US-12626139-B2 - Secret softmax function calculation system, secret softmax function calculation apparatus, secret softmax function calculation method, secret neural network calculation system, secret neural network learning system, and program

Abstract

Techniques for performing secure computing of softmax functions at high speed and with high accuracy are provided. A secure softmax function calculation system that calculates a share ([[softmax (u 1 )]], . . . , [[softmax (u J )]]) from a share ([[u 1 ]], . . . , [[u J ]]) includes a subtraction means for calculating a share ([[u 1 −u 1 ]], [[u 2 −u 1 ]], . . . , [[u J −u J ]]), a first secure batch mapping calculation means for calculating, [[exp (u 1 −u 1 )]], [[exp (u 2 −u 1 )]], . . . , [[exp (u J −u J )]], an addition means for calculating a share ( [ [ ∑ j = 1 J ⁢ exp ⁡ ( u j - u 1 ) ] ] , … , [ [ ∑ j = 1 J ⁢ exp ⁡ ( u j - u J ) ] ] , and a second secure batch mapping calculation means for calculating a share ([[softmax (u 1 )], . . . , [[softmax (u J )]]).

Inventors

• Ibuki MISHINA
• Dai Ikarashi
• Koki Hamada

Assignees

• NTT, INC.

Dates

Publication Date

20260512

Application Date

20190814

Claims (2)

1. 1 . A secure softmax function calculation system for calculating a share ([[softmax (u 1 )]], . . . , [[softmax (u J )]]) of a value (softmax (u 1 ), . . . , softmax (u J )) of a softmax function for an input vector (u 1 , . . . , u J ) from a share ([[u 1 ]], . . . , [[u J ]]) of the input vector (u 1 , . . . , u J ) (where J is an integer greater than or equal to 2), the secure softmax function calculation system being constituted with three or more secure softmax function calculation apparatuses, map 1 being a secure batch mapping defined by a parameter (a 1 , . . . , a K ) representing a domain of definition and a parameter (α 1 , . . . , α K ) representing a range of values (where K is an integer greater than or equal to 2, a 1 , . . . a K are real numbers that meet a 1 < . . . <a K ) of a function exp (x), and map 2 being a secure batch mapping defined by a parameter (b 1 , . . . , b L ) representing a domain of definition and a parameter (β 1 , . . . , β L ) representing a range of values (where L is an integer greater than or equal to 2, b 1 , . . . , b L are real numbers that meet b 1 < . . . <b L ) of a function 1/x, the secure softmax function calculation system comprising: the three or more secure softmax function calculation apparatuses which each have a subtraction circuitry, a first secure batch mapping calculation circuitry, an addition circuitry, a second secure batch mapping calculation circuitry, and wiring, cabling, or a wireless communication device for communicating between the three or more secure softmax function calculation apparatuses through a network, such that: the subtraction circuitry is configured to calculate a share ([[u 1 −u 1 ]], [[u 2 −u 1 ]], . . . , [[u J −u 1 ]], [[u 1 −u 2 ]], . . . , [[u J −u 2 ]], . . . , [[u 1 −u J ]], . . . , [[u J −u J ]]) from the share ([[u 1 ]], . . . , [[u J ]]); the first secure batch mapping calculation circuitry is configured to calculate map 1 (([[u 1 −u 1 ]], [[u 2 −u 1 ]], . . . , [[u J −u 1 ]], [[u 1 −u 2 ]], . . . , [[u J −u 2 ]], . . . , [[u 1 −u J ]], . . . , [[u J −u J ]]))=([[α f(1, 1) ]], [[α f(2, 1) ]], . . . , [[α f(J, 1) ]], [[α f(1, 2) ]], . . . , [[α f(J, 2) ]], . . . , [[α f(1, J) ]], . . . , [[α f(J, J) ]]) from the share ([[u 1 −u 1 ]], [[u 2 −u 1 ]], . . . , [[u J −u 1 ]], [[u 1 −u 2 ]], . . . , [[u J −u 2 ]], [[u 1 −u J ]], . . . , [[u J −u J ]]) (where f(i, j) (1≤i, j≤K) is p where a p ≤u i −u j <a p+1 ) to make ([[exp (u 1 −u 1 )]], [[exp (u 2 −u 1 )]], . . . [[exp (u J −u 1 ]], [[exp (u 1 −u 2 )]], . . . , [[exp (u J −u 2 )]], . . . , [[exp (u 1 −u J )]], . . . , [[exp (u J −u J )]]=([[a f(1, 1) ]], [[α f(2, 1) ]], . . . , [[α f(J, 1) ]], [[α f(1, 2) ]], . . . , [[α f(J, 2) ]], . . . , [[α f(1, J) ]], . . . , [[α f(J, J) ]]); the addition circuitry is configured to calculate a share ( [ [ ∑ j = 1 J exp ⁡ ( u j - u 1 ) ] ] , [ [ ∑ j = 1 J exp ⁡ ( u j - u 2 ) ] ] , … , [ [ ∑ j = 1 J exp ⁡ ( u j - u J ) ] ] ) from the share ([[exp (u 1 −u 1 )]], [[exp (u 2 −u 1 )]], . . . , [exp (u J −u 1 )]], [[exp (u 1 −u 2 )]], . . . , [[exp (u J −u 2 )]], . . . , [[exp (u 1 −u J ]], . . . [[exp (u J −u J )]]); and the second secure batch mapping calculation circuitry is configured to calculate map 2 ( ( [ [ ∑ j = 1 J exp ⁡ ( u j - u 1 ) ] ] , [ [ ∑ j = 1 J exp ⁡ ( u j - u 2 ) ] ] , … , [ [ ∑ j = 1 J exp ⁡ ( u j - u J ) ] ] ) = ( [ [ β g ⁡ ( 1 ) ] ] , [ [ β g ⁡ ( 2 ) ] ] , … , [ [ β g ⁡ ( J ) ] ] ) from the share ( [ [ ∑ j = 1 J exp ⁡ ( u j - u 1 ) ] ] , [ [ ∑ j = 1 J exp ⁡ ( u j - u 2 ) ] ] , … , [ [ ∑ j = 1 J exp ⁡ ( u j - u J ) ] ] ) (where g(i) (1≤i≤L) is p where b p ≤ ∑ j = 1 J exp ⁡ ( u j - u i ) < b p + 1 ) to make ([[softmax (u 1 )]], [[softmax (u 2 )]], . . . ,) [[softmax (u J )]])=([[β g(1) ]], [[β g(2) ]], . . . , [[β g(J) ]]), wherein the secure softmax function calculation system utilizes a coordinate calculation among the three or more secure function calculation apparatuses to secure computing of the softmax function through the network.
2. 2 . The secure softmax function calculation system according to claim 1 , wherein the parameters of and a representing the range of values of the secure batch mapping map 1 are taken as α 1 =0 and α K =2 b_y , respectively (where b y represents the number of bits in a fractional portion of fixed point representing accuracy of an output of the softmax function).

Description

CROSS-REFERENCE TO RELATED APPLICATION The present application is based on PCT filing PCT/JP2019/031916, filed Aug. 14, 2019, the entire contents of which are incorporated herein by reference. TECHNICAL FIELD The present invention relates to secure computing techniques, and particularly relates to techniques for secure computing of softmax functions. BACKGROUND ART Conventional methods for secure computing of softmax functions include SecureML described in NPL 1 and SecureNN described in NPL 2. Here, softmax functions are non-linear functions represented by the following equation. [Math. 1] softmax(ui)=exp⁡(ui)∑j-1Jexp⁡(uj)(1) Secure computing is a method for obtaining an arithmetic result of a specified operation without restoring encrypted numerical values (for example, see Reference NPL 1). In the method of Reference NPL 1, an encryption is performed to distribute a plurality of pieces of information that can restore a numerical value to three secure computing devices, and results of addition and subtraction, constant sum, multiplication, constant times, logic operations (NOT, AND, OR, XOR), data format conversions (integer number, binary number) can be kept distributed or kept encrypted in the three secure computing devices without restoring the numerical value. Generally, the number of distribution is not limited to 3 but can be W (W is a predetermined constant greater than or equal to 3), and a protocol that implements secure computing by coordinated calculation with W secure computing devices is referred to as a multi-party protocol. (Reference NPL 1: Koji Chida, Koki Hamada, Dai Ikarashi, Katsumi Takahashi, “A Lightweight Three-party Secure Function Evaluation with Error Detection and Its Experimental Result,” In CSS, 2010.) CITATION LIST Non Patent Literature NPL 1: Payman Mohassel and Yupeng Zhang, “SecureML: A System for Scalable Privacy-Preserving Machine Learning”, 2017 IEEE Symposium on Security and Privacy, pp. 19-38, 2017.NPL 2: Sameer Wagh, Divya Gupta, and Nishanth Chandran, “SecureNN: 3-Party Secure Computation for Neural Network Training”, Proceedings on Privacy Enhancing Technologies; 2019 (3): 26-49, 2019. SUMMARY OF THE INVENTION Technical Problem However, as can be seen from Equation (1), softmax functions include calculation of exponential functions and divisions that secure computing is not good at, so it is not easy to perform secure computing while ensuring both processing speed and accuracy. Conventionally, a function ReLU (x)=max (0, x) is used for the approximation of an exponential function exp (x), so the approximation accuracy is low, and in particular, the greater the value of x is, the greater the error is, and the lower the accuracy of the calculation of softmax functions is. Thus, an object of the present invention is to provide techniques for performing secure computing of softmax functions at high speed and with high accuracy. Means for Solving the Problem An aspect of the present invention is a secure softmax function calculation system for calculating a share ([[softmax (u1)]], . . . , [[softmax (uJ)]]) of a value (softmax (u1), . . . , softmax (uJ)) of a softmax function for an input vector (u1, . . . , uJ) from a share ([[u1]], . . . , [[uJ]]) of the input vector (u1, . . . , uJ) (where J is an integer greater than or equal to 1), the secure softmax function calculation system being constituted with three or more secure softmax function calculation apparatuses, map1 being secure batch mapping defined by a parameter (a1, . . . , aK) representing a domain of definition and a parameter (α1, . . . , αK) representing a range of values (where K is an integer greater than or equal to 2, a1, . . . , aK are real numbers that meet a1< . . . , <aK) of a function exp (x), and map2 being secure batch mapping defined by a parameter (b1, . . . , bL) representing a domain of definition and a parameter (β1, . . . , βL) representing a range of values (where L is an integer greater than or equal to 2, b1, . . . , bL are real numbers that meet b1< . . . <bL) of a function 1/x, the secure softmax function calculation system including: a subtraction means for calculating a share ([[u1−u1]], [[u2−u1]], . . . , [[uJ−u1]], [[u1−u2]], . . . , [[uJ−u2]], . . . , [[u1−uJ]], . . . , [[uJ−uJ]]) from the share ([[u1]], . . . , [[uJ]]); a first secure batch mapping calculation means for calculating map1 (([[u1−u1]], [[u2−u1]], . . . , [[uJ−u1]], [[u1−u2]], . . . , [[uJ−u2]], . . . , [[u1−uJ]], . . . , [[uJ−uJ]]))=([[αf(1, 1)]], [[αf(2, 1)]], . . . , [[αf(J, 1)]], [[αf(1, 2)]], . . . , [[αf(J, 2)]], . . . , [[αf(1, J)]], . . . , [[αf(J, J)]]) from the share ([[u1−u1]], [[u2−u1]], . . . , [[uJ−u1]], [[u1−u2]], . . . , [[uJ−u2]], [[u1−uJ]], . . . , [[uJ−uJ]]) (where f(i, j) (1≤i, j≤K) is p where ap≤ui−uj<ap+1) to make ([[exp (u1−u1)]], [[exp (u2−u1)]], . . . , [[exp (uJ−u1)]], [[exp (u1−u2)]], . . . , [[exp (uJ−u2)]], . . . , [[exp (u1−uJ)]], . . . , [[exp (uJ−uJ)]])=([[αf(1, 1)]], [[αf(2, 1)]],