Verification device, verification method, and program

Abstract

A verification device according to one aspect of the present disclosure verifies the identity between a first machine learning model and a second machine learning model in which an output is stochastically changed with respect to an input. The verification device comprises: an input unit that inputs a plurality of types of inputs a predetermined number of times to each of the first machine learning model and the second machine learning model; and a verification unit that verifies the identity between the first machine learning model and the second machine learning model on the basis of a first model feature representing the distribution of outputs of the first machine learning model obtained when the plurality of types of inputs are inputted the predetermined number of times, a second model feature representing the distribution of outputs of the second machine learning model obtained when the plurality of types of inputs are inputted the predetermined number of times, and threshold values corresponding to the types.

Description

Verification device, verification method, and program

[0001] The present disclosure relates to a verification device, a verification method, and a program.

[0002] Among the machine learning models that realize AI (Artificial Intelligence), some continue to change through continuous machine learning in order to improve their sophistication and adapt to external environments. Such machine learning models have the problem that it is difficult to detect changes due to erroneous learning or unauthorized substitution of machine learning models by third parties. In response to this problem, a method has been proposed for verifying the identity of multiple machine learning models by utilizing the characteristics of the machine learning models (Non-Patent Document 1).

[0003] Naoto Kiribuchi, Yuya Sato, Ryohei Suzuki, Nami Ashizawa, Satoshi Oki, Hirofumi Mineno, Masakatsu Nishigaki, "A Study on the Use of Verifiable Machine Learning Models: Proposal of a Model Identity Verification Method Based on Robustness to Image Manipulation," Research Report Computer Security (CSEC), vol.2023-CSEC-101, no.16, pp.1-7, 2023.

[0004] However, the method proposed in Non-Patent Document 1 sometimes fails to verify the identity of machine learning models whose outputs are not deterministically determined for the same input.

[0005] The present disclosure has been made in consideration of the above points, and aims to verify the identity of a machine learning model whose output is not deterministically determined for the same input.

[0006] A verification device according to one aspect of the present disclosure is a verification device that verifies the identity of a first machine learning model and a second machine learning model whose output changes probabilistically in response to an input, and includes an input unit that inputs multiple types of input to each of the first machine learning model and the second machine learning model a predetermined number of times, and a verification unit that verifies the identity of the first machine learning model and the second machine learning model based on first model characteristics that represent the distribution of outputs of the first machine learning model when the types of input are input the number of times, second model characteristics that represent the distribution of outputs of the second machine learning model when the types of input are input the number of times, and a threshold value corresponding to the types.

[0007] It is possible to verify the identity of machine learning models whose output is not deterministically determined for the same input.

[0008] 1 is a diagram illustrating an example of a hardware configuration of a verification device according to an embodiment; FIG. 2 is a diagram illustrating an example of a functional configuration of a verification device according to an embodiment; FIG. 3 is a flowchart illustrating an example of a threshold calculation process according to an embodiment; and FIG. 4 is a flowchart illustrating an example of a verification process according to an embodiment.

[0009] An embodiment of the present invention will be described in detail below with reference to the drawings. In the following embodiment, a verification device 10 will be described that can verify the identity of two machine learning models whose output is not deterministically determined for each input. Hereinafter, the two machine learning models to be verified for identity will be referred to as "machine learning model T" and "machine learning model V." Machine learning model T is assumed to be, for example, a legitimate machine learning model that operates as intended by the model creator or the like. On the other hand, machine learning model V is a machine learning model whose identity with machine learning model T is to be verified, and is assumed to be, for example, a machine learning model that may have changed due to erroneous learning or may have been illegally replaced by a third party.

[0010] An example of a machine learning model in which the output is not deterministically determined for the same input is a machine learning model called a large language model (LLM) that realizes generative AI (or may be called generative AI). Such machine learning models do not necessarily obtain the same output for the same input, but rather the output changes probabilistically for the same input. However, a machine learning model that realizes generative AI is just one example, and the following embodiment can be similarly applied to verifying the identity of any two machine learning models in which the output is not deterministically determined for the input (in other words, any two machine learning models in which the output changes probabilistically for the input).

[0011] <Example of Hardware Configuration of Verification Device 10> An example of the hardware configuration of the verification device 10 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the hardware configuration of the verification device 10 according to this embodiment.

[0012] 1, the verification device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0013] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the verification device 10 does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0014] The external I / F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0015] The communication I / F 104 is an interface for connecting to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a non-volatile storage device such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory. The processor 108 is a variety of arithmetic devices such as a central processing unit (CPU) or a graphic processing unit (GPU).

[0016] 1 is an example, and the hardware configuration of the verification device 10 is not limited to this. For example, the verification device 10 may have multiple auxiliary storage devices 107 or multiple processors 108, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0017] <Example of Functional Configuration of Verification Apparatus 10> An example of the functional configuration of the verification apparatus 10 according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the functional configuration of the verification apparatus 10 according to this embodiment.

[0018] 2 , the verification device 10 according to this embodiment includes a model input unit 201, a model characteristic acquisition unit 202, a threshold calculation unit 203, a verification unit 204, and a verification result output unit 205. These units are implemented, for example, by a processor 108 or the like executing one or more programs installed in the verification device 10. The verification device 10 according to this embodiment also includes an input storage unit 206, a threshold storage unit 207, and a model characteristic storage unit 208. Each of these storage units is implemented, for example, by a storage area of ​​the auxiliary storage device 107 or the like. Note that at least one of the input storage unit 206, the threshold storage unit 207, and the model characteristic storage unit 208 may be implemented by a storage area of ​​a storage device (e.g., a storage device included in a database server) or the like communicatively connected to the verification device 10.

[0019] The model input unit 201 inputs a threshold value t ｉ (i=1, . . . , s), the input x stored in the input storage unit 206 is used ｉ is input to the machine learning model T w times. In addition, the model input unit 201 inputs the input x stored in the input storage unit 206. ｉ is input to the machine learning model T w times and repeated N times. As a result, w outputs y Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ ' and a set of w outputs from the machine learning model T {y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） |n=1,...,N} is obtained. Here, w is a predetermined integer of 2 or more. Ｔ，ｉ，ｊ ' is the jth (where 1≦j≦w) input x ｉ is the output when inputted into the machine learning model T. Also, y Ｔ，ｉ，ｊ ' （ｎ） is the input x in the nth (where 1≦n≦N) iteration and the jth (where 1≦j≦w) iteration. ｉ is the output when input to the machine learning model T. Furthermore, s is the output when the input x ｉ The number of types, N, is a predetermined integer of 2 or more.

[0020] When verifying the identity of the machine learning models T and V, the model input unit 201 uses the input x stored in the input storage unit 206 ｉ (i=1, . . . , s) is input k times to the machine learning model T. In addition, the model input unit 201 inputs the input x ｉ (i = 1, ..., s) is input k times to the machine learning model V. As a result, k outputs y Ｔ，ｉ，１ , ..., y Ｔ，ｉ，ｋ and k outputs y from the machine learning model V Ｖ，ｉ，１ , ..., y Ｖ，ｉ，ｋ Here, k is a predetermined integer of 2 or more. k may be k=w. y Ｔ，ｉ，ｊ is the jth (where 1≦j≦k) input x ｉ is the output when input into the machine learning model T. Ｖ，ｉ，ｊ is the jth (where 1≦j≦k) input x ｉ is the output when input into machine learning model V.

[0021] In general, every time an input x is input to a machine learning model, an output y corresponding to the input x is obtained.

[0022] Here, the above input x ｉ The format of (i = 1, ..., s) may differ depending on the machine learning models T and V. For example, when the machine learning models T and V are machine learning models such as large-scale language models that realize generative AI, the input x ｉ is typically in text format. Similarly, the input x ｉ The output formats of the machine learning models T and V when input may differ depending on the machine learning models T and V. For example, when the machine learning models T and V are machine learning models such as large-scale language models that realize generative AI, the output of the machine learning models T and V is generally in text format. However, it is also possible to input and output data in various formats, such as still images, videos, and audio.

[0023] The machine learning models T and V are stored in a storage area such as the auxiliary storage device 107. However, at least one of the machine learning models T and V may be stored in a storage area such as a storage device communicatively connected to the verification device 10 (e.g., a storage device provided in an API (Application Programming Interface) server).

[0024] The model characteristic acquisition unit 202 determines the threshold value t ｉ (i=1, . . . , s), w outputs y Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ ' is the model characteristic Y of the machine learning model T Ｔ，ｉ '=(y Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ Similarly, the model characteristic acquisition unit 202 acquires w outputs y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） Let T be the model characteristic Y of the machine learning model T. Ｔ，ｉ ' （ｎ） = (y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） ) is obtained.

[0025] When verifying the identity of machine learning models T and V, the model property acquisition unit 202 acquires k outputs y Ｔ，ｉ，１ , ..., y Ｔ，ｉ，ｋ Let T be the model characteristic Y of the machine learning model T. Ｔ，ｉ = (y Ｔ，ｉ，１ , ..., y Ｔ，ｉ，ｋ Similarly, the model characteristic acquisition unit 202 acquires k outputs y Ｖ，ｉ，１ , ..., y Ｖ，ｉ，ｋ Let Y be the model characteristic of machine learning model V. Ｖ，ｉ = (y Ｖ，ｉ，１ , ..., y Ｖ，ｉ，ｋ ) is obtained.

[0026] Furthermore, the model characteristic acquisition unit 202 acquires the model characteristic Y Ｔ，ｉ and YＶ，ｉ At least one of the above is stored in the model characteristic storage unit 208.

[0027] The threshold calculation unit 203 calculates the model characteristic Y Ｔ，ｉ ' and model characteristic Y Ｔ，ｉ ' （ｎ） (n=1, . . . , N) and input x ｉ The threshold t corresponding to ｉ The threshold calculation unit 203 calculates the threshold t ｉ is stored in the threshold storage unit 207.

[0028] The verification unit 204 determines the model characteristic Y Ｔ，ｉ and model characteristic Y Ｖ，ｉ and the threshold value t ｉ and verify whether the machine learning model V can be considered to be the same as the machine learning model T. That is, the verification unit 204 verifies whether the machine learning model V can be considered to be the same as the machine learning model T by using the model characteristics Y Ｔ，ｉ and model characteristic Y Ｖ，ｉ and threshold t ｉ The identity of the machine learning model T and the machine learning model V is verified using the above.

[0029] The verification result output unit 205 outputs the verification result by the verification unit 204 to a predetermined output destination. Examples of the predetermined output destination include the display device 102 such as a display, a storage area such as the auxiliary storage device 107, and other devices or equipment connected to the verification device 10 so as to be able to communicate with the verification device 10.

[0030] The input storage unit 206 stores s types of inputs x given as inputs to the machine learning models T and V. ｉ (i=1, . . . , s) is stored.

[0031] The threshold value storage unit 207 stores the s threshold values ​​t ｉ (i=1, . . . , s). That is, the threshold storage unit 207 stores s types of input x ｉ (i=1, . . . , s) ｉ (i=1, . . . , s) is stored.

[0032] The model characteristic storage unit 208 stores the model characteristic Y Ｔ，ｉand Y Ｖ，ｉ (i=1, . . . , s) is stored.

[0033] <Threshold Calculation Processing> The threshold calculation processing according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a flowchart showing an example of the threshold calculation processing according to this embodiment.

[0034] The threshold calculation unit 203 calculates the input x ｉ The threshold calculation unit 203 initializes an index i representing the type of the threshold value to 1 (step S101). That is, the threshold calculation unit 203 sets i=1.

[0035] The threshold calculation unit 203 determines whether i>s (step S102). If it is determined that i>s, the threshold calculation unit 203 ends the threshold calculation process. On the other hand, if it is not determined that i>s (i.e., if i≦s), the threshold calculation unit 203 proceeds to step S103.

[0036] The model input unit 201 receives the input x stored in the input storage unit 206. ｉ is input to the machine learning model T w times (step S103). As a result, w outputs y Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ ' is obtained.

[0037] The model characteristic acquisition unit 202 calculates the w outputs y obtained in step S103. Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ ' is a model property Y Ｔ，ｉ '=(y Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ ') (step S104).

[0038] The model input unit 201 receives the input x stored in the input storage unit 206. ｉ is input to the machine learning model T w times and repeated N times (step S105). As a result, a set of w outputs from the machine learning model T, {y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ）|n=1, ..., N} is obtained. Note that it is assumed that w used in this step is the same as w used in step S103 above. However, for example, the threshold value t ｉ When calculating w, it is not necessary for them to be the same, and w used in this step may be different from w used in step S103 above.

[0039] The model characteristic acquisition unit 202 acquires the w outputs y obtained in step S105 for each n=1, . . . , N. Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） The model characteristic Y Ｔ，ｉ ' （ｎ） = (y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） ) (step S106). As a result, N model characteristics Y Ｔ，ｉ ' （１） , ..., Y Ｔ，ｉ ' （Ｎ） is obtained.

[0040] The order of steps S103 to S104 and steps S105 to S106 is not particularly limited. That is, for example, steps S103 to S104 may be executed after steps S105 to S106 are executed.

[0041] The threshold calculation unit 203 calculates the model characteristic Y Ｔ，ｉ ' and model characteristic Y Ｔ，ｉ ' （ｎ） (n=1, . . . , N) and input x ｉ The threshold t corresponding to ｉ (Step S107). ｉ is stored in the threshold storage unit 207. Here, the threshold calculation unit 203 calculates the threshold t ｉ can be calculated.

[0042] Threshold calculation method 1: Model characteristic Y Ｔ，ｉ '=(y Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ') is w points y Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ Similarly, each model characteristic Y Ｔ，ｉ ' （ｎ） = (y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） ) also has w points y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） Therefore, for each n=1,...,N, the model characteristic Y Ｔ，ｉ '=(y Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ ') and model characteristic Y Ｔ，ｉ ' （ｎ） = (y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） ) and the distribution distance D(Y Ｔ，ｉ ', Y Ｔ，ｉ ' （ｎ） ) is calculated. Ｔ，ｉ ', Y Ｔ，ｉ ' （ｎ） ) > t Ｔ，ｉ ' （ｎ） The threshold t is set so that the number of ｉ For example, D(Y Ｔ，ｉ ', Y Ｔ，ｉ ' （ｎ） ) > t Ｔ，ｉ ' （ｎ） The number of １ (Example: θ １ = 0.1 × N or θ １ = 0.01 × N, etc.) is set to a threshold t ｉ It is possible to calculate it as follows. Ｔ，ｉ ' and each model characteristic Y Ｔ，ｉ ' （ｎ） As a measure for measuring the distance between the distributions, for example, KL (Kullback-Leibler) divergence can be used.

[0043] Threshold calculation method 2: Model characteristic Y Ｔ，ｉ '=(y Ｔ，ｉ，１', ..., y Ｔ，ｉ，ｗ ') contains w outputs y Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ ' can be considered as the distribution of a sample statistically extracted from a certain population. Similarly, each model characteristic Y Ｔ，ｉ ' （ｎ） = (y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） ) Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） can be regarded as the distribution of samples statistically extracted from a certain population. Ｔ，ｉ，１ ', ..., y Ｔ，ｉ，ｗ ' and w outputs y Ｔ，ｉ，１ ' （ｎ） , ..., y Ｔ，ｉ，ｗ ' （ｎ） A statistical hypothesis test is performed on two samples to test whether the probability distributions of the populations differ between the two. Specifically, for example, the null hypothesis is that the probability distributions of the populations do not match, and the alternative hypothesis is that the probability distributions of the populations match. Then, the model characteristic Y for which the null hypothesis is not rejected is Ｔ，ｉ ' （ｎ） The significance level t is set as the threshold t so that the number of ｉ For example, the model characteristic Y for which the null hypothesis is not rejected is calculated as Ｔ，ｉ ' （ｎ） The number of １ (Example: θ １ = 0.1 × N or θ １ = 0.01 × N, etc.) is set as the threshold t ｉ As a statistical hypothesis test for two samples, for example, the Kolmogorov-Smirnov test or the Mann-Whitney U test can be used.

[0044] The above threshold calculation methods 1 and 2 are based on the model characteristic Y Ｔ，ｉ ' and each model characteristic Y Ｔ，ｉ ' （ｎ）is the characteristic of the machine learning model T, and the threshold t is set so that the false rejection rate is low. ｉ This means that the following is calculated:

[0045] The threshold calculation unit 203 calculates the input x ｉ The threshold calculation unit 203 then adds 1 to the index i, which indicates the type of the threshold value (step S108). That is, the threshold calculation unit 203 sets i←i+1. Then, the threshold calculation unit 203 returns to step S102. As a result, steps S103 to S108 are repeated for i=1, ..., s, and the threshold value storage unit 207 stores the threshold value t １ , ..., t ｓ is saved.

[0046] <Verification Process> The verification process according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a flowchart showing an example of the verification process according to this embodiment.

[0047] The model input unit 201 receives the input x stored in the input storage unit 206. ｉ (i=1, . . . , s) is input to the machine learning model T k times (step S201). As a result, for i=1, . . . , s, k outputs y Ｔ，ｉ，１ , ..., y Ｔ，ｉ，ｋ is obtained.

[0048] The model characteristic acquisition unit 202 acquires k outputs y obtained in step S201 for i=1, . . . , s. Ｔ，ｉ，１ , ..., y Ｔ，ｉ，ｋ The model characteristic Y Ｔ，ｉ = (y Ｔ，ｉ，１ , ..., y Ｔ，ｉ，ｋ ) (step S202). Ｔ，ｉ is stored in the model characteristic storage unit 208 as needed. Ｔ，ｉ is stored in the model characteristic storage unit 208, for example, Ｔ，ｉ For example, after obtaining the ID, the identity verification in step S205 described later is performed later.

[0049] The model input unit 201 receives the input x stored in the input storage unit 206. ｉ(i=1, . . . , s) is input to the machine learning model V k times (step S203). As a result, for i=1, . . . , s, k outputs y Ｖ，ｉ，１ , ..., y Ｖ，ｉ，ｋ is obtained.

[0050] The model characteristic acquisition unit 202 acquires the k outputs y obtained in step S203 for i=1, . . . , s. Ｖ，ｉ，１ , ..., y Ｖ，ｉ，ｋ The model characteristic Y Ｖ，ｉ (Step S204). Ｖ，ｉ is stored in the model characteristic storage unit 208 as needed. Ｖ，ｉ is stored in the model characteristic storage unit 208, for example, Ｖ，ｉ For example, after obtaining the ID, the identity verification in step S205 described later is performed later.

[0051] The order of steps S201 to S202 and steps S203 to S204 is not particularly limited. For example, steps S201 to S202 may be executed after steps S203 to S204.

[0052] The verification unit 204 determines the model characteristic Y Ｔ，ｉ (i=1, . . . , s) and the model characteristic Y Ｖ，ｉ (i=1, . . . , s) and the threshold value t stored in the threshold value storage unit 207. ｉ (i = 1, ..., s) to verify whether machine learning model V can be considered to be identical to machine learning model T (step S205). Here, the verification unit 204 can verify whether machine learning model V can be considered to be identical to machine learning model T, for example, by the following steps 1 to 5.

[0053] Step 1: The verification unit 204 calculates the model characteristic Y Ｔ，ｉ and model characteristic Y Ｖ，ｉ and threshold t ｉ Using these, we verify whether machine learning model V can be considered to be identical to machine learning model T. Below, we refer to this verification result as r ｉ Let's say.

[0054] Here, the threshold t ｉ is calculated by the above threshold calculation method 1, the verification unit 204 calculates the distribution distance D(Y Ｔ，ｉ , Y Ｖ，ｉ ) is calculated, and D(Y Ｔ，ｉ , Y Ｖ，ｉ ) <t ｉ When , the verification result r ｉ = "machine learning model V can be considered identical to machine learning model T", otherwise the verification result is r ｉ = "machine learning model V cannot be considered identical to machine learning model T."

[0055] On the other hand, the threshold t ｉ is calculated by the above threshold calculation method 2, the verification unit 204 calculates the k outputs y Ｔ，ｉ，１ , ..., y Ｔ，ｉ，ｋ and k outputs y Ｖ，ｉ，１ , ..., y Ｖ，ｉ，ｋ The verification unit 204 tests whether the probability distributions of the populations differ between the two samples by performing a statistical hypothesis test on the two samples. Specifically, for example, the null hypothesis is that the probability distributions of the populations do not match, and the alternative hypothesis is that the probability distributions of the populations match. Then, the verification unit 204 checks whether the p-value is greater than the significance level t ｉ If it is smaller than r, reject the null hypothesis and verify the result. ｉ = "machine learning model V can be considered identical to machine learning model T", and if not, the verification result r ｉ = "machine learning model V cannot be considered identical to machine learning model T."

[0056] Step 2: The verification unit 204 generates s verification results r １ , ..., r ｓ The number of verification results that indicate that "machine learning model V can be considered identical to machine learning model T" is determined by a predetermined threshold θ ２ If it is equal to or greater than this, the final verification result is r = "machine learning model V can be considered to be identical to machine learning model T", and if it is not, the final verification result is r = "machine learning model V cannot be considered to be identical to machine learning model T". ２ For example, θ ２= s or θ ２ = 0.9 × s, θ ２ = 0.99 × s, etc.

[0057] The verification result output unit 205 outputs the verification result obtained in step S205 to a predetermined output destination (step S206).

[0058] <Summary> As described above, the verification device 10 according to this embodiment receives s types of input x for each of the two machine learning models T and V. ｉ is given k times, and the same type of input x ｉ The verification device 10 according to the present embodiment verifies the identity of the machine learning models T and V by comparing the distribution of outputs for the same type of input x and integrating the comparison results. ｉ The threshold t used to compare the output to ｉ As a result, the verification device 10 according to this embodiment can verify with high accuracy the identity of the machine learning models T and V, even when the outputs of the machine learning models T and V change probabilistically with respect to the input. This makes it possible to detect with high accuracy machine learning models that may have changed due to erroneous learning or may have been illegally replaced by a third party, for example, targeting machine learning models that realize generative AI.

[0059] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0060] REFERENCE SIGNS LIST 10 Verification device 101 Input device 102 Display device 103 External I / F 103a Recording medium 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage device 108 Processor 109 Bus 201 Model input unit 202 Model characteristic acquisition unit 203 Threshold calculation unit 204 Verification unit 205 Verification result output unit 206 Input storage unit 207 Threshold storage unit 208 Model characteristic storage unit

Claims

1. A verification device that verifies the identity of a first machine learning model and a second machine learning model whose output changes probabilistically in response to an input, comprising: an input unit that inputs multiple types of input a predetermined number of times to each of the first machine learning model and the second machine learning model; and a verification unit that verifies the identity of the first machine learning model and the second machine learning model based on first model characteristics that represent the distribution of outputs of the first machine learning model when the types of input are input the number of times, second model characteristics that represent the distribution of outputs of the second machine learning model when the types of input are input the number of times, and a threshold value corresponding to the types.

2. The verification device described in claim 1, wherein the verification unit verifies the identity of the first machine learning model and the second machine learning model for each of the plurality of types based on a first model characteristic representing the distribution of outputs of the first machine learning model when an input of the type is input the number of times, a second model characteristic representing the distribution of outputs of the second machine learning model when an input of the type is input the number of times, and a threshold value corresponding to the type, and a result of integrating the verification results of the identity for each type is used as the final verification result.

3. The verification device according to claim 1 or 2, further comprising a threshold calculation unit that calculates a threshold corresponding to each of the plurality of types so that the false rejection rate is low when the type is input a predetermined number of times to verify the identity of the first machine learning models for each type.

4. The verification device described in claim 3, wherein the threshold calculation unit calculates, for each type, the threshold value that is verified as identical in n (where n≦N) or more verifications when verifying the identity of the first machine learning models N times, based on the distribution of the output of the first machine learning model when an input of the type is input the number of times, each of N distributions of the output of the first machine learning model when input of the type is repeated N (where N is a predetermined integer of 2 or more) times, and the threshold value corresponding to the type.

5. A verification method in which a verification device verifies the identity of a first machine learning model and a second machine learning model whose output changes probabilistically with respect to input, the verification device executing: an input procedure in which multiple types of input are input to each of the first machine learning model and the second machine learning model a predetermined number of times; and a verification procedure in which the verification device verifies the identity of the first machine learning model and the second machine learning model based on first model characteristics representing the distribution of outputs of the first machine learning model when the types of input are input the number of times, second model characteristics representing the distribution of outputs of the second machine learning model when the types of input are input the number of times, and a threshold value corresponding to the types.

6. A program that causes a verification device that verifies the identity of a first machine learning model and a second machine learning model whose output changes probabilistically in response to an input to execute the following steps: an input procedure for inputting multiple types of input to each of the first machine learning model and the second machine learning model a predetermined number of times; and a verification procedure for verifying the identity of the first machine learning model and the second machine learning model based on first model characteristics that represent the distribution of outputs of the first machine learning model when the types of input are inputted the number of times, second model characteristics that represent the distribution of outputs of the second machine learning model when the types of input are inputted the number of times, and a threshold value corresponding to the types.

Images