Abstract: An secure computation server apparatus in a secure computation system includes: a local shuffle part that computes, by using a shared permutation shared by four of the five secure computation server apparatuses, permuted values of a share for a remaining one of the five secure computation server apparatuses and sends the permuted values of the share to the remaining secure computation server apparatus; a comparison and verification part that compares values with each other, which are received from at least three of the four secure computation server apparatuses and which are supposed to be a same value, and adopts the values that are same at least two values as an accurate permutation; and a shuffle synthesis part that synthesizes mini-shuffles, by using a shared permutation shared by a corresponding combination of four secure computation server apparatuses and a permutation adopted by a corresponding one of the comparison and verification parts.

Abstract: A secure computation server apparatus in a secure computation system includes: a table storage part that stores a table of secret shares of the product of a first value and a second value for combinations of shares of possible values of the first value and shares of possible values of the second value; a table shuffle part that shuffles indices of possible values of the first value and indices of possible values of the second value in the table; a multiplication part that selects an element in the table whose indices in the shuffled table match the first and the second values; and a comparative verification part that accepts data that a majority of other secure computation server apparatuses agrees on as a correct value out of a plurality of data received from the other secure computation server apparatuses.

Abstract: A verification apparatus acquires a source code for multiparty computation, while changing a combination of options settable to a multiparty computation compiler, compiles the source code for each combination of options to generate a plurality of multiparty computation executable codes, selects at least one multiparty computation executable code from the plurality of multiparty computation executable codes as a verification code and provides the at least one verification code to a verification environment of multiparty computation, generates an evaluation index with respect to an execution result of at least one verification code in the verification environment, and selects at least one recommended code from the plurality of multiparty computation executable codes, based on the evaluation index corresponding to at least one verification code and outputs the selected recommended code.

Abstract: An individual one of secure computation server apparatuses in a secure computation system includes: a local reshare part that computes an arithmetic share from a logic share without communicating with the other secure computation server apparatuses by setting a sub-share not held thereby to zero; a secure computation part that performs a secure computation with communications by using the arithmetic share acquired by the local reshare part, to acquire an arithmetic share from the logic share through a bit conversion; and a comparison and verification part that compares received values with each other, which are received from at least three of the secure computation server apparatuses and which are supposed to be a same value, and adopts the received values that are same at least two received values as an accurate value. The comparison and verification part verifies the received values acquired in the secure computation with communications.

Abstract: A federated learning apparatus in a federated learning system includes: a model storage part that replicates and stores a shared model as a local model; a local training part that trains the local model by using data held by the federated learning apparatus; a secret sharing part that decomposes a local update parameter indicating a training result of the local model into shares based on an additive secret sharing scheme and distributes the shares to other federated learning apparatuses; an aggregation and secure computation part that performs a secure computation for shares of a global update parameter by performing addition of the shares of the local update parameters and multiplication of the shares by cleartext constants; and a global training part that reconstructs the shares of the global update parameter and updates the shared model by the global update parameter.

Abstract: In IaaS (Infrastructure as a Service), when it is desirable to delegate the authority to a user outside a system, a recipient of an access token is designated, thereby preventing illegal distribution of the access token. There is provided an access token system including a generator and a verifier. The generator generates, using secret information of a recipient, a recipient-designated access token for which the recipient is designated, and provides the recipient-designated access token to a user. The verifier verifies that the user who makes access using the recipient-designated access token is the designated recipient.

Abstract: When an absolute value of a difference value between a first share and a second share which are secret-shared is less than or equal to a natural number t, the information processing apparatus calculates the difference value between the first share and the second share. Furthermore, the information processing apparatus performs a comparison in magnitude of the first share and the second share using bit-decomposition from a least significant bit to an m-th bit (m being a natural number) of the difference value.

Abstract: A secure computation system comprises at least three secure computation server apparatuses connected to each other via a network, and each of secure computation server apparatuses comprises: a random number generation part that generates a random number for masking an input value; an m-1 bit comparison part that compares a value obtained by removing the most significant bit from input value masked with random number with a value obtained by removing the most significant bit from random number; a carry correction part that corrects calculation of a value obtained by removing the most significant bit from input value on basis of result of comparison; and a most significant bit extraction part that extracts the most significant bit of input value by subtracting corrected value of value obtained by removing the most significant bit from input value from input value.

Abstract: A secure computation system comprising secure computation server apparatuses, each of which comprises: a discriminant share generation part that computes discriminant shares configured so that an index relating to an input corresponds to a specific value from shares representing the index relating to the input and possible combinations of index shares of an array; a combination configuration part that configures a combination of shares of an element in the array and the discriminant shares for all possible combinations of indices of the array; a shuffle part that shuffles the combinations; a reconstruction part that reconstructs the discriminant shares in the shuffled combinations; and a selection part that selects shares of an element in the array in the combinations where the reconstructed value is the specific value.

Abstract: A secure computation system comprises at least five secure computation server apparatuses connected to each other via a network and performs secure computation on a value stored while being secret-shared, and each of the secure computation server apparatuses has a comparative verification part that compares values, which should be the same, received from at least three secure computation server apparatuses and that accepts a received value identical to at least another received value as a correct value.

Abstract: A secure computation system for secure exponentiation involving a non-secret base and a secret exponent comprises at least four secure computation server apparatuses connected to each other via a network, and each of the secure computation server apparatuses has: a reshare part that outputs reshares for an input including at least a share of the exponent by an operation closed within each of the secure computation server apparatuses; and a multiplication part that performs the secure exponentiation by executing multiplication using shares obtained by having the reshare part reshare the exponent that has been decomposed into additions of shares of the exponent.

Abstract: To provide an assessment apparatus capable of assessing the security of an assessment target model. The assessment apparatus is able to access a surrogate model generation apparatus that comprises a query generation part that generates a first query causing an assessment target model to make an inference to obtain an inference result; an MIA execution part that executes a membership inference attack using as an input the inference result obtained by sending the first query to the assessment target model and infers virtual training data used to train the assessment target model; and a surrogate model generation part that uses the virtual training data to generate a surrogate model that emulates the behavior of the assessment target model, and the assessment apparatus comprises a security assessment part that transmits a second query to both the surrogate model and the assessment target model to assess the security of the assessment target model using the results therefrom.

Abstract: An inference apparatus according to the embodiment including: an inference unit which is machine learning model trained using training data and configured to inference based on input data; a determination unit configured to determine whether input data is the training data or not based on inference data indicating a result of inference when the input data is input to the inference unit; and an output unit configured to output the inference data as output data when the determination unit determines that the input data is not the training data, and configured to output an alternative data different from the inference data as the output data when the determination unit determines that input data is the training data.

Abstract: A client is provided with a property classification model training part that trains a classification model, the classification model inferring a property of an input data from the gradient information and a target model training part that computes the gradient information of the target model using a training data, the target model and the classification model and transmits the gradient information to the server. The property of the input data that the classification model infers can be set for each client, and the property classification model training part trains the classification model using the target model and a second training data labelled with a teacher label regarding the property of the input data.

Abstract: The invention includes a first learning phase that a machine learning is performed using first dataset to create a learning model f; and a second learning phase that the first or a second dataset is randomly selected; a result by inputting the first and the second datasets to the learning model f is inputted to a discriminator h having a parameter ?; a machine learning is performed using a result and a ground truth data to train the parameter ?, the result being obtained by having the discriminator h discriminate whether the input data belongs to the first or the second dataset; and when the first dataset is selected, a result by inputting the data of the first dataset to the learning model f is inputted to a defender u to train a parameter ? thereof by using an output of the discriminator h through the defender u.

Abstract: A machine learning apparatus includes an influence function calculation part which calculates an influence function indicating sensitivity that input data has on parameters of a target model and a target model training part which trains the target model using the influence function as a regularization term.

Abstract: Each of the secure computation server apparatuses includes a bit-decomposition operation part that performs a bit-decomposition for a share value secretly shared with a constant number of rounds; a table operation part that determines a success or failure of an equality at each bit of the bit-decomposition using a table in which determination expressions for determination whether or not the equality holds at each bit are arranged in a row direction, and combinations of the determination expressions are arranged in a column direction; and an equality determination part that performs equality determination with a constant number of rounds for a value that accumulates a result of the success or failure of the equality at each bit of the bit-decomposition to determine an array reference corresponding to the share value.

Abstract: Each of a secure computation server apparatuses includes a random number generation part that generates random numbers using a pseudo random number generator shared among the secure computation server apparatuses; a seed storage part that shares and stores a seed(s) used for generating random numbers in the random number generation part; a pre-generated random number storage part that stores random numbers generated by the random number generation part; a share value storage part that stores a share(s) to be a target of processing; a logical operation part that computes a carry to be transmitted and received among the secure computation server apparatuses using the random numbers and the share(s) to be a target of processing; an inner product calculation part that removes a mask from the carry; and an arithmetic operation part that performs a processing of erasing the carry to obtain a processing result.

Abstract: The number of permutations is reduced when four-party shuffling is performed. Among four secure computation nodes holding first to third shares of data in a secret-shared form, first and second secure computation nodes are selected as resharing nodes, and third and fourth secure computation nodes are selected as receiving nodes. The first and second secure computation nodes perform a mini-shuffle for resharing the shares they each hold by using a permutation that third and fourth receiving nodes do not know. Next, the third and fourth secure computation nodes perform a mini-shuffle for resharing the shares they each hold by using a permutation that first and second receiving nodes do not know.

Abstract: Among four secure computation nodes, one secure computation node is selected as a receiving node. Two of three remaining secure computation nodes among the four secure computation nodes are operated as resharing nodes, and a remaining secure computation node is operated as a verifying node. The resharing node(s) performs a mini-shuffle for resharing share(s) held therein by using a permutation that the receiving node does not know and transmits a result(s) of the mini-shuffle to the receiving node. The verifying node computes data to verify the result(s) of the mini-shuffle performed by the resharing node(s) by using a permutation that the receiving node does not know and transmits the data to the receiving node. Shuffling of shares is achieved by repeatedly performing a round as described above so that each of the four secure computation nodes is selected as the receiving node at least once.