Parameter update assurance system, certification device, parameter update assurance method and program

Abstract

To improve transparency relating to update of a machine learning model while concealing a parameter of the machine learning model.SOLUTION: A certification device comprises: an update section for updating a parameter of a machine learning model on the basis of a certain data set and a certain update algorithm; an inference section for acquiring an inference result with respect to certain data according to the updated machine learning model; a circuit generation section for generating a first circuit which computes the updated parameter by inputting the non-updated parameter and the data set on the basis of the non-updated and updated parameters and the data set; and a certification section for generating a certificate using the first circuit and a key on the basis of a zero knowledge certification. A verification device comprises a verification section for verifying the non-updated and updated parameters committed using the key, the certificate, that the update is performed and the inference result is acquired on the basis of the updated parameter.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a parameter update assurance system, a certification device, a parameter update assurance method, and a program. [Background technology]

[0002] In recent years, various systems using AI have been widely deployed. The system provider uses a machine learning model (hereinafter simply referred to as "model") operated within the system to make inferences from the data received from the system user. The system provider transmits only the inference results to the system user.

[0003] In order to make highly accurate inferences even for new, unknown data, a model needs to be updated frequently rather than continuing to use a model that has already been trained once.

[0004] In order to ensure the transparency of AI, it is important to create a system that allows system providers to prove what updates have been made to the models they are using (how the model parameters have been updated) and whether the models are returning correct inference results, and to enable system users to verify this.

[0005] Non-Patent Document 1 discloses a technique for proving which model an update process was performed from. In this technique, the model parameters before and after the update are provided to the system user, and it is verified that the update was performed correctly.

[0006] Non-Patent Document 2 discloses a technique for ensuring that a model is returning correct inference results while keeping model parameters secret. [Prior art documents] [Non-patent literature]

[0007] [Non-Patent Document 1] Jia et al., "Proof-of-Learning: Definitions and Practice", In 42nd IEEE Symposium on Security and Privacy, 2021 [Non-Patent Document 2] Liu et al., "zkCNN: Zero Knowledge Proofs for Convolutional Neural Network Predictions and Accuracy", CCS 2021 Summary of the Invention [Problem to be solved by the invention]

[0008] However, the technology of Non-Patent Document 1 has a problem in that the model parameters are disclosed to system users and cannot be kept secret. In other words, since the model parameters have confidentiality and property properties, it is undesirable to disclose them to third parties.

[0009] Furthermore, the technique of Non-Patent Document 2 makes it impossible to guarantee what updates have been performed.

[0010] The present invention has been made in consideration of the above points, and aims to improve transparency regarding updates to machine learning models while keeping the parameters of the machine learning models secret. [Means for solving the problem]

[0011] In order to solve the above problem, the proof device has an update unit configured to update parameters of a machine learning model based on a certain dataset and a certain update algorithm, an inference unit configured to obtain an inference result for certain data using the updated machine learning model, a circuit generation unit configured to generate a first circuit that calculates the updated parameters using the parameters before the update and the dataset as input, based on the parameters before and after the update and the dataset, and a proof unit configured to generate a certificate using the first circuit and a key based on zero-knowledge proof, and the verification device has a verification unit configured to verify the parameters before and after the update committed using the key, the certificate, that the update has been performed, and that the inference result has been obtained based on the updated parameters. Effect of the Invention

[0012] It is possible to improve transparency regarding updates to machine learning models while keeping the machine learning model parameters secret. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of a parameter update guarantee system according to a first embodiment. [Diagram 2] 1 is a diagram illustrating an example of a hardware configuration of a proving device 10 according to a first embodiment. [Diagram 3] 1 is a diagram illustrating an example of a functional configuration of a parameter update guarantee system according to a first embodiment. [Figure 4] 1 is a sequence diagram illustrating an example of a processing procedure executed in a parameter update guarantee system according to a first embodiment. FIG. [Diagram 5] FIG. 11 is a diagram illustrating an example of a functional configuration of a parameter update guarantee system according to a second embodiment. [Figure 6] FIG. 11 is a sequence diagram illustrating an example of a process performed in the parameter update guarantee system according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] In this embodiment, a mechanism is disclosed in which a provider of a system (hereinafter referred to as the "system provider") using a machine learning model (hereinafter simply referred to as "model f") can prove how model f has been updated (how the parameters of model f have been updated) without disclosing the parameters of model f, and a user of the system (hereinafter referred to as the "system user") can verify this, by using zero-knowledge proof. Note that zero-knowledge proof is a technology for proving whether or not certain information (here, the parameters of model f) has been used in a calculation while keeping the information secret.

[0015] [First embodiment] In the first embodiment, an example is disclosed in which the entire learning process is guaranteed. That is, in the first embodiment, the system provider proves and the system user verifies that the updated parameters have been correctly updated from the pre-update parameters and that the inference results have been obtained using the updated parameters (hereinafter, referred to as "proof items" in the first embodiment). Correct updating means that the updated model parameters have been calculated through an appropriate update algorithm A.

[0016] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Fig. 1 is a diagram showing an example of the configuration of a parameter update guarantee system in a first embodiment. In Fig. 1, a proving device 10, a verification device 20, and a third party device 30 are connected via a network such as the Internet.

[0017] The proof device 10 is one or more computers operated by the system provider. The proof device 10 performs inference on data received from system users and outputs the inference results. The proof device 10 also performs processing to prove the proof items when the parameters of the model f are updated.

[0018] The verification device 20 is one or more computers operated by a system user. The verification device 20 transmits data to be inferred to the proof device 10 and receives an inference result for the data from the proof device 10. The verification device 20 also executes a process for verifying the proof items.

[0019] The third party device 30 is one or more computers operated by a third party who is neither the system provider nor the system user. The third party is not an arbitrary person, but is, for example, a person who already has parameters w of a model f, such as a "pre-model provider." The system provider purchases parameters w of a model f from a third party and updates w using a dataset D at hand to obtain updated parameters w'.

[0020] Fig. 2 is a diagram showing an example of a hardware configuration of the proving device 10 in the first embodiment. The proving device 10 in Fig. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a processor 104, and an interface device 105, which are all connected to each other via a bus B.

[0021] A program for implementing the processing in the certification device 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 via the drive device 100 into the auxiliary storage device 102. However, the program does not necessarily have to be installed from the recording medium 101, but may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program as well as necessary files, data, etc.

[0022] When an instruction to start a program is received, the memory device 103 reads out and stores the program from the auxiliary storage device 102. The processor 104 is a CPU or a GPU (Graphics Processing Unit), or a CPU and a GPU, and executes functions related to the certification device 10 in accordance with the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

[0023] The verification device 20 and the third party device 30 may also have the same hardware configuration as that shown in FIG.

[0024] Fig. 3 is a diagram showing an example of a functional configuration of the parameter update guarantee system in the first embodiment. In Fig. 3, the proof device 10 has a data set commitment unit 11, an update unit 12, an inference unit 13, a circuit generation unit 14, and a proof unit 15. Each of these units is realized by a process in which one or more programs installed in the proof device 10 are executed by a processor 104.

[0025] The verification device 20 includes a request unit 21 and a verification unit 22. These units are realized by processing that one or more programs installed in the verification device 20 cause a processor of the verification device 20 to execute.

[0026] The third party device 30 includes a parameter commitment unit 31. The parameter commitment unit 31 is realized by a process executed by one or more programs installed in the third party device 30 and executed by a processor of the third party device 30. The following describes a procedure performed in the parameter update guarantee system: Fig. 4 is a sequence diagram for explaining an example of a procedure performed in the parameter update guarantee system in the first embodiment.

[0027] In step S101, the parameter commitment unit 31 of the third party device 30 makes a commitment to a parameter w using, for example, a key pp generated by a trusted third party and a random number r generated by the third party device 30. com w =Commit(w,pp,r) Where: com w is the data that w has been made private by the commitment.

[0028] At any time after execution of step S101, the parameter commitment unit 31 w is transmitted to the verification device 20 (S102).

[0029] In step S103, the data set commitment unit 11 of the proving device 10 makes a commitment to the data set D by using, for example, the key pp and the random number r′ generated by the proving device 10. com D =Commit(D,pp,r') Where: com D is the data that D has been made private by the commitment.

[0030] At any time after execution of step S103, the data set commitment unit 11 D is transmitted to the verification device 20 (S104).

[0031] Note that steps S101 and S102 may be executed by the proving device 10. That is, the proving device 10 may have the parameter commitment unit 31. In this case, the random number r is generated by the proving device 10. That is, the random number used for the commitment is generated by the person who executes the commitment.

[0032] In step S105, the update unit 12 of the proving apparatus 10 updates the parameter w of the model f to w′ based on an arbitrary update algorithm A, using the data set D as learning data, so that the model f fits the data set D. w' = A(w,D) It should be noted that steps S101, S103 and S105 may be executed in any order.

[0033] At any time thereafter, the request unit 21 of the verification device 20 transmits an inference request including the data x to the proving device 10 (S106).

[0034] The inference unit 13 of the proving device 10 inputs the data x into the model f based on the updated parameter w', and obtains the inference result y=f(w',x) of the model f (S107). The inference unit 13 transmits the inference result y to the verification device 20 (S108).

[0035] Next, the circuit generation unit 14 (GenerateCircuit) of the proof apparatus 10 generates a software circuit C using y, x, w', w, and D, which calculates the inference result y=f(w',x) using the updated parameter w' in order to apply it to a circuit satisfaction problem (S109). C=GenerateCirucuit(y,x,w',w,D) A "circuit" refers to a program that functions as a circuit.

[0036] The circuit C is composed of a circuit C1 that calculates y using w' and x and a circuit C2 that calculates w' using w and D. Therefore, y, x, w', w, and D are input to GenerateCircuit.

[0037] However, the circuit generation unit 14 may generate only the circuit C2 that calculates w' using w and D as inputs, excluding the "circuit C1 that calculates y using w' and x." C2 = GenerateCircuit(w',w,D) In this case, the subsequent circuit C may be replaced by the circuit C2.

[0038] Next, the proving unit 15 (Prove) of the proving apparatus 10 generates data (hereinafter simply referred to as a “certificate”) π that functions as a certificate of the matter to be proven, using the circuit C, the key pp, and the random numbers r and r′, based on zero-knowledge proof (S110). π=Prove(C,pp,r,r') The certificate can be generated using, for example, a method based on zero-knowledge proof disclosed in References 1, 2, and 3. The system provider receives a random number r together with a parameter w from a third party.

[0039] Next, the proving unit 15 transmits the certificate π to the verification device 20 (S111).

[0040] Next, the verification unit 22 (Verify) of the verification device 20 verifies the committed pre-update parameter w(com w ), the committed dataset D(com D ), the certificate π, y, the data x, and the key pp are used to verify the proof (that w'=A(w,D) holds and that y=f(w',D) holds) (S112). {0,1}=Verify(com w ,com D ,π,y,x,pp) However, when the circuit C2 is generated, {0,1}=Verify(com w ,com D ,π,pp) It becomes.

[0041] The verification unit 22 (Verify) outputs 1 if the proof item holds, and outputs 0 if it does not.

[0042] The verification method may be, for example, a method based on zero-knowledge proof as disclosed in References 1, 2, and 3.

[0043] As described above, according to the first embodiment, the system provider can prove the proof items to the system users while keeping the parameters of the model f secret. Therefore, it is possible to improve the transparency regarding the update of the machine learning model while keeping the parameters of the machine learning model secret.

[0044] [Second embodiment] Next, a second embodiment will be described. In the second embodiment, differences from the first embodiment will be described. Points not specifically mentioned in the second embodiment may be the same as those in the first embodiment.

[0045] In the second embodiment, an example is disclosed in which the parameters of the model f are guaranteed to have been partially updated while reducing the certificate generation time of the first embodiment. In the second embodiment, in order to reduce the proof time of the first embodiment, proof that the parameter w' has been updated from w using the update algorithm A is omitted, and the system provider proves that a certain number of parameters with the same value exist before and after the update, and that an inference result has been obtained using the updated parameters (hereinafter referred to as "proof items" in the second embodiment), and the system user verifies it. Note that, by proving that a certain number of parameters with the same value exist before and after the update, it is possible to paradoxically prove that model parameters other than a certain number (i.e., at least some) have been updated.

[0046] Fig. 5 is a diagram showing an example of a functional configuration of a parameter update guarantee system in the second embodiment. In Fig. 5, the same reference numerals are used to designate parts that are the same as or correspond to those in Fig. 3.

[0047] In FIG. 5, the proving device 10 does not include the data set commitment unit 11 and the circuit generation unit 14.

[0048] Fig. 6 is a sequence diagram for explaining an example of a processing procedure executed in the parameter update guarantee system in the second embodiment. In Fig. 6, the same steps as those in Fig. 4 are given the same step numbers, and the explanation thereof will be omitted.

[0049] In the second embodiment, the proving apparatus 10 does not have the data set commitment unit 11 and the circuit generation unit 14, so steps S103, S104, and S109 are not executed in Fig. 6. Also, steps S105, S110, and S112 are replaced with steps S105a, S110a, or S112a.

[0050] In step S105a, the update unit 12 uses an update algorithm (PartialUpdate) that can fix a part (k parameters) of the parameters w and update the remaining parameters (i.e., a part of the parameters w) using the dataset D as learning data so that the model f fits the dataset D, thereby obtaining w' in which a part of w is updated. w' = PartialUpdate(w,k,D) A specific example of PartialUpdate will be described later.

[0051] In step S110a, the proving unit 15 (PartialProve) of the proving apparatus 10 generates a certificate π that proves the proof item based on a zero-knowledge proof (partial zero-knowledge proof) technique that proves partial knowledge, using the pre-update parameters w, the updated parameters w', the data x, the inference result y, and the keys pp and r. π=PartialProve(w',w,x,y,k,pp,r) In addition, the proving unit 15 may use the pre-update parameters w, the updated parameters w', and the keys pp and r to generate a certificate π2 that proves that k of the updated parameters w' match the pre-update parameters w. π2=PartialProve(w',w,k,pp,r) In this case, the subsequent certificates π should be replaced with π2.

[0052] Any partial zero-knowledge proof can be used as PartialProve.

[0053] In step S112a, the verification unit 22 (Verify) of the verification device 20 checks the committed pre-update parameter w(com w ), the data x, the inference results y and k, the certificate π, and the key pp are used to verify the proof. {0,1}=Verify(com w ,x,y,k,π,pp) However, when certificate π2 is generated, {0,1}=Verify(com w ,k,π,pp) It becomes.

[0054] The verification unit 22 (Verify) outputs 1 if the proof item holds, and outputs 0 if it does not.

[0055] Next, some specific examples of PartialUpdate will be described.

[0056] <Transfer Learning> Transfer Learning is a learning method that uses previously learned knowledge to solve another problem. This makes it possible to reduce learning costs and improve model performance. In Transfer Learning, when the model is a neural network, it is generally known that model parameters up to a certain layer are fixed, and the remaining parameters are trained using a data set that solves the target problem. With this embodiment, the system provider can prove that the system is using parameters w' that have been updated by Transfer Learning, which are nk parameters out of the parameters w that have been committed in advance.

[0057] <fine-tuning> Fine-tuning is training a trained model to adjust it to each task. In fine-tuning, like transfer learning, the trained model is not updated, but the parameters of the added layer are updated. With this embodiment, the system provider can prove that the parameter w' is used, which is a set of nk parameters newly added by fine-tuning, updated for the previously committed parameter w.

[0058] <Continual Learning(incremental learning, lifelong learning)> Continual Learning is a method of maintaining previously learned knowledge without forgetting it while continuously learning new data and tasks. One type of Continual Learning method is parameter isolation, which assigns neural network parameters to each task to be learned. In this method, when learning a new task, the parameters already learned are fixed and the parameter group assigned to the task is updated. With this embodiment, the system provider can prove that the model parameter w' is used by updating only the assigned parameter group nk out of the parameters w committed in advance.

[0059] <pruning> Pruning is a method for compressing model parameters without reducing accuracy as much as possible, with the aim of reducing the weight of a neural network. Specifically, neurons that are unnecessary for maintaining the accuracy of the neural network are selected using some algorithm, and their weights are set to 0. With this embodiment, the system provider can prove that they are using model parameters w' that have been updated using only a group of nk parameters that are unnecessary for maintaining accuracy among the parameters w that have been committed in advance.

[0060] As described above, according to the second embodiment, the system provider can prove the proof items to the system users while keeping the parameters of the model f secret. Therefore, it is possible to improve the transparency regarding the update of the machine learning model while keeping the parameters of the machine learning model secret.

[0061] Furthermore, according to the second embodiment, the time required to generate and verify a certificate that guarantees updating can be reduced compared to the first embodiment, and therefore, this is particularly suitable for cases where parameters are updated frequently.

[0062] In the above embodiment, the circuit C2 is an example of a first circuit, and the circuit C is an example of a second circuit.

[0063] [References] [Reference 1] Bryan Parno and Craig Gentry, "Pinocchio: Nearly Practical Verifiable Computation", IEEE S & P 2013 [Reference 2] Jens Groth and Amit Sahai, "Efficient Non-interactive Proof Systems for Bilinear Groups", IACR 2007 [References 3] Bunz et al., "Bulletproofs: Short Proofs for Confidential Transactions and More", IEEE S & P 2018 Although the embodiment of the present invention has been described in detail above, the present invention is not limited to such specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0064] 10. Identification Device 11 Data Set Commitment Section 12 Update section 13 Reasoning part 14 Circuit generation section 15 Certification Department 20 Verification Device 21 Request part 22 Verification Department 30 Third party equipment 31 Parameter Commitment Section 100 Drive device 101 Recording media 102 Auxiliary storage 103 Memory device 104 processors 105 Interface device B Bus< / pruning>

Claims

1. A parameter update assurance system including a certification device and a verification device, The certification device is An update unit configured to update parameters of a machine learning model based on a data set and an update algorithm; An inference unit configured to obtain an inference result for certain data using the updated machine learning model; a circuit generation unit configured to generate a first circuit that calculates the updated parameters by inputting the parameters before and after the update and the data set, based on the parameters before and after the update and the data set; a proving unit configured to generate a certificate using the first circuit and a key based on a zero-knowledge proof; having The verification device includes: a verification unit configured to verify the parameters before and after the update committed using the key, the certificate, that the update has been performed, and that the inference result has been obtained based on the updated parameters; A parameter update guarantee system comprising:

2. the circuit generation unit is configured to generate, based on the inference result, the data, the parameters before and after the update, and the data set, a second circuit including the first circuit and configured to calculate an inference result for the data that is the same as that of the machine learning model after the parameters are updated; The proving unit is configured to generate a certificate using the second circuit and a key based on a zero-knowledge proof.

2. The parameter update guarantee system according to claim 1.

3. A parameter update assurance system including a certification device and a verification device, The certification device is An update unit configured to update some parameters of the machine learning model based on a certain dataset and a certain update algorithm; An inference unit configured to obtain an inference result for certain data using the updated machine learning model; A proof unit configured to generate a certificate using the parameters, the data, the inference result, and a key before and after the update based on a zero-knowledge proof; having The verification device includes: a verification unit configured to verify that the inference result has been obtained based on updated parameters based on the parameters before the update committed using the key, the certificate, the inference result, the data, and the key; A parameter update guarantee system comprising:

4. An update unit that updates parameters of a machine learning model based on a certain data set and a certain update algorithm; An inference unit that obtains an inference result for certain data using the updated machine learning model; a circuit generation unit that generates a first circuit based on the parameters before and after the update and the data set, the first circuit calculating the parameters after the update by inputting the parameters before the update and the data set; a proof unit that generates a certificate using the first circuit and a key based on a zero-knowledge proof, and transmits the certificate to a verification device that verifies the parameters before and after the update committed using the key, the certificate, that the update has been performed, and that the inference result has been obtained based on the updated parameters; A certification device comprising:

5. An update unit that updates some parameters of the machine learning model based on a certain data set and a certain update algorithm; An inference unit that obtains an inference result for certain data using the updated machine learning model; a proof unit that generates a certificate using the parameters, the data, the inference result, and a key before and after the update based on a zero-knowledge proof, and transmits the certificate to a verification device that verifies that the inference result has been obtained based on the updated parameters based on the parameters, the certificate, the inference result, the data, and the key before the update that have been committed using the key; A certification device comprising:

6. The certification device is An update procedure for updating parameters of the machine learning model based on a certain dataset and an update algorithm; An inference procedure for obtaining an inference result for certain data using the updated machine learning model; a circuit generation step of generating a first circuit that calculates the updated parameters by inputting the parameters before and after the update and the data set, based on the parameters before and after the update and the data set; a proof step of generating a certificate using the first circuit and a key based on a zero-knowledge proof; Run The verification device is a verification step for verifying the parameters before and after the update committed using the key, the certificate, that the update has been performed, and that the inference result has been obtained based on the updated parameters; Execute A method for ensuring parameter updates.

7. The certification device is An update procedure for updating some parameters of the machine learning model based on a certain dataset and a certain update algorithm; An inference procedure for obtaining an inference result for certain data using the updated machine learning model; a proof procedure for generating a certificate using the parameters, the data, the inference result, and a key before and after the update based on a zero-knowledge proof; Run The verification device is a verification step for verifying that the inference result has been obtained based on updated parameters based on the parameters, the certificate, the inference result, the data, and the key before the update committed using the key; Execute A method for ensuring parameter updates.

8. 6. A program for causing a computer to function as the certification device according to claim 4 or 5.

Images