Training device, training method, and training program

Abstract

A training device (10) comprises: a generation unit (11) that has a generation model (111) for learning the features of training data and generating similar data; a first processing control unit (13) that, on the basis of the result of identification by an identification model (121) for identifying a label to which inputted data belongs, controls execution of a first process for causing the generation model (111) to suppress generation of data similar to training data to be forgotten; and a second processing control unit (15) that, after the first process, controls execution of a second process for correcting a first region, in which the generation of data similar to the training data to be forgotten is suppressed, by using data other than the training data to be forgotten.

Description

Learning device, learning method, and learning program

[0001] The present invention relates to a learning device, a learning method, and a learning program.

[0002] Deep learning has made remarkable progress, and its introduction into various fields is being considered.

[0003] As AI (Artificial Intelligence) becomes more widespread, new issues such as privacy protection and preventing data leaks have arisen. As the use of personally identifiable data for training AI models increases, it is desirable to quickly respond to data deletion requests from data providers.

[0004] To solve these problems, there is research called Machine Unlearning, which involves making an AI model forget the knowledge it has previously learned. Machine Unlearning aims to make a trained AI model forget information related to desired training data.

[0005] Takashi Shibata, Go Irie, Daiki Ikami and Yu Mitsuzumi, “Learning with Selective Forgetting”, Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence (IJCAI-21).

[0006] Previous research on machine unlearning has mainly focused on discriminative models, and no research has proposed a machine unlearning method for generative models.

[0007] However, as the accuracy of generative models has improved dramatically and their use has become more widespread, issues of copyright and privacy protection have also been raised regarding generative models, and we believe that measures are needed.

[0008] The present invention has been made in view of the above, and aims to provide a learning device, a learning method, and a learning program that can realize a machine unlearning technique for a generative model.

[0009] In order to solve the above-mentioned problems and achieve the objective, the learning device is characterized by having: a generation unit having a generative model that learns the features of training data and generates similar data; a first processing control unit that controls the execution of a first processing that causes the generative model to suppress the generation of data similar to the training data to be forgotten based on the discrimination result of a discrimination model that identifies the label to which input data belongs; and a second processing control unit that controls the execution of a second processing that, after the first processing, corrects a first region in which the generation of data similar to the training data to be forgotten is suppressed with data other than the training data to be forgotten.

[0010] According to the present invention, a machine unlearning technique for generative models can be realized.

[0011] FIG. 1 is a diagram illustrating an example of input and output of a generative model. FIG. 2 is a diagram illustrating a VAE. FIG. 3 is a diagram illustrating an example of a generative model to be subjected to learning processing. FIG. 4 is a diagram illustrating a learning process according to an embodiment. FIG. 5 is a diagram illustrating a learning process according to an embodiment. FIG. 6 is a diagram illustrating an example of the configuration of a learning device according to an embodiment. FIG. 7 is a flowchart illustrating the processing steps of the learning process according to an embodiment. FIG. 8 is a flowchart illustrating the processing steps of the first process shown in FIG. 7. FIG. 9 is a flowchart illustrating the processing steps of the second process shown in FIG. 7. FIG. 10 is a diagram illustrating the distribution of images generated by the VAE for latent variables. FIG. 11 is a diagram illustrating the distribution of images generated by the VAE for latent variables after the first process. FIG. 12 is a diagram illustrating the distribution of images generated by the VAE for latent variables after the second process. FIG. 13 is a diagram illustrating an example of a computer on which a learning device is implemented by executing a program.

[0012] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A learning device, a learning method, and a learning program according to the present invention will be described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the following embodiments.

[0013] In the embodiment, a two-stage additional learning is performed on the generative model, thereby realizing a machine unlearning technique for the generative model, i.e., forgetting of training data to be forgotten. The training data to be forgotten is, for example, data linked to personal information or data requested to be deleted by a data provider.

[0014] In this embodiment, a first process is performed on the generative model to suppress the generation of data similar to the training data to be forgotten. After the first process, a second process is performed to correct the first region where the generation of data similar to the training data to be forgotten is suppressed with data other than the training data to be forgotten. The second process can also be considered a process of filling the first region where the generation of data similar to the training data to be forgotten is suppressed with data other than the training data to be forgotten. In this embodiment, the first and second processes implement a machine unlearning technique for the generative model.

[0015] [Prerequisites] First, a prerequisite technology for the embodiment will be described. A general technical content of a machine unlearning technique, a discriminative model, and a generative model used in the embodiment will be described. The generative model and the discriminative model are machine learning models configured using a neural network or the like, and correspond to so-called AI (Artificial Intelligence) models.

[0016] [Machine Unlearning Method] Machine unlearning is a technology that aims to make a trained machine learning model forget information about desired training data. Existing machine unlearning methods have mainly targeted discriminative models. In this embodiment, we propose a machine unlearning method that targets generative models.

[0017] [Discriminative Model] A discriminative model is a machine learning model that, when inputted with data (e.g., image x), predicts and outputs the label to which the data belongs. For example, an example of a problem that a discriminative model can solve is a problem in which an image of handwritten numbers is inputted and the model is asked to guess what the written numbers are.

[0018] [Generative Model] FIG. 1 is a diagram illustrating an example of input and output of a generative model. As shown in FIG. 1, a generative model is, for example, a machine learning model (deep learning model) that outputs a clear image x when noise data z is input. For example, a service that allows an AI model to draw manga pictures is one example of an AI service that uses a generative model. Examples of generative models include VAE (Variational Auto Encoder), GAN (Generative Adversarial Networks), and Diffusion. Furthermore, application examples of generative models include conditional generation based on text and picture conversion.

[0019] [VAE] Fig. 2 is a diagram illustrating VAE. VAE is a type of autoencoder. VAE is a neural network that acquires features to represent data through unsupervised learning. Taking the handwritten digit dataset MNIST (Mixed National Institute of Standards and Technology database) as an example, as shown in Fig. 2, a neural network receives image data of digits and outputs nearly identical images.

[0020] The VAE has two neural networks: an encoder and a decoder. The output of the encoder is called the latent variable z. The encoder is responsible for encoding input data (e.g., image x) into the latent variable z. The decoder is responsible for decoding the latent variable z back to the original image (e.g., image x').

[0021] The VAE is an autoencoder that is regularized so that the probability distribution of this latent variable z matches the standard normal distribution. When a latent variable obtained from a standard normal distribution is input to a trained VAE decoder, clear numeric image data is output. Therefore, the VAE can be used as a generative model. Below, we will explain an example where two-dimensional noise data is the latent variable z.

[0022] [Adversarial Example] In this embodiment, an adversarial example (adversarial sample) is used in the second process.

[0023] Adversarial examples are an attack method that causes deep learning models to make incorrect decisions by adding tiny noise to the input data that is imperceptible to the human eye.

[0024] The objective function of the Adversarial Example is Equation (1), where l(Θ, z, x) is the loss function of the deep learning model.

[0025]

[0026] Typical algorithms for generating adversarial examples include the Fast Gradient Signed Method (FGSM) and the Projected Gradient Descent (PGD).

[0027] In FGSM, noise is added to the input data z according to equation (2).

[0028]

[0029] In Equation (2), ε is the magnitude of noise. In FGSM, noise is added to the input data so that the value of the loss function of the deep learning model increases.

[0030] Next, in the PGD, noise is added to the input data z according to the algorithm of equation (3).

[0031]

[0032] [Overview of Learning Process] Fig. 3 is a diagram showing an example of a generative model to be learned. In this embodiment, for example, as shown in Fig. 3, a VAE is used as the generative model 111. In this embodiment, a generative model that has learned to generate handwritten number images using handwritten number images of 0 to 4 as training data will be described as the generative model 111. The generative model 111 is trained to generate handwritten number images using input two-dimensional noise data z∈R ２ An image x of a handwritten digit between 0 and 4 is generated and output according to the above.

[0033] [First Process] Fig. 4 is a diagram illustrating the learning process according to the embodiment. The first process of the learning process will be described with reference to Fig. 4 .

[0034] The first process is a process of causing the generative model 111 to suppress the generation of data similar to the training data to be forgotten. Specifically, the first process causes the generative model 111 to suppress the generation of the image to be forgotten.

[0035] In this embodiment, in order to execute this first process, a discriminative model 121 is separately prepared. The discriminative model 121 discriminates the labels (0 to 4) of handwritten numeral images of, for example, 0 to 4.

[0036] Hereafter, the first image x １ is described as an image to be forgotten. The initial generative model 111 is generated from the first noise data z １ When input, the first image x １ It has been trained to generate

[0037] In the first process, noise data z is input to the generative model 111. The generative model 111 outputs an image x as generated data. In the first process, the generated image x is input to the discriminative model 121 to obtain a logit. The logit is the classification result for the image x by the discriminative model 121, and indicates to which label the input image x belongs. Among the logits, before the second process, the first noise data z １ The first image x generated by the generative model 111 with the input １ Let the logit for be the first logit.

[0038] In the first process, the first logit among the obtained logits is used as a loss, and the error is backpropagated to the generative model 111 to perform additional learning. That is, the generative model 111 performs additional learning on the first image x １ The architecture is such that it punishes the generation of the first image x １ Inhibits the production of

[0039] [Second Process] Fig. 5 is a diagram illustrating the learning process according to the embodiment. The second process will be described with reference to Fig. 5 .

[0040] By executing the first process, the first image x to be forgotten in the generative model 111 is １ Therefore, the generative model 111 after the first process is considered to suppress the generation of the first image x １ The first noise data z １ is input, an unclear image with distorted numbers will be output, and performing only the first process may lead to a decrease in the accuracy of the generative model 111.

[0041] Therefore, in the embodiment, after the first process, a second process is executed to correct the region (first region) of the image to be forgotten using a clear image other than the image to be forgotten. The second process is a process of executing additional learning on the generative model 111 so as to fill the region of the first image to be forgotten with another image.

[0042] First, in the second process, based on the entropy information of the logits in the first process (FIG. 5A), the corrupted image is corrected using another clear image (second image) generated in the area surrounding the first image. In this embodiment, an adversarial example is used to obtain the second image.

[0043] The loss used to generate Adversarial Examples is the entropy of the logit. We choose Adversarial Examples z that have a low entropy of the logit, in other words, that generate clear images. １ ' is the first noise data z １ Generated from

[0044] Adversarial Example z １ ' is input to the generative model 111, and the resulting image x １ ' is the first image x １ In the embodiment, the image is expected to be clearer than the Adversarial Example z １ ' is input to the generative model 111, and the resulting image x １ Let ' be the second image.

[0045] Then, in the second process, this second image x １ ' and the first image x １ The generative model 111 is subjected to additional learning using the backpropagation method so that the pixel error between the first image and the clear second image x is reduced. １ Therefore, in the second process, the first noise data z １ is input, the second image x １ Additional training is then performed to generate images similar to ´.

[0046] [Learning Device] A learning device according to an embodiment will be described below. Fig. 6 is a diagram showing an example of the configuration of a learning device according to an embodiment.

[0047] The learning device 10 according to the embodiment is a server device implemented by a computer or the like including, for example, a read-only memory (ROM), a random access memory (RAM), a central processing unit (CPU), etc., which loads a predetermined program into the computer and executes the predetermined program. The learning device 10 also has a communication interface for transmitting and receiving various information to and from other devices connected via a network or the like.

[0048] As shown in FIG. 6 , the learning device 10 includes a generation unit 11 , a classification unit 12 , a first processing control unit 13 , a data generation unit 14 , and a second processing control unit 15 .

[0049] The generator 11 has a generative model 111 that learns the features of training data and generates similar data. The generative model 111 is, for example, a VAE, and generates an image x when noise data z is input.

[0050] The discrimination unit 12 has a discrimination model 121 that discriminates the label to which input data belongs. For example, when an image x is input, the discrimination model 121 determines the label to which the input image x belongs and outputs the result as a logit. Among the logits, the first noise data z １ The first image x of the object to be forgotten generated by the generative model 111 based on the input １ Let the logit for be the first logit.

[0051] The first process control unit 13 controls the execution of the first process. The first process control unit 13 uses the first logit among the obtained logits as a loss and performs error backpropagation to the generative model 111 to generate a first image x １ Inhibits the production of

[0052] The data generating unit 14 generates a second image x to be used in the second processing. １ The second image x １ ' is data generated by inputting the adversarial examples of the training data to be forgotten into the generative model 111.

[0053] First, the data generating unit 14 generates the first noise data z １ Adversarial Example z １ The data generator 14 generates the first noise data z′ by using an algorithm such as FGSM or PGD. １ From Adversarial Example z １ ´ is generated.

[0054] Next, the data generator 14 generates Adversarial Example z １ ' is input to the generative model 111. As a result, the data generator 14 generates the Adversarial Example z １The second image x generated by the generative model 111 based on １ The second image x １ ' is the first image x １ Adversarial Example z such that the entropy of the logit for １ ' is an image generated by the generative model 111 based on the image.

[0055] The second processing control unit 15 controls the execution of the second processing. The second processing control unit 15 controls the execution of the first image x １ A second image x is a clear image around the area １ ' to correct the area of ​​the first image. For example, １ ' is the first image x １ The second processing control unit 15 generates the second image x １ ´ and the first image x １ The generative model 111 is subjected to additional learning using the backpropagation method so as to reduce the pixel error between the

[0056] 7 is a flowchart showing the processing steps of the learning process according to the embodiment. The learning device 10 performs a first process (step S1) to suppress generation of a first image to be forgotten, and then performs a second process (step S2) to correct an area of ​​the first image using a second image that is a clear image surrounding the area of ​​the first image.

[0057] [First Processing] Fig. 8 is a flowchart showing the processing procedure of the first processing shown in Fig. 7. The first processing is executed under the control of the first processing control unit 13. First, the generating unit 11 generates the first noise data z １ (Step S11) is input, and the first image x to be forgotten is generated by the generative model 111. １ (Step S12). Then, the classification unit 12 generates the first image x １ An identification process is then performed to identify the label to which the label belongs (step S13).

[0058] The first processing control unit 13 selects the first image x to be forgotten from the logits output from the classification unit 12. １The first process control unit 13 repeats the processes of steps S11 to S14 until a predetermined termination condition is met, and the first logit for the first image x １ Perform additional learning to suppress the generation of

[0059] [Second Processing] Fig. 9 is a flowchart showing the processing procedure of the second processing shown in Fig. 7. The second processing is executed under the control of the second processing control unit 15.

[0060] First, the data generating unit 14 generates the first noise data z １ is input (step S21), and the first noise data z １ Adversarial Example z １ The data generator 14 generates an Adversarial Example z′ (step S22). １ ' into the generative model 111, the second image x １ ' is generated (step S23).

[0061] The second processing control unit 15 processes the second image x １ ´ and the first image x １ The generative model 111 is subjected to additional learning using the backpropagation method so as to reduce the pixel error between the first and second inputs (step S24).

[0062] [Evaluation Experiment] The implementation of machine unlearning for the generative model 111 was evaluated using the method according to the embodiment.

[0063] First, the generative model 111 (VAE) was trained using labels 0 to 4 from the MNIST dataset of handwritten digit images. Adam was used for training, with a learning rate of 0.001 and 1000 epochs. If accuracy did not improve after 10 consecutive epochs, early stopping was performed.

[0064] Furthermore, handwritten digit images with labels 0 to 4 from the MNIST training data were used to train the discriminative model 121, and training was performed using Adam with a learning rate of 0.001 and 100 training epochs. The VAE model used in this evaluation experiment consisted of a three-layer encoder and a three-layer decoder. The dimension of the latent variable was set to 2. The object to be forgotten was set to label 0.

[0065] As the first and second processes according to the embodiment, additional learning is performed for 3000 epochs each, and corrective evaluation is performed based on the distribution of generated images when the latent variable z is moved from -2 to 2 for each dimension.

[0066] FIG. 10 shows the distribution of images generated by the VAE for latent variables. As a result of learning, it can be confirmed that the VAE generates images for each label (0 to 4) used in learning for the latent variables. Focusing particularly on label 0, which is the target of forgetting, it can be confirmed that it is distributed in the right region z = (1, 1) of the image (see frame W1). In this evaluation experiment, the region of frame W1 is the region to be forgotten.

[0067] 11 shows the distribution of images generated by the VAE for latent variables after the first process. In the image shown in Fig. 11, it can be seen that the image of label 0, which is the target of forgetting, has been crushed in the region (frame W1) where the image of label 0 was generated.

[0068] This is the effect of proceeding with additional learning so as to impose a penalty on the generative model 111 when the discriminative model 121 determines that the label is 0. As a result of this first process, the generative model 111 no longer generates images with a label of 0, and it can be said that forgetting the label 0 has been completed.

[0069] However, as shown in the frame W1 in Fig. 11, the accuracy of VAE generation is significantly reduced by the first process. Therefore, the generated image of the region to be forgotten (frame W1) is restored to a clear image by the second process.

[0070] In the second process, clear images are acquired from the periphery of the region to be forgotten. For example, in Fig. 10, images with label 3 are distributed in the upper left of the region to be forgotten (frame W1), images with label 2 are distributed to the left of the region to be forgotten (frame W1), and images with label 4 are distributed in the lower left of the region to be forgotten (frame W1). In the second process, images with labels 2, 3, and 4 adjacent to the image region with label 0 are used to recover the accuracy of the image region to be forgotten.

[0071] 12 is a diagram showing the distribution of images generated for latent variables by the VAE after the second process. As shown in FIG. 12, it can be seen that an image of label 3, for example, has been generated in the region to be forgotten (frame W1) by the VAE after the second process. This means that the region to be forgotten (frame W1) has been restored by the second process with the image of label 3 in the upper left of the region to be forgotten (frame W1), demonstrating the effectiveness of this embodiment.

[0072] [Effects of the Embodiment] In the embodiment, a first process is performed on the generative model to suppress the generation of data similar to the training data to be forgotten. Then, in the embodiment, after the first process, a second process is performed on the first region where the generation of data similar to the training data to be forgotten is suppressed, to correct the first region with data other than the training data to be forgotten. In this way, in the embodiment, by performing two-stage additional learning on the generative model, a machine unlearning technique for the generative model is realized, as shown in the evaluation experiment.

[0073] [System Configuration of the Embodiment] Each component of the learning device 10 is a functional concept and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the learning device 10 is not limited to that shown in the figure, and all or part of the functions can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0074] Furthermore, all or any part of the processes performed by the learning device 10 may be realized by a CPU and a program analyzed and executed by the CPU. Furthermore, each process performed by the learning device 10 may be realized as hardware using wired logic.

[0075] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0076] 13 is a diagram showing an example of a computer on which a program is executed to realize the learning device 10. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0077] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0078] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the program that defines each process of the learning device 10 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, on the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configuration of the learning device 10 is stored on the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0079] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0080] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0081] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0082] REFERENCE SIGNS LIST 10 Learning device 11 Generation unit 12 Identification unit 13 First processing control unit 14 Data generation unit 15 Second processing control unit 111 Generative model 121 Identification model

Claims

1. a generation unit having a generation model that learns the features of training data and generates similar data; a first processing control unit that controls execution of a first process that causes the generative model to suppress generation of data similar to the training data to be forgotten, based on a discrimination result of a discriminative model that discriminates a label to which input data belongs; a second processing control unit that controls execution of a second processing for correcting a first region in which generation of data similar to the training data to be forgotten is suppressed after the first processing, with data other than the training data to be forgotten; A learning device comprising:

2. 2. The learning device according to claim 1, wherein the other data is data generated by the generative model in a region surrounding the first region.

3. The learning device according to claim 2 , wherein the other data is data generated by inputting an adversarial example of the training data to be forgotten into the generative model.

4. the generative model is a generative model that generates an image when noise data is input, When an image is input, the discriminative model determines the label to which the input image belongs and outputs the result as a logit. the first processing control unit, among the logits, a logit for a first image to be forgotten, which was generated by the generative model in response to input of first noise data before the second processing, is set as a loss, and back-propagates the error to the generative model, thereby suppressing generation of the first image by the generative model; The learning device according to claim 1 , wherein the second processing control unit corrects the area of ​​the first image by using a second image surrounding the area of ​​the first image.

5. The learning device according to claim 4, wherein the second image is an image generated by the generative model based on an adversarial example that reduces the entropy of logits for the first image.

6. A learning method executed by a learning device, comprising: a step of controlling execution of a first process for causing a generative model that learns features of training data and generates similar data to suppress generation of data similar to the training data to be forgotten, based on a discrimination result of a discriminative model that discriminates the label to which input data belongs; After the first process, controlling execution of a second process for correcting a first region in which generation of data similar to the training data to be forgotten is suppressed with data other than the training data to be forgotten; A learning method comprising:

7. A step of controlling the execution of a first process in which a generative model that learns the features of training data and generates similar data based on the identification result of a discriminative model that identifies the label to which input data belongs suppresses the generation of data similar to the training data to be forgotten; After the first process, controlling execution of a second process for correcting a first region in which generation of data similar to the training data to be forgotten is suppressed with data other than the training data to be forgotten; A learning program that allows a computer to execute the above.