Secret sigmoid function calculation system, secret logistic regression calculation system, secret sigmoid function calculation apparatus, secret logistic regression calculation apparatus, secret sigmoid function calculation method, secret logistic regression calculation method and program

Patent metadata

Field	Value
Publication number	US-12518656-B2
Application number	US-201917279595-A
Country	US
Kind code	B2
Filing date	Oct 2, 2019
Priority date	Oct 4, 2018
Publication date	Jan 6, 2026
Grant date	Jan 6, 2026

Abstract

A secure sigmoid function calculation system is a system in which mapσ is assumed to be secure batch mapping defined by parameters (a0, . . . , ak-1) representing the domain of definition of a sigmoid function σ(x) and parameters (σ(a0), . . . , σ(ak-1)) representing the range of the sigmoid function σ(x) (a0, . . . , ak-1 are real numbers that satisfy a0< . . . <ak-1) and which is configured with three or more secure sigmoid function calculation apparatuses and calculates, from a share [[x→]] of an input vector x→, a share [[y→]] of a value y→ of a sigmoid function for the input vector x→, the system including a secure batch mapping calculating means that calculates the share [[y→]] by [[y→]]=mapσ([[x→]])=([[σ(af(0))]], . . . , [[σ(af(m-1)]]) (where f(i) (0≤i≤m−1) is j that makes aj≤xi<aj+1 hold).

First claim

What is claimed is:

1 . A secure logistic regression calculation system in which
η is a real number that satisfies 0<η<1, and Sigmoid ([[x]]) is a function that calculates, from a share [[x → ]] of an input vector x → , a share [[y → ]] of a value y → of a sigmoid function for the input vector x → using a secure sigmoid function calculation system in which map σ is a secure batch mapping predefined by parameters (a 0 , . . . , a k-1 ) representing a domain of definition of a sigmoid function σ(x) and parameters (σ(a 0 ), . . . , σ(a k-1 )) representing a range of the sigmoid function σ(x) (where k is an integer greater than or equal to 1 and a 0 , . . . , a k-1 are real numbers that satisfy a 0 < . . . <a k-1 ), and the secure sigmoid function calculation system is a secure sigmoid function calculation system with three or more secure sigmoid function calculation apparatuses performing cooperative computations that are connected to each other by a data network and calculates, from a share [[x → ]]=([[x 0 ]], . . . , [[x m-1 ]]) of an input vector x → =(x 0 , . . . , x m-1 ), a share [[y → ]]=([[y 0 ]], . . . , [[y m-1 ]]) of a value y → =(y 0 , . . . , y m-1 ) of a sigmoid function for the input vector x → , the secure sigmoid function calculation system comprising: the three or more secure sigmoid function calculation apparatuses each including circuitry and a memory, [[a]] secure batch mapping calculation circuitry that calculates map σ ([[x → ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) ]]) (where f(i) (0≤i≤m−1) is j that makes a j ≤x i <a j+1 hold true) from the share [[x → ]] and calculates the share [[y → ]] by ([[y 0 ]], . . . , [[y m-1 ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) )]]) by referring to the map σ which is predefined, wherein m is an integer greater than or equal to 1, when an arbitrary value, which is an object on which secure computation is to be performed, is p and b_p [bit] is a predetermined positive integer, it means that a share of p is actually a share [[p×2 b_p ]] of a fixed-point number, when an arbitrary vector, which is an object on which secure computation is to be performed, is q → , an element of q → is q i , and b_q [bit] is a predetermined positive integer, it means that a share [[q → ]] of q → is actually made up of a share [[q i × b_q ]] of a fixed-point number, b_w, b_x, b_y, b_η, b_m, H, and b_tmp are predetermined positive integers, rshift(a, b) means shifting a value a to the right by b [bit] by performing an arithmetic right shift, and the secure logistic regression calculation system is a secure logistic regression calculation system with three or more secure logistic regression calculation apparatuses and calculates a share [[w → ]] of a model parameter w → of a logistic regression model from a share [[x i → ]] (0≤i≤m−1) of data x i → on an explanatory variable and a share [[y i ]] (0≤i≤m−1) of data y i on a response variable, the secure logistic regression calculation system comprising: initializing circuitry that sets a share [[w 0 → ]] of an initial value w 0 → of the model parameter w → ; [[an]] error calculation circuitry that calculates, for i=0, . . . , m−1, [[b i ]] by [[b i ]]=hpsum ([[w t → ]], [[(1, x i → )]]) from a share [[w t → ]] of a value w t → of the model parameter w → obtained as a result of t updates and the share [[x i → ]], calculates ([[c 0 ]], . . . , [[c m-1 ]]) by ([[c 0 ]], . . . , [[c m-1 ]])=Sigmoid (([[b 0 ]], . . . , [[b m-1 ]])) from the [[b i ]] (0≤i≤m−1), and calculates, for i=0, . . . , m−1, an error [[d i ]] by [[d i ]]=[[c i ]]-[[y i ]] from the share [[y i ]] and an i-th element [[c i ]] of the ([[c 0 ]], . . . , [[c m-1 ]]); and [[a]] model parameter update circuitry that calculates, for j=0, . . . , n, [[e]] by [[e]]=Σ i=0 m-1 [[d i ]][[x i, j ]] from the error [[d i ]] (0≤i≤m−1) and a j-th element [[x i,j ]] (0≤i≤m−1) of the share [[x i → ]], calculates [[eta_grad]] by [[eta_grad]]=η[[e]] from the η and the [[e]], calculates [[eta_grad_shift]] by [[eta_grad_shift]]=rshift ([[eta_grad]], b_y+b_x+b_η−b_tmp) from the [[eta_grad]], calculates [[eta_grad_ave]] by [[eta_grad_ave]]=(1/m)[[eta_grad_shift]] from the [[eta_grad_shift]], calculates [[eta_grad_ave_shift]] by [[eta_grad_ave_shift]]=rshift ([[eta_grad_ave]], b_tmp+b_m+H−b_w) from the [[eta_grad_ave]], and calculates, from a j-th element [[w j,t ]] of the share [[w t → ]] and the [[eta_grad_ave_shift]] by [[w j,t+1 ]]=[[w j, t ]]−[[eta_grad_ave_shift]], a j-th element [[w j,t+1 ]] of a share [[w t+1 → ]] of a value w t+1 → of the model parameter w → obtained as a result of t+1 updates, wherein the calculations of the secure logistic regression calculation system are performed securely without leaking any information outside.

2 . A secure logistic regression calculation system in which η is a real number that satisfies 0<η<1, and Sigmoid ([[x]]) is a function that calculates, from a share [[x → ]] of an input vector x → , a share [[y → ]] of a value y → of a sigmoid function for the input vector x → using a secure sigmoid function calculation system in which
map σ is a secure batch mapping predefined by parameters (a 0 , . . . , a k-1 ) representing a domain of definition of a sigmoid function σ(x) and parameters (σ(a 0 ), . . . , σ(a k-1 )) representing a range of the sigmoid function σ(x) (where k is an integer greater than or equal to 1 and a 0 , . . . , a k-1 are real numbers that satisfy a 0 < . . . <a k-1 ), and
the secure sigmoid function calculation system is a secure sigmoid function calculation system that is configured with three or more secure sigmoid function calculation apparatuses performing cooperative computations that are connected to each other by a data network and calculates, from a share [[x → ]]=([[x 0 ]], . . . , [[x m-1 ]]) of an input vector x → =(x 0 , . . . , x m-1 ), a share [[y → ]]=([[y 0 ]], . . . , [[y m-1 ]]) of a value y → =(y 0 , . . . , y m-1 ) of a sigmoid function for the input vector x → ,
the secure sigmoid function calculation system comprising:
the three or more secure sigmoid function calculation apparatuses each including circuitry and a memory,

[[a]] secure batch mapping calculation circuitry that calculates map σ ([[x → ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) )]]) (where f(i) (0≤i≤m−1) is j that makes a j ≤x i <a j+1 hold true) from the share [[x → ]] and calculates the share [[y → ]] by ([[y 0 ]], . . . , [[y m-1 ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) )]]) by referring to the maps which is predefined, wherein m is an integer greater than or equal to 1,
when an arbitrary value, which is an object on which secure computation is to be performed, is p and b_p [bit] is a predetermined positive integer, it means that a share [[p]] of p is actually a share [[p×2 b_p ]] of a fixed-point number,
when an arbitrary vector, which is an object on which secure computation is to be performed, is q → , an element of q → is q i , and b_q [bit] is a predetermined positive integer, it means that a share [[q → ]] of q → is actually made up of a share [[q i ×2 b_q ]] of a fixed-point number,
b_w, b_x, b_y, and b_η are predetermined positive integers,
rshift(a, b) means shifting a value a to the right by b [bit] by performing an arithmetic right shift,
floor is a function representing rounding down and X=−(floor (log 2 (η/m))), and
the secure logistic regression calculation system is a secure logistic regression calculation system with three or more secure logistic regression calculation apparatuses and calculates a share [[w → ]] of a model parameter w → of a logistic regression model from a share [[x i → ]] (0≤i≤m−1) of data x i → on an explanatory variable and a share [[y i ]] (0≤i≤m−1) of data y i on a response variable,
the secure logistic regression calculation system comprising:
initializing circuitry that sets a share [[w 0

Assignees

• Ntt Inc

Inventors

• Mishina Ibuki
• Ikarashi Dai
• Hamada Koki
• Kikuchi Ryo

Classifications

• H04L9/008

  involving homomorphic encryption · CPC title

• G06F7/544

  for evaluating functions by calculation {(G06F7/4824 takes precedence)} · CPC title

• H04L2209/46

  Secure multiparty computation, e.g. millionaire problem · CPC title

• G09C1/00 Primary

  Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00) · CPC title

• H04L9/085 Primary

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title