Learning device, data generation device, learning method, and learning program
The data generation device uses supervised contrastive learning and adjusted loss functions to generate fair and privacy-protected synthetic data, addressing accuracy and privacy challenges in adversarial networks.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Patents
- Current Assignee / Owner
- KDDI CORP
- Filing Date
- 2023-03-15
- Publication Date
- 2026-05-12
AI Technical Summary
Existing methods for generating fair synthetic data using adversarial networks face challenges in maintaining accuracy and reducing privacy risks, as they either require significant noise addition or dataset splitting, leading to reduced accuracy and increased attack success rates.
A data generation device utilizing a generator and multiple headers within a generative adversarial network, employing supervised contrastive learning to diversify training data and adjust loss functions based on data attributes, ensuring fair and privacy-conscious synthetic data generation.
The solution enables the output of synthetic data with improved accuracy and fairness while suppressing privacy risks, enhancing the robustness of AI systems against membership inference attacks.
Smart Images
Figure 0007857244000008 
Figure 0007857244000009 
Figure 0007857244000010
Abstract
Description
Technical Field
[0001] The present invention relates to a fair data generation method using an adversarial generation network.
Background Art
[0002] Conventionally, for the purpose of fair decision-making by AI (Artificial Intelligence), an adversarial generation network is used to make the distribution of data with sensitive attributes (for example, female image data) the same as the distribution of data with non-sensitive attributes (other image data), that is, indistinguishable. An attempt has been made to train a generator so that synthetic data output by the generator is used to construct a fair AI (for example, a classifier) (see, for example, Non-Patent Document 1). When a classifier is constructed using fair synthetic data as training data, this classifier can make inferences regardless of sensitive attributes.
[0003] However, it is known that when an AI is constructed with consideration for fairness, a membership inference attack that estimates training data from its output becomes easy (see, for example, Non-Patent Document 2). In this case, it has been pointed out that, in particular, the attack success probability for training data with specific attributes increases significantly.
[0004] In addition, although Non-Patent Document 2 analyzes the privacy risk of fair AI for classifiers, it is known that a membership inference attack can also be applied to an adversarial generation network. In a membership inference attack against an adversarial generation network, training data used for learning the generator is estimated from the similarity between synthetic data output by the generator learned using the adversarial generation network and given data. As countermeasures against a membership inference attack on an adversarial generation network, there are methods using differential privacy and a method called PrivGAN that divides a set of training data into multiple datasets and adds constraints so as not to depend on individual datasets to generalize the generator (see, for example, Non-Patent Document 3). [Prior art documents] [Non-patent literature]
[0005] [Non-Patent Document 1] Xu et al., FairGAN: Fairness-aware Generative Adversarial Networks, IEEE Big Data 2018. [Non-Patent Document 2] Chang et al., On the Privacy Risks of Algorithmic Fairness, EuroSP 2021. [Non-Patent Document 3] Mukherjee et al., PrivGAN: Protecting GANs from Membership Inference Attacks at Low Cost, PETS 2021. [Non-Patent Document 4] Jeong et al., Training GANs with Stronger Augmentations via Contrastive Discriminator, ICLR 2021. [Overview of the project] [Problems that the invention aims to solve]
[0006] However, methods using differential privacy require adding a large amount of noise to the training data to ensure security, which significantly reduces the accuracy of the AI. Furthermore, PrivGAN, by splitting the dataset, reduces the size of individual datasets, making it unsuitable for training generative adversarial networks, which generally require large datasets. Furthermore, because these methods do not target fair, generative adversarial networks, they may not be able to prevent the problem of increased attack success rates for specific attributes.
[0007] Furthermore, for example, Non-Patent Document 4 proposes a technique to improve the accuracy of classifiers using generative adversarial networks with unsupervised controlled learning, but this does not generate fair data and could not be expected to reduce privacy risks.
[0008] The present invention aims to provide a data generation device that can output synthetic data with improved accuracy and fairness of AI while suppressing the increase in privacy risks. [Means for solving the problem]
[0009] The learning device according to the present invention comprises a generator that outputs synthetic data similar to training data based on noise; an encoder that acquires feature representations from data augmentation of the training data or the synthetic data; a first header that converts the feature representations corresponding to the training data into inputs to a first loss function for distinguishing between data with sensitive attributes and data with non-sensitive attributes by supervised comparative learning; a second header that converts the feature representations corresponding to the training data and the synthetic data into inputs to a second loss function for distinguishing between the training data and the synthetic data by supervised comparative learning; a third header that converts the feature representations corresponding to the training data and the synthetic data into inputs to a third loss function for distinguishing between each other; and a fourth header that converts the feature representations of the synthetic data corresponding to data with sensitive attributes and data with non-sensitive attributes into inputs to a fourth loss function for distinguishing between each other, comprising a generative adversarial network, the first loss function and the The system comprises: a first update unit that repeatedly updates the first header, the second header, and the encoder based on the gradient of a second loss function, and updates the third header based on the gradient of a third loss function; a second update unit that repeatedly updates the generator based on the update process by the first update unit and a loss function that corresponds to the third loss function and prevents the training data from being distinguished from the synthesized data; a third update unit that repeatedly updates the fourth header based on the update process by the second update unit and a fourth loss function; and a fourth update unit that repeatedly updates the generator based on the update process by the third update unit and a loss function that corresponds to the fourth loss function and prevents the distinguishing between data with sensitive attributes and data with non-sensitive attributes, wherein the first loss function is adjusted so that the contribution to the loss is adjusted according to the number of data for each of the data with sensitive attributes and data with non-sensitive attributes.
[0010] The first and second headers may be converted into vectors for calculating the cosine similarity between data points.
[0011] The first loss function may be adjusted to the mean value of the cosine similarity within the sets of data with sensitive attributes and the sets of data with non-sensitive attributes, respectively.
[0012] The third and fourth headers may be converted into estimates for identifying the feature representation of the target.
[0013] The data generation device according to the present invention includes an output unit that inputs noise to the generator learned by the learning device and outputs the synthesized data.
[0014] The learning method according to the present invention comprises a generator that outputs synthetic data similar to training data based on noise; an encoder that acquires feature representations from data augmentation of the training data or the synthetic data; a first header that converts the feature representations corresponding to the training data into inputs to a first loss function for distinguishing between data with sensitive attributes and data with non-sensitive attributes by supervised contrast learning; a second header that converts the feature representations corresponding to the training data and the synthetic data into inputs to a second loss function for distinguishing between the training data and the synthetic data by supervised contrast learning; a third header that converts the feature representations corresponding to the training data and the synthetic data into inputs to a third loss function for distinguishing between each other; and a fourth header that converts the feature representations of the synthetic data corresponding to data with sensitive attributes and data with non-sensitive attributes into inputs to a fourth loss function for distinguishing between each other. The learning method comprises a computer that has configured a generative adversarial network including the first and second loss functions. The process involves executing a first update step which repeats the process of updating the first header, the second header, and the encoder based on the distribution, and the process of updating the third header based on the gradient of the third loss function; a second update step which repeats the process of updating the generator based on the update process by the first update step and a loss function that corresponds to the third loss function and makes it impossible to distinguish between the training data and the synthesized data; a third update step which repeats the process of updating the fourth header based on the update process by the second update step and the fourth loss function; and a fourth update step which repeats the process of updating the generator based on the update process by the third update step and a loss function that corresponds to the fourth loss function and makes it impossible to distinguish between data with sensitive attributes and data with non-sensitive attributes, wherein the first loss function is adjusted so that the contribution of sensitive data and non-sensitive data to the loss is adjusted according to the number of data points.
[0015] The learning program according to the present invention is for causing a computer to function as the learning device.
Advantages of the Invention
[0016] According to the present invention, synthetic data with improved AI accuracy and fairness can be output while suppressing an increase in privacy risk.
Brief Description of the Drawings
[0017] [Figure 1] It is a diagram showing the functional configuration of the data generation device in the embodiment. [Figure 2A] It is a first flowchart showing the processing algorithm in the learning phase of the data generation device in the embodiment. [Figure 2B] It is a second flowchart showing the processing algorithm in the learning phase of the data generation device in the embodiment.
Modes for Carrying Out the Invention
[0018] Hereinafter, an example of an embodiment of the present invention will be described. The data generation device of the present embodiment applies supervised contrastive learning instead of the adversarial generation network using unsupervised contrastive learning shown in Non-Patent Document 4. The data generation device diversifies the training data for both sensitive attributes and non-sensitive attributes using data augmentation and supervised contrastive learning, thereby generating fair synthetic data that takes into account privacy and is not similar only to the training data.
[0019] FIG. 1 is a diagram showing the functional configuration of a data generation device 1 (learning device) in the present embodiment. The data generation device 1 is an information processing device (computer) including a control unit 10, a storage unit 20, and various input / output interfaces.
[0020] The control unit 10 is a part that controls the entire data generation device 1, and realizes each function in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.
[0021] The storage unit 20 is a storage area for various programs and data that enable the hardware group to function as a data generation device 1, and may be ROM, RAM, flash memory, or a hard disk drive (HDD). Specifically, the memory unit 20 stores programs (learning program, data generation program) for causing the control unit 10 to execute each of the functions of this embodiment, as well as parameters of the learning model that constitutes the generative adversarial network, training data, and the like.
[0022] The control unit 10 includes a generator G, an encoder D, a first header h1, a second header h2, a third header h3, and a fourth header h4 as multiple learning models based on various parameters stored in the memory unit 20, a first update unit 11, a second update unit 12, a third update unit 13, and a fourth update unit 14 for training these learning models, and an output unit 15 that outputs synthesized data using the trained models. The data generation device 1 operates these functional units to train the generator G (training phase) and then uses the trained generator G to output fair, privacy-conscious synthesized data (generation phase).
[0023] The control unit 10 constitutes a generative adversarial network that includes the following multiple learning models. The generator G is a neural network that outputs synthetic data similar to the training data based on noise, and this generator G is trained during the learning phase. Encoder D is a neural network that acquires feature representations from training data or data augmentation of synthetic data. The first header, h1, is a neural network that transforms feature representations corresponding to the training data into inputs to a first loss function that distinguishes between data with sensitive attributes and data with non-sensitive attributes using supervised controlled learning. The second header, h2, is a neural network that transforms feature representations corresponding to the training data and synthetic data into inputs to a second loss function that distinguishes between the training data and synthetic data using supervised comparative learning. The third header, h3, is a neural network that transforms feature representations corresponding to the training and synthesized data into estimates that serve as inputs to a third loss function for discriminating against each other. The fourth header, h4, is a neural network that transforms feature representations of data with sensitive and non-sensitive attributes from the synthetic data into estimates that serve as input to a fourth loss function for distinguishing between them.
[0024] Here, the first loss function is adjusted so that the contribution of sensitive and non-sensitive data to the loss is proportional to the number of data points. Furthermore, the first header h1 and the second header h2 convert the feature representations of the target into vectors for calculating cosine similarity between data, and the first loss function is adjusted so that the cosine similarity is averaged instead of summing within each set of data with sensitive attributes and data with non-sensitive attributes.
[0025] The first update unit 11 repeatedly updates the first header h1, the second header h2, and the encoder D based on the gradient of the loss function obtained by summing the first loss function and the second loss function during the learning phase, and updates the third header h3 based on the gradient of the third loss function.
[0026] In the learning phase, the second update unit 12 repeatedly performs the update process by the first update unit 11 and updates the generator G based on a loss function that corresponds to the third loss function and makes it impossible to distinguish between training data and synthesized data.
[0027] The third update unit 13, during the learning phase, repeatedly performs the update process by the second update unit 12 and the process of updating the fourth header h4 based on the fourth loss function.
[0028] In the learning phase, the fourth update unit 14 repeatedly performs the update process by the third update unit 13 and updates the generator G based on a loss function that corresponds to the fourth loss function and makes it impossible to distinguish between data with sensitive attributes and data with non-sensitive attributes.
[0029] In the generation phase, the output unit 15 inputs noise to the generator G learned by the fourth update unit 14 and outputs synthesized data.
[0030] Figures 2A and 2B are flowcharts showing the operation procedure of the learning phase of the data generation device 1 in this embodiment.
[0031] In step S1, the first update unit 11 selects N training data from the training data set X to create batch B. The first update unit 11 also generates N composite data using the generator G to create batch B' of composite data.
[0032] In step S2, the first update unit 11 first selects three data augmentation functions t1, t2, and t3. The first update unit 11 then applies functions t1 and D sequentially to each data point in batch B to obtain a set of feature-represented data Z1. Similarly, the first update unit 11 applies functions t2 and D sequentially to each data point in batch B to obtain a set of data Z2. Furthermore, the first update unit 11 applies functions t3 and D sequentially to each data in batch B' to obtain the data set Z3.
[0033] In step S3, the first update unit 11 calculates the loss function L1 (first loss function) using the data sets Z1 and Z2 as follows:
number
[0034] The loss function L1 has a small value (loss) when the similarity between data within each data set, whether sensitive or non-sensitive, is high, and the similarity between data with sensitive attributes and data with non-sensitive attributes is low. In other words, the loss function L1 calculates the loss required to train the encoder D and header h1 to distinguish between data with sensitive attributes and data with non-sensitive attributes. Here, in the equation, 1 / |Z s The | symbol adjusts the contribution to loss according to the amount of data for each attribute.
[0035] In step S4, the first update unit 11 uses data sets Z2 and Z3 to calculate the loss function L2 (second loss function) as follows:
number
[0036] The loss function L2 has a small value (loss) when the similarity between the synthetic data is high and the similarity between the training data and the synthetic data is low. In other words, the loss function L2 calculates the loss required to train the encoder D and header h2 to distinguish between the training data and the synthetic data.
[0037] In step S5, the first update unit 11 applies the header h3 as a classifier to each data point in the data sets Z2 and Z3, and calculates the loss function L3 (third loss function) as shown in the following equation. However, for all data points in Z2 and Z3, the gradient calculation is stopped (stop-gradient), and the loss function L3 is not used for training the encoder D.
number
[0038] The loss function L3 is designed so that the value (loss) decreases when the header h3 transforms the training data into large values (positive numbers) and the synthetic data into small values (negative numbers). In other words, the loss function L3 calculates the loss required to train the header h3 to distinguish between training data and synthetic data.
[0039] In step S6, the first update unit 11 calculates the loss function LD for the encoder D as follows:
number
[0040] In step S7, the first update unit 11 updates the encoder D and headers h1 to h3 using the gradient of the LD. More specifically, the first update unit 11 executes in parallel the process of updating the encoder D and headers h1 and h2 using the gradients of L1 and L2, and the process of updating header h3 using the gradient of L3. In step S8, the first update unit 11 repeats the processes from step S1 to step S7 T1 times. That is, if the number of times is less than T1, the process returns to step S1.
[0041] In step S9, the second update unit 12 calculates the loss function LG1 for the generator G using the data set Z3 as follows:
number
[0042] The loss function LG1, unlike the term related to synthetic data in L3, decreases in value (loss) when the synthetic data is transformed into a large value (positive number) by the header h3. In other words, it calculates the loss required to train the generator G so that it cannot distinguish between training data and synthetic data.
[0043] In step S10, the second update unit 12 updates the generator G using the gradient of the loss function LG1. In step S11, the second update unit 12 repeats the processes from step S1 to step S10 T2 times. That is, if the number of times is less than T2, the process returns to step S1.
[0044] In step S12, the third update unit 13 uses the generator G to generate N composite data with sensitive attributes and N composite data with non-sensitive attributes, and combines these to create batch B.
[0045] In step S13, the third update unit 13 selects a data extension function t4. Note that t4 may be the same as any of t1 to t3. Then, the third update unit 13 sequentially applies t4 and D to each data point in batch B'' to obtain a set of feature-represented sensitive data R1 and a set of non-sensitive data R2. However, the gradient calculation is stopped for all data points in R1 and R2.
[0046] In step S14, the third update unit 13 applies the header h4 as a classifier to each of the data contained in the data sets R1 and R2, and calculates the loss function L4 (fourth loss function) as shown in the following equation.
number
[0047] The loss function L4 decreases in value (loss) when the header h4 transforms data with sensitive attributes into large values (positive numbers) and data with non-sensitive attributes into small values (negative numbers). In other words, the loss function L4 calculates the loss required to train the header h4 to distinguish between data with sensitive attributes and data with non-sensitive attributes.
[0048] In step S15, the third update unit 13 updates the header h4 using the gradient of the loss function L4. In step S16, the third update unit 13 repeats the processes from step S1 to step S15 T3 times. That is, if it is less than T3 times, the process returns to step S1.
[0049] In step S17, the fourth update unit 14 applies the header h4 as a classifier to each of the data contained in the data sets R1 and R2, and calculates the loss function LG2 for the generator G as follows.
number
[0050] Unlike L4, the loss function LG2 decreases in value (loss) when the header h4 transforms data with sensitive attributes to small values (negative numbers) and data with non-sensitive attributes to large values (positive numbers). In other words, the loss function LG2 calculates the loss required to train the generator G so that it cannot distinguish between data with sensitive and non-sensitive attributes.
[0051] In step S18, the fourth update unit 14 updates the generator G using the gradient of the loss function LG2. In step S19, the fourth update unit 14 repeats the processes from step S1 to step S18 T4 times. That is, if it is less than T4 times, the process returns to step S1.
[0052] Thus, the data generation device 1 first trains generator G and encoder D to generate synthetic data that is similar to the training data and in which data with sensitive attributes and data with non-sensitive attributes can be distinguished in the feature space, by having a learning model based on the loss function LD (encoder D and headers h1, h2, h3) compete with a learning model based on the loss function LG1 (generator G) (steps S1 to S11). Furthermore, the data generation device 1 trains the generator G to generate unbiased composite data that cannot distinguish between data with sensitive attributes and data with non-sensitive attributes by having a learning model based on loss function L4 (header h4) compete with a learning model based on loss function LG2 (generator G) (steps S12-S19).
[0053] The number of data points in a batch N and the number of iterations T1 to T4 may be set appropriately depending on the type of data, the application field, etc. Also, T1 to T3 may be changed each time the iteration is performed.
[0054] According to this embodiment, the data generation device 1 acquires feature representations of data with sensitive attributes and data with non-sensitive attributes using supervised contrast learning (trains encoder D) in a generative adversarial network, and introduces a classifier (header h4) to distinguish between data with sensitive attributes and data with non-sensitive attributes. The generator G is trained by having the classifier and the generator G, which outputs synthetic data, compete against each other. As a result, the training data is diversified, so the data generation device 1 can construct a generator G that generates synthetic data that does not depend solely on the original training data, and since it becomes impossible to distinguish between the training data and other data, it can generate fair data that takes privacy into consideration.
[0055] Furthermore, in supervised controlled learning, by using a controlled loss that adjusts the contribution of sensitive and non-sensitive attributes according to the number of sensitive and non-sensitive attributes in the training data, the data generator 1 can improve the feature representation of data with attributes that are scarce in the training data and appropriately learn data with those attributes. As a result, the data generator 1 can improve the accuracy and fairness of AI such as classifiers using synthetic data by diversifying the synthetic data using data augmentation and controlled learning, while suppressing the increase in privacy risk for data with specific attributes.
[0056] Furthermore, the data generation device 1 adjusts the loss function L1 by using the mean value instead of the sum of the cosine similarity of the feature representations used for comparative learning within the sets of data with sensitive attributes and data with non-sensitive attributes. This allows the data generation device 1 to easily adjust the control loss in supervised control learning and diversify the training data. Furthermore, the data generation device 1 can easily construct a generative adversarial network concerning fairness by applying a known classifier and defining a loss function using the estimated value.
[0057] Furthermore, this embodiment makes it possible to construct AI using unbiased synthetic data with reduced privacy risks, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), "Build resilient infrastructure, promote sustainable industrialization and foster innovation."
[0058] Although embodiments of the present invention have been described above, the present invention is not limited to the embodiments described above. Furthermore, the effects described in the embodiments described above are merely a list of the most preferred effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.
[0059] The learning method and data generation method by the data generation device 1 are implemented by software. When implemented by software, the programs constituting this software are installed on an information processing device (computer). These programs may be distributed to users by being recorded on removable media such as a CD-ROM, or by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of Symbols]
[0060] D encoder G generator h1 First Header h2 Second Header h3 Third Header h4 Fourth Header 1. Data generation device 10 Control Unit 11 1st update part 12 2nd update part 13 Third update part 14 4th update part 15 Output section 20 Memory section
Claims
1. A generator that outputs synthetic data similar to the training data based on noise, An encoder that obtains feature representations from the data augmentation of the training data or the data augmentation of the synthesized data, A first header that transforms the feature representations corresponding to the aforementioned training data into input to a first loss function for distinguishing between data with sensitive attributes and data with non-sensitive attributes using supervised controlled learning, A second header that converts the feature representations corresponding to the training data and the composite data into inputs to a second loss function for distinguishing between the training data and the composite data using supervised comparative learning, A third header that converts the feature representations corresponding to the training data and the synthesized data into inputs to a third loss function for mutual identification, A generative adversarial network is constructed that includes a fourth header which converts feature representations of data with sensitive attributes and data with non-sensitive attributes from the aforementioned synthesized data into inputs to a fourth loss function for mutual identification. A first update unit that repeatedly updates the first header, the second header, and the encoder based on the gradients of the first and second loss functions, and updates the third header based on the gradient of the third loss function, A second update unit repeats the process of updating the generator based on the update process performed by the first update unit and the third loss function, which is used to make it impossible to distinguish between the training data and the synthesized data. A third update unit repeats the update process performed by the second update unit and the process of updating the fourth header based on the fourth loss function, The system includes a fourth update unit that repeats the process of updating the generator based on the update process performed by the third update unit and the fourth loss function, and which is designed to make it impossible to distinguish between data with sensitive attributes and data with non-sensitive attributes. The first loss function is a learning device in which the contribution to the loss is adjusted according to the number of data points for each type of data, including data with sensitive attributes and data with non-sensitive attributes.
2. The learning device according to claim 1, wherein the first header and the second header convert the feature representation of the target into a vector for calculating the cosine similarity between data.
3. The learning device according to claim 2, wherein the first loss function is adjusted as the average value of the cosine similarity within the set of data having sensitive attributes and the set of data having non-sensitive attributes, respectively.
4. The learning device according to claim 1, wherein the third header and the fourth header are converted into estimated values for identifying the feature representation of the target.
5. A generator that outputs synthetic data similar to the training data based on noise, An encoder that obtains feature representations from the data augmentation of the training data or the data augmentation of the synthesized data, A first header that transforms the feature representations corresponding to the aforementioned training data into input to a first loss function for distinguishing between data with sensitive attributes and data with non-sensitive attributes using supervised controlled learning, A second header that converts the feature representations corresponding to the training data and the composite data into inputs to a second loss function for distinguishing between the training data and the composite data using supervised comparative learning, A third header that converts the feature representations corresponding to the training data and the synthesized data into inputs to a third loss function for mutual identification, A computer that has constructed a generative adversarial network including a fourth header that converts feature representations corresponding to data with sensitive attributes and data with non-sensitive attributes from the aforementioned synthesized data into inputs to a fourth loss function for mutual identification, A first update step that repeats the process of updating the first header, the second header and the encoder based on the gradients of the first loss function and the second loss function, and the process of updating the third header based on the gradient of the third loss function, A second update step repeats the process of updating the generator based on the update process of the first update step and the third loss function, which is used to make it impossible to distinguish between the training data and the synthesized data. A third update step which repeats the update process performed in the second update step and the process of updating the fourth header based on the fourth loss function, The update process performed in the third update step and the fourth update step, which repeats the process of updating the generator based on a loss function that corresponds to the fourth loss function and makes it impossible to distinguish between data with sensitive attributes and data with non-sensitive attributes, are executed. The first loss function is a learning method in which the contribution to the loss is adjusted according to the number of data points for each type of data, including data with sensitive attributes and data with non-sensitive attributes.
6. A learning program for causing a computer to function as a learning device according to any one of claims 1 to 4.