one estimation model can be shared among many service users i, which reduces the calculation cost.

[0028] [Estimation system] Next, an estimation system according to an embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the configuration of the estimation system according to an embodiment.

[0029] The estimation system 100 according to the embodiment includes a model creation device 10 (learning device) provided on the model creator side, a user terminal 20i used by a service user i, a conversion device 30 provided on the image converter side, and an estimation device 40 provided on the service provider side. The model creation device 10, the user terminal 20i, the conversion device 30, and the estimation device 40 are capable of communicating with each other.

[0030] The model creation device 10 executes learning of an estimation model and transmits parameters of the learned estimation model to the estimation device 40. The user terminal 20i transmits an estimation request for data to the estimation device 40. The estimation device 40 performs estimation for the data requested by the user terminal 20i using an estimation model to which the parameters received from the model creation device 10 are applied. The conversion device 30 is capable of communicating with the model creation device 10, the user terminal 20i, and the estimation device 40.

[0031] [Model creation device] The following describes the model creation device 10. The model creation device 10 executes learning of an estimation model required when executing an estimation service provided by a service provider.

[0032] The model creating device 10 is a server device that is realized by loading a predetermined program into a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. The model creating device 10 also has a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc. The model creating device 10 has a conversion unit 11, a learning unit 12, and a secret information division unit 15.

[0033] The conversion unit 11 performs a predetermined conversion (t(x,K)) based on secret information K on training data (e.g., a labeled training data set d) used for training an estimation model 131 (machine learning model) (described later) to be trained. The training data is a labeled image data set. The predetermined conversion is a conversion according to a specific rule. The predetermined conversion is a shuffling (SHF) conversion or a negative / positive (NP) conversion.

[0034] The learning unit 12 executes learning of an estimation model 131 based on the learning data that has been subjected to a predetermined conversion by the conversion unit 11. The learning unit 12 includes an estimation unit 13 having the estimation model 131, and a parameter update unit .

[0035] The estimation unit 13 uses the estimation model 131 to perform estimation processing based on the learning data converted by the conversion unit 11, and outputs the estimation result to the parameter update unit .

[0036] The parameter update unit 14 performs learning of the estimation model 131 by machine learning. For example, the parameter update unit 14 performs a parameter update process to update the parameters of the estimation model 131 so that the labels of the learning data on which the estimation process has been performed approach the estimation result of the model 131.

[0037] The estimation process and the parameter update process are repeatedly executed until a predetermined termination condition is satisfied. The termination condition is, for example, when the number of parameter updates reaches a predetermined number, when the parameter update amount becomes equal to or less than a predetermined threshold, when the calculated loss becomes equal to or less than a predetermined threshold, etc. The parameter update unit 14 transmits the parameters of the optimized estimation model 131 to the estimation device 40.

[0038] The secret information division unit 15 divides the secret information K into two first secret information K i1 , 2nd secret information K i2 The first secret information K i1 is a function that converts a given transformation (t(x,K)) into a first transformation (t(x,K i1 )) and the second transformation (t(x',K i2 )) is used for the first conversion when the second secret information K i2 is used for the second conversion. The secret information division unit 15 divides the first secret information K i1 The secret information division unit 15 transmits the second secret information K i2 is transmitted to the conversion device 30.

[0039] [User terminal] Next, the user terminal 20i will be described. The service user i is a user of the estimation service provided by the service provider. The user terminal 20i transmits an estimation request for input data (image) to be estimated to the estimation device 40.

[0040] The user terminal 20i is, for example, a server device realized by loading a predetermined program into a computer including a ROM, a RAM, a CPU, etc., and executing the predetermined program by the CPU. The user terminal 20i also has a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc. The user terminal 20i has a first conversion unit 21.

[0041] The first conversion unit 21 receives the first secret information K i1 The first conversion unit 21 receives an input of an image x to be estimated. Then, the first conversion unit 21 adds the first secret information K i1 The first transformation based on (t(x,K i1 )) to generate a first transformed image x'. The first transform unit 21 transmits the first transformed image x' to the transform device 30.

[0042] [Conversion device] Next, the conversion device 30 will be described. The conversion device 30 is, for example, a server device that is realized by loading a predetermined program into a computer including a ROM, a RAM, a CPU, etc., and executing the predetermined program by the CPU. The conversion device 30 also has a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc. The conversion device 30 has a second conversion unit 31.

[0043] The second conversion unit 31 receives the second secret information K i2 The second conversion unit 31 receives the input of the first converted image x' from the user terminal 20i. Then, the second conversion unit 31 adds the second secret information K i2 The second transformation based on (t(x',K i2 )) to generate a second transformed image x″. The second transformation unit 31 transmits the second transformed image x″ to the estimation device 40.

[0044] [Estimation device] Next, the estimation device 40 will be described. For example, it is a server device realized by loading a predetermined program into a computer including a ROM, a RAM, a CPU, etc., and executing the predetermined program by the CPU. The estimation device 40 also has a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc. The estimation device 40 has an estimation unit 41 having an estimation model 411.

[0045] The estimation unit 41 receives parameters optimized in the model creation device 10 from the model creation device 10 and applies them to the estimation model 141. The estimation unit 41 receives the second transformed image x". The estimation unit 41 executes estimation processing based on the second transformed image x" using the estimation model 411, and outputs the estimation result to the user terminal 20i.

[0046] [Conversion process example] Next, an example of conversion processing for an image will be described. In the embodiment, as a specific application example, attention is paid to SHF conversion and NP conversion, which suffer from a large deterioration in accuracy when erroneous secret information is used. SHF conversion and NP conversion are block conversions that divide an image into blocks of a specific size and perform processing. SHF conversion is a conversion that shuffles pixel values ​​within a block. NP conversion is a conversion that inverts pixel values ​​within a block with a 50% probability.

[0047] First, we will introduce the methods of SHF transformation and NP transformation using secret information. In the following, we will use the following notation.

[0048] w, h, c are the width, height, and number of channels of the image. Tensor x∈[0, , 255] (c×h×w) represents the input image. The tensor x´∈[0, ,255] (c×h×w) represents the transformed image. M represents the size of the block to be transformed. p b =M×M×c represents the number of pixel values ​​contained in one block. b =[x b1 ,···,x bk ,···,x (bp_b) ],x bk∈[0, ,255] represents a block b. b ´=[x b1 ´,···,x bk ´,···,x (bp_b) ´],x bk ´∈[0, ,255] represents block b´, which is the transformed version of block b.

[0049] [Example of division of SHF conversion process] 5 is a diagram for explaining an example of division in the SHF conversion process using secret information. In FIG. 5, for the sake of simplicity, the block size is set to 2×2×1.

[0050] First, as a predetermined process, consider rearranging pixel values ​​as shown in FIG. 5(1) by SHF conversion.

[0051] The permutation in FIG. 5(1) can be divided into two permutations as shown in FIG. 5(2). Pairs of secret information (key) K can be generated only for factorials of the block size. For example, pairs of secret information K are (K 11 ,K 12 ),(K 21 ,K 22 ),(K 31 ,K 32 In practice, the sorting is expressed as a matrix calculation, and three secret pieces of information are generated from one secret piece of information.

[0052] [SHF conversion using secret information] The method of SHF transformation using secret information is explained. First, when k ≠ k′, α k ≠α k´ Generate a sequence α (equation (1)) such that

[0053]

number

[0054] In the SHF transformation, α is used as the secret information K. In this case, x b After SHF conversion, x b Each element x ofbk ´ can be calculated using equation (2).

[0055]

number

[0056] [Apply SHF conversion] The SHF transform, which rearranges pixel values ​​based on the secret information α, can be expressed by a matrix calculation such as equation (3).

[0057]

number

[0058] Here, A(P b ×P b ) is a matrix representation of the secret information α, and each element A kl is expressed as equation (4).

[0059]

number

[0060] Also, X b and X b ´ means x b and x b ´ and elements arranged vertically, size p b × 1 matrix. When splitting the SHF transform based on the secret information α into two SHF transforms, if equation (3) is used, two pieces of secret information α1 and α2 are required such that the following equation (5) holds.

[0061]

number

[0062] Here, A1(p b ×p b ),A2(p b ×p b) is a matrix representation of the secret information α1 and α2. In this case, when the secret information α1 is generated arbitrarily, it is obtained from the formula (5), and the remaining secret information α2 is obtained as shown in the formula (6).

[0063]

number

[0064] [Example of division of NP conversion processing] 6 is a diagram for explaining an example of division of the NP transform process using secret information. In FIG. 6, the block size is set to 2×2×1 for the sake of simplicity.

[0065] First, consider a predetermined process, such as the NP transformation shown in (1) of Figure 6. For example, perform an XOR calculation with 255 on only two squares in the first row.

[0066] The transformation in FIG. 6(1) can be divided into two transformations as shown in FIG. 6(2). The pair of secret information K is 2 ブロックサイズ It is possible to generate only one pair of secret information K, for example, (K 11 ,K 12 ),(K 21 ,K 22 ),(K 31 ,K 32 In practice, the properties of XOR are used to generate two pieces of secret information from one piece of secret information.

[0067] [NP transformations using secret information] We introduce a method of NP transformation using secret information. First, generate the sequence β (equation (7)).

[0068]

number

[0069] In the NP transformation, β is used as the secret information K. In this case, x b After the NP transformation of x b Each element x of bk´ can be calculated using equation (8).

[0070]

number

[0071] [Application of NP transformation] The NP transformation that performs an XOR calculation based on the secret information β can be divided into two NP transformations using the secret information β1 and β2 by utilizing the property of XOR as shown in equation (9).

[0072]

number

[0073] From equation (4), in the NP transformation, β k x corresponding to k where = 1 bk Only for is an XOR calculation with 255. When dividing an NP transformation into two NP transformations, taking into account the nature of XOR shown in equation (9), the results of the two NP transformations should satisfy the following condition:

[0074] The first condition is β k x corresponding to k where = 1 bk An odd number of XORs with 255. An odd number of XORs with the same value is equivalent to one XOR with that value.

[0075] The second condition is β k = 0 for the k corresponding to x bk The trick is to XOR 255 an even number of times with a value. XORing the same value an even number of times is equivalent to not XORing it with that value.

[0076] From the above conditions, if the sum of each element of the secret information β1 and β2 satisfies the formula (10), the NP transformation can be divided into two times.

[0077]

number

[0078] In order to generate secret information β2 from secret information β and arbitrarily generated secret information β1 so as to satisfy the above, it is sufficient to perform a calculation such as that shown in equation (11).

[0079]

number

[0080] Although the SHF transformation and the NP transformation have been described as examples of the predetermined transformation, it is also possible to divide the secret information for other transformation methods by using a method appropriate to the transformation.

[0081] [Processing Procedure] Fig. 7 is a sequence diagram showing the procedure of the processing executed by the estimation system 100 shown in Fig. 4. Fig. 7 shows the processing during learning of the estimation model 141.

[0082] As shown in FIG. 7, the model generating device 10 performs a predetermined transformation (t(x,K)) based on secret information K on the learning data used for learning the estimation model 131 to be learned (step S11).

[0083] The model creation device 10 executes an estimation process based on the learning data converted in step S11 using the estimation model 131 (step S12). The model creation device 10 updates the parameters of the estimation model 131 (step S13). The model creation device 10 transmits the optimized parameters of the estimation model 131 to the estimation device 40 (step S14).

[0084] The model generating device 10 divides the secret information K into two pieces of first secret information K i1 , 2nd secret information K i2 (Step S15). The model generating device 10 divides the first secret information K i1 The model creation device 10 transmits the second secret information K i2is transmitted to conversion device 30 (step S17).

[0085] Fig. 8 is a sequence diagram showing the procedure of the processing executed by the estimation system 100 shown in Fig. 4. Fig. 8 shows the processing when an estimation model is used.

[0086] The user terminal 20i adds the first secret information K i1 The first transformation based on (t(x,K i1 )) (step S21) to generate a first converted image x', and transmit the first converted image x' to the conversion device 30 (step S22).

[0087] The conversion device 30 converts the first converted image x′ into second secret information K i2 The second transformation based on (t(x',K i2 )) (step S23) to generate a second transformed image x″, and transmit the second transformed image x″ to the estimation device 40 (step S24).

[0088] The estimation device 40 uses the estimation model 411 to execute an estimation process based on the second transformed image x'' (step S25), and outputs the estimation result to the user terminal 20i (step S26).

[0089] [Evaluation experiment] Next, the performance of the estimation model to which this embodiment is applied is evaluated. Specifically, the estimation model is trained and evaluated for each combination of the conversion method and the block size to which the conversion is applied. The conversion method used is SHF conversion and NP conversion. In addition, the block size is set to three patterns: 4×4, 8×8, and 16×16. The learning procedure is shown below.

[0090] The first step is to determine the secret information.

[0091] In the second step, we create a training dataset of images converted using the secret information. The dataset to be converted is CIFAR-10. CIFAR-10 is a dataset consisting of 60,000 color images and contains 10 classes of objects.

[0092] In the third step, we train an estimation model using the training dataset. The model structure of the estimation model is a small-scale convolution neural network (CNN).

[0093] Next, we evaluated the estimation model trained using the above procedure using the following four types of evaluation datasets. The evaluation results are shown in Table 1.

[0094] [Table 1]

[0095] The first set is the image dataset transformed with the secret information used during training ("Single" in Table 1).

[0096] The second set is a set of secret information pairs (first secret information K i1 , 2nd secret information K i2 ) image dataset ("Pair" in Table 1).

[0097] The third set is an image dataset transformed with an incorrect secret pair. This image dataset was transformed using 10 combinations of correct and incorrect secret pairs, as shown in the following first to third combinations.

[0098] The first combination is where the first secret information is incorrect and the second secret information is correct ("1st" in Table 1). The second combination is where the first secret information is correct and the second secret information is incorrect ("2nd" in Table 1). The third combination is where the first secret information is incorrect and the second secret information is incorrect ("Both" in Table 1).

[0099] The fourth set is an image dataset without any transformation ("Plain" in Table 1).

[0100] The above learning and evaluation process was carried out 10 times for each combination of conversion method and block size, and the average accuracy rate was calculated. The results are shown in Table 1.

[0101] As shown in “Single” and “Pair” in Table 1, “an image dataset converted with the secret information used during training (secret information K)” and “a secret information pair generated from the secret information used during training (first secret information K i1 , 2nd secret information K i2 It can be seen that the estimation model to which the embodiment is applied shows exactly the same accuracy rate for the "image dataset converted by 1. )". Therefore, when correct secret information is used, the presence or absence of division does not affect the accuracy rate of the model.

[0102] In addition, with reference to “Pair”, “1st”, “2nd”, and “Both” in Table 1, for the estimation model to which the embodiment is applied, “a secret information pair (first secret information K) generated from the secret information (secret information K) used during learning” is described. i1 , 2nd secret information K i2 We compare the accuracy rates for the "image dataset converted with the 3D image conversion algorithm" and the "image dataset converted with an incorrect secret information pair."

[0103] As a result of the comparison, the estimation model to which the embodiment is applied has a secret information pair (first secret information K i1 , 2nd secret information K i2 ) is incorrect, the accuracy rate drops significantly.

[0104] Furthermore, it can be seen that the accuracy rate of the estimation model to which this embodiment is applied also drops significantly for the "image dataset that has not been subjected to any transformation" ("Plain" in Table 1).

[0105] From the above evaluation results, the embodiment is also effective as a measure against unauthorized use of the estimation model by those who do not have the secret information K.

[0106] [Effects of the embodiment] Thus, in the embodiment, when learning an estimation model, the estimation model is learned using learning data that has been subjected to a predetermined conversion based on predetermined secret information. In the embodiment, the conversion of the learning data is divided into two stages of conversion processing, a first conversion and a second conversion, and the secret information used for the conversion is also divided into first secret information and second secret information. Then, in the embodiment, the first secret information is distributed to the service user i, and the second secret information is distributed to the image converter.

[0107] In the embodiment, during actual service operation, the service user side performs a first conversion on input data to be estimated based on the first secret information to generate first converted data. The image converter side performs a second conversion on the first converted data based on the second secret information to generate second converted data. The service provider side uses the estimation model to perform estimation processing based on the second converted data.

[0108] Since there are many different secret division patterns, it is possible to distribute different secret pairs to each user. Therefore, according to the embodiment, one estimation model can be shared by many users, and the calculation cost can be reduced.

[0109] Furthermore, the estimation model to which the embodiment is applied can be said to be a robust estimation model because the estimation accuracy is significantly reduced when only one of the first secret information and the second secret information is incorrect.The estimation model to which the embodiment is applied can be said to be a robust estimation model because the estimation accuracy is significantly reduced even when there is no secret information.

[0110] [System configuration of the embodiment] Each component device of the estimation system 100 is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of each component device of the estimation system 100 is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0111] Furthermore, all or any part of the processes performed in each of the components of the estimation system 100 may be realized by a CPU and a program analyzed and executed by the CPU. Furthermore, each process performed in each of the components of the estimation system 100 may be realized as hardware using wired logic.

[0112] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the process procedures, control procedures, specific names, and information including various data and parameters described above and shown in the drawings can be changed as appropriate unless otherwise specified.

[0113] [program] 9 is a diagram showing an example of a computer in which each component device of the estimation system 100 is realized by executing a program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these components is connected by a bus 1080.

[0114] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0115] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of each component device of the estimation system 100 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration of each component device of the estimation system 100 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0116] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary, and executes the program.

[0117] Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)). The program module 1093 and the program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0118] Although the embodiment of the invention made by the present inventor has been described above, the present invention is not limited by the description and drawings that form a part of the disclosure of the present invention according to the present embodiment. In other words, other embodiments, examples, operation techniques, etc. made by those skilled in the art based on the present embodiment are all included in the scope of the present invention. [Explanation of symbols]

[0119] 10 Model making equipment 11 Conversion section 12 Learning Department 13 Estimation part 14 Parameter Update Section 15 Confidential Information Division 20i User Terminal 21 First conversion unit 30 Conversion Device 31 Second conversion section 40 Estimation device 41 Estimation part 131,411 Estimation Model

Claims

1. An estimation system including a user terminal that makes an estimation request for data, an estimation device that performs estimation for the data, and a conversion device that is capable of communicating with the user terminal and the estimation device, The user terminal includes: a first conversion unit that performs the first conversion of a first conversion and a second conversion obtained by dividing a predetermined conversion on input data to be estimated, based on the first secret information of the first secret information and the second secret information obtained by dividing a predetermined secret information, to generate first converted data; having The conversion device comprises: a second conversion unit that performs the second conversion based on the second secret information on the first converted data to generate second converted data; Have The estimation device includes: an estimation unit that executes an estimation process based on the second converted data by using an estimation model executed based on learning data that has been executed with the predetermined conversion based on the predetermined secret information, and transmits an estimation result to the user terminal; An estimation system comprising:

2. An estimation system including: a learning device that executes learning of an estimation model; a user terminal that issues an estimation request for data; an estimation device that performs estimation on the data; and a conversion device that is capable of communicating with the learning device, the user terminal, and the estimation device, The learning device includes: A conversion unit that performs a predetermined conversion on the learning data based on the secret information; a learning unit that learns the estimation model based on the learning data converted by the conversion unit; a division unit that divides the secret information into first secret information to be used in the first conversion and second secret information to be used in the second conversion when the predetermined conversion is divided into two stages, a first conversion and a second conversion; having The user terminal includes: a first conversion unit that performs the first conversion based on the first secret information on input data to be estimated, to generate first converted data; having The conversion device comprises: a second conversion unit that performs the second conversion based on the second secret information on the first converted data to generate second converted data; having The estimation device includes: an estimation unit that uses the estimation model to execute an estimation process based on the second converted data and transmits an estimation result to the user terminal; An estimation system comprising:

3. 3. The estimation system according to claim 1, wherein the predetermined transformation is a transformation that follows a specific rule.

4. 3. The estimation system according to claim 1, wherein the predetermined transformation is a shuffling (SHF) transformation or a negative / positive (NP) transformation when the data to be processed is image data.

5. An estimation method executed by an estimation system having a user terminal that makes an estimation request for data, an estimation device that makes an estimation for the data, and a conversion device that is capable of communicating with the user terminal and the estimation device, a first conversion step in which the user terminal executes, on input data to be estimated, a first conversion out of a first conversion and a second conversion obtained by dividing a predetermined conversion, based on the first secret information out of first secret information and second secret information obtained by dividing a predetermined secret information, to generate first converted data; a second conversion step in which the conversion device performs the second conversion based on the second secret information on the first converted data to generate second converted data; an estimation step in which the estimation device executes an estimation process based on the second converted data using an estimation model executed based on learning data that has been subjected to the predetermined conversion based on the predetermined secret information, and transmits an estimation result to the user terminal; The estimation method according to claim 1, further comprising:

6. An estimation method executed by an estimation system having a learning device that executes learning of an estimation model, a user terminal that issues an estimation request for data, an estimation device that performs estimation on the data, and a conversion device that is capable of communicating with the learning device, the user terminal, and the estimation device, a conversion step in which the learning device performs a predetermined conversion based on secret information on the learning data; a learning step in which the learning device learns the estimation model based on the learning data converted in the conversion step; a division step in which the learning device divides the secret information into first secret information to be used in the first conversion and second secret information to be used in the second conversion when the predetermined conversion is divided into two stages, a first conversion and a second conversion; a first conversion step in which the user terminal performs the first conversion based on the first secret information on input data to be estimated, to generate first converted data; a second conversion step in which the conversion device performs the second conversion based on the second secret information on the first converted data to generate second converted data; an estimation step in which the estimation device executes an estimation process based on the second converted data using the estimation model and transmits an estimation result to the user terminal; The estimation method according to claim 1, further comprising:

7. An estimation program for causing a computer to execute the method, A computer as a user terminal that makes an estimation request for data, a first conversion step of performing a first conversion of a first conversion and a second conversion obtained by dividing a predetermined conversion on input data to be estimated based on the first secret information of the first secret information and the second secret information obtained by dividing a predetermined secret information, thereby generating first converted data; Run the command, A computer as a conversion device capable of communicating with the user terminal and the estimation device, a second conversion step of performing the second conversion based on the second secret information on the first converted data to generate second converted data; Run the command, a computer as the estimation device that transmits an estimation result for data to the user terminal, A step of executing an estimation process based on the second converted data using an estimation model executed based on the learning data on which the predetermined conversion based on the predetermined secret information has been executed, and transmitting an estimation result to the user terminal. The present invention relates to an estimation program for performing the above-mentioned steps.

8. An estimation program for causing a computer to execute the method, A computer as a learning device for executing learning of an estimation model includes: A conversion step of performing a predetermined conversion based on the secret information on the training data; a learning step of learning the estimation model based on the learning data converted in the conversion step; a division step of dividing the secret information into first secret information to be used in a first conversion and second secret information to be used in the second conversion when the predetermined conversion is divided into two stages, a first conversion and a second conversion; Run the command, A computer as a user terminal that makes an estimation request for data, a first conversion step of performing the first conversion based on the first secret information on input data to be estimated, to generate first converted data; Run the command, a computer as a conversion device capable of communicating with the learning device, the user terminal, and the estimation device, a second conversion step of performing the second conversion based on the second secret information on the first converted data to generate second converted data; Run the command, The computer as the estimation device that performs estimation on data includes: an estimation step of executing an estimation process based on the second converted data using the estimation model and transmitting an estimation result to the user terminal; The present invention relates to an estimation program for performing the above-mentioned steps.

Images