Information processing device

Abstract

To detect change of an AI model.SOLUTION: An information processing device comprises: calculation means which calculates a hash value related to an AI model; acquisition means which acquires the hash value related to the AI model, as at least a part of model information, from transaction data including the model information related to the AI model; and determination means which determines whether or not the calculated hash value is the same as the acquired hash value.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to the technical field of information processing devices. [Background technology]

[0002] As an AI (Artificial Intelligence) model used in this type of device, for example, an AI model has been proposed that rewrites sentences written in Japanese so that they are properly translated into English (see Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2017-129995 Summary of the Invention [Problem to be solved by the invention]

[0004] AI models may be subject to cyberattacks. Examples of cyberattacks include malware that rewrites AI models and / or contaminates training datasets (which may result in unintended behavior by the AI ​​model). However, there is a technical problem in that it is difficult to determine whether an AI model has been subjected to a cyberattack.

[0005] The present invention has been made in view of the above-mentioned problems, and has an object to provide an information processing device that can detect changes in an AI model. [Means for solving the problem]

[0006] An information processing device according to one aspect of the present invention comprises a calculation means for calculating a hash value related to an AI model, an acquisition means for acquiring a hash value related to the AI ​​model from model information related to the AI ​​model registered in a distributed ledger, and a determination means for determining whether the calculated hash value and the acquired hash value are identical. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a block diagram illustrating an example of a configuration of an information processing apparatus according to an embodiment. [Figure 2] FIG. 1 is a block diagram illustrating an example of a configuration of a calculation device according to an embodiment. [Figure 3] 4 is a flowchart illustrating an operation of the information processing device according to the embodiment. [Figure 4] FIG. 10 is a block diagram showing another example of the configuration of the arithmetic device according to the embodiment. [Figure 5] 10 is a flowchart illustrating another example of the operation of the information processing device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0008] First Embodiment A first embodiment of an information processing device will be described with reference to Fig. 1 to Fig. 3. In Fig. 1, the information processing device 100 includes a calculation device 110, a storage device 120, a communication device 130, an input device 140, and an output device 150. The calculation device 110, the storage device 120, the communication device 130, the input device 140, and the output device 150 are connected via a data bus 160. Note that the information processing device 100 does not necessarily have to include at least one of the input device 140 and the output device 150.

[0009] The arithmetic device 110 may include a processor 1101. The arithmetic device 110 may include other processors in addition to the processor 1101. That is, the arithmetic device 110 may include one or more processors. The processor 1101 may be a multi-core processor. When the arithmetic device 110 includes a single processor 1101 that is a multi-core processor, it can be said that the arithmetic device 110 logically includes multiple processors.

[0010] The processor 1101 may be, for example, at least one of a central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), and a tensor processing unit (TPU).

[0011] The storage device 120 may include a memory 1201. The storage device 120 may include other memories in addition to the memory 1201. That is, the storage device 120 may include one or more memories. The memory 1201 may be, for example, at least one of a RAM (Random Access Memory), a ROM (Read Only Memory), a hard disk device, a magneto-optical disk device, an SSD (Solid State Drive), and an optical disk array.

[0012] The storage device 120 can store desired data. A computer program 1201a executed by the arithmetic device 110 may be stored in the memory 1201 of the storage device 120. The storage device 120 may temporarily store data that is temporarily used by the arithmetic device 110 when the arithmetic device 110 is executing the computer program 1201a.

[0013] The computer program 1201a may be recorded on a computer-readable, non-transitory recording medium. In this case, the computer program 1201a may be stored in the memory 1201 by reading the recording medium using a recording medium reading device (not shown) included in the information processing device 100. The recording medium may be at least one of an optical disk, a magnetic medium, a magneto-optical disk, a semiconductor memory, and any other medium capable of storing a program. The computer program 1201a may be acquired (in other words, downloaded) from a device (not shown) external to the information processing device 100 via the communication device 130. The acquired computer program 1201a may be stored in the memory 1201.

[0014] The communication device 130 may be capable of communicating with devices external to the information processing device 100. The communication device 130 may perform wired communication or wireless communication.

[0015] The input device 140 is a device capable of accepting information input to the information processing device 100 from outside. The input device 140 may include an operation device (e.g., a keyboard, a mouse, a touch panel, etc.) that can be operated by a user of the information processing device 100. The input device 140 may include a recording medium reading device that can read information recorded on a recording medium that is detachable from the information processing device 100, such as a USB (Universal Serial Bus) memory. Note that when information is input to the information processing device 100 via the communication device 130 (in other words, when the information processing device 100 acquires information via the communication device 130), the communication device 130 may function as an input device.

[0016] The output device 150 is a device capable of outputting information to the outside of the information processing device 100. The output device 150 may output, as the information, visual information such as characters or images, auditory information such as sound, or tactile information such as vibration. The output device 150 may include, for example, at least one of a display, a speaker, a printer, and a vibration motor. The output device 150 may be capable of outputting information to a recording medium detachable from the information processing device 100, such as a USB memory. Note that when the information processing device 100 outputs information via the communication device 130, the communication device 130 may function as the output device.

[0017] The processor 1101 of the arithmetic device 110, together with the memory 1201 of the storage device 120 in which a computer program 1201a is stored (in other words, together with the memory 1201 and the computer program 1201a stored in the memory 1201), may execute the processing to be performed by the information processing device 100. For example, the processor 1101 may execute the computer program 1201a, thereby realizing logical functional blocks in the arithmetic device 110 (for example, in the processor 1101) for executing the processing to be performed by the information processing device 100.

[0018] 2, the arithmetic device 110 may include a calculation unit 111, an acquisition unit 112, a determination unit 113, and a warning unit 114, which may be implemented as logically implemented functional blocks or physically implemented processing circuits. At least one of the calculation unit 111, the acquisition unit 112, the determination unit 113, and the warning unit 114 may be implemented as a mixture of logical functional blocks and physical processing circuits (i.e., hardware). When the calculation unit 111, the acquisition unit 112, the determination unit 113, and the warning unit 114 are implemented as functional blocks, the calculation unit 111, the acquisition unit 112, the determination unit 113, and the warning unit 114 may be implemented by a single processor (e.g., processor 1101). Alternatively, the calculation unit 111, the acquisition unit 112, the determination unit 113, and the warning unit 114 may be implemented by different processors. Alternatively, the calculation unit 111, the acquisition unit 112, the judgment unit 113, and a portion of the warning unit 114 may be realized by a single processor, and the remaining portions of the calculation unit 111, the acquisition unit 112, the judgment unit 113, and the warning unit 114 may be realized by one or more other processors different from the single processor.

[0019] The calculation unit 111 calculates a current hash value related to the AI ​​model using a predetermined hash function. Since various existing methods for calculating the hash value can be applied, detailed description thereof will be omitted. The AI ​​model may be used in the information processing device 100, or in a device different from the information processing device 100. For example, if the information processing device 100 constitutes part of a vehicle, the AI ​​model may be used in an Autonomous Driving Kit (ADK) connected to the vehicle.

[0020] The AI ​​model may be a model generated by, for example, machine learning. Examples of machine learning include at least one of supervised learning, unsupervised learning, reinforcement learning, and deep learning. An example of an AI model is an AI model related to autonomous vehicle driving. The AI ​​model related to autonomous vehicle driving may include at least one of an AI model for controlling vehicle behavior, an AI model related to image processing, an AI model related to object detection, and an AI model related to voice recognition. Another example of an AI model is an AI model related to robot control. Examples of robots include at least one of an industrial robot, a collaborative robot, and an autonomous robot.

[0021] In this embodiment, when an AI model is generated, a hash value related to the AI ​​model (e.g., a hash value at the time of model generation) may be calculated using a predetermined hash function. The hash value may be included in model information related to the AI ​​model. In other words, the hash value related to the AI ​​model may constitute at least a part of the model information. Thereafter, transaction data including the model information may be registered in a distributed ledger. An example of a distributed ledger is a blockchain.

[0022] The acquiring unit 112 may identify model information related to the AI ​​model (i.e., the AI ​​model corresponding to the AI ​​model for which the calculation unit 111 calculated a hash value) from the transaction data registered in the distributed ledger. The acquiring unit 112 acquires the hash value included in the identified model information. In other words, the acquiring unit 112 acquires the hash value related to the AI ​​model from the distributed ledger.

[0023] The determination unit 113 compares the hash value calculated by the acquisition unit 111 with the hash value acquired by the acquisition unit 112. The determination unit 113 determines whether the hash value calculated by the acquisition unit 111 and the hash value acquired by the acquisition unit 112 are the same. Here, if the original data changes even slightly, the hash value associated with the changed data will differ from the hash value associated with the original data. Therefore, when the determination unit 113 determines whether the hash value calculated by the acquisition unit 111 and the hash value acquired by the acquisition unit 112 are the same, it can be said that the determination unit 113 is determining whether the current AI model is the same as the AI ​​model at the time of generation.

[0024] When it is determined that the hash value calculated by the acquisition unit 111 and the hash value acquired by the acquisition unit 112 are the same, for example, the calculation device 110 may control the output device 150 to notify the user of the information processing device 100 that the current AI model has not changed from the AI ​​model at the time of generation. On the other hand, when it is determined that the hash value calculated by the acquisition unit 111 and the hash value acquired by the acquisition unit 112 are not the same, the warning unit 114 controls the output device 150 to issue a warning.

[0025] Next, the operation of the information processing device 100 will be described with reference to the flowchart in Fig. 3. In Fig. 3, the calculation unit 111 of the information processing device 100 calculates a current hash value of the AI ​​model using a predetermined hash function (step S101). In parallel with the processing of step S101, the acquisition unit 112 of the information processing device 100 acquires a hash value of the AI ​​model (e.g., a hash value at the time of model generation) from the distributed ledger (step S102). Thereafter, the determination unit 113 of the information processing device 100 determines whether the hash value calculated in the processing of step S101 and the hash value acquired in the processing of step S102 are the same (step S103).

[0026] If it is determined in the process of step S103 that the hash value calculated in the process of step S101 and the hash value acquired in the process of step S102 are not the same (step S103: No), the warning unit 114 of the information processing device 100 controls the output device 150 to issue a warning (step S104). On the other hand, if it is determined that the hash value calculated in the process of step S101 and the hash value acquired in the process of step S102 are the same (step S103: Yes), the operation shown in Fig. 3 may be terminated. In this case, for example, the user of the information processing device 100 may be notified that the current AI model has not changed from the AI ​​model at the time of generation.

[0027] (Technical Effects) A distributed ledger is a system that is extremely resistant to data tampering. Therefore, a hash value related to an AI model registered in the distributed ledger can be considered to be a true value. Therefore, if the hash value calculated by the acquisition unit 111 differs from the hash value acquired by the acquisition unit 112 (i.e., the hash value registered in the distributed ledger), it can be said that the current AI model has changed from the AI ​​model at the time of generation. As described above, the determination unit 113 of the information processing device 100 determines whether the hash value calculated by the acquisition unit 111 and the hash value acquired by the acquisition unit 112 are the same. Therefore, the information processing device 100 according to the first embodiment can detect changes in the AI ​​model.

[0028] If the hash value calculated by the acquisition unit 111 differs from the hash value acquired by the acquisition unit 112, the warning unit 114 of the information processing device 100 controls the output device 150 to issue a warning. This allows the user of the information processing device 100 to know that the AI ​​model has changed. As a result, it is expected that the user will take appropriate action (for example, stop using the AI ​​model, notify the provider of the AI ​​model, etc.).

[0029] Second Embodiment A second embodiment of the information processing device will be described with reference to Figures 4 and 5. The second embodiment may be the same as the first embodiment described above, except that the configuration of the arithmetic unit of the information processing device 100 is partially different. Therefore, for the second embodiment, descriptions that overlap with the description of the first embodiment will be omitted as appropriate.

[0030] The information processing device 100 according to the second embodiment may include a calculation device 110a instead of the calculation device 110. The calculation device 110a may have one or more processors, similar to the calculation device 110. As shown in Fig. 4, the calculation device 110a may include a calculation unit 111, an acquisition unit 112, a determination unit 113, a warning unit 114, and a restoration unit 115 as logically realized functional blocks or as physically realized processing circuits. Note that at least one of the calculation unit 111, the acquisition unit 112, the determination unit 113, the warning unit 114, and the restoration unit 115 may be realized in a form in which a logical functional block and a physical processing circuit (i.e., hardware) are mixed.

[0031] Note that when the calculation unit 111, the acquisition unit 112, the determination unit 113, the warning unit 114, and the restoration unit 115 are realized as functional blocks, the calculation unit 111, the acquisition unit 112, the determination unit 113, the warning unit 114, and the restoration unit 115 may be realized by a single processor (for example, the processor 1101). Alternatively, the calculation unit 111, the acquisition unit 112, the determination unit 113, the warning unit 114, and the restoration unit 115 may be realized by different processors. Alternatively, some of the calculation unit 111, the acquisition unit 112, the determination unit 113, the warning unit 114, and the restoration unit 115 may be realized by one processor, and the remaining parts of the calculation unit 111, the acquisition unit 112, the determination unit 113, the warning unit 114, and the restoration unit 115 may be realized by one or more processors different from the single processor.

[0032] In this embodiment, when an AI model is generated, a backup model (for example, a copy of the generated AI model) as a backup of the generated AI model may be stored in a predetermined device. Note that the predetermined device may be the storage device 120 of the information processing device 100, or may be a device different from the information processing device 100. The device different from the information processing device 100 may be configured to be able to communicate with the information processing device 100. The device different from the information processing device 100 may be, for example, a cloud server or an on-premise server.

[0033] The calculation unit 111 calculates a current hash value related to the AI ​​model using a predetermined hash function. The acquisition unit 112 acquires the hash value related to the AI ​​model from the distributed ledger. The determination unit 113 determines whether the hash value calculated by the acquisition unit 111 and the hash value acquired by the acquisition unit 112 are the same. If it is determined that the hash value calculated by the acquisition unit 111 and the hash value acquired by the acquisition unit 112 are not the same, the warning unit 114 may control the output device 150 to issue a warning.

[0034] If it is determined that the hash value calculated by the acquisition unit 111 and the hash value acquired by the acquisition unit 112 are not identical, the restoration unit 115 may acquire the backup model described above. Note that if the backup model is stored in a device other than the information processing device 100, the restoration unit 115 may acquire (i.e., download) the backup model via the communication device 130. The restoration unit 115 may replace the AI ​​model with the backup model. In other words, the restoration unit 115 may restore the AI ​​model by replacing the changed AI model with a backup model equivalent to the AI ​​model before the change.

[0035] Note that the replacement of the AI ​​model with the backup model may be performed automatically by the restoration unit 115. In this case, the restoration unit 115 may control the output device 150 to notify the user of the information processing device 100 that the AI ​​model has been restored. Alternatively, when it is determined that the hash value calculated by the acquisition unit 111 and the hash value acquired by the acquisition unit 112 are not identical, the restoration unit 115 may control the output device 150 to output, for example, at least one of text, an image, and a voice to inquire of the user of the information processing device 100 whether or not to restore the AI ​​model. When the user requests restoration of the AI ​​model, the restoration unit 115 may replace the AI ​​model with the backup model.

[0036] Next, the operation of the information processing device 100 will be described with reference to the flowchart in Fig. 5. If it is determined in the process of step S103 that the hash value calculated in the process of step S101 and the hash value acquired in the process of step S102 are not identical (step S103: No), the warning unit 114 of the information processing device 100 may control the output device 150 to issue a warning (step S104). In parallel with the process of step S104, the restoration unit 115 of the information processing device 100 may restore the AI ​​model by replacing it with a backup model (step S201).

[0037] The information processing device 100 according to the second embodiment may not include the warning unit 114. In this case, the processing of step S104 shown in Fig. 5 may not be performed. When the AI ​​model is restored by the restoration unit 115, the warning unit 114 may control the output device 150 to stop issuing a warning.

[0038] (Technical Effects) According to the information processing device 100 of the second embodiment, it is possible to detect changes in the AI ​​model, as in the first embodiment. Additionally, in the second embodiment, the AI ​​model is restored by the restoration unit 115. Therefore, according to the information processing device 100 of the second embodiment, it is possible to restore the function of a device that uses the AI ​​model (for example, the information processing device 100) relatively quickly.

[0039] Aspects of the invention derived from the above-described embodiment and modifications will be described below.

[0040] An information processing device according to one aspect of the invention includes a calculation means for calculating a hash value associated with an AI model, an acquisition means for acquiring a hash value associated with the AI ​​model from model information associated with the AI ​​model registered in a distributed ledger, and a determination means for determining whether the calculated hash value and the acquired hash value are identical. In the above-described embodiment, the "calculation unit 111" corresponds to an example of the "calculation means," the "acquisition unit 112" corresponds to an example of the "acquisition means," and the "determination unit 113" corresponds to an example of the "determination means."

[0041] The information processing device may include a warning means that issues a warning when it is determined that the calculated hash value and the acquired hash value are not identical. In the above-described embodiment, the "warning unit 114" corresponds to an example of the "warning means." The information processing device may include a restoration means that replaces the AI ​​model with a backup model that serves as a backup of the AI ​​model when it is determined that the calculated hash value and the acquired hash value are not identical. In the above-described embodiment, the "restoration unit 115" corresponds to an example of the "restoration means."

[0042] The present invention is not limited to the above-described embodiments, but can be modified as appropriate within the scope that does not contradict the gist or idea of ​​the invention that can be read from the claims and the entire specification, and information processing devices that involve such modifications are also included in the technical scope of the present invention. [Explanation of symbols]

[0043] 100...information processing device, 111...calculation unit, 112...acquisition unit, 113...determination unit, 114...warning unit, 115...restoration unit

Claims

1. A calculation means for calculating a hash value related to an AI model; An acquisition means for acquiring a hash value related to the AI ​​model from model information related to the AI ​​model registered in a distributed ledger; a determination means for determining whether the calculated hash value is the same as the acquired hash value; An information processing device comprising:

2. The system further includes a warning unit that issues a warning when it is determined that the calculated hash value is not the same as the acquired hash value.

2. The information processing apparatus according to claim 1, wherein:

3. and a restoration means for replacing the AI ​​model with a backup model as a backup of the AI ​​model when it is determined that the calculated hash value and the acquired hash value are not identical.

3. The information processing apparatus according to claim 1, wherein the information processing apparatus is a computer.

Images