Model training method, model training program and information processing device

Abstract

The present invention makes it possible to efficiently generate a machine learning model having immunity to membership estimation by executing processes for: inputting, to a first class sorting model trained using basic data associated with correct-answer labels, a plurality of items of processing data, each of which is associated with a correct-answer label and each of which differs from the basic data, to thereby acquire the certainty factors of the correct-answer labels for each of the plurality of items of processing data; identifying processing data that corresponds to a certainty factor less than a first reference value; and training a new class sorting model using the identified processing data as training data.

Description

[Technical Field]

[0001] The present invention relates to a model training method, a model training program, and an information processing device. [Background technology]

[0002] In recent years, the development and use of systems using machine learning has progressed rapidly. However, security issues specific to machine learning systems have also been discovered. For example, membership inference attacks are known as one of the security issues.

[0003] In a membership estimation attack, for example, an attacker estimates whether data of interest is included in the training data of a machine learning model that is the target of the attack.

[0004] A known defense against membership inference attacks is to train a machine learning model using pseudo data as training data. The pseudo data may be generated by adding noise to base data, or may be generated from base data by machine learning.

[0005] There are known techniques for selecting training data. For example, a training data selection device is known that selects training data that can shorten the training time (see Patent Document 1).

[0006] The property of making it difficult to infer whether specific data is included in the training data is sometimes called resistance to membership inference attacks. Various pseudo data may contain data that affects resistance to membership inference attacks (hereinafter referred to as "membership inference resistance"). In the past, pseudo data was divided into several groups to train a machine learning model, and each group was evaluated based on its membership estimation resistance. This process was repeated several times, changing the way the data was divided into groups, and data that was commonly used in models with low resistance was identified as data that reduces the membership estimation resistance and removed from the training data. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Patent Publication No. 2021-107970 [Patent Document 1] Japanese Patent Application Publication No. 2019-159961 [Patent Document 3] US Patent Application Publication No. 2007 / 0143284 Summary of the Invention [Problem to be solved by the invention]

[0008] However, identifying data that reduces the robustness of membership estimation using such conventional methods requires a lot of computational time, which makes it difficult to efficiently train a machine learning model to improve the robustness of membership estimation.

[0009] In one aspect, the present invention aims to efficiently generate a machine learning model that is resistant to membership estimation. [Means for solving the problem]

[0010] Therefore, in this model training method, a computer executes a process in which a first class classification model trained using basic data associated with a correct answer label is input with a plurality of processed data, each of which is associated with a correct answer label and differs from the basic data, to obtain the confidence level of the correct answer label for each of the plurality of processed data, identify the processed data corresponding to the confidence level that is less than a first reference value, and use the identified processed data as training data to train a new class classification model. [Effects of the Invention]

[0011] According to one embodiment, a machine learning model that is resistant to membership estimation can be efficiently generated. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating a hardware configuration of an information processing apparatus according to an embodiment; [Figure 2] FIG. 1 is a diagram illustrating a functional configuration of an information processing apparatus as an example of an embodiment. [Figure 3] FIG. 10 is a diagram for explaining an example of a second training execution unit and a second confidence factor vector acquisition unit in the information processing device as an example of an embodiment. [Figure 4] FIG. 2 is a diagram illustrating processing content in an information processing apparatus as an example of an embodiment. [Figure 5] FIG. 1 is a diagram illustrating an overview of a training phase and an inference phase of a classification model in an information processing device as an example of an embodiment. [Figure 6] 10 is a flowchart illustrating a model training method in an information processing device as an example of an embodiment. [Figure 7] 10 is a flowchart illustrating a first example of a method for specifying pseudo data in an information processing device as an example of an embodiment. [Figure 8] 10 is a flowchart illustrating a second example of a method for specifying pseudo data in an information processing device as an example of an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments of the present model training method, model training program, and information processing device will be described with reference to the drawings. However, the embodiments shown below are merely examples, and are not intended to exclude the application of various modifications and techniques not explicitly stated in the embodiments. In other words, the present embodiment can be implemented with various modifications within the scope of its intent. Furthermore, each figure does not intend to include only the components shown in the figure, but can include other functions, etc.

[0014] (A) Configuration FIG. 1 is a diagram illustrating a hardware configuration of an information processing device 1 as an example of an embodiment.

[0015] 1, the information processing device 1 has, as components, a processor 11, a memory 12, a storage device 13, a graphics processing device 14, an input interface 15, an optical drive device 16, a device connection interface 17, and a network interface 18. These components 11 to 18 are configured to be able to communicate with each other via a bus 19. The information processing device 1 is an example of a computer.

[0016] The processor 11 (control unit) controls the entire information processing device 1. The processor 11 may be a multiprocessor. The processor 11 may be, for example, any one of a CPU, an MPU (Micro Processing Unit), a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), a PLD (Programmable Logic Device), an FPGA (Field Programmable Gate Array), and a GPU (Graphics Processing Unit). The processor 11 may also be a combination of two or more types of elements from the CPU, MPU, DSP, ASIC, PLD, FPGA, and GPU.

[0017] The processor 11 executes the control program (model training program 13a), thereby realizing the function of a training processing unit 100, as exemplified in FIG.

[0018] The information processing device 1 realizes the function of the training processing unit 100 by executing a model training program 13a and an OS (Operating System) program, which are programs recorded on a computer-readable non-transitory recording medium, for example.

[0019] Programs describing the processing to be executed by the information processing device 1 can be recorded on various recording media. For example, a model training program 13a to be executed by the information processing device 1 can be stored in the storage device 13. The processor 11 loads at least a part of the model training program 13a in the storage device 13 into the memory 12 and executes the loaded model training program 13a.

[0020] The model training program 13a to be executed by the information processing device 1 (processor 11) can also be recorded on a non-transitory portable recording medium such as an optical disk 16a, a memory device 17a, or a memory card 17c. The model training program 13a stored on the portable recording medium becomes executable after being installed in the storage device 13 under the control of the processor 11, for example. The processor 11 can also read and execute the model training program 13a directly from the portable recording medium.

[0021] The memory 12 is a storage memory including a ROM (Read Only Memory) and a RAM (Random Access Memory). The RAM of the memory 12 is used as the main storage device of the information processing device 1. The RAM temporarily stores at least a part of the OS program and control program to be executed by the processor 11. The memory 12 also stores various data required for processing by the processor 11.

[0022] The storage device 13 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), or a storage class memory (SCM), and stores various data. The storage device 13 is used as an auxiliary storage device for the information processing device 1. The storage device 13 stores an OS program, a control program, and various data. The control program includes a model training program 13a.

[0023] The auxiliary storage device may be a semiconductor storage device such as an SCM or a flash memory. A plurality of storage devices 13 may be used to configure a RAID (Redundant Array of Inexpensive Disks).

[0024] In addition, the memory device 13 may store various data acquired or generated by the third training execution unit 101, basic data acquisition unit 102, pseudo data acquisition unit 103, first training execution unit 104, second training execution unit 105, and specific training data generation unit 106, which will be described later.

[0025] A monitor 14a is connected to the graphics processing device 14. The graphics processing device 14 displays an image on the screen of the monitor 14a in accordance with an instruction from the processor 11. Examples of the monitor 14a include a display device using a CRT (Cathode Ray Tube) and a liquid crystal display device.

[0026] A keyboard 15a and a mouse 15b are connected to the input interface 15. The input interface 15 transmits signals sent from the keyboard 15a and the mouse 15b to the processor 11. The mouse 15b is an example of a pointing device, and other pointing devices can also be used. Examples of other pointing devices include a touch panel, a tablet, a touch pad, and a trackball.

[0027] The optical drive device 16 uses a laser beam or the like to read data recorded on an optical disc 16a. The optical disc 16a is a portable, non-transitory recording medium on which data is recorded so that it can be read by reflected light. Examples of the optical disc 16a include a DVD (Digital Versatile Disc), a DVD-RAM, a CD-ROM (Compact Disc Read Only Memory), and a CD-R (Recordable) / RW (Rewritable).

[0028] The device connection interface 17 is a communication interface for connecting peripheral devices to the information processing device 1. For example, a memory device 17a or a memory reader / writer 17b can be connected to the device connection interface 17. The memory device 17a is a non-transitory recording medium, such as a USB (Universal Serial Bus) memory, that has a function for communicating with the device connection interface 17. The memory reader / writer 17b writes data to or reads data from a memory card 17c. The memory card 17c is a card-type non-transitory recording medium.

[0029] The network interface 18 is connected to a network (not shown). The network interface 18 may be connected to other information processing devices and communication devices via the network. For example, data related to diseases may be input via the network.

[0030] 2 is a diagram illustrating a functional configuration of an information processing device 1 as an example of an embodiment. As shown in FIG.

[0031] In the information processing device 1, the processor 11 executes a control program (model training program 13a), thereby realizing the function of a training processing unit 100.

[0032] The training processing unit 100 realizes learning processing (training processing) in machine learning using training data. That is, the information processing device 1 functions as a training device that trains a machine learning model using the training processing unit 100.

[0033] The training processing unit 100 includes a third training execution unit 101 that implements learning processing in machine learning using training data (teacher data) to which correct labels have been assigned. In this example, the training processing unit 100 includes a data selection unit 100a that selects (identifies) training data to be input to the third training execution unit 101. The "correct label" may be correct information assigned to each piece of data.

[0034] The training data input to the third training execution unit 101 may be a plurality of pseudo data generated by adding noise or the like to raw data in order to defend against membership estimation attacks. "Pseudo data" is an example of processed data obtained by processing original data.

[0035] The data selection unit 100a removes data that affects the membership estimation resistance, i.e., data that reduces the membership estimation resistance, from the plurality of pseudo data. The data selection unit 100a selects training data to be used for a new classification model (third classification model C) to be trained in the third training execution unit 101.

[0036] The classification model is a machine learning model for classifying data into multiple classes. The machine learning model may be, for example, a deep learning model (deep neural network). The neural network may be a hardware circuit, or may be a virtual network using software that connects layers virtually constructed on a computer program by the processor 11 or the like.

[0037] As shown in FIG. 2, the data selection unit 100a may include a basic data acquisition unit 102, a pseudo data acquisition unit 103, a first training execution unit 104, a second training execution unit 105, and a specific training data generation unit 106.

[0038] The basic data acquisition unit 102 acquires basic data. The basic data is data (teacher data) associated with a correct label. The basic data is training data used by the first training execution unit 104 to realize a learning process in machine learning.

[0039] The basic data may be data generated (processed) based on collected unprocessed raw data, or may be the raw data itself. However, it is preferable that the basic data be data processed based on the raw data rather than the raw data itself. If the raw data is data with a level of confidentiality above a predetermined level, such as disease-related data, it is preferable to avoid using the raw data itself for training as much as possible from the perspective of maintaining confidentiality. However, depending on the content of the data, the raw data may be used as the basic data.

[0040] The basic data acquisition unit 102 may acquire basic data generated by an external device, or may generate basic data within the information processing device 1.

[0041] The pseudo data acquisition unit 103 acquires a plurality of pseudo data, and may generate the pseudo data based on the raw data.

[0042] Each piece of pseudo data is an example of processed data generated (processed) based on collected unprocessed raw data. The pseudo data acquisition unit 103 may generate the pseudo data using various known methods. For example, the pseudo data may be generated by adding noise to the raw data. In one example, the pseudo data acquisition unit 103 may generate each piece of pseudo data by adding random noise to the raw data. The noise may be Gaussian noise or Laplace noise. In one example, each piece of pseudo data may be data processed from basic data.

[0043] Alternatively, the pseudo data acquiring unit 103 may train a generative model based on machine learning, such as a Generative Adversarial Network (GAN), with raw data and generate pseudo data using the trained model. Alternatively, the pseudo data acquiring unit 103 may generate pseudo data using dynamic programming (DP).

[0044] The degree of processing of each of the pseudo data may be greater than the degree of processing of the base data. The degree of processing refers to the degree of processing from the raw data. In one example, the greater the noise added to the raw data, the greater the degree of processing.

[0045] Each of the plurality of pseudo data is associated with a correct label. However, each of the plurality of pseudo data is different from the base data. The plurality of pseudo data includes training data (teacher data) used by the second training execution unit 105 to realize a learning process in machine learning.

[0046] The pseudo data acquiring unit 103 may acquire pseudo data generated by a device external to the information processing device 1, or may generate pseudo data within the information processing device 1. In particular, the pseudo data acquiring unit 103 may generate multiple pieces of pseudo data within the information processing device 1 based on the basic data acquired by the basic data acquiring unit 102.

[0047] The first training execution unit 104 uses the basic data as training data to train a first class classification model A (model A: see FIG. 4 ) and generate a trained first class classification model A. The first class classification model A is an example of a first class classification model. The basic data is configured as, for example, a combination of input data x and correct output data y. It is desirable that the first training execution unit 104 executes training of the first class classification model A using a plurality of basic data. The first training execution unit 104 can execute training of the first class classification model A using a known method.

[0048] The training of the first class classification model A performed by the first training execution unit 104 using basic data may be referred to as first training. Furthermore, the class classification model before training by the first training execution unit 104 may be an empty machine learning model. The machine learning model may also be simply referred to as a model.

[0049] The second training execution unit 105 trains a second class classification model B (model B) using a plurality of pseudo data as training data, and generates a trained second class classification model B. The second class classification model is an example of a second class classification model. Each of the plurality of pseudo data is configured as a combination of input data x and correct output data y, for example. The second training execution unit 105 can train the second class classification model B using a known method.

[0050] The second training execution unit 105 may train a second class classification model B (e.g., model B1: see Figure 3) using two or more first pseudo data (e.g., pseudo data #1 described later: see Figure 3) from among the multiple pseudo data as training data.

[0051] The training of the second class classification model B performed by the second training execution unit 105 using multiple pieces of pseudo data may be referred to as second training. Furthermore, the class classification model before training by the second training execution unit 105 may be the same empty machine learning model as the class classification model before training by the first training execution unit 104.

[0052] In addition, the second training execution unit 105 may use the pseudo data as training data to train multiple (e.g., two) second class classification models B (e.g., models B1 and B2) and generate multiple trained second class classification models B.

[0053] FIG. 3 is a diagram for explaining an example of the processing of the second training executing unit 105 and the second confidence factor vector acquiring unit 108 in the information processing device 1 as an example of an embodiment.

[0054] 3, the second training execution unit 105 trains two second class classification models B1 and B2. The second training execution unit 105 may include an allocating unit 111. The allocating unit 111 allocates the plurality of pseudo data acquired from the pseudo data acquisition unit 103 into a plurality of groups. The allocating unit 111 may randomly allocate the plurality of pseudo data into the plurality of groups.

[0055] 3, the pseudo data is divided into pseudo data #1 (first converted data) belonging to one group and pseudo data #2 (second converted data) belonging to another group different from the first group. However, the pseudo data may be divided into three or more groups. There are two or more pseudo data for each of pseudo data #1 and pseudo data #2.

[0056] The second training execution unit 105 trains the second class classification model B1 using the pseudo data #1. The second training execution unit 105 trains the second class classification model B2 using the pseudo data #2.

[0057] 2 identifies (selects, generates) training data used by the third training execution unit 101 to realize the learning process in machine learning. The specific training data generation unit 106 may remove data from the plurality of pseudo data that may deteriorate the membership estimation resistance. The specific training data generation unit 106 may identify training data from the plurality of pseudo data that maintains the membership estimation resistance.

[0058] The specific training data generation unit 106 may select training data for the third training execution unit 101 using a trained first class classification model A, a trained second class classification model B, and multiple pseudo data to be evaluated.

[0059] The specific training data generation unit 106 may acquire the trained first class classification model A, the trained second class classification model B, and multiple pieces of pseudo data to be evaluated from outside the information processing device 1. In this case, the functions of the basic data acquisition unit 102, the pseudo data acquisition unit 103, the first training execution unit 104, and the second training execution unit 105 may be provided in a device external to the information processing device 1.

[0060] As shown in FIG. 2, the specific training data generation unit 106 includes a first confidence factor vector acquisition unit 107, a second confidence factor vector acquisition unit 108, a distance calculation unit 109, and a specification unit 110.

[0061] First confidence vector acquisition unit 107 acquires a first confidence vector V A for each of the plurality of pseudo data by inputting the plurality of pseudo data to first class classification model A. The generation of the first confidence vector V A is one of the inference processes using the trained first class classification model A, and is referred to as first inference.

[0062] The confidence vector contains the confidence of each label, which is the result of data classification by a classification model. A "label" may be an item used to classify data by a classification model. The confidence is the probability that the pair of data of interest and the label (item) is correct.

[0063] In one example, when a classification model classifies input data into four elements, for example, labels of element (A), element (B), element (C), and element (D), a confidence level is calculated for each label. Furthermore, a confidence level of the correct label of the input data is calculated. The confidence level vector includes the confidence level of each label as an element.

[0064] First certainty vector acquiring unit 107 is an example of a certainty acquiring unit that inputs a plurality of pseudo data to first class classification model A, and thereby acquires the certainty of the correct label for each of the plurality of pseudo data.

[0065] Second confidence vector acquisition unit 108 acquires a second confidence vector VB for each of two or more pieces of second processed data, the second confidence vector VB having elements each representing the confidence of each of a plurality of labels that are the discrimination results. The generation of second confidence vector VB is one of the inference processes using trained second class classification model B, and is referred to as second inference.

[0066] Second confidence vector acquisition unit 108 inputs pseudo data into second class classification model B to cause it to perform inference, and acquires second confidence vector VB.

[0067] When the second training execution unit 105 trains a plurality of second class classification models B, the second confidence vector acquisition unit 108 inputs pseudo data into each of the plurality of second class classification models B, causes them to perform inference, and acquires a second confidence vector VB.

[0068] The second belief vector acquisition unit 108 may include a switching unit 112. The switching unit 112 exchanges (swap) the pseudo data input to the second class classification models B1 and B2 between the training phase and the evaluation phase.

[0069] 3, the switching unit 112 inputs pseudo data #2 as pseudo data to be evaluated to the second class classification model B1 trained using pseudo data #1, while the switching unit 112 inputs pseudo data #1 as pseudo data to be evaluated to the second class classification model B2 trained using pseudo data #2.

[0070] In this way, by the switching unit 112 exchanging the pseudo data input to the second classification models B1 and B2 between the training phase and the evaluation phase, it is possible to avoid the second classification model B1 trained using pseudo data #1 evaluating the same pseudo data #1 as in the training phase. Similarly, it is possible to avoid the second classification model B2 trained using pseudo data #2 evaluating the same pseudo data #2 as in training.

[0071] If the same data is used in the training phase and the evaluation phase, the certainty of the correct label in the second certainty vector VB may become higher than necessary due to the influence of overlearning, etc., and the distance |VA-VB| may not reflect the membership estimation robustness. The configuration in Figure 3 makes it easier to evaluate the membership estimation robustness based on the distance |VA-VB|.

[0072] The switching unit 112 exchanges (swaps) the pseudo data input to the second class classification models B1 and B2, thereby making it possible to evaluate the membership estimation robustness for the entire pseudo data #1 and the entire pseudo data #2.

[0073] To generate the second confidence vector VB, the second confidence vector acquisition unit 108 may use second class classification models B1, B2 (see FIG. 3) trained using two or more first pseudo data (e.g., pseudo data #1, #2: see FIG. 3) from among the plurality of pseudo data.

[0074] Second confidence vector acquisition unit 108 generates second confidence vector VB (see FIG. 4) by inputting two or more second pseudo data (e.g., pseudo data #1 and #2 described below: see FIG. 3) from among the plurality of pseudo data to trained second class classification models B2 and B1 (see FIG. 3). The first pseudo data (e.g., pseudo data #1) and the second pseudo data (e.g., pseudo data #2) may be different.

[0075] Distance calculation section 109 shown in FIG. 2 obtains the distance between first confidence vector VA and second confidence vector VB.

[0076] The distance may be the KL distance (Kullback-Leibler distance) or the L1 distance (also known as Manhattan distance). In one example, the first belief vector VA is defined as VA(p1,...pn) (where p1,...pn are the beliefs of each label in the first belief vector VA). The second belief vector VB is defined as VB(q1,...qn) (where q1,...qn are the beliefs of each label in the second belief vector VB).

[0077] The KL distance |VA-VB| between the first belief vector VA and the second belief vector VB is given by the following equation (1). sqrt((p1-q1) 2 +···+(pn-qn) 2 )···(1)

[0078] The L1 distance |VA-VB| between the first belief vector VA and the second belief vector VB is given by the following equation (2). |p1-q1|+···+|pn-qn|···(2)

[0079] The identification unit 110 identifies, from among the plurality of pieces of pseudo data, pseudo data to be input to the third training execution unit 101. The identification unit 110 may identify the pseudo data based on the first confidence vector VA.

[0080] In one example, the identification unit 110 may identify pseudo data based on the first confidence vector VA. The identification unit 110 determines whether the confidence of the correct label of the first confidence vector VA is less than a first reference value. The identification unit 110 may identify pseudo data corresponding to a confidence less than the first reference value as data that does not adversely affect the membership estimation resistance. The pseudo data identified as data that does not adversely affect the membership estimation resistance in this manner may be used as training data for training the third class classification model C (model C) by the third training execution unit 101. The first reference value may be a predetermined threshold.

[0081] The identification unit 110 may further identify pseudo data based on the distance |VA-VB| between the first confidence vector VA and the second confidence vector VB. For example, the identification unit 110 determines whether the distance |VA-VB| is greater than a second reference value. The identification unit 110 may identify pseudo data corresponding to a confidence equal to or greater than the first reference value, but having a distance |VA-VB| greater than the second reference value, as data that does not adversely affect the membership estimation resistance. The identification unit 110 may use the pseudo data identified as data that does not adversely affect the membership estimation resistance as training data for training the third class classification model C. That is, the identification unit 110 may identify, as training data for the third class classification model C, pseudo data that satisfies the condition that the confidence of the correct label of the first confidence vector VA is less than the first reference value or the distance |VA-VB| is greater than the second reference value.

[0082] In other words, in this embodiment, identification unit 110 removes, from among the multiple pseudo data, pseudo data whose first confidence vector VA has a confidence level for the correct label equal to or greater than a first reference value and whose distance |VA-VB| is equal to or less than a second reference value. Pseudo data that increases the confidence level for the correct label of the first confidence vector VA and decreases the distance |VA-VB| may adversely affect the membership estimation robustness. Therefore, identification unit 110 can proactively remove pseudo data that may adversely affect the membership estimation robustness.

[0083] However, the identification unit 110 may identify the corresponding pseudo data as training data for the third class classification model C only when the confidence of the correct label of the first confidence vector VA is less than a first reference value and the distance |VA-VB| is greater than a second reference value.

[0084] The third training execution unit 101 uses the pseudo data identified by the identification unit 110 as training data to train the third class classification model C. The third class classification model C is the model actually used for estimation. The pseudo data identified by the identification unit 110 is configured as, for example, a combination of input data x and correct output data y.

[0085] The training of the third class classification model C performed by the third training execution unit 101 using a plurality of identified pseudo data may be referred to as third training. Furthermore, the class classification model before training by the third training execution unit 101 may be the same empty machine learning model as the class classification model at the stage before training by the first training execution unit 104 or the second training execution unit 105.

[0086] FIG. 4 is a diagram for explaining the processing contents of first training execution unit 104, second training execution unit 105, first confidence factor vector acquisition unit 107, and second confidence factor vector acquisition unit 108 in information processing device 1 as an example of an embodiment.

[0087] FIG. 4 shows an example in which the second training execution unit 105 trains two second class classification models B1 and B2, and the second confidence vector acquisition unit 108 acquires the second confidence vector VB using these multiple second class classification models B1 and B2.

[0088] In the example shown in Figure 4, the processing content is roughly divided into processing #1 and processing #2. Processing #1 is the training phase of the first class classification model A and the second class classification models B1 and B2. Processing #2 is the evaluation phase of the pseudo data #1 and #2. The evaluation phase is an example of an inference phase using the first class classification model A and the second class classification models B1 and B2.

[0089] Process #1 includes a first training and a second training. In the first training, the first training execution unit 104 uses basic data as training data to train a first class classification model A. In the second training, the second training execution unit 105 uses pseudo data #1 as training data to train a second class classification model B1. In the second training, the second training execution unit 105 further uses pseudo data #2 as training data to train a second class classification model B2.

[0090] Process #2 includes a first inference and a second inference. In the first inference, first confidence vector acquisition unit 107 inputs the pseudo data (both pseudo data #1 and pseudo data #2) into a trained first class classification model A to acquire a first confidence vector V A.

[0091] In the second inference, second confidence vector acquisition unit 108 inputs pseudo data #1 to trained second class classification model B2, and as a result, second confidence vector acquisition unit 108 acquires second confidence vector VB for pseudo data #1.

[0092] In the second inference, second confidence vector acquisition unit 108 inputs pseudo data #2 to the trained second class classification model B1, and as a result, second confidence vector acquisition unit 108 acquires a second confidence vector VB for pseudo data #2.

[0093] In this way, second confidence vector acquisition section 108 can acquire second confidence vector VB for the pseudo data (both pseudo data #1 and pseudo data #2).

[0094] The identification unit 110 removes pseudo data for which the confidence of the correct label in the first confidence vector V A is equal to or greater than a first reference value and the distance |V A - V B | between the first confidence vector V A and the second confidence vector V B is equal to or less than a second reference value. The identification unit 110 can determine pseudo data that affects the membership estimation resistance based on the confidence of the correct label and the distance |V A - V B |. In other words, the identification unit 110 identifies pseudo data to be used as training data for training the third class classification model C by the third training execution unit 101.

[0095] FIG. 5 is a diagram illustrating an overview of the training phase and inference phase of a classification model in the information processing device 1 as an example of an embodiment.

[0096] The process shown in Fig. 5 includes a training phase. The training phase includes third training in which a third class classification model C is trained using the pseudo data identified by the process shown in Fig. 4 as training data. The third class classification model C is a new class classification model and is the model actually used in the inference phase.

[0097] The third training execution unit 101 sets parameters of the machine learning model by training an empty machine learning model using the identified pseudo data as training data.

[0098] In the inference phase, when query data x to be classified is input to the third classification model C, the third classification model C outputs the classification result as output data y.

[0099] In the inference phase, the information processing device 1 of this embodiment can be used as a device that infers whether or not a specific disease is suspected by inputting, for example, disease-related data or the like as query data x into the third class classification model C. However, the information processing device 1 is not limited to this case, and may be used as various classifying devices, such as a device that infers whether or not an email text is spam.

[0100] (B) Operation A method for training a classification model (machine learning model) in the information processing device 1 configured as above as an example of an embodiment will be described with reference to the flowchart (steps S1 to S5) shown in FIG.

[0101] In step S1, the pseudo data acquisition unit 103 generates a plurality of pseudo data. The pseudo data acquisition unit 103 may generate a plurality of pseudo data based on basic data. Information constituting the pseudo data is stored in a predetermined storage area such as the storage device 13.

[0102] In step S2, the first training execution unit 104 executes first training to train the first class classification model A using the basic data as training data. An empty class classification model before executing the first training may be stored in advance in the storage device 13. The first class classification model A after training may be stored in the storage device 13.

[0103] In step S3, the second training execution unit 105 executes second training to train the second classification model B (B1, B2) using a plurality of pseudo data as training data. An empty classification model before executing the second training may be stored in the storage device 13 in advance.

[0104] In step S4, the data selection unit 100a identifies (selects) pseudo data to be input to the third training execution unit 101 for training the third class classification model C.

[0105] Specifically, first confidence vector acquisition unit 107 generates a first confidence vector VA for each of the plurality of pseudo data by inputting the plurality of pseudo data to first class classification model A. The first confidence vector VA may include, as elements, the confidence of each of the plurality of labels that are the discrimination results. In particular, the first confidence vector VA includes the confidence of the correct label.

[0106] Similarly, the second belief vector 10 is generated by inputting a plurality of pseudo data to the second class classification model B, thereby generating a second belief vector VB for each of the plurality of pseudo data.

[0107] The identification unit 110 identifies pseudo data based on at least one of the confidence of the correct label inferred by the first class classification model A and the distance |VA-VB|.

[0108] In step S5, the third training execution unit 101 executes third training using the pseudo data identified in step S4 as training data to train the third class classification model C. The third class classification model C trained in this way has membership estimation resistance.

[0109] The pseudo data acquiring unit 103 may acquire multiple pseudo data generated by a device external to the information processing device 1. Furthermore, the information processing device 1 may acquire the first class classification model A and the second class classification model B generated by a device external to the information processing device 1. In these cases, the processes of steps S1, S2, and S3 may be omitted.

[0110] 7 is a flowchart (steps S11 to S18) for explaining a first example of a method for specifying pseudo data in the information processing device 1 as an example of an embodiment. The flowchart shown in FIG. 7 is an example of the process of step S4 in FIG.

[0111] In step S11, a first class classification model A trained using only basic data and a second class classification model B trained using only pseudo data are prepared.

[0112] The data selection unit 100a determines whether unevaluated pseudo data remains (step S12). If the determination result shows that there is no unevaluated pseudo data remaining (see the NO route in step S12), the pseudo data identification process ends. If there is unevaluated pseudo data remaining (see the YES route in step S12), the process proceeds to step S13.

[0113] In step S13, first confidence vector acquisition unit 107 selects one unevaluated piece of pseudo data from the plurality of pieces of pseudo data. First confidence vector acquisition unit 107 inputs the selected pseudo data into first class classification model A and performs inference to obtain a first confidence vector VA. The first confidence vector VA includes the confidence of the correct label.

[0114] In step S14, second confidence vector acquisition unit 108 obtains second confidence vector VB by inputting the pseudo data selected in step S13 into second class classification model B and performing inference. In the processing of step S14, as shown in Fig. 4, multiple second class classification models B1 and B2 may be prepared, and the second confidence vector VB may be obtained by exchanging (swapping) the pseudo data input to each second class classification model B1 and B2 between the training and evaluation cases.

[0115] In step S15, identification unit 110 determines whether the confidence level for the correct label in first confidence level vector VA is equal to or greater than a first reference value. If the confidence level for the correct label is equal to or greater than the first reference value (see the YES route from step S15), the process proceeds to step S16. On the other hand, if the confidence level for the correct label is less than the first reference value (see the NO route from step S15), the process proceeds to step S17.

[0116] In step S16, identification unit 110 determines whether the distance |VA-VB| between the first confidence vector VA and the second confidence vector VB is equal to or less than a second reference value. If the distance |VA-VB| is greater than the second reference value (see the NO route from step S16), the process proceeds to step S17. If the distance |VA-VB| is equal to or less than the second reference value (see the YES route from step S16), the process proceeds to step S18.

[0117] In step S17, identification unit 110 identifies the pseudo data as training data for third class classification model C, and the process returns to step S12. Therefore, the pseudo data is identified as training data when the confidence of the correct label of the first confidence vector VA is less than the first criterion, or when the confidence is equal to or greater than the first criterion but the distance |VA-VB| is greater than the second criterion.

[0118] In step S18, identification unit 110 excludes the corresponding pseudo data from the training data of third class classification model C, and the process returns to step S12. Therefore, if the confidence of the correct label of first confidence vector VA is equal to or greater than the first reference value and the distance |VA-VB| is equal to or less than the second reference value, the corresponding pseudo data is excluded from the training data.

[0119] 8 is a flowchart (steps S21 to S28) for explaining a second example of the method for specifying pseudo data in the information processing device 1 as an example of an embodiment. The flowchart shown in FIG. 8 is another example of the process of step S4 in FIG.

[0120] In FIG. 8, the processes of steps S21 to S24 are the same as the processes of steps S11 to S14 in FIG. 7, and the description of each process will be omitted.

[0121] In step S25, identification unit 110 determines whether the confidence level for the correct label in first confidence level vector VA is equal to or greater than a first reference value. If the confidence level for the correct label is less than the first reference value (see the NO route from step S25), the process proceeds to step S26. On the other hand, if the confidence level for the correct label is equal to or greater than the first reference value (see the YES route from step S25), the process proceeds to step S28.

[0122] In step S26, identification unit 110 determines whether the distance |VA-VB| between the first confidence vector VA and the second confidence vector VB is equal to or less than a second reference value. If the distance |VA-VB| is greater than the second reference value (see the NO route from step S26), the process proceeds to step S27. If the distance |VA-VB| is equal to or less than the second reference value (see the YES route from step S26), the process proceeds to step S28.

[0123] In step S27, identification unit 110 identifies the corresponding pseudo data as training data for third class classification model C, and the process returns to step S22. Therefore, if the confidence of the correct label of the first confidence vector VA is less than the first criterion and the distance |VA-VB| is greater than the second criterion value, the corresponding pseudo data is identified as training data.

[0124] In step S28, identification unit 110 excludes the corresponding pseudo data from the training data of third class classification model C, and the process returns to step S22. Therefore, if the confidence of the correct label of first confidence vector VA is equal to or greater than the first reference value, or if the distance |VA-VB| is equal to or less than the second reference value, the pseudo data is excluded from the training data.

[0125] Information constituting each of the first class classification model A, the second class classification model B, and the third class classification model C is stored in a predetermined storage area such as the storage device 13.

[0126] (C) Effects of one embodiment In one embodiment, a computer inputs a plurality of pseudo data sets into a first classification model A trained using basic data associated with correct labels, and acquires a confidence level of the correct label for each of the plurality of pseudo data sets. The computer then identifies pseudo data sets corresponding to confidence levels that are less than a first reference value. The computer then uses the identified pseudo data sets as training data to train a third classification model C, which is a new classification model.

[0127] According to the above method, the third-class classification model C is trained by removing spurious data that affect the robustness of membership estimation. This makes it possible to generate a machine learning model that is robust against membership estimation.

[0128] Furthermore, the basic data and the processed data are generated based on collected unprocessed raw data. The processed data is processed from the raw data to a greater extent than the basic data. Therefore, each of the multiple pseudo data is input to the first-class classification model A, which is trained using basic data that is closer to the raw data, so that the pseudo data that affect the membership estimation resistance can be effectively removed.

[0129] Furthermore, the information processing device 1 executes a process of inputting a plurality of pseudo data to the first class classification model A, thereby generating a first confidence vector VA for each of the plurality of pseudo data, the elements of which are the confidence of each of the plurality of labels that are the discrimination results. The information processing device 1 inputs two or more pseudo data #2 (second pseudo data) different from the pseudo data #1 to the second class classification model B1, which has been trained using two or more pseudo data #1 (first pseudo data) among the plurality of pseudo data. As a result, the information processing device 1 generates a second confidence vector VB for each of the two or more second processed data, the elements of which are the confidence of each of the plurality of labels that are the discrimination results. The information processing device 1 then executes a process of acquiring the distance |VA-VB| between the first confidence vector VA and the second confidence vector VB. The information processing device 1 executes a process of identifying, from the pseudo data, pseudo data for which the confidence of the correct label in the first confidence vector VA is equal to or greater than a first reference value and the distance is greater than a second reference value.

[0130] According to the above method, even if the confidence of the correct label of the first confidence vector VA becomes equal to or exceeds the first reference value due to some kind of noise or the like, the pseudo data can be identified as training data by examining the distance |VA-VB|.

[0131] Alternatively, pseudo data in which the confidence of the correct label in the first confidence vector V A is less than a first reference value and the distance |V A - V B| is greater than a second reference value may be identified as training data. In this case, pseudo data that affects the membership estimation robustness can be removed.

[0132] (D) Other The disclosed technology is not limited to the above-described embodiment, and various modifications can be made without departing from the spirit of the present embodiment. For example, the configurations and processes of the present embodiment can be selected or combined as needed. For example, in the above-described embodiment, pseudo data is used as training data and two second class classification models B1 and B2 are used, but this is not limited to this and three or more second class classification models B may be used. In this case as well, the switching unit 112 performs control so that the pseudo data input to each second class classification model B is different between the training phase and the evaluation phase. [Explanation of symbols]

[0133] 1. Information processing equipment 11 processors 12 Memory 13 Storage device 13a Model Training Program 14 Graphics Processing Unit 14a Monitor 15 Input Interface 15a keyboard 15b Mouse 16 Optical drive device 16a Optical disc 17 Device connection interface 17a Memory Device 17b Memory reader / writer 17c memory card 18 Network Interface 19 Bus 100 Training Processing Unit 100a Data selection section 101 Third Training Execution Department 102 Basic Data Acquisition Section 103 Pseudo Data Acquisition Unit 104 First Training Execution Department 105 2nd Training Execution Department 106 Specific training data generation unit 107 First confidence vector acquisition unit 108 Second confidence vector acquisition unit 109 Distance calculation unit 110 Specific section 111 Distribution Department 112 Switching section

Claims

1. a plurality of processed data items each associated with a correct label and each different from the basic data are input to a first classification model trained using basic data associated with the correct label, thereby obtaining a confidence level of the correct label for each of the plurality of processed data items; Identifying processed data corresponding to the confidence level that is less than a first reference value; The identified processed data is used as training data to train a new classification model. A model training method in which processing is performed by a computer.

2. the basic data and the processed data are generated based on collected unprocessed raw data; The model training method according to claim 1 , wherein the processed data is processed from the raw data to a greater extent than the basic data.

3. generating a first confidence vector, the elements of which are the confidences of a plurality of labels that are discrimination results, for each of the plurality of processed data by inputting the plurality of processed data into the first classification model; two or more pieces of second processed data different from the first processed data among the plurality of pieces of processed data are input to a second classification model trained using two or more pieces of first processed data among the plurality of pieces of processed data, thereby generating a second confidence vector having elements each representing a confidence of each of a plurality of labels that are discrimination results for each of the two or more pieces of second processed data; obtaining a distance between the first belief vector and the second belief vector; Among the two or more second processed data, the second processed data in which the confidence of the correct label of the first confidence vector is equal to or greater than the first reference value and the distance is greater than a second reference value is also identified as the training data for training the new class classification model; Training the new classification model using the identified training data. The method of claim 1 or 2, wherein the processing is performed by the computer.

4. generating a first confidence vector, the elements of which are the confidences of a plurality of labels that are discrimination results, for each of the plurality of processed data by inputting the plurality of processed data into the first classification model; two or more pieces of second processed data different from the first processed data among the plurality of pieces of processed data are input to a second classification model trained using two or more pieces of first processed data among the plurality of pieces of processed data, thereby generating a second confidence vector having elements each representing a confidence of each of a plurality of labels that are discrimination results for each of the two or more pieces of second processed data; obtaining a distance between the first belief vector and the second belief vector; Identifying, from among the two or more second processed data, the second processed data in which the confidence of the correct label of the first confidence vector is less than the first reference value and the distance is greater than a second reference value; training the new classification model using the identified second processed data as the training data; The method of claim 1 or 2, wherein the processing is performed by the computer.

5. a plurality of processed data items each associated with a correct label and each different from the basic data are input to a first classification model trained using basic data associated with the correct label, thereby obtaining a confidence level of the correct label for each of the plurality of processed data items; Identifying processed data corresponding to the confidence level that is less than a first reference value; The identified processed data is used as training data to train a new classification model. A model training program that runs the process on a computer.

6. a plurality of processed data items each associated with a correct label and each different from the basic data are input to a first classification model trained using basic data associated with the correct label, thereby obtaining a confidence level of the correct label for each of the plurality of processed data items; Identifying processed data corresponding to the confidence level that is less than a first reference value; The identified processed data is used as training data to train a new classification model. An information processing device comprising a control unit that executes processing.

Images