Data production method, data production program, and data production system

Abstract

This method is used in a system comprising a user terminal having a control unit and a user storage unit, and an operation device having a cryptographic operation unit which performs an operation including data encrypted by a homomorphic encryption scheme and an encrypted data storage unit which stores a machine learning model that outputs a prediction result from parent data. The method comprises: a step in which the control unit produces a public key and a private key; a step in which the control unit encrypts multiple pieces of parent data acquired from the user storage unit using the public key by the homomorphic encryption scheme; a next generation producing step in which the cryptographic operation unit and the control unit produce multiple pieces of child data on the basis of multiple prediction results outputted by inputting the encrypted multiple pieces of parent data to the machine learning model; an update step in which the encrypted data storage unit stores the produced multiple pieces of child data as the encrypted multiple pieces of parent data; and a step in which the next generation producing step and the update step are repeated.

Description

Data generation method, data generation program, and data generation system

[0001] The present disclosure relates to a data generation method, a data generation program, and a data generation system.

[0002] There are efforts to design optimal parameters using machine learning technology. For example, Patent Literature 1 discloses an invention related to materials informatics, a technology for efficiently developing new substances, that discovers new material candidates from a chemical database.

[0003] Special Publication No. 2022-516697

[0004] In recent years, in various fields, there has been a growing trend to utilize data not only in-house (including information on machine learning models) but also in collaboration with external companies and organizations. However, providing and utilizing highly confidential data to other companies poses security issues, such as information leaks and unauthorized use.

[0005] Therefore, the present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a data generation method that utilizes data held by each organization without disclosing the contents of the data, and makes it easy to design optimal parameters.

[0006] In order to achieve the above-mentioned object, the data generation method disclosed herein is a method used in a system including a user terminal having a control unit and a user memory unit that stores multiple parent data, and a calculation device having a cryptographic calculation unit that performs calculations including data encrypted using a homomorphic encryption method, and an encrypted data memory unit that stores a machine learning model that outputs prediction results from the parent data, and includes the following steps: a step in which the control unit generates a public key and a private key; a step in which the control unit encrypts the multiple parent data obtained from the user memory unit using a homomorphic encryption method using the public key; a next-generation generation step in which the cryptographic calculation unit and the control unit input the encrypted multiple parent data into the machine learning model and generate multiple child data based on the multiple prediction results output; an update step in which the encrypted data memory unit stores the generated multiple child data as multiple encrypted parent data; and a step in which the next-generation generation step and the update step are repeated.

[0007] In addition, in order to achieve the above-mentioned object, the data generation program disclosed herein is a program used in a system including a user terminal having a control unit and a user memory unit that stores multiple parent data, and a calculation device having a cryptographic calculation unit that performs calculations including data encrypted using a homomorphic encryption method, and an encrypted data memory unit that stores a machine learning model that outputs prediction results from the parent data, and includes a step in which the control unit generates a public key and a private key, a step in which the control unit encrypts the multiple parent data obtained from the user memory unit using the homomorphic encryption method using the public key, a next-generation generation step in which the cryptographic calculation unit and the control unit input the encrypted multiple parent data into the machine learning model and generate multiple child data based on the multiple prediction results output, an update step in which the encrypted data memory unit stores the generated multiple child data as multiple encrypted parent data, and a step in which the next-generation generation step and the update step are repeated.

[0008] In addition, in order to achieve the above-mentioned object, the data generation system of the present disclosure is a system comprising: a user terminal having a control unit and a user memory unit that stores multiple parent data; a calculation device having a cryptographic calculation unit that performs calculations including data encrypted using a homomorphic encryption method; and an encrypted data memory unit that stores a machine learning model that outputs prediction results from the parent data, and the system comprises: a step in which the control unit generates a public key and a private key; a step in which the control unit encrypts the multiple parent data obtained from the user memory unit using a homomorphic encryption method using the public key; a next-generation generation step in which the cryptographic calculation unit and the control unit input the encrypted multiple parent data into the machine learning model and generate multiple child data based on the multiple prediction results output; an update step in which the encrypted data memory unit stores the generated multiple child data as multiple encrypted parent data; and a step in which the next-generation generation step and the update step are repeated.

[0009] According to the present disclosure, it is possible to utilize data held by each organization without disclosing the contents of the data, making it easier to design optimal parameters.

[0010] 1 is an overall diagram of a data generation system 1. FIG. 1 is a diagram illustrating the hardware configuration of a terminal device 100. FIG. 2 is a block diagram illustrating the functional configuration of the terminal device 100. FIG. 2 is a diagram illustrating the data structure of material data. FIG. 3 is a diagram illustrating a specific example of material data. FIG. 4 is a diagram illustrating an example of a screen for setting material data to be searched. FIG. 5 is a diagram illustrating an example of a screen for setting a target variable. FIG. 6 is a diagram illustrating calculation of an evaluation value. FIG. 7 is a block diagram illustrating the functional configuration of a calculation device 200. FIG. 8 is a diagram illustrating an example of difficult-to-identify processing in embodiment 1. FIG. 9 is a diagram illustrating an example of difficult-to-identify processing in embodiment 1. FIG. 10 is a diagram illustrating an application example of a genetic algorithm. FIG. 11 is a sequence diagram illustrating processing in the data generation system 1. FIG. 12 is a sequence diagram illustrating processing in the data generation system 1. FIG. 13 is a diagram illustrating an example of difficult-to-identify processing in embodiment 2. FIG. 14 is a block diagram illustrating the functional configuration of a calculation device 300. FIG. 15 is a sequence diagram illustrating processing in a data generation system 2. FIG. 16 is an overall diagram of a data generation system 4. FIG. 17 is a block diagram illustrating the functional configuration of a terminal device 400. FIG. 18 is a block diagram illustrating the functional configuration of a calculation device 500. FIG. 19 is a sequence diagram illustrating processing in the data generation system 4.

[0011] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In all drawings describing the embodiments, common components are designated by the same reference numerals, and repeated explanations will be omitted. Note that the following embodiments do not unduly limit the content of the present disclosure described in the claims. Furthermore, not all of the components shown in the embodiments are necessarily essential components of the present disclosure.

[0012] <Outline of the Data Generation Method According to the Present Invention> There are efforts to utilize machine learning technology to design optimal parameters and use them in setting delivery routes, forecasting demand, designing the shapes of industrial products, developing new substances, etc. For example, in materials informatics, by using a predictive model generated by machine learning using a large amount of data in which the characteristics (composition, etc.) of chemical substances are used as explanatory variables and the properties (hardness, etc.) of those chemical substances are used as target variables, it is possible to reduce the effort required to actually conduct experiments to confirm the properties of new substances.

[0013] Furthermore, a genetic algorithm, which is an optimization algorithm that mimics natural evolution, is known as a method for searching for optimal parameters. A genetic algorithm is a method for repeatedly obtaining a population of offspring generations by applying survival selection operations such as crossover and mutation to a population of parent-generation individuals to search for better individuals. For example, by using a chemical substance having parameters searched for by such an algorithm and the above-mentioned prediction model, it is possible to efficiently develop new substances.

[0014] In recent years, there has been a growing trend for companies to collaborate with external companies and utilize the data they hold, creating a demand for a method for data collaboration while keeping highly confidential data confidential from other companies. According to the data generation method of the present invention, a model provider who provides a predictive model does not disclose to model users the data of the offspring that is being generated by a genetic algorithm, allowing the model users to use the predictive model without being able to guess it. Furthermore, the model users can obtain the final optimal solution without disclosing the data to be predicted to the model provider.

[0015] Specifically, this is achieved by using homomorphic encryption, which allows calculations to be performed on encrypted data. However, if all calculation steps were performed while the data was encrypted, the calculation costs would be enormous. Therefore, in order to prevent model users from guessing the prediction model, the survival selection operation for the parent generation population in the genetic algorithm is performed after executing a process that makes it difficult to identify the correct correspondence between the input and output of the prediction model, and the child generation population is generated based on the evaluation value of the prediction results.

[0016] This allows the efficient generation of offspring populations in the genetic algorithm, reducing computational costs, and also preventing prediction models from being guessed by model users.

[0017] As described above, in the data generation system 1 according to this embodiment, the survival selection operation for the parent generation population in the genetic algorithm is performed by rearranging the correspondence between the input (data to be predicted) and output (prediction result) of the prediction model, making it difficult to identify the correspondence between them so that the model user cannot guess the prediction model.

[0018] (Configuration of Data Generation System 1) Fig. 1 is an overall view of a data generation system 1. The overall view of the data generation system 1 according to this embodiment will be described with reference to Fig. 1 .

[0019] The data generation system 1 according to this embodiment includes one or more terminal devices 100 used by a user, and a computing device 200. The terminal devices 100 and the computing device 200 are communicatively connected via a network NW. The network NW is composed of a wide area network (WAN), a local area network (LAN), etc. In the data generation system 1, a user who wants to search for new substances uses, via the terminal device 100, the computing device 200 that provides prediction models owned by other organizations, etc.

[0020] The terminal device 100 accepts input from a user and transmits the input content to the arithmetic device 200 via the network NW. The terminal device 100 also receives data transmitted from the arithmetic device 200 via the network NW and presents the data to the user.

[0021] The arithmetic device 200 is a server of a model provider (or a platform provider of the data generation system 1) that provides a prediction model. The arithmetic device 200 performs arithmetic processing such as machine learning inference processing and searching for new substances using a genetic algorithm on the data transmitted from the terminal device 100 while keeping the data encrypted.

[0022] (Hardware Configuration of Terminal Device 100) Fig. 2 is a diagram showing the hardware configuration of the terminal device 100. The hardware configuration of the terminal device 100 according to this embodiment will be described with reference to Fig. 2 .

[0023] The terminal device 100 is a user terminal used by a user, and may be realized, for example, by a general-purpose computer such as a desktop or laptop PC (Personal Computer), or may be realized by a smartphone or tablet.

[0024] The terminal device 100 includes a processor 11 , a memory 12 , a storage 13 , a communication IF 14 , and an input / output IF 15 .

[0025] The processor 11 is hardware for executing an instruction set written in a program, and is composed of an arithmetic unit, a register, a peripheral circuit, and the like.

[0026] The memory 12 is for temporarily storing programs and data to be processed by the programs, etc. The memory 12 is realized by a volatile memory such as a DRAM (Dynamic Random Access Memory). The programs stored in the memory 12 are programs for executing the data generation method according to the present invention, etc.

[0027] The storage 13 is a storage device for saving data, and is realized by, for example, a flash memory, a hard disk drive (HDD), or the like.

[0028] The communication IF 14 is an interface for transmitting and receiving signals so that the terminal device 100 can communicate with external devices. For example, the communication IF 14 is a wireless communication device for wireless communication, a USB (Universal Serial Bus) connector for serial communication, or the like.

[0029] The input / output IF 15 is an interface between an input device for receiving input from a user and an output device for presenting information to the user. The input device is realized by, for example, a keyboard, a mouse, a touch panel, buttons, a microphone, etc. The output device is realized by, for example, a display, a printer, a speaker, etc.

[0030] The hardware configuration of the arithmetic device 200 may be the same as the hardware configuration of the terminal device 100 shown in Fig. 2. The arithmetic device 200 may be realized by a general-purpose computer such as a workstation, a server computer, a desktop personal computer (PC), a laptop PC, or the like, or may be logically realized by cloud computing. Similar to the terminal device 100 described above, the operation of each component of the arithmetic device 200 is realized by a processor 11 in accordance with a program stored in a memory 12.

[0031] (Functional Configuration of Terminal Device 100) Fig. 3 is a block diagram showing the functional configuration of the terminal device 100. The functional configuration of the terminal device 100 according to this embodiment will be described with reference to Fig. 3 .

[0032] The terminal device 100 includes a communication unit 110 , an input unit 120 , an output unit 130 , a storage unit 140 , and a control unit 150 .

[0033] The communication unit 110 performs processing for the terminal device 100 to communicate with the arithmetic device 200 or other devices. The other devices may be a PC connected via a network, a smartphone, a tablet, or an XR (Cross Reality) (AR: Augmented Reality, MR: Mixed Reality, VR: Virtual Reality) terminal. The other devices may also be input / output devices, such as a flash memory or HDD, that input and output data.

[0034] The communication unit 110 also transmits and receives data via a secure communication channel with devices connected via the network NW or locally, etc. The construction of a secure communication channel and the communication method are well-known techniques using a common key (such as a session key) or a public key, and therefore a description thereof will be omitted.

[0035] The input unit 120 is an interface that accepts user input to the terminal device 100. The input unit 120 is, for example, but not limited to, a keyboard, a touch panel, a display panel in the virtual space, or a microphone that detects voice input. The user can input parameters and the like required for searching for a new substance via the input unit 120. Examples of parameters include explanatory variables of the search target, search constraints, a response variable to be predicted, a target value of the response variable, and a priority (weight).

[0036] A search stop condition may also be input. The stop condition may be, for example, the number of generations to be generated by the genetic algorithm, a threshold value for the evaluation value (described later), or the maximum execution time required for the search. Input examples will be described with reference to FIGS. 6 and 7.

[0037] The output unit 130 is an interface that outputs information to notify the user of the terminal device 100. The output unit 130 is, for example, but not limited to, a display or a speaker that outputs audio. The output unit 130 displays data received from the arithmetic device 200 or the like on a display.

[0038] The storage unit 140 is configured with, for example, volatile memory such as RAM, flash memory, or an HDD, and stores data used by the terminal device 100 and computer programs used for various processes. The computer programs may be installed from a predetermined server or the like, or may be installed using a known setup program from a computer-readable portable recording medium. Examples of the portable recording medium include a CD-ROM (Compact Disc Read Only Memory) and a DVD-ROM (Digital Versatile Disc Read Only Memory).

[0039] The storage unit 140 functions as a “user storage unit” and includes a key storage unit 141 and a material database 142 .

[0040] The key storage unit 141 stores a public key and a private key generated by the control unit 150 (described later). The public key and the private key may be managed in a secure key management system (KMS) connected to the terminal device 100 via a network or directly. The key storage unit 141 may store multiple pairs of public and private keys, or may store a communication key (session key).

[0041] The material database 142 is a database that stores multiple pieces of material data. The multiple pieces of material data are unknown material data to be searched for, but may also include known material data. The material database 142 stores the multiple pieces of material data to be searched for as multiple parent data for the genetic algorithm. The material database 142 may also store material data (child data) that are the search results.

[0042] The material data includes information indicating a plurality of characteristics of the material and information regarding a plurality of properties. The data structure of the material data will be described with reference to FIG.

[0043] The control unit 150 is a processor such as a CPU (Central Processing Unit) that controls each function of the terminal device 100 and operates based on a program stored in advance in the storage unit 140 .

[0044] The control unit 150 includes a key generation unit 151 , an encryption / decryption unit 152 , and an evaluation value calculation unit 153 .

[0045] The key generation unit 151 generates a pair of a public key and a private key for encrypting data or for decrypting encrypted data. The generated public key and private key are stored in the key storage unit 141.

[0046] The encryption / decryption unit 152 encrypts the multiple parent data stored in the material database 142 using the generated public key with homomorphic encryption. Examples of homomorphic encryption methods include the Paillier method, the Lifted-ElGamal method, the Somewhat Homomorphic Encryption method, and the Fully Homomorphic Encryption method. As described above, the material data includes information indicating multiple characteristics of the material, and the encryption / decryption unit 152 encrypts each value of each characteristic.

[0047] The encryption / decryption unit 152 also decrypts encrypted data received from the arithmetic device 200 using a private key paired with the public key.

[0048] The evaluation value calculation unit 153 calculates an evaluation value for a target value from the prediction result (predicted value) output by a prediction model (described later) of the arithmetic device 200. The evaluation value is a value that indicates the degree of difference between two values, and may be evaluated using a well-known method, such as absolute difference, squared difference, relative error, a specific index, weighting, or the like. In this embodiment, the evaluation value is the absolute difference between the prediction result and the target value. For example, if the prediction result is "20" and the target value is "24", the evaluation value is the absolute difference between the target value and the prediction result, "4" (=|20-24|).

[0049] 4 is a diagram showing the data structure of the material data, which will be described with reference to FIG.

[0050] The material data 1000 includes a material ID 1100, information 1200 indicating the characteristics of the material, and information 1300 indicating the properties of the material.

[0051] The material ID 1000 is an identifier for identifying each of a plurality of material data.

[0052] The information 1200 indicating the characteristics of the material is, for example, the substances that make up the material and is expressed as a plurality of explanatory variables x1 to xn. For each piece of material data, numerical values ​​such as experimental values ​​and calculated values ​​are input as information indicating the characteristics of the material. Note that the explanatory variables are not limited to information indicating the characteristics of the material, and may also include information indicating the process conditions (temperature, pressure, time, etc.) in the reaction process or production process of the material.

[0053] The information 1300 indicating the characteristics of the material is, for example, the physical, chemical, mechanical, and electrical characteristics of the material, such as the density, hardness, conductivity, and strength of the material, and is expressed as a plurality of objective variables y1 to ym.

[0054] If the material data identified by the material ID 1100 is unknown material data to be searched for, a symbol or the like indicating that the information is unknown is input into the information indicating the material properties 1300. On the other hand, if the material identified by the material ID 1100 is a known material, a numerical value such as an experimental value or a calculated value of the property is input into the information indicating the material properties 1300.

[0055] As explained in FIG. 3, in the example of FIG. 4, the encryption / decryption unit 152 of the terminal device 100 encrypts each cell (explanatory variable) of the unknown material data to be searched.

[0056] 5 is a diagram showing a specific example of material data, and a specific example of material data stored in the material database 142 will be described with reference to FIG.

[0057] The material data 2000 is a data set including a material ID, a material feature (explanatory variable), and a material property (objective variable).

[0058] In the example of FIG. 5, the material features include "raw material A," "raw material B," "raw material C," ..., "additive X," "additive Y," and "additive Z" that make up the material. Also, the material properties include the "viscosity" of the material. Note that although there is one objective variable in the example of FIG. 5, there may be multiple objective variables.

[0059] For each material ID that identifies a material, the characteristics (explanatory variables) of the material are associated with the properties (objective variables). Numerical values, such as experimental values, that indicate the characteristics of each material are input into the explanatory variables. "NULL," indicating that no numerical value exists, is input into the objective variable of the material data to be searched, but a numerical value is input into the objective variable of a known material.

[0060] The material data identified by material IDs "1" to "5" are the material data to be searched, and "NULL" is input as the viscosity, which is the objective variable. Specifically, when the material ID is "1", the following values ​​are input: raw material A is "80", raw material B is "0", raw material C is "0", ..., additive X is "4", additive Y is "0", additive Z is "8", and viscosity is "NULL". The material data to be searched is stored in the material database 142 as parent data for the genetic algorithm. In other words, the multiple parent data are a data set in which records containing values ​​corresponding to multiple explanatory variables are arranged in a predetermined order.

[0061] Material data identified by material IDs "51" to "55" is known material data, and numerical values ​​are input as explanatory variables and target variables. Specifically, when the material ID is "51," the following values ​​are input: raw material A is "40," raw material B is "0," raw material C is "0," ..., additive X is "2," additive Y is "0," additive Z is "8," and viscosity is "10." The known material data may be, for example, material data that has been searched for, or material data whose actual measured values ​​are known in advance. The known material data may be used as training data for machine learning.

[0062] 6 is a diagram showing an example of a screen for setting material data to be searched for. An example of setting material data to be searched for will be described with reference to FIG.

[0063] Screen 3000 includes information 3100 indicating the characteristics of the material, a selection field 3200, and information 3300 indicating the range. Screen 3000 is displayed, for example, on output unit 130 of terminal device 100. The user inputs parameters necessary for searching for material data via input unit 120.

[0064] The information 3100 indicating the material indicates the characteristics (explanatory variables) of the material data. For example, in the example of Fig. 6, all of the explanatory variables shown in Fig. 5 are shown, but it is also possible to show only specific variables among the explanatory variables, or to have the user input explanatory variables or select them using a pull-down menu.

[0065] A selection column 3200 shows check boxes for selecting explanatory variables to be optimized among the explanatory variables. In the example of Fig. 6, "Additive X," "Additive Y," and "Additive Z" are selected as the optimization targets.

[0066] The range information 3300 indicates the constraint conditions for the explanatory variables selected as the optimization targets. In the example of FIG. 6, the user can input minimum and maximum values ​​as parameters and set the optimization to be performed within these value ranges. That is, in the example of FIG. 6, the system is set to search for material data in which, among the material characteristics, "Additive X" falls within the range of "0 to 10," "Additive Y" falls within the range of "2 to 5," and "Additive Z" falls within the range of "0 to 3."

[0067] 7 is a diagram showing an example of a screen for setting a response variable. An example of setting a response variable to be predicted will be described with reference to FIG.

[0068] The screen 4000 includes information 4100 indicating the objective variable, a selection field 4200, information 4300 indicating the target value, and information 4400 indicating the weight. The screen 4000 is displayed, for example, on the output unit 130 of the terminal device 100. The user inputs parameters necessary for setting the objective variable via the input unit 120.

[0069] The information 4100 indicating the objective variables indicates the characteristics (objective variables) of the material data. For example, in the example of Fig. 7, the material characteristics such as strength, solubility, ..., viscosity, conductivity, and resistance are shown. The objective variables may be input by the user or may be selected from a pull-down menu.

[0070] The selection field 4200 shows check boxes for selecting the response variables to be predicted. In the example of Fig. 7, "solubility" and "viscosity" are selected as the targets to be predicted. Note that multiple response variables may be selected, or only one may be selected.

[0071] The target value information 4300 indicates the target values ​​of the objective variables, and sets the final values ​​of the objective variables of the searched material data. In the example of Fig. 7, the target values ​​are set as "10" for "solubility" and "40" for "viscosity."

[0072] The weight information 4400 is a parameter that indicates which objective variable is to be emphasized when multiple objective variables are selected. In the example of Fig. 7, the weights have a setting range of 0 to 100, and "40" is input for "solubility" and "60" for "viscosity." In other words, it is set so that material data is searched for with emphasis on "viscosity."

[0073] 8 is a diagram illustrating the calculation of an evaluation value. An example of a method in which the evaluation value calculation unit 153 of the control unit 150 in the terminal device 100 calculates an evaluation value will be described with reference to FIG.

[0074] The example in FIG. 8 shows the evaluation value for each material ID when viscosity is used as the response variable and its target value is "40." The evaluation value represents the distance (absolute difference) between the target value and the predicted value of the response variable. For material ID "11," the predicted viscosity value is "20," so the distance from the target value "40" is calculated as "20" (=|40-20|).

[0075] Similarly, for material ID "13," the predicted viscosity value is "50," so the distance from the target value "40" (=|40-50|) is calculated as the evaluation value.

[0076] In the example of FIG. 8, among the material IDs "11" to "15," the evaluation value of the material ID "14" is "0," indicating that the predicted value of the objective variable of the material ID "14" has achieved the target value.

[0077] (Functional Configuration of Arithmetic Device 200) Fig. 9 is a block diagram showing the functional configuration of the arithmetic device 200. The functional configuration of the arithmetic device 200 according to the first embodiment will be described with reference to Fig. 9 .

[0078] The arithmetic device 200 includes a communication unit 210 , an input unit 220 , an output unit 230 , a storage unit 240 , and a control unit 250 .

[0079] The communication unit 210 performs processing for the arithmetic device 200 to communicate with the terminal device 100 and other devices. The communication unit 210 has the same function as the communication unit 110 of the terminal device 100, and therefore a duplicated description will be omitted.

[0080] The input unit 220 is an interface that accepts user input to the arithmetic device 200. The input unit 220 is, for example, a keyboard, a touch panel, or a microphone that detects voice input, but is not limited to these.

[0081] The output unit 230 is an interface that outputs information to notify a user of the arithmetic device 200. The output unit 230 is, for example, a display or a speaker that outputs audio, but is not limited to these. For example, the output unit 230 displays data received from the terminal device 100 or the like on a display.

[0082] The storage unit 240 is configured, for example, with a volatile memory such as RAM, a flash memory, an HDD, etc., and stores data used by the arithmetic device 200 and computer programs used for various processes. The storage unit 240 has the same function as the storage unit 140 of the terminal device 100, and therefore a duplicated description will be omitted.

[0083] The storage unit 240 functions as an “encryption data storage unit” and includes a model database 241 and a parent data storage unit 242 .

[0084] The model database 241 stores a prediction model constructed by machine learning using material data, which has material features as explanatory variables and material properties as objective variables, as training data. Specifically, the training data is a data set in which, for each of a plurality of material data, values ​​of multiple explanatory variables related to the material features are associated with values ​​of one or multiple objective variables related to the material properties.

[0085] A prediction model is a machine learning model that outputs a prediction result from parent data acquired from the terminal device 100. The model database 241 may store multiple prediction models. The prediction models may have different model construction algorithms, such as linear regression, logistic regression, support vector machine (SVM), or neural network, different amounts of training data, different labeling accuracy, different selection of explanatory variables, different preprocessing, or different learning process parameters.

[0086] The parent data storage unit 242 stores encrypted parent data acquired from the terminal device 100. The parent data storage unit 242 also updates and stores, as parent data, child data generated by the next-generation generation unit 252 (described later). The parent data acquired from the terminal device 100 is, in other words, material data to be searched.

[0087] The control unit 250 is a processor such as a CPU (Central Processing Unit) that controls each function of the arithmetic device 200 and operates based on a program stored in advance in the storage unit 240 .

[0088] The control unit 250 functions as a “cryptographic calculation unit” that performs calculations including data encrypted using homomorphic encryption, and has a prediction unit 251, a next-generation generation unit 252, and an identification-obfuscation unit 253.

[0089] The prediction unit 251 outputs a prediction result of the objective variable from the parent data encrypted using homomorphic encryption based on the prediction model in the model database 241. Specifically, the prediction unit 251 selects a prediction model in the model database 241 according to the objective variable set in the terminal device 100. The prediction unit 251 then encrypts the prediction model using homomorphic encryption with the public key of the terminal device 100. Next, the prediction unit 251 inputs the parent data into the encrypted prediction model and outputs a predicted value of the objective variable. The output predicted value has been encrypted using homomorphic encryption with the public key of the terminal device 100 and is not disclosed to the user of the arithmetic device 200.

[0090] The next-generation generation unit 252 applies a genetic algorithm to multiple parent data items that satisfy a predetermined condition from among the multiple encrypted parent data items, thereby generating multiple child data items. The predetermined condition may be, for example, data items with an evaluation value within the top 10 or data items with an evaluation value within a predetermined threshold value. Alternatively, the genetic algorithm may be applied to parent data items randomly selected from the data items that satisfy the condition, or to multiple parent data items including randomly selected parent data items and parent data items extracted based on the evaluation values. The generation of child data using a genetic algorithm is outlined in FIG. 12 , but because genetic algorithms are well-known technology, a detailed description thereof will be omitted here.

[0091] The difficult-to-identify unit 253 performs a process of rearranging the correspondence between inputs (parent data) and outputs (prediction results) to a prediction model. The difficult-to-identify unit 253 also performs a process of returning the rearranged correspondence to its original state (cancelling the difficult-to-identify process). By performing the rearrangement process, the correct correspondence between inputs and outputs for the prediction model can be concealed, thereby preventing the prediction model from being estimated.

[0092] The identification-obscuring unit 253 may also perform a process of rearranging the correspondences of explanatory variables included in multiple child data (material data). This allows the correct correspondences between child data (inputs) and outputs to be kept secret, thereby preventing the prediction model from being inferred. Specific examples of the rearranging process will be described with reference to FIGS. 10 and 11.

[0093] 10 is a diagram showing an example of the difficult-to-identify process in embodiment 1. As the difficult-to-identify process, a process of rearranging the correspondence between explanatory variables and objective variables of material data will be described with reference to FIG.

[0094] The material data 5100 is a data set in which explanatory variables relating to the characteristics of a material correspond to objective variables relating to the properties of the material. A material ID 5110 and a material ID 5120 indicate the same identifier. For example, the explanatory variables of material ID "1" correspond to the objective variable of material ID "1."

[0095] Material data 5200 is a data set obtained after performing a process for making material data 5100 difficult to identify, in which the correspondence between explanatory variables and response variables is rearranged. Material ID 5210 corresponds to material ID 5110 and indicates the same identifier. Material ID 5220 is obtained by rearranging the identifiers (numbers) of material ID 5120. For example, the explanatory variable for material ID "1" is associated with the response variable for material ID "4" (viscosity "30") rather than the response variable for material ID "1" (viscosity "20"). Similarly, the explanatory variable for material ID "2" is associated with the response variable for material ID "1" (viscosity "20") rather than the response variable for material ID "2" (viscosity "10"). In this way, the difficult-to-identify process rearranges the correspondence between explanatory variables and response variables. After the rearrangement, a new identifier, for example, temporary material ID 5230, may be assigned.

[0096] When the prediction results are sent to the terminal device 100, the rearranged prediction results are sent, making it impossible for the terminal device 100 to identify the correct predicted value of the objective variable corresponding to the explanatory variable for the material ID. In other words, the user of the terminal device 100, who is the model user, is unable to obtain material data consisting of explanatory variables and objective variables, and therefore has difficulty inferring a prediction model based on this material data. Therefore, the model provider can allow the model user to use the prediction model without having the model user infer the prediction model.

[0097] Furthermore, the difficult-to-identify unit 253 can cancel the difficult-to-identify process by storing the correspondence between the material ID 5220 and the temporary material ID 5230.

[0098] 11 is a diagram showing an example of the difficult-to-identify process in embodiment 1. Referring to FIG. 11, a process of rearranging the correspondence relationships of explanatory variables of material data will be described as the difficult-to-identify process.

[0099] The material data 5300 is a data set of parent data configured from explanatory variables related to the characteristics of the material. The material data 5400 is a data set obtained by performing a difficult-to-identify process on the explanatory variables of the material data 5300.

[0100] As a process for making it difficult to identify, the values ​​corresponding to the explanatory variable "raw material A" for each material ID in the material data 5300 are rearranged. For example, the values ​​corresponding to "raw material A" for material IDs "21" to "25" are "80", "10", "20", "70", and "30", respectively. However, by rearranging the values, the values ​​corresponding to "raw material A" become "10", "80", "70", "30", and "20", respectively. Similarly, the values ​​corresponding to "raw material B" for material IDs "21" to "25" are "10", "80", "20", "30", and "70", respectively. However, by rearranging the values, the values ​​corresponding to "raw material B" become "20", "30", "10", "70", and "80", respectively.

[0101] In this way, rearranging the correspondence between the explanatory variables results in a data set indicated by material data 5400. That is, for example, the material data identified by material ID "21'" is composed of "raw material A" = "10," "raw material B" = "20," "raw material C" = "80," ..., "additive X" = "0," "additive Y" = "6," and "additive Z" = "0." By performing the difficult-to-identify process on the material data 5300, the material data identified by material ID "21" becomes difficult to identify from the material data 5400.

[0102] 11, the correspondence relationships of all explanatory variables in the material data 5300 are rearranged, but if it becomes difficult to identify each material data, the difficult-to-identify process may be performed on only some of the explanatory variables. Furthermore, the difficult-to-identify unit 253 can cancel the difficult-to-identify process by storing the correspondence relationships between each explanatory variable and the rearranged material ID.

[0103] Fig. 12 is a diagram showing an application example of a genetic algorithm. With reference to Fig. 11, a process of generating child data (material ID "C1" and material ID "C2") from parent data (material ID "1" and material ID "5") by a genetic algorithm when optimizing explanatory variables "additive X", "additive Y", and "additive Z" of material data 6100 will be described.

[0104] In a genetic algorithm, two individuals from the N parent generation individuals (each piece of material data) are selected and crossed over, or one is selected and mutated, or copied as is. This process is repeated until the number of individuals in the child generation reaches N. Once the number of children reaches N, the child generation is updated as the parent generation, and the same process is repeated. For example, after repeating the process a predetermined number of times, the parent generation individual with a good evaluation value (i.e., close to the target value) is output as the "solution."

[0105] 12, when performing single-point intersection for the material data of material ID "1" and material ID "5," first, the intersection location is selected randomly. In the material data 6100, the intersection point between additive X and additive Y is set as intersection point L1.

[0106] Then, the data after the intersection point L1 is swapped. In the material data 6100, if the data is arranged from raw material A to additive Z, the values ​​of "additive Y" and "additive Z" of material ID "1" after the intersection point L1 are swapped with the values ​​of "additive Y" and "additive Z" of material ID "5".

[0107] The material data 6200 is child data (material ID "C1" and material ID "C5") generated by crossover. By crossover, material data with compositions different from those of material ID "1" and material ID "5" are generated for "additive X," "additive Y," and "additive Z."

[0108] (Processing in Data Generation System 1) Fig. 13 is a sequence diagram showing processing in the data generation system 1. With reference to Fig. 13, a process will be described in which, in the data generation system 1, next-generation child data is generated from material data (parent data) to be searched that has been input to the terminal device 100 (next-generation generation step), and the child data is updated as parent data (update step).

[0109] FIG. 13 shows an example of processing in the terminal device 100 and the calculation device 200 (particularly, the prediction unit 251, the next-generation generation unit 252, and the identification-compromising unit 253).

[0110] In step S100, parameters and the like are set in the data generation system 1. Specifically, the key generation unit 151 of the terminal device 100 generates a public key and a private key and stores them in the key storage unit 141 of the storage unit 140. The terminal device 100 also transmits the generated public key to the calculation device 200, and the calculation device 200 stores the public key in the storage unit 240.

[0111] The terminal device 100 also acquires parameters necessary for searching for material data. The parameters are, for example, a response variable, a target value, or an explanatory variable to be optimized. The parameters may also be stopping conditions such as the number of times the next-generation generation step and the update step are repeated in the computing device 200, or the maximum execution time of the algorithm. The optimal stopping conditions may be set in advance by the developer of the data generation system 1, and may be changed by the user of the terminal device 100 as needed.

[0112] Furthermore, the terminal device 100 acquires a plurality of pieces of material data to be searched for as a plurality of parent data, and stores them in the material database 142 of the storage unit 140 .

[0113] In step S101, the encryption / decryption unit 152 of the terminal device 100 reads out multiple parent data items to be searched from the material database 142 and encrypts them using the generated public key by homomorphic encryption. The parent data items are encrypted in explanatory variable units (cell units).

[0114] In step S102, the communication unit 210 of the arithmetic device 200 acquires the plurality of parent data encrypted by the terminal device 100, and the parent data storage unit 242 stores the acquired plurality of parent data.

[0115] In step S103, the prediction unit 251 of the calculation device 200 predicts the properties of the material. Specifically, the prediction unit 251 reads a prediction model corresponding to the objective variable set in step S100 from the model database 241. The prediction unit 251 then inputs multiple parent data, which are material data to be searched, into the prediction model and outputs multiple prediction results (predicted values) corresponding to each of the parent data. Note that the prediction model is encrypted with a public key obtained from the terminal device 100 (i.e., the public key used to encrypt the parent data) so that it is in the same encryption space as the encrypted multiple parent data. This allows for efficient calculations and output of prediction results.

[0116] In step S104 , the identification-compromising unit 253 acquires the multiple prediction results output by the prediction unit 251 .

[0117] In step S105, the identification-compromising unit 253 performs an identification-compromising process on the output prediction results, making it difficult to identify the prediction results corresponding to the parent data. Specifically, the identification-compromising unit 253 performs a process of rearranging the correspondence between the inputs (explanatory variables) and outputs (target variables) of the prediction model, as shown in Fig. 10. The identification-compromising unit 253 stores the rearranged correspondence.

[0118] In step S106, the communication unit 110 of the terminal device 100 acquires, via the communication unit 210 of the arithmetic device 200, a plurality of prediction results on which the identification-hardening process has been executed.

[0119] In step S107, the encryption / decryption unit 152 of the terminal device 100 reads the private key from the key storage unit 141 and uses the private key to decrypt the acquired multiple prediction results for which the identification-obfuscating process has been performed. The prediction results are disclosed to the user of the terminal device 100, but because the correspondence between the explanatory variables of the parent data and the objective variables (prediction results) was rearranged in step S105, it is not possible to know which parent data the prediction result corresponds to. In other words, because the inputs and outputs of the prediction model are not disclosed to the user of the terminal device 100 in the correct correspondence, it is difficult for the user to infer the prediction model. The provider of the prediction model can allow model users to utilize the prediction model while keeping it confidential.

[0120] In step S108, the evaluation value calculation unit 153 of the terminal device 100 calculates, from the decoded prediction results, a plurality of evaluation values ​​for the respective target values ​​of the plurality of prediction results. Specifically, the evaluation value calculation unit 153 calculates the distance between the target value set in step S100 and the prediction result (predicted value). Note that, in this embodiment, the absolute difference is calculated as the distance, but any calculation method may be used as long as the value indicates how much the target value and the predicted value differ.

[0121] In step S109, the difficult-to-identify unit 253 of the arithmetic device 200 acquires the multiple evaluation values ​​calculated in step S108 via the communication unit 210. The multiple evaluation values ​​are transmitted to the arithmetic device 200 in a manner that allows the correspondence between the evaluation values ​​and the prediction results used to calculate the evaluation values ​​to be known. For example, an identifier corresponding to an ID that identifies the prediction result may be assigned to the evaluation value, and transmitted to the arithmetic device 200 together with the correspondence between the evaluation value and the prediction result.

[0122] Note that the evaluation value is not encrypted in the terminal device 100, and therefore is disclosed to the user of the calculation device 200. However, the explanatory variables of the material data input to the prediction model and the prediction results cannot be obtained from the evaluation value. In other words, the user of the calculation device 200 is not informed of the characteristics (objective variables) of the material data for which the features (explanatory variables) are known, making it difficult to obtain the material data to be predicted. Model users can use the prediction model while concealing the material data to be searched from the model provider.

[0123] In step S110, the difficult-to-identify unit 253 of the arithmetic device 200 cancels the difficult-to-identify process for the multiple prediction results corresponding to the multiple acquired evaluation values. Specifically, the difficult-to-identify unit 253 executes a process to restore the correspondence relationships rearranged in step S105 to the original relationships, and makes the prediction results for the explanatory variables of the parent data have correct correspondence relationships.

[0124] In step S111, the next-generation generation unit 252 of the computing device 200 obtains a plurality of evaluation values ​​corresponding to a plurality of parent data via a plurality of prediction results for which the identification-hardening process has been canceled. Because the parent data and the prediction results correspond to each other and the prediction results correspond to evaluation values ​​calculated from the prediction results, it is possible to obtain evaluation values ​​corresponding to the parent data via the prediction results.

[0125] In step S112, the next-generation generation unit 252 generates the next generation. Specifically, the next-generation generation unit 252 extracts multiple parent data corresponding to evaluation values ​​that satisfy a predetermined condition. Then, the next-generation generation unit 252 applies a genetic algorithm to the extracted multiple parent data to generate multiple child data. The predetermined condition may be, for example, the evaluation value being within the top 10 or the evaluation value being within a predetermined threshold. An example of applying the genetic algorithm is shown in FIG. 11. Because the material data is encrypted for each explanatory variable, the generated child data is not disclosed to the user of the arithmetic device 200.

[0126] In step S113, the identification-compromising unit 253 acquires the generated plurality of child data.

[0127] In step S114, the difficult-to-identify unit 253 performs difficult-to-identify processing on the explanatory variables of the generated child data. Specifically, as described with reference to FIG. 11 , the correspondence relationships between the explanatory variables included in each child data are rearranged.

[0128] In step S115, the communication unit 110 of the terminal device 100 acquires a plurality of child data items that have been subjected to the identification-hardening process.

[0129] In step S116, the encryption / decryption unit 152 of the terminal device 100 re-encrypts the multiple child data. Specifically, the encryption / decryption unit 152 reads the private key from the key storage unit 141 and uses the private key to decrypt the multiple child data acquired in step S115. Furthermore, the encryption / decryption unit 152 reads the public key from the key storage unit 141 and re-encrypts the decrypted multiple child data using the public key by homomorphic encryption. The child data is encrypted in units of explanatory variables.

[0130] The re-encryption process performed in step S116 is necessary to control errors that accumulate during the process of operations using homomorphic encryption and to continue to perform operations efficiently. For the re-encryption process, the child data is decrypted in step S116. However, even if the child data is decrypted, the user of the terminal device 100 cannot identify the child data because the child data has been subjected to the identification-obfuscation process in step S114.

[0131] In step S117 , the identification-obfuscating unit 253 of the arithmetic device 200 acquires the re-encrypted child data via the communication unit 210 .

[0132] In step S118, the difficult-to-identify unit 253 cancels the difficult-to-identify process for the explanatory variables of the plurality of child data. Specifically, the difficult-to-identify unit 253 performs rearrangement to restore the correspondence relationships of the explanatory variables executed in step S114 to their original state.

[0133] In step S119, the next-generation generating unit 252 of the arithmetic device 200 acquires a plurality of child data items for which the difficult-to-identify processing has been cancelled.

[0134] In step S120, the next-generation generation unit 252 updates the child data as parent data. Specifically, the next-generation generation unit 252 stores the child data acquired in step S119 in the parent data storage unit 242. That is, the parent data storage unit 242 stores the multiple child data as multiple encrypted parent data.

[0135] In step S121, the prediction unit 251 of the arithmetic device 200 obtains a plurality of encrypted parent data.

[0136] As described above, the processes from step S103 to step S119 are a next-generation generation step in which the control unit 250 of the arithmetic device 200 and the control unit 150 of the terminal device 100 input encrypted parent data into a machine learning model and generate multiple child data based on multiple prediction results output. Also, step S120 is an update step in which the parent data storage unit 242 of the arithmetic device 200 stores the generated multiple child data as multiple encrypted parent data.

[0137] After step S121, the processes performed in steps S103 to S120 are repeated to repeatedly generate child data for the next generation.

[0138] The re-encryption process performed in step S116 may be omitted if the operation using homomorphic encryption can be performed in a realistic time depending on the homomorphic encryption algorithm, the processing performance of the computing device 200, etc. If the re-encryption process is omitted, the multiple child data generated by the next-generation generation unit 252 in step S112 are then updated as parent data in step S120. In other words, because the re-encryption process is not performed in the terminal device 100 (the child data is not decrypted), there is no need to perform the identification-obfuscation process to conceal the child data, and the processes of steps S113 to S119 can be omitted.

[0139] Fig. 14 is a sequence diagram showing the processing in the data generating system 1. The processing of outputting the searched material data, which is performed after the processing shown in Fig. 13, will be described with reference to Fig. 14.

[0140] In step S200, a step of repeating the next generation generation step and the update step is performed between the terminal device 100 and the calculation device 200. The number of repetitions may be input as a setting parameter in step S100 of FIG.

[0141] In step S201, the prediction unit 201 of the calculation device 200 acquires the multiple parent data items updated in step S200 (i.e., the multiple child data items generated), inputs them into a prediction model, and outputs a prediction result.

[0142] In step S202, the communication unit 110 of the terminal device 100 acquires, as search results using the genetic algorithm, the parent data input to the prediction model in step S201 and prediction results corresponding to the parent data.

[0143] In step S203, the encryption / decryption unit 152 of the terminal device 100 reads the private key from the key storage unit 141 and decrypts the acquired parent data and prediction result.

[0144] Through the above process, the user of the terminal device 100 can obtain the material data to be searched and the predicted value of the objective variable predicted from the material data.

[0145] In the data generation system 1 according to this embodiment, the search target is material data, but other parameters related to design (shape, appearance, dimensions, etc.), specifications (functionality, performance, standards, etc.), delivery route optimization, and demand forecasting can also be search targets, for example, in the manufacturing process of industrial products.

[0146] (Explanation of Effects) According to the data generation method of the present invention, unknown material data is searched for by using homomorphic encryption, which enables calculations on encrypted data, and material data generated by a genetic algorithm and a prediction model that predicts the characteristics of the material data. Here, a survival selection operation for a parent generation population in the genetic algorithm is performed after execution of a process that makes it difficult to identify the correspondence between the input (data to be predicted) and output (prediction results) of the prediction model, and a child generation population is generated based on an evaluation value for the prediction results. This prevents model users from guessing the prediction model, and allows predictive model providers to allow model users to utilize the prediction model while keeping it confidential.

[0147] Furthermore, in the genetic algorithm, the next generation population can be generated efficiently, and the calculation cost can be reduced.

[0148] In addition, model users can use the prediction model without disclosing the data to be predicted to the model provider (or platform provider).

[0149] Furthermore, according to the data generation method of the present invention, the identification-obfuscating process is realized by rearranging the correspondence relationships, which makes it possible to conceal sensitive data while reducing the computational cost compared to encryption using an encryption key.

[0150] Furthermore, according to the data generation method of the present invention, in relation to the re-encryption process required to control errors accumulated during computation using homomorphic encryption and continue to efficiently execute computations, an obfuscation process is performed on the explanatory variables of the child data before the child data is decrypted for re-encryption. This prevents a model user from identifying the child data even if the child data is decrypted. Therefore, the child generation data being generated by the genetic algorithm can be kept secret from the model user, and the prediction model can be prevented from being inferred based on the child generation data and prediction results.

[0151] In the first embodiment, the process of rearranging correspondence relationships is performed as the process of making it difficult to identify. In the data generation system 2 according to the second embodiment, the process of making it difficult to identify is performed by adding noise.

[0152] The data generation system 2 includes a calculation device 300 instead of the calculation device 200 of the data generation system 1 according to the first embodiment. First, the difficult-to-identify process according to this embodiment will be described, and then the functional configuration of the calculation device 300 will be described.

[0153] Fig. 15 is a diagram showing an example of the difficult-to-identify process in embodiment 2. For the sake of explanation, Fig. 15 shows a case where the objective variable of the material data is only "viscosity." Referring to Fig. 15, the process of adding noise to the objective variable of the material data as the difficult-to-identify process will be described.

[0154] Table 7000 shows the change in the predicted and evaluated values ​​of the response variable "viscosity" of the material data identified by material IDs "31" to "35" due to the addition and removal of noise.

[0155] Column 7100 shows the predicted values ​​of the response variable "viscosity" for the material data identified by material IDs "31" to "35." No noise is added to the predicted values ​​shown in column 7100.

[0156] Column 7200 shows the noise value to be added to the predicted values ​​of material IDs "31" to "35." For example, "+10" is added as noise to the predicted value "20" of material ID "31." Also, for example, "-2" is added as noise to the predicted value "30" of material ID "34."

[0157] Column 7300 shows the predicted value after noise has been added. For example, if a noise of "+10" is added to a predicted value of "20" for material ID "31," the predicted value including noise becomes "30."

[0158] Column 7400 shows the evaluation value of the predicted value including noise and the target value when the target value is set to "20." In this embodiment, the evaluation value is the distance (absolute difference) between the target value and the predicted value. Using the "absolute difference" as the evaluation value is just one example, and evaluation may be performed using other well-known methods.

[0159] For example, the distance between the predicted value "30" containing noise for material ID "31" and the target value "20" is "10" (=|30-20|). Also, the distance between the predicted value "2" containing noise for material ID "32" and the target value "20" is "18" (=|2-20|).

[0160] Column 7500 shows the evaluation values ​​after noise has been removed from the noisy evaluation values. That is, each value shown in column 7500 is the value obtained by removing each of the noisy values ​​shown in column 7200 from each of the noisy evaluation values ​​shown in column 7400. For example, removing the noise "+5" from the noisy evaluation value "35" for material ID "33" results in an evaluation value of "30."

[0161] (Functional Configuration of Arithmetic Device 300) Fig. 16 is a block diagram showing the functional configuration of the arithmetic device 300. The functional configuration of the arithmetic device 300 according to this embodiment will be described with reference to Fig. 16. Note that components common to the arithmetic device 200 according to the first embodiment are denoted by the same reference numerals, and repeated description will be omitted.

[0162] The arithmetic device 300 includes a control unit 350 instead of the control unit 250 of the arithmetic device 200. The control unit 350 includes a prediction unit 251, a next-generation generation unit 252, and an identification-compromising unit 353.

[0163] The identification-obscuring unit 353 performs a process of adding noise to the predicted value output by the prediction unit 251 for each of the multiple parent data (material data). The identification-obscuring unit 353 also performs a process of removing the noise added to the predicted value from the evaluation value calculated by the terminal device 100 (cancelling the identification-obscuring process). By performing the noise-adding process, it is possible to make it impossible to identify the predicted value corresponding to the parent data. Note that the addition of noise to the predicted value involves an operation between numerical values ​​encrypted using homomorphic encryption. On the other hand, the removal of noise from the evaluation value involves an operation between plaintext numerical values, since the evaluation value calculated by the terminal device 100 is in plaintext.

[0164] The identification-obfuscating unit 353 also adds noise to explanatory variables included in multiple child data (material data). This makes it impossible to identify the characteristics (explanatory variables) of the child data. Note that adding and removing noise to explanatory variables is performed by performing operations on numerical values ​​encrypted using homomorphic encryption.

[0165] A specific example of the processing performed by the identification-compromising unit 353 is as described with reference to FIG. 15. (Processing in the data generation system 2)

[0166] 17 is a sequence diagram showing the processing in the data generation system 2. The processing in the data generation system 2 is similar to the processing performed by the data generation system 1 according to the first embodiment (see FIGS. 13 and 14 ), except for the difficult-to-identify processing. Therefore, with reference to FIG. 17 , steps related to the difficult-to-identify processing, which is different from the processing performed by the data generation system 1, will be described.

[0167] In step S305, the identification-compromising unit 353 performs an identification-compromising process on the output prediction results, making it difficult to identify the prediction results corresponding to the parent data. Specifically, as shown in Fig. 15, the identification-compromising unit 353 adds noise to the prediction results (predicted values) corresponding to each of the parent data. The identification-compromising unit 353 stores the added noise.

[0168] In step S310, the difficult-to-identify unit 353 cancels the difficult-to-identify process for the multiple prediction results corresponding to the multiple acquired evaluation values. Specifically, the difficult-to-identify unit 353 executes a process of removing the noise added in step S305 from the evaluation values, and makes the prediction results for the explanatory variables of the parent data correspond correctly.

[0169] In step S314, the difficult-to-identify unit 353 performs difficult-to-identify processing on the explanatory variables of the generated multiple child data. Specifically, noise is added to the explanatory variables of the child data. The explanatory variables to which noise is added may be all explanatory variables included in the child data, or may be some of the explanatory variables. The difficult-to-identify unit 353 stores the added noise.

[0170] In step S318, the difficult-to-identify unit 353 cancels the difficult-to-identify process for the explanatory variables of the multiple child data. Specifically, the noise added to the explanatory variables in step S314 is removed. Note that the addition and removal of noise in steps S314 and S318 involves operations between numerical values ​​encrypted using homomorphic encryption.

[0171] By performing the above-described identification-obscuring process, it is possible to make it difficult to identify the correspondence between inputs and outputs of a prediction model and child data without encrypting them.

[0172] In the first and second embodiments, the difficult-to-identify process involves rearranging correspondence relationships and adding noise, respectively. In the data generation system 3 according to the third embodiment, the difficult-to-identify process involves a combination of rearranging correspondence relationships and adding noise.

[0173] Specifically, in the difficult-to-identify process, the process for making the correspondence between the input and output of the prediction model difficult to identify (e.g., corresponding to step S105 in FIG. 13) is a process for rearranging the correspondence, and the process for making the child data difficult to identify (e.g., corresponding to step S114 in FIG. 13) is a process for adding noise.

[0174] Alternatively, the reverse combination may be used: the process for making it difficult to identify the correspondence between the input and output of the prediction model (e.g., corresponding to step S105 in FIG. 13 ) may be a process for adding noise, and the process for making it difficult to identify the child data (e.g., corresponding to step S114 in FIG. 13 ) may be a process for rearranging the correspondence.

[0175] Furthermore, as the process for making it difficult to identify, a process for adding noise may be performed after a process for rearranging correspondence relationships, or conversely, a process for adding noise may be performed after a process for rearranging correspondence relationships.

[0176] By combining processes that make it difficult to identify data, the risk of information being disclosed can be further reduced.

[0177] In the first to third embodiments, the terminal device 100 calculates the evaluation value. In the data generation system 4 according to the fourth embodiment, the evaluation value is calculated on the arithmetic device side, not on the terminal device side. By performing encryption / decryption of data on the terminal device side and consolidating arithmetic processing related to data other than encryption / decryption on the arithmetic device side, arithmetic processing can be executed efficiently.

[0178] (Configuration of Data Generation System 4) Fig. 18 is an overall view of the data generation system 4. The overall view of the data generation system 4 according to this embodiment will be described with reference to Fig. 18 .

[0179] The data generation system 4 according to this embodiment includes a terminal device 400 and a computing device 500 instead of the terminal device 100 and the computing device 200 of the data generation system 1 according to the first embodiment.

[0180] 19 is a block diagram showing the functional configuration of the terminal device 400. Components common to the terminal device 100 according to the first embodiment are denoted by the same reference numerals, and repeated description will be omitted.

[0181] Terminal device 400 differs from terminal device 100 in that it includes a control unit 450 instead of control unit 150 of terminal device 100. Control unit 450 includes a key generation unit 151 and an encryption / decryption unit 152. Control unit 450 differs from control unit 150 of terminal device 100 in that it does not include evaluation value calculation unit 153.

[0182] The terminal device 100 decodes the prediction result obtained from the arithmetic device 200 and subjected to the difficult-to-identify process, and calculates an evaluation value. Meanwhile, the terminal device 400 decodes the prediction result subjected to the difficult-to-identify process, and then transmits the decoded prediction result to the arithmetic device 500 via the communication unit 110.

[0183] (Functional Configuration of the Arithmetic Device 500) Fig. 20 is a block diagram showing the functional configuration of the arithmetic device 500. Components common to the arithmetic device 200 according to the first embodiment are denoted by the same reference numerals, and repeated description will be omitted.

[0184] The arithmetic device 500 differs from the arithmetic device 200 in that it includes a control unit 550 instead of the control unit 250 of the arithmetic device 200. The control unit 550 differs from the control unit 250 of the arithmetic device 200 in that it includes an evaluation value calculation unit 554 in addition to the prediction unit 251, the next-generation generation unit 252, and the identification-difficulty making unit 253.

[0185] The evaluation value calculation unit 554 calculates an evaluation value for a target value from the prediction result (prediction value) output by the prediction unit 251 and decoded by the terminal device 100. The evaluation value is a value that indicates the degree to which two values ​​differ, and as in the first embodiment, for ease of explanation, in this embodiment, the evaluation value is the absolute difference between the prediction result and the target value.

[0186] 21 is a sequence diagram showing the processing in the data generation system 4. More specifically, in the data generation system 4, next-generation child data is generated from the material data (parent data) of the search target input to the terminal device 400 (next-generation generation step), and the child data is updated as parent data (update step).

[0187] The processing in the data generation system 4 shown in Figure 21 differs from the processing in the data generation system 1 shown in embodiment 1 (Figure 13) in that processing in steps S408 to S411 is performed instead of processing in steps S108 to S111. That is, processing steps other than steps S408 to S411 in the data generation system 4 are the same as processing steps in the data generation system 1 and are assigned the same reference numerals. Therefore, repeated explanations of steps with the same reference numerals will be omitted. Following the processing shown in Figure 21, the processing shown in Figure 14 is performed, and the searched material data is output.

[0188] Step S408 is a process performed following the process of step S107. The terminal device 400 transmits the plurality of prediction results that have been decoded in step S107 and subjected to the hard-to-identify process to the arithmetic device 500. The hard-to-identify unit 253 of the arithmetic device 500 acquires the plurality of decoded prediction results via the communication unit 210.

[0189] In step S409, the difficult-to-identify unit 253 of the computing device 500 cancels the difficult-to-identify process on the multiple prediction results obtained. Specifically, the difficult-to-identify unit 253 executes a process to restore the correspondence relationships rearranged in step S105 to their original state, thereby correcting the correspondence relationships between the prediction results and the explanatory variables of the parent data. Next, the difficult-to-identify unit 253 sends the multiple parent data and the prediction results that now have the correct correspondence relationships with the parent data to the evaluation value calculation unit 554.

[0190] In step S410, the evaluation value calculation unit 554 calculates a plurality of evaluation values ​​for the target values ​​of the plurality of prediction results, from the plurality of prediction results decoded by the terminal device 400. Specifically, similar to the evaluation value calculation unit 153, the evaluation value calculation unit 554 calculates the distance between the target value set in step S100 and the prediction result (predicted value). Note that in this embodiment, as in the first embodiment, the absolute difference is calculated as the distance, but any method for calculation may be used as long as the value indicates how much the target value and the predicted value differ.

[0191] In step S411, the next-generation generation unit 252 of the arithmetic device 500 obtains the encrypted parent data and the evaluation values ​​corresponding to the parent data from the evaluation value calculation unit 554. Based on the parent data and the evaluation values ​​corresponding to the parent data, the next-generation generation unit 252 then generates the next generation in step S112. The subsequent processing is the same as that described in embodiment 1 ( FIG. 13 ).

[0192] In the data generation system 4 according to this embodiment, the difficult-to-identify process is realized by rearranging the correspondence between the input (data to be predicted) and output (prediction result) of the prediction model. However, other difficult-to-identify processes can also be realized by the "noise addition process" described in the second embodiment or the "combination of the process of rearranging the correspondence and the noise addition process" described in the third embodiment.

[0193] (Explanation of Effects) In this embodiment, data encryption / decryption is performed in the terminal device 400, and arithmetic processing related to data other than encryption / decryption is consolidated in the arithmetic device 500. This makes it possible to execute arithmetic processing more efficiently.

[0194] The above-described embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and modifications are intended to be included in the scope of the invention and their equivalents as defined in the claims, as well as in the scope and spirit of the invention.

[0195] 1, 2, 3 Data generation system, 100, 400 Terminal device, 200, 300, 500 Calculation device, 110, 210 Communication unit, 120, 220 Input unit, 130, 230 Output unit, 140, 240 Memory unit, 141 Key memory unit, 142 Material database, 150, 250, 350, 450 Control unit, 151 Key generation unit, 152 Encryption / decryption unit, 153, 554 Evaluation value calculation unit, 251 Prediction unit, 252 Next-generation generation unit, 253, 353 Identification difficult unit.

Claims

1. A method for use in a system including: a user terminal having a control unit and a user memory unit that stores multiple parent data; and a calculation device having a cryptographic calculation unit that performs calculations including data encrypted using a homomorphic encryption method, and an encrypted data storage unit that stores a machine learning model that outputs prediction results from the parent data, the method comprising: a step in which the control unit generates a public key and a private key; a step in which the control unit encrypts the multiple parent data obtained from the user memory unit using the homomorphic encryption method using the public key; a next-generation generation step in which the cryptographic calculation unit and the control unit generate multiple child data based on multiple prediction results output by inputting the multiple encrypted parent data into the machine learning model; an update step in which the encrypted data storage unit stores the generated multiple child data as the multiple encrypted parent data; and a step in which the next-generation generation step and the update step are repeated.

2. The next generation generating step includes: a step in which the cryptographic calculation unit acquires the plurality of parent data encrypted by the control unit; a step in which the cryptographic calculation unit inputs the acquired plurality of parent data into the machine learning model and outputs a plurality of prediction results corresponding to each of the parent data; a step in which the cryptographic calculation unit executes an identification-hardening process on the output plurality of prediction results to make it difficult to identify the plurality of prediction results corresponding to the plurality of parent data; a step in which the control unit acquires the plurality of prediction results on which the identification-hardening process has been executed and decrypts them using the private key; a step in which the control unit calculates a plurality of evaluation values ​​for each target value of the plurality of prediction results from the decrypted plurality of prediction results on which the identification-hardening process has been executed; a step in which the cryptographic calculation unit acquires the calculated plurality of evaluation values; a step in which the cryptographic calculation unit cancels the identification-hardening process on the plurality of prediction results corresponding to the acquired plurality of evaluation values; and a step in which the cryptographic calculation unit acquires a plurality of evaluation values ​​corresponding to the plurality of parent data through the plurality of prediction results on which the identification-hardening process has been canceled.

2. The data generation method according to claim 1, comprising: a step in which the cryptographic calculation unit extracts the plurality of parent data corresponding to the evaluation value that satisfies a predetermined condition; and a step in which the cryptographic calculation unit applies a genetic algorithm to the extracted plurality of parent data to generate a plurality of child data.

3. The next generation generating step includes: a step in which the cryptographic calculation unit acquires the plurality of parent data encrypted by the control unit; a step in which the cryptographic calculation unit inputs the acquired plurality of parent data into the machine learning model and outputs a plurality of prediction results corresponding to each of the parent data; a step in which the cryptographic calculation unit executes an identification-hardening process on the output plurality of prediction results to make it difficult to identify the plurality of prediction results corresponding to the plurality of parent data; a step in which the control unit acquires the plurality of prediction results on which the identification-hardening process has been executed and decrypts them using the private key; a step in which the cryptographic calculation unit acquires the decrypted plurality of prediction results on which the identification-hardening process has been executed; a step in which the cryptographic calculation unit cancels the identification-hardening process on the acquired plurality of prediction results on which the identification-hardening process has been executed; a step in which the cryptographic calculation unit calculates a plurality of evaluation values ​​corresponding to the plurality of parent data from the plurality of prediction results on which the identification-hardening process has been canceled; and a step in which the cryptographic calculation unit extracts the plurality of parent data corresponding to the evaluation value that satisfies a predetermined condition. The data generation method according to claim 1 , further comprising: a step of: the cryptographic calculation unit applying a genetic algorithm to the extracted plurality of parent data to generate a plurality of child data.

4. The data generation method according to claim 2 or claim 3, wherein the multiple parent data are a dataset in which records containing values ​​corresponding to multiple explanatory variables are arranged in a predetermined order, and the next-generation generation step further includes: a step by the cryptographic operation unit executing the hard-to-identify processing on explanatory variables of the multiple generated child data; a step by the control unit acquiring the multiple child data on which the hard-to-identify processing has been performed and decrypting the multiple child data using the private key; a step by the control unit re-encrypting the decrypted multiple child data using a homomorphic encryption method using the public key; a step by the cryptographic operation unit acquiring the multiple re-encrypted child data; and a step by the cryptographic operation unit canceling the hard-to-identify processing on explanatory variables of the multiple child data acquired, and wherein in the update step, the encrypted data storage unit stores the multiple child data from which the hard-to-identify processing has been canceled as the multiple encrypted parent data.

5. The data generating method according to claim 2 or 3, wherein the process for making it difficult to identify is a process for rearranging correspondence relationships.

6. The data generating method according to claim 2 or 3, wherein the processing for making it difficult to identify is a process for adding noise.

7. The data generating method according to claim 2 or 3, wherein the processing for making it difficult to identify is a combination of a process for rearranging correspondences and a process for adding noise.

8. A data generation method according to any one of claims 1 to 3, further comprising a step in which the control unit acquires multiple child data generated by executing the repeating step multiple times and prediction results corresponding to the child data, and decrypts the multiple child data using the private key.

9. The data generating method according to claim 8, further comprising a step of the control unit receiving the number of times the repeating step is to be performed.

10. A program used in a system comprising: a user terminal having a control unit and a user memory unit that stores multiple parent data; and a calculation device having a cryptographic calculation unit that performs calculations including data encrypted using a homomorphic encryption method, and an encrypted data storage unit that stores a machine learning model that outputs prediction results from the parent data, the data generation program comprising: a step in which the control unit generates a public key and a private key; a step in which the control unit encrypts the multiple parent data obtained from the user memory unit using the homomorphic encryption method using the public key; a next-generation generation step in which the cryptographic calculation unit and the control unit generate multiple child data based on multiple prediction results output by inputting the multiple encrypted parent data into the machine learning model; an update step in which the encrypted data storage unit stores the generated multiple child data as the multiple encrypted parent data; and a step in which the next-generation generation step and the update step are repeated.

11. A system comprising: a user terminal having a control unit and a user memory unit that stores multiple parent data; and a calculation device having a cryptographic calculation unit that performs calculations including data encrypted using a homomorphic encryption method, and an encrypted data storage unit that stores a machine learning model that outputs prediction results from the parent data, the system comprising: a step in which the control unit generates a public key and a private key; a step in which the control unit encrypts the multiple parent data obtained from the user memory unit using the homomorphic encryption method using the public key; a next-generation generation step in which the cryptographic calculation unit and the control unit generate multiple child data based on multiple prediction results output by inputting the multiple encrypted parent data into the machine learning model; an update step in which the encrypted data storage unit stores the generated multiple child data as the multiple encrypted parent data; and a step in which the next-generation generation step and the update step are repeated.

Images