JP7832872B2 - Learning systems, learning methods, and programs - Google Patents

Description

This disclosure relates to learning systems, learning methods, and programs.

A federated learning system has been proposed in which a server and multiple client terminals cooperate in learning (see, for example, Patent Document 1). In this federated learning system, each client terminal learns the weight coefficients of a machine learning model and sends them to the server. The server updates the weight coefficients of the machine learning model based on the weight coefficients received from each of the multiple client terminals. The server then distributes the updated weight coefficients to the multiple client terminals.

Japanese Patent Publication No. 2019-028656

The applicant has identified the following problems: It has been pointed out that images used for training (e.g., images from within the home) could be reconstructed based on weight coefficients. Therefore, directly transmitting weight coefficients poses a privacy concern. Furthermore, for large models with high-performance configurations, transmitting weight coefficients is computationally expensive. Additionally, it has been pointed out that malicious users could degrade the model's performance.

This disclosure was made in light of these issues, and aims to realize a learning system, learning method, and program that can prevent the leakage of data used in machine learning.

One aspect of the learning system of this disclosure is a learning system comprising a plurality of client terminals and a server,
Each client terminal
The machine learning model learns the weight coefficients, and sends the dot product of the vector consisting of the weight coefficients and the key vector to the server.
The aforementioned server,
The weight coefficients of the machine learning model are optimized based on the dot product received from each of the aforementioned client terminals.

A learning method in one aspect of this disclosure is:
Each client terminal learns the weight coefficients of the machine learning model and sends the dot product of the vector consisting of the weight coefficients and the key vector to the server.
The server includes the step of optimizing the weights of the machine learning model based on the dot product received from each of the multiple client terminals.

A program in one aspect of this disclosure is
On the computer,
The process involves receiving the dot product of the weight coefficients vector of the machine learning model and the key vector from each client terminal,
A process to optimize the weight coefficients of the machine learning model based on the dot product received from each of the multiple client terminals,
Make it run.

According to this disclosure, a learning system, learning method, and program that can prevent the leakage of data used for machine learning can be realized.

This diagram illustrates the configuration of the learning system according to Embodiment 1. This figure illustrates the verification results of the operation of the learning system according to Embodiment 1. This figure illustrates the verification results of the operation of the learning system according to Embodiment 1. This figure illustrates the verification results when robust regression is used in the learning system according to Embodiment 1. This figure illustrates the verification results when robust regression is used in the learning system according to Embodiment 1. This figure illustrates the verification results when Lasso regression is used in the learning system according to Embodiment 1.

The following describes specific embodiments applying this disclosure, with reference to the drawings. However, this disclosure is not limited to the following embodiments. Furthermore, for clarity, the following descriptions and drawings have been simplified as appropriate.

Background to this Disclosure First, the general flow of a federated learning method will be explained with reference to Figure 1. The learning system 100 shown in Figure 1 comprises client terminals 110_1, 110_2, 110_3, and a server 120. Client terminals 110_1, 110_2, 110_3, and the server 120 are connected to each other via a network N so that they can communicate with one another.

Client terminal 110_1 is located in house 10_1, client terminal 110_2 is located in house 10_2, and client terminal 110_3 is located in house 10_3. When houses 10_1, 10_2, and 10_3 are not distinguished from each other, they are referred to as house 10. When client terminals 110_1, 110_2, and 110_3 are not distinguished from each other, they are referred to as client terminal 110.

First, server 120 trains a machine learning model (for example, an object recognition model) using images collected from the web and images generated from a 3D model (also called a simulator). Then, server 120 distributes the initial values of the machine learning model's weight coefficients to client terminals 110_1, 110_2, and 110_3.

Next, client terminal 110_1 collects training data 20_1 at house 10_1, client terminal 110_2 collects training data 20_2 at house 10_2, and client terminal 110_3 collects training data 20_3 at house 10_3. When training data 20_1, 20_2, and 20_3 are not distinguished from each other, they are referred to as training data 20.

Next, client terminal 110_1 updates the weight coefficients of the machine learning model with training data 20_1, client terminal 110_2 updates the weight coefficients of the machine learning model with training data 20_2, and client terminal 110_3 updates the weight coefficients of the machine learning model with training data 20_3. Then, each client terminal 110 sends the weight coefficients of the trained machine learning model to server 120.

Next, server 120 updates the weight coefficients of the machine learning model based on the weight coefficients received from client terminal 110_1, client terminal 110_2, and client terminal 110_3. Server 120 may also calculate the average value of the received weight coefficients and use that as the new weight coefficient.

Next, server 120 distributes the updated machine learning model's weight coefficients to client terminals 110_1, 110_2, and 110_3. Then, client terminal 110 returns to the process of collecting training data 20.

In typical federative learning methods, the client terminal 110 transmits the weight coefficients of the machine learning model, rather than the training data 20. This reduces the risk of the training data 20 being leaked. However, it is known that the images used for training can be reconstructed from the weight coefficients. Furthermore, for high-performance models, transmitting the weight coefficients presents a high overhead. Additionally, if a malicious user participates in the federative learning process, the performance of the machine learning model may degrade. Based on these considerations, the inventors of this application conceived of the learning system according to Embodiment 1.

Embodiment 1
The learning system according to Embodiment 1 will now be described with reference to the drawings. First, an overview of the learning system 100 according to Embodiment 1 will be described with reference to Figure 1.

Figure 1 shows a case where there are three client terminals 110, but the number of client terminals 110 may be two, four or more. The client terminals 110 may be a combination of a camera and a PC, or they may be robots.

The client terminal 110 and server 120 each comprise a processing unit, such as a CPU (Central Processing Unit), and a storage unit, such as RAM (Random Access Memory) or ROM (Read Only Memory), which stores various control programs and data. In other words, the client terminal 110 and server 120 function as computers and perform processing based on the aforementioned control programs.

Next, the operation of the learning system 100 will be explained. In the learning system 100, first, client terminals 110_1, 110_2, and 110_3 learn matrices W1, W2, and W3, which represent the weight coefficients of the machine learning model, using the collected training data 20_1, 20_2, and 20_3. When matrices W1, W2, and W3 are not distinguished from each other, they are simply called matrix W. Each column vector in matrix W1 is called vector w1, each column vector in matrix W2 is called vector w2, and each column vector in matrix W3 is called vector w3. When vectors w1, w2, and w3 are not distinguished from each other, they are simply called vector w. Vector w consists of the weight coefficients of the machine learning model.

The training data 20 includes, for example, images useful for machine learning and annotations indicating objects depicted in those images. The client terminal 110 may present images to the user and determine annotations based on the user's responses. Annotations may also be determined based on the user's actions and reactions. Images may be captured by cameras or robots installed within the house 10. Note that the machine learning model is not limited to object recognition models.

Next, client terminal 110_1 generates key vector v1, client terminal 110_2 generates key vector v2, and client terminal 110_3 generates key vector v3. When vectors v1, v2, and v3 are indistinguishable from each other, they are called key vectors v. The number of components of key vector v is assumed to be the same as the number of components of vector w. For example, if v is an n-dimensional vector, it can be expressed as v = [ _v1 , _v2 , ..., _vn ].

Client terminal 110_1 calculates the dot product y1 of vector w1 and key vector v1. Client terminal 110_2 calculates the dot product y2 of vector w2 and key vector v2. Client terminal 110_3 calculates the dot product y3 of vector w3 and key vector v3. When the dot products y1, y2, and y3 are not distinguished from each other, they are simply called the dot product y.

Since there are as many vectors w as there are columns in matrix W, there are as many dot products y as there are columns in matrix W. A vector formed by arranging multiple dot products y is called a dot product vector Y. If we denote the l-th column vector of matrix W (where l represents the letter L) as W _l , and the result of calculating the l-th dot product as Y _l , then Y _l = <W _l , v> = W _l1・v ₁ + W _l2・v ₂ + ... Note that W _lj represents the j-th element of W _l .

By the way, if a and b are n-dimensional vectors, their inner product c is given by c = <a, b> = a ₁ * b ₁ + a ₂ * b ₂ + ... + a _n * b _n , where _{a j} represents the j-th element of vector a, and b _j represents the j-th element of vector b. A key characteristic is that even if the inner product c and vector a are given, vector b is not uniquely determined. For example, if a = [1, 1, 1, 1, 1] and c = [1], then the vector b that satisfies c = <a, b> cannot be uniquely determined. Furthermore, the dimension of the inner product c is smaller than the dimensions of vector a or vector b.

Therefore, the inner product y can also be considered as data obtained by compressing vector w with key vector v. The client terminal 110 compresses multiple column vectors contained in matrix W using key vector v.

Next, client terminal 110_1 sends the key vector v1 and the dot product vector Y1 to server 120. Client terminal 110_2 sends the key vector v2 and the dot product vector Y2 to server 120. Client terminal 110_3 sends the key vector v3 and the dot product vector Y3 to server 120.

The client terminal 110 compresses multiple column vectors contained in matrix W. Typically, the sum of the data size of the key vector v and the data size of the dot product vector Y is smaller than the data size of matrix W.

Next, server 120 optimizes the weight coefficients of the machine learning model based on the dot product vectors Y1 to Y3 and key vectors v1 to v3. Specifically, server 120 represents the model that explains the dot product vector Y with respect to the key vector v as Y = W ^T v, and estimates the optimal matrix W. Matrix W ^T represents the transpose of matrix W.

The learning system 100 optimizes the weight coefficients of the machine learning model by performing linear regression with key vector v as the independent variable and dot product vector Y as the dependent variable. When performing regression analysis, the least squares method may be used, robust regression may be used, or Lasso regression may be used. When the least squares method is used, the server 120 calculates the weight coefficients so as to minimize the loss function L shown in equation (1). Matrix W ^~ represents the optimized matrix W representing the weight coefficients. Y represents the matrix formed by arranging the dot product vectors Y1, Y2, and Y3. V represents the matrix formed by arranging the key vectors v1, v2, and v3.

Furthermore, if server 120 uses robust regression, it can suppress the degradation of the machine learning model's performance due to attacks from malicious users. If server 120 uses Lasso regression, it can reduce unnecessary weight coefficients, thereby significantly reducing communication load.

If there is only one client terminal 110, and only client terminal 110_1 exists, then we must estimate W satisfying Y1 _l = W _l1・v1 ₁ + W _l2・v1 ₂ + ... from the l-th element of the dot product vector Y1, _{Y1 l} , and the key vector v1. However, due to the properties of the dot product, it is not possible to uniquely determine W from only the dot product Y1 _l and the key vector v1. The learning system 100 assumes that there are multiple client terminals 110. The server 120 only needs to decode a single W from the dot products calculated by the multiple client terminals 110.

The learning system 100 considers the above process as one round (referred to as a Communication Round), and progresses through learning by repeating these rounds.

In the learning system 100, each client terminal 110 transmits the dot product and key vector, rather than the weight coefficients of the machine learning model. Even if the dot product and key vector are intercepted, it is impossible to uniquely determine the weight coefficients of the machine learning model, thus enhancing the protection of user privacy for those participating in federated learning.

Furthermore, the sum of the data size of the dot product and the data size of the key vector is smaller than the data size of the matrix representing the weight coefficients. Therefore, the learning system 100 can reduce the communication load.

Figure 1 illustrates the case where the client terminal 110 generates the key vector. However, the server 120 may generate the key vector v and distribute it to the client terminal 110. In this case, the client terminal 110 does not need to send the key vector when sending the dot product.

Next, the verification results of the operation of the learning system 100 will be explained with reference to Figures 2 and 3. In Figure 2, CNN (Convolutional Neural Network) was used as the machine learning model. CIFAR (Canadian Institute for Advanced Research)-10 was used as the dataset. The weight coefficients of the machine learning model were estimated using the least squares method. The horizontal axis represents the number of rounds, and the vertical axis represents the accuracy.

The accuracy rate when using Embodiment 1 is shown by the dotted line. Graphs 31, 32, 33, and 34 show the accuracy rates when the number of client terminals 110 is 1, 30, 50, and 100.

The accuracy rate using conventional technology is shown by the solid line. In conventional technology, the average of the weighting coefficients was used as the new weighting coefficient. Graphs 41, 42, 43, and 44 show the accuracy rates when the number of client terminals 110 is 1, 30, 50, and 100. Graphs 42, 43, and 44 almost overlap.

Referring to Figure 2, the accuracy rate is low when the number of client terminals 110 is small, but high when the number of client terminals 110 is large. A high-accuracy machine learning model can be obtained when the number of client terminals 110 is large. As the number of client terminals 110 increases, the accuracy rate in Embodiment 1 approaches the accuracy rate (baseline) of the conventional technology.

Figure 3 shows the verification results when using a Multilayer Perceptron (MLP) as a machine learning model. The MNIST (Modified National Institute of Standards and Technology) dataset was used.

The accuracy rate when using Embodiment 1 is shown by the dotted line. Graphs 51, 52, 53, and 54 show the accuracy rates when the number of client terminals 110 is 1, 30, 50, and 100.

The accuracy rate using conventional technology is shown by the solid line. Graphs 61, 62, 63, and 64 show the accuracy rate using conventional technology. Graphs 61, 62, 63, and 64 show the accuracy rate when the number of client terminals 110 is 1, 30, 50, and 100. Graphs 62, 63, and 64 almost overlap.

Similar to Figure 2, it can be seen that a machine learning model with higher accuracy can be obtained as the number of client terminals 110 increases. Embodiment 1 is also effective when the machine learning model is a multilayer perceptron.

Next, we will explain the case of using robust regression, referring to Figures 4 and 5. Robust regression is robust against attacks that degrade the performance of machine learning models. Robust regression uses Huber loss.

Figure 4 shows the verification results when CIFAR is used as the dataset. Graphs 71-73 show the accuracy when the number of malicious clients is 1. Graphs 71-73 also show the accuracy when using conventional technology, when using L2 loss as the loss, and when using Huber loss as the loss.

Graphs 74-76 show the accuracy rate when the number of malicious clients is 5. Graphs 74-76 also show the accuracy rate when using conventional technology, when using L2 loss as the loss, and when using Huber loss as the loss.

Figure 5 shows the verification results when using MNIST as the dataset. Graphs 81-83 show the accuracy when the number of malicious clients is 1. Graphs 81-83 also show the accuracy when using conventional technology, when using L2 loss as the loss, and when using Huber loss as the loss.

Graphs 84-86 show the accuracy rate when the number of malicious clients is 5. Graphs 84-86 show the accuracy rate when using conventional technology, when using L2 loss as the loss, and when using Huber loss as the loss.

Referring to Figures 4 and 5, the performance of machine learning models degrades under attack when using conventional techniques or L1 loss. When using Huber loss, i.e., robust regression, the machine learning model becomes robust against attacks from malicious clients.

Next, referring to Figure 6, we will explain the case using Lasso regression. The first column of Table 90 indicates whether the prior art or Embodiment 1 is used. The second column indicates whether Lasso regression is performed on the client and server sides. "Yes" indicates that Lasso regression is performed, and "No" indicates that Lasso regression is not performed. In Lasso regression, the L1 loss is used as the loss. The third and fourth columns represent the error rate and sparsity.

The first and second rows show the error rate and sparsity when using conventional technology. The first row represents the case where lasso regression is not performed on client terminal 110, and the second row represents the case where lasso regression is performed on client terminal 110. Note that in conventional technology, weight coefficient estimation is not performed on the server side, so the server side shows "No".

Lines 3, 4, 5, and 6 show the verification results when using Embodiment 1. Line 3 represents the case where neither the client terminal 110 nor the server 120 performs Lasso regression. Line 4 represents the case where the client terminal 110 performs Lasso regression, but the server 120 does not. Line 5 represents the case where the client terminal 110 does not perform Lasso regression, but the server 120 does. Line 6 represents the case where both the client terminal 110 and the server 120 perform Lasso regression.

Referring to Figure 6, it can be seen that server 120 has high sparsity when using Lasso regression, indicating that the machine learning model can be made sparse.

The program described above includes a set of instructions (or software code) that, when loaded into a computer, causes the computer to perform one or more functions. The program may be stored on a non-temporary computer-readable medium or a physical storage medium. Examples, but not limited to, include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drives (SSDs), or other memory technologies, CD-ROMs, digital versatile discs (DVDs), Blu-ray® discs, or other optical disc storage, magnetic cassettes, magnetic tapes, magnetic disk storage, or other magnetic storage devices. The program may be transmitted over a temporary computer-readable medium or a communication medium. Examples, but not limited to, include electrical, optical, acoustic, or other forms of propagating signals.

Furthermore, this disclosure is not limited to the embodiments described above, and may be modified as appropriate without departing from its intent.

100 Learning system 110, 110_1, 110_2, 110_3 Client terminal 120 Server 10, 10_1, 10_2, 10_3 House 20, 20_1, 20_2, 20_3 Learning data 31-34, 41-44, 51-54, 61-64, 71-76, 81-86 Graph 90 Table

Claims (4)

A learning system comprising multiple client terminals and a server,
Each client terminal
The machine learning model learns the weight coefficients, and sends the dot product of the vector consisting of the weight coefficients and the key vector to the server.
The aforementioned server,
Based on the dot product received from each of the aforementioned client terminals, the weight coefficients of the machine learning model are optimized .
The aforementioned server,
The weight coefficients of the machine learning model are optimized by performing a linear regression with the key vector as the independent variable and the inner product as the dependent variable.
Learning system. The server performs robust regression or lasso regression.
The learning system according to claim 1. Each client terminal learns the weight coefficients of the machine learning model and sends the dot product of the vector consisting of the weight coefficients and the key vector to the server.
The server optimizes the weight coefficients of the machine learning model based on the dot products received from each of the multiple client terminals.
Includes,
The aforementioned optimization step is,
The weight coefficients of the machine learning model are optimized by performing a linear regression with the key vector as the independent variable and the inner product as the dependent variable.
Learning methods. On the computer,
The process involves receiving the dot product of the weight coefficients vector of the machine learning model and the key vector from each client terminal,
A process to optimize the weight coefficients of the machine learning model based on the dot product received from each of the multiple client terminals,
Make it run ,
The aforementioned optimization process is:
The weight coefficients of the machine learning model are optimized by performing a linear regression with the key vector as the independent variable and the inner product as the dependent variable.
program.