情報セキュリティと分散型 AI の融合:
データのプライバシーとユーティリティの保護

LE TRIEU PHONG
セキュリティ基盤研究室 主任研究員
1

世界の連合学習の市場（2032まで予測）

約21x109円

https://market.us/report/federated-learning-market/2

プライバシー保護連合学習技術 DeepProtect (2018)
Central parameter server
Task: update or aggregate the encrypted parameters
using additively homomorphic property.

add…

⚫IEEE Trans. Inf. Forensics

Secur. (2018)に掲載⚫Google Scholarによる引用数

1300以上dataset M

dataset 1
DeepLearning

Organization 1…

⚫2023 IEEE SPS Best Paper Award受賞

DeepLearning

Organization M

Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, Shiho Moriai:
Privacy-Preserving Deep Learning via Additively Homomorphic Encryption. IEEE Trans. Inf. Forensics Secur. (2018)3

DeepProtect (2018)以降の研究
認証付き暗号により、暗号文を変える攻撃者を対応!

Le Trieu Phong: Secure deep learning for distributed data against malicious central server. PLoS ONE 17(8), 20224

DeepProtect (2018)以降の研究
認証付き暗号により、暗号文を変える攻撃者を対応!
一部のパラメータは、別のデータセットの学習
結果でもOK!
Le Trieu Phong: Secure deep learning for distributed data against malicious central server. PLoS ONE 17(8), 20225

オープンデータを用いた実験• 医療データ
1.MRI
2.X-Ray画像

arXiv:1711.05225v3 [cs.CV] 25 Dec 2017

Pranav Rajpurkar * 1 Jeremy Irvin * 1 Kaylie Zhu 1 Brandon Yang 1 Hershel Mehta 1Tony Duan 1 Daisy Ding 1 Aarti Bagul 1 Robyn L. Ball 2 Curtis Langlotz 3 Katie Shpanskaya 3
Matthew P. Lungren 3 Andrew Y. Ng 1Abstract
We develop an algorithm that can detectpneumonia from chest X-rays at a level exceeding practicing radiologists. Our algorithm, CheXNet, is a 121-layer convolutional
neural network trained on ChestX-ray14, currently the largest publicly available chest Xray dataset, containing over 100,000 frontalview X-ray images with 14 diseases. Fourpracticing academic radiologists annotate atest set, on which we compare the performance of CheXNet to that of radiologists.
We find that CheXNet exceeds average radiologist performance on the F1 metric. We
extend CheXNet to detect all 14 diseases in
ChestX-ray14 and achieve state of the art results on all 14 diseases.

• クレジットカードのデータ

Input

Chest X-Ray ImageCheXNet121-layer CNN

OutputPneumonia Positive (85%)

1. IntroductionMore than 1 million adults are hospitalized with pneumonia and around 50,000 die from the disease every
year in the US alone (CDC, 2017). Chest X-rays
are currently the best available method for diagnosing
pneumonia (WHO, 2001), playing a crucial role in clinical care (Franquet, 2001) and epidemiological studies
MRI: http://www.riteh.uniri.hr/~istajduh/projects/kneeMRI/(Cherian et al., 2005). However, detecting pneumoX-Ray: https://stanfordmlgroup.github.io/projects/chexnet/
nia in chest X-rays is a challenging task that relies on
Credit Card: https://www.kaggle.com/datasets/mlg-ulb/creditcardfraud
the availability of expert radiologists. In this work, weFigure 1. CheXNet is a 121-layer convolutional neural network that takes a chest X-ray image as input, and outputs
the probability of a pathology. On this example, CheXnetcorrectly detects pneumonia and also localizes areas in theimage most indicative of the pathology. 6

MRIデータ
MRI1:• スタンフォード⼤学医療センターで取得。
• 1,370 件の膝 MRI 検査。
• ラベルは臨床レポートから⼿動で抽出。
MRI2:• クロアチアの病院センターで取得。
• 917件の膝 MRI 検査。
MRI: http://www.riteh.uniri.hr/~istajduh/projects/kneeMRI/

⽬的：膝の前⼗字靭帯断裂 (ACL tears)を推測
7

MRNet：我々のシステムの部品
AlexNetMRNet

https://stanfordmlgroup.github.io/projects/mrnet/

MRI1を持つ組織

MRI2を持つ組織

Le Trieu Phong, PLoS ONE 17(8), 2022

8

MRNet：我々のシステムの部品学習結果を良くするために
ImageNetデータセットで学習されたパラメータで初期化

AlexNetMRNet

https://www.image-net.org/

https://stanfordmlgroup.github.io/projects/mrnet/

MRI1を持つ組織

MRI2を持つ組織

Le Trieu Phong, PLoS ONE 17(8), 2022

9

upload and download) of the encrypted weight from each distributed trainer with the server isapproximately 234 ÖMBÜ ⇥ 20 ⇥ 2 à 9:36 ÖGBÜ.

我々のシステムを用い、MRIに関わる実験結果
Table 3. Area-under-the-curve (AUC) scores of learning methods on MRI datasets.
PaperMethod

AUC score

Stajduhar et al. [15]Support Vector Machine

0.894

Bien et al. [14]Neural Network

0.824

Bien et al. [14]Neural Network

0.911

我々のシステムon MRI1 + MRI2）
This work（Train(our system)

Neural Network

0.924

MRI2 のテスト
セットで予測

https://doi.org/10.1371/journal.pone.0272423.t003

ournal.pone.0272423 August 1, 2022

9 / 15

Le Trieu Phong: Secure deep learning for distributed data against malicious central server. PLoS ONE 17(8), 2022
Le Trieu Phong, Tran Thi Phuong, Lihua Wang, Seiichi Ozawa: Frameworks for Privacy-Preserving Federated Learning. IEICE Trans.
Inf.
10
Syst. 107(1): 2-12(2024)

学習の詳細 (MRIデータ)
Model (MRNet)

6,100万個のパラメータ(ハードディスクに234MB)
CBC-encrypt-then-mac
3秒
Training on GPU (one epoch) 13 秒

11

X-Rayデータ： NIH ChestX-ray14データセット

https://www.nih.gov/news-events/news-releases/nih-clinical-center-provides-one-largest-publicly-available-chest-x-ray-datasets-scientific-community

ChestX-ray14 データセット• 14 の異なる胸部疾患に個別にラベル付けされる。
• 112,120 枚の正面胸部 X 線画像がある。
12

CheXNet: Radiologist-Level Pneumonia Detection on Chest X-Rayswith Deep Learning

既存結果
arXiv:1711.05225v3 [cs.CV] 25 Dec 2017

Pranav Rajpurkar * 1 Jeremy Irvin * 1 Kaylie Zhu 1 Brandon Yang 1 Hershel Mehta 1
Tony Duan 1 Daisy Ding 1 Aarti Bagul 1 Robyn L. Ball 2 Curtis Langlotz 3 Katie Shpanskaya 3
Matthew P. Lungren 3 Andrew Y. Ng 1

Abstract

CheXNet: Radiologist-Level Pneumonia
Detection on Chest X-Rays with Deep Learning
AUCスコア（高い方が良い）

Pathology

病理

Atelectasis
CardiomegalyE↵usion
Infiltration
Mass
NodulePneumonia
Pneumothorax
Consolidation
Edema
EmphysemaFibrosis
Pleural Thickening
Hernia(Stanford大学)

We develop an algorithm that can detectpneumonia from chest X-rays at a level exradiologists.CheXNet
Our algo- (ours)
Wang et al. (2017) ceeding
Yao practicing
et al. (2017)rithm, CheXNet, is a 121-layer convolutional
neural network trained on ChestX-ray14, cur0.716
0.772publicly available chest0.8094
rently the largest
Xray dataset,0.904
containing over 100,000 0.9248
frontal0.807
view X-ray images with 14 diseases. Four
0.784
0.859
0.8638practicing academic radiologists annotate a0.609
test set, on0.695
which we compare the 0.7345
performanceofCheXNet
tothatofradiologists.
0.706
0.792
0.8676
We find that CheXNet exceeds average ra0.671
0.717 on the F1 metric.
0.7802diologist performanceWe
extend CheXNet
in
0.633
0.713to detect all 14 diseases
0.7680
ChestX-ray14 and achieve state of the art re0.806
0.841
0.8887
sults on all 14 diseases.

0.708
0.835
0.815
0.769
0.708
0.767

Input

Chest X-Ray ImageCheXNet121-layer CNN

OutputPneumonia Positive (85%)

0.788
0.79010.882
0.88780.829
0.93710.767
0.8047
1. Introduction
0.765
0.8062More than 1 million adults are hospitalized with pneu0.914
0.9164
monia and around50,000 die from the disease
everyyear in the US alone (CDC, 2017). Chest X-rays
are currently the best available method for diagnosing
Figure 1.In
CheXNetis a 121-layer convolutional neural netTable 2. CheXNet outperforms the best published results on
all 14 pathologies
in theaChestX-ray14
detectingpneumonia(WHO, 2001), playing
crucial role in clin-dataset.
work that takes a chest X-ray image as input, and outputs
Mass, Nodule, Pneumonia, and Emphysema, CheXNet has
marginof 2001)>0.05
overstudies
previousthestateof theart
ical acare(Franquet,andAUROC
epidemiologicalprobabilityof a pathology.
On this example, CheXnet(Cherian et al., 2005). However, detecting pneumocorrectly detects pneumonia and also localizes areas in theresults.
nia in chest X-rays is a challenging task that relies on
image most indicative of the pathology.
the availability of expert radiologists. In this work, we
present a model that can automatically detect pneu3.2. TestCI.atWe
findthatpracticing
CheXNet achieves an F1
moniabootstrap
from chest X-rays
a levelexceeding
Our model, ChexNet (shown in Figure 1), is a 121radiologists.
score of 0.435 (95% CI 0.387, 0.481), layer
higherthan theconvolutional
neural network that inputs a chest

https://stanfordmlgroup.github.io/projects/chexnet/

13

NIH
ChestX-ray14 に関わる実験結果
PLOS ONE

Secure deep learning for distributed data against malicious central server

Table 4. Area-under-the-curve (AUC) scores of learning methods on ChestX-ray14.

病理Wang et al. [13]Yao et al. [70]Zech [71]

我々のシステム
Our system

CheXNet [3]Atelectasis

0.716

0.772

0.81610.81760.8094

Cardiomegaly

0.807

0.904

0.91050.91430.9248Effusion

0.784

0.859

0.88390.88420.8638

Infiltration

0.609

0.695

0.70770.70980.7345

Mass

0.706

0.792

0.83080.84940.8676

Nodule

0.671

0.717

0.77480.78290.7802

Pneumonia

0.633

0.713

0.76510.76750.7680Pneumothorax

0.806

0.841

0.87390.87620.8887

Consolidation

0.708

0.788

0.80080.80770.7901

Edema

0.835

0.882

0.89790.89310.8878Emphysema

0.815

0.829

0.92270.93400.9371

Fibrosis

0.769

0.767

0.82930.82580.8047

Pleural Thickening

0.708

0.765

0.78600.78510.8062

Hernia

0.767

0.914

0.90100.90870.9164

Average

0.73810.80270.83580.83970.8414

Securely distributed training?

nononoyesnohttps://doi.org/10.1371/journal.pone.0272423.t004

Le Trieu Phong, PLoS ONE 17(8), 2022

元のデータを分け、4 組織を想定

14学習の詳細 (NIH ChestX-ray14 データ)
Model (DenseNet-121)

約 700 万個のパラメータ(ハードディスク 28 MB)
CBC-encrypt-then-mac
0.2 秒
Training on GPU (one epoch) 60 秒
工夫したポイントの一つ：• 早期に重みパラメータを共有して精度を向上させる。
Le Trieu Phong, Tran Thi Phuong, Lihua Wang, Seiichi Ozawa:
Frameworks for Privacy-Preserving Federated Learning. IEICE Trans. Inf. Syst. 107(1): 2-12(2024)15クレジットカード不正⾏為の検出のデータセット

https://www.kaggle.com/datasets/mlg-ulb/creditcardfraud• ヨーロッパのカード所有者によって行われた取引が含まれている。
• 284,807 件の取引のうち 492 件の不正行為が発生した。
• ポジティブ クラス (詐欺) は全取引の 0.172% を占める。
16

クレジットカードのデータの実験結果
各学習参加者にあるニューラルネットワークの構成データが多いほど、True positive rateが1False positive rateが0に近づく。

データが多いほど、学習結果が良くなる！

Le Trieu Phong, Tran Thi Phuong, Lihua Wang, Seiichi Ozawa:
Frameworks for Privacy-Preserving Federated Learning. IEICE
Trans. Inf. Syst. 107(1): 2-12(2024)

データが多いほど、Precisionが1
Recall (True Positive Rate)が1に近づく。

17

今後の見通し• 連合学習には利点があるが、学習に伴うすべての課題（例：データの品質、データの標準化、システムの運⽤）に対処できるわけではない。
• 連合学習の取り組みと⾮連合学習の取り組みの両⽅が必要である。
• すべての技術的な疑問がまだ解決されているわけではない。これからも、活発な研究開発となるだろう。
18