WO2024224504A1 - Verification device, verification method, and program - Google Patents

Abstract

Provided is a verification device capable of verifying the sameness of an AI that continuously learns and changes. This verification device includes: an acquisition unit which acquires a first output data group obtained when input data is given to a machine learning model group considered to be the same, and second output data obtained when the input data is given to a machine learning model to be verified; and a verification unit which uses the first output data group and the second output data to verify, by statistical hypothesis testing, whether or not the machine learning model to be verified is the same as the machine learning model group.

Description

Verification device, verification method, and program

The present invention relates to a technology for verifying the identity of multiple AIs (hereinafter also referred to as machine learning models).

When using AI provided by a third party, there is a risk of the AI being faked or tampered with, so there is a demand to verify that the AI intended and the AI being used are the same.

Digital signatures (see Non-Patent Document 1) are known as a conventional technology for verifying identity.

Author: Eiichiro Fujisaki, "Knowledge Base Group 1, Part 3, Chapter 6, Digital Signature", [online], 2010, Institute of Electronics, Information and Communication Engineers, [Retrieved April 19, 2023], Internet <URL: https://www.ieice-hbkb.org/files/01/01gun_03hen_06.pdf>

Some AIs continuously learn and change in order to adapt to the external environment and improve their accuracy. By using the technology in Non-Patent Document 1, it is possible to verify the identity of completely identical AIs, but for AIs that continuously learn and change, it is not possible to determine that the AI before and after the change is the same AI. For AIs that continuously learn and change, there is a demand to determine that the AI before and after the change is the same AI if the AI changes within the range expected by the AI creator or user, and to determine that the AI is not the same AI if the AI changes beyond the expected range due to erroneous learning, falsification, or tampering. Here, the problem with AIs that continuously learn and change is that it is difficult to notice whether changes beyond the expected range have occurred because they are changing.

As in the past, there is a demand to detect the possibility of AI being disguised or tampered with. However, there is a problem with AI that continuously learns and changes, in that the fact that it changes means that it is difficult to notice when a third party disguises or tampers with the AI.

For this reason, we want to verify whether AI that continuously learns and changes has changed within the expected range, and whether it is the AI that users and creators expect (whether it has been faked or tampered with).

The present invention aims to provide a verification device, verification method, and program that can verify the identity of AI that continuously learns and changes.

In order to solve the above problem, according to one aspect of the present invention, a verification device includes an acquisition unit that acquires a first output data group obtained when input data is provided to a group of machine learning models considered to be identical, and a second output data obtained when the input data is provided to the machine learning model to be verified, and a verification unit that uses the first output data group and the second output data to verify whether the machine learning model to be verified is identical to the group of machine learning models through statistical hypothesis testing.

The present invention has the effect of being able to verify the identity of an AI that is continually learning and changing.

FIG. 2 is a functional block diagram of a verification device according to the first embodiment; FIG. 4 is a diagram showing an example of a processing flow of the verification apparatus according to the first embodiment; FIG. 13 is a diagram showing an example of the configuration of a computer to which the present technique is applied.

Below, an embodiment of the present invention will be described. In the drawings used in the following description, components having the same functions and steps performing the same processing will be given the same reference numerals, and duplicate explanations will be omitted. In the following description, processing performed on an element-by-element basis of a vector or matrix will be applied to all elements of that vector or matrix, unless otherwise specified.

<Key Points of the First Embodiment>
The distribution of the characteristics of the AI considered to be identical and the distribution of the characteristics of the AI to be verified are obtained, and the identity is verified by examining whether the distributions differ through statistical hypothesis testing. Here, the output of an AI for a certain input is called the "AI characteristic."

Even if the AI is one that changes, it is possible to verify whether the AI being verified is the AI the user expects, or whether the AI has changed in ways not anticipated by the user or creator, by verifying its identity with information about the expected AI obtained in advance.

In addition, in this embodiment, not only completely identical AIs are considered to be the same, but AIs that fall within the expected range (the range of allowable changes) are considered to be the same AI. This configuration makes it easier to keep up with AI that is continually learning and changing.

First Embodiment
FIG. 1 is a functional block diagram of a verification device 100 according to the first embodiment, and FIG. 2 shows the processing flow thereof.

The verification device 100 includes an acquisition unit 110, a storage unit 120, and a verification unit 130.

The verification device 100 takes as input the output data Y={( _y1,1 , ..., y1, _K ), ..., (yN _{,1 ,} ..., yN _,K )} obtained when input data X=( _x1 , ..., xK) is given to a group of AIs that are considered to be identical, and the output data _Ym =( _{ym,1 ,} ..., _ym,K ) obtained when the same input data X=(x1, ..., _xK ) is given to the AI to be verified, and verifies whether the AI to be verified is identical to the group of AIs that are considered to be identical, and outputs the verification results.

The verification device 100 is a special device configured by loading a special program into a publicly known or dedicated computer having, for example, a central processing unit (CPU), a main memory (RAM), etc. The verification device 100 executes each process under the control of, for example, the central processing unit. Data input to the verification device 100 and data obtained in each process are stored, for example, in the main memory, and the data stored in the main memory is read out to the central processing unit as necessary and used for other processes. At least a part of each processing unit of the verification device 100 may be configured by hardware such as an integrated circuit. Each memory unit provided in the verification device 100 can be configured by, for example, a main memory such as a RAM (Random Access Memory), or middleware such as a relational database or a key-value store. However, each storage unit does not necessarily need to be provided inside the verification device 100, but may be configured as an auxiliary storage device made up of a hard disk, optical disk, or semiconductor memory element such as flash memory, and may be configured to be provided outside the verification device 100.

Each part is explained below.

<Acquisition Unit 110 and Storage Unit 120>
The acquisition unit 110 retrieves input data X=( _x1 , ..., _xK ) previously stored in a storage unit (not shown) and outputs it to each AI included in the group of AIs considered to be identical. The group of AIs considered to be identical includes N AIs. N is any integer equal to or greater than 1, and is a sufficient amount for verification. The nth AI receives input data X=( _x1 , ..., _xK ), obtains output data ( _yn,1 , ..., _yn,K ), and outputs it to the acquisition unit 110. The same process is performed for n=1, 2, ..., N, and the acquisition unit 110 acquires output data Y={( _y1,1 , ..., y1 _,K ), ..., ( _yN,1 , ..., yN _,K )} (S110) and stores it in the storage unit 120. This process is carried out before the output data _Ym = ( _ym,1 , ..., _{ym,K )} obtained when the input data X = ( _x1 , ..., xK) is given to the AI to be verified is input.

Once the AI to be verified is decided, the acquisition unit 110 outputs input data X = ( _x1 , ..., _xK ) to the AI to be verified. The AI to be verified receives input data X = ( _x1 , ..., _xK ), determines output data _Ym = ( _ym,1 , ..., ym _,K ), and outputs it to the acquisition unit 110. The acquisition unit 110 acquires the output data _Ym (S110) and outputs it to the verification unit 130.

Here, a group of AIs considered to be identical refers to a group of AIs within the range of the assumptions of the creator or user of the AI (the range of acceptable changes or differences), and the creator or user of the AI may set the range of assumptions and conditions appropriately according to the purpose. A group of AIs considered to be identical may be obtained, for example, by acquiring an AI that continuously learns and changes N times at each predetermined period of time, or by distributing an AI that continuously learns and changes at a certain point in time to N clients and acquiring the changed AI from the N clients after a predetermined period of time has passed. Note that a single original AI may be one of the N AIs included in the group of AIs considered to be identical, or it may not be included in the AI group. Here, an AI that has changed beyond the range expected by the creator or user of the AI is not included in the group of AIs considered to be identical, even if it has changed from a single original AI. In addition, the determination of whether or not the change has exceeded the expected range may be performed automatically or manually based on the magnitude relationship between the variable parameters used inside the AI and the threshold value, or the magnitude relationship between the output data of the AI and the threshold value, by setting a threshold value or the like. In addition, when a random parameter is used as the initial value of the parameter used inside the AI before learning, it is possible to prepare multiple AIs that have the same structure but different random parameters, and these multiple AIs may be considered as a group of AIs that are considered to be the same, with the condition of having the same structure being that the AIs are considered to be the same. Furthermore, a group of AIs may be obtained by combining these methods. For example, N AIs that have the same structure but different random parameters may be prepared and distributed to N clients, and the changed AIs may be obtained from the N clients after a predetermined period of time has passed.
<Verification Unit 130>
The verification unit 130 receives the output data _Ym = ( _ym,1 , ..., _ym,K ), retrieves the output data Y = {( _y1,1 , ..., y1 _,K ), ..., ( _yN,1 , ..., yN _,K )} from the storage unit 120, verifies whether the AI to be verified is identical to the group of AIs considered to be identical by statistical hypothesis testing (S130), and outputs the verification result. The verification result may be information indicating whether the AI to be verified can be considered to be identical to the group of AIs considered to be identical, and may be, for example, a value (e.g., 1) indicating that "the AI to be verified can be considered to be identical to the group of AIs considered to be identical" or a value (e.g., 0) indicating that "the AI to be verified cannot be considered to be identical to the group of AIs considered to be identical".

The verification method used by the verification unit 130 is explained below.

ただし、y_p',k,q、y_q,k,qは、それぞれベクトル値である要素y_p',k、y_g,kのq次元目の値であり、Q_kはベクトル値である要素y_p',k、y_g,kの次元数である。なお、距離を計算する手法は一例であり、ベクトル値をスカラ値に変換できる方法であれば他の方法を用いてもよい。 (1) When the output data _Ym or the element _yp,k (p is m, 1, 2, ..., N, k = 1, 2, ..., K) of Y is a scalar value, the output data _Ym and Y are regarded as samples statistically extracted from a certain population, and a statistical hypothesis test is used to examine whether the probability distributions of the populations are different, and the results of the test are used to determine whether the AIs are different as well. In other words, if the probability distributions of the populations are different, the AIs are considered to be different, and if the probability distributions of the populations are the same, the AIs are considered to be the same. The statistical hypothesis test used here can verify whether the probability distributions of the populations are different, and examples of such tests include the Kolmogorov-Smirnov test for two samples and the Mann-Whitney U test. As a method for verifying the identity of AIs, it is possible to consider a method in which the AI is regarded as a function, the similarity is approximated from the distance between the input and output, and whether the AI to be verified can be considered to be the same as a group of AIs that are considered to be the same based on the magnitude relationship between the similarity and a threshold value. In this case, however, it is necessary to set an appropriate threshold value for the similarity. On the other hand, statistical hypothesis testing does not require the setting of a separate appropriate threshold, and can examine whether the probability distributions of populations differ based on conventional methods.
(2) If the output data _Ym or element _yp,k of Y is a vector (multidimensional), select the output data (yg _,1 , ..., yg _,K ) (g _{is 1, 2 ,} ... _, N) of any AI from the output data Y = {(y1,1, ..., y1, _K ), ..., (yN,1, ..., yN,K)}, and calculate the distance _dp',k from element yp _',k based on the output data _yg,k . Here, p' is m, 1, 2, ..., N other than g (p' ≠ g). For example, if there is one AI that is the source of N-1 AIs included in a group of AIs that are considered to be identical, the output data of that source AI may be selected. If we calculate a distance such that dp _',k is a scalar value, we can use the same process as when the output data _Ym or element _yp,k of Y is a scalar value (but use distance dp _{', k instead of element yp,} k) to examine whether the probability distributions of the populations are different through statistical hypothesis testing, and use the test results to determine whether the AI is also different. For example, the distance can be Euclidean distance.

Here, yp _',k,q and yq _,k,q are the q-th dimension values of the vector-valued elements yp _',k and _yg,k, respectively, and _Qk is the number of dimensions of the vector-valued elements yp _',k and _yg,k . Note that the method for calculating the distance is just one example, and other methods may be used as long as they can convert vector values into scalar values.

＜Effects＞
With the above configuration, it is possible to verify the identity of an AI that continuously learns and changes from only the output data, without referring to the internal structure or parameters of the AI.

<Modification>
In this embodiment, the acquisition unit 110 stores the output data Y={( _y1,1 , ..., y1 _,K ), ..., (yN _,1 , ..., yN _,K )} in the storage unit 120, but when verification is performed immediately after or simultaneously with receiving the output data Y={( _y1,1 , ..., y1 _,K ), ..., (yN _,1 , ..., yN _,K )}, the output data Y may be directly output to the verification unit 130 without going through the storage unit 120. In addition, the acquisition unit 110 outputs the output data _Ym to the verification unit 130, but when verification is not performed immediately after or simultaneously with receiving the output data _Ym , the output data Ym may be stored in the storage unit 120 until verification is performed. In this case, the verification unit 130 may take out the output data _Ym from the storage unit 120 at the time of verification.

In this embodiment, the acquisition unit 110 outputs input data X = ( _x1 , ..., _xK ) to each AI included in a group of AIs considered to be identical and to the AI to be verified, but this processing may be performed by an external device and the acquisition unit 110 may be configured to acquire and store or output output data _Y = {( _y1,1 , ..., y1 _,K ), ..., ( _{yN,1 ,} ..., yN _{, K)}, Ym = (ym,1, ..., ym,K} ).

<Other Modifications>
The present invention is not limited to the above-mentioned embodiment and modified examples. For example, the above-mentioned various processes may be executed not only in chronological order as described, but also in parallel or individually depending on the processing capacity of the device executing the processes or as necessary. In addition, appropriate modifications are possible within the scope of the present invention.

<Program and recording medium>
The various processes described above can be implemented by loading a program that executes each step of the above method into the recording unit 2020 of the computer 2000 shown in Figure 3, and operating the control unit 2010, input unit 2030, output unit 2040, display unit 2050, etc.

The program describing this processing can be recorded on a computer-readable recording medium. Examples of computer-readable recording media include magnetic recording devices, optical disks, magneto-optical recording media, and semiconductor memories.

The program may be distributed, for example, by selling, transferring, or lending portable recording media such as DVDs or CD-ROMs on which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of a server computer and transferring the program from the server computer to other computers via a network.

A computer that executes such a program, for example, first stores in its own storage device the program recorded on a portable recording medium or the program transferred from a server computer. Then, when executing a process, the computer reads the program stored on its own recording medium and executes the process according to the read program. As another execution form of the program, the computer may read the program directly from the portable recording medium and execute the process according to the program, or may execute the process according to the received program each time a program is transferred from the server computer to the computer. The above-mentioned process may also be executed by a so-called ASP (Application Service Provider) type service that does not transfer the program from the server computer to the computer, but realizes the processing function only by issuing an execution instruction and obtaining the results. Note that the program in this form includes information used for processing by an electronic computer that is equivalent to a program (such as data that is not a direct command to the computer but has properties that specify the processing of the computer).

In addition, in this embodiment, the device is configured by executing a specific program on a computer, but at least a portion of the processing may be realized by hardware.

Claims (3)

an acquisition unit that acquires a first output data group obtained when input data is provided to a group of machine learning models that are considered to be identical, and a second output data obtained when the input data is provided to a machine learning model to be verified;
A verification unit that verifies whether the machine learning model to be verified is identical to the machine learning model group by statistical hypothesis testing using the first output data group and the second output data.
Verification device. An acquisition step in which an acquisition unit acquires a first output data group obtained when input data is provided to a group of machine learning models considered to be identical, and a second output data obtained when the input data is provided to a machine learning model to be verified;
A verification step in which a verification unit verifies whether the machine learning model to be verified is identical to the machine learning model group by a statistical hypothesis test using the first output data group and the second output data.
Verification method. A program for causing a computer to function as the verification device of claim 1.

Images