Machine learning systems and methods

Abstract

To provide a machine learning system and a method capable of ensuring a high level of security in machine learning.SOLUTION: Each of a plurality of client terminals extracts a first parameter column from a machine learning model on which learning processing has been performed, changes an arrangement of the first parameter column, generates a first fragment parameter column by performing secret sharing on the first parameter column of which the arrangement has been changed, and transmits the first fragment parameter column to a plurality of integration server devices. Each of the plurality of integration server devices changes the arrangement of each of the plurality of first fragment parameter columns received from the plurality of client terminals; and generates a second fragment parameter column by performing integration processing on the plurality of first fragment parameter columns of which the arrangement has been changed. The machine learning model is updated on the basis of a second parameter column decoded from a plurality of second fragment parameter columns.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] FIELD OF THE INVENTION Embodiments of the present invention relate to machine learning systems and methods. [Background technology]

[0002] In recent years, advanced telecommunications services using digitized data (information) have been provided. These telecommunications services make it possible to provide information tailored to the environment based on various data.

[0003] Incidentally, machine learning (learning models generated by it) can be considered as a way to provide the above-mentioned telecommunications services. The scale of machine learning tends to expand, and in recent years, large-scale machine learning has been realized by outsourcing the computations (calculations) related to the machine learning to businesses that provide cloud computing services (hereinafter referred to as cloud businesses).

[0004] However, the learning data used in machine learning may contain personal information, etc., and there is a risk that the learning data may be leaked when machine learning calculations are outsourced to a cloud service provider. Specifically, for example, when machine learning is performed by collecting (aggregating) learning data held by multiple organizations, the learning data may be leaked when collecting the learning data from the multiple organizations, and there is also a possibility that the learning data may be leaked from the integrated server device.

[0005] Federated learning is known as a technique for preventing such leakage of training data. Federated learning is a technique for performing machine learning using training data across multiple organizations. In this federated learning, for example, a master model (global model) is distributed to each of the multiple organizations, and each organization performs training on the master model using the training data distributed and held by each of the multiple organizations. The results of the training performed in each of the multiple organizations (the difference between the master model before the update and the master model after the update) are collected by an integrated server device, and the master model is updated using the collected training results.

[0006] In other words, in federated learning, learning is performed with the learning data distributed without collecting the learning data held by each of multiple organizations (i.e., only the results of the learning are provided to the integrated server device), which makes it possible to prevent the learning data from being leaked when the learning data is collected or the learning data collected by the integrated server device from being leaked from the integrated server.

[0007] Furthermore, in federated learning, only the differences between the master model before the update and the master model after the update (e.g., the parameters of the master model after the update) are collected by the integrated server device, which has the added advantage of reducing the amount of communication data when performing machine learning.

[0008] However, even if federated learning is applied, it is not possible to eliminate the threat of learning data being inferred from information collected by the integrated server device (such as parameters obtained during the learning process), and therefore, if the information is leaked, sufficient security may not be ensured. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] International Publication No. 2021 / 059604 Summary of the Invention [Problem to be solved by the invention]

[0010] Therefore, the problem to be solved by the present invention is to provide a machine learning system and method that can ensure high security in machine learning. [Means for solving the problem]

[0011] According to an embodiment, there is provided a machine learning system including a plurality of client terminals and a plurality of integrated server devices communicatively connected to the plurality of client terminals. Each of the plurality of client terminals includes: a learning processing means for executing a learning process for a machine learning model using learning data managed by the client terminal; an extraction means for extracting a first parameter sequence in which a plurality of parameters are arranged from the machine learning model on which the learning process has been executed; a first modification means for changing the arrangement of the plurality of parameters in the extracted first parameter sequence; a first generation means for generating a first fragment parameter sequence corresponding to each of the plurality of integrated server devices by performing secret sharing on the first parameter sequence with the changed arrangement of the plurality of parameters; and a transmission means for transmitting the generated first fragment parameter sequence to each of the plurality of integrated server devices. Each of the plurality of integrated server devices includes a receiving means for receiving a plurality of first fragment parameters transmitted by a transmission means included in each of the plurality of client terminals; a second modification means for changing the arrangement of the plurality of fragment parameters in each of the received plurality of first fragment parameter sequences; and a second generation means for generating a second fragment parameter sequence by executing an integration process on the plurality of first fragment parameter sequences with the changed arrangement of the plurality of fragment parameters. The machine learning model is updated based on a plurality of parameters in a second parameter sequence decoded from a plurality of second fragment parameter sequences generated by a second generation means included in each of the plurality of integrated server devices. [Brief explanation of the drawings]

[0012] [Figure 1]FIG. 1 is a diagram showing an example of a network configuration of a machine learning system according to a first embodiment. [Figure 2] FIG. 2 is a diagram showing an example of the hardware configuration of a client terminal. [Figure 3] FIG. 2 is a diagram showing an example of the functional configuration of a client terminal. [Figure 4] FIG. 2 is a diagram showing an example of the functional configuration of an integrated server apparatus. [Figure 5] 1 is a sequence chart showing an example of a processing procedure of a machine learning system. [Figure 6] FIG. 10 is a diagram for explaining an example of an array change process. [Figure 7] FIG. 1 is a diagram for explaining a first application example of a machine learning system. [Figure 8] FIG. 10 is a diagram for explaining a second application example of the machine learning system. [Figure 9] FIG. 10 is a diagram showing an example of the functional configuration of a client terminal according to the second embodiment. [Figure 10] 1 is a sequence chart showing an example of a processing procedure of a machine learning system. [Figure 11] FIG. 11 is a diagram for explaining an example of an arrangement change process according to the third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, each embodiment will be described with reference to the drawings. (First embodiment) First, a description will be given of the first embodiment. Fig. 1 shows an example of the network configuration of a machine learning system according to the first embodiment.

[0014] The machine learning system 1 of this embodiment is equipped with multiple client terminals and multiple integrated server devices, and is used to perform machine learning on machine learning models used to provide various services (telecommunications services) (i.e., to generate machine learning models through machine learning).

[0015] In this embodiment, the multiple client terminals include client terminals 10-1 to 10-M (M is an integer of 2 or more), and the multiple integrated server devices include integrated server devices 20-1 to 20-N (N is an integer of 2 or more).

[0016] Each of client terminals 10-1 to 10-M and integrated server devices 20-1 to 20-N is realized by an electronic device (computer) such as a personal computer, etc. Furthermore, client terminals 10-1 to 10-M and integrated server devices 20-1 to 20-N are communicatively connected via network 30 such as the Internet.

[0017] The client terminals 10-1 to 10-M are configured to manage (or access) data held by the corresponding organizations (clients), and in this embodiment, it is assumed that the data is used as training data to perform machine learning on a machine learning model. It is assumed that different training data is managed in each of the client terminals 10-1 to 10-M.

[0018] Furthermore, each of integrated server devices 20-1 to 20-N may be realized as a cloud server device that provides cloud computing services to client terminals 10-1 to 10-M described above.

[0019] In this embodiment, the number of client terminals 10-1 to 10-M and the number of integrated server devices 20-1 to 20-N may be the same or different.

[0020] Here, it is conceivable to collect data (learning data) managed in each of the client terminals 10-1 to 10-M and perform machine learning using the collected learning data, but in such a configuration, there is a possibility that the learning data may be leaked when the learning data is collected from the client terminals 10-1 to 10-M.

[0021] In response to this, it may be possible to suppress the leakage of training data by applying a technique known as federated learning, for example.

[0022] However, in federated learning, it is necessary to collect the parameters of the machine learning model (updated machine learning model) obtained by performing machine learning as the learning result. If the parameters of this machine learning model are leaked when they are collected, the training data may be inferred from the parameters, so it cannot be said that the security against the leakage of the training data is sufficient.

[0023] For this reason, in this embodiment, when machine learning is performed using the learning data managed in each of the client terminals 10-1 to 10-M, a configuration is adopted in which the above parameters are kept secret (encrypted).

[0024] Incidentally, the technologies (secrecy computation technologies) for realizing the above-mentioned confidentiality include homomorphic encryption and secret sharing schemes, but homomorphic encryption generally requires a larger amount of computation (computational complexity) than secret sharing schemes. For this reason, the secret sharing scheme is used as the secret computation technology applied in this embodiment.

[0025] A secret sharing scheme is a method of converting data to be kept secret (secret information) into a plurality of fragmented data called shares, and Shamir's secret sharing scheme is known as an example of such a secret sharing scheme.

[0026] Below, we will explain the outline of Shamir's secret sharing scheme. Here, we consider the case where the owner of data a to be kept secret securely distributes the data a to n pieces.

[0027] In such a case, according to Shamir's secret sharing scheme, the data holder selects a field (ring of integers) Q such that a∈Q and performs secret sharing.

[0028] Specifically, k-1 (k is an integer between 2 and n) random elements of field Q, r1,...,r k-1 and construct the following equation (1), which is a k-1 degree polynomial with the data a to be anonymized as an intercept.

number

[0029] Also, there are n elements P1,…,P n Select (decide) the P1,...,P n By applying these to P in the above equation (1), W(P1), ..., W(P n ) is calculated. k-1 and P1,…,P n corresponds to the coefficient in equation (1). Also, P1,...,P n are different values. In other words, P t (t=1,2,…,n) is P t´ This is different from (t´=1,2,…,n and t≠t´).

[0030] W(P1),...,W(P n ) is a share (fragment data) of data a to be anonymized, and is transmitted to, for example, n different server devices.

[0031] This allows the data a to be concealed to be distributed to n server devices. The n server devices are referred to as server devices S1, ..., S n Let us assume that the server device S t (t=1,2,…,n) is the share sent to t ), then the W(P t ) is, for example, [a] t :=W(P t )

[0032] Next, consider the case where data a is restored from n shares distributed as described above. In this case, the n servers S1, ..., S nAmong them, k server devices (hereinafter referred to as server devices S t1 ,…,S tk and select the selected server device S t1 ,…,S tk The server device S t1 ,…,S tk The share received from [a] t1 ,…,[a] tk Let's say.

[0033] In this case, data a has k shares [a] t1 ,…,[a] tk can be restored using the following equation (2).

number

[0034] In addition, λ in Equation (2) tj are the Lagrange coefficients in the Lagrange interpolation method.

[0035] According to the above-mentioned Shamir's secret sharing scheme, n shares (fragment data) can be generated (calculated) from one piece of data a to be concealed, and the n shares can be distributed to n server devices, and the original data a (concealed information) can be restored by collecting a predetermined k shares from the distributed n shares. In other words, for integers n and k greater than or equal to 2 such that k≦n, the Shamir's secret sharing scheme has both loss resistance, which allows the original data a to be restored even if k shares are lost, and confidentiality, which prevents the original data a from being restored from fewer than k shares.

[0036] In this embodiment, each of the client terminals 10-1 to 10-M executes a learning process for a machine learning model, and encrypts (conceals) the results of the learning process (i.e., the parameters of the updated machine learning model) by using a secret sharing scheme based on the above-mentioned Shamir's secret sharing scheme.

[0037] In the secret sharing scheme of this embodiment, the plurality of integrated server devices 20-1 to 20-N are the above-mentioned server devices S1, . . . , S n is equivalent to

[0038] The machine learning system 1 according to this embodiment will be described in detail below. First, with reference to Figure 2, an example of the hardware configuration of client terminal 10-1, one of client terminals 10-1 to 10-M included in machine learning system 1, will be described. Here, for convenience, the hardware configuration of client terminal 10-1 will be described, but each of the other client terminals 10-2 to 10-M also has a hardware configuration similar to that shown in Figure 2.

[0039] As shown in FIG. 2, the client terminal 10-1 includes a CPU 11, a nonvolatile memory 12, a RAM 13, a communication device 14, and the like.

[0040] The CPU 11 is a processor for controlling the operation of various components within the client terminal 10-1. The CPU 11 may be a single processor or may be configured with multiple processors. The CPU 11 executes various programs loaded from the non-volatile memory 12 to the RAM 13. These programs include an operating system (OS) and various application programs. The application programs executed by the CPU 11 in this manner include a program for operating as a client terminal in the machine learning system 1 (hereinafter referred to as a client program).

[0041] The nonvolatile memory 12 is a storage medium used as an auxiliary storage device. The RAM 13 is a storage medium used as a main storage device. Although only the nonvolatile memory 12 and the RAM 13 are shown in Fig. 2, the client terminal 10-1 may also include other storage devices such as an HDD (Hard Disk Drive) and an SSD (Solid State Drive).

[0042] The communication device 14 is a device configured to execute communication with an external device (for example, a plurality of integrated servers 20-1 to 20-N) of the client terminal 10-1.

[0043] Here, each of the client terminals 10-1 to 10-M has been described as having the hardware configuration shown in Figure 2, but each of the multiple integrated server devices 20-1 to 20-N provided in the machine learning system 1 is also assumed to have a hardware configuration similar to that of the client terminals 10-1 to 10-M.

[0044] In the above description, the CPU 11 of each of the client terminals 10-1 to 10-M executes a client program, but in each of the integrated server devices 20-1 to 20-N, the CPU executes a server program (a program for operating as the integrated server devices 20-1 to 20-N in the machine learning system 1).

[0045] Next, an example of the functional configuration of client terminal 10-1 among client terminals 10-1 to 10-M will be described with reference to Fig. 3. Here, for convenience, the functional configuration of client terminal 10-1 will be described, but each of the other client terminals 10-2 to 10-M also has a functional configuration similar to that of Fig. 3.

[0046] As shown in FIG. 3, the client terminal 10-1 includes a storage unit 101, a learning processing unit 102, a parameter extraction unit 103, an array modification unit 104, an encryption unit 105, a decryption unit 106, and an update unit 107.

[0047] In this embodiment, the storage unit 101 included in the client terminal 10-1 is realized by the nonvolatile memory 12 shown in FIG. 2 or another storage device.

[0048] 2 (i.e., the computer of client terminal 10-1) executes the above-mentioned client program, that is, all or part of the learning processing unit 102, parameter extraction unit 103, array modification unit 104, encryption unit 105, decryption unit 106, and update unit 107 included in client terminal 10-1 are realized by software. Note that the client program executed by CPU 11 may be distributed by being stored in a computer-readable storage medium, or may be downloaded to client terminal 10-1 via a network.

[0049] Here, it has been explained that each of the units 102 to 107 is realized by having the CPU 11 execute a client program, but some or all of the units 102 to 107 may be realized by hardware such as an IC (Integrated Circuit), or may be realized by a combination of software and hardware.

[0050] It is assumed that the storage unit 101 stores the above-mentioned learning data (data held by the organization corresponding to the client terminal 10-1).

[0051] The learning data stored in the storage unit 101 may be data managed by the client terminal 10-1, and may be data acquired from a database or the like that can be accessed by the client terminal 10-1. However, the client terminal 10-1 in this embodiment is assumed to be arranged in a network configuration in which it can access the learning data managed by the client terminal 10-1 but cannot access the learning data managed by the other client terminals 10-2 to 10-M. That is, in this embodiment, it is assumed that different learning data is stored in the storage unit 101 included in each of the client terminals 10-1 to 10-M.

[0052] The learning processing unit 102 executes a learning process on the machine learning model (i.e., performs machine learning) using the learning data stored in the storage unit 101. Note that the machine learning model on which the learning processing unit 102 executes the learning process is managed in advance in an external device as, for example, a master model, and is distributed from the external device to the client terminal 10-1. The machine learning model distributed in this manner is held in the client terminal 10-1 as a local model, and the learning processing unit 102 executes the learning process on the machine learning model (local model).

[0053] In this embodiment, a neural network is used as the learning algorithm. The neural network is configured with an input layer, an output layer, and one or more intermediate layers (hidden layers), and multiple nodes included in each layer are interconnected with multiple nodes included in adjacent layers. The neural network used in this embodiment may be, for example, a convolutional neural network (CNN) or a recurrent neural network (RNN).

[0054] Here, the machine learning model in this embodiment is constructed so that, when predetermined data is input, for example, in order to provide various services, it outputs a prediction result or an analysis result based on the data, and when a learning process is executed on such a machine learning model, the parameters (network parameters) constituting the machine learning model are updated. Note that there are multiple parameters constituting the machine learning model, and these parameters include, for example, a weight coefficient and a bias.

[0055] The parameter extraction unit 103 extracts, from the machine learning model on which the learning process has been executed, a parameter sequence in which multiple parameters constituting the machine learning model (i.e., multiple parameters updated by executing the learning process) are arranged in a predetermined order.

[0056] The array change unit 104 changes the array of a plurality of parameters in the parameter sequence extracted by the parameter extraction unit 103. Note that "changing the array of a plurality of parameters in the parameter sequence" includes rearranging the plurality of parameters.

[0057] The encryption unit 105 encrypts the parameter sequence whose array has been changed by the array change unit 104 by performing secret sharing on the parameter sequence. According to this, a share sequence (fragment parameter sequence) in which shares of each of the plurality of parameters in the parameter sequence are arranged is generated. Note that as described above, when the machine learning system 1 includes a plurality of integrated server devices 20-1 to 20-N (that is, the number of integrated server devices is N), the encryption unit 105 generates N share sequences corresponding to each of the integrated server devices 20-1 to 20-N. Each of the N share sequences generated by the encryption unit 105 in this way is transmitted to the integrated server device corresponding to the share sequence among the integrated server devices 20-1 to 20-N.

[0058] The decryption unit 106 receives the share sequences transmitted from each of the integrated server devices 20-1 to 20-N as described later, and decrypts (restores) the parameter sequence (a plurality of parameters constituting the machine learning model) from the received share sequences. In this case, at the client terminal 10-1, N share sequences are received from the integrated server devices 20-1 to 20-N. However, according to the Shamir's secret sharing method described above, the number of shares required for data restoration is k. Therefore, the decryption unit 106 decrypts the parameter sequence using k share sequences among the received N share sequences. Note that k in this case is an integer that satisfies 2 or more and N or less (1 < k ≤ N).

[0059] The update unit 107 applies the multiple parameters in the parameter sequence decoded by the decoding unit 106 to the local model stored inside the client terminal 10-1 (i.e., updates the multiple parameters that make up the local model to the multiple parameters in the decoded parameter sequence), thereby updating the local model (machine learning model).

[0060] Next, an example of the functional configuration of integrated server device 20-1 among integrated server devices 20-1 to 20-N will be described with reference to Fig. 4. Here, for convenience, integrated server device 20-1 will be described, but each of the other integrated server devices 20-2 to 20-N also has the same functional configuration as Fig. 4.

[0061] As shown in FIG. 4, integrated server device 20-1 includes arrangement change unit 201, integration processing unit 202, and update unit 203.

[0062] In this embodiment, all or part of the arrangement modification unit 201, integration processing unit 202, and update unit 203 included in integrated server device 20-1 are realized by causing a CPU (i.e., the computer of integrated server device 20-1) provided in integrated server device 20-1 to execute the above-mentioned server program, that is, by software. Note that the server program executed by this CPU may be distributed by being stored in a computer-readable storage medium, or may be downloaded to integrated server device 20-1 via a network.

[0063] Here, it has been explained that each of the units 201 to 203 is realized by having the CPU execute a server program, but some or all of the units 201 to 203 may be realized by hardware such as an IC, or may be realized by a combination of software and hardware.

[0064] Arrangement change unit 201 receives a sequence of M shares transmitted from each of client terminals 10-1 to 10-M. Here, as described above, the sequence of M shares transmitted from each of client terminals 10-1 to 10-M is data encrypted by performing secret sharing on a sequence of parameters whose arrangement has been changed in client terminals 10-1 to 10-M, and the shares of each of the multiple parameters whose arrangement has been changed are arranged in the same order as the multiple parameters.

[0065] For this reason, for each received share sequence, the array modification unit 201 modifies the array of shares of multiple parameters in the share sequence. Specifically, the array modification unit 201 rearranges the shares of multiple parameters in each of the received M share sequences so that the array is the same as the array of multiple parameters in the parameter sequence at the time of extraction from the machine learning model (i.e., the order of multiple parameters before the array modification unit 104 modifies the array). This allows M share sequences to be obtained in which shares of the same parameters are arranged in the same position (order).

[0066] The integration processing unit 202 performs integration processing on the M share sequences whose sequence has been changed by the sequence change unit 201. As a result, the integration processing unit 202 generates one share sequence in which the M share sequences have been integrated. Note that such an integrated share sequence using the M share sequences is generated in each of the multiple integrated server devices 20-1 to 20-N, but this share sequence can be said to correspond to a share sequence (i.e., a share sequence of the parameters of the master model) generated by performing secret sharing on a parameter sequence of a master model obtained by performing machine learning (a parameter sequence in which multiple parameters constituting the master model are arranged in order).

[0067] The update unit 203 executes a process of synchronizing a machine learning model (i.e., a master model) obtained by machine learning performed in the machine learning system 1 with a machine learning model (i.e., a local model) held inside the client terminals 10-1 to 10-M. In this case, the update unit 203 transmits the share sequence (a share sequence of parameters of the master model) generated by the integration processing unit 202 to each of the client terminals 10-1 to 10-M. As a result, each of the client terminals 10-1 to 10-M can decode a parameter sequence from k share sequences out of the N share sequences transmitted from each of the integrated server devices 20-1 to 20-N (update unit 203), and update the local model based on the multiple parameters in the decoded parameter sequence.

[0068] An example of the processing procedure of the machine learning system 1 according to this embodiment will be described below with reference to the sequence chart in Fig. 5. Although Fig. 5 shows only the processing executed by client terminal 10-1 and integrated server device 20-1, each of the other client terminals 10-2 to 10-M executes processing similar to the processing of client terminal 10-1 shown in Fig. 5, and each of the other integrated server devices 20-2 to 20-N executes processing similar to the processing of integrated server device 20-1 shown in Fig. 5.

[0069] It should be noted that when machine learning is performed in the machine learning system 1 (i.e., before the processing shown in Figure 5 is executed), a master model is distributed in advance to the client terminals 10-1 to 10-M, and the master model is held inside the client terminals 10-1 to 10-M as a local model.

[0070] It is also assumed that the storage unit 101 included in each of the client terminals 10-1 to 10-M stores learning data held by the organization corresponding to the client terminal (learning data managed in the client terminal).

[0071] First, the learning processing unit 102 included in the client terminal 10-1 executes learning processing of the local model using the learning data stored in the storage unit 101 included in the client terminal 10-1 (step S1).

[0072] The processing of step S1 will be described below. In this embodiment, a plurality of pieces of training data are stored in storage unit 101 included in client terminal 10-1, and each piece of the training data includes input data to be input to a machine learning model and data (correct answer data) that should be output from the machine learning model when the input data is input to the machine learning model. In step S1, a training process is repeatedly executed using each piece of such training data. Note that in the training process, input data included in the training data is input to a machine learning model (local model), and output data output from the machine learning model is compared with the correct answer data included in the training data, and parameters constituting the machine learning model are updated so as to reduce the error between the output data and the correct answer data.

[0073] The learning process in step S1 described above is terminated, for example, when the accuracy of the machine learning model meets a target value (i.e., the timing of terminating the learning process is adjusted according to the learning accuracy of the machine learning model). Note that the accuracy of the machine learning model is calculated, for example, using pre-prepared evaluation data (a set of input data and correct answer data) based on the error between the output data output from the machine learning model when the input data is input to the machine learning model and the correct answer data included in the evaluation data. If the accuracy of the machine learning model calculated in this way is equal to or greater than the target value, the process of step S1 (learning process) is terminated. If the accuracy of the machine learning model is less than the target value, the learning process is executed again.

[0074] Here, we have explained that the accuracy of the machine learning model is calculated using evaluation data, but it is also possible to calculate the accuracy of the machine learning model using, for example, a portion of the multiple learning data stored in storage unit 101.

[0075] Also, although it has been described here that the processing of step S1 is terminated when the accuracy of the machine learning model meets the target value, the processing of step S1 may also be terminated when the learning process has been performed a predetermined number of times (i.e., a predetermined number of epochs).

[0076] Next, the parameter extraction unit 103 extracts a parameter sequence from the local model that has been subjected to the learning process in step S1 (step S2).

[0077] Here, when a neural network is used as the learning algorithm in this embodiment, the local model (machine learning model) is composed of a plurality of parameters, such as weighting coefficients and bias (information). In step S2, a parameter string in which such a plurality of parameters are arranged in a predetermined order is extracted from the local model. Specifically, for example, the number of parameters constituting the local model is L, and the L parameters are denoted as p1, p2, ..., p L In step S2, the one-dimensional array of the plurality of parameters [p1, p2, ..., p L ] is extracted as a parameter string. In the following description, the parameter string extracted in step S2 will be referred to as a first parameter string for convenience.

[0078] The process of step S2 is executed in each of client terminals 10-1 to 10-M, and it is assumed that the same (same type) parameters are arranged in the same position (order) in the parameter sequence extracted in each of client terminals 10-1 to 10-M.

[0079] When the process of step S2 is executed, the array modification unit 104 generates an index array in which indices corresponding to each of the plurality of parameters in the first parameter array are arranged (step S3). The index array generated in step S3 is assumed to be, for example, an integer array in which integers representing the order of each of the plurality of parameters in the parameter array are arranged. L ] is extracted, an index sequence [1, 2, ..., L] is generated in step S3. That is, this index sequence [1, 2, ..., L] is the first parameter sequence [p1, p2, ..., p L ], the parameter "p1" is first in order, the parameter "p2" is second in order, and the parameter "p L " is the Lth parameter. L The same applies to parameters other than ".

[0080] When the process of step S3 is executed, the array modification unit 104 combines the first parameter sequence extracted in step S2 with the index sequence generated in step S3. As described above, in step S2, the first parameter sequence [p1, p2, ..., p L ] is extracted, and the index sequence [1, 2, ..., L] is generated in step S3, the first parameter sequence and the index sequence are combined to obtain [[1, 2, ..., L], [p1, p2, ..., p L A 2xL two-dimensional array like this is generated:

[0081] Next, the array modification unit 104 modifies the array of multiple parameters in the first parameter column (model parameter array) and the array of multiple indexes in the index column by randomly rearranging the columns in the two-dimensional array generated as described above (step S4).

[0082] 6 is a diagram for explaining an example of the process of step S4 (array change process for the first parameter sequence and index sequence). In Fig. 6, it is assumed that the first parameter sequence extracted in step S2 is [p1, p2, p3, p4, p5] and the index sequence is [1, 2, 3, 4, 5].

[0083] In this case, in step S4, the columns in the two-dimensional array shown in the upper part of Figure 6 (the two-dimensional array generated by combining the first parameter column and the index column) are randomly rearranged, thereby converting the two-dimensional array into the two-dimensional array shown in the lower part of Figure 6.

[0084] By separating the first parameter sequence and the index sequence from the two-dimensional array shown in the lower part of Figure 6, a first parameter sequence [p4,p1,p2,p5,p3] in which the arrangement of multiple parameters in the first parameter sequence [p1,p2,p3,p4,p5] has been changed, and an index sequence [4,1,2,5,3] in which the arrangement of multiple indexes in the index sequence [1,2,3,4,5] has been changed, are obtained.

[0085] In this embodiment, the multiple parameters in the first parameter sequence and the multiple indexes in the index sequence (integers representing the order of each of the multiple parameters in the first parameter sequence) are rearranged (i.e., the arrangement is changed) while being associated with each other, and therefore the index sequence with the rearrangement changed can be said to be information (parameter rearrangement information) that indicates the correspondence between the arrangement of the multiple parameters in the first parameter sequence before the change and the arrangement of the multiple parameters after the change.

[0086] The arrangement change unit 104 may be configured to include, for example, a random number generation unit, and to execute the process of step S4 described above using random numbers generated by the random number generation unit.

[0087] Furthermore, in this embodiment, the index string has been described as an integer string in which integers representing the order of each of the multiple parameters in the parameter string are arranged as elements, but the index string may also be an array of other elements as long as it can indicate the correspondence between the array of the multiple parameters before and after the change.

[0088] Next, the encryption unit 105 encrypts the first parameter sequence (hereinafter referred to as the rearranged first parameter sequence) and the index sequence (hereinafter referred to as the rearranged index sequence) obtained by executing the process of step S4 (step S5). Note that the encryption in step S5 involves the secret sharing described above.

[0089] The following describes the case where the first parameter sequence after rearrangement is encrypted in step S5. For example, a plurality of parameters are arranged in the first parameter sequence after rearrangement, and in step S5, secret sharing is performed (i.e., the above-mentioned formula (1) is used) to generate N shares from each of the plurality of parameters. Specifically, for example, if the first parameter sequence after rearrangement is [p4, p1, p2, p5, p3] shown in FIG. 6 above, secret sharing is performed on one parameter "p4" in the first parameter sequence, and N shares "p 41 ´,p 42 ´,…,p 4N ´ is generated. These N shares "p 41 ´,p 42 ´,…,p 4N ´” is the above W(P1),…,W(P n ) Similarly, N shares are generated for each of the other parameters "p1", "p2", "p5", and "p3" in the first parameter string after the rearrangement. The shares generated by secret sharing are as described above, so a detailed explanation will be omitted here.

[0090] The number of shares generated from each of the multiple parameters in the first parameter sequence after the rearrangement is the same as the number of integrated server devices 20-1 to 20-N.

[0091] In step S5, the encryption unit 105 generates a sequence of N shares (hereinafter referred to as the first parameter share sequence) corresponding to each of the integrated server devices 20-1 to 20-N based on the N shares generated from each of the multiple parameters in the first parameter sequence after the arrangement change as described above.

[0092] Specifically, when the first parameter sequence is [p4, p1, p2, p5, p3] as described above, the N first parameter share sequences corresponding to each of the integrated server devices 20-1 to 20-N are set as [p 41 ´,p 11 ´,p 21 ´,p 51 ´,p 31 ´],[p 42 ´,p 12 ´,p 22 ´,p 52 ´,p 32 ´],…,[p 4N ´,p 1N ´,p 2N ´,p 5N ´,p 3N ´] is generated.

[0093] In addition, "p 11 ´,p 12 ´,…,p 4N ´ is the N shares generated by secret sharing for “p1”, and “p 21 ´,p 22 ´,…,p 2N ´ is the N shares generated by secret sharing on “p2”, and “p 51 ´,p 52 ´,…,p 5N ´ is the N shares generated by secret sharing on “p5”, and “p 31 ´,p 32 ´,…,p 3N´” are the N shares generated by secret sharing on “p3”.

[0094] Here, we have explained the case where the first parameter string after rearrangement is encrypted, but the index string after rearrangement is also encrypted in the same manner. Specifically, N shares are generated from each of the multiple indexes "4", "1", "2", "5", and "3" in the index string after rearrangement, thereby generating N share strings (hereinafter referred to as index share strings) corresponding to each of integrated server devices 20-1 to 20-N. In this case, the index share strings corresponding to each of integrated server devices 20-1 to 20-N are [41',11',21',51',31'], [42',12',22',52',3'], ..., [4 N ´,1 N ´,2 N ´,5 N ´,3 N '] is generated. Note that the index share column "41', 42', ..., 4 N ´ represents the N shares generated by secret sharing for the index “4” in the index sequence after the rearrangement. N ´, ´, 21´, 22´,…, 2 N ´, 51´,52´,…,5 N ´” and “31´,32´,…,3 N The same is true for ´.

[0095] The N first parameter share sequences and N index share sequences generated by executing the process of step S5 are transmitted to the integrated servers 20-1 to 20-N (step S6).

[0096] In this case, in step S6, one first parameter share sequence is transmitted (distributed) to one integrated server. Specifically, for example, the first parameter share sequence [p41 ´,p 11 ´,p 21 ´,p 51 ´,p 31 Similarly, each of the other integrated servers 20-2 to 20-N transmits a corresponding first parameter share sequence.

[0097] While the first parameter share sequence has been described above, the same applies to the index share sequence. That is, among integrated server devices 20-1 to 20-N, an index share sequence [41', 11', 21', 51', 31'] is transmitted to integrated server device 20-1. Similarly, one corresponding index share sequence is transmitted to the other integrated server devices 20-2 to 20-N.

[0098] In this embodiment, the first parameter share sequence and the index share sequence are transmitted in different files.

[0099] The array modification unit 201 included in the integrated server device 20-1 receives the parameter share sequence and index share sequence transmitted from the client terminal 10-1 in step S6. Note that the processes of steps S1 to S6 described above are also executed in each of the other client terminals 10-2 to 10-M, so that the array modification unit 201 receives M first parameter share sequences and M index share sequences transmitted from each of the client terminals 10-1 to 10-M.

[0100] Here, for example, in the first parameter share sequence received from client terminal 10-1, shares of multiple parameters are arranged, but the arrangement (order) of the multiple parameters in the first parameter share sequence used to generate the first parameter share sequence is changed by the client terminal 10-1 executing the process of step S4. Note that this change of arrangement (rearrangement of the multiple parameters) is performed randomly in each of the client terminals 10-1 to 10-M, so the arrangement (i.e., rearrangement order) of the multiple parameters (shares) differs among the client terminals 10-1 to 10-M. In other words, the shares (arrangement) of the multiple parameters in the first parameter share sequence received from client terminal 10-1 do not correspond to the shares (arrangement) of the multiple parameters in the first parameter share sequence received from the other client terminals 10-2 to 10-M.

[0101] For this reason, the arrangement change unit 201 changes the arrangement of the shares of the multiple parameters in the first parameter share column based on the index share column for each of the client terminals 10-1 to 10-M (step S7).

[0102] Here, for example, the first parameter share sequence [p 41 ´,p 11 ´,p 21 ´,p 51 ´,p 31Assume that the first parameter share sequence [41',11',21',51',31'] and the index share sequence [41',11',21',51',31'] are received. As described above, the first parameter share sequence and the index share sequence are transmitted in different files, but the file in which the first parameter share sequence is stored and the file in which the index share sequence is stored are each provided with information (e.g., a terminal ID) for identifying (specifying) the client terminal that transmitted the file. By referring to the information provided in such files, the array modification unit 201 can determine (specify) the first parameter share sequence and the index share sequence transmitted from the same client terminal (e.g., client terminal 10-1) from among the M parameter share sequences and M index share sequences received by the integrated server device 20-1.

[0103] In this case, the array modification unit 201 modifies the first parameter share array [p 41 ´,p 11 ´,p 21 ´,p 51 ´,p 31 ´] and the index share column [41´,11´,21´,51´,31´] are combined into a 2x5 two-dimensional array [[41´,11´,21´,51´,31´],[p 41 ´,p 11 ´,p 21 ´,p 51 ´,p 31 The columns in [[41',11',21',51',31'],[p 41 ´,p 11 ´,p 21 ´,p 51 ´,p 31 ´]] is a two-dimensional array [[11´,21´,31´,41´,51´],[p 11 ´,p 21 ´,p 31 ´,p 41 ´,p 51´]] (That is, the reverse of the transformation shown in Figure 6 above is performed, and the data is encrypted and sorted in ascending order based on the index column.) The resulting two-dimensional array [[11´,21´,31´,41´,51´],[p 11 ´,p 21 ´,p 31 ´,p 41 ´,p 51 ´]] to the first parameter share column [p 11 ´,p 21 ´,p 31 ´,p 41 ´,p 51 ´] is obtained.

[0104] In step S7, the shares of the multiple parameters in the first parameter share column are rearranged (i.e., sorted) according to the arrangement of the shares of the multiple indexes in the index share column as described above, thereby obtaining a first parameter share column in which the shares of the multiple parameters are arranged in the correct order before the arrangement change.

[0105] Here, the case where the arrangement of the shares of a plurality of parameters in the first parameter share sequence received from the client terminal 10-1 has been described, but the arrangement change unit 201 also changes the arrangement of the shares of a plurality of parameters in the first parameter share sequence for the other client terminals 10-2 to 10-M (first parameter sequences received from them). According to this, the arrangement change unit 201 included in the integrated server device 20-1 changes the arrangement of the shares of the M first parameter share sequences [p 11 ´,p 21 ´,p 31 ´,p 41 ´,p 51 Since the learning process using different learning data is executed in each of the client terminals 10-1 to 10-M, the first parameter share sequence [p 11 ´,p 21 ´,p 31 ´,p 41´,p 51 The share value of each parameter in [parameters] (that is, parameters constituting the local model) differs for each of client terminals 10-1 to 10-M.

[0106] In order to change the arrangement of the shares of multiple parameters in the first parameter share sequence, it is necessary to refer to the index share sequence (the arrangement of the shares of multiple indexes in the index share sequence). The shares of the index are, as described above, data obtained by encrypting each of the multiple indexes in the index sequence. Therefore, the processing of step S7 described above (the calculation for rearranging the shares of multiple parameters in the first parameter share sequence) is performed using a technology known as secure computation, which allows calculations to be performed on encrypted data. In other words, in this embodiment, secure computation can be used to rearrange the shares of multiple parameters in the first parameter share sequence (i.e., change the arrangement) without decrypting the index share sequence.

[0107] Next, the integration processing unit 202 executes an integration process on the M first parameter share sequences corresponding to each of the client terminals 10-1 to 10-M acquired by executing the process of step S7 (step S8). Note that the integration process corresponds to a process of generating one parameter share sequence (hereinafter referred to as a second parameter share sequence) from the M first parameter share sequences by, for example, integrating the shares of parameters arranged in the same position (order) in each of the M first parameter share sequences.

[0108] Specifically, for example, in the integrated server device 20-1, M first parameter share sequences [p 11 ´,p 21 ´,p 31 ´,p 41 ´,p 51 If the parameter share "p" is obtained, the parameter share "p" in each of the first parameter share columns is 11'" are integrated, and the parameter share "p 21 '" are integrated, and the parameter share "p 31 '" are integrated, and the parameter share "p 41 '" are integrated, and the parameter share "p 51 This will unify the parameter share "p 11 As a result of integrating the parameters, the share of the parameter "p 21 As a result of integrating the parameters, the share of the parameter "p 31 As a result of integrating the parameters, the share of the parameter "p 41 The results of the integration of "p" and the parameter share "p 51 A second parameter share column is generated in which the results of integrating the "" are arranged.

[0109] Note that the "integration (processing)" in this embodiment may be any processing that aggregates multiple data (shares) into one data, such as averaging.

[0110] Furthermore, the parameter shares integrated in the integration process executed in step S8 are data obtained by encrypting each of the multiple parameters in the first parameter sequence, as described above. Therefore, the process (integration process) in step S8 is executed using the above-mentioned secure computation.

[0111] When the process of step S8 is executed, the array change unit 201 changes the array of the shares of the multiple parameters in the second parameter share sequence generated by executing the process of step S8 (step S9). In step S9, the array of the shares of the multiple parameters is changed (rearranged) for each of the client terminals 10-1 to 10-M based on the index share sequence (i.e., the order of the indexes) received from each of the client terminals 10-1 to 10-M in step 6, thereby acquiring a second parameter share sequence corresponding to each of the client terminals 10-1 to 10-M.

[0112] Specifically, for example, the second parameter share sequence generated by executing the process of step S8 is [P 11 ´,P 21 ´,P 31 ´,P 41 ´,P 51 '], and the index share sequence received from the client terminal 10-1 of the client terminals 10-1 to 10-M is [41', 11', 21', 51', 31'], the array change unit 201 determines the second parameter share sequence [P 41 ´,P 11 ´,P 21 ´,P 51 ´,P 31 Furthermore, if the index share sequence received from the client terminal 10-2 is [21', 51', 11', 41', 31'], the array change unit 201 obtains the second parameter share sequence [P 21 ´,P 51 ´,P 11 ´,P 41 ´,P 31 Here, the second parameter share sequences corresponding to each of the client terminals 10-1 and 10-2 have been described, but the second parameter share sequences corresponding to each of the other client terminals 10-3 to 10-M are similarly acquired.

[0113] The update unit 203 transmits the second parameter share sequence obtained by executing the process of step S9 to the client terminals 10-1 to 10-M (step S10). In this case, of the M second parameter share sequences corresponding to the client terminals 10-1 to 10-M obtained by executing the process of step S9 as described above, for example, the second parameter share sequence [P 41 ´,P 11 ´,P 21 ´,P 51 ´,P 31 Similarly, the second parameter share sequence [P 21 ´,P 51 ´,P 11 ´,P 41 ´,P 31 The second parameter share sequence transmitted to the client terminals 10-1 and 10-2 has been described here, but the second parameter share sequence is also transmitted to the other client terminals 10-3 to 10-M in the same manner.

[0114] The client terminal 10-1 receives the second parameter share sequence transmitted in step S10, and the arrangement change unit 104 included in the client terminal 10-1 changes the arrangement of the shares of the multiple parameters in the second parameter share sequence (step S11).

[0115] For example, in the client terminal 10-1, the second parameter share sequence [P 41 ´,P 11 ´,P 21 ´,P 51 ´,P 31When the second parameter share sequence [P 11 ´,P 21 ´,P 31 ´,P 41 ´,P 51 ´].

[0116] Here, the process of step S10 described above is executed by, for example, each of integrated server devices 20-1 to 20-N, and therefore client terminal 10-1 receives N second parameter share sequences transmitted from each of integrated server devices 20-1 to 20-N. The process of step S11 is executed for each of these N second parameter share sequences.

[0117] In this case, each of the N second parameter share sequences obtained by executing the processing of step S11 can be considered a share value for the plaintext master model (i.e., a share sequence of the parameters of the master model), so the decryption unit 106 decrypts a parameter sequence (hereinafter referred to as the second parameter sequence) from the N second parameter share sequences (step S12).

[0118] In step S12, by utilizing the above-mentioned equation (2), a process of decoding one parameter from k parameter shares arranged in the same position (order) in each of k second parameter share sequences selected from the N second parameter share sequences obtained by executing the process of step S11 is sequentially executed, thereby generating a second parameter sequence in which the decoded parameters are arranged in order.

[0119] When the processing of step S12 is executed, the update unit 107 updates the local model held inside the client terminal 10-1 by applying the multiple parameters in the second parameter sequence generated by executing the processing of step S12 to the local model (step S13).

[0120] Although the arrangement (order) of the parameter shares in the second parameter share sequence transmitted in step S10 is different, the processes of steps S11 to S13 are executed in each of the client terminals 10-1 to 10-M. Therefore, the local model (machine learning model) after the process of step S13 is executed in each of the client terminals 10-1 to 10-M is the same.

[0121] That is, in this embodiment, the processing of step S13 described above is executed in each of the client terminals 10-1 to 10-M, so that the machine learning model (master model) obtained by performing machine learning in the entire machine learning system 1 and the machine learning model (local model updated in step S13) held inside each of the client terminals 10-1 to 10-M are synchronized.

[0122] In this embodiment, the process shown in FIG. 5 is repeatedly executed, thereby making it possible to perform machine learning using learning data that is managed in a distributed manner in each of the client terminals 10-1 to 10-M.

[0123] In the example shown in FIG. 5, the processing of step S12 is described as being executed after the processing of step S11 is executed. However, in the processing shown in FIG. 5, the processing of step S12 may be executed before the processing of step S11 is executed (i.e., the order of the processing of step S11 and the processing of step S12 shown in FIG. 5 may be reversed).

[0124] 5, the processes of steps S11 to S13 are described as being executed by client terminals 10-1 to 10-M to continuously perform machine learning in machine learning system 1, but the processes corresponding to steps S11 to S13 may be executed by a device different from client terminals 10-1 to 10-M. Specifically, the processes corresponding to steps S11 to S13 may be executed by, for example, a device located outside machine learning system 1 (such as a device that provides a service using a machine learning model). In other words, when machine learning is to be terminated, the processes related to updating the machine learning model may be executed by a device other than client terminals 10-1 to 10-M.

[0125] As described above, in this embodiment, each of client terminals 10-1 to 10-M performs a learning process for a machine learning model using learning data managed in the client terminal, extracts a first parameter sequence in which multiple parameters are arranged from the machine learning model on which the learning process has been performed, changes the arrangement of the multiple parameters in the extracted first parameter sequence, and performs secret sharing on the first parameter sequence in which the arrangement of the multiple parameters has been changed, thereby generating a first parameter share sequence (first fragment parameter sequence) corresponding to each of integrated server devices 20-1 to 20-N, and transmits the generated first parameter share sequence to each of integrated server devices 20-1 to 20-N. Furthermore, in this embodiment, each of the integrated server devices 20-1 to 20-N receives M first parameter share sequences transmitted from each of the client terminals 10-1 to 10-M, changes the arrangement of the shares of the multiple parameters in each of the received M first parameter share sequences, and generates a second parameter share sequence (second fragment parameter sequence) by performing an integration process on the M first parameter share sequences in which the arrangement of the shares of the multiple parameters has been changed. In this embodiment, the machine learning model is updated based on the multiple parameters in the second parameter sequence decoded from the N second parameter share sequences generated in each of the integrated server devices 20-1 to 20-N.

[0126] In this embodiment, the above-described configuration makes it possible to ensure high security in machine learning (federated learning).

[0127] Specifically, in this embodiment, the first parameter share sequence generated by performing secret sharing is transmitted from the client terminals 10-1 to 10-M to the integrated server devices 20-1 to 20-N, thereby preventing a situation in which a third party obtains parameters (sequences) in communication between the client terminals 10-1 to 10-M and the integrated server devices 20-1 to 20-N and infers learning data from the parameters (i.e., the learning data is leaked).

[0128] In this embodiment, the secret sharing is performed by dividing the first coefficients r1, . . . , r2, which are elements of a random integer ring Q. k-1 and second coefficients P1, ..., P2, which are elements of N random integer rings Q corresponding to the integrated server devices 20-1 to 20-N. N This is realized by determining the first parameter share sequence, generating N first parameter share sequences corresponding to each of the integrated server devices 20-1 to 20-N based on a k-1 degree polynomial (the above-mentioned equation (1)) with each of the multiple parameters in the first parameter sequence as intercept a, and transmitting each of the generated N first parameter share sequences to the integrated server device corresponding to the share sequence.

[0129] However, even in a configuration in which secret sharing is implemented as described above, if, for example, k first parameter share sequences out of N first parameter share sequences are obtained by a third party, the parameter sequence may be decrypted from the k first parameter share sequences, and the training data may be inferred from the parameter sequence (multiple parameters in the parameter sequence).

[0130] However, in this embodiment, since the secret sharing is performed after changing the arrangement of multiple parameters, even if a parameter sequence is decrypted from k first parameter share sequences as described above, the correct order of the multiple parameters in the parameter sequence is unknown, and therefore the multiple parameters (decrypted data) do not function as correct model information (i.e., they cannot be used as multiple parameters that constitute a machine learning model).In other words, in this embodiment, it is necessary to obtain the correct combination of the first parameter share sequence and the index share sequence indicating the arrangement order from each client terminal 10-1 to 10-M before performing the sorting process, which is thought to improve the difficulty of guessing the training data described above.

[0131] That is, in this embodiment, by applying secret sharing and changing the arrangement of multiple parameters in a parameter sequence in federated learning as described above, it is possible to achieve high security against leakage of training data, etc.

[0132] In addition, in this embodiment, since the integration process is performed using secure computation, it is possible to integrate the first parameter share sequences transmitted from each of the client terminals 10-1 to 10-M without decrypting the first parameter sequence, thereby further improving security.

[0133] Furthermore, in this embodiment, each of the client terminals 10-1 to 10-M generates an index share sequence (fragment index sequence) corresponding to each of the integrated server devices 20-1 to 20-N by performing secret sharing on an index sequence indicating a correspondence between an arrangement of multiple parameters in a first parameter sequence (first array) and an arrangement of the multiple parameters modified from the first array (second array) (i.e., the index sequence after the arrangement is modified), and transmits the generated index share sequence to each of the integrated server devices 20-1 to 20-N. Furthermore, in this embodiment, each of the integrated server devices 20-1 to 20-N receives M index share sequences transmitted from each of the client terminals 10-1 to 10-M, and modifies the arrangement of the shares of the multiple parameters in each of the M first parameter share sequences based on each of the received M index share sequences.

[0134] In this embodiment, with this configuration, it is possible to unify the order of multiple parameters in M ​​first parameter share sequences that have been randomly rearranged (arranged) in each of the client terminals 10-1 to 10-M, and appropriately integrate the M first parameter share sequences.

[0135] In this embodiment, for example, by adopting a configuration in which the first parameter share sequence and the index share sequence are transmitted from the client terminals 10-1 to 10-M to the integrated server devices 20-1 to 20-N in different files, the index share sequence is acquired along with the first parameter share sequence, and it is possible to prevent the multiple parameters (arrangement of the parameters) in the parameter sequence decoded from the first parameter share sequence from being rearranged in the correct order.

[0136] In this embodiment, the change in the arrangement of the shares of the multiple parameters in the first parameter share sequence based on the index share sequence (i.e., the rearrangement calculation) is performed using secure computation, which eliminates the need for processing to decrypt the index sequence from the index share sequence, thereby reducing the amount of processing in each of the integrated servers 20-1 to 20-N.

[0137] Furthermore, in this embodiment, the second parameter share sequence is transmitted from the integrated server devices 20-1 to 20-N to the client terminals 10-1 to 10-M, but the arrangement of the shares of the multiple parameters in the second parameter share sequence is changed based on an index sequence (plaintext parameter rearrangement information) held in each client terminal 10-1 to 10-M. Therefore, the index share sequence does not need to be transmitted from the integrated server devices 20-1 to 20-N to the client terminals 10-1 to 10-M. With this configuration, even if a third party obtains the second parameter share sequence and decrypts the second parameter sequence from the second parameter share sequence, the multiple parameters in the second parameter sequence cannot be rearranged (the index share sequence cannot be obtained), thereby reducing the risk of the above-mentioned learning data leakage. If the above-mentioned plaintext parameter rearrangement information is discarded (not stored) in the client terminals 10-1 to 10-M, the integrated server devices 20-1 to 20-N may transmit the index share sequence corresponding to each of the client terminals 10-1 to 10-M together with the second parameter share sequence to the client terminals 10-1 to 10-M. In this case, the second parameter share sequence and the index share sequence are transmitted in different files.

[0138] Although the present embodiment has been described as applying both secret sharing and changing the arrangement of multiple parameters in a parameter sequence, the present embodiment may also adopt a configuration in which only secret sharing is applied and changing the arrangement of multiple parameters in a parameter sequence is omitted. In this case, the processes of steps S3, S4, S7, S9, and S11 shown in FIG. 5 can be omitted.

[0139] Below, application examples of the machine learning system 1 according to this embodiment will be briefly described. Here, first and second application examples of the machine learning system 1 will be described.

[0140] As a first application example, it is assumed that each of the client terminals 10-1 to 10-M is a POS register installed in a store such as a convenience store, as shown in Fig. 7. In such a first application example, by performing machine learning using information about the store where the POS register is installed and purchase information collected by the POS register as learning data, it is possible to obtain a machine learning model that can provide services such as predicting (analyzing) sales at a newly opened store or predicting (analyzing) the customer demographic that will purchase a new product.

[0141] Furthermore, as a second application example, as shown in Fig. 8, it is assumed that each of the client terminals 10-1 to 10-M is located in a medical institution such as a hospital, and is a terminal device (hereinafter referred to as a doctor terminal) such as a personal computer used by a doctor, etc. In such a second application example, by performing machine learning using information about the patient (information on the electronic medical record) input to the doctor terminal as learning data, it is possible to obtain a machine learning model that can provide a service such as predicting (analyzing) risks that may occur to the patient (such as future medical conditions).

[0142] The first and second application examples described here are merely examples, and the machine learning system 1 according to this embodiment can be applied to various fields as long as it performs machine learning using learning data that is distributed and managed in each of the client terminals 10-1 to 10-M.

[0143] (Second embodiment) Next, a second embodiment will be described. Note that the network configuration of the machine learning system according to this embodiment, and the hardware configurations of the client terminal and integrated server device provided in the machine learning system are the same as those of the first embodiment described above, so detailed explanations thereof will be omitted here and explanations will be given using Figures 1 and 2 as appropriate. Furthermore, in this embodiment, differences from the first embodiment described above will be mainly described.

[0144] This embodiment differs from the first embodiment described above in that it has a configuration for evaluating (the accuracy of) a machine learning model obtained by performing machine learning.

[0145] An example of the functional configuration of the client terminal 10-1 in this embodiment will now be described with reference to Fig. 9. For convenience, the functional configuration of the client terminal 10-1 will be described here, but each of the other client terminals 10-2 to 10-M also has the same functional configuration as that in Fig. 9.

[0146] As shown in Figure 9, the client terminal 10-1 further includes an evaluation unit 108 in addition to the storage unit 101, learning processing unit 102, parameter extraction unit 103, array modification unit 104, encryption unit 105, decryption unit 106, and update unit 107 shown in Figure 3 described above.

[0147] Note that part or all of the evaluation unit 108 may be realized by software, by hardware, or by a combination of software and hardware.

[0148] The evaluation unit 108 evaluates the machine learning model updated by the update unit 107. In the machine learning system 1 according to this embodiment, the learning process of the machine learning model is executed again (that is, machine learning is performed repeatedly) based on the evaluation result of the machine learning model by the evaluation unit 108.

[0149] The functional configuration of integrated servers 20-1 to 20-N is the same as that of the first embodiment, so a detailed description thereof will be omitted here and FIG. 4 will be used as appropriate for the description.

[0150] An example of the processing procedure of the machine learning system 1 according to this embodiment will be described below with reference to the sequence chart in Fig. 10. While Fig. 10 shows only the processing executed by client terminal 10-1 and integrated server device 20-1, the other client terminals 10-2 to 10-M execute processing similar to the processing of client terminal 10-1 shown in Fig. 9, and each of the other integrated server devices 20-2 to 20-N executes processing similar to the processing of integrated server device 20-1 shown in Fig. 9.

[0151] First, steps S21 to S33 are executed, which correspond to steps S1 to S13 shown in Fig. 5. The local model updated in step S33 corresponds to the machine learning model (hereinafter referred to as the first master model) obtained by performing machine learning in the entire machine learning system 1.

[0152] The process shown in FIG. 10, like the process shown in FIG. 5 described above, is executed with a pre-distributed master model held inside the client terminal 10-1 (to 10-M) as a local model, and for convenience, this master model (i.e., the master model before the process shown in FIG. 10 is executed) is referred to as the second master model.

[0153] Here, the evaluation unit 108 included in the client terminal 10-1 executes a process (hereinafter referred to as an evaluation process) for evaluating the first master model (the local model updated in the client terminal 10-1) (step S34).

[0154] Specifically, in step S34, the accuracy of the first master model is calculated. As described in the first embodiment, the accuracy of the first master model (machine learning model) is calculated, for example, using pre-prepared evaluation data (pairs of input data and correct answer data) based on the error between the correct answer data and output data output from the first master model when the input data is input to the first master model. By using a plurality of pairs of input data and correct answer data, the accuracy of the first master model may be calculated as the accuracy rate when the case where the error between the output data and the correct answer data is within a predetermined range is considered to be correct.

[0155] When the processing of step S34 is executed, the evaluation unit 108 selects one of the first and second master models based on the result of the processing of step S34 (i.e., the evaluation result), and synchronizes the local model held inside the client terminal 10-1 with the selected master model (step S35).

[0156] In this case, the evaluation unit 108 compares the accuracy of the first master model calculated by executing the process of step S34 with a target value, and determines whether the accuracy of the first master model is equal to or greater than the target value.

[0157] If it is determined that the accuracy of the first master model is equal to or greater than the target value, the evaluation unit 108 selects the first master model (i.e., the new machine learning model updated in step S33) and synchronizes the local model with the first master model (i.e., stores the first master model as a local model inside the client terminal 10-1).

[0158] On the other hand, if it is determined that the accuracy of the first master model is not equal to or greater than the target value (i.e., is less than the target value), the evaluation unit 108 selects the second master model (i.e., the master model at the time the processing shown in Figure 10 is executed) and synchronizes the local model with the second master model (i.e., maintains the second master model as the local model).

[0159] That is, in the machine learning repeatedly performed in the machine learning system 1 according to this embodiment, if the evaluation result (accuracy) of the first master model is equal to or greater than the target value, the learning process of the first master model (the machine learning model after updating) is performed as in the first embodiment described above, but if the evaluation result (accuracy) of the first master model is not equal to or greater than the target value, the learning process of the second master model (the machine learning model before updating) is performed again. Note that the learning process performed in this case uses learning data different from the learning data used in the learning process that has already been performed.

[0160] Furthermore, the evaluation data used to calculate the accuracy of the first master model differs for each of the client terminals 10-1 to 10-M (i.e., is individually prepared). Furthermore, a portion of the learning data stored in the storage unit 101 included in each of the client terminals 10-1 to 10-M may be used as the evaluation data. Furthermore, the target value used when selecting the first or second master model may be a value common to the client terminals 10-1 to 10-M, or may be a value different for each of the client terminals 10-1 to 10-M. That is, in this embodiment, the local models of some of the client terminals 10-1 to 10-M may be synchronized with the first master model, and the local models of the other client terminals may be synchronized with the second master model.

[0161] As described above, in this embodiment, for example, the first master model (the updated machine learning model) is evaluated using evaluation data prepared in advance, and the learning process of the first master model or the second master model (the machine learning model before the update) is executed based on the evaluation results. In this embodiment, with this configuration, if the accuracy of the first master model is low, the first master model is not adopted (the updated machine learning model is not used), and as a result, it is possible to improve the accuracy of the machine learning model (master model) obtained by machine learning in the machine learning system 1.

[0162] (Third embodiment) Next, a third embodiment will be described. Note that the network configuration of the machine learning system according to this embodiment, and the hardware and functional configurations of the client terminal and integrated server device provided in the machine learning system are the same as those of the first embodiment described above, so detailed explanations thereof will be omitted here and explanations will be given using Figures 1 to 4 as appropriate. Furthermore, in this embodiment, differences from the first embodiment described above will be mainly described.

[0163] Here, in the first embodiment described above, it was explained that first parameter share sequences and index share sequences are transmitted from client terminals 10-1 to 10-M to integrated server devices 20-1 to 20-N. However, for example, if a third party obtains k first parameter share sequences out of the N first parameter share sequences transmitted from each of client terminals 10-1 to 10-M to integrated server devices 20-1 to 20-N, and if a third party obtains k index share sequences out of the N index share sequences, the k first parameter share sequences and the first parameter sequence in which multiple parameters are rearranged in the correct order from the k index share sequences may be decoded, and the learning data used in the learning process of the machine learning model (local model) from which the first parameter sequence was extracted may be inferred.

[0164] In contrast, this embodiment differs from the first embodiment in that a dummy index column is prepared (generated) in addition to the index column (index share column) in the first embodiment.

[0165] An example of the processing procedure of the machine learning system 1 according to this embodiment will be described below. For convenience, the description will be made with reference to FIG. 5 mentioned above.

[0166] First, the processes of steps S1 and S2 described above are executed. Next, in the first embodiment described above, one index sequence is generated in which indexes corresponding to each of the multiple parameters in the first parameter sequence are arranged. However, in this embodiment, the array modification unit 104 generates multiple index sequences (hereinafter referred to as first and second index sequences) (step S3). Specifically, for example, if the number of multiple parameters in the first parameter sequence is L as described in the first embodiment described above, the array modification unit 104 in this embodiment generates a 2×L two-dimensional array by combining, for example, the first index sequence [1, 2, ..., L] and the second index sequence [1, 2, ..., L]. Note that, although the first and second index sequences are assumed to be the same index sequence here, the first and second index sequences may each be an array of multiple different indexes.

[0167] When the processing of step S3 is executed, the array modification unit 104 modifies the array of the multiple parameters in the first parameter string extracted in step S2 and the array of the multiple indexes in the first and second index strings generated in step S3 (step S4).

[0168] 11 is a diagram for explaining an example of the process of step S4 (arrangement change process for the first parameter sequence and the first and second index sequences). In Fig. 11, it is assumed that the first parameter sequence extracted in step S2 is [p1, p2, p3, p4, p5] and the first and second index sequences are [1, 2, 3, 4, 5].

[0169] In this case, in step S4, the columns in the two-dimensional array shown in the upper part of Figure 11 (the two-dimensional array generated by combining the first parameter column and the first and second index columns) are randomly permuted, thereby converting the two-dimensional array into the two-dimensional array shown in the middle part of Figure 11.

[0170] Furthermore, in step S4, only the multiple indexes (columns) in the second index column in the two-dimensional array shown in the middle of Figure 11 are further randomly permuted, thereby converting the two-dimensional array into the two-dimensional array shown in the bottom of Figure 11.

[0171] By separating the first parameter sequence, the first index sequence, and the second index sequence from the two-dimensional array shown in the lower part of Figure 11, a first parameter sequence [p4,p1,p2,p5,p3] in which the arrangement of multiple parameters in the first parameter sequence [p1,p2,p3,p4,p5] has been changed, a first index sequence [4,1,2,5,3] in which the arrangement of multiple indexes in the first index sequence [1,2,3,4,5] has been changed, and a second index sequence [1,5,2,4,3] in which the arrangement of multiple indexes in the second index sequence [1,2,3,4,5] has been changed are obtained.

[0172] The first index sequence, whose arrangement has been changed in step S4 in this way, corresponds to information (parameter rearrangement information) indicating the correspondence between the arrangement of the multiple parameters in the first parameter sequence before the change and the arrangement of the multiple parameters after the change, similar to the index sequence in the first embodiment described above. On the other hand, the second index sequence, whose arrangement has been changed in step S4, corresponds to information indicating the correspondence between the arrangement of the multiple parameters in the first parameter sequence before the change and an arrangement different from the arrangement of the multiple parameters after the change, and can be said to be a dummy index sequence (dummy rearrangement information).

[0173] The processing in step S4 described above using FIG. 11 is just one example, and in step S4, processing may be executed to change the arrangement of the multiple indexes in the first index column in the same way as the index column in the first embodiment described above, and to change the arrangement of the multiple indexes in the second index column to an arrangement different from that arrangement.

[0174] Next, the encryption unit 105 encrypts the first parameter sequence, the first index sequence, and the second index sequence obtained by executing the process of step S4 (step S5). Although a detailed description will be omitted, in step S5, instead of the process of encrypting the index sequence described in the first embodiment, a process of encrypting each of the first and second index sequences is executed. The process of encrypting the first parameter sequence is the same as in the first embodiment. That is, when the process of step S5 is executed in this embodiment, N first parameter share sequences, N first index share sequences, and N second index share sequences are generated.

[0175] When the process of step S5 is executed, the N first parameter share sequences, N first index share sequences, and N second index share sequences generated by the process of step S5 are transmitted to the integrated server devices 20-1 to 20-N (step S6). In this case, one first parameter share sequence, one first index share sequence, and one second index share sequence are transmitted to one integrated server device.

[0176] In this embodiment, the first parameter share sequence and the first and second index share sequences are transmitted in different files. Furthermore, the first and second index share sequences may be transmitted in different files.

[0177] In the first embodiment described above, for example, the array change unit 201 included in the integrated server device 20-1 changes the array of the shares of the multiple parameters in the first parameter share sequence (rearranges the shares of the multiple parameters) based on the index share sequence transmitted from each of the client terminals 10-1 to 10-M, but in this embodiment, it is necessary to change the array of the shares of the multiple parameters in the first parameter share sequence based on the first index share sequence of the first and second index share sequences. That is, the integrated server device 20-1 needs to know that it should refer to the first index share sequence when changing the array of the multiple parameters in the first parameter sequence.

[0178] Specifically, if the index share column to be referenced in repeated machine learning (i.e., the first index column to be referenced) is fixed, it is sufficient that the first index column to be referenced is set (specified) in advance in the integrated server device 20-1 (to 20-N).

[0179] Alternatively, the index share sequence to be referenced may be changed for each iteration of machine learning. In this case, the index share sequence must be specified in each client terminal 10-1 to 10-M. The index share sequence (the index used to change the array) specified in the client terminal 10-1 to 10-M must be shared with the integrated server devices 20-1 to 20-N (i.e., instructed to the integrated server devices 20-1 to 20-N). However, if the first and second index share sequences are transmitted from the client terminals 10-1 to 10-M in the form of a two-dimensional array, a file containing the row numbers of the two-dimensional array indicating the specified index sequence may be transmitted separately, or a numerical value indicating the index share sequence may be inserted into the two-dimensional array (e.g., a fixed array coordinate number).

[0180] In this embodiment, it is sufficient that the integrated server devices 20-1 to 20-N are configured to be able to determine which of the first and second index share columns should be referenced, and the method for specifying (sharing) the index share column is not limited.

[0181] In the above Figure 11, we have explained the case where the first index share column is an index when changing the array, but if the second index share column is specified as an index when changing the array, it is sufficient to further randomly permute only the multiple indexes (columns) in the first index column in the two-dimensional array shown in the middle of Figure 11.

[0182] The processes of steps S8 to S13 described in the first embodiment are then executed. Note that, as described above, if the arrangement of the shares of the multiple parameters in the first parameter share sequence is changed based on the first index share sequence in step S7, the arrangement of the shares of the multiple parameters in the second parameter share sequence is changed based on the first index share sequence in step S9. Furthermore, since the arrangement of the shares of the multiple parameters in the second parameter share sequence is changed based on the plaintext parameter rearrangement information (first index sequence) in step S11, it is not necessary to transmit the first index share sequence in step S10. However, as in the first embodiment, if the plaintext parameter rearrangement information has been discarded in the client terminals 10-1 to 10-M, the first index share sequence may be transmitted to the client terminals 10-1 to 10-M together with the second parameter share sequence in step S10. In this case, however, it is preferable to transmit the second index share sequence together with the first index share sequence.

[0183] As described above, in this embodiment, each of client terminals 10-1 to 10-M generates a first index share sequence (first fragment index sequence) corresponding to each of integrated server devices 20-1 to 20-N by performing secret sharing on a first index sequence that indicates the correspondence between an array of multiple parameters in a first parameter sequence (first array) and an array of multiple parameters changed from that array (second array), and generates a second index share sequence (second fragment index sequence) corresponding to each of integrated server devices 20-1 to 20-N by performing secret sharing on a second index sequence that is different from the first index sequence, and transmits the first and second index share sequences to each of integrated server devices 20-1 to 20-N.

[0184] In this embodiment, with this configuration, for example, even if a third party acquires k first parameter share sequences out of N first parameter share sequences and k first and second index share sequences out of N first and second index share sequences, the third party will not be able to determine which of the first and second index sequences to refer to when sorting the k first parameter share sequences (multiple parameters in the first parameter sequences), thereby reducing the possibility that learning data will be inferred from the multiple parameters (i.e., improving safety in machine learning).

[0185] Furthermore, in this embodiment, each of the integrated server devices 20-1 to 20-N receives M first index share sequences and M second index share sequences transmitted from each of the client terminals 10-1 to 10-M, and changes the arrangement of shares of multiple parameters in each of the M first parameter share sequences based on each of the M first index share sequences that are pre-specified among the received M first index share sequences and M second index share sequences.

[0186] In this embodiment, with this configuration, even if a second index share sequence (dummy index sequence) is transmitted from the client terminals 10-1 to 10-M in addition to the first index share sequence as described above, the first parameter share sequences transmitted from the respective client terminals 10-1 to 10-M can be appropriately integrated in each of the integrated server devices 20-1 to 20-N.

[0187] In addition, in this embodiment, for example, by adopting a configuration in which the first parameter share sequence and the first and second index share sequences are transmitted from the client terminals 10-1 to 10-M to the integrated server devices 20-1 to 20-N in different files, the first and second index share sequences are acquired along with the first parameter share sequence, and it is possible to prevent the multiple parameters (arrangement of the parameters) in the parameter sequence decoded from the first parameter share sequence from being rearranged in the correct order.

[0188] In addition, in this embodiment, by performing a secret computation to change the arrangement of shares of multiple parameters in the first parameter share sequence based on the first index share sequence (i.e., a rearrangement operation), there is no need to perform a process to decrypt the index sequence from the index share sequence, thereby reducing the amount of processing in each of the integrated server devices 20-1 to 20-N.

[0189] In this embodiment, a second index sequence is prepared (generated) as a dummy index sequence. However, multiple second index sequences may be provided. In this case, the multiple second index sequences are changed to different arrangements. Specifically, for example, as shown in FIG. 11, if the first parameter sequence whose arrangement has been changed is [p4, p1, p2, p5, p3] and the first index sequence whose arrangement has been changed is [4, 1, 2, 5, 3], the multiple second index sequences whose arrangement has been changed may be, for example, [1, 5, 2, 4, 3] and [3, 4, 5, 2, 1]. Although the case where the number of second index sequences is two has been described, the number of second index sequences may be three or more.

[0190] Furthermore, in this embodiment, a dummy index column (second index column) is prepared in the configuration described in the first embodiment, but this embodiment may also be applied to the second embodiment (that is, a configuration in which a dummy index column is prepared in the configuration described in the second embodiment)

[0191] According to at least one of the embodiments described above, it is possible to provide a machine learning system and method that can ensure high safety in machine learning.

[0192] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, as well as within the scope of the invention described in the claims and their equivalents. [Explanation of symbols]

[0193] 1...machine learning system, 10-1 to 10-M...client terminal, 11...CPU, 12...non-volatile memory, 13...RAM, 14...communication device, 20-1 to 20-N...integrated server device, 30...network, 101...storage unit, 102...learning processing unit, 103...parameter extraction unit, 104...array modification unit, 105...encryption unit, 106...decryption unit, 107...update unit, 108...evaluation unit, 201...array modification unit, 202...integration processing unit, 203...update unit.

Claims

1. A machine learning system including a plurality of client terminals and a plurality of integrated server devices communicably connected to the plurality of client terminals, Each of the plurality of client terminals a learning processing means for executing a learning process of a machine learning model using learning data managed in the client terminal; extraction means for extracting a first parameter sequence in which a plurality of parameters are arranged from the machine learning model on which the learning process has been executed; a first change means for changing the arrangement of a plurality of parameters in the extracted first parameter sequence; a first generating means for generating a first fragment parameter sequence corresponding to each of the plurality of integrated server devices by performing secret sharing on a first parameter sequence in which the arrangement of the plurality of parameters has been changed; a transmitting means for transmitting the generated first fragment parameter sequence to each of the plurality of integrated server devices; Including, Each of the plurality of integrated server devices a receiving means for receiving a plurality of first fragment parameter sequences transmitted by a transmitting means included in each of the plurality of client terminals; a second modification means for modifying an arrangement of a plurality of fragment parameters in each of the received plurality of first fragment parameter sequences; second generating means for generating a second fragment parameter sequence by executing integration processing on a plurality of first fragment parameter sequences in which the arrangement of the plurality of fragment parameters has been changed; Including, The machine learning model is updated based on a plurality of parameters in a second parameter sequence decoded from a plurality of second fragment parameter sequences generated by a second generation means included in each of the plurality of integrated server devices. Machine learning systems.

2. When the number of the plurality of integrated server devices is N (N is an integer equal to or greater than 2), the first generation means generates k-1 (k is an integer equal to or greater than 2 and equal to or less than N) first coefficients r that are elements of a random integer ring Q. １ , ..., r ｋ－１ and N random second coefficients P that are elements of the integer ring Q corresponding to each of the N integrated server devices. １ , ..., P Ｎ and a k-1 degree polynomial having each of the plurality of parameters in the first parameter sequence as an intercept a is determined. [Equation 3] generating N first fragment parameter sequences corresponding to each of the N integrated server devices based on the The transmitting means transmits each of the generated N first fragment parameter sequences to an integrated server device corresponding to the first fragment parameter sequence. The machine learning system of claim 1 .

3. The machine learning system according to claim 1 , wherein the integration process is performed using secure computation.

4. the first generating means generates fragment index sequences corresponding to each of the plurality of integrated server devices by performing secret sharing on an index sequence indicating a correspondence relationship between a first array of a plurality of parameters in the extracted first parameter sequence and a second array of the plurality of parameters modified from the first array; the transmitting means transmits the generated fragment index sequence to each of the plurality of integrated server devices; the receiving means receives a plurality of fragment index sequences transmitted by a transmitting means included in each of the plurality of client terminals; The second modification means modifies an arrangement of the plurality of fragment parameters in each of the plurality of received first fragment parameter sequences based on each of the plurality of received fragment index sequences. The machine learning system of claim 1 .

5. The machine learning system of claim 4 , wherein the fragment index sequence is transmitted in a file different from the first fragment parameter sequence.

6. Each of the plurality of client terminals further includes an evaluation means for evaluating the updated machine learning model using evaluation data prepared in advance; The learning processing means included in each of the plurality of client terminals executes a learning process for the updated machine learning model or the machine learning model before the update based on the evaluation result by the evaluation means included in the client terminal. The machine learning system of claim 1 .

7. the first generation means generates a first fragment index sequence corresponding to each of the plurality of integrated server devices by performing secret sharing on a first index sequence indicating a correspondence relationship between a first array of a plurality of parameters in the extracted first parameter sequence and a second array of the plurality of parameters modified from the first array, and generates a second fragment index sequence corresponding to each of the plurality of integrated server devices by performing secret sharing on a second index sequence different from the first index sequence; the transmitting means transmits the generated first and second fragment index sequences to each of the plurality of integrated server devices; the receiving means receives a plurality of first fragment index sequences and a plurality of second fragment index sequences transmitted by a transmitting means included in each of the plurality of client terminals; The second change means changes an arrangement of a plurality of fragment parameters in each of the received plurality of first fragment parameter sequences based on each of a plurality of first fragment index sequences that are designated in advance among the received plurality of first fragment index sequences and a plurality of second fragment index sequences. The machine learning system of claim 1 .

8. The machine learning system of claim 7 , wherein the first and second fragment index strings are transmitted in a file different from the first fragment parameter string.

9. The machine learning system according to claim 4 or 7, wherein the change in the arrangement of the plurality of fragment parameters in each of the plurality of received first fragment parameter sequences is performed using secure computation.

10. A method executed by a machine learning system including a plurality of client terminals and a plurality of integrated server devices communicably connected to the plurality of client terminals, a step in which each of the plurality of client terminals executes a learning process of a machine learning model using learning data managed in the client terminal; Each of the client terminals extracts a first parameter sequence in which a plurality of parameters are arranged from the machine learning model on which the learning process has been executed; each of the client terminals changing an arrangement of a plurality of parameters in the extracted first parameter sequence; each of the client terminals performs secret sharing on a first parameter sequence in which the arrangement of the plurality of parameters has been changed, thereby generating a first fragment parameter sequence corresponding to each of the plurality of integrated server devices; a step in which each of the client terminals transmits the generated first fragment parameter sequence to each of the plurality of integrated server devices; a step in which each of the plurality of integrated server devices receives a plurality of first fragment parameters transmitted by a transmitting means included in each of the plurality of client terminals; each of the integrated server devices changing an arrangement of a plurality of fragment parameters in each of the received first fragment parameter sequences; each of the plurality of integrated server devices performs an integration process on the plurality of first fragment parameter sequences in which the arrangement of the plurality of fragment parameters has been changed, thereby generating a second fragment parameter sequence; Equipped with The machine learning model is updated based on a plurality of parameters in a second parameter sequence decoded from a second fragment parameter sequence generated in each of the plurality of integrated server devices. method.

Images