Learning system, learning method, and program

Abstract

Provided are a learning system, a learning method, and a program that prevent the training data used for federated learning from being inferred. A learning system (10) comprises an acquisition unit (11) that acquires obfuscation data for obfuscating prescribed data included in data sets owned by respective organizations, a training unit (12) that trains local models by machine learning that uses the obfuscation data and the data sets, and a generation unit (13) that generates a federated learning global model on the basis of the local models.

Description

Learning system, learning method, and computer-readable medium

[0001] The present disclosure relates to a learning system, a learning method, and a computer-readable medium.

[0002] Patent Document 1 discloses a system having a computational model that performs machine learning.

[0003] Japanese Patent Application Laid-Open No. 2019-144872

[0004] Federated learning technology has been proposed, which integrates local models trained on datasets owned by each organization to generate a global model. With federated learning technology, only the generated global model is distributed, making it possible to conceal the dataset used for training. However, if there is an organization that records changes in the global model over time, there is a risk that the training data used to train the most recent local model may be inferred by reverse engineering the global model.

[0005] Therefore, one of the objectives that the embodiments disclosed in this specification aim to achieve is to provide a learning system, a learning method, and a program that prevent the learning data used in federated learning from being guessed.

[0006] A learning system according to a first aspect of the present disclosure includes an acquisition means for acquiring blurred data for blurring predetermined data included in a dataset owned by each organization, a learning means for training a local model by machine learning using the blurred data and the dataset, and a generation means for generating a global model in federated learning based on the local model.

[0007] A learning method according to a second aspect of the present disclosure includes obtaining blurred data for blurring specific data included in a dataset owned by each organization, training a local model through machine learning using the blurred data and the dataset, and generating a global model in federated learning based on the local model.

[0008] A non-transitory computer-readable medium according to a third aspect of the present disclosure stores a program for causing a computer to execute the following processes: acquiring blurred data for blurring specific data included in a dataset owned by each organization; training a local model through machine learning using the blurred data and the dataset; and generating a global model in federated learning based on the local model.

[0009] According to the present disclosure, it is possible to provide a learning system, a learning method, and a program that prevent the learning data used in federated learning from being guessed.

[0010] Fig. 1 is a block diagram showing the configuration of a related learning system. Fig. 2 is a block diagram showing the configuration of a learning system according to embodiment 1. Fig. 3 is a block diagram showing the configuration of a learning system according to embodiment 2. Fig. 4 is a block diagram showing the configuration of a client terminal according to embodiment 2. Fig. 5 is a flowchart showing the flow of operation of an acquisition unit. Fig. 6 is a block diagram showing the configuration of a client terminal according to embodiment 3. Fig. 7 is a block diagram showing the configuration of a learning system according to embodiment 4.

[0011] <Background to the embodiment> First, an overview of federated learning will be described. First, the configuration of a related learning system 1 will be described with reference to Fig. 1. Learning system 1 includes client terminal 2x, client terminal 2y, client terminal 2z, and server 3.

[0012] The client terminal 2x generates a machine learning model (called a local model 4x) from a dataset owned by organization X. The client terminal 2x transmits the local model 4x to the server 3.

[0013] The client terminal 2y generates a machine learning model (referred to as a local model 4y) from a dataset owned by organization Y. The client terminal 2y transmits the local model 4y to the server 3.

[0014] The client terminal 2z generates a machine learning model (referred to as a local model 4z) from a dataset owned by the organization Z. The client terminal 2z transmits the local model 4z to the server 3.

[0015] The server 3 generates a global model by integrating the local model 4x, the local model 4y, and the local model 4z. The server 3 may, for example, calculate the arithmetic mean of the model parameters of the local models 4x, 4y, and 4z. Note that the method of integrating the model parameters is not limited to the arithmetic mean. The server 3 then distributes the global model to the client terminals 2x, 2y, and 2z.

[0016] Here, the datasets owned by each organization may contain data (e.g., data on compounds under development) that need to be kept confidential from other organizations. For example, if an organization begins development of a compound that exhibits a specific effect, it may want to keep this a secret. However, because the datasets owned by that organization contain a large amount of data on compounds that exhibit a specific effect, there is a risk that the organization may be able to infer that it has begun development of such a compound by reverse engineering the global model. The inventors of the present application have conceived the invention of embodiment 1 based on the above considerations.

[0017] 2 is a block diagram showing the configuration of a learning system 10 according to embodiment 1. The learning system 10 includes an acquisition unit 11, a learning unit 12, and a generation unit 13.

[0018] The acquisition unit 11 acquires blurred data for blurring predetermined data included in a dataset owned by each organization. The learning unit 12 trains a local model through machine learning using the blurred data and the dataset. The generation unit 13 generates a global model for federated learning based on the local model trained by the learning unit 12.

[0019] The learning system 10 according to the first embodiment learns a local model using blurred data, and therefore can prevent the learning data used in the associative learning from being guessed.

[0020] The learning system 10 includes a processor, memory, and storage device (not shown). The storage device stores a computer program that implements the processing of the learning method according to this embodiment. The processor then loads the computer program from the storage device into the memory and executes the computer program. This allows the processor to realize the functions of the acquisition unit 11, learning unit 12, and generation unit 13.

[0021] Alternatively, the acquisition unit 11, the learning unit 12, and the generation unit 13 may each be realized by dedicated hardware. Furthermore, some or all of the components of each device may be realized by general-purpose or dedicated circuits, processors, etc., or a combination thereof. These may be configured by a single chip, or by multiple chips connected via a bus. Some or all of the components of each device may be realized by a combination of the above-mentioned circuits, etc., and a program. Furthermore, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), an FPGA (Field-Programmable Gate Array), etc. may be used as the processor.

[0022] Furthermore, when some or all of the components of the learning system 10 are realized by multiple information processing devices, circuits, etc., the multiple information processing devices, circuits, etc. may be centrally or decentralized. For example, the information processing devices, circuits, etc. may be realized as a client-server system, cloud computing system, etc., connected via a communication network. Furthermore, the functions of the learning system 10 may be provided in the form of SaaS (Software as a Service).

[0023] <Embodiment 2> A learning system 100 according to embodiment 2 is a specific example of the learning system 10 according to embodiment 1. Figure 3 is a block diagram showing the configuration of the learning system 100. The learning system 100 includes client terminals 20x, 20y, and 20z, and a server 30. Each client terminal is a terminal of an organization that uses the learning system 100 (e.g., a pharmaceutical manufacturer or a chemical manufacturer).

[0024] The client terminals 20x, 20y, and 20z are communicatively connected to the server 30 via a network N. The network N may be wired or wireless. The network N may be, for example, a virtual private network (VPN).

[0025] Hereinafter, when there is no need to distinguish between the client terminals 20x, 20y, and 20z, they may be simply referred to as client terminals 20. Note that the number of client terminals 20 is not limited to three, and may be two, or four or more.

[0026] Next, the client terminal 20 will be described with reference to Fig. 4. The client terminal 20 includes a storage unit 21, an acquisition unit 22, and a learning unit 23. The acquisition unit 22 is a specific example of the acquisition unit 11 described above, and the learning unit 23 is a specific example of the learning unit 12 described above.

[0027] The memory unit 21 is a storage that stores datasets owned by each organization. The dataset is, for example, a dataset of chemical compounds. In this case, the dataset lists values ​​such as the structure and properties of the chemical compounds. The structure of the chemical compound is expressed by a fixed-length bit string, and each bit in the bit string represents the presence or absence of a specific structure (e.g., a benzene ring). The property value (e.g., a tensile strength value) may be a value obtained by experiment, or may be a value obtained by simulation or theoretical calculation.

[0028] The dataset includes predetermined data. The predetermined data is data that needs to be kept secret. For example, the predetermined data is data on a compound that exhibits a specific action.

[0029] The storage unit 21 may store, in addition to the data set, data that is the source of the blurred data. The storage unit 21 may store, for example, experimental data, theoretical calculation data, simulation data, data used in materials informatics, and the like.

[0030] The acquisition unit 22 acquires blurred data for blurring predetermined data included in the dataset. The blurred data is data that is different from the predetermined data and needs to be data that does not degrade the performance of the local model.

[0031] If the predetermined data is data on a compound exhibiting a specific effect (e.g., a compound under development), the blurred data may be data on a compound exhibiting an effect other than the specific effect (referred to as a first compound). For example, if the compound exhibiting a specific effect is a compound used as a headache medicine, the first compound may be a compound used as a stomachache medicine.

[0032] It should be noted that the above-mentioned dataset is not limited to a dataset of chemical compounds. When the dataset includes data on things related to the business of each organization, the predetermined data may be data on things having a specific attribute (e.g., action), and the blurred data may be data on things having attributes different from the specific attribute. The things may be, for example, chemical compounds or financial products. The blurred data does not need to be actual data, but may be data estimated by simulation or the like.

[0033] For example, if an organization is conducting research or studies on a subject having a particular attribute (e.g., a chemical compound or a financial product), the organization may want to keep the fact that it is conducting research or studies on that subject a secret. By using the second embodiment, the organization can keep the purpose (objective) of the research or studies a secret.

[0034] Next, the flow of operations of the acquisition unit 22 will be described with reference to Fig. 5. A data set includes a plurality of records, and each record is called data.

[0035] The acquisition unit 22 performs the following process on each data item included in the data set. First, the acquisition unit 22 determines whether the data item is data on an object having a specific attribute (step S101). If the data item is not data on an object having a specific attribute (NO in step S101), the acquisition unit 22 does not acquire blurred data (step S102) and proceeds to the process on the next data item.

[0036] If the data is of a thing having a specific attribute (YES in step S101), the acquisition unit 22 determines whether the storage unit 21 stores data of a thing (referred to as a first thing) having an attribute other than the specific attribute (step S103). Note that the first compound is a specific example of the first thing.

[0037] If the data of the first thing is stored (YES in step S103), the acquisition unit 22 extracts the data of the first thing from the data stored in the storage unit 21 (step S104). The acquisition unit 22 acquires the extracted data of the first thing as blurred data and proceeds to processing the next data.

[0038] If the data of the first thing is not stored (NO in step S103), the acquisition unit 22 estimates the data of the first thing based on the data stored in the storage unit 21 (step S105). Then, the acquisition unit 22 acquires the estimated data of the first thing as blurred data and moves on to processing the next data. The acquisition unit 22 may estimate the data of the first compound based on, for example, material informatics or theoretical calculations.

[0039] Returning to FIG. 4 , the learning unit 23 learns a local model through machine learning using the blurred data and the data set acquired by the acquisition unit 22. The local model trained on the client terminal 20x is referred to as local model 40x, the local model trained on the client terminal 20y is referred to as local model 40y, and the local model trained on the client terminal 20z is referred to as local model 40z. When the local models 40x, 40y, and 40z are not distinguished from one another, they are simply referred to as local models 40. The local model 40 may be, for example, a model that infers properties from the structure of a compound. The learning unit 23 transmits the trained local model 40, i.e., the parameters of the local model 40, to the server 30.

[0040] The server 3 will be described with reference to FIG. 3 . The server 3 includes a generation unit 31. The generation unit 31 generates a global model that integrates local model 40x, local model 40y, and local model 40z. The generation unit 31 is a specific example of the generation unit 13 described above. The generation unit 31 distributes the global model that integrates local model 40x, local model 40y, and local model 40z to the client terminals 20x, 20y, and 20z.

[0041] Alternatively, the server 30 may store the datasets owned by each organization, generate the local models 40x, 40y, and 40z, and integrate the local models 40x, 40y, and 40z. In this case, the acquisition unit 22 and the learning unit 23 are provided in the server 30.

[0042] The learning system 100 according to the second embodiment trains a local model using blurred data for blurring predetermined data, thereby preventing other organizations from extrapolating the predetermined data from the global model.

[0043] Third Embodiment In the second embodiment, blurred data and actual data included in a dataset were not distinguished when generating a local model. In the third embodiment, the weights of blurred data (referred to as first weights) in machine learning are differentiated from the weights of actual data (referred to as second weights). Note that because parameters of a machine learning model are sometimes called weights, care must be taken not to confuse them with the first weights and second weights that are weights for training data.

[0044] In the learning system according to the third embodiment, the client terminals 20x, 20y, and 20z in Fig. 3 are replaced with client terminals 200x, 200y, and 200z, respectively. When the client terminals 200x, 200y, and 200z are not to be distinguished from one another, they will be simply referred to as client terminals 200.

[0045] 6 is a block diagram showing the configuration of the client terminal 200. The client terminal 200 includes a storage unit 21, an acquisition unit 22, a learning unit 23, a first setting unit 24, an erasing unit 25, and a second setting unit 26.

[0046] The storage unit 21 stores the blurred data acquired by the acquisition unit 22 and the actual data included in the data set. The storage unit 21 may also store data that is the source of the blurred data.

[0047] The acquisition unit 22 acquires blurred data for blurring predetermined data included in the dataset. The acquisition unit 22 may extract the blurred data from the original data, or may estimate the blurred data using material informatics or experimental design. The acquisition unit 22 stores the acquired blurred data in the storage unit 21. The acquisition unit 22 assigns a flag to the blurred data to distinguish it from actual data included in the dataset.

[0048] The learning unit 23 performs machine learning by differentiating the weights of the blurred data (first weights) from the weights of the actual data included in the dataset (second weights), and learns a local model. The blurred data and the actual data can be distinguished using flags. The method of differentiating the weights of the data is not particularly limited, and for example, the weights of the data may be included in a loss function.

[0049] When the first weight is larger than the second weight, it becomes easier to blur the specified data, but there is a risk that the performance of the local model will be degraded due to blurred data that is not actual data. If the performance of the local model is degraded, the performance of the global model that integrates the local models will also be degraded. On the other hand, when the first weight is smaller than the second weight, it is possible to suppress degradation of the performance of the local model, but there is a possibility that the specified data will not be blurred sufficiently.

[0050] Furthermore, when the reliability of the blurred data is high, the first weight may be increased because it is believed that the performance of the local model will not be degraded. On the other hand, when the reliability of the blurred data is low, the first weight needs to be decreased because there is a risk of the performance of the local model being degraded. An example of a case where the reliability of the blurred data is low is when the data of the first compound is estimated from a small amount of data.

[0051] Furthermore, the learning unit 23 performs machine learning using the blurred data and dataset stored in the storage unit 21. Because the blurred data is erased by the erasing unit 25 after a predetermined period of time has elapsed, the learning unit 23 suppresses degradation in the performance of the local model by not using unnecessary blurred data in machine learning. In other words, the learning unit 23 generates a local model through machine learning using the blurred data and dataset that have not been erased.

[0052] The first setting unit 24 sets the above-described first weights. The first setting unit 24 may set the first weights based on input to the client terminal 200. By appropriately setting the first weights, it is possible to blur predetermined data while suppressing degradation in performance of the local model due to the blurred data. The first weights may be set according to the confidentiality of the blurred data. Furthermore, the first weights may be set according to the reliability of the blurred data.

[0053] The erasing unit 25 erases the blurred data stored in the memory unit 21 after a predetermined period of time has elapsed. The predetermined period of time is set by the second setting unit 26. If the blurred data is stored for a long period of time, there is a possibility that the performance of the local model learned by the learning unit 23 during that period will deteriorate, and therefore the blurred data is erased after the predetermined period of time has elapsed.

[0054] The second setting unit 26 sets the above-mentioned predetermined period, i.e., the period for storing the blurred data, based on the first weight set by the first setting unit 24. Specifically, the second setting unit 26 may set the predetermined period so that the larger the first weight, the longer the predetermined period. If the first weight is set according to the reliability of the first data, the less reliable the first data, the shorter the time period for erasing, so that the performance of the local model is less likely to deteriorate.

[0055] The learning system 100 according to the third embodiment can prevent a decrease in the performance of the local model and the global model while ensuring the confidentiality of the specified data by setting the weight of the blurred data for blurring the specified data.

[0056] <Fourth embodiment> Fig. 7 is a block diagram showing the configuration of a learning system 101 according to a fourth embodiment. Comparing Fig. 3 with Fig. 7, the server 30 has been replaced with a server group 300. The server group 300 includes a plurality of servers 32. Note that the number of servers 32 is not limited to three. However, in order to perform secure computation, it is preferable that the number of servers 32 is three or more.

[0057] The server group 300 integrates the global model using secure computation and transmits the results of the secure computation to the client terminals 20x, 20y, and 20z.

[0058] The client terminals 20x, 20y, and 20z learn local models 40x, 40y, and 40z by machine learning using blurred data and a data set, as in embodiment 2. Then, each client terminal 20 divides each model parameter of the local model 40 into multiple shares (e.g., three) and transmits the multiple shares to multiple servers 32.

[0059] Each server 32 uses the received shares to perform secure computation to integrate the models. Each server 32 may integrate the models at a predetermined time. The local models cannot be discovered from the shares, and computation using the shares can be considered secure computation. Multiple servers 32 may cooperate to perform multi-party computation (MPC). Because the amount of computation required to integrate the local models is sufficiently small, it is believed that the server group 300 can perform secure computation in a realistic amount of time.

[0060] The fourth embodiment also provides the same effects as the second embodiment. Furthermore, according to the fourth embodiment, the calculation for integrating the local models can be kept confidential.

[0061] The above-described program includes a set of instructions (or software code) that, when loaded into a computer, causes the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable media or tangible storage media include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, CD-ROM, digital versatile disc (DVD), Blu-ray (registered trademark) disc or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may also be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, transitory computer-readable media or communication media include electrical, optical, acoustic, or other forms of propagated signals.

[0062] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the invention.

[0063] 1, 10, 100, 101 Learning system 2, 2x, 2y, 2z, 20, 20x, 20y, 20z, 200, 200x, 200y, 200z Client terminal 4, 4x, 4y, 4z, 40, 40x, 40y, 40z Local model 21 Storage unit 11, 22 Acquisition unit 12, 23 Learning unit 24 First setting unit 25 Erasure unit 26 Second setting unit 3, 30, 32 Server 13, 31 Generation unit 300 Server group

Claims

1. An acquisition means for acquiring blurred data for blurring predetermined data included in a dataset owned by each organization; A learning means for learning a local model by machine learning using the blurred data and the data set; a generating means for generating a global model in associative learning based on the local model; A learning system comprising:

2. The predetermined data is data of an object having a specific attribute, The blurred data is data of an object having an attribute different from the specific attribute. The learning system according to claim 1 .

3. The blurred data is distinguished from the actual data contained in the data set using a flag. A learning system according to claim 1 or 2.

4. The learning means makes the weight of the blurred data in the machine learning different from the weight of the actual data. The learning system according to claim 3 .

5. A first setting unit that sets a weight of the blur data. The learning system according to claim 4 .

6. A storage unit that stores the blur data and the data set; an erasing unit that erases the blurred data after a predetermined period of time has elapsed; Equipped with The learning means learns the local model by machine learning using the unerased blurred data and the data set. The learning system according to claim 5 .

7. A second setting unit that sets the predetermined period based on a weight of the blur data. The learning system according to claim 6 , comprising:

8. the predetermined data is data on a compound exhibiting a specific effect, The acquiring means acquires the blurring data from at least one of theoretical calculation data, experimental data, simulation data, data used in materials informatics, and data inferred by experimental design. A learning system according to claim 1 or 2.

9. Obtain blurred data, which is data used to blur certain data contained in the dataset owned by each organization, training a local model by machine learning using the blurred data and the dataset; Generate a global model in federated learning based on the local model How to learn.

10. On the computer, A process of obtaining blurred data for blurring predetermined data included in a dataset owned by each organization; A process of learning a local model by machine learning using the blurred data and the dataset; A process of generating a global model in federated learning based on the local model; A program for executing the above.