Learning systems, learning methods, and programs

Abstract

To provide a learning system, a learning method, and a program that can prevent the leakage of data used for machine learning.SOLUTION: A learning system 100 according to an embodiment of the present disclosure includes a plurality of client terminals 110 and a server 120. Each client terminal 110 learns weight coefficients of a model and transmits the inner product of a vector consisting of the weight coefficients and a key vector to the server 120. The server 120 optimizes the weight coefficients of a machine learning model based on the inner product received from each of the plurality of client terminals 110.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] This disclosure relates to learning systems, learning methods, and programs. [Background technology]

[0002] A federated learning system has been proposed in which a server and multiple client terminals cooperate to perform learning (see, for example, Patent Document 1). In this federated learning system, each client terminal learns the weight coefficients of a machine learning model and sends them to the server. The server updates the weight coefficients of the machine learning model based on the weight coefficients received from each of the multiple client terminals. The server then distributes the updated weight coefficients to the multiple client terminals. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2019-028656 [Overview of the project] [Problems that the invention aims to solve]

[0004] The applicant has identified the following problems: It has been pointed out that images used for training (e.g., images from within the home) may be reconstructed based on the weight coefficients. Therefore, directly transmitting the weight coefficients is problematic from a privacy protection standpoint. Furthermore, in the case of large models with high performance configurations, there is a problem that transmitting the weight coefficients is burdensome. In addition, it has been pointed out that malicious users may degrade the performance of the model.

[0005] This disclosure was made in light of these issues and aims to realize a learning system, learning method, and program that can prevent the leakage of data used in machine learning. [Means for solving the problem]

[0006] One aspect of the learning system of this disclosure is a learning system comprising a plurality of client terminals and a server, Each client terminal The machine learning model learns the weight coefficients, and sends the dot product of the vector consisting of the weight coefficients and the key vector to the server. The aforementioned server, The weight coefficients of the machine learning model are optimized based on the dot product received from each of the aforementioned client terminals.

[0007] A learning method in one aspect of this disclosure is: Each client terminal learns the weight coefficients of the machine learning model and sends the dot product of the vector consisting of the weight coefficients and the key vector to the server. The server optimizes the weights of the machine learning model based on the dot product received from each of the multiple client terminals. Includes.

[0008] A program in one aspect of this disclosure is On the computer, The process involves receiving the dot product of the weight coefficients vector of the machine learning model and the key vector from each client terminal, A process to optimize the weight coefficients of the machine learning model based on the dot product received from each of the multiple client terminals, Make it run. [Effects of the Invention]

[0009] According to this disclosure, it is possible to realize a learning system, learning method, and program that can prevent the leakage of data used for machine learning. [Brief explanation of the drawing]

[0010] [Figure 1] This diagram illustrates the configuration of the learning system according to Embodiment 1. [Figure 2] This figure illustrates the verification results of the operation of the learning system according to Embodiment 1. [Figure 3]This is a diagram for explaining the verification results of the operation of the learning system according to Embodiment 1. [Figure 4] This is a diagram for explaining the verification results when robust regression is used in the learning system according to Embodiment 1. [Figure 5] This is a diagram for explaining the verification results when robust regression is used in the learning system according to Embodiment 1. [Figure 6] This is a diagram for explaining the verification results when lasso regression is used in the learning system according to Embodiment 1.

Modes for Carrying Out the Invention

[0011] Hereinafter, specific embodiments to which the present disclosure is applied will be described in detail with reference to the drawings. However, the present disclosure is not limited to the following embodiments. Also, for clarity of explanation, the following description and drawings are simplified as appropriate.

[0012] Background Leading to the Present Disclosure First, referring to FIG. 1, the flow of a general federated learning method will be described. The learning system 100 shown in FIG. 1 includes client terminals 110_1, client terminals 110_2, client terminals 110_3, and a server 120. The client terminals 110_1, client terminals 110_2, client terminals 110_3, and the server 120 are connected to be communicable with each other via a network N.

[0013] The client terminal 110_1 is arranged in the house 10_1, the client terminal 110_2 is arranged in the house 10_2, and the client terminal 110_3 is arranged in the house 10_3. When the houses 10_1, 10_2, and 10_3 are not distinguished from each other, they are referred to as the house 10. When the client terminals 110_1, 110_2, and 110_3 are not distinguished from each other, they are referred to as the client terminal 110.

[0014] First, server 120 trains a machine learning model (for example, a model for object recognition) using images collected from the web and images generated from a 3D model (also called a simulator). Then, server 120 distributes the initial values ​​of the machine learning model's weight coefficients to client terminals 110_1, 110_2, and 110_3.

[0015] Next, client terminal 110_1 collects training data 20_1 at house 10_1, client terminal 110_2 collects training data 20_2 at house 10_2, and client terminal 110_3 collects training data 20_3 at house 10_3. When training data 20_1, 20_2, and 20_3 are not distinguished from each other, they are referred to as training data 20.

[0016] Next, client terminal 110_1 updates the weight coefficients of the machine learning model with training data 20_1, client terminal 110_2 updates the weight coefficients of the machine learning model with training data 20_2, and client terminal 110_3 updates the weight coefficients of the machine learning model with training data 20_3. Then, each client terminal 110 sends the weight coefficients of the trained machine learning model to server 120.

[0017] Next, the server 120 updates the weight coefficients of the machine learning model based on the weight coefficients received from client terminal 110_1, client terminal 110_2, and client terminal 110_3. The server 120 may also calculate the average value of the received weight coefficients and use that as the new weight coefficient.

[0018] Next, server 120 distributes the updated machine learning model's weight coefficients to client terminals 110_1, 110_2, and 110_3. Then, client terminal 110 returns to the process of collecting training data 20.

[0019] In typical federative learning methods, the client terminal 110 transmits the weight coefficients of the machine learning model, rather than the training data 20. This reduces the risk of the training data 20 being leaked. However, it is known that the images used for training can be reconstructed from the weight coefficients. Furthermore, for high-performance models, there is a problem in that transmitting the weight coefficients is computationally intensive. Moreover, if a malicious user participates in the federative learning, the performance of the machine learning model may deteriorate. The inventors of this application arrived at the learning system according to Embodiment 1 based on the above circumstances.

[0020] Embodiment 1 The learning system according to Embodiment 1 will now be described with reference to the drawings. First, an overview of the learning system 100 according to Embodiment 1 will be described with reference to Figure 1.

[0021] Figure 1 shows a case where there are three client terminals 110, but the number of client terminals 110 may be two, four or more. The client terminals 110 may be a combination of a camera and a PC, or they may be robots.

[0022] The client terminal 110 and server 120 each include a processing unit such as a CPU (Central Processing Unit) and a storage unit such as RAM (Random Access Memory) and ROM (Read Only Memory) that store various control programs and data. In other words, the client terminal 110 and server 120 have the functionality of a computer and perform processing based on the various control programs mentioned above.

[0023] Next, the operation of the learning system 100 will be explained. In the learning system 100, first, client terminals 110_1, 110_2, and 110_3 learn matrices W1, W2, and W3, which represent the weight coefficients of the machine learning model, using the collected training data 20_1, 20_2, and 20_3. When matrices W1, W2, and W3 are not distinguished from each other, they are called matrix W. Each column vector in matrix W1 is called vector w1, each column vector in matrix W2 is called vector w2, and each column vector in matrix W3 is called vector w3. When vectors w1, w2, and w3 are not distinguished from each other, they are called vector w. Vector w consists of the weight coefficients of the machine learning model.

[0024] The training data 20 includes, for example, images useful for machine learning and annotations indicating the objects depicted in those images. The client terminal 110 may present the images to the user and determine the annotations according to the user's response. The annotations may also be determined according to the user's actions and reactions. The images may be captured by cameras or robots installed inside the house 10. Note that the machine learning model is not limited to an object recognition model.

[0025] Next, client terminal 110_1 generates key vector v1, client terminal 110_2 generates key vector v2, and client terminal 110_3 generates key vector v3. When vectors v1, v2, and v3 are indistinguishable from each other, they are called key vector v. The number of components of key vector v is assumed to be the same as the number of components of vector w. For example, if v is an n-dimensional vector, then v = [v1, v2, ..., v n It is expressed as ].

[0026] Client terminal 110_1 calculates the dot product y1 of vector w1 and key vector v1. Client terminal 110_2 calculates the dot product y2 of vector w2 and key vector v2. Client terminal 110_3 calculates the dot product y3 of vector w3 and key vector v3. When the dot products y1, y2, and y3 are not distinguished from each other, they are called the dot product y.

[0027] Since the vector w exists as many as the number of columns of the matrix W, the inner product y exists as many as the number of columns of the matrix W. A vector formed by arranging a plurality of inner products y is called an inner product vector Y. Let the l-th (l represents the alphabetical letter l) column vector of the matrix W be W l and represent the calculation result of the l-th inner product as Y l Then, Y l =<W l ,v>=W l1 ·v1 + W l2 ·v2 + ···. Note that W lj represents the j-th element of W l .

[0028] By the way, when a and b are n-dimensional vectors, the inner product c is given by c = <a, b> = a1·b1 + a2·b2 + ··· + a n ·b n . a j represents the j-th element of the vector a, and b j represents the j-th element of the vector b. There is a feature that even if the inner product c and the vector a are given, the vector b is not uniquely determined. For example, when a = [1, 1, 1, 1, 1] and c = [1], the vector b that satisfies c = <a, b> cannot be uniquely determined. Furthermore, the dimension of the inner product c is smaller than the dimension of the vector a and the dimension of the vector b.

[0029] Therefore, it can also be considered that the inner product y is data obtained by compressing the vector w with the key vector v. The client terminal 110 compresses a plurality of column vectors included in the matrix W with the key vector v.

[0030] Next, the client terminal 110_1 transmits the key vector v1 and the inner product vector Y1 to the server 120. The client terminal 110_2 transmits the key vector v2 and the inner product vector Y2 to the server 120. The client terminal 110_3 transmits the key vector v^{3} and the inner product vector Y3 to the server 120.

[0031] The client terminal 110 compresses multiple column vectors contained in matrix W. Typically, the sum of the data size of the key vector v and the data size of the dot product vector Y is smaller than the data size of matrix W.

[0032] Next, server 120 optimizes the weight coefficients of the machine learning model based on the dot product vectors Y1-Y3 and key vectors v1-v3. Specifically, server 120 defines a model in which the dot product vector Y is explained by the key vector v as Y=W T Let v be the optimal matrix W, and estimate it. Matrix W T This represents the transpose of matrix W.

[0033] The learning system 100 optimizes the weight coefficients of the machine learning model by performing linear regression with the key vector v as the independent variable and the inner product vector Y as the dependent variable. When performing regression analysis, the least squares method, robust regression, or Lasso regression may be used. When the least squares method is used, the server 120 calculates the weight coefficients to minimize the loss function L shown in equation (1). Matrix W ~ represents the optimized matrix W representing the weight coefficients. Y represents the matrix formed by arranging the inner product vectors Y1, Y2, and Y3. V represents the matrix formed by arranging the key vectors v1, v2, and v3.

number

[0034] Furthermore, if server 120 uses robust regression, it can suppress the degradation of machine learning model performance due to attacks from malicious users. If server 120 uses Lasso regression, it can reduce unnecessary weight coefficients, thereby significantly reducing communication load.

[0035] If there is only one client terminal 110, and only client terminal 110_1 exists, then the l-th element of the dot product vector Y1 is Y1 l And from key vector v1, Y1 l =W l1 ·v11+W l2We must estimate W that satisfies ·v12+···. However, from the properties of the dot product, the dot product Y1 l It is not possible to uniquely determine W from the key vector v1 alone. The learning system 100 assumes the existence of multiple client terminals 110. The server 120 only needs to decode a single W from the inner product calculated by the multiple client terminals 110.

[0036] The learning system 100 considers the above process as one round (called a Communication Round), and progresses through learning by repeating rounds.

[0037] In the learning system 100, each client terminal 110 transmits the dot product and key vector, rather than the weight coefficients of the machine learning model. Even if the dot product and key vector are intercepted, it is not possible to uniquely determine the weight coefficients of the machine learning model, thus enhancing the protection of the privacy of users participating in federated learning.

[0038] Furthermore, the sum of the data size of the dot product and the data size of the key vector is smaller than the data size of the matrix representing the weight coefficients. Therefore, the learning system 100 can reduce the communication load.

[0039] Figure 1 illustrates the case where the client terminal 110 generates the key vector. However, the server 120 may generate the key vector v and distribute it to the client terminal 110. In this case, the client terminal 110 does not need to send the key vector when sending the dot product.

[0040] Next, the verification results of the operation of the learning system 100 will be explained with reference to Figures 2 and 3. In Figure 2, a Convolutional Neural Network (CNN) was used as the machine learning model. The CIFAR (Canadian Institute for Advanced Research)-10 dataset was used. The weight coefficients of the machine learning model were estimated using the least squares method. The horizontal axis shows the number of rounds, and the vertical axis shows the accuracy.

[0041] The accuracy rate when using Embodiment 1 is shown by the dotted line. Graphs 31, 32, 33, and 34 show the accuracy rates when the number of client terminals 110 is 1, 30, 50, and 100.

[0042] The accuracy rate using the conventional technology is shown by the solid line. In the conventional technology, the average of the weight coefficients was used as the new weight coefficient. Graphs 41, 42, 43, and 44 show the accuracy rates when the number of client terminals 110 is 1, 30, 50, and 100. Graphs 42, 43, and 44 almost overlap.

[0043] Referring to Figure 2, the accuracy rate is low when the number of client terminals 110 is small, but high when the number of client terminals 110 is large. When the number of client terminals 110 is large, a highly accurate machine learning model can be obtained. As the number of client terminals 110 increases, the accuracy rate in Embodiment 1 approaches the accuracy rate (baseline) of the conventional technology.

[0044] Figure 3 shows the verification results when using a multilayer perceptron (MLP) as a machine learning model. The MNIST (Modified National Institute of Standards and Technology) dataset was used.

[0045] The accuracy rate when using Embodiment 1 is shown by the dotted line. Graphs 51, 52, 53, and 54 show the accuracy rates when the number of client terminals 110 is 1, 30, 50, and 100.

[0046] The accuracy rate when using conventional technology is shown by the solid line. Graphs 61, 62, 63, and 64 show the accuracy rate when using conventional technology. Graphs 61, 62, 63, and 64 show the accuracy rate when the number of client terminals 110 is 1, 30, 50, and 100. Graphs 62, 63, and 64 almost overlap.

[0047] Similar to Figure 2, it can be seen that a machine learning model with higher accuracy can be obtained as the number of client terminals 110 increases. Embodiment 1 is also effective when the machine learning model is a multilayer perceptron.

[0048] Next, we will discuss the use of robust regression, referring to Figures 4 and 5. Robust regression is robust against attacks that degrade the performance of machine learning models. Robust regression uses Huber loss.

[0049] Figure 4 shows the verification results when CIFAR is used as the dataset. Graphs 71-73 show the accuracy when the number of malicious clients is 1. Graphs 71-73 show the accuracy when using conventional technology, when using L2 loss as the loss, and when using Huber loss as the loss.

[0050] Graphs 74-76 show the accuracy when the number of malicious clients is 5. Graphs 74-76 show the accuracy when using conventional technology, when using L2 loss as the loss, and when using Huber loss as the loss.

[0051] Figure 5 shows the verification results when MNIST is used as the dataset. Graphs 81-83 show the accuracy when the number of malicious clients is 1. Graphs 81-83 show the accuracy when using conventional technology, when using L2 loss as the loss function, and when using Huber loss as the loss function.

[0052] Graphs 84-86 show the accuracy when the number of malicious clients is 5. Graphs 84-86 show the accuracy when using conventional technology, when using L2 loss as the loss, and when using Huber loss as the loss.

[0053] Referring to Figures 4 and 5, the performance of machine learning models is degraded by attacks when using conventional techniques or L1 loss. When using Huber loss, i.e., robust regression, the machine learning model is robust against attacks from malicious clients.

[0054] Next, with reference to Figure 6, we will explain the case using Lasso regression. The first column of Table 90 indicates whether the prior art is used or Embodiment 1 is used. The second column indicates whether Lasso regression is performed on the client side and the server side. "Yes" indicates that Lasso regression is performed, and "No" indicates that Lasso regression is not performed. In Lasso regression, the L1 loss is used as the loss. The third and fourth columns represent the error rate and sparsity.

[0055] The first and second rows show the error rate and sparsity when using conventional technology. The first row represents the case where lasso regression is not performed on client terminal 110, and the second row represents the case where lasso regression is performed on client terminal 110. Note that in conventional technology, the server does not estimate the weight coefficients, so the server side is shown as "No".

[0056] The third, fourth, fifth, and sixth lines show the verification results when using Embodiment 1. The third line represents the case where neither the client terminal 110 nor the server 120 performs Lasso regression. The fourth line represents the case where the client terminal 110 performs Lasso regression and the server 120 does not. The fifth line represents the case where the client terminal 110 does not perform Lasso regression and the server 120 does. The sixth line represents the case where both the client terminal 110 and the server 120 perform Lasso regression.

[0057] Referring to Figure 6, we can see that server 120 has high sparsity when using Lasso regression, indicating that the machine learning model can be made sparse.

[0058] The program described above includes a set of instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions. The program may be stored on a non-temporary computer-readable medium or a physical storage medium. Examples, but not limited to, include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, CD-ROM, digital versatile disc (DVD), Blu-ray® disc or other optical disc storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices. The program may be transmitted over a temporary computer-readable medium or a communication medium. Examples, but not limited to, include temporary computer-readable medium or a communication medium that includes electrically, optically, acoustically or otherwise propagating signals.

[0059] This disclosure is not limited to the embodiments described above, and may be modified as appropriate without departing from its spirit. [Explanation of symbols]

[0060] 100 Learning Systems 110, 110_1, 110_2, 110_3 client terminals 120 servers 10, 10_1, 10_2, 10_3 Houses 20, 20_1, 20_2, 20_3 Training data Graphs for 31-34, 41-44, 51-54, 61-64, 71-76, and 81-86. 90 tables

Claims

1. A learning system comprising multiple client terminals and a server, Each client terminal The machine learning model learns the weight coefficients, and sends the dot product of the vector consisting of the weight coefficients and the key vector to the server. The aforementioned server, Based on the dot product received from each of the aforementioned client terminals, the weight coefficients of the machine learning model are optimized. The aforementioned server, The weight coefficients of the machine learning model are optimized by performing a linear regression with the key vector as the independent variable and the inner product as the dependent variable. Learning system.

2. The server performs robust regression or lasso regression. The learning system according to claim 1.

3. Each client terminal learns the weight coefficients of the machine learning model and sends the dot product of the vector consisting of the weight coefficients and the key vector to the server. The server optimizes the weight coefficients of the machine learning model based on the dot products received from each of the multiple client terminals. Includes, The aforementioned optimization step is: The weight coefficients of the machine learning model are optimized by performing a linear regression with the key vector as the independent variable and the inner product as the dependent variable. Learning methods.

4. On the computer, The process involves receiving the dot product of the weight coefficients vector of the machine learning model and the key vector from each client terminal, A process to optimize the weight coefficients of the machine learning model based on the dot product received from each of the multiple client terminals, Make it run, The aforementioned optimization process is: The weight coefficients of the machine learning model are optimized by performing a linear regression with the key vector as the independent variable and the inner product as the dependent variable. program.

Images