Data generation method, data generation program and data generation system

Abstract

To provide a data generation method facilitating optimum parameter design without disclosing content of data.SOLUTION: A method is used in a system comprising a user terminal including a control part and a user storage part, and an arithmetic device including a cryptography arithmetic part for executing arithmetic operations involving data encrypted by a homomorphic encryption method and a cryptographic data storage part for storing a machine learning model that outputs prediction results from parent data. The method includes: a step of causing the control part to generate a public key and a private key; a step of causing the control part to encrypt a plurality of pieces of parent data acquired from the user storage part, by the homomorphic encryption method using the public key; a next-generation generating step of causing the cryptography arithmetic part and the control part to generate a plurality of pieces of child data based on the plurality of prediction results output by inputting the plurality of pieces of encrypted parent data to the machine learning model; an updating step of causing the cryptographic data storage part to store the plurality of pieces of generated child data as a plurality of pieces of encrypted parent data; and a step of repeating the next-generation generating step and the updating step.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a data generation method, a data generation program, and a data generation system. [Background technology]

[0002] There are efforts to design optimal parameters using machine learning technology. For example, Patent Document 1 discloses an invention related to materials informatics technology for efficiently developing new substances, which discovers new material candidates from a chemical database. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special Publication No. 2022-516697 Summary of the Invention [Problem to be solved by the invention]

[0004] In recent years, in various fields, there has been a growing trend to utilize data in collaboration with external companies and organizations, rather than simply utilizing data held in-house (including information related to machine learning models). However, providing highly confidential data to other companies and utilizing it raises security issues such as information leaks and unauthorized use.

[0005] Therefore, the present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a data generation method that utilizes data held by each organization without disclosing the contents of the data, and facilitates optimal parameter design. [Means for solving the problem]

[0006] In order to achieve the above-mentioned object, the data generation method disclosed herein is a method used in a system including a user terminal having a control unit and a user memory unit that stores multiple parent data, a calculation device having a cryptographic calculation unit that performs calculations including data encrypted using a homomorphic encryption method, and an encrypted data storage unit that stores a machine learning model that outputs prediction results from the parent data, and includes a step in which the control unit generates a public key and a private key, a step in which the control unit encrypts the multiple parent data obtained from the user memory unit using the homomorphic encryption method using the public key, a next-generation generation step in which the cryptographic calculation unit and the control unit input the encrypted multiple parent data into the machine learning model and generate multiple child data based on the multiple prediction results output, an update step in which the encrypted data storage unit stores the generated multiple child data as multiple encrypted parent data, and a step in which the next-generation generation step and the update step are repeated.

[0007] In addition, in order to achieve the above-mentioned object, the data generation program disclosed herein is a program used in a system including a user terminal having a control unit and a user memory unit that stores multiple parent data, a calculation device having a cryptographic calculation unit that performs calculations including data encrypted using a homomorphic encryption method, and an encrypted data storage unit that stores a machine learning model that outputs prediction results from the parent data, and includes a step in which the control unit generates a public key and a private key, a step in which the control unit encrypts the multiple parent data obtained from the user memory unit using the homomorphic encryption method using the public key, a next-generation generation step in which the cryptographic calculation unit and the control unit input the encrypted multiple parent data into the machine learning model and generate multiple child data based on the multiple prediction results output, an update step in which the encrypted data storage unit stores the generated multiple child data as multiple encrypted parent data, and a step of repeating the next-generation generation step and the update step.

[0008] In addition, in order to achieve the above-mentioned object, the data generation system of the present disclosure is a system comprising: a user terminal having a control unit and a user memory unit that stores multiple parent data; a calculation device having a cryptographic calculation unit that performs calculations including data encrypted using a homomorphic encryption method; and an encrypted data storage unit that stores a machine learning model that outputs prediction results from the parent data, and the system comprises a step in which the control unit generates a public key and a private key; a step in which the control unit encrypts the multiple parent data obtained from the user memory unit using the homomorphic encryption method using the public key; a next-generation generation step in which the cryptographic calculation unit and the control unit generate multiple child data based on the multiple prediction results output by inputting the encrypted multiple parent data into the machine learning model; an update step in which the encrypted data storage unit stores the generated multiple child data as multiple encrypted parent data; and a step of repeating the next-generation generation step and the update step. Effect of the Invention

[0009] According to the present disclosure, it is possible to utilize data held by each organization without disclosing the contents of the data, making it easier to design optimal parameters. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is an overall view of a data generation system 1. [Diagram 2] 2 is a diagram illustrating a hardware configuration of a terminal device 100. [Diagram 3] 2 is a block diagram showing a functional configuration of a terminal device 100. FIG. [Figure 4] FIG. 4 is a diagram showing a data structure of material data. [Diagram 5] FIG. 11 is a diagram showing a specific example of material data. [Figure 6] FIG. 13 is a diagram showing an example of a screen for setting material data to be searched for. [Figure 7] FIG. 13 is a diagram illustrating an example of a screen for setting a response variable. [Figure 8] FIG. 11 is a diagram illustrating calculation of an evaluation value. [Figure 9]FIG. 2 is a block diagram showing the functional configuration of a calculation device 200. [Figure 10] FIG. 11 is a diagram illustrating an example of difficult-to-identify processing in the first embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of difficult-to-identify processing in the first embodiment. [Figure 12] FIG. 13 is a diagram illustrating an application example of a genetic algorithm. [Figure 13] 2 is a sequence diagram showing a process in the data generation system 1. FIG. [Figure 14] 2 is a sequence diagram showing a process in the data generation system 1. FIG. [Figure 15] FIG. 11 is a diagram illustrating an example of difficult-to-identify processing in the second embodiment. [Figure 16] FIG. 2 is a block diagram showing the functional configuration of a calculation device 300. [Figure 17] 10 is a sequence diagram showing a process in the data generation system 2. FIG. [Figure 18] FIG. 2 is an overall view of the data generation system 4. [Figure 19] FIG. 4 is a block diagram showing the functional configuration of a terminal device 400. [Figure 20] FIG. 5 is a block diagram showing the functional configuration of a calculation device 500. [Figure 21] 10 is a sequence diagram showing the processing in the data generation system 4. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In all drawings describing the embodiments, common components are given the same reference numerals, and repeated explanations will be omitted. Note that the following embodiments do not unduly limit the contents of the present disclosure described in the claims. In addition, not all components shown in the embodiments are necessarily essential components of the present disclosure.

[0012] <Outline of the data generation method according to the present invention> There are efforts to use machine learning technology to design optimal parameters and use them in setting delivery routes, forecasting demand, designing the shapes of industrial products, developing new substances, etc. For example, in materials informatics, predictive models are generated by machine learning using large amounts of data with the characteristics of chemical substances (composition, etc.) as explanatory variables and the properties of those chemical substances (hardness, etc.) as objective variables, reducing the effort required to actually conduct experiments to confirm the properties of new substances.

[0013] Also, as a method for searching for optimal parameters, a genetic algorithm, which is an optimization algorithm that imitates natural evolution, is known. In a genetic algorithm, a population of individuals in the parent generation is subjected to survival selection operations such as crossover and mutation to repeatedly obtain a population of offspring generations to search for better individuals. For example, by using a chemical substance having parameters searched for by such an algorithm and the above-mentioned prediction model, it is possible to efficiently develop new substances.

[0014] In recent years, there has been a growing trend to collaborate with external companies and utilize the data that each company possesses, and a method for collaborating on data while keeping highly confidential data secret from other companies is desired. According to the data generation method of the present invention, the model provider who provides the predictive model does not disclose to the model user the data of the offspring generation in the middle of being generated by the genetic algorithm, so that the model user can use the predictive model without being guessed. In addition, the model user can obtain the final optimal solution without disclosing the data to be predicted to the model provider.

[0015] Specifically, this is achieved by using homomorphic encryption, which allows calculations to be performed while the data is encrypted. However, if all calculation steps are performed while the data is encrypted, the calculation costs will be enormous. Therefore, in order to prevent model users from guessing the prediction model, the survival selection operation for the parent generation population in the genetic algorithm is performed after a process that makes it difficult to identify the correct correspondence between the input and output of the prediction model, and a child generation population is generated based on the evaluation value of the prediction result.

[0016] This allows the generation of children to be generated efficiently in the genetic algorithm, reducing the calculation cost, and also prevents the prediction model from being guessed by the model user.

[0017] <Embodiment 1> In the data generation system 1 of this embodiment, as described above, the survival selection operation for the parent generation population in the genetic algorithm is performed by rearranging the correspondence between the input (data to be predicted) and output (prediction result) of the prediction model, making it difficult to identify the correspondence between them so that the model user cannot guess the prediction model.

[0018] (Configuration of data generation system 1) Fig. 1 is an overall view of a data generating system 1. The overall view of the data generating system 1 according to this embodiment will be described with reference to Fig. 1.

[0019] The data generation system 1 according to this embodiment includes one or more terminal devices 100 used by a user, and a calculation device 200. The terminal devices 100 and the calculation device 200 are communicably connected via a network NW. The network NW is composed of a WAN (Wide Area Network), a LAN (Local Area Network), or the like. In the data generation system 1, a user who wishes to search for a new substance uses, via the terminal device 100, a calculation device 200 that provides a prediction model owned by another organization or the like.

[0020] The terminal device 100 accepts an input from a user and transmits the input content to the arithmetic device 200 via the network NW. The terminal device 100 also receives data transmitted from the arithmetic device 200 via the network NW and presents it to the user.

[0021] The arithmetic device 200 is a server of a model provider (or a platform provider of the data generation system 1) that provides a prediction model. The arithmetic device 200 performs arithmetic processing such as machine learning inference processing and searching for new substances using a genetic algorithm on the data transmitted from the terminal device 100 while keeping the data encrypted.

[0022] (Hardware configuration of terminal device 100) Fig. 2 is a diagram showing a hardware configuration of the terminal device 100. The hardware configuration of the terminal device 100 according to this embodiment will be described with reference to Fig. 2.

[0023] The terminal device 100 is a user terminal used by a user, and may be realized, for example, by a general-purpose computer such as a desktop or laptop PC (Personal Computer), or may be realized by a smartphone or a tablet.

[0024] The terminal device 100 includes a processor 11, a memory 12, a storage 13, a communication IF 14, and an input / output IF 15.

[0025] The processor 11 is hardware for executing an instruction set written in a program, and is composed of an arithmetic unit, a register, peripheral circuits, and the like.

[0026] The memory 12 is for temporarily storing programs and data to be processed by the programs, etc. The memory 12 is realized by a volatile memory such as a DRAM (Dynamic Random Access Memory). The programs stored in the memory 12 are programs for executing the data generating method according to the present invention, etc.

[0027] The storage 13 is a storage device for saving data and is realized by, for example, a flash memory, a hard disc drive (HDD), etc.

[0028] The communication IF 14 is an interface for transmitting and receiving signals so that the terminal device 100 can communicate with an external device, for example, a wireless communication device for wireless communication, a Universal Serial Bus (USB) connector for serial communication, or the like.

[0029] The input / output IF 15 is an interface between an input device for receiving input from a user and an output device for presenting information to the user. The input device is realized by, for example, a keyboard, a mouse, a touch panel, a button, a microphone, etc. The output device is realized by, for example, a display, a printer, a speaker, etc.

[0030] The hardware configuration of the arithmetic device 200 may be the hardware configuration of the terminal device 100 shown in Fig. 2. The arithmetic device 200 may be realized by a general-purpose computer such as a workstation, a server computer, a stationary PC (Personal Computer), a laptop PC, or the like, or may be logically realized by cloud computing. The operation of each component of the arithmetic device 200 is realized by the processor 11 following a program stored in the memory 12, similar to the terminal device 100 described above.

[0031] (Functional configuration of terminal device 100) Fig. 3 is a block diagram showing a functional configuration of the terminal device 100. The functional configuration of the terminal device 100 according to this embodiment will be described with reference to Fig. 3.

[0032] The terminal device 100 includes a communication unit 110, an input unit 120, an output unit 130, a storage unit 140, and a control unit 150.

[0033] The communication unit 110 performs processing for the terminal device 100 to communicate with the arithmetic device 200 or other devices. The other devices may be a PC connected via a network, or may be a smartphone, tablet, or XR (Cross Reality) (AR: Augmented Reality, MR: Mixed Reality, VR: Virtual Reality) terminal. The other devices may also be input / output devices, such as a flash memory or HDD, that input and output data.

[0034] The communication unit 110 also transmits and receives data through a secure communication channel with devices connected via the network NW or locally, etc. The construction of a secure communication channel and the communication method are well-known techniques using a common key (such as a session key) or a public key, so a description thereof will be omitted.

[0035] The input unit 120 is an interface that accepts user input of the terminal device 100. The input unit 120 is, for example, but not limited to, a keyboard, a touch panel, a display panel in a virtual space, or a microphone that detects voice input. A user can input parameters and the like required for searching for a new substance via the input unit 120. The parameters include, for example, explanatory variables of the search target, search constraint conditions, objective variables to be predicted, target values ​​of the objective variables, and priorities (weights).

[0036] A search stop condition may be input. The search stop condition may be, for example, the number of generations generated by a genetic algorithm, a threshold value of an evaluation value (described later), or a maximum execution time required for a search. Input examples will be described with reference to Figs. 6 and 7.

[0037] The output unit 130 is an interface that outputs information to notify the user of the terminal device 100. The output unit 130 is, for example, a display or a speaker that outputs audio, but is not limited to these. The output unit 130 displays data received from the arithmetic device 200 or the like on a display.

[0038] The storage unit 140 is configured, for example, with a volatile memory such as a RAM, a flash memory, a HDD, etc., and stores data used by the terminal device 100 and computer programs used for various processes. The computer programs may be installed from a predetermined server or the like, or may be installed from a computer-readable portable recording medium using a known setup program or the like. The portable recording medium is, for example, a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), etc.

[0039] The storage unit 140 functions as a “user storage unit”, and includes a key storage unit 141 and a material database 142 .

[0040] The key storage unit 141 stores a public key and a private key generated by the control unit 150, which will be described later. The public key and the private key may be managed in a secure key management system (KMS) that is connected to the terminal device 100 via a network or directly. The key storage unit 141 may store a plurality of pairs of a public key and a private key, or may store a key for communication (session key).

[0041] The material database 142 is a database that stores multiple pieces of material data. The multiple pieces of material data are unknown material data to be searched for, but may also include known material data. The material database 142 stores the multiple pieces of material data to be searched for as multiple parent data for a genetic algorithm. The material database 142 may also store material data (child data) that is the result of the search.

[0042] The material data includes information indicating a plurality of characteristics of the material and information regarding a plurality of properties. The data structure of the material data will be described with reference to FIG.

[0043] The control unit 150 is a processor such as a CPU (Central Processing Unit) that controls each function of the terminal device 100 and operates based on a program stored in the storage unit 140 in advance.

[0044] The control unit 150 includes a key generation unit 151 , an encryption / decryption unit 152 , and an evaluation value calculation unit 153 .

[0045] The key generation unit 151 generates a pair of a public key and a private key for encrypting data or for decrypting encrypted data. The generated public key and private key are stored in the key storage unit 141.

[0046] The encryption / decryption unit 152 encrypts the multiple parent data stored in the material database 142 by homomorphic encryption using the generated public key. Examples of homomorphic encryption include the Paillier scheme, the Lifted-ElGamal scheme, the Somewhat Homomorphic Encryption scheme, and the Fully Homomorphic Encryption scheme. As described above, the material data includes information indicating multiple characteristics of the material, and the encryption / decryption unit 152 encrypts each value of each characteristic.

[0047] Moreover, the encryption / decryption unit 152 decrypts the encrypted data received from the arithmetic device 200 using a private key paired with the public key.

[0048] The evaluation value calculation unit 153 calculates an evaluation value for a target value from a prediction result (prediction value) output by a prediction model (described later) of the arithmetic device 200. The evaluation value is a value indicating the degree of difference between two values, and may be evaluated by a well-known method such as using an absolute difference, a squared difference, a relative error, a specific index, weighting, or the like. In this embodiment, the evaluation value is the absolute difference between the prediction result and the target value. For example, when the prediction result is "20" and the target value is "24", the evaluation value is the absolute difference between the target value and the prediction result, "4" (=|20-24|).

[0049] 4 is a diagram showing the data structure of the material data, which will be described with reference to FIG.

[0050] The material data 1000 includes a material ID 1100, information 1200 indicating the characteristics of the material, and information 1300 indicating the properties of the material.

[0051] The material ID 1000 is an identifier for identifying each of a plurality of material data.

[0052] The information 1200 indicating the characteristics of the material is, for example, a substance constituting the material, and is expressed as a plurality of explanatory variables x1 to xn. For each piece of material data, numerical values ​​such as experimental values ​​and calculated values ​​are input as information indicating the characteristics of the material. Note that the explanatory variables are not limited to information indicating the characteristics of the material, and may include information indicating process conditions (temperature, pressure, time, etc.) in the reaction process or production process of the material.

[0053] The information 1300 indicating the characteristics of the material is, for example, the physical characteristics, chemical characteristics, mechanical characteristics, and electrical characteristics of the material, such as the density, hardness, conductivity, and strength of the material, and is expressed as a plurality of objective variables y1 to ym.

[0054] When the material data identified by the material ID 1100 is unknown material data to be searched for, a symbol or the like indicating that the information is unknown is input into the information indicating the material characteristics 1300. On the other hand, when the material identified by the material ID 1100 is a known material, a numerical value such as an experimental value or a calculated value of the characteristic is input into the information indicating the material characteristics 1300.

[0055] As described in FIG. 3, in the example of FIG. 4, the encryption / decryption unit 152 of the terminal device 100 encrypts each cell (explanatory variable) of the unknown material data to be searched.

[0056] 5 is a diagram showing a specific example of material data A specific example of material data stored in the material database 142 will be described with reference to FIG.

[0057] The material data 2000 is a data set including a material ID, a material feature (explanatory variable), and a material property (objective variable).

[0058] In the example of Fig. 5, the characteristics of the material include "raw material A", "raw material B", "raw material C" ..., "additive X", "additive Y", and "additive Z" that make up the material. In addition, the characteristics of the material include the "viscosity" of the material. Note that, although there is one objective variable in the example of Fig. 5, there may be multiple objective variables.

[0059] For each material ID that identifies a material, the characteristics (explanatory variables) of the material are associated with the properties (objective variables). Numerical values, such as experimental values, that indicate the characteristics of each material are input into the explanatory variables. "NULL," indicating that no numerical value exists, is input into the objective variable of the material data to be searched, but a numerical value is input into the objective variable of a known material.

[0060] The material data identified by the material IDs "1" to "5" are the material data to be searched, and "NULL" is input as the objective variable, viscosity. Specifically, when the material ID is "1", the following are input: raw material A is "80", raw material B is "0", raw material C is "0", ..., additive X is "4", additive Y is "0", additive Z is "8", and viscosity is "NULL". The material data to be searched is stored in the material database 142 as parent data for the genetic algorithm. In other words, the multiple parent data are a data set in which records including values ​​corresponding to multiple explanatory variables are arranged in a predetermined order.

[0061] Material data identified by material IDs "51" to "55" are known material data, and numerical values ​​are input to the explanatory variables and the objective variables. Specifically, when the material ID is "51", raw material A is "40", raw material B is "0", raw material C is "0", ..., additive X is "2", additive Y is "0", additive Z is "8", and viscosity is "10". The known material data may be, for example, material data that has been searched, or material data whose actual measured values ​​are known in advance. The known material data may be used as training data for machine learning.

[0062] 6 is a diagram showing an example of a screen for setting material data to be searched for. A setting example of material data to be searched for will be described with reference to FIG.

[0063] The screen 3000 includes information 3100 indicating the characteristics of the material, a selection field 3200, and information 3300 indicating the range. The screen 3000 is displayed, for example, on the output unit 130 of the terminal device 100. The user inputs parameters necessary for searching for material data via the input unit 120.

[0064] The information 3100 indicating the material indicates the characteristics (explanatory variables) of the material data. For example, in the example of Fig. 6, all the explanatory variables shown in Fig. 5 are shown, but only specific variables among the explanatory variables may be shown, or the user may be prompted to input the explanatory variables or to select them from a pull-down menu.

[0065] A selection column 3200 shows check boxes for selecting explanatory variables to be optimized among explanatory variables. In the example of Fig. 6, "Additive X", "Additive Y", and "Additive Z" are selected as the optimization targets.

[0066] The information 3300 indicating the range indicates the constraint condition of the explanatory variable selected as the target for optimization. In the example of Fig. 6, the user can input a minimum value and a maximum value as parameters and set to execute optimization within the range of these values. That is, in the example of Fig. 6, it is set to search for material data in which, among the characteristics of the material, "additive X" is in the range of "0 to 10", "additive Y" is in the range of "2 to 5", and "additive Z" is in the range of "0 to 3".

[0067] 7 is a diagram showing an example of a screen for setting a response variable. A setting example of a response variable to be predicted will be described with reference to FIG.

[0068] The screen 4000 includes information 4100 indicating the objective variables, a selection field 4200, information 4300 indicating the target values, and information 4400 indicating the weights. The screen 4000 is displayed, for example, on the output unit 130 of the terminal device 100. The user inputs parameters necessary for setting the objective variables via the input unit 120.

[0069] The information 4100 indicating the objective variables indicates the characteristics (objective variables) of the material data. For example, in the example of Fig. 7, the material characteristics such as strength, solubility, ..., viscosity, conductivity, and resistance are shown. Note that the objective variables may be input by the user, or may be selected by a pull-down display.

[0070] A selection field 4200 shows check boxes for selecting the objective variables to be predicted. In the example of Fig. 7, "solubility" and "viscosity" are selected as the objects to be predicted. Note that multiple objective variables may be selected, or only one may be selected.

[0071] The information 4300 indicating the target value indicates the target value of the objective variable, and sets the final value of the objective variable of the searched material data. In the example of Fig. 7, the target values ​​are set as "10" for "solubility" and "40" for "viscosity".

[0072] The weighting information 4400 is a parameter indicating which objective variable is to be emphasized when multiple objective variables are selected. In the example of Fig. 7, for the weighting range of 0 to 100, "40" is input for "solubility" and "60" for "viscosity". In other words, it is set so that material data is searched for with emphasis on "viscosity".

[0073] Fig. 8 is a diagram for explaining calculation of an evaluation value. With reference to Fig. 8, an example of a method in which the evaluation value calculation unit 153 of the control unit 150 in the terminal device 100 calculates an evaluation value will be described.

[0074] The example in FIG. 8 shows the evaluation value for each material ID when viscosity is the objective variable and its target value is "40." The evaluation value represents the distance (absolute difference) between the target value and the predicted value of the objective variable. For material ID "11," the predicted viscosity value is "20," so the distance from the target value "40," that is, "20" (=|40-20|), is calculated as the evaluation value.

[0075] Similarly, for material ID "13," the predicted viscosity value is "50," so the distance from the target value "40," that is, "10" (=|40-50|), is calculated as the evaluation value.

[0076] In the example of FIG. 8, among the material IDs "11" to "15," the evaluation value of the material ID "14" is "0," indicating that the predicted value of the objective variable of the material ID "14" achieves the target value.

[0077] (Functional configuration of the arithmetic device 200) Fig. 9 is a block diagram showing a functional configuration of the arithmetic device 200. The functional configuration of the arithmetic device 200 according to the first embodiment will be described with reference to Fig. 9.

[0078] The arithmetic device 200 includes a communication unit 210, an input unit 220, an output unit 230, a storage unit 240, and a control unit 250.

[0079] The communication unit 210 performs processing for the arithmetic device 200 to communicate with the terminal device 100 and other devices. The communication unit 210 has the same function as the communication unit 110 of the terminal device 100, and therefore a duplicated description will be omitted.

[0080] The input unit 220 is an interface that accepts user input to the arithmetic device 200. The input unit 220 is, for example, a keyboard, a touch panel, or a microphone that detects voice input, but is not limited to these.

[0081] The output unit 230 is an interface that outputs information to notify a user of the arithmetic device 200. The output unit 230 is, for example, a display or a speaker that outputs audio, but is not limited to these. For example, the output unit 230 displays data received from the terminal device 100 or the like on a display.

[0082] The storage unit 240 is configured, for example, with a volatile memory such as a RAM, a flash memory, a HDD, etc., and stores data used by the arithmetic device 200 and computer programs used for various processes. The storage unit 240 has the same function as the storage unit 140 of the terminal device 100, so a duplicated description will be omitted.

[0083] The storage unit 240 functions as an “encryption data storage unit”, and includes a model database 241 and a parent data storage unit 242 .

[0084] The model database 241 stores a prediction model constructed by machine learning using material data having material features as explanatory variables and material properties as objective variables as training data. Specifically, the training data is a data set in which, for each of a plurality of material data, values ​​of a plurality of explanatory variables related to the material features are associated with values ​​of one or a plurality of objective variables related to the material properties.

[0085] The prediction model is a machine learning model that outputs a prediction result from parent data acquired from the terminal device 100. The model database 241 may store a plurality of prediction models. The prediction models may have different model construction algorithms, such as linear regression, logistic regression, support vector machine (SVM), and neural network, different amounts of teacher data, different labeling accuracy, different selection of explanatory variables, different preprocessing, and different learning process parameters.

[0086] The parent data storage unit 242 stores encrypted parent data acquired from the terminal device 100. The parent data storage unit 242 also updates and stores child data generated in the next-generation generation unit 252 (described later) as parent data. The parent data acquired from the terminal device 100 is, in other words, material data to be searched for.

[0087] The control unit 250 is a processor such as a CPU (Central Processing Unit) that controls each function of the arithmetic device 200 and operates based on a program stored in the storage unit 240 in advance.

[0088] The control unit 250 functions as an “encryption calculation unit” that performs calculations including data encrypted by homomorphic encryption, and has a prediction unit 251 , a next-generation generation unit 252 , and an identification-obfuscation unit 253 .

[0089] The prediction unit 251 outputs a prediction result of the objective variable based on the prediction model of the model database 241 from the parent data encrypted by the homomorphic encryption method. Specifically, the prediction unit 251 selects a prediction model of the model database 241 according to the objective variable set in the terminal device 100. Then, the prediction unit 251 encrypts the prediction model by the homomorphic encryption method using the public key of the terminal device 100. Next, the prediction unit 251 inputs the parent data to the encrypted prediction model and outputs a predicted value of the objective variable. The output predicted value is encrypted by the homomorphic encryption method using the public key of the terminal device 100, and is not disclosed to the user of the arithmetic device 200.

[0090] The next generation generation unit 252 applies a genetic algorithm to a plurality of parent data satisfying a predetermined condition from among the plurality of encrypted parent data, thereby generating a plurality of child data. The predetermined condition may be, for example, data having an evaluation value within the top 10, or data having an evaluation value within a predetermined threshold value. In addition, the genetic algorithm may be applied to parent data randomly selected from the data satisfying the conditions, or the genetic algorithm may be applied to a plurality of parent data including the randomly selected parent data and parent data extracted based on the evaluation value. The generation of child data by applying a genetic algorithm is outlined in FIG. 12, but since the genetic algorithm is a well-known technology, a detailed description is omitted here.

[0091] The difficult-to-identify unit 253 performs a process of rearranging the correspondence between the input (parent data) and the output (prediction result) to the prediction model. The difficult-to-identify unit 253 also performs a process of returning the rearranged correspondence to its original state (cancellation of the difficult-to-identify process). By performing the rearrangement process, the correct correspondence between the input and output for the prediction model can be concealed, and therefore the prediction model can be prevented from being estimated.

[0092] In addition, the difficult-to-identify unit 253 may perform a process of rearranging the correspondence between explanatory variables included in multiple child data (material data). This makes it possible to conceal the correct correspondence between child data (input) and output, thereby preventing the prediction model from being estimated. A specific example of the rearrangement process will be described in FIG. 10 and FIG. 11.

[0093] Fig. 10 is a diagram showing an example of the difficult-to-identify processing in embodiment 1. As the difficult-to-identify processing, a process of rearranging the correspondence relationships between explanatory variables and objective variables of material data will be described with reference to Fig. 10.

[0094] Material data 5100 is a data set in which explanatory variables related to the characteristics of a material correspond to objective variables related to the properties of the material. Material ID 5110 and material ID 5120 indicate the same identifier. For example, the explanatory variables of material ID "1" correspond to the objective variables of material ID "1".

[0095] The material data 5200 is a data set after performing a process of rearranging the correspondence between explanatory variables and objective variables as a process of making the material data 5100 difficult to identify. The material ID 5210 corresponds to the material ID 5110 and indicates the same identifier. The material ID 5220 is obtained by rearranging the identifiers (numbers) of the material ID 5120. For example, the explanatory variable of the material ID "1" is associated with the objective variable of the material ID "4" (viscosity "30"), not the objective variable of the material ID "1" (viscosity "20"). Similarly, the explanatory variable of the material ID "2" is associated with the objective variable of the material ID "1" (viscosity "20"), not the objective variable of the material ID "2" (viscosity "10"). In this way, the process of making the material data difficult to identify rearranges the correspondence between the explanatory variables and objective variables. After the rearrangement, a new identifier may be assigned, for example, as the provisional material ID 5230.

[0096] When transmitting the prediction results to the terminal device 100, the rearranged prediction results are transmitted, so that the terminal device 100 cannot identify the correct predicted value of the objective variable corresponding to the explanatory variable for the material ID. In other words, since the user of the terminal device 100, who is the model user, cannot obtain material data consisting of explanatory variables and objective variables, it is difficult for the user to infer a prediction model based on this material data. Therefore, the model provider can allow the model user to use the prediction model without inferring the prediction model.

[0097] Furthermore, the difficult-to-identify unit 253 can cancel the difficult-to-identify process by storing the correspondence between the material ID 5220 and the temporary material ID 5230.

[0098] Fig. 11 is a diagram showing an example of the difficult-to-identify processing in embodiment 1. With reference to Fig. 11, a process of rearranging the correspondence relationships of explanatory variables of material data will be described as the difficult-to-identify processing.

[0099] The material data 5300 is a data set of parent data composed of explanatory variables related to the characteristics of the material. The material data 5400 is a data set in which the explanatory variables of the material data 5300 have been subjected to difficult-to-identify processing.

[0100] As the difficult-to-identify process, the values ​​corresponding to the explanatory variable "raw material A" of each material ID are rearranged for the material data 5300. For example, the values ​​corresponding to "raw material A" of material IDs "21" to "25" are "80", "10", "20", "70", and "30", respectively, but by rearrangement, the values ​​corresponding to "raw material A" are "10", "80", "70", "30", and "20". Similarly, the values ​​corresponding to "raw material B" of material IDs "21" to "25" are "10", "80", "20", "30", and "70", respectively, but by rearrangement, the values ​​corresponding to "raw material B" are "20", "30", "10", "70", and "80", respectively.

[0101] In this way, rearranging the correspondences of the explanatory variables results in a data set indicated by material data 5400. That is, for example, material data identified by material ID "21'" is composed of "raw material A" at "10," "raw material B" at "20," "raw material C" at "80," ..., "additive X" at "0," "additive Y" at "6," and "additive Z" at "0." By executing the difficult-to-identify process on material data 5300, the material data identified by material ID "21" becomes difficult to identify from material data 5400.

[0102] 11, the correspondence relationships of all explanatory variables of the material data 5300 are rearranged, but if it becomes difficult to identify each material data, the difficult-to-identify process may be executed only for some explanatory variables. Also, the difficult-to-identify unit 253 can cancel the difficult-to-identify process by storing the correspondence relationships between each explanatory variable and the rearranged material ID.

[0103] Fig. 12 is a diagram showing an application example of a genetic algorithm. With reference to Fig. 11, a process of generating child data (material ID "C1" and material ID "C2") from parent data (material ID "1" and material ID "5") by a genetic algorithm in the case of optimizing explanatory variables "additive X", "additive Y", and "additive Z" of the material data 6100 will be described.

[0104] In a genetic algorithm, two of the N individuals (each piece of material data) in the parent generation are selected and crossed over, or one is selected and mutated, or copied as is, and this process is repeated until the number of individuals in the child generation reaches N. Once there are N individuals in the child generation, the child generation is updated as the parent generation and the same process is repeated. For example, after repeating the process a specified number of times, the individual in the parent generation with the best evaluation value (i.e., close to the target value) is output as the "solution."

[0105] 12, when one-point intersection is performed for the material data of material ID "1" and material ID "5," the intersection location is selected randomly. In the material data 6100, the intersection location between additive X and additive Y is set as intersection point L1.

[0106] Then, the data after the intersection point L1 is swapped. In the material data 6100, if the data is arranged from raw material A to additive Z, the values ​​of "additive Y" and "additive Z" of material ID "1" after the intersection point L1 are swapped with the values ​​of "additive Y" and "additive Z" of material ID "5".

[0107] Material data 6200 is child data (material ID "C1" and material ID "C5") generated by crossover. Through crossover, material data with compositions different from material ID "1" and material ID "5" are generated for "additive X", "additive Y", and "additive Z".

[0108] (Processing in data generation system 1) Fig. 13 is a sequence diagram showing processing in the data generation system 1. With reference to Fig. 13, a process will be described in which, in the data generation system 1, next-generation child data is generated (next-generation generation step) from material data (parent data) of a search target input to the terminal device 100, and the child data is updated as parent data (update step).

[0109] FIG. 13 illustrates an example of processing in the terminal device 100 and the arithmetic device 200 (particularly, the prediction unit 251, the next-generation generation unit 252, and the identification-compromising unit 253).

[0110] In step S100, parameters and the like are set in the data generation system 1. Specifically, the key generation unit 151 of the terminal device 100 generates a public key and a private key, and stores them in the key storage unit 141 of the storage unit 140. In addition, the terminal device 100 transmits the generated public key to the calculation device 200, and the calculation device 200 stores the public key in the storage unit 240.

[0111] Furthermore, the terminal device 100 acquires parameters necessary for searching for material data. The parameters are, for example, an objective variable, a target value, and an explanatory variable to be optimized. The parameters may also be a stop condition such as the number of times the next generation step and the update step are repeated in the arithmetic device 200, or a maximum execution time of an algorithm. The stop condition may be set in advance as an optimal condition by the developer of the data generation system 1, and may be changed by the user of the terminal device 100 as appropriate.

[0112] Moreover, the terminal device 100 acquires a plurality of pieces of material data to be searched for as a plurality of parent data, and stores them in the material database 142 of the storage unit 140.

[0113] In step S101, the encryption / decryption unit 152 of the terminal device 100 reads out a plurality of parent data to be searched from the material database 142, and encrypts the parent data by homomorphic encryption using the generated public key. The parent data is encrypted in explanatory variable units (cell units).

[0114] In step S102, the communication unit 210 of the arithmetic device 200 acquires the plurality of parent data encrypted by the terminal device 100, and the parent data storage unit 242 stores the acquired plurality of parent data.

[0115] In step S103, the prediction unit 251 of the calculation device 200 predicts the properties of the material. Specifically, the prediction unit 251 reads a prediction model corresponding to the objective variable set in step S100 from the model database 241. Then, the prediction unit 251 inputs a plurality of parent data, which are material data to be searched, to the prediction model, and outputs a plurality of prediction results (predicted values) corresponding to each of the parent data. Note that the prediction model is encrypted with a public key (i.e., the public key used in encrypting the parent data) obtained from the terminal device 100 so that the prediction model has the same encryption space as the encrypted plurality of parent data. This allows efficient calculation and output of the prediction result.

[0116] In step S104 , the identification-compromising unit 253 acquires the multiple prediction results output by the prediction unit 251 .

[0117] In step S105, the difficult-to-identify unit 253 executes a difficult-to-identify process for the output prediction results, which makes it difficult to identify the prediction results corresponding to the parent data. Specifically, the difficult-to-identify unit 253 performs a process of rearranging the correspondence between the input (explanatory variables) and the output (target variables) of the prediction model, as shown in Fig. 10. The difficult-to-identify unit 253 stores the rearranged correspondence.

[0118] In step S106, the communication unit 110 of the terminal device 100 acquires, via the communication unit 210 of the arithmetic device 200, a plurality of prediction results on which the identification-hardening process has been executed.

[0119] In step S107, the encryption / decryption unit 152 of the terminal device 100 reads the private key from the key storage unit 141, and uses the private key to decrypt the acquired multiple prediction results on which the identification-compromising process has been performed. The prediction results are disclosed to the user of the terminal device 100, but since the correspondence between the explanatory variables of the parent data and the objective variables (prediction results) is rearranged in step S105, it is not possible for the user to know which parent data the prediction result corresponds to. In other words, since the input and output of the prediction model are not disclosed to the user of the terminal device 100 in the correct correspondence, it is difficult for the user to infer the prediction model. The provider of the prediction model can allow the model user to utilize the prediction model while keeping it confidential.

[0120] In step S108, the evaluation value calculation unit 153 of the terminal device 100 calculates, from the decoded prediction results, a plurality of evaluation values ​​for the target values ​​of the plurality of prediction results. Specifically, the evaluation value calculation unit 153 calculates the distance between the target value set in step S100 and the prediction result (predicted value). Note that, in this embodiment, the absolute difference is calculated as the distance, but any method may be used for calculation as long as the value indicates how much the target value and the predicted value differ.

[0121] In step S109, the difficult-to-identify unit 253 of the arithmetic device 200 acquires the multiple evaluation values ​​calculated in step S108 via the communication unit 210. The multiple evaluation values ​​are transmitted to the arithmetic device 200 in a manner that allows the correspondence between the evaluation values ​​and the prediction results used to calculate the evaluation values ​​to be known. For example, an identifier corresponding to an ID that identifies the prediction results may be assigned to the evaluation values, and transmitted to the arithmetic device 200 together with the correspondence between the evaluation values ​​and the prediction results.

[0122] Since the evaluation value is not encrypted in the terminal device 100, the evaluation value is disclosed to the user of the calculation device 200. However, the explanatory variables of the material data input to the prediction model and the prediction results cannot be obtained from the evaluation value. In other words, since the user of the calculation device 200 is not informed of the characteristics (objective variables) of the material data with respect to the features (explanatory variables), it is difficult to obtain the material data to be predicted. The model user can use the prediction model while concealing the material data to be searched from the model provider.

[0123] In step S110, the difficult-to-identify unit 253 of the arithmetic device 200 cancels the difficult-to-identify process for the multiple prediction results corresponding to the multiple acquired evaluation values. Specifically, the difficult-to-identify unit 253 executes a process of restoring the correspondence relationships rearranged in step S105 to the original, and makes the prediction results for the explanatory variables of the parent data have the correct correspondence relationships.

[0124] In step S111, the next-generation generating unit 252 of the calculation device 200 obtains a plurality of evaluation values ​​corresponding to a plurality of parent data through a plurality of prediction results from which the difficult-to-identify process has been released. Since the parent data and the prediction results correspond to each other, and the prediction results and the evaluation values ​​calculated from the prediction results correspond to each other, it is possible to obtain the evaluation values ​​corresponding to the parent data through the prediction results.

[0125] In step S112, the next generation generating unit 252 generates the next generation. Specifically, the next generation generating unit 252 extracts a plurality of parent data corresponding to evaluation values ​​that satisfy a predetermined condition. Then, a genetic algorithm is applied to the extracted plurality of parent data to generate a plurality of child data. The predetermined condition may be, for example, that the evaluation value is within the top 10 or that the evaluation value is within a predetermined threshold. An example of application of the genetic algorithm is as shown in FIG. 11. Since the material data is encrypted for each explanatory variable, the generated child data is not disclosed to the user of the arithmetic device 200.

[0126] In step S113, the identification-compromising unit 253 acquires the multiple child data items that have been generated.

[0127] In step S114, the difficult-to-identify unit 253 executes a difficult-to-identify process on the explanatory variables of the generated child data. Specifically, as described in FIG. 11, the correspondence relationship of the explanatory variables included in each child data is rearranged.

[0128] In step S115, the communication unit 110 of the terminal device 100 acquires a plurality of child data items for which the identification-hardening process has been executed.

[0129] In step S116, the encryption / decryption unit 152 of the terminal device 100 re-encrypts the multiple child data. Specifically, the encryption / decryption unit 152 reads a private key from the key storage unit 141, and uses the private key to decrypt the multiple child data acquired in step S115. Furthermore, the encryption / decryption unit 152 reads a public key from the key storage unit 141, and re-encrypts the decrypted multiple child data by homomorphic encryption using the public key. The child data is encrypted in units of explanatory variables.

[0130] The re-encryption process performed in step S116 is necessary to control errors accumulated during the process of operations using homomorphic encryption and to continue to execute operations efficiently. For the re-encryption process, the child data is decrypted in step S116, but even if the child data is decrypted, the user of the terminal device 100 cannot identify the child data because the child data has been subjected to the identification-obfuscation process in step S114.

[0131] In step S117, the identification-obfuscating unit 253 of the arithmetic device 200 acquires the re-encrypted child data via the communication unit 210.

[0132] In step S118, the difficult-to-identify unit 253 cancels the difficult-to-identify process for the explanatory variables of the multiple child data. Specifically, the unit 253 performs rearrangement to return the correspondence relationship of the explanatory variables executed in step S114 to the original.

[0133] In step S119, the next-generation generating unit 252 of the arithmetic device 200 acquires a plurality of child data items for which the difficult-to-identify processing has been cancelled.

[0134] In step S120, the next-generation generation unit 252 updates the child data as parent data. Specifically, the next-generation generation unit 252 stores the child data acquired in step S119 in the parent data storage unit 242. That is, the parent data storage unit 242 stores the multiple child data as multiple encrypted parent data.

[0135] In step S121, the prediction unit 251 of the arithmetic device 200 obtains a plurality of encrypted parent data.

[0136] As described above, the processes from step S103 to step S119 are a next-generation generation step in which the control unit 250 of the calculation device 200 and the control unit 150 of the terminal device 100 generate multiple child data based on multiple prediction results output by inputting multiple encrypted parent data into a machine learning model. Step S120 is an update step in which the parent data storage unit 242 of the calculation device 200 stores the multiple generated child data as multiple encrypted parent data.

[0137] After step S121, the processes performed in steps S103 to S120 are repeated to repeatedly generate child data of the next generation.

[0138] The re-encryption process performed in step S116 may be omitted if the operation using homomorphic encryption can be executed in a practical time depending on the homomorphic encryption algorithm, the processing performance of the arithmetic device 200, etc. When the re-encryption process is omitted, the multiple child data generated by the next-generation generation unit 252 in step S112 are then updated as parent data in step S120. That is, since the re-encryption process is not performed in the terminal device 100 (the child data is not decrypted), it is not necessary to execute the identification obfuscation process to conceal the child data, and the processes of steps S113 to S119 can be omitted.

[0139] Fig. 14 is a sequence diagram showing the processing in the data generating system 1. The processing for outputting the searched material data, which is performed after the processing shown in Fig. 13, will be described with reference to Fig. 14.

[0140] In step S200, a step of repeating a next-generation generating step and an updating step is performed between the terminal device 100 and the arithmetic device 200. The number of repetitions may be input as a setting parameter in step S100 of FIG.

[0141] In step S201, the prediction unit 201 of the arithmetic device 200 acquires the multiple parent data items updated in step S200 (that is, the multiple child data items generated), inputs them to a prediction model, and outputs a prediction result.

[0142] In step S202, the communication unit 110 of the terminal device 100 acquires, as a search result by the genetic algorithm, the multiple parent data input to the prediction model in step S201 and the prediction results corresponding to the parent data.

[0143] In step S203, the encryption / decryption unit 152 of the terminal device 100 reads the private key from the key storage unit 141, and decrypts the obtained parent data and prediction result.

[0144] Through the above process, the user of the terminal device 100 can obtain the material data to be searched and the predicted value of the objective variable predicted from the material data.

[0145] In the data generation system 1 according to this embodiment, the search target is material data, but it is also possible to search for other parameters, for example, parameters related to design (shape, appearance, dimensions, etc.), specifications (functionality, performance, standards, etc.), delivery route optimization, and demand forecasting in the manufacturing process of industrial products.

[0146] (Explanation of effect) According to the data generation method of the present invention, homomorphic encryption is used, which allows calculations to be performed on data while it is encrypted, and unknown material data is searched for by using material data generated by a genetic algorithm and a prediction model that predicts the characteristics of the material data. Here, a survival selection operation for a parent generation population in the genetic algorithm is performed after execution of a process that makes it difficult to identify the correspondence between the input (data to be predicted) and output (prediction result) of the prediction model, and a child generation population is generated based on an evaluation value for the prediction result. This makes it possible to prevent model users from guessing the prediction model, and the provider of the prediction model can allow model users to utilize the prediction model while keeping it confidential.

[0147] Furthermore, in the genetic algorithm, the next generation population can be generated efficiently, and the calculation cost can be reduced.

[0148] In addition, model users can use the predictive model without disclosing the data to be predicted to the model provider (or platform provider).

[0149] Furthermore, according to the data generation method of the present invention, the process of making it difficult to identify is realized by rearranging the correspondence relationships, which makes it possible to conceal sensitive data while reducing calculation costs compared to encryption using an encryption key.

[0150] Furthermore, according to the data generation method of the present invention, in the re-encryption process required to control errors accumulated during the computation using homomorphic encryption and continue to efficiently execute computation, an obfuscating process is performed on the explanatory variables of the child data before the child data is decrypted for re-encryption. This makes it impossible for a model user to identify the child data even if the child data is decrypted. Therefore, the child generation data being generated by the genetic algorithm can be kept secret from the model user, and the prediction model can be prevented from being inferred based on the child generation data and the prediction result.

[0151] <Embodiment 2> In the first embodiment, the process of making it difficult to identify is a process of rearranging the correspondence relationships. In the data generation system 2 according to the second embodiment, the process of making it difficult to identify is a process of adding noise.

[0152] The data generation system 2 includes a calculation device 300 instead of the calculation device 200 of the data generation system 1 according to the embodiment 1. First, the difficult-to-identify process in this embodiment will be described, and then the functional configuration of the calculation device 300 will be described.

[0153] Fig. 15 is a diagram showing an example of the difficult-to-identify process in embodiment 2. For the sake of explanation, Fig. 15 shows a case where the objective variable of the material data is only "viscosity". With reference to Fig. 15, a process of adding noise to the objective variable of the material data as the difficult-to-identify process will be described.

[0154] Table 7000 shows the change in value due to the addition and removal of noise to the predicted value and the evaluated value of the objective variable "viscosity" of the material data identified by the material IDs "31" to "35".

[0155] Column 7100 indicates the predicted values ​​of the response variable "viscosity" of the material data identified by the material IDs "31" to "35." No noise is added to the predicted values ​​indicated in column 7100.

[0156] Column 7200 indicates the noise value to be added to the predicted values ​​of material IDs "31" to "35." For example, "+10" is added as noise to the predicted value "20" of material ID "31." Also, for example, "-2" is added as noise to the predicted value "30" of material ID "34."

[0157] Column 7300 shows the predicted value after noise has been added. For example, if "+10" is added as noise to the predicted value "20" of material ID "31," the predicted value including noise becomes "30."

[0158] Column 7400 shows the evaluation value of the predicted value including noise and the target value when the target value is set to "20". In this embodiment, the evaluation value is the distance (absolute difference) between the target value and the predicted value. Using the "absolute difference" as the evaluation value is just one example, and evaluation may be performed using other well-known methods.

[0159] For example, the distance between the noisy predicted value "30" of material ID "31" and the target value "20" is "10" (=|30-20|). Also, for example, the distance between the noisy predicted value "2" of material ID "32" and the target value "20" is "18" (=|2-20|).

[0160] Column 7500 shows the evaluation value after noise is removed from the noisy evaluation value. That is, each value shown in column 7500 is a value obtained by removing each noise value shown in column 7200 from each noisy evaluation value shown in column 7400. For example, removing noise "+5" from the noisy evaluation value "35" of material ID "33" results in an evaluation value of "30."

[0161] (Functional configuration of the arithmetic device 300) Fig. 16 is a block diagram showing the functional configuration of the arithmetic device 300. The functional configuration of the arithmetic device 300 according to this embodiment will be described with reference to Fig. 16. Note that components common to the arithmetic device 200 according to the first embodiment are given the same reference numerals, and repeated description will be omitted.

[0162] The arithmetic device 300 includes a control unit 350 instead of the control unit 250 of the arithmetic device 200. The control unit 350 includes a prediction unit 251, a next-generation generation unit 252, and a difficult-to-identify unit 353.

[0163] The difficult-to-identify unit 353 performs a process of adding noise to the predicted value output by the prediction unit 251 for each of a plurality of parent data (material data). The difficult-to-identify unit 353 also performs a process of removing the noise added to the predicted value from the evaluation value calculated in the terminal device 100 (cancellation of the difficult-to-identify process). By performing the process of adding noise, it is possible to make the predicted value corresponding to the parent data unidentifiable. The addition of noise to the predicted value is performed by performing an operation between numerical values ​​encrypted by homomorphic encryption. On the other hand, the removal of noise from the evaluation value is performed by performing an operation between numerical values ​​in plaintext, since the evaluation value calculated in the terminal device 100 is in plaintext.

[0164] The identification-obfuscating unit 353 also performs a process of adding noise to explanatory variables included in multiple child data (material data). This makes it possible to make the characteristics (explanatory variables) of the child data unidentifiable. The addition and removal of noise from explanatory variables is performed by performing an operation between numerical values ​​encrypted by homomorphic encryption.

[0165] A specific example of the process performed by the difficult-to-identify unit 353 is as described with reference to FIG.

[0166] (Processing in data generation system 2) Fig. 17 is a sequence diagram showing the processing in the data generating system 2. The processing in the data generating system 2 is similar to the processing (see Figs. 13 and 14) performed by the data generating system 1 according to the first embodiment, except for the difficult-to-identify processing. Therefore, with reference to Fig. 17, steps related to the difficult-to-identify processing, which is a processing different from that of the data generating system 1, will be described among the processing in the data generating system 2.

[0167] In step S305, the difficult-to-identify unit 353 executes a difficult-to-identify process on the output prediction results to make it difficult to identify the prediction results corresponding to the parent data. Specifically, the difficult-to-identify unit 353 performs a process of adding noise to the prediction results (predicted values) corresponding to each of the parent data, as shown in Fig. 15. The difficult-to-identify unit 353 stores the added noise.

[0168] In step S310, the difficult-to-identify unit 353 cancels the difficult-to-identify process for the multiple prediction results corresponding to the multiple acquired evaluation values. Specifically, the difficult-to-identify unit 353 executes a process of removing the noise added in step S305 from the evaluation values, and makes the prediction results for the explanatory variables of the parent data have a correct correspondence.

[0169] In step S314, the difficult-to-identify unit 353 executes a difficult-to-identify process on the explanatory variables of the generated multiple child data. Specifically, noise is added to the explanatory variables of the child data. The explanatory variables to which noise is added may be all explanatory variables included in the child data, or may be some of the explanatory variables. The difficult-to-identify unit 353 stores the added noise.

[0170] In step S318, the difficult-to-identify unit 353 cancels the difficult-to-identify process for the explanatory variables of the multiple child data. Specifically, the noise added to the explanatory variables in step S314 is removed. Note that the addition and removal of noise in steps S314 and S318 involves calculations between numerical values ​​encrypted by homomorphic encryption.

[0171] By executing the above-described difficult-to-identify process, it is possible to make it difficult to identify the correspondence between the input and output of the prediction model and the child data without encryption.

[0172] <Embodiment 3> In the first and second embodiments, the difficult-to-identify process is a process of rearranging correspondence relationships and a process of adding noise, respectively. In the data generation system 3 according to the third embodiment, the difficult-to-identify process is a combination of a process of rearranging correspondence relationships and a process of adding noise.

[0173] Specifically, in the difficult-to-identify process, the process for making the correspondence between the input and output of the prediction model difficult to identify (e.g., corresponding to step S105 in FIG. 13) is a process for rearranging the correspondence, and the process for making the child data difficult to identify (e.g., corresponding to step S114 in FIG. 13) is a process for adding noise.

[0174] Also, the reverse combination may be used. That is, the process for making it difficult to identify the correspondence between the input and output of the prediction model (e.g., corresponding to step S105 in FIG. 13) may be a process for adding noise, and the process for making it difficult to identify child data (e.g., corresponding to step S114 in FIG. 13) may be a process for rearranging the correspondence.

[0175] As the process for making it difficult to identify, a process for adding noise may be performed after a process for rearranging the correspondence relationships, or conversely, a process for adding noise may be performed after a process for rearranging the correspondence relationships.

[0176] By combining processes that make it difficult to identify data, the risk of information being disclosed can be further reduced.

[0177] <Embodiment 4> In the first to third embodiments, the terminal device 100 calculates the evaluation value. In the data generation system 4 according to the fourth embodiment, the evaluation value is calculated on the arithmetic device side, not on the terminal device side. The terminal device side encrypts and decrypts data, and the arithmetic device side consolidates arithmetic processing related to data other than data encryption and decryption, thereby enabling arithmetic processing to be executed efficiently.

[0178] (Configuration of data generation system 4) Fig. 18 is an overall view of the data generating system 4. The overall view of the data generating system 4 according to this embodiment will be described with reference to Fig. 18.

[0179] The data generation system 4 according to the present embodiment includes a terminal device 400 and a calculation device 500 instead of the terminal device 100 and the calculation device 200 of the data generation system 1 according to the first embodiment.

[0180] (Functional configuration of terminal device 400) 19 is a block diagram showing the functional configuration of the terminal device 400. The same components as those in the terminal device 100 according to the first embodiment are denoted by the same reference numerals, and repeated explanations will be omitted.

[0181] The terminal device 400 differs from the terminal device 100 in that it includes a control unit 450 instead of the control unit 150 of the terminal device 100. The control unit 450 includes a key generation unit 151 and an encryption / decryption unit 152. The control unit 450 differs from the control unit 150 of the terminal device 100 in that it does not include an evaluation value calculation unit 153.

[0182] The terminal device 100 decodes the prediction result obtained from the arithmetic device 200 and subjected to the hard-to-identify processing, and calculates an evaluation value. On the other hand, the terminal device 400 decodes the prediction result subjected to the hard-to-identify processing, and then transmits the decoded prediction result to the arithmetic device 500 via the communication unit 110.

[0183] (Functional configuration of the arithmetic device 500) 20 is a block diagram showing the functional configuration of the arithmetic device 500. The same components as those in the arithmetic device 200 according to the first embodiment are denoted by the same reference numerals, and repeated explanations will be omitted.

[0184] The arithmetic device 500 differs from the arithmetic device 200 in that it includes a control unit 550 instead of the control unit 250 of the arithmetic device 200. The control unit 550 differs from the control unit 250 of the arithmetic device 200 in that it includes an evaluation value calculation unit 554 in addition to the prediction unit 251, the next-generation generation unit 252, and the identification difficulty unit 253.

[0185] The evaluation value calculation unit 554 calculates an evaluation value for a target value from the prediction result (prediction value) output by the prediction unit 251 and decoded by the terminal device 100. The evaluation value is a value indicating the degree to which two values ​​differ, and in the present embodiment, for ease of explanation, as in the first embodiment, the evaluation value is the absolute difference between the prediction result and the target value.

[0186] (Processing in data generation system 4) 21 is a sequence diagram showing the processing in the data generation system 4. More specifically, in the data generation system 4, next-generation child data is generated from material data (parent data) of the search target input to the terminal device 400 (next-generation generation step), and the child data is updated as parent data (update step).

[0187] The process in the data generating system 4 shown in Fig. 21 differs from the process in the data generating system 1 in that the process is from step S408 to step S411, instead of the process from step S108 to step S111 in the data generating system 1 shown in the embodiment 1 (Fig. 13). That is, the process steps other than step S408 to step S411 in the data generating system 4 are the same as the process steps in the data generating system 1, and are assigned the same reference numerals. Therefore, repeated explanations of the steps with the same reference numerals will be omitted. Following the process shown in Fig. 21, the process shown in Fig. 14 is performed, and the searched material data is output.

[0188] Step S408 is a process performed following the process of step S107. The terminal device 400 transmits the plurality of prediction results that have been decoded in step S107 and subjected to the hard-to-identify process to the arithmetic device 500. The hard-to-identify unit 253 of the arithmetic device 500 acquires the plurality of decoded prediction results via the communication unit 210.

[0189] In step S409, the difficult-to-identify unit 253 of the arithmetic device 500 cancels the difficult-to-identify process for the acquired multiple prediction results. Specifically, the difficult-to-identify unit 253 executes a process of restoring the correspondences rearranged in step S105 to the original, and makes the prediction results for the explanatory variables of the parent data into correct correspondences. Next, the difficult-to-identify unit 253 sends the multiple parent data and the prediction results that have the correct correspondence with the parent data to the evaluation value calculation unit 554.

[0190] In step S410, the evaluation value calculation unit 554 calculates a plurality of evaluation values ​​for the target values ​​of the plurality of prediction results from the plurality of prediction results decoded in the terminal device 400. Specifically, like the evaluation value calculation unit 153, the evaluation value calculation unit 554 calculates the distance between the target value set in step S100 and the prediction result (predicted value). Note that in this embodiment, like the first embodiment, the absolute difference is calculated as the distance, but any method may be used for calculation as long as the value indicates how much the target value and the predicted value differ.

[0191] In step S411, the next-generation generation unit 252 of the arithmetic device 500 acquires the encrypted parent data and the evaluation values ​​corresponding to the parent data from the evaluation value calculation unit 554. Based on the parent data and the evaluation values ​​corresponding to the parent data, the next-generation generation unit 252 subsequently generates the next generation in step S112. The subsequent processing is the same as that described in the first embodiment (FIG. 13).

[0192] In the data generation system 4 according to the present embodiment, the difficult-to-identify process is realized by rearranging the correspondence between the input (data to be predicted) and the output (prediction result) of the prediction model. However, in addition to this, the difficult-to-identify process can also be realized by the "process of adding noise" described in the second embodiment, or the "combination of the process of rearranging the correspondence or the process of adding noise" described in the third embodiment.

[0193] (Explanation of effect) In this embodiment, data encryption / decryption is performed in the terminal device 400, and arithmetic processing related to data other than encryption / decryption of data is consolidated in the arithmetic device 500. This makes it possible to execute arithmetic processing more efficiently.

[0194] The above-described embodiment can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and modifications are included in the scope of the invention and its equivalents as described in the claims, as well as in the scope and spirit of the invention. [Explanation of symbols]

[0195] 1,2,3 data generation system, 100,400 terminal device, 200,300,500 calculation device, 110,210 communication unit, 120,220 input unit, 130,230 output unit, 140,240 memory unit, 141 key memory unit, 142 material database, 150,250,350,450 control unit, 151 key generation unit, 152 encryption / decryption unit, 153,554 evaluation value calculation unit, 251 prediction unit, 252 next-generation generation unit, 253,353 identification-obstructing unit.

Claims

1. A user terminal having a control unit and a user storage unit that stores a plurality of parent data; A computing device including: an encryption computation unit that performs computations including data encrypted by a homomorphic encryption method; and an encrypted data storage unit that stores a machine learning model that outputs a prediction result from the parent data; 1. A method for use in a system comprising: The control unit generates a public key and a private key; The control unit encrypts the plurality of parent data acquired from the user storage unit using the public key by a homomorphic encryption method; a next-generation generation step in which the encryption calculation unit and the control unit input the encrypted parent data to the machine learning model and generate a plurality of child data based on a plurality of prediction results output; an updating step in which the encrypted data storage unit stores the generated child data as the encrypted parent data; repeating the next generation generating step and the updating step; A data generation method comprising:

2. The next generation generation step includes: a step in which the encryption calculation unit acquires the plurality of parent data encrypted by the control unit; The cryptographic calculation unit inputs the acquired plurality of parent data into the machine learning model, and outputs a plurality of prediction results corresponding to each of the parent data; a step of performing, by the cryptographic calculation unit, a process of making it difficult to identify the plurality of prediction results corresponding to the plurality of parent data, on the plurality of output prediction results; the control unit acquiring the plurality of prediction results on which the identification-hardening process has been performed, and decrypting the plurality of prediction results by using the private key; a step of the control unit calculating a plurality of evaluation values ​​for each target value of the plurality of prediction results from the plurality of prediction results that have been decrypted and subjected to the difficult-to-identify processing; the cryptographic calculation unit acquiring the calculated evaluation values; a step of canceling the identification-compromising process for the plurality of prediction results corresponding to the plurality of acquired evaluation values ​​by the cryptographic calculation unit; the cryptographic calculation unit acquiring a plurality of evaluation values ​​corresponding to the plurality of parent data through a plurality of prediction results from which the identification-compromising processing has been cancelled; a step of extracting the plurality of parent data items corresponding to the evaluation values ​​that satisfy a predetermined condition by the cryptographic calculation unit; the encryption calculation unit applies a genetic algorithm to the extracted parent data to generate a plurality of child data; The data generation method of claim 1 , comprising:

3. The next generation generation step includes: a step in which the encryption calculation unit acquires the plurality of parent data encrypted by the control unit; The cryptographic calculation unit inputs the acquired plurality of parent data into the machine learning model, and outputs a plurality of prediction results corresponding to each of the parent data; a step of performing, by the cryptographic calculation unit, a process of making it difficult to identify the plurality of prediction results corresponding to the plurality of parent data, on the plurality of output prediction results; the control unit acquiring the plurality of prediction results on which the identification-hardening process has been performed, and decrypting the plurality of prediction results by using the private key; the cryptographic calculation unit acquiring the decrypted prediction results on which the identification-hardening process has been performed; a step of canceling the identification-hardening process for the acquired prediction results on which the identification-hardening process has been performed, by the cryptographic calculation unit; a step of calculating a plurality of evaluation values ​​corresponding to the plurality of parent data from the plurality of prediction results from which the identification-compromising processing has been cancelled, by the cryptographic calculation unit; a step of extracting the plurality of parent data items corresponding to the evaluation values ​​that satisfy a predetermined condition by the cryptographic calculation unit; the encryption calculation unit applies a genetic algorithm to the extracted parent data to generate a plurality of child data; The data generation method of claim 1 , comprising:

4. the plurality of parent data are a data set in which records including values ​​corresponding to a plurality of explanatory variables are arranged in a predetermined order; The next generation generation step includes: a step of executing the hard-to-identify process on explanatory variables of the generated child data by the cryptographic calculation unit; the control unit acquiring a plurality of child data items on which the identification-hardening process has been performed, and decrypting the child data items using the private key; the control unit re-encrypting the decrypted child data using the public key by a homomorphic encryption scheme; the encryption operation unit obtaining the re-encrypted child data; a step of canceling the identification-compromising processing for explanatory variables of the plurality of child data acquired by the cryptographic calculation unit; Further comprising: In the updating step, the encrypted data storage unit stores the plurality of child data items for which the identification-hardening processing has been released as the plurality of encrypted parent data items. The data generating method according to claim 2 or 3.

5. The data generating method according to claim 2 or 3, wherein the process for making it difficult to identify is a process for rearranging correspondence relationships.

6. The data generating method according to claim 2 or 3, wherein the identification-compromising processing is a process of adding noise.

7. 4. The data generating method according to claim 2, wherein the process for making it difficult to identify is a combination of a process for rearranging correspondences and a process for adding noise.

8. 4. The data generation method according to claim 1, further comprising a step of: acquiring a plurality of child data generated by executing the repeating step a plurality of times and a prediction result corresponding to the child data, and decrypting the plurality of child data by using the private key.

9. The data generating method according to claim 8 , further comprising the step of: the control unit receiving a number of times the repeating step is to be performed.

10. A user terminal having a control unit and a user storage unit that stores a plurality of parent data; A computing device including: an encryption computation unit that performs computations including data encrypted by a homomorphic encryption method; and an encrypted data storage unit that stores a machine learning model that outputs a prediction result from the parent data; A program for use in a system comprising: The control unit generates a public key and a private key; The control unit encrypts the plurality of parent data acquired from the user storage unit using the public key by a homomorphic encryption method; a next-generation generation step in which the encryption calculation unit and the control unit input the encrypted parent data to the machine learning model and generate a plurality of child data based on a plurality of prediction results output; an updating step in which the encrypted data storage unit stores the generated child data as the encrypted parent data; repeating the next generation generating step and the updating step; A data generation program comprising:

11. A user terminal having a control unit and a user storage unit that stores a plurality of parent data; A computing device including: an encryption computation unit that performs computations including data encrypted by a homomorphic encryption method; and an encrypted data storage unit that stores a machine learning model that outputs a prediction result from the parent data; A system comprising: The control unit generates a public key and a private key; The control unit encrypts the plurality of parent data acquired from the user storage unit using the public key by a homomorphic encryption method; a next-generation generation step in which the encryption calculation unit and the control unit input the encrypted parent data to the machine learning model and generate a plurality of child data based on a plurality of prediction results output; an updating step in which the encrypted data storage unit stores the generated child data as the encrypted parent data; repeating the next generation generating step and the updating step; A data generation system comprising:

Images