Patent Description:
Samples that deceive a neural network that has performed learning are called adversarial examples. Adversarial examples can be generated artificially.

Conventional adversarial examples are generated based on internal parameters of deep learning or probability information that is output.

According to Non-Patent Literature <NUM>, countermeasures against attacks using adversarial examples include a built-in detection function and introducing and learning anomalous data. Concealing internal parameters or probability information that is output, each of which serves as a clue for an attack, is considered to be one of effective countermeasures. In Non-Patent Literature <NUM>, consideration is not given to information leakage based on the processing time of deep learning.

In conventional countermeasures against timing attacks, attention is focused on countermeasures against leakage of a secret key based on the processing time of an encryption device.

In Patent Literature <NUM>, a countermeasure against leakage is implemented by executing dummy processing while encryption or decryption is being executed, delaying the execution start time of encryption or decryption, causing the amounts of change in data to be uniform, or changing a processing order.

Non-Patent Literature <NUM>: <NPL> <NPL>) discloses a multi layer perceptron as the machine learning architecture of choice and assume a passive attacker capable of measuring only passive side-channels like power, electromagnetic radiation, and timing. <NPL>) discloses a brokered learning abstraction that allows data sources to contribute towards a globally-shared model with provable privacy guarantees in an untrusted setting. <NPL>] discloses the state-of-the-art about side channel crypt-analysis. It will describe the various side channels known in the literature and discuss them from various points of view.

An attacker on deep learning may generate adversarial examples based on the relationship between input data and the processing time. Since the attacker focuses on the relationship between input data and the processing time, a problem is that attacks cannot be prevented by concealing internal parameters or probability information, which is a conventional countermeasure.

Another problem is that the conventional countermeasures against timing attacks are specifically for encryption devices and cannot be directly applied to deep learning.

It is an object of the present invention to provide countermeasures against timing attacks on deep learning.

Preferable embodiments are defined by the dependent claims.

A learning-and-recognition apparatus according to one aspect of the present invention includes.

In the present invention, a time control unit causes the processing time on input data to be independent of the input data, so that defense against attacks on a learning-and-recognition apparatus can be provided.

Preferable embodiments are defined by the dependent claims. Embodiments of the present invention will be described hereinafter with reference to the drawings. Throughout the drawings, the same or corresponding parts are denoted by the same reference sign. In the description of the embodiments, description of the same or corresponding parts will be suitably omitted or simplified.

Countermeasures against timing attacks to be described in the embodiments to be discussed hereinafter are to cause the processing time on input data to be independent of the input data. In other words, the countermeasures against timing attacks to be described in the embodiments are to cause a time period from an input time point of input data to an output time point of output data to be independent of the input data, and output the output data.

In the embodiments, the following countermeasures against timing attacks will be described.

A configuration of an apparatus according to this embodiment, operation of the apparatus according to this embodiment, and effects of this embodiment will be described.

<FIG> is a configuration diagram of a learning-and-recognition apparatus <NUM>.

The learning-and-recognition apparatus <NUM> is an apparatus that performs recognition work on input data while learning the input data.

The learning-and-recognition apparatus <NUM> has a learning-and-recognition unit <NUM>.

The learning-and-recognition unit <NUM> performs learning-and-recognition processing on input data <NUM> and outputs output data <NUM>.

The learning-and-recognition unit <NUM> conducts deep learning.

The learning-and-recognition unit <NUM> has a plurality of neural network layers <NUM>.

Each of the neural network layers <NUM> executes a plurality of perceptron processes <NUM>.

The learning-and-recognition unit <NUM> executes the perceptron processes <NUM> in parallel as calculations of each of the neural network layers <NUM>.

The learning-and-recognition unit <NUM> outputs calculation results of the perceptron processes <NUM> of the final neural network layer <NUM>.

The learning-and-recognition apparatus <NUM> has a time control unit <NUM>.

The time control unit <NUM> causes the processing time on the input data <NUM> by the learning-and-recognition unit <NUM> to be independent of the input data <NUM>.

The time control unit <NUM> has an input control unit <NUM>.

The input control unit <NUM> performs processing on the input data <NUM> to change the processing time of the learning-and-recognition unit <NUM>.

The input control unit <NUM> has a data masking unit <NUM>.

The data masking unit <NUM> applies random noise to the input data <NUM>.

In the learning-and-recognition apparatus <NUM>, the data masking unit <NUM> to apply random noise to the input data <NUM> is added anterior to the learning-and-recognition unit <NUM>, so as to cause the input data <NUM> and the processing time of the learning-and-recognition apparatus <NUM> to be independent of each other.

The meanings of terms to be used in the description of the embodiments are as indicated below.

"Learning-and-recognition processing": processing executed by the learning-and-recognition apparatus <NUM>.

"Processing of the learning-and-recognition apparatus <NUM>": the same as "learning-and-recognition processing".

"Processing time of learning-and-recognition processing": a time period from a time point when the input data <NUM> is input to the learning-and-recognition apparatus <NUM> to a time point when the output data <NUM> is output from the learning-and-recognition apparatus <NUM>.

"Processing time of the learning-and-recognition apparatus <NUM>": the same as "processing time of learning-and-recognition processing".

"Processing of the learning-and-recognition unit <NUM>": processing executed by the learning-and-recognition unit <NUM>.

"Processing time of the learning-and-recognition unit <NUM>": a time period from a time point when the input data <NUM> is input to the learning-and-recognition unit <NUM> to a time point when the output data <NUM> is output from the learning-and-recognition unit <NUM>.

When the "processing time of the learning-and-recognition unit <NUM>" changes, the "processing time of the learning-and-recognition apparatus <NUM>" or the "processing time of learning-and-recognition processing" also changes.

In the following, the embodiments will be described assuming that data input/output times of a reception unit <NUM> and a transmission unit <NUM> are negligible.

The learning-and-recognition apparatus <NUM> includes a processor <NUM>.

The learning-and-recognition apparatus <NUM> includes other hardware components, such as a memory <NUM>, an auxiliary storage device <NUM>, a communication interface <NUM>, and a recording medium <NUM>.

The processor <NUM> is connected with other hardware components via signal lines and controls these other hardware components.

The learning-and-recognition apparatus <NUM> includes the time control unit <NUM> and the learning-and-recognition unit <NUM> as functional elements.

The functions of the time control unit <NUM> and the learning-and-recognition unit <NUM> are realized by software.

The processor <NUM> is a device that executes a learning-and-recognition program.

The learning-and-recognition program is a program for realizing the functions of the time control unit <NUM> and the learning-and-recognition unit <NUM>.

The processor <NUM> is an integrated circuit (IC) that performs operational processing. A specific example of the processor <NUM> is a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU).

The memory <NUM> is a storage device to temporarily store data.

A specific example of the memory <NUM> is a static random access memory (SRAM) or a dynamic random access memory (DRAM).

The recording medium <NUM> and the auxiliary storage device <NUM> are storage devices to store data.

A specific example of each of the recording medium <NUM> and the auxiliary storage device <NUM> is a hard disk drive (HDD).

Each of the recording medium <NUM> and the auxiliary storage device <NUM> may be a portable storage medium, such as a NAND flash, a flexible disk, an optical disc, a compact disc, or a digital versatile disk (DVD).

The communication interface <NUM> has the reception unit <NUM> to receive data and the transmission unit <NUM> to transmit data.

The communication interface <NUM> has a communication chip, a network interface card (NIC), or the like.

The learning-and-recognition program is read from the memory <NUM> into the processor <NUM> and executed by the processor <NUM>.

The memory <NUM> stores not only the learning-and-recognition program but also an operating system <NUM>, a network driver <NUM>, and a storage driver <NUM>.

The processor <NUM> executes the learning-and-recognition program while executing the operating system <NUM>, the network driver <NUM>, and the storage driver <NUM>.

The learning-and-recognition program, the operating system <NUM>, the network driver <NUM>, and the storage driver <NUM> may be stored in the auxiliary storage device <NUM>.

The learning-and-recognition program, the operating system <NUM>, the network driver <NUM>, and the storage driver <NUM> that are stored in the auxiliary storage device <NUM> are loaded into the memory <NUM> and executed by the processor <NUM>.

Note that part or the entirety of the learning-and-recognition program may be embedded in the operating system <NUM>.

The learning-and-recognition apparatus <NUM> may include a plurality of processors as an alternative to the processor <NUM>. The plurality of processors share execution of the learning-and-recognition program. Each of the processors is, like the processor <NUM>, a device that executes the learning-and-recognition program.

Data, information, signal values, and variable values that are used, processed, or output by the learning-and-recognition program are stored in the memory <NUM> or the auxiliary storage device <NUM>, or stored in a register or a cache memory in the processor <NUM>.

The "unit" of each of the time control unit <NUM> and the learning-and-recognition unit <NUM> may be interpreted as "process", "procedure", or "step". The "process" of each process of the time control unit <NUM> and the learning-and-recognition unit <NUM> may be interpreted as "program", "program product", or "computer readable storage medium recording a program".

The learning-and-recognition program causes a computer to execute each process, each procedure, or each step, where the "unit" of each of the units is interpreted as "process", "procedure", or "step". A learning-and-recognition method is a method performed by execution of the program by the learning-and-recognition apparatus <NUM>.

The program may be stored and provided in a computer readable recording medium. The program may be provided as a program product.

The learning-and-recognition apparatus <NUM> may be realized by a processing circuit, such as a logic integrated circuit (IC), a gate array (GA), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA).

A superordinate concept of a processor, a memory, a combination of a processor and a memory, and a processing circuit is referred to as processing circuitry. That is, each of a processor, a memory, a combination of a processor and a memory, and a processing circuit is a specific example of processing circuitry.

<FIG> is a flowchart <NUM> illustrating operation of the learning-and-recognition method of the learning-and-recognition apparatus <NUM> of this embodiment. The following processing is realized by execution of the learning-and-recognition program by the processor <NUM>.

First in step S301, the input control unit <NUM> inputs, to the data masking unit <NUM>, the input data <NUM> input to the reception unit <NUM> of the learning-and-recognition apparatus <NUM>.

In step S302, the data masking unit <NUM> applies random noise to the input data <NUM>. Note that the intensity of noise to be applied by the data masking unit <NUM> is set to be equivalent to or greater than noise that would be applied by an attacker, and the upper limit is a level that does not affect processing of the learning-and-recognition unit <NUM>.

In step S303, the data masking unit <NUM> inputs, to the learning-and-recognition unit <NUM>, the input data to which the random noise has been applied.

The learning-and-recognition unit <NUM> executes the perceptron processes <NUM> in the plurality of neural network layers <NUM>.

In the perceptron processes <NUM>, the processing time of input data to which random noise has not been applied and the processing time of input data to which random noise has been applied are different.

Each of the neural network layers <NUM> outputs calculation results of corresponding ones of the perceptron processes <NUM>.

The neural network layer <NUM> that is the final layer is a learning-and-recognition result.

The learning-and-recognition unit <NUM> obtains the learning-and-recognition result from the input data <NUM> and outputs the learning-and-recognition result.

Finally in step S304, the learning-and-recognition unit <NUM> outputs, to the transmission unit <NUM>, the learning-and-recognition result as the output data <NUM> of the learning-and-recognition apparatus <NUM>.

The transmission unit <NUM> outputs the output data <NUM> to the outside.

As described above, in the learning-and-recognition method of this embodiment, the time control unit <NUM> causes the processing time on the input data <NUM> by the learning-and-recognition unit <NUM> to be independent of the input data <NUM>.

Then, the learning-and-recognition unit <NUM> performs learning-and-recognition processing on the input data <NUM>, and outputs output data.

The learning-and-recognition program of this embodiment causes a computer that executes learning-and-recognition processing to perform learning-and-recognition processing on the input data <NUM>, to cause a time period from an input time point when the input data <NUM> is input to the learning-and-recognition unit <NUM> to an output time point when the output data <NUM> is output from the learning-and-recognition unit <NUM> to be independent of the input data, and to output the output data <NUM>.

The learning-and-recognition apparatus <NUM> of this embodiment is characterized in that means for processing the input data <NUM> is added anterior to the learning-and-recognition unit <NUM>, so as to cause the input data <NUM> and the processing time of the learning-and-recognition unit <NUM> to be independent of each other.

The learning-and-recognition apparatus <NUM> of this embodiment is characterized in that the means for processing the input data <NUM> is realized by means for applying random noise to the input data <NUM> of the learning-and-recognition apparatus <NUM>.

In the learning-and-recognition apparatus <NUM> of this embodiment, the data masking unit <NUM> to apply random noise to the input data <NUM> is added anterior to the learning-and-recognition unit <NUM>, so as to cause the input data <NUM> and the processing time of the learning-and-recognition unit <NUM> to be independent of each other.

The learning-and-recognition apparatus <NUM> of this embodiment provides a countermeasure against timing attacks by causing the processing time of the learning-and-recognition unit <NUM> to be a processing time dependent on the input data <NUM> to which random noise has been applied, by the data masking unit <NUM> to apply random noise to the input data <NUM>.

As described above, the learning-and-recognition apparatus <NUM> of this embodiment causes the processing time of the learning-and-recognition unit <NUM> to be dependent on the input data <NUM> to which random noise has been applied, so that defense against timing attacks that focus on the relationship between the input data <NUM> and the processing time can be provided.

Differences from the first embodiment will be described below.

An embodiment in which an input time point distribution unit <NUM> to randomize an input time point when the input data <NUM> is input to the learning-and-recognition unit <NUM> is added as a countermeasure against timing attacks will be presented in this embodiment.

<FIG> is a configuration diagram of the learning-and-recognition apparatus <NUM>.

The learning-and-recognition apparatus <NUM> has the time control unit <NUM>.

The time control unit <NUM> has the input control unit <NUM>.

The input control unit <NUM> has the input time point distribution unit <NUM>.

The input time point distribution unit <NUM> randomizes an input time point when the input data <NUM> is input to the learning-and-recognition unit <NUM>.

In the learning-and-recognition apparatus <NUM>, the input time point distribution unit <NUM> to randomize an input time point is added anterior to the learning-and-recognition unit <NUM>, so as to cause the input data <NUM> and the processing time of the learning-and-recognition apparatus <NUM> to be independent of each other.

First in step S501, the input data <NUM> input to the learning-and-recognition apparatus <NUM> is input to the input time point distribution unit <NUM>.

In step S502, the input time point distribution unit <NUM> randomizes an input time point when the input data <NUM> is input to the learning-and-recognition unit <NUM>.

Specifically, the input time point distribution unit <NUM> randomizes a time period from a time point when the input data <NUM> is received by the reception unit <NUM> to a time point when the input data <NUM> is output to the learning-and-recognition unit <NUM>.

The randomization of the input time point is realized by dummy processing, wait processing, or the like.

In step S503, the input time point distribution unit <NUM> inputs the input data <NUM> to the learning-and-recognition unit <NUM> according to the randomized input time point.

Finally in step S504, the learning-and-recognition unit <NUM> outputs a learning-and-recognition result as the output data <NUM>.

The learning-and-recognition apparatus <NUM> of this embodiment is characterized in that means for processing input data is added anterior to the learning-and-recognition unit, so as to cause the input data <NUM> and the processing time of the learning-and-recognition apparatus <NUM> to be independent of each other.

The learning-and-recognition apparatus <NUM> of this embodiment is characterized in that the means for processing input data is realized by means for randomizing an input timing to the learning-and-recognition unit of the learning-and-recognition apparatus <NUM>.

The learning-and-recognition apparatus <NUM> of this embodiment provides a countermeasure against timing attacks by causing the processing time of the learning-and-recognition apparatus <NUM> to be a processing time dependent on an input time point that results in a randomized processing time, by the input time point distribution unit <NUM> to randomize an input time point of the input data <NUM>.

As described above, the learning-and-recognition apparatus <NUM> of this embodiment causes the processing time of the learning-and-recognition apparatus <NUM> to be dependent on a randomized input time point, so that defense against timing attacks that focus on the relationship between the input data <NUM> and the processing time can be provided.

An embodiment in which adding an output time point distribution unit <NUM> to randomize an output time point of the learning-and-recognition unit <NUM> serves as a countermeasure against timing attacks will now be presented.

In the learning-and-recognition apparatus <NUM>, the output time point distribution unit <NUM> to randomize an output time point is added posterior to the learning-and-recognition unit <NUM>, so as to cause the input data <NUM> and the processing time of the learning-and-recognition apparatus <NUM> to be independent of each other.

The time control unit <NUM> has an output control unit <NUM>.

The output control unit <NUM> performs processing on the output data <NUM> to change the processing time of the learning-and-recognition apparatus <NUM>.

The input control unit <NUM> has the output time point distribution unit <NUM>.

The output time point distribution unit <NUM> randomizes an output time point of the output data <NUM>.

In the learning-and-recognition apparatus <NUM> of this embodiment, the output time point distribution unit <NUM> to randomize an output time point of the output data <NUM> of the learning-and-recognition apparatus <NUM> is added posterior to the learning-and-recognition unit <NUM>, so as to cause the input data <NUM> and the processing time of the learning-and-recognition apparatus <NUM> to be independent of each other.

First in step S701, the input data <NUM> input to the learning-and-recognition apparatus <NUM> is input to the learning-and-recognition unit <NUM>.

In step S702, a learning-and-recognition result output from the learning-and-recognition unit <NUM> is input to the output time point distribution unit <NUM>.

In step S703, the output time point distribution unit <NUM> randomizes an output time point of the output data <NUM> of the learning-and-recognition apparatus <NUM>.

Specifically, the output time point distribution unit <NUM> randomizes a time period from an input time point when the output data <NUM> is input from the learning-and-recognition unit <NUM> to an output time point when it is output to the transmission unit <NUM>.

The randomization of the output time point is realized by dummy processing, wait processing, or the like.

Finally in step S704, the output time point distribution unit <NUM> outputs, to the transmission unit <NUM>, the learning-and-recognition result output from the learning-and-recognition unit <NUM>, as the output data <NUM>, in accordance with the randomized output time point.

The learning-and-recognition apparatus <NUM> of this embodiment is characterized in that means for processing the output data <NUM> is added posterior to the learning-and-recognition unit <NUM>, so as to cause the input data <NUM> and the processing time of the learning-and-recognition apparatus <NUM> to be independent of each other.

The learning-and-recognition apparatus <NUM> of this embodiment is characterized in that the means for processing the output data <NUM> is realized by means for randomizing an output timing of the learning-and-recognition apparatus <NUM>.

The learning-and-recognition apparatus <NUM> of this embodiment provides a countermeasure against timing attacks by randomizing an output time point of the output data <NUM> by the output time point distribution unit <NUM>, so as to cause the processing time of the learning-and-recognition apparatus <NUM> to be a processing time dependent on a randomized output time point.

As described above, the learning-and-recognition apparatus <NUM> of this embodiment causes the processing time of the learning-and-recognition apparatus <NUM> to be dependent not on the input data <NUM> but on a randomized output time point of the output data <NUM>, so that defense against timing attacks that focus on the relationship between the input data <NUM> and the processing time can be provided.

An embodiment in which a countermeasure against timing attacks is provided by causing processing times of the learning-and-recognition unit <NUM> to be uniform will be presented in this embodiment.

The time control unit <NUM> has the output control unit <NUM>.

The output control unit <NUM> has a time stamp generation unit <NUM> and an output time point adjustment unit <NUM>.

The time stamp generation unit <NUM> records, as a time stamp <NUM>, an input time point when the input data <NUM> is input to the time stamp generation unit <NUM>.

The output time point adjustment unit <NUM> uses the time stamp <NUM> to cause a time period from the input time point of the input data <NUM> to an output time point of the output data <NUM> to be uniform.

The output time point adjustment unit <NUM> sets the output time point of the output data <NUM> by adding a certain period of time to the input time point of the input data <NUM> indicated by the time stamp <NUM>.

In the learning-and-recognition apparatus <NUM>, the time stamp generation unit <NUM> to record an input time point when the input data <NUM> is input to the time stamp generation unit <NUM> is added anterior to the learning-and-recognition unit <NUM>, and the output time point adjustment unit <NUM> to cause the processing time of the learning-and-recognition unit <NUM> to be uniform is added posterior to the learning-and-recognition unit <NUM>, so as to cause the input data <NUM> and the processing time of the learning-and-recognition apparatus <NUM> to be independent of each other.

First in step S901, the input data <NUM> input to the learning-and-recognition apparatus <NUM> is input to the time stamp generation unit <NUM>.

In step S902, the time stamp generation unit <NUM> generates a time stamp <NUM> according to the input time point of the input data <NUM>.

The time stamp <NUM> contains the input time point when the input data <NUM> is input to the time stamp generation unit <NUM>.

The time stamp <NUM> is stored in the memory <NUM>.

In step S903, the time stamp generation unit <NUM> inputs, to the learning-and-recognition unit <NUM>, the input data <NUM> for which the time stamp <NUM> has been recorded in the memory <NUM>.

In step S904, the learning-and-recognition unit <NUM> inputs a learning-and-recognition result to the output time point adjustment unit <NUM>.

In step S905, the output time point adjustment unit <NUM> refers to the time stamp <NUM> generated by the time stamp generation unit <NUM>, and causes the processing time to be uniform.

Specifically, the time stamp generation unit <NUM> sets the output time point of the learning-and-recognition result to a time point resulting from adding a certain period of time to the input time point indicated by the time stamp <NUM>.

Causing the processing time to be uniform is realized by dummy processing, wait processing, or the like.

Finally in step S906, the output time point adjustment unit <NUM> outputs, to the transmission unit <NUM>, the learning-and-recognition result output from the learning-and-recognition unit <NUM>, as the output data <NUM>, in accordance with the output time point that causes the processing time to be uniform.

The learning-and-recognition apparatus <NUM> of this embodiment is characterized in that the means for processing the output data <NUM> is realized by means for generating a time stamp in advance of the learning-and-recognition unit <NUM> of the learning-and-recognition apparatus <NUM>, and referring to the time stamp <NUM> and setting the output timing of the learning-and-recognition apparatus <NUM> so as to cause the processing time of the learning-and-recognition unit <NUM> to be uniform.

The learning-and-recognition apparatus <NUM> of this embodiment adjusts the output time point of the output data <NUM>, independently of the input data <NUM>, by the time stamp generation unit <NUM> to record the input time point of the input data <NUM> and the output time point adjustment unit <NUM> to cause the processing time of the learning-and-recognition unit <NUM> to be uniform.

As described above, the learning-and-recognition apparatus <NUM> of this embodiment adjusts the output time point of the output data <NUM> so as to cause the processing time of the learning-and-recognition apparatus <NUM> to be uniform, so that defense against timing attacks that focus on the relationship between the input data <NUM> and the processing time can be provided.

An embodiment in which a countermeasure against timing attacks is implemented in the perceptron processes <NUM> of each neural network layer <NUM> in the learning-and-recognition unit <NUM> will be presented in this embodiment.

The learning-and-recognition unit <NUM> has processes of a plurality of layers constituted by the neural network layers <NUM>.

In the learning-and-recognition apparatus <NUM>, an output time point adjustment unit <NUM> to cause output time points of processing results of perceptron processes of each neural network layer <NUM> in the learning-and-recognition unit <NUM> to be random or uniform is added, so as to cause the input data <NUM> and the processing time of the learning-and-recognition unit <NUM> to be independent of each other.

The time control unit <NUM> has a processing control unit <NUM>.

The processing control unit <NUM> controls processing time points of the learning-and-recognition unit <NUM> to change processing times of the learning-and-recognition unit <NUM>.

The processing control unit <NUM> has a plurality of output time point adjustment units <NUM>.

Each of the output time point adjustment units <NUM> is provided posterior to a corresponding one of the neural network layers <NUM>.

The neural network layers <NUM> and the output time point adjustment units <NUM> correspond to each other, and the number of the neural network layers <NUM> and the number of the output time point adjustment units <NUM> are equal. However, it is sufficient that there is at least one output time point adjustment unit <NUM>.

Each of the output time point adjustment units <NUM> causes output time points of each layer of the learning-and-recognition unit <NUM> to be random or causes learning time points of each layer of the learning-and-recognition unit <NUM> to be uniform.

In the learning-and-recognition apparatus <NUM>, the output time point adjustment unit <NUM> to cause output time points to be random or uniform is added to the perceptron processes <NUM> of each layer of the neural network layers <NUM> in the learning-and-recognition unit <NUM>, so as to cause the input data <NUM> and the processing time of the learning-and-recognition unit <NUM> to be independent of each other.

First in step S1101, the input data <NUM> input to the learning-and-recognition apparatus <NUM> is input to the learning-and-recognition unit <NUM>.

Then, the processor <NUM> performs processing from step S1102 to step S1105 in a loop in each layer until calculations of all layers of the neural network layers <NUM> are completed.

In step S1103, the neural network layer <NUM> executes the perceptron processes <NUM>.

In step S1104, the neural network layer <NUM> inputs an output of calculation results of the perceptron processes <NUM> to the output time point adjustment unit <NUM>.

In step S1103, the output time point adjustment unit <NUM> receives the calculation results of the neural network layer <NUM> as intermediate data <NUM>, and causes output time points of the intermediate data <NUM> to be uniform or random.

Specifically, the output time point adjustment unit <NUM> receives a plurality of processing results of a plurality of perceptron processes <NUM> as a plurality of pieces of intermediate data <NUM>, and outputs the plurality of pieces of intermediate data <NUM> by causing their output time points to be random or uniform.

Causing the output time points of the plurality of pieces of intermediate data <NUM> to be uniform or random is realized by dummy processing, wait processing, or the like.

The output time point adjustment unit <NUM> receives a plurality of pieces of intermediate data <NUM> and simultaneously outputs the plurality of pieces of intermediate data <NUM>, so as to cause the output time points of the intermediate data <NUM> to be uniform.

Alternatively, the output time point adjustment unit <NUM> receives a plurality of pieces of intermediate data <NUM> and outputs the plurality of pieces of intermediate data <NUM> at mutually random time points, so as to cause the output time points of the plurality of pieces of intermediate data <NUM> to be random.

Causing the output time points of the plurality of pieces of intermediate data <NUM> to be uniform or random may be realized as part of the perceptron processes <NUM>.

Finally in step S1106, after calculations of all layers of the neural network layers <NUM> have been completed, the learning-and-recognition unit <NUM> outputs a learning-and-recognition result to the transmission unit <NUM> as the output data <NUM>.

The learning-and-recognition apparatus <NUM> of this embodiment is characterized in that means for processing intermediate data <NUM> is added between the perceptron processes <NUM> of adjacent layers in the learning-and-recognition unit of the learning-and-recognition apparatus <NUM>, so as to change the processing time of the learning-and-recognition unit <NUM> and to cause input data and the processing time of the learning-and-recognition apparatus <NUM> to be independent of each other.

The learning-and-recognition apparatus <NUM> of this embodiment is characterized in that the means for processing intermediate data <NUM> is realized by means for causing output timings of a plurality of pieces of intermediate data <NUM> of each layer in the learning-and recognition unit of the learning-and-recognition apparatus <NUM> to be random or uniform.

As described above, the learning-and-recognition apparatus <NUM> of this embodiment causes the output time points of a plurality of pieces of intermediate data <NUM> to be uniform or random, so as to change the processing time of the learning-and-recognition unit <NUM>, so that defense against timing attacks that focus on the relationship between the input data <NUM> and the processing time can be provided.

<FIG> is a diagram illustrating another configuration of the learning-and-recognition apparatus <NUM> according to this embodiment.

<FIG> is a variation such that the output time point adjustment units <NUM> of the learning-and-recognition apparatus <NUM> illustrated in <FIG> are modified.

Each of the output time point adjustment units <NUM> illustrated in <FIG> receives intermediate data <NUM> from some perceptron processes <NUM> of all the perceptron processes <NUM> in a corresponding one of the neural network layers <NUM>, instead of receiving intermediate data <NUM> from all the perceptron processes <NUM> in the corresponding one of the neural network layers <NUM>.

When intermediate data <NUM> of a perceptron process <NUM> is not received by the corresponding one of the output time point adjustment units <NUM>, the intermediate data <NUM> is directly input to the next neural network layer <NUM>.

In this embodiment, differences from the first embodiment will be described.

<FIG> is a diagram illustrating a configuration of the learning-and-recognition apparatus <NUM> according to this embodiment.

In <FIG>, the processor <NUM> of the learning-and-recognition apparatus <NUM> illustrated in <FIG> is replaced with an electronic circuit <NUM>.

The learning-and-recognition apparatus <NUM> includes the electronic circuit <NUM>, the memory <NUM>, the auxiliary storage device <NUM>, the communication interface <NUM>, and the recording medium <NUM>.

The electronic circuit <NUM> is a dedicated electronic circuit that realizes the functions of the time control unit <NUM> and the learning-and-recognition unit <NUM>.

Specifically, the electronic circuit <NUM> is a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

The functions of the time control unit <NUM> and the learning-and-recognition unit <NUM> may be realized by one electronic circuit, or may be distributed among and realized by a plurality of electronic circuits.

In this embodiment, the functions of the time control unit <NUM> and the learning-and-recognition unit <NUM> may be realized by software.

Alternatively, the functions of the time control unit <NUM> and the learning-and-recognition unit <NUM> may be realized by hardware.

Alternatively, some of the functions of the time control unit <NUM> and the learning-and-recognition unit <NUM> may be realized by the electronic circuit, and the rest of the functions may be realized by software.

Each of the processor and the electronic circuit is also referred to as processing circuitry. That is, in the learning-and-recognition apparatus <NUM>, the functions of the time control unit <NUM> and the learning-and-recognition unit <NUM> are realized by the processing circuitry.

Although not illustrated, the processor <NUM> of the learning-and-recognition apparatus <NUM> of any one of the embodiments other than the first embodiment may be replaced with the electronic circuit <NUM>.

In the embodiments described above, the learning-and-recognition apparatus <NUM> that performs recognition work while learning has been described. However, instead of the learning-and-recognition apparatus <NUM>, a learning apparatus that performs learning or a recognition apparatus that performs recognition work may be implemented.

The embodiments have been described above. Two or more of these embodiments may be implemented in combination. Alternatively, one embodiment or a combination of two or more embodiments of these embodiments may be partially implemented. Note that the present invention is not limited to these embodiments, and various modifications are possible depending on needs.

Claim 1:
A learning-and-recognition apparatus (<NUM>) comprising:
a learning-and-recognition unit (<NUM>) to perform learning-and-recognition processing on input data, and output output data, the learning-and-recognition unit (<NUM>) having a plurality of neural network layers (<NUM>), each neural network layer (<NUM>) being configured to execute a plurality of perceptron processes (<NUM>), the output data (<NUM>) being calculation results of the perceptron processes (<NUM>) of the final neural network layer (<NUM>); and
a time control unit (<NUM>) to cause a processing time of the learning-and-recognition processing on the input data to be independent of the input data, as a countermeasure against a timing attack, the processing time corresponding to a time period from a time point when the input data (<NUM>) is input to the learning-and-recognition apparatus (<NUM>) to a time point when the output data (<NUM>) is output from the learning-and-recognition apparatus (<NUM>),
wherein the time control unit (<NUM>) includes an input control unit (<NUM>) to perform processing on the input data to change the processing time of the learning-and-recognition processing, and
wherein the input control unit (<NUM>) includes a data masking unit (<NUM>) and the data masking unit (<NUM>) to apply random noise to the input data (<NUM>) is added anterior to the learning-and-recognition unit (<NUM>).