Data dimension compression method, data dimension compression system, secure computation device, and user terminal

Abstract

There is a desire for dimension compression of training data by linear discriminant analysis to be achieved by secure computation. An AI analysis model generation system according to the disclosed technology comprises a secure computation device and a user terminal. The secure computation device acquires data with n rows and m columns encrypted so as to be able to be securely computed, the data comprising n m-dimensional vectors to which class classifications are assigned. For each class, encrypted vectors belonging to the class are securely computed to obtain an encrypted sum vector and an encrypted sum-of-products matrix. The user terminal decrypts the encrypted sum vector and the encrypted sum-of-products matrix to obtain a plaintext sum vector and a plaintext sum-of-products matrix, uses the plaintext sum vector and the plaintext sum-of-products matrix to obtain a within-class scatter matrix and a between-class scatter matrix, and uses the within-class scatter matrix and the between-class scatter matrix to obtain a transformation matrix with m rows and d columns.

Description

Data dimensionality reduction method, data dimensionality reduction system, secure computing device, and user terminal

[0001] The disclosed technology relates to data utilization techniques in AI analysis using secure computation. In particular, it relates to a method and apparatus for performing data dimensionality reduction using linear discriminant analysis with secure computation.

[0002] While momentum is building for data utilization in AI and other fields, demands for privacy protection are also increasing. This creates a need for environments in fields such as healthcare where highly confidential data can be analyzed using proven AI algorithms.

[0003] Secure Computation AI is a technology for securely utilizing data accumulated by multiple companies. It enables the creation of highly secure and diverse AI algorithms for model creation and inference (data management where only the calculation results are visible to anyone) without ever decrypting the encrypted data. While Secure Computation AI can provide statistical analysis and machine learning services that can be used while keeping data confidential, it is significantly less efficient than processing data in plaintext because it performs analysis and processing without viewing the data. To date, no systems have been implemented that operate under realistic usage conditions (acceptable computation time).

[0004] To efficiently operate secure computation AI, methods can be considered to reduce computational complexity by compressing the attributes of the training data. One representative method for this is linear discriminant analysis (Non-Patent Literature 1).

[0005] [Linear Discriminant Analysis (LDA)] Assume the data to be analyzed consists of n records with m elements. Let this be X, and each record and element belonging to X can be represented as a vector or matrix as follows.

[0006] Each record belongs to one of the classes 1, 2, ..., c. The number of records in class i (i=1, 2, ..., c) is n. (i) Let's assume that.

[0007] The record set of class i is X (i) Let's assume that. X (i)Each record and element belonging to

[0008] xj → and (xj (i) ) → The direction vector for projection is w → . Then, the variance J → of the class - wise average value after projection by w b (w → ) is given by the following formula. Also, the sum J → of the within - class variances after projection by w W (w → ) is given by the following formula. Here, μ → is the average vector of all records, (μ (i) ) → is the average vector of the records within a class and is given by the following formula. Also, Σ b is the between - class scatter matrix, and Σ W is called the within - class scatter matrix.

[0009] In linear discriminant analysis, the projection vector w b (w → ) is selected such that the projected records of different classes are as far apart as possible (so that J W (w → ) is large) and the variance of each class after projection is small (so that J → is small). For this reason, the following evaluation function is considered. The w → ) that maximizes J(w → and the evaluation value are obtained as the eigenvectors and eigenvalues of (Σ W ) -1 Σ b . The obtained projection vector w → (an m - dimensional vector), using d (d < m) of them, a transformation matrix of m rows and d columns can be constructed, and the n - row and m - column data can be compressed into n - row and d - column data.

[0010] scikit-learn, "LinearDiscriminantAnalysis", [Retrieved November 19, 2024], Internet, <https: / / scikitlearn.org / stable / modules / generated / sklearn.discriminant_analysis.LinearDiscriminantAnalysis.html>

[0011] Linear discriminant analysis allows for dimensionality reduction based on the classification characteristics of the training data, which was difficult with conventional principal component analysis, enabling dimensionality reduction that extracts more of the training data's features. However, linear discriminant analysis requires four major calculations: (1) the intraclass variance matrix, (2) the interclass variance matrix, (3) the inverse matrix, and (4) eigenvalues ​​and eigenvectors. Calculations (3) and (4) are computationally expensive, and directly implementing them using secure computation would prevent the creation of a system that operates within an acceptable computation time.

[0012] To solve the above problems, this specification discloses an AI analysis model generation system that compresses the dimensionality of the data to be analyzed using a linear discriminant analysis method while keeping the data to be analyzed confidential. The AI ​​analysis model generation system according to the disclosed technology consists of a secure computing device and a user terminal. The secure computing device includes a recording unit, a first transformation matrix learning unit, and a dimensionality compression unit. The user terminal includes a second transformation matrix learning unit. The recording unit of the secure computing device records n x m data, which consists of n m-dimensional vectors assigned to class classifications (n ​​and m are natural numbers greater than 1), and is encrypted securely. The first transformation matrix learning unit of the secure computing device securely computes the encrypted vectors belonging to each class to obtain an encrypted sum vector and an encrypted sum of products matrix. The second transformation matrix learning unit of the user terminal decrypts the encrypted sum vector and encrypted sum product matrix to obtain the plaintext sum vector and plaintext sum product matrix, uses the plaintext sum vector and plaintext sum product matrix to obtain the intraclass dispersion matrix and interclass dispersion matrix, uses the intraclass dispersion matrix and interclass dispersion matrix to obtain an m x d (d is a natural number smaller than m) transformation matrix, and obtains an encrypted transformation matrix by encrypting the transformation matrix in a secure computation manner. The dimensionality reduction unit of the secure computation device uses the encrypted transformation matrix to convert the encrypted n x m data into encrypted n x d data.

[0013] According to the disclosed technology, dimensionality reduction using linear discriminant analysis becomes possible within an acceptable computation time. This expands the applicability of secure computation AI (such as AI-based data analysis) and improves ease of implementation (such as integration with business assets).

[0014] A functional block diagram showing an example configuration of the AI ​​analysis model generation system according to the first embodiment. A detailed functional block diagram of the user terminal and secure computing device. A flowchart explaining an example of the operation of the AI ​​analysis model generation system. A flowchart showing the details of the operation of the dimensionality reduction unit. A diagram showing an example of the functional configuration of the computer.

[0015] Prior to describing the embodiments, the basic technical concepts used in this disclosure will be explained.

[0016] <Secret Sharing Technology> Secret sharing is a technology that converts data into multiple distributed values, allowing the original data to be reconstructed using a certain number of distributed values, while preventing any reconstruction of the original data from fewer than a certain number of distributed values. (k,n)-secret sharing, a type of secret sharing, involves dividing the input plaintext into n parts and distributing these distributed values ​​among n computational entities. The plaintext can be reconstructed using any k distributed values, while no information about the plaintext can be obtained from fewer than k distributed values. In this case, n and k are integers greater than or equal to 1, and n ≥ k. A typical example of (k,n)-secret sharing is Shamir's secret sharing, described in "A. Shamir, "How to share a secret", Communications of the ACM, Volume 22 Issue 11, pp. 612-613, 1979. (Reference 1)". The secret sharing used in this disclosure may be any method that allows for the use of the secret computation described later. In this specification, plaintext scalar s, plaintext vector v → , the secret distribution values ​​of the plaintext matrix A are [s], [v → This is denoted as ], [A].

[0017] <Secure Computation Technology> Secure computation is a technique in which data to be computed is secretly shared and stored among multiple computing entities, and the distributed values ​​of the function values ​​of the original data are calculated in cooperation with other computing entities without restoring the original data. Secure computation utilizes secret sharing as an elemental technology.

[0018] The secure computation used in the first embodiment of this disclosure can be any method that allows various operations necessary for the desired data processing on a value distributed by a specific secret sharing method. For example, a secure computation technique that performs basic operations such as addition and multiplication on a secret-shared value is described in "Koji Senda, Hiroki Hamada, Dai Igarashi, Katsumi Takahashi, "Rethinking Lightweight Verifiable Three-Party Secure Function Computation," Computer Security Symposium 2010, 2010 (Reference 2)." Secure computation aggregate functions that perform counting, summing, and sum-of-products from the secret-shared values ​​of database records while keeping the information secret are described, for example, in International Publication WO2019 / 221108 (Reference 3) for counting, and in International Publication WO2019 / 208484 (Reference 4) for summing and sum-of-products.

[0019] The embodiments of the disclosed technology will be described in detail below. Components with the same function will be numbered identically, and redundant explanations will be omitted.

[0020] As mentioned above, LDA processing requires inverse matrix calculation and eigenvalue / eigenvector calculation. These are computationally expensive processes and are not desirable to implement directly using secure computation. After the inventors examined each process in linear discriminant analysis in detail, they determined that the number of records belonging to each class is n. (i) We found that by using the intraclass sum vector (described later) and the intraclass sum product matrix (described later), it is possible to calculate (1) the intraclass variance matrix, (2) the interclass variance matrix, (3) the inverse matrix, and (4) eigenvalues ​​and eigenvectors. Therefore, the number of records per class, the intraclass sum vector, and the intraclass sum product matrix are calculated securely using secure computation, and subsequent calculations are performed in plaintext. This allows linear discriminant analysis to be processed quickly on secure computation. In particular, complex matrix operations such as the calculation of the inverse matrix and the calculation of eigenvalues ​​and eigenvectors are known to be very slow on secure computation, so the speedup achieved by processing them on the plaintext side is significant.

[0021] Furthermore, when the number of records is sufficiently large, it is generally difficult to estimate the original data from the sum vector and sum product matrix, so the security of the original data is not compromised even if the sum vector and sum product matrix are decoded. The transformation process using linear discriminant analysis can be implemented with simple matrix multiplication and can therefore be directly implemented using secure computation.

[0022] First, we will show that the intra-class variance matrix and the inter-class variance matrix can be calculated from the number of records per class, the intra-class sum vector, and the intra-class sum product matrix.

[0023] <Class sum vector> X (i) The sum vector of records belonging to (S (i) ) → We define it by the following equation. (S (i) ) → Using this, the sum vector S of all records belonging to X is obtained. → It is calculated as follows:

[0024] <Intraclass summation matrix> X (i) The sum of products matrix P of the records belonging to this category. (i) We define it by the following equation. P (i) Using this method, the sum-of-products matrix P of all records belonging to X is calculated as follows:

[0025] [Intraclass distribution matrix] Σ of equation (6) W For this, the within-class distribution matrix for each class is Σ W (i) Let's assume that. Σ W (i) Transforming this equation yields the following: Therefore, Σ W However, n (i) and P (i) and (S (i) ) → It was shown that it can be calculated using [this method].

[0026] [Interclass distribution matrix] Σ of equation (5) b Transforming this equation yields the following: Therefore, Σ bHowever, n (i) and (S (i) ) → It was shown that it can be calculated using [this method].

[0027] Note Σ b It can also be calculated using the following relationship. However, Σ is the variance matrix of all records (X), and is given by the following formula. Σ and ΣW are n (i) and P (i) and (S (i) ) → Since it can be calculated as follows, the Σ of equation (16) b n (i) and P (i) and (S (i) ) → It can be calculated using this method.

[0028] [First Embodiment] Figure 1 is a functional block diagram showing an example configuration of the AI ​​analysis model generation system according to the first embodiment. The AI ​​analysis model generation system 1 includes secure computing devices 101, ..., 10 n The user terminal 11 is connected to the secure computing device 10 via a communication network 12. Figure 2 is a detailed functional block diagram of the user terminal 11 and the secure computing device 10. The user terminal 11 includes a learning request unit 21, a decoding unit 22, and a second transformation matrix learning unit 27. The secure computing device 10 includes a recording unit 23, a dimensionality reduction unit 24, a learning unit 25, and a first transformation matrix learning unit 26. Figure 3 is a flowchart illustrating an example of the operation of the AI ​​analysis model generation system 1. Figure 4(a) is a flowchart detailing the operation of the first transformation matrix learning unit 26, and (b) is a flowchart detailing the operation of the second transformation matrix learning unit 27. The first embodiment will be described below using Figures 1, 2, 3, and 4. In the following description, "secretive computing" refers to the secure computing devices 101, ..., 10 n This refers to storing the data to be calculated using secret sharing, and then collaborating with other secure computing devices to calculate the variance of the function values ​​of the original data without recovering the original data.

[0029] Secret computing device 101,…,10 nThe recording unit 23 is assumed to record data (distribution value) of the data to be analyzed, which has been encrypted by secret sharing. The user terminal 11 is connected to each secret computing device 101, ..., 10 n A learning request (a request to generate an AI analysis model) is made (step S301). In the learning request, for example, the data to be analyzed [X], the dimension d to compress the data to be analyzed, and the AI ​​analysis model are specified.

[0030] Secret computing device 101,…,10 n The first transformation matrix learning unit 26 performs the first transformation matrix learning process (described later) to securely calculate the number of records for each class, the sum vector within the class, and the sum product matrix within the class (step S302). Secure computing devices 101, ..., 10 n The system sends the variance of the number of records for each class, the variance of the intra-class sum vector, and the variance of the intra-class sum-of-products matrix to the user terminal 11 (step S303).

[0031] The second transformation matrix learning unit 27 of the user terminal 11 performs the second transformation matrix learning process (described later) to obtain the transformation matrix R, and encrypts R by secret sharing (step S304). The user terminal 11 then uses the variance value [R] to obtain the secret computing devices 101, ..., 10 n Send to (step S305). Assume that [X] is n row m column data. Secure computing devices 101, ..., 10 n The dimensionality reduction unit 24 performs a secure calculation of the matrix product of the specified data to be analyzed [X] and [R] to generate an n-row, d-column encrypted data [Z] (step S306).

[0032] Next, secure computing devices 101, ..., 10 n The learning unit 25 uses [Z] to securely compute the parameters [Param] of the AI ​​analysis model (step S307). Then, the secure computing devices 101, ..., 10 n The calculated [Param] is sent to the user terminal 11 (step S308). The user terminal 11 receives secure computing devices 101, ..., 10 n The Param obtained from [Param] is decoded (step S309) and an AI analysis model is obtained.

[0033] The above is the overall picture of the operation of the AI analysis model generation system 1.

[0034] <<Learning of Transformation Matrix>> The learning of the transformation matrix will be described. This process consists of the first transformation matrix learning process performed by the secure computing devices 101,..., 10 n and the second transformation matrix learning process performed by the user terminal 11. <<First Transformation Matrix Learning Process>> FIG. 4(a) is a flowchart showing the details of the operation of the first transformation matrix learning unit 26. The secure computing devices 101,..., 10 n The recording units of store, together with [X], n-dimensional data [y → indicating the class of each record. That is, y j represents the class of the record (x j ). →

[0035] The first transformation matrix learning unit 26 calculates, for 1 ≤ i ≤ c, the number of records n j for which y (i) = i using a secure aggregation function (count), and obtains [n → (step S401).

[0036] The first transformation matrix learning unit 26 calculates an encrypted sum vector [(s (i) ) → using a secure aggregation function (sum) (step S402). The first transformation matrix learning unit 26 calculates an encrypted product sum matrix [P (i) using a secure aggregation function (product sum) (step S403). As described above, [n → , [(s (i) ) → , and [P (i) are transmitted to the user terminal 11.

[0037] <<Second Transformation Matrix Learning Process>> FIG. 4(b) is a flowchart showing the details of the operation of the second transformation matrix learning unit 27 of the user terminal 11. The second transformation matrix learning unit 27 uses the distributed values received from each secure computing device to calculate [n → , [(s (i) ) → , and [P (i) ​Decrypt the data (step S404).

[0038] The second transformation matrix learning unit 27 is n → and (s (i) ) → and P (i) Using this, the within-class distribution matrix Σ W and the interclass distribution matrix Σ b The second transformation matrix learning unit 27 calculates A = (Σ W ) -1 Σ b Calculate (step S406).

[0039] The second transformation matrix learning unit 27 calculates all the eigenvalues ​​of A (step S407). From the eigenvalues, d are selected in descending order (λ1, ..., λ d ) The second transformation matrix learning unit 27 is λ1,...,λ d The corresponding eigenvector (v1 → ,…,v d → ) is calculated (step S408) to generate the m-row, d-column transformation matrix R.

[0040] The second transformation matrix learning unit 27 encrypts R using secret sharing and generates the distributed value [R] (step S409). As described above, [R] is the secret computing device 101, ..., 10 n It is sent to [the specified destination]. This concludes the explanation of learning the transformation matrix.

[0041] The above describes the first embodiment. In the above description, the second transformation matrix learning process (generation of the transformation matrix) was performed on the user terminal 11, but the second transformation matrix learning process may be performed on any of the secure computing devices. For example, secure computing device 10 １ other secure computing devices 102, ..., 10 n [n → ] and [(s (i) ) → ] and [P (i) ] and secure computing device 10 １ The second transformation matrix learning process is performed, and the variance value [R] is obtained from other secure computing devices 102, ..., 10 n You should distribute it there.

[0042] [Programs, Recording Media] The functions realized by the components described herein may be implemented in a circuitry or processing circuitry, including a general-purpose processor, an application-specific processor, an integrated circuit, an ASIC (Application Specific Integrated Circuit), a CPU (a Central Processing Unit), conventional circuits, and / or a combination thereof, programmed to realize the functions described herein. A processor includes transistors and other circuits and is considered a circuitry or processing circuitry. A processor may be a programmed processor that executes a program stored in memory.

[0043] In this specification, circuitry, unit, and means are hardware programmed to perform or execute the functions described herein. Such hardware may be any hardware disclosed herein, or any hardware known to be programmed to perform or execute the functions described herein.

[0044] If the hardware is a processor that is considered to be a type of circuitry, then the circuitry, means, or unit is a combination of hardware and software used to constitute the hardware and / or processor.

[0045] The various processes described above can be carried out by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 5, and then causing the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc. to operate.

[0046] The program describing this process can be recorded on a computer-readable recording medium. Any computer-readable recording medium can be used, such as a magnetic recording device, optical disc, magneto-optical recording medium, or semiconductor memory.

[0047] Furthermore, this program may be distributed, for example, by selling, transferring, or lending portable recording media such as DVDs or CD-ROMs on which the program is recorded. Alternatively, the program may be stored in the storage device of a server computer and distributed by transferring the program from the server computer to other computers via a network.

[0048] A computer executing such a program may, for example, first store the program recorded on a portable storage medium or a program transferred from a server computer in its own storage device. Then, when processing is to be executed, the computer reads the program stored on its own storage medium and executes the processing according to the read program. Alternatively, the computer may directly read the program from the portable storage medium and execute the processing according to that program, or it may sequentially execute the processing according to the received program each time a program is transferred to it from a server computer. Furthermore, the processing may be executed using a so-called ASP (Application Service Provider) type service, where the processing function is realized only by issuing execution instructions and obtaining results, without transferring the program from the server computer to this computer.In addition, the processing may be executed using a so-called SaaS (Software as a Service) type service, where a part of the server computer is made available to the user along with the program. Furthermore, the term "program" in this form includes information used for processing by an electronic computer that is equivalent to a program (data, etc., that is not a direct instruction to the computer but has the property of defining the processing of the computer).

[0049] Furthermore, in this configuration, the device is configured by executing a predetermined program on a computer, but at least a part of these processes may be implemented in hardware.

Claims

1. A system comprising a secure computing device and a user terminal is used to compress the dimensionality of data to be analyzed using a linear discriminant analysis method while keeping the data to be analyzed confidential, wherein the recording unit of the secure computing device acquires n x m data consisting of n m-dimensional vectors assigned to class classifications (n ​​and m are natural numbers greater than 1), which are encrypted securely; the first transformation matrix learning unit of the secure computing device securely computes the encrypted vectors belonging to each class to obtain an encrypted sum vector and an encrypted sum of products matrix; the second transformation matrix learning unit of the user terminal decrypts the encrypted sum vector and the encrypted sum of products matrix to obtain a plaintext sum vector and a plaintext sum of products matrix; the intraclass dispersion matrix and the interclass dispersion matrix are used to obtain an m x d (d is a natural number less than m) transformation matrix using the intraclass dispersion matrix and the interclass dispersion matrix; and the transformation matrix is ​​encrypted securely to obtain an encrypted transformation matrix. A data dimension reduction method in which the dimension reduction unit of a secure computing device uses the encryption transformation matrix to convert the encrypted n x m data into encrypted n x d data.

2. A system comprising a secure computing device and a user terminal, which compresses the dimensionality of the data to be analyzed by a linear discriminant analysis method while keeping the data to be analyzed confidential, comprising: a recording unit of the secure computing device that records n x m-dimensional data consisting of n m-dimensional vectors assigned to class classifications (n ​​and m are natural numbers greater than 1), which are encrypted in a secure computing manner; a first transformation matrix learning unit of the secure computing device that securely computes the encrypted vectors belonging to each class to obtain an encrypted sum vector and an encrypted sum of products matrix; a second transformation matrix learning unit of the user terminal that decrypts the encrypted sum vector and the encrypted sum of products matrix to obtain a plaintext sum vector and a plaintext sum of products matrix, uses the plaintext sum vector and the plaintext sum of products matrix to obtain an intra-class distribution matrix and an inter-class distribution matrix, uses the intra-class distribution matrix and the inter-class distribution matrix to obtain an m x d (d is a natural number less than m) transformation matrix, and obtains an encrypted transformation matrix obtained by securely encrypting the transformation matrix; A data dimension compression system comprising a dimension compression unit of a secure computing device that uses the encryption transformation matrix to convert the encrypted n x m data into encrypted n x d data.

3. A secure computing device comprising a secure computing device and a user terminal, comprising a system that compresses the dimensionality of data to be analyzed by a linear discriminant analysis method while keeping the data to be analyzed confidential, the secure computing device comprising: a recording unit that records n x m-dimensional data consisting of n m-dimensional vectors assigned to class classifications (n ​​and m are natural numbers greater than 1), which are encrypted in a secure computing manner; a transformation matrix learning unit that securely computes the encrypted vectors belonging to each class, calculates an encrypted sum vector and an encrypted sum of products matrix, and transmits them to the user terminal; and a dimensionality compression unit that obtains an m x d (d is a natural number less than m) encrypted transformation matrix obtained by the user terminal from the encrypted sum vector and the encrypted sum of products matrix, and converts the encrypted n x m-dimensional data into encrypted n x d-dimensional data.

4. A user terminal comprising a secure computing device and a user terminal, comprising a system that compresses the dimensionality of data to be analyzed by a linear discriminant analysis method while keeping the data to be analyzed confidential, the user terminal comprising: a learning request unit that instructs the secure computing device to provide data to be analyzed; and a transformation matrix learning unit that, assuming the data to be analyzed is n x m column data (where n and m are natural numbers greater than 1), obtains an encrypted sum vector and an encrypted sum of products matrix from the data to be analyzed from the secure computing device, decrypts the encrypted sum vector and the encrypted sum of products matrix to obtain a plaintext sum vector and a plaintext sum of products matrix, uses the plaintext sum vector and the plaintext sum of products matrix to obtain an intraclass distribution matrix and an interclass distribution matrix, uses the intraclass distribution matrix and the interclass distribution matrix to obtain an m x d (where d is a natural number less than m) transformation matrix, and obtains an encrypted transformation matrix obtained by encrypting the transformation matrix in a secure computing manner.

Images