Secure Machine Learning Parameter Updates via Isolated Instances

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

In medical and other applications, entities with AI expertise lack the data security and privacy measures to handle sensitive training data for AI models, while entities with data security expertise lack AI know-how, making it challenging to perform privacy-preserving machine learning updates.

Innovation Solution

A method and system for securely updating machine learning parameters using isolated computing instances that cannot communicate with each other, with a orchestrator entity ensuring security criteria are met, and allowing for the creation and destruction of these instances to prevent data exposure.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If entities with AI expertise use their own computing systems to train models, then machine learning can be performed efficiently, but data security and privacy protection deteriorate

Engineering Contradiction:
Improvemachine learning training efficiencyVSAvoiddata security and privacy protection
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The system segments the computing tasks by distributing data samples across multiple isolated computing instances, each processing a subset of data independently. This segmentation allows efficient parallel machine learning training while maintaining security boundaries between instances, preventing any single entity from accessing the complete dataset.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary orchestrator entity that coordinates between data-holding entities and AI-expert entities. The orchestrator manages the distributed computing instances, assigns data samples, collects results, and aggregates gradients, enabling secure collaboration without direct access between parties.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If entities with data security expertise create secure environments, then data privacy is protected, but machine learning know-how and computational capability deteriorate

Engineering Contradiction:
Improvedata privacy protectionVSAvoidmachine learning computational capability
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The system divides the computational workload across multiple isolated computing instances, each capable of performing machine learning operations on assigned data samples. This segmentation maintains privacy by isolating data while preserving computational capability through distributed processing.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The isolated computing instances are designed as universal computing units that can execute various machine learning functions and process different data types. Each instance serves multiple purposes: data processing, model training, and security isolation, making the system adaptable to different AI tasks while maintaining privacy protection.

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Reliability

If data is kept private and secure, then data protection regulations are fulfilled, but collaboration for joint model training deteriorates

Engineering Contradiction:
Improvedata protection complianceVSAvoidcollaboration capability for joint training
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The orchestrator entity acts as a mediator that enables collaboration between data-holding entities and AI-expert entities without requiring direct data sharing. It coordinates the distributed computing instances, manages data sample assignment, collects computational results, and aggregates gradients, facilitating joint model training while maintaining data protection compliance.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional mechanical data sharing mechanisms with a computational abstraction layer. Instead of sharing actual data files between entities, the system uses virtualized computing instances that process data locally and communicate only through standardized interfaces for model parameters and gradients, enabling collaboration without data exposure.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

4Productivity

If computing instances remain active for continuous processing, then productivity is maintained, but security risks from persistent state accumulation increase

Engineering Contradiction:
Improvecontinuous processing capabilityVSAvoidsecurity risks from state accumulation
Core Design Contradiction:
ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system employs short-lived isolated computing instances that are created, used, and destroyed in each processing cycle. These transient instances do not persist between tasks, eliminating the accumulation of sensitive state information. After completing their computational function, instances are terminated and their memory is freed, reducing security risks associated with persistent storage.

Inventive Principle:
Principle #27Cheap short-living objects (Disposable)

Data Source

PatentEP3767511B1Securely performing parameter data updates
Publication Date: 2021.08.25 SIEMENS HEALTHCARE GMBH
  • EP3767511B1 patent drawingFigure 1
  • EP3767511B1 patent drawingFigure 2
  • EP3767511B1 patent drawingFigure 3~4

AI summary

The invention provides a system and a method for a parameter update, comprising: - obtaining, by a first entity (10), a function (1) and parameter data (2) from a second entity (20); - selecting (S20) data samples (3) provided by the first entities (10); - providing (S30) a plurality of mutually isolated computing instances (12); - assigning (S40) and providing (S50) the selected data samples (3) to the computing instances (12); - calculating (S60), within each computing instance (12), results of the function (1); - calculating (S70) averages over the results; - determining (S100; S02) whether the function (1) fulfils a security criterion, and, if so: - providing (S120) the calculated average for the gradient of the loss function and/or the calculated average of the output value and/or updated parameter data to the second entity (20) .