Service provider device, user device, performance verification system, performance verification method, and performance verification program

Abstract

To provide a performance verification system that allows a user to perform performance verification of an inference model provided by a service in advance while preventing the user from just getting on the service in MLaaS.SOLUTION: A service provider apparatus 500 that provides an inference model use service without disclosing an inference model includes a zero knowledge proof verification unit 502 that verifies whether or not selected verification data is acceptable by a verification algorithm of a zero knowledge proof algorithm based on a selective proof that is a zero knowledge proof generated by a proof generation algorithm of the zero knowledge proof algorithm based on selective inference data, a selective signature that is a signature generated using a signature key in a signature algorithm, a verification key corresponding to the signature key, and the selective inference data, and based on the verification key and the selected verification data that is data corresponding to the selective inference data and is data used in inference using the inference model.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present disclosure relates to a service provider device, a user device, a performance verification system, a performance verification method, and a performance verification program. [Background technology]

[0002] Artificial intelligence (AI) inference techniques using neural networks have been highly successful in machine learning tasks such as data classification. Data analysis using neural networks requires prior training of an inference model using a large amount of training data. However, due to the difficulty of preparing training data and the limited computing resources required, it can be difficult for each user to build an inference model in their own environment. Against this backdrop, services offering neural network-based data analysis in cloud systems (Machine Learning as a Service, MLaaS) have emerged in recent years. With MLaaS, users can perform inference using the provided inference model simply by uploading the data they want to analyze to the cloud system, without incurring the cost of building an inference model.

[0003] In MLaaS, users of the service are motivated to verify the inference accuracy (performance) of the inference model provided by the service before starting to use the service. A simple method for pre-verifying inference accuracy is to temporarily make the inference model public and allow users to try it out. However, simply making the inference model public can cause disadvantages to the service because users can use the inference model without any restrictions. Therefore, Non-Patent Document 1 discloses a method using multi-party computation technology to prevent such disadvantages. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Attrapadung, N. et al., “Privacy-Preserving Verifiable CNNs”, ACNS 2024, LNCS vol 14584, 2024, pp.373-402 Summary of the Invention [Problem to be solved by the invention]

[0005] According to the technology disclosed in Non-Patent Document 1, users can use an inference model to make inferences without disclosing the inference model to the users. Therefore, this technology does not cause any disadvantages that arise from simply disclosing the inference model. However, even if the inference model is not made public using this technology, users may repeatedly run inference for verification purposes, which may eliminate the need for actual use of the service. In other words, this technology has the problem that users can free ride on the service.

[0006] The present disclosure aims to provide a performance verification system in MLaaS that allows users to verify the performance of inference models provided by a service in advance, while preventing users from freeloading on the service. [Means for solving the problem]

[0007] The service provider device according to the present disclosure comprises: A device for a service provider that provides a service using an inference model without disclosing the inference model, When each inference data of an inference dataset consisting of each inference data for performing inference using the inference model is selected as inference data, a choice signature, which is a signature generated using the data for choice inference and a signature key in a signature algorithm; a choice proof, which is a zero-knowledge proof generated by a proof generation algorithm of a zero-knowledge proof algorithm based on a verification key corresponding to the signature key and the data for choice inference; the verification key; and Selection verification data, which corresponds to the selection inference data and is used in inference using the inference model; a zero-knowledge proof verification unit that verifies whether the selected verification data is acceptable or not using a verification algorithm of a zero-knowledge proof algorithm based on the Equipped with. [Effects of the Invention]

[0008] According to the present disclosure, a zero-knowledge proof verification unit verifies, using a verification algorithm of a zero-knowledge proof algorithm, whether the selective verification data is data based on a prepared inference model. Here, the selective verification data is data used in inference using the inference model. A user can verify the performance of the inference model in advance using the selective verification data. Furthermore, it is also possible to prevent the service provider device from verifying the performance of the inference model using any data other than selective verification data verified by the verification algorithm of the zero-knowledge proof algorithm. Therefore, according to the present disclosure, a performance verification system can be provided in MLaaS that allows users to verify the performance of inference models provided by a service in advance, while preventing users from freeloading on the service. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a performance verification system 100 according to a first embodiment. [Figure 2] 1 is a diagram showing an example of the configuration of a common parameter generation device 200 according to a first embodiment. [Figure 3] FIG. 1 is a diagram showing an example of the configuration of a data set generation device 300 according to the first embodiment. [Figure 4] FIG. 2 is a diagram showing an example of the configuration of a user device 400 according to the first embodiment. [Figure 5] FIG. 2 is a diagram showing an example of the configuration of a service provider device 500 according to the first embodiment. [Figure 6] FIG. 2 is a diagram showing an example of the hardware configuration of each device according to the first embodiment. [Figure 7] 4 is a flowchart showing the operation of the common parameter generation device 200 according to the first embodiment. [Figure 8] 4 is a flowchart showing the operation of the data set generation device 300 according to the first embodiment. [Figure 9] 6 is a flowchart showing the operation of the user device 400 according to the first embodiment. [Figure 10] 6 is a flowchart showing the operation of the service provider device 500 according to the first embodiment. [Figure 11] FIG. 10 is a diagram showing an example of the hardware configuration of each device according to a modification of the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] In the description of the embodiments and drawings, the same elements and corresponding elements are given the same symbols. The description of elements given the same symbols is omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "unit" may be interpreted as "circuit," "device," "equipment," "process," "step," "procedure," "processing," or "circuitry" as appropriate. The functions of each unit provided in each device may be realized by firmware, software, hardware, or a combination of these.

[0011] Embodiment 1 Hereinafter, this embodiment will be described in detail with reference to the drawings.

[0012] ***Configuration Description*** 1 shows an example of the configuration of a performance verification system 100 according to this embodiment. The performance verification system 100 utilizes zero-knowledge proofs when verifying the performance of an inference model. As shown in FIG. 1, the performance verification system 100 includes a common parameter generation device 200, a data set generation device 300, a user device 400, and a service provider device 500. A plurality of devices constituting the performance verification system 100 are appropriately connected to each other so as to be able to communicate with each other via the Internet 101 .

[0013] The Internet 101 is a communication path that connects the common parameter generation device 200, the data set generation device 300, the user device 400, and the service provider device 500. The Internet 101 is an example of a network. Other types of networks may be used instead of the Internet 101.

[0014] A specific example of the common parameter generation device 200 is a PC (Personal Computer). The common parameter generation device 200 is a computer that generates common parameters to be used in common in the performance verification system 100 and transmits the common parameters to the data set generation device 300, the user device 400, and the service provider device 500 via the Internet 101.

[0015] A specific example of the dataset generation device 300 is a PC. The dataset generation device 300 is a computer that generates a validation dataset to be used in the performance verification system 100 and transmits the validation dataset to the user device 400 via the Internet 101. The dataset generation device 300 is also called a validation dataset generation device.

[0016] A specific example of the user device 400 is a PC. The user device 400 is a computer that generates a modified dataset for verifying the performance of an inference model using the verification dataset received from the dataset generation device 300, and transmits the modified dataset to the service provider device 500 via the Internet 101. The modified dataset consists of multiple pairs of modified data and zero-knowledge proofs. The user device 400 is also called a user computing device. In addition, the user device 400 may verify the performance of the inference model provided by the service provider device 500 by comparing and verifying each modified data in the modified dataset with the inference results corresponding to each modified data.

[0017] The service provider device 500 is a device that provides a service for using an inference model without disclosing the inference model, and a specific example is a PC. The service provider device 500 is a computer that performs performance verification of the inference model using a modified dataset received from the user device 400. The service provider device 500 is also called a service provider computing device.

[0018] The operator of the data set generation device 300 must be different from the operator of the user device 400 and the operator of the service provider device 500. A specific example of the operator is an organization or an institution. The common parameter generation device 200 and the data set generation device 300 may be present in the same computer.

[0019] 2 is a block diagram showing an example of the configuration of the common parameter generation device 200. As shown in FIG. Although not shown, each device has a recording medium for storing data used in each section of the device. The common parameter generation unit 201 generates common parameters pp used in the performance verification system 100. The common parameters pp may also be called public parameters. Although not shown, the common parameter generation unit 201 may have a random number generation function or the like to generate the common parameters pp. The output unit 202 transmits the common parameters pp generated by the common parameter generation unit 201 to the data set generation device 300 , the user device 400 , and the service provider device 500 .

[0020] Fig. 3 is a block diagram showing an example configuration of a data set generation device 300. As shown in Fig. 3, the data set generation device 300 includes an input unit 301, a key generation unit 302, a data set generation unit 303, a signature generation unit 304, and an output unit 305. The input unit 301 receives the common parameters pp from the common parameter generation device 200 . The key generation unit 302 uses the common parameter pp to generate a signing key sk and a verification key vk used in the signature scheme. Each of the signing key sk and the verification key vk is a key in the signature algorithm. Although not shown, the key generation unit 302 may have a random number generation function or the like to generate the signing key sk and the verification key vk. The dataset generation unit 303 generates an inference dataset consisting of multiple inference data x to be used in the performance verification system 100. The inference data x is data for performing inference using an inference model in a system that provides an inference model utilization service without disclosing the inference model. The signature generation unit 304 generates a signature σ for each piece of inference data x generated by the data set generation unit 303 by using the signature key sk generated by the key generation unit 302 . The output unit 305 transmits multiple pairs of all the signatures σ generated by the signature generation unit 304 and the inference data x as verification data sets to the user device 400. The output unit 305 also transmits the verification key vk generated by the key generation unit 302 to the user device 400 and the service provider device 500.

[0021] Fig. 4 is a block diagram showing an example configuration of user device 400. As shown in Fig. 4, user device 400 has an input unit 401, a signature verification unit 402, a modified data generation unit 403, a zero-knowledge proof generation unit 404, and an output unit 405.

[0022] The input unit 401 receives the common parameters pp from the common parameter generation device 200. The input unit 401 also receives, from the data set generation device 300, a plurality of pairs of inference data x and signature σ as a verification data set, and also receives a verification key vk.

[0023] The signature verification unit 402 performs signature verification on a pair of inference data x and signature σ using a verification key vk. That is, the signature verification unit 402 verifies whether each piece of inference data x in the inference data set is acceptable or not using the verification algorithm of the signature algorithm, using each piece of inference data x, the signature σ corresponding to each piece of inference data x, and the verification key vk. If the verification result is unacceptable, the process is terminated.

[0024] The modified data generation unit 403 applies the modification f to each of the plurality of pieces of inference data x to generate a plurality of pieces of modified data y.

[0025] The zero-knowledge proof generation unit 404 generates a choice proof, which is a zero-knowledge proof π, based on the choice signature, the verification key vk, and the choice inference data using a proof generation algorithm of the zero-knowledge proof algorithm. The choice signature is a signature generated using the choice inference data and the signing key sk. The choice inference data is each inference data x in the inference dataset. We will also explain the case where each transformation data y is selected transformation data, and the signing key sk and verification key vk are each generated using a common parameter pp. Here, the selected transformation data is data corresponding to the selected inference data and is data for verifying the performance of the inference model. In this case, the zero-knowledge proof generation unit 404 may generate a selected proof by inputting evidence w, statement s, and the common parameter pp into a proof generation algorithm. The evidence w consists of the selected inference data, the selected signature, and a transformation f corresponding to the selected transformation data. The statement s consists of the selected transformation data and the verification key vk. Furthermore, the zero-knowledge proof generation unit 404 may generate a selection proof when all of the results of verifying each inference data x in the inference data set using a verification algorithm are acceptable. In this case, the zero-knowledge proof generation unit 404 may generate a zero-knowledge proof π from the inference data x, the signature σ, the transformation f, the transformed data y, the verification key vk, and the common parameter pp.

[0026] The output unit 405 transmits the transformed data y generated by the transformed data generation unit 403 and the zero-knowledge proof π generated by the zero-knowledge proof generation unit 404 to the service provider device 500.

[0027] 5 is a block diagram showing an example of the configuration of the service provider device 500. As shown in FIG. 5, the service provider device 500 includes an input unit 501, a zero-knowledge proof verification unit 502, and a performance verification unit 503.

[0028] The input unit 501 receives the common parameter pp from the common parameter generation device 200, and receives the transformed data y and the zero-knowledge proof π from the user device 400. The input unit 501 also receives the verification key vk from the data set generation device 300. The verification key vk corresponds to the signature key sk.

[0029] The zero-knowledge proof verification unit 502 verifies the zero-knowledge proof π using the common parameter pp, the verification key vk, and the transformed data y. If the verification result is not acceptable, the process is stopped. Specifically, the zero-knowledge proof verification unit 502 verifies whether the selective verification data is acceptable or not using a verification algorithm of the zero-knowledge proof algorithm, based on the selected proof, the verification key vk, and the selective verification data. The selected proof is a zero-knowledge proof π generated by a proof generation algorithm of the zero-knowledge proof algorithm, based on the selected signature, the verification key vk, and the selective inference data. The selective verification data is data corresponding to the selective inference data and is data used in inference using an inference model. The selective verification data may be the selective inference data itself. Next, a case will be described in which each transformed data y is selected transformed data. Here, the selected transformed data corresponds to selected verification data, and is data for verifying the performance of the inference model. In this case, the selected proof is generated by a proof generation algorithm using the selected signature, the verification key vk, the selected inference data, the selected transformed data, and the transformation f corresponding to the selected transformed data. Furthermore, the zero-knowledge proof verification unit 502 may verify whether the selected transformed data is acceptable or not by a verification algorithm using the selected proof, the verification key vk, and the selected transformed data. Also, the case will be described where the signing key sk and the verification key vk are each generated using a common parameter pp, and the chosen proof is generated by a proof generation algorithm using the common parameter. In this case, the zero-knowledge proof verification unit 502 may verify whether the selected transformation data is acceptable by inputting the statement s, the common parameter pp, and the chosen proof into the verification algorithm. The statement s consists of the selected transformation data and the verification key vk.

[0030] If the results of verifying each piece of transformed data y using the verification algorithm are all acceptable, the performance verification unit 503 generates an inference result using each piece of transformed data y and the inference model. Specifically, the performance verification unit 503 obtains the inference result by performing inference using the inference model and multiple pieces of transformed data y. Furthermore, the performance verification unit 503 transmits the generated inference results to the user device 400. Upon receiving the inference results, the user device 400 compares and verifies the transmitted transformed data with the inference results, thereby confirming the performance of the inference model.

[0031] 6 shows an example of hardware resources of each device according to this embodiment, that is, an example of the hardware configuration of each device. Each device is made up of a computer. Each device may be made up of multiple computers.

[0032] 6, each device is a computer equipped with hardware such as a processor 11, a ROM 13, a RAM 14, a communication board 15, a display 31 (display device), a keyboard 32, a mouse 33, a drive 34, and a magnetic disk device 20. These pieces of hardware are connected appropriately via a bus 12. The ROM 13, the RAM 14, the magnetic disk device 20, and the drive 34 are each an example of a storage device. The keyboard 32, the mouse 33, and the communication board 15 are each an example of an input device. The display 31 and the communication board 15 are each an example of an output device.

[0033] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). Each device may have multiple processors that take the place of the processor 11. The multiple processors share the role of the processor 11.

[0034] The ROM 13 is typically a non-volatile storage device, and specific examples thereof include a hard disk drive (HDD) or a flash memory. Data stored in the ROM 13 is loaded into the RAM 14 as needed.

[0035] The RAM 14 is typically a volatile storage device. The RAM 14 is also called a primary storage device or a main memory. Data stored in the RAM 14 is saved in the ROM 13 as needed. The ROM 13 and the RAM 14 may be integrally configured.

[0036] The communication board 15 is a receiver and a transmitter. Specific examples of the communication board 15 include a communication chip or a network interface card (NIC). The communication board 15 is connected to a communication network such as a local area network (LAN), the Internet, or a telephone line via a wired or wireless connection. Each unit of each device may use a communication board 15 as appropriate when communicating with other devices.

[0037] The drive 34 is a device that reads and writes data from and to a storage medium such as a flexible disk drive (FD), a compact disc (CD), or a digital versatile disc (DVD).

[0038] The magnetic disk device 20 stores an OS 21 (operating system), a group of programs 22, and a group of files 23.

[0039] The program group 22 includes a program that executes a function described as a "unit" in this embodiment. The program (specifically, a data search program and a data registration program) is read and executed by the processor 11. That is, the program causes the computer to function as a "unit" and also causes the computer to execute the procedure and method of the "unit."

[0040] The file group 23 includes various data (input, output, determination results, calculation results, processing results, etc.) used in the "part" described in this embodiment.

[0041] Data used when executing the performance verification program and data obtained by executing the performance verification program are stored in a storage device as appropriate. Each part of each device uses a storage device as appropriate. Note that the terms "data" and "information" may have the same meaning. The storage device may be independent of the computer. The functions of the ROM 13 and RAM 14 may be realized by other storage devices.

[0042] The performance verification program may be recorded on a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The performance verification program may be provided as a program product.

[0043] ***Explanation of Operation*** The operating procedures of the devices included in the performance verification system 100 are collectively referred to as a performance verification method. Also, the programs that realize the operations of the devices included in the performance verification system 100 are collectively referred to as a performance verification program.

[0044] First, the cryptographic algorithms used in the performance verification system 100, ie, signature Sig and zero-knowledge proof ZKProof, will be described.

[0045] The signature Sig consists of three algorithms: KeyGen, Sign, and VerifyS. Each algorithm works as follows: KeyGen is an algorithm that generates a signing key sk and a verification key vk. Sign is an algorithm that receives data x and a signing key sk as input and generates a signature σ. VerifyS is an algorithm that receives data x, a signature σ, and a verification key vk as input, and outputs acceptance or rejection as a verification result. VerifyS corresponds to the verification algorithm of the signature algorithm.

[0046] Zero-knowledge proof ZKProof consists of three algorithms: Setup, Prove, and VerifyP. Each algorithm works as follows: Setup is an algorithm that generates the common parameters pp. Prove is an algorithm that takes common parameters pp, evidence w, and statement s as input and generates a zero-knowledge proof π. Prove is the proof generation algorithm for zero-knowledge proof algorithms. VerifyP is an algorithm that receives a common parameter pp, a statement s, and a zero-knowledge proof π as input, and outputs acceptance or rejection as a verification result. VerifyP is a verification algorithm for zero-knowledge proof algorithms.

[0047] The calculation method performed in the performance verification system 100 using Sig and ZKProof will be described below.

[0048] 7 is a flowchart showing an example of the operation of the common parameter generation device 200. The operation will be described with reference to FIG.

[0049] (Step S201) The common parameter generation unit 201 executes Setup to generate common parameters pp.

[0050] (Step S202) The output unit 202 transmits the common parameter pp to each device.

[0051] 8 is a flowchart showing an example of the operation of the data set generation device 300. The operation will be described with reference to FIG.

[0052] (Step S301) The input unit 301 receives the common parameters pp.

[0053] (Step S302) The key generation unit 302 executes KeyGen using the common parameters pp to generate a signature key sk and a verification key vk.

[0054] (Step S303) The dataset generation unit 303 generates an inference dataset consisting of multiple inference data x. Note that the dataset generation unit 303 may use an already published dataset as the inference dataset. The inference data is data used when performing inference using an inference model provided by MLaaS (Machine Learning as a Service).

[0055] (Step S304) The signature generation unit 304 generates a signature σ by executing Sign on each piece of inference data x in the inference data set and the signature key sk.

[0056] (Step S305) The output unit 305 transmits all pairs of the generated signature σ and the inference data x as a verification data set to the user device 400. The output unit 305 also transmits the verification key vk generated by the key generation unit 302 to the user device 400 and the service provider device 500.

[0057] 9 is a flowchart showing an example of the operation of the user device 400. The operation will be explained using FIG.

[0058] (Step S401) The input unit 401 receives a common parameter pp, a verification key vk, and each set of inference data x and a signature σ as a verification data set.

[0059] (Step S402) The signature verification unit 402 executes VerifyS for each pair of inference data x and signature σ using a verification key vk. If any of the verification results for each pair of inference data x and signature σ is not accepted, the process is stopped. If all of the verification results for each pair of inference data x and signature σ are accepted, the next process is executed.

[0060] (Step S403) The modified data generation unit 403 applies a modification f to a plurality of pieces of inference data x to generate a plurality of pieces of modified data y. The modification f may be rotation, superposition, or addition of noise.

[0061] (Step S404) The zero-knowledge proof generation unit 404 generates a zero-knowledge proof π by executing Prove with the inference data x, the signature σ, and the transformation f as evidence w, the transformed data y and the verification key vk as statement s, and the common parameter pp. The process of generating a zero-knowledge proof π is repeated for each pair of inference data x and the transformed data y for each inference data x.

[0062] (Step S405) The output unit 405 transmits a plurality of pairs each consisting of the transformed data y and the zero-knowledge proof π to the service provider device 500.

[0063] 10 is a flowchart showing an example of the operation of the service provider device 500. The operation will be described with reference to FIG.

[0064] (Step S501) The input unit 501 receives a common parameter pp, a verification key vk, transformed data y, and a zero-knowledge proof π.

[0065] (Step S502) The zero-knowledge proof verification unit 502 executes VerifyP using the transformed data y and the verification key vk as statement s, along with the common parameter pp and the zero-knowledge proof π. If any one of the verification results for each pair of the transformed data y and the zero-knowledge proof π is unacceptable, the process is stopped. If all of the verification results for each pair of the transformed data y and the zero-knowledge proof π are acceptable, the next process is executed.

[0066] (Step S503) The performance verification unit 503 generates an inference result by sequentially inputting the transformed data y to the inference model.

[0067] (Step S504) The performance verification unit 503 communicates with the user device 400, compares the inference results for the modified data with the modified data, and checks the accuracy of the inference results to verify the performance of the inference model.

[0068] ***Explanation of the effect of the first embodiment*** The performance verification system 100 according to this embodiment has the following advantages. A user of MLaaS can check the inference performance of an inference model provided by MLaaS before starting to use the service. Here, the dataset used to check the inference performance is not prepared by the user but is prepared in advance. Therefore, a user cannot abuse the function for verifying inference performance to free ride on the service. Therefore, according to this embodiment, it is possible to provide a function for verifying the performance of an inference model provided by MLaaS while preventing users from free riding on MLaaS. Furthermore, in the performance verification system 100 according to this embodiment, a pre-prepared dataset is utilized when verifying inference performance. However, the user may also modify the dataset. Therefore, it is not effective from the viewpoint of improving the inference performance of the inference model to be verified for the service provider to perform optimal learning on the dataset and generate an inference model. Therefore, according to this embodiment, the user can obtain verification results of the inference model with a relatively high degree of accuracy.

[0069] ***Other Configurations*** <Variation 1> FIG. 11 shows an example of the hardware configuration of each device according to this modification. Each device includes a processing circuit 18 in place of the processor 11, the processor 11 and ROM 13, the processor 11 and RAM 14, or the processor 11, ROM 13, and RAM 14. The processing circuitry 18 is hardware that realizes at least a part of each unit provided in each device. The processing circuit 18 may be dedicated hardware, or may be a processor that executes a program stored in the ROM 13 .

[0070] When processing circuitry 18 is dedicated hardware, processing circuitry 18 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. Each device may include multiple processing circuits that replace the processing circuit 18. The multiple processing circuits share the role of the processing circuit 18.

[0071] In each device, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0072] Processing circuitry 18 is illustratively implemented in hardware, software, firmware, or a combination thereof. The processor 11, ROM 13, RAM 14, and processing circuit 18 are collectively referred to as "processing circuitry." In other words, the functions of the functional components of each device are realized by the processing circuitry.

[0073] ***Other embodiments*** Although the first embodiment has been described, it is also possible to combine multiple parts of this embodiment. Alternatively, it is also possible to implement this embodiment in part. In addition, this embodiment may be modified in various ways as needed, and may be implemented in any combination, either as a whole or in part. The above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, its applications, and uses. The procedures described using flowcharts and the like may be modified as appropriate. The processes described based on flowcharts and the like are executed using the hardware included in each device.

[0074] Various aspects of the present disclosure are summarized below as appendices.

[0075] (Appendix 1) A device for a service provider that provides a service using an inference model without disclosing the inference model, When each inference data of an inference dataset consisting of each inference data for performing inference using the inference model is selected as inference data, a choice signature, which is a signature generated using the data for choice inference and a signature key in a signature algorithm; a choice proof, which is a zero-knowledge proof generated by a proof generation algorithm of a zero-knowledge proof algorithm based on a verification key corresponding to the signature key and the data for choice inference; the verification key; and Selection verification data, which corresponds to the selection inference data and is used in inference using the inference model; a zero-knowledge proof verification unit that verifies whether the selected verification data is acceptable or not using a verification algorithm of a zero-knowledge proof algorithm based on the A service provider device comprising:

[0076] (Appendix 2) Each transformed data generated by applying a transformation to each inference data of the inference data set is designated as selected transformed data; When the selected transformation data corresponds to the selected verification data and is data for verifying the performance of the inference model, the selected proof is generated by the proof generation algorithm using the selected signature, the verification key, the selected inference data, the selected transformation data, and a transformation corresponding to the selected transformation data; The zero-knowledge proof verification unit is a service provider device described in Appendix 1 that uses the selected proof, the verification key, and the selected transformed data to verify whether the selected transformed data is acceptable using the verification algorithm.

[0077] (Appendix 3) each of the signature key and the verification key is generated using a common parameter; the selected proof is generated by the proof generation algorithm using the common parameters; The zero-knowledge proof verification unit is a service provider device described in Appendix 2, which verifies whether the selected transformation data is acceptable by inputting the selected transformation data and the verification key as a statement, the statement, the common parameter, and the selected proof into the verification algorithm.

[0078] (Appendix 4) The service provider device further comprises: a performance verification unit that generates an inference result using each of the transformed data and the inference model when the results of verifying each of the transformed data by the verification algorithm are all acceptable; 4. A service provider device according to claim 2 or 3, comprising:

[0079] (Appendix 5) A zero-knowledge proof generation unit that generates a selected proof, which is a zero-knowledge proof, by a proof generation algorithm of a zero-knowledge proof algorithm based on selected inference data, which is each inference data of an inference dataset consisting of each inference data for performing inference using the inference model, a selected signature, which is a signature generated using a signing key in a signature algorithm, a verification key corresponding to the signing key, and the selected inference data, in a system that provides a service that uses the inference model without disclosing the inference model. A user device comprising:

[0080] (Appendix 6) Each transformed data generated by applying a transformation to each inference data of the inference data set is designated as selected transformed data; the selected transformation data is data corresponding to the selected inference data and is data for verifying the performance of the inference model; When the signature key and the verification key are each generated using a common parameter, The zero-knowledge proof generation unit generates the selected proof by inputting the evidence, the statement, and the common parameters into the proof generation algorithm, using the selected inference data, the selected signature, and a transformation corresponding to the selected transformation data as evidence, and the selected transformation data and the verification key as a statement.

[0081] (Appendix 7) The user device further comprises: a signature verification unit that verifies whether each piece of inference data in the inference data set is acceptable or not by a verification algorithm of a signature algorithm using each piece of inference data, a signature corresponding to each piece of inference data, and the verification key; Equipped with A user device as described in Appendix 5 or 6, wherein the zero-knowledge proof generation unit generates the selection proof when all results of verifying each inference data set in the inference data set using the verification algorithm are accepted.

[0082] (Appendix 8) A service provider device according to any one of appendices 1 to 4; A user device according to any one of appendices 5 to 7; A performance verification system comprising: [Explanation of symbols]

[0083] 11 processor, 12 bus, 13 ROM, 14 RAM, 15 communication board, 18 processing circuit, 20 magnetic disk device, 21 OS, 22 program group, 23 file group, 31 display, 32 keyboard, 33 mouse, 34 drive, 100 performance verification system, 101 Internet, 200 common parameter generation device, 201 common parameter generation unit, 202 output unit, 300 dataset generation device, 301 input unit, 302 key generation unit, 303 dataset generation unit, 304 signature generation unit, 305 output unit, 400 user device, 401 input unit, 402 signature verification unit, 403 transformed data generation unit, 404 zero-knowledge proof generation unit, 405 output unit, 500 service provider device, 501 input unit, 502 zero-knowledge proof verification unit, 503 performance verification unit.

Claims

1. A device for a service provider that provides a service using an inference model without disclosing the inference model, When each inference data of an inference dataset consisting of each inference data for performing inference using the inference model is selected as inference data, a choice signature, which is a signature generated using the data for choice inference and a signature key in a signature algorithm; a choice proof, which is a zero-knowledge proof generated by a proof generation algorithm of a zero-knowledge proof algorithm based on a verification key corresponding to the signature key and the data for choice inference; the verification key; and Selection verification data, which corresponds to the selection inference data and is used in inference using the inference model; a zero-knowledge proof verification unit that verifies whether the selected verification data is acceptable or not using a verification algorithm of a zero-knowledge proof algorithm based on the A service provider device comprising:

2. Each transformed data generated by applying a transformation to each inference data of the inference data set is designated as selected transformed data; When the selected transformation data corresponds to the selected verification data and is data for verifying the performance of the inference model, the selected proof is generated by the proof generation algorithm using the selected signature, the verification key, the selected inference data, the selected transformation data, and a transformation corresponding to the selected transformation data; The service provider device according to claim 1, wherein the zero-knowledge proof verification unit uses the selected proof, the verification key, and the selected transformation data to verify whether the selected transformation data is acceptable using the verification algorithm.

3. each of the signature key and the verification key is generated using a common parameter; the selected proof is generated by the proof generation algorithm using the common parameters; The zero-knowledge proof verification unit verifies whether the selected transformation data is acceptable by inputting the selected transformation data and the verification key as a statement, the statement, the common parameter, and the selected proof into the verification algorithm.

4. The service provider device further comprises: a performance verification unit that generates an inference result using each of the transformed data and the inference model when the results of verifying each of the transformed data by the verification algorithm are all acceptable; 4. The service provider device according to claim 2 or 3, comprising:

5. A zero-knowledge proof generation unit that generates a selected proof, which is a zero-knowledge proof, by a proof generation algorithm of a zero-knowledge proof algorithm based on selected inference data, which is each inference data of an inference dataset consisting of each inference data for performing inference using the inference model, a selected signature, which is a signature generated using a signing key in a signature algorithm, a verification key corresponding to the signing key, and the selected inference data, in a system that provides a service that uses the inference model without disclosing the inference model. A user device comprising:

6. Each transformed data generated by applying a transformation to each inference data of the inference data set is designated as selected transformed data; the selected transformation data is data corresponding to the selected inference data and is data for verifying the performance of the inference model; When the signature key and the verification key are each generated using a common parameter, The user device of claim 5, wherein the zero-knowledge proof generation unit generates the selected proof by inputting the evidence, the statement, and the common parameters into the proof generation algorithm, using the selected inference data, the selected signature, and the transformation corresponding to the selected transformation data as evidence, and the selected transformation data and the verification key as a statement.

7. The user device further comprises: a signature verification unit that verifies whether each piece of inference data in the inference data set is acceptable or not by a verification algorithm of a signature algorithm using each piece of inference data, a signature corresponding to each piece of inference data, and the verification key; Equipped with The user device according to claim 5 or 6, wherein the zero-knowledge proof generation unit generates the selection proof when all results of verifying each inference data set in the inference data set using the verification algorithm are accepted.

8. A service provider device according to claim 1; A user device according to claim 5; A performance verification system comprising:

9. A performance verification method executed by a service provider device, which is a computer that provides a service using an inference model without disclosing the inference model, comprising: When each inference data of an inference dataset consisting of each inference data for performing inference using the inference model is selected as inference data, a zero-knowledge proof verification unit of the service provider device, a choice signature, which is a signature generated using the data for choice inference and a signature key in a signature algorithm; a choice proof, which is a zero-knowledge proof generated by a proof generation algorithm of a zero-knowledge proof algorithm based on a verification key corresponding to the signature key and the data for choice inference; the verification key; and Selection verification data, which corresponds to the selection inference data and is used in inference using the inference model; A performance verification method for verifying whether the selected verification data is acceptable or not using a verification algorithm of a zero-knowledge proof algorithm based on the above.

10. A performance verification method in which a zero-knowledge proof generation unit of a user device, which is a computer, generates a selected proof, which is a zero-knowledge proof, using a proof generation algorithm of a zero-knowledge proof algorithm based on selected inference data, which is each inference data of an inference dataset consisting of each inference data for performing inference using an inference model in a system that provides a service for using the inference model without disclosing the inference model, a selected signature, which is a signature generated using a signing key in a signature algorithm, a verification key corresponding to the signing key, and the selected inference data.

11. A performance verification program executed on a computer that provides a service for using an inference model without disclosing the inference model, When each inference data of an inference dataset consisting of each inference data for performing inference using the inference model is selected as inference data, The zero-knowledge proof verification unit a choice signature, which is a signature generated using the data for choice inference and a signature key in a signature algorithm; a choice proof, which is a zero-knowledge proof generated by a proof generation algorithm of a zero-knowledge proof algorithm based on a verification key corresponding to the signature key and the data for choice inference; the verification key; and Selection verification data, which corresponds to the selection inference data and is used in inference using the inference model; A zero-knowledge proof verification process that verifies whether the selected verification data is acceptable or not using a verification algorithm of a zero-knowledge proof algorithm based on the A performance verification program that causes the computer to function as a service provider device that performs the above.

12. A zero-knowledge proof generation process in which a zero-knowledge proof generation unit generates a selected proof, which is a zero-knowledge proof, by a proof generation algorithm of a zero-knowledge proof algorithm based on selected inference data, which is each inference data of an inference dataset consisting of each inference data for performing inference using an inference model in a system that provides a service that uses the inference model without disclosing the inference model, a selected signature, which is a signature generated using a signing key in a signature algorithm, a verification key corresponding to the signing key, and the selected inference data. A performance verification program that causes a computer to function as a user device.

Images