Patent Application
20240303471
Embodiments relate generally to data processing and more particularly to an activation function for homomorphically-encrypted neural networks.
Neural networks and other types of machine learning models are useful tools that have demonstrated their value solving complex problems regarding pattern recognition, natural language processing, automatic speech recognition, etc. Neural networks operate using artificial neurons arranged into one or more layers that process data from an input layer to an output layer, applying weighting values to the data during the processing of the data. Such weighting values are determined during a training process and applied during an inference process.
One type of neural network model is a deep neural network (DNN) model. In order to enable the delegation of the data processing without exposing the data itself, there are several encryption schemes that allow for computation over encrypted data and that have been adopted for deployment of DNN models. Such encryption schemes, including (but not limited to) homomorphic encryption, operate to secure multi-party computation and oblivious transfer, while allowing a DNN accelerator to effectively obtain the correct results (like as it was done on the unencrypted data), while the data or the model are strongly protected by being encrypted.
So that the manner in which the above recited features of the present embodiments can be understood in detail, a more particular description of the embodiments, briefly summarized above, may be had by reference to embodiments, some of which are illustrated in the appended drawings. It is to be noted, however, that the appended drawings illustrate typical embodiments and are therefore not to be considered limiting of its scope. The figures are not to scale. In general, the same reference numbers are used throughout the drawing(s) and accompanying written description to refer to the same or like parts.
Implementations of the disclosure describe an activation function for homomorphically-encrypted neural networks. In computer engineering, computing architecture is a set of rules and methods that describe the functionality, organization, and implementation of computer systems. Today's computing systems are expected to deliver near zero-wait responsiveness and superb performance while taking on large workloads for execution. Therefore, computing architectures have continually changed (e.g., improved) to accommodate demanding workloads and increased performance expectations.
Examples of large workloads include neural networks, artificial intelligence (AI), machine learning, etc. Such workloads have become more prevalent as they have been implemented in a number of computing devices, such as personal computing devices, business-related computing devices, etc. Furthermore, with the growing use of large machine learning and neural network workloads, new silicon has been produced that is targeted at running large workloads. Such new silicon includes dedicated hardware accelerators (e.g., graphics processing unit (GPU), field-programmable gate array (FPGA), vision processing unit (VPU), etc.) customized for processing data using data parallelism.
Artificial intelligence (AI), including machine learning (ML), deep learning (DL), neural networks, and/or other artificial machine-driven logic, enables machines (e.g., computers, logic circuits, etc.) to use a model to process input data to generate an output based on patterns and/or associations previously learned by the model via a training process. For instance, the model may be trained with data to recognize patterns and/or associations and follow such patterns and/or associations when processing input data such that other input(s) result in output(s) consistent with the recognized patterns and/or associations.
Many different types of machine learning models and/or machine learning architectures exist. In some examples disclosed herein, a convolutional neural network is used. Using a convolutional neural network (CNN) enables classification of objects in images, natural language processing, etc. In general, machine learning models/architectures that are suitable to use in the example approaches disclosed herein may include convolutional neural networks. However, other types of machine learning models could additionally or alternatively be used such as recurrent neural network, feedforward neural network, generative adversarial network (GAN), etc.
In general, implementing a ML/AI system involves two phases, a learning/training phase and an inference phase. In the learning/training phase, a training algorithm is used to train a model to operate in accordance with patterns and/or associations based on, for example, training data. In general, the model includes internal parameters that guide how input data is transformed into output data, such as through a series of nodes and connections within the model to transform input data into output data. Additionally, hyperparameters are used as part of the training process to control how the learning is performed (e.g., a learning rate, a number of layers to be used in the machine learning model, etc.). Hyperparameters are defined to be training parameters that are determined prior to initiating the training process.
Different types of training may be performed based on the type of ML/AI model and/or the expected output. For example, supervised training uses inputs and corresponding expected (e.g., labeled) outputs to select parameters (e.g., by iterating over combinations of select parameters) for the ML/AI model that reduce model error. As used herein, labelling refers to an expected output of the machine learning model (e.g., a classification, an expected output value, etc.) Alternatively, unsupervised training involves inferring patterns from inputs to select parameters for the ML/AI model (e.g., without the benefit of expected (e.g., labeled) outputs). Examples of unsupervised training could be clustering, nearest neighbors, etc.
Deep learning is a family of learning algorithms that might be used in both supervised and unsupervised training. Deep learning may utilize deep neural networks (DNNs), which are widely used in many application domains and are currently the state of the art in tasks like computer vision, audio and video classification and natural language processing. In some cases, DNN models may be deployed either on the cloud (e.g., Machine Learning as a Service (MLaaS)) or on an edge platform. These two models expose a sensitive data leakage problem where data is exposed upon delegation of the data. In many cases, the data, the model, or both, are private and/or confidential, and using them without protection exposes privacy, security, or IP leaks. In cloud deployment, an example of the sensitive data leakage problem is when a client might want to infer data with private properties (e.g., text containing bank account details, etc.), but once such data is uploaded to the cloud either a rouge service provider or malicious administrator can gain access to the data. In an edge deployment, an example of the sensitive data leakage problem is when the DNN model itself is high value IP that could be extracted from the cloud using well-known classic hacking techniques.
In order to enable the delegation of the data processing without exposing the data itself, there are several encryption schemes that allow for computation over encrypted data and that have been adopted for deployment of DNN models. Such encryption schemes, including (but not limited to) homomorphic encryption, operate to secure multi-party computation and oblivious transfer, while allowing a DNN accelerator to effectively obtain the correct results (like as it was done on the unencrypted data), while the data and/or the model are strongly protected by being encrypted.
A problem with homomorphic encryption schemes is that they utilize and support polynomial operations, and do not support non-polynomial operations. However, many of the common activation functions, such as Rectified Linear Unit (ReLU), Sigmoid, and Softmax, for example, that are utilized in DNN models are non-polynomial in nature.
Existing approaches for homomorphic encryption based DNN implementations may address the above-noted limitations of the common encryption schemes by using polynomial approximations. For example, such polynomial approximations may include either Taylor expansions or Chebyshev approximation. Another current approach to address the above-noted limitations is to use other non-regular activation functions, such as square operation followed by mean-pooling, for example.
However, these current approaches for activation functions in the encrypted computation context work significantly slower and/or suffer inaccuracies. For instance, polynomial approximations slow down the computation significantly: instead of using simple and quick computation such as ReLU (x→max(0, x)) or optimized exponent-based Sigmoid,
for i=1, . . . , K respectively), heavy piecewise polynomial calculation has to take place. In addition, operations that involve multiplication (and exist in any approximation method) increase the use of bootstrapping in homomorphic encryption systems, to get rid of noise, and increase communication time between parties in secure multi-party computation systems, which is involved in additional performance degradation. Furthermore, the non-standard activations reduce accuracy and utilize longer training.
Implementations of the disclosure address these drawbacks by providing an activation function for homomorphically-encrypted neural networks. In particular, implementations herein propose a novel, data agnostic activation method that collects information about the distribution of the most-dominant activated locations in the feature maps of the trained DNN model and maintain a map of those locations. This map, along with a defined percent of random locations, decides which neurons in the DNN model are activated.
Implementations of the disclosure provide for a variety of technical advantages over the conventional approaches. Advantages of implementations of the disclosure include allowing for efficient activation function computations in encrypted computations of neural networks, yet no data-dependent computation is done during inference time (e.g., data agnostic). Implementations utilize negligible overhead in model storage, while preserving the same accuracy (within acceptable score change) as with the general activation functions and runs in orders of magnitude faster than the approximation-based activations. Furthermore, implementations herein may be applied post-hoc to already-trained models and, as such, do not utilize fine-tuning.
In some embodiments the computing system 100 is part of an Internet-of-Things (IoT) device, which are typically resource-constrained devices. IoT devices may include embedded systems, wireless sensor networks, control systems, automation (including home and building automation), and other devices and appliances (such as lighting fixtures, thermostats, home security systems and cameras, and other home appliances) that support one or more common ecosystems, and can be controlled via devices associated with that ecosystem, such as smartphones and smart speakers.
Computing system 100 can also include, couple with, or be integrated within: a wearable device, such as a smart watch wearable device; smart eyewear or clothing enhanced with augmented reality (AR) or virtual reality (VR) features to provide visual, audio or tactile outputs to supplement real world visual, audio or tactile experiences or otherwise provide text, audio, graphics, video, holographic images or video, or tactile feedback; other augmented reality (AR) device; or other virtual reality (VR) device. In some embodiments, the computing system 100 includes or is part of a television or set top box device. In one embodiment, computing system 100 can include, couple with, or be integrated within a self-driving vehicle such as a bus, tractor trailer, car, motor or electric power cycle, plane or glider (or any combination thereof). The self-driving vehicle may use computing system 100 to process the environment sensed around the vehicle.
As illustrated, in one embodiment, computing system 100 may include any number and type of hardware and/or software components, such as (without limitation) graphics processing unit (“GPU”, general purpose GPU (GPGPU), or simply “graphics processor”) 112, a hardware accelerator 114, central processing unit (“CPU” or simply “application processor”) 115, memory 130, network devices, drivers, or the like, as well as input/output (I/O) sources 160, such as touchscreens, touch panels, touch pads, virtual or regular keyboards, virtual or regular mice, ports, connectors, etc. Computing system 100 may include operating system (OS) 110 serving as an interface between hardware and/or physical resources of the computing system 100 and a user. In some implementations, the computing system 100 may include a combination of one or more of the CPU 115, GPU 112, and/or hardware accelerator 114 on a single system on a chip (SoC), or may be without a GPU 112 or visual output (e.g., hardware accelerator 114) in some cases, etc.
As used herein, “hardware accelerator”, such as hardware accelerator 114, refers to a hardware device structured to provide for efficient processing. In particular, a hardware accelerator may be utilized to provide for offloading of some processing tasks from a central processing unit (CPU) or other general processor, wherein the hardware accelerator may be intended to provide more efficient processing of the processing tasks than software run on the CPU or other processor. A hardware accelerator may include, but is not limited to, a graphics processing unit (GPU), a vision processing unit (VPU), neural processing unit, AI (Artificial Intelligence) processor, field programmable gate array (FPGA), or application-specific integrated circuit (ASIC).
The GPU 112 (or graphics processor 112), hardware accelerator 114, and/or CPU 115 (or application processor 115) of example computing system 100 may include a model trainer 125, model executor 105, and a pre-deployment activation analyzer 150. Although the model trainer 125, model executor 105, and pre-deployment activation analyzer 150 are depicted as part of the CPU 115, in some implementations, the GPU 112 and/or hardware accelerator 114 may include the model trainer 125, model executor 105, and pre-deployment activation analyzer 150. Moreover, in some implementations, although depicted as operating on the same computing system 100 in
The example model executor 105 accesses input values (e.g., via an input interface (not shown)), and processes those input values based on a machine learning model stored in a model parameter memory 135 of the memory 130 to produce output values (e.g., via an output interface (not shown)). The input data may be received from one or more data sources (e.g., via one or more sensors, via a network interface, etc.). However, the input data may be received in any fashion such as, for example, from an external device (e.g., via a wired and/or wireless communication channel). In some examples, multiple different types of inputs may be received. In some examples, the input data and/or output data is received via inputs and/or outputs of the system of which the computing system 100 is a component.
In the illustrated example of
In the illustrated example of
The example model executor 105, the example model trainer 125, and/or the example pre-deployment activation analyzer 150, are implemented by one or more logic circuits such as, for example, hardware processors. In some examples, one or more of the example model trainer 125, and/or the example pre-deployment activation analyzer 150 may be implemented by a same hardware component (e.g., a same logic circuit) or by different hardware components (e.g., different logic circuits, different computing systems, etc.). However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.
In examples disclosed herein, the example model executor 105 executes a machine learning model. The example machine learning model may be implemented using a neural network (e.g., a feedforward neural network). However, any other past, present, and/or future machine learning topology(ies) and/or architecture(s) may additionally or alternatively be used such as, for example, a CNN.
To execute a model, the example model executor 105 accesses input data. The example model executor 105 applies the model (defined by the model parameters (e.g., neural network parameters including weight and/or activations) stored in the model parameter memory 135) to the input data.
The example memory 130 of the illustrated example of
In examples disclosed herein, the output data may be information that classifies the received input data (e.g., as determined by the model executor 105.). However, any other type of output that may be used for any other purpose may additionally or alternatively be used. In examples disclosed herein, the output data may be output by an input/output (I/O) source 160 that displays the output values. However, in some examples, the output data may be provided as output values to another system (e.g., another circuit, an external system, a program executed by the computing system 100, etc.). In some examples, the output data may be stored in a memory.
The example model trainer 125 of the illustrated example of
The example model trainer 125 determines whether the training error is less than a training error threshold. If the training error is less than the training error threshold, then the model has been trained such that it results in a sufficiently low amount of error, and no further training is pursued. In examples disclosed herein, the training error threshold is ten errors. However, any other threshold may additionally or alternatively be used. Moreover, other types of factors may be considered when determining whether model training is complete. For example, an amount of training iterations performed and/or an amount of time elapsed during the training process may be considered.
The training data that is utilized by the model trainer 125 includes example inputs (corresponding to the input data expected to be received), as well as expected output data. In examples disclosed herein, the example training data is provided to the model trainer 125 to enable the model trainer 125 to determine an amount of training error.
In examples disclosed herein, the example model trainer 125 and model executor 105 utilize the pre-deployment activation analyzer 150 to implement an activation function for homomorphically-encrypted neural networks. As discussed above, the pre-deployment activation analyzer 150 includes an activation statistics collects information about the distribution of the most-dominant activated locations in feature maps of a model trained by model trainer 125. The pre-deployment activation analyzer also maintains a map, such as a heat map, of the most-dominant (e.g., most-frequent) activated locations and saves indices of those locations. A set of activation parameters, such as a percent of fixed activated locations (of each of the feature maps) and a percent of randomized activated locations (of each of the feature maps), are determined for the trained model. The activation indices, along with the activation parameters, are then passed to model executor 105, along with the trained model, and used by model executor 105 to determine which neurons in the trained model to activate during inference. This provides a data-agnostic activation function that can be implemented in a deployed encrypted model at the model executor 105.
Further discussion and detailed description of the model trainer 125, the model executor 105, and the pre-deployment activation analyzer 150 are provided below with respect to
The example I/O source 160 of the illustrated example of
While an example manner of implementing the computing system 100 is illustrated in
In some implementations of the disclosure, a software and/or firmware implementation of at least one of the example model executor 105, the example model trainer 125, the example pre-deployment activation analyzer 150, the example I/O source(s) 160, and/or, more generally, the example computing system 100 of
A machine learning algorithm is an algorithm that can learn based on a set of data. Embodiments of machine learning algorithms can be designed to model high-level abstractions within a data set. For example, image recognition algorithms can be used to determine which of several categories to which a given input belong; regression algorithms can output a numerical value given an input; and pattern recognition algorithms can be used to generate translated text or perform text to speech and/or speech recognition.
An example type of machine learning algorithm is a neural network. There are many types of neural networks; a simple type of neural network is a feedforward network. A feedforward network may be implemented as an acyclic graph in which the nodes are arranged in layers. Typically, a feedforward network topology includes an input layer and an output layer that are separated by at least one hidden layer. The hidden layer transforms input received by the input layer into a representation that is useful for generating output in the output layer. The network nodes are fully connected via edges to the nodes in adjacent layers, but there are no edges between nodes within each layer. Data received at the nodes of an input layer of a feedforward network are propagated (i.e., “fed forward”) to the nodes of the output layer via an activation function that calculates the states of the nodes of each successive layer in the network based on coefficients (“weights”) respectively associated with each of the edges connecting the layers. Depending on the specific model being represented by the algorithm being executed, the output from the neural network algorithm can take various forms.
Before a machine learning algorithm can be used to model a particular problem, the algorithm is trained using a training data set. Training a neural network involves selecting a network topology, using a set of training data representing a problem being modeled by the network, and adjusting the weights until the network model performs with a minimal error for all instances of the training data set. For example, during a supervised learning training process for a neural network, the output produced by the network in response to the input representing an instance in a training data set is compared to the “correct” labeled output for that instance, an error signal representing the difference between the output and the labeled output is calculated, and the weights associated with the connections are adjusted to minimize that error as the error signal is backward propagated through the layers of the network. The network is considered “trained” when the errors for each of the outputs generated from the instances of the training data set are minimized.
The accuracy of a machine learning algorithm can be affected significantly by the quality of the data set used to train the algorithm. The training process can be computationally intensive and may require a significant amount of time on a conventional general-purpose processor. Accordingly, parallel processing hardware is used to train many types of machine learning algorithms. This is particularly useful for optimizing the training of neural networks, as the computations performed in adjusting the coefficients in neural networks lend themselves naturally to parallel implementations. Specifically, many machine learning algorithms and software applications have been adapted to make use of the parallel processing hardware within general-purpose graphics processing devices.
Hardware acceleration for the machine learning application 202 can be enabled via a machine learning framework 204. The machine learning framework 204 can provide a library of machine learning primitives. Machine learning primitives are basic operations that are commonly performed by machine learning algorithms. Without the machine learning framework 204, developers of machine learning algorithms would have to create and optimize the main computational logic associated with the machine learning algorithm, then re-optimize the computational logic as new parallel processors are developed. Instead, the machine learning application can be configured to perform the computations using the primitives provided by the machine learning framework 204. Example primitives include tensor convolutions, activation functions, and pooling, which are computational operations that are performed while training a convolutional neural network (CNN). The machine learning framework 204 can also provide primitives to implement basic linear algebra subprograms performed by many machine-learning algorithms, such as matrix and vector operations.
The machine learning framework 204 can process input data received from the machine learning application 202 and generate the appropriate input to a compute framework 206. The compute framework 206 can abstract the underlying instructions provided to the GPGPU driver 208 to enable the machine learning framework 204 to take advantage of hardware acceleration via the GPGPU hardware 210 without requiring the machine learning framework 204 to have intimate knowledge of the architecture of the GPGPU hardware 210. Additionally, the compute framework 206 can enable hardware acceleration for the machine learning framework 204 across a variety of types and generations of the GPGPU hardware 210.
The computing architecture provided by embodiments described herein can be configured to perform the types of parallel processing that is particularly suited for training and deploying neural networks for machine learning. A neural network can be generalized as a network of functions having a graph relationship. As is known in the art, there are a variety of types of neural network implementations used in machine learning. One example type of neural network is the feedforward network, as previously described.
A second example type of neural network is the Convolutional Neural Network (CNN). A CNN is a specialized feedforward neural network for processing data having a known, grid-like topology, such as image data. Accordingly, CNNs are commonly used for compute vision and image recognition applications, but they also may be used for other types of pattern recognition such as speech and language processing. The nodes in the CNN input layer are organized into a set of “filters” (feature detectors inspired by the receptive fields found in the retina), and the output of each set of filters is propagated to nodes in successive layers of the network. The computations for a CNN include applying the convolution mathematical operation to each filter to produce the output of that filter. Convolution is a specialized kind of mathematical operation performed by two functions to produce a third function that is a modified version of one of the two original functions. In convolutional network terminology, the first function to the convolution can be referred to as the input, while the second function can be referred to as the convolution kernel. The output may be referred to as the feature map. For example, the input to a convolution layer can be a multidimensional array of data that defines the various color components of an input image. The convolution kernel can be a multidimensional array of parameters, where the parameters are adapted by the training process for the neural network.
Recurrent neural networks (RNNs) are a family of feedforward neural networks that include feedback connections between layers. RNNs enable modeling of sequential data by sharing parameter data across different parts of the neural network. The architecture for an RNN includes cycles. The cycles represent the influence of a present value of a variable on its own value at a future time, as at least a portion of the output data from the RNN is used as feedback for processing subsequent input in a sequence. This feature makes RNNs particularly useful for language processing due to the variable nature in which language data can be composed.
The figures described below present example feedforward, CNN, and RNN networks, as well as describe a general process for respectively training and deploying each of those types of networks. It can be understood that these descriptions are example and non-limiting as to any specific embodiment described herein and the concepts illustrated can be applied generally to deep neural networks and machine learning techniques in general.
The example neural networks described above can be used to perform deep learning. Deep learning is machine learning using deep neural networks. The deep neural networks used in deep learning are artificial neural networks composed of multiple hidden layers, as opposed to shallow neural networks that include a single hidden layer. Deeper neural networks are generally more computationally intensive to train. However, the additional hidden layers of the network enable multistep pattern recognition that results in reduced output error relative to shallow machine learning techniques.
Deep neural networks used in deep learning typically include a front-end network to perform feature recognition coupled to a back-end network which represents a mathematical model that can perform operations (e.g., object classification, speech recognition, etc.) based on the feature representation provided to the model. Deep learning enables machine learning to be performed without requiring hand crafted feature engineering to be performed for the model. Instead, deep neural networks can learn features based on statistical structure or correlation within the input data. The learned features can be provided to a mathematical model that can map detected features to an output. The mathematical model used by the network is generally specialized for the specific task to be performed, and different models can be used to perform different task.
Once the neural network is structured, a learning model can be applied to the network to train the network to perform specific tasks. The learning model describes how to adjust the weights within the model to reduce the output error of the network. Backpropagation of errors is a common method used to train neural networks. An input vector is presented to the network for processing. The output of the network is compared to the sought-after output using a loss function and an error value is calculated for each of the neurons in the output layer. The error values are then propagated backwards until each neuron has an associated error value which roughly represents its contribution to the original output. The network can then learn from those errors using an algorithm, such as the stochastic gradient descent algorithm, to update the weights of the of the neural network.
The convolutional layers are sparsely connected, which differs from traditional neural network configuration found in the fully connected layers 308. Traditional neural network layers are fully connected, such that every output unit interacts with every input unit. However, the convolutional layers are sparsely connected because the output of the convolution of a field is input (instead of the respective state value of each of the nodes in the field) to the nodes of the subsequent layer, as illustrated. The kernels associated with the convolutional layers perform convolution operations, the output of which is sent to the next layer. The dimensionality reduction performed within the convolutional layers is one aspect that enables the CNN to scale to process large images.
In the convolution stage 316 performs several convolutions in parallel to produce a set of linear activations. The convolution stage 316 can include an affine transformation, which is any transformation that can be specified as a linear transformation plus a translation. Affine transformations include rotations, translations, scaling, and combinations of these transformations. The convolution stage computes the output of functions (e.g., neurons) that are connected to specific regions in the input, which can be determined as the local region associated with the neuron. The neurons compute a dot product between the weights of the neurons and the region in the local input to which the neurons are connected. The output from the convolution stage 316 defines a set of linear activations that are processed by successive stages of the convolutional layer 314.
The linear activations can be processed by a detector stage 318. In the detector stage 318, each linear activation is processed by a non-linear activation function. The non-linear activation function increases the nonlinear properties of the overall network without affecting the receptive fields of the convolution layer. Several types of non-linear activation functions may be used. One particular type is the rectified linear unit (ReLU), which uses an activation function defined as ƒ(x)=max(0, x), such that the activation is thresholded at zero.
The pooling stage 320 uses a pooling function that replaces the output of the second convolutional layer 306 with a summary statistic of the nearby outputs. The pooling function can be used to introduce translation invariance into the neural network, such that small translations to the input do not change the pooled outputs. Invariance to local translation can be useful in scenarios where the presence of a feature in the input data is weighted more heavily than the precise location of the feature. Various types of pooling functions can be used during the pooling stage 320, including max pooling, average pooling, and l2-norm pooling. Additionally, some CNN implementations do not include a pooling stage. Instead, such implementations substitute and additional convolution stage having an increased stride relative to previous convolution stages.
The output from the convolutional layer 314 can then be processed by the next layer 322. The next layer 322 can be an additional convolutional layer or one of the fully connected layers 308. For example, the first convolutional layer 304 of
In addition to the basic CNN and RNN networks described, variations on those networks may be enabled. One example RNN variant is the long short-term memory (LSTM) RNN. LSTM RNNs are capable of learning long-term dependencies that may be utilized for processing longer sequences of language. A variant on the CNN is a convolutional deep belief network, which has a structure similar to a CNN and is trained in a manner similar to a deep belief network. A deep belief network (DBN) is a generative neural network that is composed of multiple layers of stochastic (random) variables. DBNs can be trained layer-by-layer using greedy unsupervised learning. The learned weights of the DBN can then be used to provide pre-train neural networks by determining an optimized initial set of weights for the neural network.
Supervised learning is a learning method in which training is performed as a mediated operation, such as when the training dataset 502 includes input paired with the sought-after output for the input, or where the training dataset includes input having known output and the output of the neural network is manually graded. The network processes the inputs and compares the resulting outputs against a set of expected or sought-after outputs. Errors are then propagated back through the system. The training framework 504 can adjust to adjust the weights that control the untrained neural network 506. The training framework 504 can provide tools to monitor how well the untrained neural network 506 is converging towards a model suitable to generating correct answers based on known input data. The training process occurs repeatedly as the weights of the network are adjusted to refine the output generated by the neural network. The training process can continue until the neural network reaches a statistically relevant accuracy associated with a trained neural network 508. The trained neural network 508 can then be deployed to implement any number of machine learning operations to generate an inference result 514 based on input of new data 512.
Unsupervised learning is a learning method in which the network attempts to train itself using unlabeled data. Thus, for unsupervised learning the training dataset 502 can include input data without any associated output data. The untrained neural network 506 can learn groupings within the unlabeled input and can determine how individual inputs are related to the overall dataset. Unsupervised training can be used to generate a self-organizing map, which is a type of trained neural network 508 capable of performing operations useful in reducing the dimensionality of data. Unsupervised training can also be used to perform anomaly detection, which allows the identification of data points in an input dataset that deviate from the normal patterns of the data.
Variations on supervised and unsupervised training may also be employed. Semi-supervised learning is a technique in which in the training dataset 502 includes a mix of labeled and unlabeled data of the same distribution. Incremental learning is a variant of supervised learning in which input data is continuously used to further train the model. Incremental learning enables the trained neural network 508 to adapt to the new data 512 without forgetting the knowledge instilled within the network during initial training.
Whether supervised or unsupervised, the training process for particularly deep neural networks may be too computationally intensive for a single compute node. Instead of using a single compute node, a distributed network of computational nodes can be used to accelerate the training process.
Machine learning can be applied to solve a variety of technological problems, including but not limited to computer vision, autonomous driving and navigation, speech recognition, and language processing. Computer vision has traditionally been an active research areas for machine learning applications. Applications of computer vision range from reproducing human visual abilities, such as recognizing faces, to creating new categories of visual abilities. For example, computer vision applications can be configured to recognize sound waves from the vibrations induced in objects visible in a video. Parallel processor accelerated machine learning enables computer vision applications to be trained using significantly larger training dataset than previously feasible and enables inferencing systems to be deployed using low power parallel processors.
Parallel processor accelerated machine learning has autonomous driving applications including lane and road sign recognition, obstacle avoidance, navigation, and driving control. Accelerated machine learning techniques can be used to train driving models based on datasets that define the appropriate responses to specific training input. The parallel processors described herein can enable rapid training of the increasingly complex neural networks used for autonomous driving solutions and enables the deployment of low power inferencing processors in a mobile platform suitable for integration into autonomous vehicles.
Parallel processor accelerated deep neural networks have enabled machine learning approaches to automatic speech recognition (ASR). ASR includes the creation of a function that computes the probable linguistic sequence given an input acoustic sequence. Accelerated machine learning using deep neural networks have enabled the replacement of the hidden Markov models (HMMs) and Gaussian mixture models (GMMs) previously used for ASR.
Parallel processor accelerated machine learning can also be used to accelerate natural language processing. Automatic learning procedures can make use of statistical inference algorithms to produce models that are robust to erroneous or unfamiliar input. Example natural language processor applications include automatic machine translation between human languages.
The parallel processing platforms used for machine learning can be divided into training platforms and deployment platforms. Training platforms are generally highly parallel and include optimizations to accelerate multi-GPU single node training and multi-node, multi-GPU training, while deployed machine learning (e.g., inferencing) platforms generally include lower power parallel processors suitable for use in products such as cameras, autonomous robots, and autonomous vehicles.
As discussed above, implementations of the disclosure provide for an activation function for homomorphically-encrypted neural networks. As previously discussed, implementations of the disclosure provide an activation function for homomorphically-encrypted neural networks. In particular, implementations herein propose a data-agnostic activation method that collects information about the distribution of the most-dominant activated locations in the feature maps of a trained model, such as a trained DNN model, and maintain a map of those locations. This map, along with a defined percent of random locations, decides which neurons in the DNN model are activated during deployment (e.g., inference) of the trained model.
More generally, the process 600 of
Process 600 generally includes gathering activation statistics 610, analyzing the collected statistics 620, and saving top activations 630. Process 600 begins at block 610 where activation statistics are collected for the trained model. Initially, a set of empty matrices {M} are initialized, where the set of empty matrices {M} corresponds with each output feature map for all layers of the neural network of a trained model 602. Each training sample of training dataset 604 is forward-propagated through the trained model 602 to obtain activation maps for all of the layers of the neural network. The activations, specifically of the training samples, are accumulated into the matrices {M}. In some implementations, the activations can be normalized by the accumulated number of the processed samples to avoid an overflow situation. The forward-propagation and accumulation of activations is then repeated for each of the training samples in the training dataset 604. In one implementation, the collected activation statistics indicate a percentage of times that a particular index location in the feature map is activated, with a higher percentage value correlated to more frequent activation of the index location in the heat map.
At block 620, the collected activation statistics are analyzed. In one implementation, activation parameters are selected based on the analysis of the activation statistics. For example, an alpha (α) parameter may be selected, which indicates a percent of the fired activations that are to be fixed in terms of location (e.g., index location in an output feature map). A beta (β) parameter may also be selected, which indicates a percent of the fired activations that are to be randomized (in terms of location) at inference time.
The activation parameters 635 (e.g., the α and β parameters) are utilized at block 630, where each activation map from the set {M} is scanned. The indices of the a percent chosen from the top-activated neurons (i.e., the most frequently activated feature maps' values) are saved. One or more data structures comprising the saved indices (also referred to herein as “activation indices”) from block 630 and the activation parameters 635 may be output at block 640 for use as part of activation function(s) for the trained model 602 during deployment of the trained model (e.g., inference). In one implementation, the data structure may be one or more data structures that provide the saved indices (activation indices) and the activation parameters, respectively. The data structure may be in the form of a matrix, an array, a table, an index, a linked list, a record, a tree, and so on.
In one implementation, a data structure for the activation indices may include a matrix having values (also referred to herein as “indications”) indicating that the particular index location is activated (e.g., a 1 value) or not activated (e.g. a 0 value). The activated indices in the matrix data structure are the locations chosen using the a parameter. In this example, the activation indices matrix data structure and the β parameter are passed as output at block 640. Other implementations may utilize other variations of data structures to output a combination of activation indices and activation parameters.
In one implementation, during inference, a neuron 720 may receive one or more input data 710 and weights 725. Input data 710 may be one or more binary inputs. Neuron 720 may apply a filter 722 to the input data 710 to generate filter output. Filter 722 may include a kernel that transforms the input data 710 into a feature map. For example, filter 722 can detect spatial patterns such as edges in an image by detecting the changes in intensity values of the image.
Neuron 720 then applies an activation function 724 to the filter output. Activation function 724 defines the output of the neuron 720 given the input 710 (or set of inputs 710). Activation function 724 can transform a summed weighted input from the neuron 720 into an output value 740 to be fed to a next layer of the neural network, or as an output.
As previously noted, implementations herein provide an activation function 724 for homomorphically-encrypted neural networks. In one implementation, the activation function 724 utilizes data 730 including activation indices 732 and activation parameter(s) 734 to provide a data-agnostic activation function 724. In one implementation, data 730 may provide the activation indices 732 and the activation parameter(s) 734 in the form of one or more data structures, such as a matrix, or other data organization structure such as an array, table, index, linked list, record, tree, and so on. In one implementation, activation indices 732 and activation parameters 734 are generated during a pre-deployment process for analyzing a trained model to obtain activation statistics for an activation function for homomorphically-encrypted neural network of the trained model, such as process 600 described with respect to
An activation function 724 applying the activation indices 732 and activation parameters 734 to the filter output is utilized to generate the output 740 of the neuron 720. In one implementation, the output 740 is a feature map that is passed to a next layer in the neural network and/or used as an output of the neural network.
In implementations herein, the actual activation operation at inference time applied at activation function 724 is composed of passing all neurons that are in the corresponding saved fixed locations feature map for the processed layer. A determined percent of the remaining non-fixed locations in the feature map may be randomly fired (e.g., activated) based on the activation parameter 734 defining the percent of the fired activations that are to be randomized (e.g., the β parameter described above).
As previously noted, the a parameter is the percent of activations that are fired (activated) based on a fixed location, and the β parameter is the percent of activations fired (activated) based on locations randomized at inference time. As such, the sum of alpha and beta is the total percent of the fired (activated) indices for the specific layer. For example, if the activation parameters 734 are identified during pre-deployment analysis to be α=50 and β=30, the pre-deployment analysis calculates 50% of the topmost activations locations (e.g., index locations) from the aggregated activation heat map and saves those locations. An additional 30% of the indices are to be randomized during runtime (e.g., during inference), covering 80% activation rate in total.
During inference time, the activation function works as follows. The values in the indices corresponding with the α parameter, which were saved in advance (e.g., during the pre-deployment of the trained model), are used (“activated”), and additional β indices are randomized and used as well. The values in the rest of the indices are not activated and in one embodiment, are propagated as zeros, or an encrypted form of zeros, that can be prepared offline before the inference.
In one implementation, the activation function 724 can work at the feature map level. For example, the activation function may apply a “masking” matrix in the same size as the feature map of the neuron 720. The “masking” matrix can consist of zeros and ones. Zero means that the value in the corresponding location in the feature map is not activated (e.g., not used) and translated to zero. One means that the value in the corresponding location in the feature map is used and activated (e.g., the original value remains). Some indices are one, which means that the corresponding locations are fixed in advance based on the α parameter. Additional indices can be changed from 0 to 1 at runtime, based on randomization happens independently for each run using the activation parameter (e.g., the β parameter described above).
For the examples of
With respect to
The process of method 900 is illustrated in linear sequences for brevity and clarity in presentation; however, it is contemplated that any number of them can be performed in parallel, asynchronously, or in different orders. Further, for brevity, clarity, and ease of understanding, many of the components and processes described with respect to
The example process of method 900 of
Subsequently, at block 940, the processor may, for each neuron of the neural network, identify activation parameters for an activation function of the neuron. In one implementation, the activation parameters include a first parameter indicating a first percent of fixed activations for the neuron and a second parameter indicating a second percent of randomized activations. Then, at block 950, the processor may, for each output feature map of the neuron, identify the first percent of fixed index locations in a matrix corresponding to the output feature map. In one implementation, the first percent of fixed locations can include a randomly-selected most-activated locations (e.g., locations having the highest number of activations) in the matrix.
Lastly, at block 960, the processor may, for each output feature map of the neuron, save the identified index locations and the first and second parameters with the trained model. In one implementation, the identified index locations and the first and second parameters are utilized during an inference phase of the trained model to implement an activation function for the neuron having the first percent of activations at the fixed index locations of the output feature map and the second percent of activations at randomized non-fixed index locations in the output feature map.
The process of method 1000 is illustrated in linear sequences for brevity and clarity in presentation; however, it is contemplated that any number of them can be performed in parallel, asynchronously, or in different orders. Further, for brevity, clarity, and ease of understanding, many of the components and processes described with respect to
The example process of method 1000 of
Subsequently, at block 1030, the processor may apply an activation function to the filter output. In one implementation, the activation function can include a feature map masking matrix of a same size as the filter output. In one implementation, the feature map masking matrix is generated based on saved fixed activated index locations and saved activation parameters identified from an accumulated activation heat map of the trained model. Lastly, at block 1040, the processor may output a feature map from the neuron based on application of the activation function to the filter output.
The computing device 1100 may additionally include one or more of the following: cache 1162, a graphical processing unit (GPU) 1112 (which may be the hardware accelerator in some implementations), a wireless input/output (I/O) interface 1120, a wired I/O interface 1130, memory circuitry 1140, power management circuitry 1150, non-transitory storage device 1160, and a network interface 1170 for connection to a network 1172. The following discussion provides a brief, general description of the components forming the illustrative computing device 1100. Example, non-limiting computing devices 1100 may include a desktop computing device, blade server device, workstation, or similar device or system.
In embodiments, the processor cores 1118 are capable of executing machine-readable instruction sets 1114, reading data and/or instruction sets 1114 from one or more storage devices 1160 and writing data to the one or more storage devices 1160. Those skilled in the relevant art can appreciate that the illustrated embodiments as well as other embodiments may be practiced with other processor-based device configurations, including portable electronic or handheld electronic devices, for instance smartphones, portable computers, wearable computers, consumer electronics, personal computers (“PCs”), network PCs, minicomputers, server blades, mainframe computers, and the like. For example, machine-readable instruction sets 1114 may include instructions to implement an authenticator-integrated GAN for secure deepfake generation, as provided in
The processor cores 1118 may include any number of hardwired or configurable circuits, some or all of which may include programmable and/or configurable combinations of electronic components, semiconductor devices, and/or logic elements that are disposed partially or wholly in a PC, server, or other computing system capable of executing processor-readable instructions.
The computing device 1100 includes a bus or similar communications link 1116 that communicably couples and facilitates the exchange of information and/or data between various system components including the processor cores 1118, the cache 1162, the graphics processor circuitry 1112, one or more wireless I/O interfaces 1120, one or more wired I/O interfaces 1130, one or more storage devices 1160, and/or one or more network interfaces 1170. The computing device 1100 may be referred to in the singular herein, but this is not intended to limit the embodiments to a single computing device 1100, since in some embodiments, there may be more than one computing device 1100 that incorporates, includes, or contains any number of communicably coupled, collocated, or remote networked circuits or devices.
The processor cores 1118 may include any number, type, or combination of currently available or future developed devices capable of executing machine-readable instruction sets.
The processor cores 1118 may include (or be coupled to) but are not limited to any current or future developed single- or multi-core processor or microprocessor, such as: on or more systems on a chip (SOCs); central processing units (CPUs); digital signal processors (DSPs); graphics processing units (GPUs); application-specific integrated circuits (ASICs), programmable logic units, field programmable gate arrays (FPGAs), and the like. Unless described otherwise, the construction and operation of the various blocks shown in
The system memory 1140 may include read-only memory (“ROM”) 1142 and random access memory (“RAM”) 1146. A portion of the ROM 1142 may be used to store or otherwise retain a basic input/output system (“BIOS”) 1144. The BIOS 1144 provides basic functionality to the computing device 1100, for example by causing the processor cores 1118 to load and/or execute one or more machine-readable instruction sets 1114. In embodiments, at least some of the one or more machine-readable instruction sets 1114 cause at least a portion of the processor cores 1118 to provide, create, produce, transition, and/or function as a dedicated, specific, and particular machine, for example a word processing machine, a digital image acquisition machine, a media playing machine, a gaming system, a communications device, a smartphone, or similar.
The computing device 1100 may include at least one wireless input/output (I/O) interface 1120. The at least one wireless I/O interface 1120 may be communicably coupled to one or more physical output devices 1122 (tactile devices, video displays, audio output devices, hardcopy output devices, etc.). The at least one wireless I/O interface 1120 may communicably couple to one or more physical input devices 1124 (pointing devices, touchscreens, keyboards, tactile devices, etc.). The at least one wireless I/O interface 1120 may include any currently available or future developed wireless I/O interface. Example wireless I/O interfaces include, but are not limited to: BLUETOOTH®, near field communication (NFC), and similar.
The computing device 1100 may include one or more wired input/output (I/O) interfaces 1130. The at least one wired I/O interface 1130 may be communicably coupled to one or more physical output devices 1122 (tactile devices, video displays, audio output devices, hardcopy output devices, etc.). The at least one wired I/O interface 1130 may be communicably coupled to one or more physical input devices 1124 (pointing devices, touchscreens, keyboards, tactile devices, etc.). The wired I/O interface 1130 may include any currently available or future developed I/O interface. Example wired I/O interfaces include, but are not limited to: universal serial bus (USB), IEEE 1394 (“FireWire”), and similar.
The computing device 1100 may include one or more communicably coupled, non-transitory, data storage devices 1160. The data storage devices 1160 may include one or more hard disk drives (HDDs) and/or one or more solid-state storage devices (SSDs). The one or more data storage devices 1160 may include any current or future developed storage appliances, network storage devices, and/or systems. Non-limiting examples of such data storage devices 1160 may include, but are not limited to, any current or future developed non-transitory storage appliances or devices, such as one or more magnetic storage devices, one or more optical storage devices, one or more electro-resistive storage devices, one or more molecular storage devices, one or more quantum storage devices, or various combinations thereof. In some implementations, the one or more data storage devices 1160 may include one or more removable storage devices, such as one or more flash drives, flash memories, flash storage units, or similar appliances or devices capable of communicable coupling to and decoupling from the computing device 1100.
The one or more data storage devices 1160 may include interfaces or controllers (not shown) communicatively coupling the respective storage device or system to the bus 1116. The one or more data storage devices 1160 may store, retain, or otherwise contain machine-readable instruction sets, data structures, program modules, data stores, databases, logical structures, and/or other data useful to the processor cores 1118 and/or graphics processor circuitry 1112 and/or one or more applications executed on or by the processor cores 1118 and/or graphics processor circuitry 1112. In some instances, one or more data storage devices 1160 may be communicably coupled to the processor cores 1118, for example via the bus 1116 or via one or more wired communications interfaces 1130 (e.g., Universal Serial Bus or USB); one or more wireless communications interfaces 1120 (e.g., Bluetooth®, Near Field Communication or NFC); and/or one or more network interfaces 1170 (IEEE 802.3 or Ethernet, IEEE 802.10, or Wi-Fi®, etc.).
Processor-readable instruction sets 1114 and other programs, applications, logic sets, and/or modules may be stored in whole or in part in the system memory 1140. Such instruction sets 1114 may be transferred, in whole or in part, from the one or more data storage devices 1160. The instruction sets 1114 may be loaded, stored, or otherwise retained in system memory 1140, in whole or in part, during execution by the processor cores 1118 and/or graphics processor circuitry 1112.
The computing device 1100 may include power management circuitry 1150 that controls one or more operational aspects of the energy storage device 1152. In embodiments, the energy storage device 1152 may include one or more primary (i.e., non-rechargeable) or secondary (i.e., rechargeable) batteries or similar energy storage devices. In embodiments, the energy storage device 1152 may include one or more supercapacitors or ultracapacitors. In embodiments, the power management circuitry 1150 may alter, adjust, or control the flow of energy from an external power source 1154 to the energy storage device 1152 and/or to the computing device 1100. The power source 1154 may include, but is not limited to, a solar power system, a commercial electric grid, a portable generator, an external energy storage device, or any combination thereof.
For convenience, the processor cores 1118, the graphics processor circuitry 1112, the wireless I/O interface 1120, the wired I/O interface 1130, the storage device 1160, and the network interface 1170 are illustrated as communicatively coupled to each other via the bus 1116, thereby providing connectivity between the above-described components. In alternative embodiments, the above-described components may be communicatively coupled in a different manner than illustrated in
Flowcharts representative of example hardware logic, machine readable instructions, hardware implemented state machines, and/or any combination thereof for implementing the system 100 of
The machine readable instructions described herein may be stored in one or more of a compressed format, an encrypted format, a fragmented format, a compiled format, an executable format, a packaged format, etc. Machine readable instructions as described herein may be stored as data (e.g., portions of instructions, code, representations of code, etc.) that may be utilized to create, manufacture, and/or produce machine executable instructions. For example, the machine readable instructions may be fragmented and stored on one or more storage devices and/or computing devices (e.g., servers). The machine readable instructions may require one or more of installation, modification, adaptation, updating, combining, supplementing, configuring, decryption, decompression, unpacking, distribution, reassignment, compilation, etc. in order to make them directly readable, interpretable, and/or executable by a computing device and/or other machine. For example, the machine readable instructions may be stored in multiple parts, which are individually compressed, encrypted, and stored on separate computing devices, wherein the parts when decrypted, decompressed, and combined form a set of executable instructions that implement a program such as that described herein.
In another example, the machine readable instructions may be stored in a state in which they may be read by a computer, but require addition of a library (e.g., a dynamic link library (DLL)), a software development kit (SDK), an application programming interface (API), etc. in order to execute the instructions on a particular computing device or other device. In another example, the machine readable instructions may be configured (e.g., settings stored, data input, network addresses recorded, etc.) before the machine readable instructions and/or the corresponding program(s) can be executed in whole or in part. Thus, the disclosed machine readable instructions and/or corresponding program(s) are intended to encompass such machine readable instructions and/or program(s) regardless of the particular format or state of the machine readable instructions and/or program(s) when stored or otherwise at rest or in transit.
The machine readable instructions described herein can be represented by any past, present, or future instruction language, scripting language, programming language, etc. For example, the machine readable instructions may be represented using any of the following languages: C, C++, Java, C #, Perl, Python, JavaScript, HyperText Markup Language (HTML), Structured Query Language (SQL), Swift, etc.
As mentioned above, the example processes of
“Including” and “comprising” (and all forms and tenses thereof) are used herein to be open ended terms. Thus, whenever a claim employs any form of “include” or “comprise” (e.g., comprises, includes, comprising, including, having, etc.) as a preamble or within a claim recitation of any kind, it is to be understood that additional elements, terms, etc. may be present without falling outside the scope of the corresponding claim or recitation. As used herein, when the phrase “at least” is used as the transition term in, for example, a preamble of a claim, it is open-ended in the same manner as the term “comprising” and “including” are open ended.
The term “and/or” when used, for example, in a form such as A, B, and/or C refers to any combination or subset of A, B, C such as (1) A alone, (2) B alone, (3) C alone, (4) A with B, (5) A with C, (6) B with C, and (7) A with B and with C. As used herein in the context of describing structures, components, items, objects and/or things, the phrase “at least one of A and B” is intended to refer to implementations including any of (1) at least one A, (2) at least one B, and (3) at least one A and at least one B. Similarly, as used herein in the context of describing structures, components, items, objects and/or things, the phrase “at least one of A or B” is intended to refer to implementations including any of (1) at least one A, (2) at least one B, and (3) at least one A and at least one B. As used herein in the context of describing the performance or execution of processes, instructions, actions, activities and/or steps, the phrase “at least one of A and B” is intended to refer to implementations including any of (1) at least one A, (2) at least one B, and (3) at least one A and at least one B. Similarly, as used herein in the context of describing the performance or execution of processes, instructions, actions, activities and/or steps, the phrase “at least one of A or B” is intended to refer to implementations including any of (1) at least one A, (2) at least one B, and (3) at least one A and at least one B.
As used herein, singular references (e.g., “a”, “an”, “first”, “second”, etc.) do not exclude a plurality. The term “a” or “an” entity, as used herein, refers to one or more of that entity. The terms “a” (or “an”), “one or more”, and “at least one” can be used interchangeably herein. Furthermore, although individually listed, a plurality of means, elements or method actions may be implemented by, e.g., a single unit or processor. Additionally, although individual features may be included in different examples or claims, these may possibly be combined, and the inclusion in different examples or claims does not imply that a combination of features is not feasible and/or advantageous.
Descriptors “first,” “second,” “third,” etc. are used herein when identifying multiple elements or components which may be referred to separately. Unless otherwise specified or understood based on their context of use, such descriptors are not intended to impute any meaning of priority, physical order or arrangement in a list, or ordering in time but are merely used as labels for referring to multiple elements or components separately for ease of understanding the disclosed examples. In some examples, the descriptor “first” may be used to refer to an element in the detailed description, while the same element may be referred to in a claim with a different descriptor such as “second” or “third.” In such instances, it should be understood that such descriptors are used merely for ease of referencing multiple elements or components.
The following examples pertain to further embodiments. Example 1 is an apparatus to facilitate implementations of activation function for homomorphically-encrypted neural networks. The apparatus of Example 1 comprises one or more processors to: collect activation statistics for a neural network of a trained model; analyze the activation statistics to identify one or more top activations in the activation statistics, the activation statistics corresponding to activations by activation functions of the neural network; save the one or more top activations as saved activations; and output the saved activations and activation parameters as input for an activation function of the trained model.
In Example 2, the subject matter of Example 1 can optionally include wherein the activation statistics comprise a percentage of activations of a neuron of the neural network by a previous activation function of the neuron, and wherein the activation statistics are collected for each output feature map of each layer of the neural network. In Example 3, the subject matter of any one of Examples 1-2 can optionally include wherein the activation statistics are collected in matrices corresponding to output feature maps of the neural network, where the matrices correspond to index locations in the output feature maps.
In Example 4, the subject matter of any one of Examples 1-3 can optionally include wherein analyzing the activation statistics comprises, for each matrix of the matrices, identifying a first percent of the activation statistics having a highest number of activations in the matrix. In Example 5, the subject matter of any one of Examples 1-4 can optionally include wherein the one or more processors are to save index locations corresponding to the first percent of the activation statistics as the one or more top activations. In Example 6, the subject matter of any one of Examples 1-5 can optionally include wherein the activation parameters comprise: the first percent of the activation statistics that are fixed activations by the activation functions during an inference phase that deploys the trained model; and a second percent of the activation statistics to randomly initialize by the activation functions during the inference phase that deploys the trained model.
In Example 7, the subject matter of any one of Examples 1-6 can optionally include wherein the first percent and the second percent are automatically tuned during a training phase that trains the trained model. In Example 8, the subject matter of any one of Examples 1-7 can optionally include wherein the saved activations are output using a matrix data structure. In Example 9, the subject matter of any one of Examples 1-8 can optionally include wherein the activation parameters differ for one or more of the output feature maps of the neural network.
Example 10 is a non-transitory computer-readable storage medium for facilitating an activation function for homomorphically-encrypted neural networks. The non-transitory computer-readable storage medium of Example 10 having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising: receiving input data at a neuron of a neural network of a trained model, the input data received during an inference phase deploying the trained model; applying a filter to the input data at the neuron, the filter to generate filter output; applying an activation function to the filter output, the activation function comprising a matrix to apply to an output feature map of the neuron, the matrix generated based on saved fixed activated index locations of the output feature map and based on saved activation parameters identifying a percent of randomly-activated index locations of the output feature map; and output the output feature map from the neuron based on application of the activation function to the filter output.
In Example 11, the subject matter of Example 10 can optionally include wherein the matrix is generated from activation statistics that are collected from applying training data to the trained model prior to deployment of the trained model, wherein the activation statistics comprise a percentage of activations a neuron of the neural network by a previous activation function of the neuron, and wherein the activation statistics are collected for each output feature map of each layer of the neural network. In Example 12, the subject matter of Examples 10-11 can optionally include wherein the activation statistics are collected in matrices corresponding to output feature maps of the neural network, where the matrices correspond to index locations in the output feature maps.
In Example 13, the subject matter of Examples 10-12 can optionally include wherein the saved fixed activated index locations comprise, for each matrix of the matrices, a first percent of the activation statistics having a highest number of activations in the matrix. In Example 14, the subject matter of Examples 10-13 can optionally include wherein the saved activation parameters are automatically tuned during a training phase that trains the trained model. In Example 15, the subject matter of Examples 10-14 can optionally include wherein the saved activation parameters differ for one or more of the output feature maps of the neural network.
Example 16 is a method for facilitating an activation function for homomorphically-encrypted neural networks. The method of Example 16 can include collecting, by one or more processors, activation statistics for a neural network of a trained model; analyzing the activation statistics to identify one or more top activations in the activation statistics, the activation statistics corresponding to activations by activation functions of the neural network; saving the one or more top activations as saved activations; and outputting the saved activations and activation parameters as input for an activation function of the trained model
In Example 17, the subject matter of Example 16 can optionally include wherein the activation statistics comprise a percentage of activations a neuron of the neural network by a previous activation function of the neuron, and wherein the activation statistics are collected for each output feature map of each layer of the neural network. In Example 18, the subject matter of Examples 16-17 can optionally include wherein the activation statistics are collected in matrices corresponding to output feature maps of the neural network, where the matrices correspond to index locations in the output feature maps, and wherein analyzing the activation statistics comprises, for each matrix of the matrices, identifying a first percent of the activation statistics having a highest number of activations in the matrix.
In Example 19, the subject matter of Examples 16-18 can optionally include wherein the one or more processors are to save index locations corresponding to the first percent of the activation statistics as the one or more top activations, and wherein the activation parameters comprise: the first percent of the activation statistics that are fixed activations by the activation functions during an inference phase that deploys the trained model; and a second percent of the activation statistics to randomly initialize by the activation functions during the inference phase that deploys the trained model. In Example 20, the subject matter of Examples 16-19 can optionally include wherein the activation parameters differ for one or more of the output feature maps of the neural network.
Example 21 is a system for facilitating an activation function for homomorphically-encrypted neural networks. The system of Example 21 can optionally include a memory to store a block of data, and a processor communicably coupled to the memory to: collect activation statistics for a neural network of a trained model; analyze the activation statistics to identify one or more top activations in the activation statistics, the activation statistics corresponding to activations by activation functions of the neural network; save the one or more top activations as saved activations; and output the saved activations and activation parameters as input for an activation function of the trained model.
In Example 22, the subject matter of Example 21 can optionally include wherein the activation statistics comprise a percentage of activations of a neuron of the neural network by a previous activation function of the neuron, and wherein the activation statistics are collected for each output feature map of each layer of the neural network. In Example 23, the subject matter of any one of Examples 21-22 can optionally include wherein the activation statistics are collected in matrices corresponding to output feature maps of the neural network, where the matrices correspond to index locations in the output feature maps.
In Example 24, the subject matter of any one of Examples 21-23 can optionally include wherein analyzing the activation statistics comprises, for each matrix of the matrices, identifying a first percent of the activation statistics having a highest number of activations in the matrix. In Example 25, the subject matter of any one of Examples 21-24 can optionally include wherein the one or more processors are to save index locations corresponding to the first percent of the activation statistics as the one or more top activations. In Example 26, the subject matter of any one of Examples 21-25 can optionally include wherein the activation parameters comprise: the first percent of the activation statistics that are fixed activations by the activation functions during an inference phase that deploys the trained model; and a second percent of the activation statistics to randomly initialize by the activation functions during the inference phase that deploys the trained model.
In Example 27, the subject matter of any one of Examples 21-26 can optionally include wherein the first percent and the second percent are automatically tuned during a training phase that trains the trained model. In Example 28, the subject matter of any one of Examples 21-27 can optionally include wherein the saved activations are output using a matrix data structure. In Example 29, the subject matter of any one of Examples 21-28 can optionally include wherein the activation parameters differ for one or more of the output feature maps of the neural network.
Example 30 is an apparatus for facilitating an activation function for homomorphically-encrypted neural networks, comprising means for collecting, using one or more processors, activation statistics for a neural network of a trained model; means for analyzing the activation statistics to identify one or more top activations in the activation statistics, the activation statistics corresponding to activations by activation functions of the neural network; means for saving the one or more top activations as saved activations; and means for outputting the saved activations and activation parameters as input for an activation function of the trained model. In Example 31, the subject matter of Example 30 can optionally include the apparatus further configured to perform the method of any one of the Examples 17 to 20.
Example 32 is at least one machine readable medium comprising a plurality of instructions that in response to being executed on a computing device, cause the computing device to carry out a method according to any one of Examples 16-20. Example 33 is an apparatus for facilitating an activation function for homomorphically-encrypted neural networks, configured to perform the method of any one of Examples 16-20. Example 34 is an apparatus for facilitating an activation function for homomorphically-encrypted neural networks, comprising means for performing the method of any one of Examples 16-20. Specifics in the Examples may be used anywhere in one or more embodiments.
The foregoing description and drawings are to be regarded in an illustrative rather than a restrictive sense. Persons skilled in the art can understand that various modifications and changes may be made to the embodiments described herein without departing from the broader spirit and scope of the features set forth in the appended claims.
