Training data processing device and training data processing method

Abstract

A training data processing device according to the present invention is provided with a division unit, a synthetic data generation unit, and a synthetic data comparison unit. The division unit divides raw data into synthetic data generating raw data and reference raw data. The synthetic data generation unit generates synthetic data, which is pseudo training data of the synthetic data generating raw data, on the basis of the synthetic data generating raw data. The synthetic data comparison unit compares the distribution of the reference raw data with the synthetic data, and excludes, from the synthetic data, outlier synthetic data that is synthetic data deviating from the distribution of the reference raw data.

Description

Learning data processing device and learning data processing method

[0001] The present invention relates to a learning data processing device and a learning data processing method for processing data for learning a model.

[0002] Machine learning, especially supervised learning, is becoming widespread in various application fields. As the scope of applications expands, the data used for learning is becoming more sensitive and is typically continuously updated along with the model.

[0003] Secure machine learning processing technology for data analysis has three requirements: [1] For widespread adoption in fields handling sensitive data, there is a constraint that the data, labels, and models used in machine learning cannot be disclosed to anyone other than their providers, necessitating a secure environment and processing method. [2] When building and updating training datasets and models, an interactive processing method is required in which label and model providers observe the model's operating status, such as the characteristics of the actual data and the model's output, to achieve sufficient inference performance. A training dataset is a collection of data to which the analysis target is labeled with labels (results of identification, classification, regression, and identity determination), which are the results of data analysis. Supervised learning requires the construction of a training dataset in advance. [3] When building and updating training datasets and models, the workload of label providers must be kept to a realistic level.

[0004] Data sandboxing is a well-known method for processing sensitive data in a secure environment without disclosing it to anyone other than the data provider. Data sandboxing is a technology that ensures a secure environment on hardware by utilizing hardware encryption technology (TEE), and allows both learning and inference to be performed in plaintext within that environment.

[0005] Furthermore, a conventional technique is known in which synthetic data, which is pseudo-learning data, is generated from raw training data in a data sandbox and the synthetic data is presented to a generator of labels, models, etc. (see, for example, Non-Patent Document 1). This allows for the generation of models, etc., without presenting the raw training data to anyone other than the provider of the raw training data.

[0006] Osamu Zeisho, Takayuki Miura, Kazuki Iwahana, Masanori Kii, "Active Synthetic Data Generation: Utilizing Privacy-Preserving Synthetic Data for Machine Learning with Annotation," Research Report Mobile Computing and New Social Systems (MBL), 2023-MBL-107(9), 1-8 (2023-05-11), 2188-8817.

[0007] However, the accuracy of the model generated by the technique of Non-Patent Document 1 was sometimes low. An object of the present invention is to provide a technique for generating training data that can generate a model with higher accuracy.

[0008] The training data processing device of the present invention includes a division unit, a synthetic data generation unit, and a synthetic data comparison unit. The division unit divides raw data into raw data for synthetic data generation and reference raw data. The synthetic data generation unit generates synthetic data, which is pseudo-training data of the raw data for synthetic data generation, based on the raw data for synthetic data generation. The synthetic data comparison unit compares the distribution of the reference raw data with the synthetic data, and removes outlying synthetic data, which is synthetic data that deviates from the distribution of the reference raw data, from the synthetic data.

[0009] According to the training data processing device of the present invention, the dividing unit divides raw data for training into raw data for synthetic data generation and reference raw data. By using the reference raw data different from the raw data for synthetic data generation, out-of-range synthetic data is removed from the synthetic data, providing a technology for generating training data that can generate a more accurate model.

[0010] Fig. 1 is a diagram showing an example of the functional configuration of a training data processing device according to Example 1. Fig. 2 is a diagram showing an example of a processing flow of a training data processing device. Fig. 3 is a diagram showing an example of the functional configuration of a training data processing device according to another modified example. Fig. 4 is a diagram showing an example of the functional configuration of a computer.

[0011] Hereinafter, embodiments of the present invention will be described in detail. Components having the same functions are given the same numbers, and duplicated explanations will be omitted.

[0012] FIG. 1 shows an example of the functional configuration of a training data processing device according to a first embodiment. FIG. 2 shows an example of a processing flow of the training data processing device. A training data processing device 2 receives raw data for training from a training raw data providing device 1. The training data processing device 2 is connected to a model providing device 3 and a user device 4. The training data processing device 2 may be connected to a label providing device 5, shown by a dashed line in FIG. 1, so as to be able to transmit and receive data. The training data processing device 2 includes a training raw data storage unit 21, a division unit 29, a composite data generation unit 22, a composite data storage unit 23, and a composite data comparison unit 27. As will be described later, the training data processing device 2 may further include a presentation data extraction unit 25, shown by a dashed line in FIG. 1, a model learning management unit 26, shown by a dashed line in FIG. 1, and a model storage unit 24, shown by a dotted line in FIG. 1. The training method is realized, for example, by the components of the training data processing device 2 performing the processes of steps S29, S22, and S27, which will be described below and are shown in FIG. 2.

[0013] The learning raw data storage unit 21 stores the learning raw data provided from the learning raw data providing device 1. The learning raw data providing device 1 may transmit the learning raw data using an encrypted communication method. This prevents leakage of the learning raw data. Of course, the communication method used by the learning raw data providing device 1 when transmitting the learning raw data is not limited to an encrypted communication method. The number of learning raw data providing devices 1 may be one or more. In other words, the learning raw data storage unit 21 may store at least one piece of learning raw data provided from at least one learning raw data providing device 1.

[0014] The dividing unit 29 divides the raw data for learning into raw data for generating synthetic data and raw data for reference (S29). The raw data for generating synthetic data is output to the synthetic data generating unit 22. The raw data for reference is output to the synthetic data comparing unit 27.

[0015] The synthetic data generation unit 22 generates synthetic data, which is pseudo-learning data of the raw data for synthetic data generation, based on the raw data for synthetic data generation (S22). At least one piece of raw data for learning is transmitted from the dividing unit 29, so the synthetic data generation unit 22 can generate synthetic data, which is pseudo-learning data of the raw data for learning, based on the raw data for learning read from the raw data for learning storage unit 21. For example, the synthetic data generation unit 22 generates synthetic data by specifying a privacy jet in advance and taking differential privacy into consideration. The generated synthetic data is output to the synthetic data comparison unit 27.

[0016] The timing at which the dividing unit 29 divides the learning raw data and the composite data generating unit 22 generates the composite data may be every time the learning raw data stored in the learning raw data storage unit 21 is updated, or may be once every several updates of the learning raw data stored in the learning raw data storage unit 21. In this way, the timing at which the composite data generating unit 22 generates the composite data may be determined taking into account the timing at which the learning raw data stored in the learning raw data storage unit 21 is updated. Furthermore, the predetermined time interval may also be determined taking into account the timing at which the learning raw data stored in the learning raw data storage unit 21 is updated.

[0017] The composite data comparison unit 27 compares the distribution of the reference raw data with the composite data, and removes outlying composite data, which is composite data that deviates from the distribution of the reference raw data, from the composite data (S27). The composite data from which the outlying composite data has been removed is stored in the composite data storage unit 23.

[0018] The composite data comparison unit 27, for example, divides the reference raw data and the composite data into multiple clusters by clustering them, and removes from the composite data any composite data included in a cluster where the proportion of composite data is equal to or greater than a predetermined proportion. An example of the predetermined proportion is a real number c between 0 and 1. For example, assume that c = 1, the number of synthetic data included in a certain cluster is 100, and the number of reference raw data included in that cluster is 0. In this case, the proportion of synthetic data included in that cluster is 1, which is equal to or greater than c (= 1), and therefore the composite data included in that cluster is determined to be inferior composite data. The composite data comparison unit 27 performs this process for each cluster and determines inferior composite data. Then, the composite data comparison unit 27 removes the determined inferior composite data from the composite data.

[0019] It is possible to replace the conventional clustering constraint processing with differential privacy processing (for example, by utilizing a differential privacy clustering algorithm). However, in this case, due to the differential privacy composition theorem, the overall privacy budget is the sum of the privacy budgets of each processing. In other words, the privacy budget for the composite data under the same conditions is doubled. Therefore, in order to guarantee privacy equivalent to conventional methods, it is necessary to perform differential privacy processing, which may generate larger noise. This results in a degradation of performance. Therefore, in the past, it was necessary to set ε in (ε, δ)-differential privacy to 1 / 2.

[0020] On the other hand, the clustering in the composite data comparison unit 27 may be hierarchical clustering with guaranteed differential privacy. Specifically, in (ε, δ)-differential privacy, the maximum value ε in the two processes becomes the privacy budget, so if the same ε as when generating the composite data is set in the clustering constraint process, the process can be performed without affecting the differential privacy budget.

[0021] In the training data processing device 2, the division unit 29 divides the training raw data into raw data for generating synthetic data and reference raw data. By using differential privacy assurance processing for the clustering constraint on the reference raw data, which is data different from the raw data for generating synthetic data, it is possible to achieve equivalent differential privacy assurance without increasing the privacy budget.

[0022] The composite data storage unit 23 stores the composite data from which the outlier composite data has been removed by the composite data comparison unit 27. By removing the outlier composite data in this way, the accuracy of the model generated from the composite data from which the outlier composite data has been removed is increased. This is because the distribution of the composite data from which the outlier composite data has been removed is closer to the distribution of the public data than the distribution of the composite data from before the outlier composite data has been removed.

[0023] According to the training data processing device 2, the dividing unit divides the raw data for training into raw data for generating synthetic data and reference raw data. By using the reference raw data that is different from the raw data for generating synthetic data, out-of-order synthetic data is removed from the synthetic data, thereby providing a technology for generating training data that can generate a more accurate model.

[0024] In addition, from the viewpoint of other than differential privacy, the quality of the generated synthetic data generally decreases when there is a small amount of data to be used as the source for generating the synthetic data. In Example 1, the data set is divided, so there are concerns about the impact of a reduction in the number of data. However, by combining this with active learning, the impact of a reduction in the number of data can be offset if only a portion of the data ultimately used for machine learning is extracted.

[0025] In this example, the synthetic data from which the incorrect synthetic data has been removed is used as training data. For example, the model providing device 3 performs training based on the synthetic data from which the incorrect synthetic data has been removed to generate a model (S3). In this example, the model providing device 3 receives the synthetic data stored in the synthetic data storage unit 23, performs training based on the received synthetic data, and generates a model.

[0026] The model providing device 3 may receive the composite data using an encrypted communication method. This can prevent leakage of the composite data. Of course, the communication method used by the model providing device 3 when receiving the composite data is not limited to an encrypted communication method.

[0027] If the training data processing device 2 is equipped with a model storage unit 24 indicated by a dotted line in FIG. 1 , the generated model is transmitted to the training data processing device 2 and stored in the model storage unit 24. The model providing device 3 may transmit the model using an encrypted communication method. This prevents the model from being leaked. Of course, the communication method used by the model providing device 3 when transmitting the model is not limited to an encrypted communication method. Note that reception of the synthetic data by the model providing device 3 may be achieved by allowing the operator of the model providing device 3 to view the synthetic data stored in the synthetic data storage unit 23 via a web browser.

[0028] A user device 4 that wishes to use a model transmits data to be input into the model to the training data processing device 2. The training data processing device 2 obtains an output result when the received data is input into the model read from the model storage unit 24. The obtained output result is transmitted to the user device 4. In this way, the user device 4 can use the model stored in the model storage unit 24.

[0029] <Comparison with Related Prior Art> The following five challenges correspond to the three requirements for secure machine learning processing technology required for data analysis described above. (1) In the processes of building, updating, and inferring training datasets and models, the acquired raw data must not be disclosed to anyone other than the data provider, and the acquired raw data must not be inferable from other presented information. (2) An interface must be provided that allows label providers and model providers to build and update training datasets and models through trial and error. (3) In the processes of building, updating, and inferencing models, model architecture and parameter information must not be disclosed to anyone other than the model provider. (4) The time required for learning and inference performance of the built and updated models must not be inferior to machine learning models built in conventional environments. (5) It must be possible to obtain the same performance of a machine learning model as when labels are assigned to all data, even if labels are not assigned to all data.

[0030] The training data processing device 2 can solve the five problems described above. On the other hand, the related conventional technologies, such as data sandboxing, synthetic data generation, secure computation AI, and automatic machine learning, each have their own difficulties.

[0031] The most relevant technology is the data sandbox. Data sandbox is a processing technology (see Non-Patent Document 1) that uses TEE to ensure a secure environment on hardware and enables both learning and inference to be performed in plain text within that environment. However, data sandbox does not solve the problem (2) because it does not have an interface that allows humans to build training datasets and construct and update models while referencing the data.

[0032] Synthetic data generation is a processing technique that generates a pseudo-dataset based on the acquired original data. By using synthetic data generated with a privacy budget specified in advance and taking differential privacy into consideration, the model creator can build a model by trial and error without accessing the original data. However, since synthetic data generation is not a processing technique that conceals model information, it cannot solve problem (3). In addition, there is a trade-off: the smaller the privacy budget for differential privacy, the less useful the generated dataset becomes. As a result, the performance of the model trained based on the generated dataset will also be inferior. Therefore, it cannot solve problem (4).

[0033] Secure computing AI is a processing technology that can perform both learning and inference using multi-party secure computation, outputting results while keeping data confidential. Secure computing AI assumes that the model used for learning is known, and there is no interface that allows humans to build and update the model used for learning while referring to data. Therefore, it does not solve problem (2). Furthermore, secure computing AI takes longer to learn than conventional machine learning models, and currently does not cover the calculations of all machine learning algorithms, so its performance may be inferior. Therefore, it is difficult to solve problem (4).

[0034] Automated machine learning is a processing technology that builds and updates models without human intervention by automatically exploring model architectures and parameters. Although automated machine learning is a processing technology for building models without human intervention, it does not aim to keep data or models confidential, and therefore does not solve problems (1), (2), and (3). Furthermore, automated machine learning does not have an interface that can reflect human domain knowledge, and the performance of the constructed models is limited to what can be achieved within a predetermined search range, which can result in inferior performance. Therefore, there are problems addressing problem (4).

[0035] [Variation 1] The learning data processing device 2 may also be connected to the label provision device 5 shown by the dashed line in Fig. 1 . In this case, the composite data read from the composite data storage unit 23 is transmitted to the label provision device 5. The transmission of the composite data to the label provision device 5 may be performed using an encrypted communication method. This makes it possible to prevent leakage of the composite data. Of course, the communication method used when transmitting the composite data to the label provision device 5 is not limited to an encrypted communication method.

[0036] The label providing device 5 assigns labels to the synthetic data received from the training data processing device 2 (S5). The labeled synthetic data is transmitted to the model providing device 3. The labeled synthetic data is also referred to as training data. The labeled synthetic data may be transmitted to the training data processing device 2 and stored in the synthetic data storage unit 23. This allows the labeled synthetic data to be managed by the training data processing device 2. Of course, the labeled synthetic data may also be managed independently by the label providing device 5.

[0037] The model providing device 3 performs learning using the labeled synthetic data to generate a model. The subsequent processing is the same as in the above embodiment. In this way, the label providing device 5 assigns labels to the synthetic data, making it possible to perform supervised learning or semi-supervised learning.

[0038] [Variation 2] The training data processing device 2 may include a presentation data extraction unit 25 indicated by a dashed line in Fig. 1. The presentation data extraction unit 25 extracts a portion of the composite data from which the outlier composite data has been removed, and sets the extracted portion as presentation data (S25). To this end, the presentation data extraction unit 25 extracts, for example, a portion of the composite data stored in the composite data storage unit 23, and sets the extracted portion as presentation data.

[0039] The extracted synthetic data (presentation data) is transmitted to, for example, the model providing device 3. In this case, the model providing device 3 performs learning based on the presentation data and generates a model. The subsequent processing is the same as in the above embodiment.

[0040] 1 is provided, the composite data (presentation data) extracted by the presentation data extraction unit 25 may be transmitted to the label providing device 5. In this case, the label providing device 5 assigns a label to the presentation data. The subsequent processing is the same as in Modification 1. In this way, the model providing device 3 may perform learning using the composite data to which labels have been assigned by the label providing device 5 that assigns labels to the presentation data, and generate a model.

[0041] The data to be transmitted may be sent from the data sandbox to the local environments of the label providing device 5 and the model providing device 3. Alternatively, the data may be passed to the operator of the model providing device 3 by being shown on a web UI screen. When considering the risk of data leakage during communication, an encrypted communication method can be selected, but the method is not limited to this.

[0042] The presentation data extraction unit 25 may extract a portion of the composite data randomly, or may extract a portion of the composite data in consideration of at least one of the distribution of past composite data stored in the composite data storage unit 23 and the distribution of the current composite data. For example, the presentation data extraction unit 25 may extract a portion of the composite data in consideration of a comparison between the distribution of past composite data stored in the composite data storage unit 23 and the distribution of the current composite data.

[0043] Furthermore, the number of pieces of composite data extracted by the presentation data extraction unit 25 may be a constant, or may be dynamically determined, for example, taking into consideration the privacy budget and / or the current distribution of composite data.

[0044] By extracting a portion of the synthetic data by the presentation data extraction unit 25, it is possible to increase the uncertainty of the distribution of the synthetic data, making it more difficult to estimate the raw data for training. In other words, by not providing all of the synthetic data to the model providing device 3 or the label providing device 5, it is possible to reduce the possibility of the raw data for training being leaked.

[0045] [Variation 3] The training data processing device 2 may include a model learning management unit 26 indicated by a two-dot chain line in Fig. 1 in addition to the presentation data extraction unit 25 of Variation 2. The model learning management unit 26 performs additional training of the model generated by the model providing device 3 using raw data and / or synthetic data for training (S26).

[0046] For example, if the raw data and synthetic data are labeled data and the learning method is supervised learning or semi-supervised learning, the model learning management unit 26 can combine the raw data and synthetic data that are allowed to be used for learning with the presented data, treat them as training data, and perform additional learning on the model stored in the model memory unit 24.

[0047] When the learning method is unsupervised learning, the model learning management unit 26 simply combines the presented data with raw data and synthetic data that are permitted to be used for learning, and performs additional learning on the model stored in the model memory unit 24.

[0048] If the raw data and synthetic data are unlabeled data and the learning method is supervised learning or semi-supervised learning, the model learning management unit 26 can perform additional learning of the model stored in the model memory unit 24 using semi-supervised learning, while keeping the raw data and synthetic data that is allowed to be used for learning, in combination with the presented data, as unlabeled data.

[0049] By having the model learning management unit 26 perform additional learning, it is possible to secure a sufficient amount of learning data while confining most of the data within the data sandbox, thereby improving the performance of the model.

[0050] [Other Modifications] The specific configurations of the embodiments of the disclosed technology are not limited to the configurations described above. The specific configurations of the embodiments of the disclosed technology can be modified in design as appropriate within the scope of the spirit of the embodiments of the disclosed technology. The various processes described in the embodiments of the disclosed technology may not only be executed chronologically in the order described, but may also be executed in parallel or individually depending on the processing capacity of the device executing the processes or as needed.

[0051] The learning raw data storage unit 21 may be provided outside the learning raw data providing device 1, as exemplified in Fig. 3. In other words, the learning raw data providing device 1 does not need to be provided with the learning raw data storage unit 21. In this case, the learning raw data is transmitted from the learning raw data storage unit 21 to the learning data processing device 2, for example, using an encrypted communication method. Of course, the communication method used when transmitting the learning raw data from the learning raw data storage unit 21 to the learning data processing device 2 is not limited to an encrypted communication method. In the example of Fig. 3 as well, there may be multiple learning raw data providing devices 1.

[0052] The model providing device 3 may be composed of multiple devices. Similarly, the label providing device 5 may be composed of multiple devices. For example, data exchange between the components of the training data processing device may be performed directly or via a storage unit (not shown).

[0053] The label providing device 5 and the model providing device 3 may be the same device. In this case, for example, the labeled synthetic data and the model are transmitted to the training data processing device 2 at the same time.

[0054] The user device 4 may be a device different from the learning raw data providing device 1, the model providing device 3, and the label providing device 5, or may be the same device.

[0055] Each of the learning raw data providing device 1, the model providing device 3, the label providing device 5, and the user device 4 may be configured from multiple devices.

[0056] At least one of the label providing device 5 and the model providing device 3 may be able to access the raw data for learning.

[0057] [Processor, Program, Recording Medium] The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), a CPU (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes a program stored in a memory.

[0058] In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions.

[0059] If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0060] The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 4, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

[0061] The program describing the processing contents can be recorded on a computer-readable recording medium, which may be, for example, a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, or any other suitable recording medium.

[0062] The program may be distributed by, for example, selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, the program may be stored in a storage device of a server computer, and then transferred from the server computer to other computers via a network, thereby distributing the program.

[0063] A computer that executes such a program may first temporarily store the program recorded on a portable recording medium or transferred from a server computer in its own storage device. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process in accordance with the read program. Alternatively, the computer may read the program directly from a portable recording medium and execute the process in accordance with the program. Furthermore, the computer may execute the process in accordance with the program each time a program is transferred from a server computer to the computer. Alternatively, the server computer may not transfer the program to the computer, but may instead execute the process through a so-called ASP (Application Service Provider) service, which realizes the processing function by issuing an execution instruction and obtaining the results. Furthermore, the server computer may execute the process at the terminal using a so-called SaaS (Software as a Service) service, which allows users to use part of a server computer along with the program. In this embodiment, the program includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct instruction to a computer but has properties that dictate computer processing).

[0064] Furthermore, in this embodiment, the device is configured by executing a predetermined program on a computer, but at least a part of the processing contents may be realized by hardware.

[0065] REFERENCE SIGNS LIST 1 Learning raw data providing device 2 Learning data processing device 3 Model providing device 4 User device 5 Label providing device 21 Learning raw data storage unit 22 Synthetic data generation unit 23 Synthetic data storage unit 24 Model storage unit 25 Presentation data extraction unit 26 Model learning management unit 27 Synthetic data comparison unit 29 Division unit

Claims

1. A training data processing device comprising: a division unit that divides raw data into raw data for generating synthetic data and reference raw data; a synthetic data generation unit that generates synthetic data, which is pseudo-training data of the raw data for generating synthetic data, based on the raw data for generating synthetic data; and a synthetic data comparison unit that compares the distribution of the reference raw data with the synthetic data and removes outlying synthetic data, which is synthetic data that deviates from the distribution of the reference raw data, from the synthetic data.

2. A training data processing device according to claim 1, wherein the synthetic data comparison unit divides the reference raw data and the synthetic data into a plurality of clusters by clustering them, and removes synthetic data included in a cluster where the proportion of synthetic data is equal to or greater than a predetermined proportion from the synthetic data as outlier synthetic data.

3. The training data processing device according to claim 2, wherein the clustering performed by the synthetic data comparison unit is hierarchical clustering with differential privacy guarantee.

4. A learning data processing method that executes the following steps: a division step of dividing raw data into raw data for generating synthetic data and reference raw data; a synthetic data generation step of generating synthetic data, which is pseudo-learning data of the raw data for generating synthetic data, based on the raw data for generating synthetic data; and a synthetic data comparison step of comparing the distribution of the reference raw data with the synthetic data and excluding outlying synthetic data, which is synthetic data that deviates from the distribution of the reference raw data, from the synthetic data.

Images