Information processor, information processing method and program

Abstract

To provide a technique for reducing a risk of inferring information in a machine learning model.SOLUTION: An information processor includes: an acquisition part for acquiring data; and a model processing part for executing calculation in a machine learning model on the data by a non-decisive execution sequence.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] In recent years, machine learning models for image processing and language processing have come to be widely used. Such machine learning models are not only stored on a server and executed over a network, but also stored on an edge terminal and executed. Edge terminals equipped with such machine learning models are deployed and used in various environments. For example, an edge terminal equipped with a machine learning model for detecting defective products may be deployed on a factory production line. In addition, a mobile robot for pick-and-place equipped with a machine learning model for moving goods is deployed and used in a logistics warehouse. In addition, an edge terminal equipped with a machine learning model for face recognition is deployed at the entrance of an office.

[0003] Information such as weight coefficients and bias values ​​in neural networks contains corporate know-how and confidential information. Conventionally, attackers who wish to steal such know-how have attempted to extract confidential information by disassembling edge terminals and reading the contents of their memory. Such attacks can be detected by remotely monitoring whether the terminal is alive or not, or by installing a tamper sensor on the edge terminal. In addition, software-based countermeasures can be used to counter cyber attacks that attempt to leak information through remote control (such as buffer overruns). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Special Publication No. 2018-524745 Summary of the Invention [Problem to be solved by the invention]

[0005] One such attack is side-channel analysis, which focuses on changes in electric current and electromagnetic waves at the moment when specific confidential information is processed. In side-channel analysis, if it is possible to observe changes in electric current flowing through an edge device or electromagnetic waves leaking from an edge device in an unopened state, and the input information to the estimation process of a machine learning model, it may be possible to infer the confidential information inside. Since information that enables side-channel analysis can be collected even while the edge device is in operation, it is considered difficult for the edge device to realize that it is being attacked. In side-channel analysis, the risk of a successful attack may increase if the process of handling confidential information is repeated at a certain timing.

[0006] In view of the above problems, an object of the present disclosure is to provide a technology for reducing the risk of inferring information in a machine learning model. [Means for solving the problem]

[0007] One aspect of the present disclosure relates to an information processing device having an acquisition unit that acquires data and a model processing unit that performs operations in a machine learning model on the data in a non-deterministic execution order. Effect of the Invention

[0008] According to the present disclosure, it is possible to provide a technique for reducing the risk of inferring information in a machine learning model. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic diagram illustrating a non-deterministic computation process according to one embodiment of the present disclosure. [Diagram 2] FIG. 2 is a block diagram illustrating a hardware configuration of an edge terminal according to an embodiment of the present disclosure. [Diagram 3] FIG. 3 is a block diagram illustrating a functional configuration of an edge terminal according to an embodiment of the present disclosure. [Figure 4]FIG. 4 is a diagram illustrating a machine learning model according to one embodiment of the present disclosure. [Diagram 5] FIG. 5 is a flowchart illustrating a model calculation process according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0011] In the following embodiments, an information processing device that executes model calculation processing of a machine learning model is disclosed.

[0012] [Summary of the Disclosure] In summary, the present disclosure provides a neural network model with N nodes x in layer i. i_1 ,x i_2 ,x i_3 ,···,x i_N For each node, the node operation is typically as shown in FIG. 1A. i_1 , second node x i_2 , 3rd node x i_3 , ,Nth node x i_N In the embodiment described later, the first node x i_1 , second node x i_2 , 3rd node x i_3 , ,Nth node x i_N The execution order of node x i_t1 ,x i_t2 ,x i_t3 ,···,x i_tN Here, t1, t2, t3, . . . , tN are the execution order of the first node x i_1 , second node x i_2 , 3rd node x i_3 , ,Nth node x i_N indicates any substitution of

[0013] For example, if a layer includes three nodes x1, x2, and x3, the permuted execution order may be x2, x3, x1 or x3, x1, x2, etc. In the following embodiment, the permuted execution order is not fixedly defined, but may be determined non-deterministically, such as randomly.

[0014] In an embodiment described later, the edge terminal 100 equipped with a neural network model executes node operations in each layer in a non-deterministic execution order, which may make it difficult to estimate the weight coefficients and bias values ​​of the neural network model by side channel analysis of the edge terminal 100.

[0015] Here, the edge terminal 100 may have, for example, a hardware configuration as shown in Fig. 2. That is, the edge terminal 100 has a drive device 101, a storage device 102, a memory device 103, a processor 104, an interface device 105, and a communication device 106, which are interconnected via a bus B.

[0016] Programs or instructions for implementing various functions and processes in the edge terminal 100 may be stored in a removable storage medium such as a CD-ROM (Compact Disk-Read Only Memory) or a flash memory. When the storage medium is set in the drive device 101, the programs or instructions are installed from the storage medium via the drive device 101 into the storage device 102 or the memory device 103. However, the programs or instructions do not necessarily have to be installed from the storage medium, and may be downloaded from any external device via a network or the like.

[0017] The storage device 102 is realized by a hard disk drive or the like, and stores installed programs or instructions as well as files, data, etc. used in executing the programs or instructions.

[0018] The memory device 103 is realized by a random access memory, a static memory, or the like, and when a program or an instruction is activated, reads and stores the program or instruction, data, or the like from the storage device 102. The storage device 102, the memory device 103, and the removable storage medium may be collectively referred to as a non-transitory storage medium.

[0019] The processor 104 may be realized by one or more CPUs (Central Processing Units), GPUs (Graphics Processing Units), processing circuitry, etc., which may be composed of one or more processor cores, and performs various functions and processing of the edge terminal 100 in accordance with programs, instructions, data such as parameters necessary to execute the programs or instructions, etc. stored in the memory device 103.

[0020] The interface device 105 provides an interface between an external device and the edge terminal 100 .

[0021] The communication device 106 is realized by various communication circuits that execute wired and / or wireless communication processing with an external device, the Internet, a LAN (Local Area Network), a cellular network, or other communication network.

[0022] However, the above-described hardware configuration is merely an example, and the edge terminal 100 according to the present disclosure may be realized by any other suitable hardware configuration.

[0023] [Edge terminal] Next, an edge terminal 100 according to an embodiment of the present disclosure will be described. Fig. 3 is a block diagram showing a functional configuration of the edge terminal 100 according to an embodiment of the present disclosure. As shown in Fig. 3, the edge terminal 100 has an acquisition unit 110 and a model processing unit 120. Each functional unit of the acquisition unit 110 and the model processing unit 120 may be realized by the processor 104 executing a computer program stored in the memory device 103 of the edge terminal 100.

[0024] The acquisition unit 110 acquires data. For example, if the machine learning model is related to image processing, the acquisition unit 110 may acquire image data. Also, if the machine learning model is related to voice processing, the acquisition unit 110 may acquire voice data. The acquisition unit 110 passes the acquired data to the model processing unit 120.

[0025] The model processing unit 120 executes operations in the machine learning model on the data in a non-deterministic execution order. Specifically, the model processing unit 120 inputs the data acquired from the acquisition unit 110 to the machine learning model, and determines the execution order of multiple operations in the machine learning model on the input data in a non-deterministic manner, such as randomly. Then, the model processing unit 120 executes multiple operations according to the execution order determined non-deterministically, such as the randomized execution order.

[0026] For example, when the machine learning model is realized by a neural network, the model processing unit 120 may execute node operations in a layer of the neural network model in a non-deterministic execution order on a node-by-node basis. i_j Alternatively, the execution order of the node operations in the layer may be determined non-deterministically, and the node operations in the layer may be executed according to the determined execution order.

[0027] 4, the model processing unit 120 may randomly determine the execution order of the node operations in the two nodes y0 and y1 in the hidden layer 1, the node operations in the two nodes s0 and s1 in the hidden layer 2, and the node operations in the three nodes z0, z1, and z2 in the output layer. For example, the model processing unit 120 may randomly determine the execution order of the node operations in the hidden layer 1.<y1,y0> , execution order for hidden layer 2<s0,s1> and the execution order for the output layer<z1,z2,z0> Assume that the following has been decided.

[0028] In this case, the model processing unit 120 first performs the execution order<y1,y0> According to

number

number

[0029] Next, the model processing unit 120 executes the execution order of hidden layer 2<s0,s1> According to

number

number

[0030] Finally, the model processing unit 120 determines the execution order of the output layer.<z1,z2,z0> According to

number

number

number

[0031] In this way, the model processing unit 120 executes node operations within a layer of the neural network model on a node-by-node basis in a non-deterministic execution order, which may reduce the possibility of external inference of information such as the weight coefficients and bias values ​​of the neural network model against attacks such as side channel analysis.

[0032] In one embodiment, the model processing unit 120 may execute the weighted sum operation in the node of the neural network model in a non-deterministic execution order for each weighted term. In other words, in addition to or instead of determining the non-deterministic execution order for each node described above, the model processing unit 120 may randomize the execution order of multiplication of the output value from each node of the previous layer and the weight coefficient.

[0033] For example, for node y0 in hidden layer 1, the model processing unit 120

number

number

[0034] In this way, the model processing unit 120 performs weighted sum operations within nodes of the neural network model in a non-deterministic execution order on a weighted term basis, and can reduce the possibility of external inference of information such as the weight coefficients and bias values ​​of the neural network model against attacks such as side channel analysis.

[0035] In addition, in one embodiment, the model processing unit 120 may add a dummy operation to the operation in the machine learning model. For example, for the neural network model shown in Fig. 4, the model processing unit 120 may add a dummy node that does not affect the operation processing in the subsequent layers to one or more layers. For example, the model processing unit 120 may add a dummy node s2 to the hidden layer 2, and may include a dummy operation in the operation in the hidden layer 2, without being limited thereto, as follows.

number

[0036] In this case, the model processing unit 120 may non-deterministically determine the execution order of three nodes s0, s1, and s2 including the dummy node s2, and execute the node operations of each node in the hidden layer 2. Here, the weighting coefficient from the dummy node s2 to each node in the output layer may be set to zero, for example, so that the output value of the dummy node s2 is not transmitted to the next layer, the output layer.

[0037] In addition, the dummy operation may be added to the weighted sum operation within the node, not just the addition of a dummy node. For example, for node y0 in hidden layer 1, the model processing unit 120

number

number

[0038] Furthermore, the number of dummy terms is not limited to one, and values ​​with inverted signs, such as β×γ and β×(−γ), may be added to cancel the results of the arithmetic operations.

[0039] Note that the above-mentioned dummy operations and dummy terms are not limited to these, and may be any other operations and terms that do not affect the calculation results of the machine learning model.

[0040] In this way, the model processing unit 120 can add dummy operations to the operations in the machine learning model, thereby reducing the possibility of information such as weight coefficients and bias values ​​of the neural network model being inferred from outside in attacks such as side channel analysis.

[0041] In one embodiment, the model processing unit 120 may non-deterministically allocate operations in a machine learning model to a plurality of arithmetic cores. For example, it is assumed that the edge terminal 100 is realized by a processor consisting of two processor cores #0 and #1, and executes an estimation process using a neural network model including N nodes in a layer. In this case, the model processing unit 120 may randomly allocate node operations of N nodes to the two processor cores #0 and #1. For example, when a certain layer includes four nodes #0 to #3, the model processing unit 120 may allocate, for example, nodes #0 and #3 to the processor core #0 and nodes #1 and #2 to the processor core #1 according to any non-deterministic allocation method such as a random allocation method.

[0042] In this way, the model processing unit 120 non-deterministically assigns and executes calculations in the machine learning model among multiple calculation cores, which may reduce the possibility of external inference of information such as the weight coefficients and bias values ​​of the neural network model against attacks such as side channel analysis.

[0043] In one embodiment, the model processing unit 120 may non-deterministically assign dummy operations added to the operations in the machine learning model to multiple arithmetic cores. For example, assume that the edge terminal 100 is realized by a processor consisting of two processor cores #0 and #1, and executes an estimation process using a neural network model including N nodes in a layer. In this case, the model processing unit 120 may add, for example, one dummy node and randomly assign the node operations of (N+1) nodes to the two processor cores #0 and #1. For example, when a certain layer includes four nodes #0 to #3, the model processing unit 120 may add a dummy node #4 and assign, for example, nodes #0, #3, and #4 to the processor core #0 and nodes #1 and #2 to the processor core #1 according to any non-deterministic assignment method such as a random assignment method.

[0044] In this way, the model processing unit 120 non-deterministically assigns and executes dummy operations added to the operations in the machine learning model to multiple calculation cores, thereby reducing the possibility of external inference of information such as the weight coefficients and bias values ​​of the neural network model against attacks such as side channel analysis.

[0045] [Model calculation processing] Next, a model calculation process according to an embodiment of the present disclosure will be described. Fig. 5 is a flowchart showing the model calculation process according to an embodiment of the present disclosure. The model calculation process may be performed, for example, by the edge terminal 100, and more specifically, may be realized by the processor 104 of the edge terminal 100 executing a computer program or instructions stored in the memory device 103.

[0046] In step S101, the edge terminal 100 acquires data. For example, the edge terminal 100 may acquire image data, audio data, etc. as input data.

[0047] In step S102, the edge terminal 100 non-deterministically determines the execution order of operations in the machine learning model. For example, when the machine learning model is realized as a neural network model, the edge terminal 100 may non-deterministically determine the execution order of node operations of each node in one or more layers of the neural network model. In addition to or instead of such non-deterministic determination of the execution order per node, the edge terminal 100 may non-deterministically determine the execution order of weighted operations in node operations for one or more nodes of the neural network model.

[0048] In addition to or instead of determining the non-deterministic execution order of operations in the machine learning model, the edge terminal 100 may add a dummy operation to the operations in the machine learning model. For example, when the machine learning model is realized as a neural network model, the edge terminal 100 may add a dummy node to add a dummy operation to a node operation for one or more layers of the neural network model.

[0049] In step S103, the edge terminal 100 may execute a machine learning model on the data according to a non-deterministic execution order. Specifically, the edge terminal 100 may input the data acquired in step S101 to the machine learning model, and execute an operation in the machine learning model on the input data according to the execution order determined non-deterministically in step S102.

[0050] According to the above-described embodiment, it is possible to reduce the possibility that information such as the weighting coefficients and bias values ​​of the neural network model can be inferred from the outside in an attack such as a side channel analysis on the edge terminal 100.

[0051] Although the examples of the present disclosure have been described in detail above, the present disclosure is not limited to the specific embodiments described above, and various modifications and variations are possible within the scope of the gist of the present disclosure described in the claims. [Explanation of symbols]

[0052] 100 Edge Devices 110 Acquisition Department 120 Model processing section

Claims

1. An acquisition unit for acquiring data; A model processing unit that executes operations in a machine learning model on the data in a non-deterministic execution order; An information processing device having the above configuration.

2. The information processing device according to claim 1 , wherein the model processing unit executes operations in the machine learning model in a randomized execution order.

3. The information processing device according to claim 1 , wherein the model processing unit executes node operations in a layer of the neural network model on a node-by-node basis in a non-deterministic execution order.

4. The information processing device according to claim 1 , wherein the model processing unit executes the weighted sum operation in the node of the neural network model in units of weighted terms in a non-deterministic execution order.

5. The information processing device according to claim 1 , wherein the model processing unit adds a dummy operation to an operation in the machine learning model.

6. The information processing device according to claim 1 , wherein the model processing unit non-deterministically allocates operations in the machine learning model to a plurality of processing cores.

7. The information processing device according to claim 1 , wherein the model processing unit non-deterministically assigns dummy operations added to operations in the machine learning model to a plurality of operation cores.

8. Obtaining data and Executing operations in a machine learning model on the data in a non-deterministic execution order; An information processing method implemented by a computer.

9. Obtaining data and Executing operations in a machine learning model on the data in a non-deterministic execution order; A program that causes a computer to execute the following.

Images