Calculation device, calculation method, and program

Abstract

Provided is a calculation device that calculates an evaluation value that can be used for identifying a machine learning model or the like. The calculation device comprises a calculation unit that for the mth input image data among M types of input image data, sets image data obtained by adding the a(n)th stage perturbation to the nth perturbation p(n) among N types of perturbations as Img(m,b(n,a(n))), applies A(n) pieces of image data to a machine learning model to be evaluated, and assuming that A(n) output values are obtained, calculates an evaluation value E(s,m,n), which is a value representing the degree to which the machine learning model model(s) is affected by the nth perturbation p(n) for the mth input image data Img(m) by using A(n) output values Out(s,m,b(n,a(n))), and a set of M×N evaluation values E(s,m,n) is defined as the evaluation value for the machine learning model model(s) to be evaluated.

Description

[Technical Field]

[0001] The present invention relates to a technique for identifying machine learning models. [Background technology]

[0002] Due to the large datasets required for AI training and concerns about data copyright and portrait rights, it is difficult for trainers to independently collect training data. Therefore, it is common for AI to be trained using data distributed online in advance. However, there are problems with this approach, such as the possibility that the training data available online may be contaminated by an adversary, preventing the AI ​​from learning with the intended data, or, conversely, that an adversary may gain access to important data, leading to data leaks. There is a growing demand for trainers to identify the data used by AI, and for data providers to identify AIs accessing data. Therefore, AI identification, including information on the learning architecture and training datasets, is becoming increasingly important.

[0003] Non-Patent Document 1 is known as a method for asserting the originality of AI by using the inference boundary of AI. Non-Patent Document 2 is known as a method for asserting the originality of AI by inserting a watermark by changing the parameters of AI. Furthermore, Non-Patent Document 3 is known as a method for identifying AI by using perturbed images. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong, "IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary". In Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security (ASIA CCS '21). Association for Computing Machinery, pp. 14 - 25. [Non-patent document 2] Y. Lao, P. Yang, W. Zhao and P. Li, "Identification for Deep Neural Network: Simply Adjusting Few Weights!", 2022 IEEE 38th International Conference on Data Engineering (ICDE), 2022, pp. 1328-1341. [Non-patent document 3] Naoto Kiribuchi, Ryohei Suzuki, Nami Ashizawa, Satoshi Oki, Hirofumi Mineno, and Masakatsu Nishigaki, "A Study on Authentication of Machine Learning Models," IEICE Technical Report, vol. 122, no. 50, SC2022-2, pp. 7-12, May 2022. Summary of the Invention [Problem to be solved by the invention]

[0005] However, because Non-Patent Documents 1 and 2 aim to assert the originality of AI, they have the problem of being unable to distinguish with high accuracy between AIs trained with the same model architecture and dataset. Furthermore, Non-Patent Document 2 requires the manipulation of AI parameters, so data providers must obtain permission from the AI ​​learner (both the owner and the rights holder) in order to use this technology. In Non-Patent Document 3, discrimination is performed by human eyes, and there is no evaluation value, so reliable and quantitative discrimination is not possible.

[0006] The present invention aims to provide a calculation device, a calculation method, and a program for calculating an evaluation value that can be used for identifying machine learning models, etc. [Means for solving the problem]

[0007] In order to solve the above problem, according to one aspect of the present invention, a calculation device, where m=1, 2, ..., M, n=1, 2, ..., N, a(n)=1, 2, ..., A(n), and s=1, 2, ..., S, performs the calculation by adding a perturbation of the a(n)th stage b(n, a(n)) of the nth perturbation p(n) of the N types of perturbations to the mth input image data Img(m) among M types of input image data, and defines Img(m, b(n, a(n))), and provides A(n) pieces of image data Img(m, b(n, 1)), Img(m, b(n, 2)), ..., Img(m, b(n, A(n))) to a machine learning model model(s) to be evaluated, and calculates A(n ) output values ​​Out(s,m,b(n,1)), Out(s,m,b(n,2)), ..., Out(s,m,b(n,A(n))) are obtained, and a calculation unit calculates an evaluation value E(s,m,n), which is a value representing the degree to which the machine learning model model(s) is affected by the n-th perturbation p(n) for the m-th input image data Img(m), using the A(n) output values ​​Out(s,m,b(n,1)), Out(s,m,b(n,2)), ..., Out(s,m,b(n,A(n))), and the set of M x N evaluation values ​​E(s,m,n) is used as the evaluation value for the machine learning model model(s) to be evaluated. [Effects of the Invention]

[0008] According to the present invention, it is possible to calculate an evaluation value that can be used for identifying machine learning models, etc., thereby achieving the effect of enabling quantitative identification. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a functional block diagram of a discrimination device according to a first embodiment. [Figure 2] FIG. 3 is a diagram showing an example of a processing flow of the identification device according to the first embodiment. [Figure 3] FIG. 10 is a diagram showing an example of the configuration of a computer to which the present technique is applied. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described. In the drawings used in the following description, components having the same functions and steps performing the same processing are denoted by the same reference numerals, and duplicated explanations will be omitted. In the following description, processing performed on each element of a vector or matrix is ​​assumed to apply to all elements of that vector or matrix, unless otherwise specified.

[0011] First Embodiment FIG. 1 is a functional block diagram of a discrimination device according to a first embodiment, and FIG. 2 shows the processing flow thereof.

[0012] The identification device includes a perturbation applying unit 110, a machine learning model applying unit 120, a calculating unit 130, and an identifying unit 140.

[0013] The classification device receives M types of input image data Img(m), applies perturbations to the input image data Img(m) to generate image data Img(m, b(n, a(n))), provides the image data Img(m, b(n, a(n))) to S machine learning models model(s), obtains output values ​​Out(s, m, b(n, a(n))) from the machine learning models model(s), classifies whether a certain machine learning model model(t) and another machine learning model model(u) are the same machine learning model, and outputs a classification result. Let m = 1, 2, ..., M, n = 1, 2, ..., N, a(n) = 1, 2, ..., A(n), s = 1, 2, ..., S, t is 1, 2, ..., S, u is 1, 2, ..., S, and t ≠ u.

[0014] The identification device is a special device configured by loading a special program into a publicly known or dedicated computer having, for example, a central processing unit (CPU) and a main memory (RAM). The identification device executes each process under the control of, for example, the central processing unit. Data input to the identification device and data obtained from each process are stored in, for example, the main memory, and the data stored in the main memory is read by the central processing unit as needed and used for other processes. At least a portion of each processing unit of the identification device may be configured with hardware such as an integrated circuit. Each storage unit included in the identification device may be configured with, for example, a main memory such as a RAM (Random Access Memory) or middleware such as a relational database or a key-value store. However, each storage unit does not necessarily have to be included inside the identification device. It may be configured with an auxiliary storage device including a hard disk, optical disk, or semiconductor memory element such as a flash memory, and be configured external to the identification device.

[0015] Each part will be explained below.

[0016] <Perturbation applying unit 110> The perturbation applying unit 110 receives M types of input image data Img(m), applies perturbations to the input image data Img(m) (S110), and generates and outputs perturbed image data Img(m, b(n, a(n))). The number of types of perturbations is N, where n is an index representing the type of perturbation. The term "perturbation" refers to a "shift." In this embodiment, "adding a perturbation" refers to gradually shifting various values ​​of the input image data Img(m). Possible types of perturbations include Gaussian blur, rotation, resizing, exposure, JPEG compression, motion blur, brightness, saturation, luminosity, speckle noise, and vignette effect. Furthermore, each perturbation p(n) has A(n) levels. The image data obtained by adding a perturbation of the a(n)th level b(n, a(n)) to the mth input image data Img(m) is called Img(m, b(n, a(n))).

[0017] For example, when performing Gaussian blurring to add perturbation, the standard deviation σ is varied from 1 to 10 in increments of 1, and 10 pieces of image data with different blur strengths are generated from one piece of input image data Img(m). The strength of the blur corresponds to the level.

[0018] Furthermore, for example, when changing brightness by gamma correction to add perturbation, the brightness (luminance) range of the input image data Img(m) is scaled to a value between 0 and 100, and 19 pieces of image data are generated with brightness values ​​ranging from 5 to 95 in increments of 5. The brightness corresponds to the steps.

[0019] In this way, A(n) images are generated from the input image data Img(m) for each perturbation p(n),

number

number

[0020] The number and types of perturbations may be manually applied, or R(>N) types of perturbations may be prepared in advance and N types of perturbations may be selected randomly or appropriately in accordance with the machine learning model. The value of each stage of perturbation may be manually applied, or may be calculated by the classification device depending on the range of perturbation possible, the stage width, and the number of stages. The stage width does not necessarily have to be equal intervals and may be changed appropriately in accordance with the machine learning model.

[0021] <Machine Learning Model Application Unit 120> The machine learning model application unit 120 receives Q pieces of image data Img(m, b(n, a(n))), provides the Q pieces of image data Img(m, b(n, a(n))) to the machine learning model model(s) to be evaluated, and obtains Q output values ​​Out(s, m, b(n, a(n))) (S120). The same process is performed on S machine learning models model(s) to be evaluated, and S × Q output values ​​Out(s, m, b(n, a(n))) are obtained and output.

[0022] The machine learning model model(s) to be evaluated may be prepared inside the classification device or externally. When prepared externally, the machine learning model application unit 120 only needs to have a function to provide image data Img(m, b(n, a(n))) as input to the external machine learning model model(s) via a communication line or the like, and a function to receive output values ​​Out(s, m, b(n, a(n))).

[0023] A machine learning model is a model that takes image data as input, performs some processing, and outputs the processing results; it is a model that has been fully trained through machine learning. For example, the processing of a machine learning model can be various processes that use image data as input, such as image recognition including facial recognition (processing to identify objects and features in images or videos), position detection (processing to detect the position (coordinate values, etc.) of an object in an image or video), and image processing (general processing such as transforming an image, changing its color, combining it with another image, or extracting some information from an image). Possible processing results include recognition results, detection results, confidence levels, and images after image processing. The output value Out(s, m, b(n, a(n))) may consist of a single value, or may be a vector or matrix containing multiple values ​​as elements.

[0024] <Calculation unit 130> The calculation unit 130 receives S×Q output values ​​Out(s,m,b(n,a(n))) as input, and calculates an evaluation value E(s,m,n), which represents the degree to which the machine learning model model(s) is affected by the nth perturbation p(n) for the mth input image data Img(m), using the A(n) output values ​​Out(s,m,b(n,1)), Out(s,m,b(n,2)), ..., Out(s,m,b(n,A(n))) obtained by providing A(n) image data Img(m,b(n,1)), Img(m,b(n,2)), ..., Img(m,b(n,A(n))) to a machine learning model model(s) to be evaluated (S130), and outputs S×M×N evaluation values ​​E(s,m,n).

[0025] For example, using sensitivity analysis (Reference 1), an evaluation value E(s,m,n) is calculated from A(n) output values ​​Out(s,m,b(n,1)), Out(s,m,b(n,2)), ..., Out(s,m,b(n,A(n))), which represents the degree to which the machine learning model model(s) is affected by the nth perturbation p(n) for the mth input image data Img(m).

[0026] (Reference 1): Joshi, Aparna R., et al., "Fair SA: Sensitivity Analysis for Fairness in Face Recognition", Algorithmic Fairness through the Lens of Causality and Robustness workshop, PMLR, 2022. Sensitive analysis can obtain an index for measuring the fairness of a model for sensitive attributes such as race and gender. In this embodiment, the index for measuring the fairness of this model is used as a value representing the degree to which the machine learning model model(s) is affected by the nth perturbation p(n) for the mth input image data Img(m). The more fair the index for measuring the fairness of the model indicates, the higher the tolerance for deviations and the smaller the degree of influence. Conversely, the more unfair the index for measuring the fairness of the model indicates, the lower the tolerance for deviations and the larger the degree of influence.

[0027] The M×N evaluation values ​​E(s, m, n) for each machine learning model model(s) can be expressed as a matrix, for example, as follows:

number

[0028] In this embodiment, the evaluation value E(s, m, n) is calculated using sensitive analysis, but the evaluation value may be calculated using any method as long as it can calculate a value that represents the degree of influence of perturbation. <Identification unit 140> The discrimination unit 140 receives the S×M×N evaluation values ​​E(s,m,n), and calculates the sum of the differences |E(t,m,n)-E(u,m,n)| between the M×N evaluation values ​​E(t,m,n) for a certain machine learning model model(t) and the M×N evaluation values ​​E(u,m,n) for another machine learning model model(u).

number

[0029] <Effects> With the above configuration, it is possible to quantitatively identify machine learning models with high accuracy by comparing the fingerprints of various machine learning models, and other uses such as identifying machine learning models, similar to human fingerprints, are also possible.

[0030] <Modification> In this embodiment, the calculation unit 130 is part of the identification device, but it may also function as a calculation device consisting of only the calculation unit 130. In this case, the perturbation adding unit 110 and the machine learning model application unit 120 are performed by an external device, and the output values ​​of the external device (S×Q output values ​​Out(s,m,b(n,a(n))))) are input to the calculation device. The calculation device calculates and outputs S×M×N evaluation values ​​E(s,m,n). The set of M×N evaluation values ​​E(s,m,n) becomes the evaluation value for the machine learning model model(s) to be evaluated. As described above, the calculated evaluation value can be used for machine learning models, classification, and identification.

[0031] <Other variations> The present invention is not limited to the above-described embodiments and modifications. For example, the various processes described above may not only be executed in chronological order as described, but may also be executed in parallel or individually depending on the processing capabilities of the devices that execute the processes or as needed. Other modifications are possible within the scope of the present invention.

[0032] <Programs and recording media> The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 3, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0033] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0034] The program may be distributed, for example, by selling, transferring, lending, etc. a portable recording medium such as a DVD or CD-ROM on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to another computer via a network, thereby distributing the program.

[0035] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with each program transferred from the server computer. Alternatively, the server computer may not transfer the program to the computer, but may execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. In this embodiment, the program includes information used for processing by a computer that is equivalent to a program (such as data that is not a direct instruction to the computer but has properties that define computer processing).

[0036] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

Claims

1. Let m = 1, 2, ..., M, n = 1, 2, ..., N, a(n) = 1, 2, ..., A(n), s = 1, 2, ..., S. Let Img(m, b(n, a(n))) be the image data to which the mth input image data Img(m) among M types of input image data has been subjected to the a(n)th stage b(n, a(n)) perturbation of the nth perturbation p(n) among N types of perturbations. A(n) pieces of image data Img(m, b(n, 1)), Img(m, b(n, 2)), ..., Img(m, b(n, A(n))) are given to the machine learning model model(s) to be evaluated, and A(n) output values ​​Out(s, m, b(n, 1)), Out(s, m, b(n, 2)), ..., Out(s, m, b(n, A(n))) are obtained. a calculation unit that calculates an evaluation value E(s,m,n) that is a value representing the degree to which the machine learning model model(s) is affected by the n-th perturbation p(n) for the m-th input image data Img(m) using A(n) output values ​​Out(s,m,b(n,1)), Out(s,m,b(n,2)), ..., Out(s,m,b(n,A(n))); A set of M × N evaluation values ​​E(s, m, n) is defined as the evaluation value for the machine learning model model(s) to be evaluated. Calculation device.

2. 2. The calculation device of claim 1, an identification unit that identifies a machine learning model based on the magnitude relationship between the sum of M×N evaluation values ​​E(t,m,n) for a certain machine learning model model(t) and M×N evaluation values ​​E(u,m,n) for another machine learning model model(u), |E(t,m,n)-E(u,m,n)|, and a predetermined threshold ε, where t is any of 1, 2, ..., S, u is any of 1, 2, ..., S, and t≠u; Calculation device.

3. 2. The calculation device of claim 1, a perturbation applying unit that applies a perturbation of the a(n)th stage b(n,a(n)) of the perturbation p(n) to the input image data Img(m) to generate image data Img(m,b(n,a(n))); and a machine learning model application unit that applies the image data Img(m, b(n, a(n))) to the machine learning model model(s) and obtains an output value Out(s, m, b(n, a(n))). Calculation device.

4. Let m = 1, 2, ..., M, n = 1, 2, ..., N, a(n) = 1, 2, ..., A(n), s = 1, 2, ..., S. Let Img(m, b(n, a(n))) be the image data to which the mth input image data Img(m) among M types of input image data has been subjected to the a(n)th stage b(n, a(n)) perturbation of the nth perturbation p(n) among N types of perturbations. A(n) pieces of image data Img(m, b(n, 1)), Img(m, b(n, 2)), ..., Img(m, b(n, A(n))) are given to the machine learning model model(s) to be evaluated, and A(n) output values ​​Out(s, m, b(n, 1)), Out(s, m, b(n, 2)), ..., Out(s, m, b(n, A(n))) are obtained. a calculation step of calculating an evaluation value E(s,m,n) which is a value representing the degree to which the machine learning model model(s) is affected by the n-th perturbation p(n) for the m-th input image data Img(m) using A(n) output values ​​Out(s,m,b(n,1)), Out(s,m,b(n,2)), ..., Out(s,m,b(n,A(n))); A set of M × N evaluation values ​​E(s, m, n) is defined as the evaluation value for the machine learning model model(s) to be evaluated. Calculation method.

5. A program for causing a computer to function as the calculation device according to any one of claims 1 to 3.

Images