Secret sigmoid function calculation system, secret logistic regression calculation system, secret sigmoid function calculation apparatus, secret logistic regression calculation apparatus, secret sigmoid function calculation method, secret logistic regression calculation method and program

1 . A secure logistic regression calculation system in which

η is a real number that satisfies 0<η<1, and Sigmoid ([[x]]) is a function that calculates, from a share [[x → ]] of an input vector x → , a share [[y → ]] of a value y → of a sigmoid function for the input vector x → using a secure sigmoid function calculation system in which

map σ is a secure batch mapping predefined by parameters (a 0 , . . . , a k-1 ) representing a domain of definition of a sigmoid function σ(x) and parameters (σ(a 0 ), . . . , σ(a k-1 )) representing a range of the sigmoid function σ(x) (where k is an integer greater than or equal to 1 and a 0 , . . . , a k-1 are real numbers that satisfy a 0 < . . . <a k-1 ), and

the secure sigmoid function calculation system is a secure sigmoid function calculation system with three or more secure sigmoid function calculation apparatuses performing cooperative computations that are connected to each other by a data network and calculates, from a share [[x → ]]=([[x 0 ]], . . . , [[x m-1 ]]) of an input vector x → =(x 0 , . . . , x m-1 ), a share [[y → ]]=([[y 0 ]], . . . , [[y m-1 ]]) of a value y → =(y 0 , . . . , y m-1 ) of a sigmoid function for the input vector x → ,

the secure sigmoid function calculation system comprising:

the three or more secure sigmoid function calculation apparatuses each including circuitry and a memory,

[[a]] secure batch mapping calculation circuitry that calculates map σ ([[x → ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) ]]) (where f(i) (0≤i≤m−1) is j that makes a j ≤x i <a j+1 hold true) from the share [[x → ]] and calculates the share [[y → ]] by ([[y 0 ]], . . . , [[y m-1 ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) )]]) by referring to the map σ which is predefined, wherein m is an integer greater than or equal to 1,

when an arbitrary value, which is an object on which secure computation is to be performed, is p and b_p [bit] is a predetermined positive integer, it means that a share of p is actually a share [[p×2 b_p ]] of a fixed-point number,

when an arbitrary vector, which is an object on which secure computation is to be performed, is q → , an element of q → is q i , and b_q [bit] is a predetermined positive integer, it means that a share [[q → ]] of q → is actually made up of a share [[q i × b_q ]] of a fixed-point number,

b_w, b_x, b_y, b_η, b_m, H, and b_tmp are predetermined positive integers,

rshift(a, b) means shifting a value a to the right by b [bit] by performing an arithmetic right shift, and

the secure logistic regression calculation system is a secure logistic regression calculation system with three or more secure logistic regression calculation apparatuses and calculates a share [[w → ]] of a model parameter w → of a logistic regression model from a share [[x i → ]] (0≤i≤m−1) of data x i → on an explanatory variable and a share [[y i ]] (0≤i≤m−1) of data y i on a response variable,

the secure logistic regression calculation system comprising:

initializing circuitry that sets a share [[w 0 → ]] of an initial value w 0 → of the model parameter w → ;

[[an]] error calculation circuitry that calculates, for i=0, . . . , m−1, [[b i ]] by [[b i ]]=hpsum ([[w t → ]], [[(1, x i → )]]) from a share [[w t → ]] of a value w t → of the model parameter w → obtained as a result of t updates and the share [[x i → ]], calculates ([[c 0 ]], . . . , [[c m-1 ]]) by ([[c 0 ]], . . . , [[c m-1 ]])=Sigmoid (([[b 0 ]], . . . , [[b m-1 ]])) from the [[b i ]] (0≤i≤m−1), and calculates, for i=0, . . . , m−1, an error [[d i ]] by [[d i ]]=[[c i ]]-[[y i ]] from the share [[y i ]] and an i-th element [[c i ]] of the ([[c 0 ]], . . . , [[c m-1 ]]); and

[[a]] model parameter update circuitry that calculates, for j=0, . . . , n, [[e]] by [[e]]=Σ i=0 m-1 [[d i ]][[x i, j ]] from the error [[d i ]] (0≤i≤m−1) and a j-th element [[x i,j ]] (0≤i≤m−1) of the share [[x i → ]], calculates [[eta_grad]] by [[eta_grad]]=η[[e]] from the η and the [[e]], calculates [[eta_grad_shift]] by [[eta_grad_shift]]=rshift ([[eta_grad]], b_y+b_x+b_η−b_tmp) from the [[eta_grad]], calculates [[eta_grad_ave]] by [[eta_grad_ave]]=(1/m)[[eta_grad_shift]] from the [[eta_grad_shift]], calculates [[eta_grad_ave_shift]] by [[eta_grad_ave_shift]]=rshift ([[eta_grad_ave]], b_tmp+b_m+H−b_w) from the [[eta_grad_ave]], and calculates, from a j-th element [[w j,t ]] of the share [[w t → ]] and the [[eta_grad_ave_shift]] by [[w j,t+1 ]]=[[w j, t ]]−[[eta_grad_ave_shift]], a j-th element [[w j,t+1 ]] of a share [[w t+1 → ]] of a value w t+1 → of the model parameter w → obtained as a result of t+1 updates, wherein the calculations of the secure logistic regression calculation system are performed securely without leaking any information outside.

2 . A secure logistic regression calculation system in which η is a real number that satisfies 0<η<1, and Sigmoid ([[x]]) is a function that calculates, from a share [[x → ]] of an input vector x → , a share [[y → ]] of a value y → of a sigmoid function for the input vector x → using a secure sigmoid function calculation system in which

map σ is a secure batch mapping predefined by parameters (a 0 , . . . , a k-1 ) representing a domain of definition of a sigmoid function σ(x) and parameters (σ(a 0 ), . . . , σ(a k-1 )) representing a range of the sigmoid function σ(x) (where k is an integer greater than or equal to 1 and a 0 , . . . , a k-1 are real numbers that satisfy a 0 < . . . <a k-1 ), and

the secure sigmoid function calculation system is a secure sigmoid function calculation system that is configured with three or more secure sigmoid function calculation apparatuses performing cooperative computations that are connected to each other by a data network and calculates, from a share [[x → ]]=([[x 0 ]], . . . , [[x m-1 ]]) of an input vector x → =(x 0 , . . . , x m-1 ), a share [[y → ]]=([[y 0 ]], . . . , [[y m-1 ]]) of a value y → =(y 0 , . . . , y m-1 ) of a sigmoid function for the input vector x → ,

the secure sigmoid function calculation system comprising:

the three or more secure sigmoid function calculation apparatuses each including circuitry and a memory,

[[a]] secure batch mapping calculation circuitry that calculates map σ ([[x → ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) )]]) (where f(i) (0≤i≤m−1) is j that makes a j ≤x i <a j+1 hold true) from the share [[x → ]] and calculates the share [[y → ]] by ([[y 0 ]], . . . , [[y m-1 ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) )]]) by referring to the maps which is predefined, wherein m is an integer greater than or equal to 1,

when an arbitrary value, which is an object on which secure computation is to be performed, is p and b_p [bit] is a predetermined positive integer, it means that a share [[p]] of p is actually a share [[p×2 b_p ]] of a fixed-point number,

when an arbitrary vector, which is an object on which secure computation is to be performed, is q → , an element of q → is q i , and b_q [bit] is a predetermined positive integer, it means that a share [[q → ]] of q → is actually made up of a share [[q i ×2 b_q ]] of a fixed-point number,

b_w, b_x, b_y, and b_η are predetermined positive integers,

rshift(a, b) means shifting a value a to the right by b [bit] by performing an arithmetic right shift,

floor is a function representing rounding down and X=−(floor (log 2 (η/m))), and

the secure logistic regression calculation system is a secure logistic regression calculation system with three or more secure logistic regression calculation apparatuses and calculates a share [[w → ]] of a model parameter w → of a logistic regression model from a share [[x i → ]] (0≤i≤m−1) of data x i → on an explanatory variable and a share [[y i ]] (0≤i≤m−1) of data y i on a response variable,

the secure logistic regression calculation system comprising:

initializing circuitry that sets a share [[w 0 → ]] of an initial value w 0 → of the model parameter w → ;

[[an]] error calculation circuitry that calculates, for i=0, . . . , m−1, [[b i ]] by [[b i ]]=hpsum ([[w t → ]], [[(1, x i → )]]) from a share [[w t → ]] of a value w i → of the model parameter w → obtained as a result of t updates and the share [[x i → , calculates ([[c 0 ]], . . . , [[c m-1 ]]) by ([[c 0 ]], . . . , [[c m-1 ]])=Sigmoid (([[b 0 ]], . . . , [[b m-1 ]])) from the [[b i ]] (0≤i≤m−1), and calculates, for i=0, . . . , m−1, an error [[d i ]] by [[d i ]]=[[c i ]]-[[y i ]] from the share [[y i ]] and an i-th element [[c i ]] of the ([[c 0 ]], . . . , [[c m-1 ]]); and

[[a]] model parameter update circuitry that calculates, for j=0, . . . , n, [[e]] by [[e]]=Σ i=0 m-1 [[d i ]][[x i,j ]] from the error [[d i ]] (0≤i≤m−1) and a j-th element [[x i,j ]] (0≤i≤m−1) of the share [[x i → ]], calculates [[eta_grad_ave]] by [[eta_grad_ave]]=rshift ([[e]], X+b_y+b_x−b_w) from the [[e]], and calculates, from a j-th element [[w j,t ]] of the share [[w t → ]] and the [[eta_grad_ave]] by [[w j,t+1 ]]=[[w j, t ]]−[[eta_grad_ave]], a j-th element [[w j,t+1 ]] of a share [[w t+1 → ]] of a value w t+1 → of the model parameter w → obtained as a result of t+1 updates, wherein the calculations of the secure logistic regression calculation system are performed securely without leaking any information outside.

3 . A secure logistic regression calculation apparatus in which

η is a real number that satisfies 0<η<1, and Sigmoid ([[x]]) is a function that calculates, from a share [[x → ]] of an input vector x → , a share [[y → ]] of a value y → of a sigmoid function for the input vector x → using a secure sigmoid function calculation apparatus in which

map σ is secure batch mapping predefined by parameters (a 0 , . . . , a k-1 ) representing a domain of definition of a sigmoid function σ(x) and parameters (σ(a 0 ), . . . , σ(a k-1 )) representing a range of the sigmoid function σ(x) (where k is an integer greater than or equal to 1 and a 0 , . . . , a k-1 are real numbers that satisfy a 0 < . . . <a k-1 ), and

the secure sigmoid function calculation apparatus is a secure sigmoid function calculation apparatus in a secure sigmoid function calculation system that is configured with three or more secure sigmoid function calculation apparatuses performing cooperative computations that are connected to each other by a data network and calculates, from a share [[x → ]]=([[x 0 ]], . . . , [[x m-1 ]]) of an input vector x → =(x 0 , . . . , x m-1 ), a share [[y → ]]=([[y 0 ]], . . . , [[y m-1 ]]) of a value y → =(y 0 , . . . , y m-1 ) of a sigmoid function for the input vector x → ,

the secure sigmoid function calculation apparatus comprising

a memory, and

processing circuitry configured to

calculate map σ ([[x → ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) ]]) (where f(i) (0≤i≤m−1) is j that makes a j ≤x i <a j+1 hold true) from the share [[x → ]] and calculating the share [[y → ]] by ([[y 0 ]], . . . , [[y m-1 ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) ]]) by referring to the maps which is predefined, wherein m is an integer greater than or equal to 1,

when an arbitrary value, which is an object on which secure computation is to be performed, is p and b_p [bit] is a predetermined positive integer, it means that a share of p is actually a share [[p×2 b_p ]] of a fixed-point number,

when an arbitrary vector, which is an object on which secure computation is to be performed, is q → , an element of q → is q i , and b_q [bit] is a predetermined positive integer, it means that a share [[q → ]] of q → is actually made up of a share [[q i ×2 b_q ]] of a fixed-point number,

b_w, b_x, b_y, b_η, b_m, H, and b_tmp are predetermined positive integers,

rshift(a, b) means shifting a value a to the right by b [bit] by performing an arithmetic right shift, and

the secure logistic regression calculation apparatus is a secure logistic regression calculation apparatus in a secure logistic regression calculation system with three or more secure logistic regression calculation apparatuses and calculates a share [[w → ]] of a model parameter w → of a logistic regression model from a share [[x i → ]] (0≤i≤m−1) of data x i → on an explanatory variable and a share [[y i ]] (0≤i≤m−1) of data y i on a response variable,

the secure logistic regression calculation apparatus comprising

processing circuitry configured to

set a share [[w 0 → ]] of an initial value w 0 → of the model parameter w → ;

calculate, for i=0, . . . , m−1, [[b i ]] by [[b i ]]=hpsum ([[w t → ]], [[(1, x i → )]]) from a share [[w t → ]] of a value w t → of the model parameter w → obtained as a result of t updates and the share [[x i → ]], calculates ([[c 0 ]], . . . , [[c m-1 ]]) by ([[c 0 ]], . . . , [[c m-1 ]])=Sigmoid (([[b 0 ]], . . . , [[b m-1 ])) from the [[b i ]] (0≤i≤m−1), and calculates, for i=0, . . . , m−1, an error [[d i ]] by [[d i ]]=[[c i ]]-[[y i ]] from the share [[y i ]] and an i-th element [[c i ]] of the ([[c 0 ]], . . . , [[c m-1 ]]); and

calculate, for j=0, . . . , n, [[e]] by [[e]]=Σ i=0 m-1 [[d i ]][[x i,j ]] from the error [[d i ]] (0≤i≤m−1) and a j-th element [[x i,j ]] (0≤i≤m−1) of the share [[x i → ]], calculates [[eta_grad]] by [[eta_grad]] =η[[e]] from the η and the [[e]], calculates [[eta_grad_shift]] by [[eta_grad_shift]]=rshift([[eta_grad]], b_y+b_x+b_η−b_tmp) from the [[eta_grad]], calculates [[eta_grad_ave]] by [[eta_grad_ave]]=(1/m)[[eta_grad_shift]] from the [[eta_grad_shift]], calculates [[eta_grad_ave_shift]] by [[eta_grad_ave_shift]]=rshift([[eta_grad_ave]], b_tmp+b_m+H−b_w) from the [[eta_grad_ave]], and calculates, from a j-th element [[w j,t ]] of the share [[w t → ]] and the [[eta_grad_ave_shift]] by [[w j,t+1 ]]=[[w j,t ]]−[[eta_grad_ave_shift]], a j-th element [[w j,t+1 ]] of a share [[w t+1 → ]] of a value w t+1 → of the model parameter w → obtained as a result of t+1 updates, wherein the calculations of the secure logistic regression calculation apparatus are performed securely without leaking any information outside.

4 . A secure logistic regression calculation apparatus in which

η is a real number that satisfies 0<Θ<1, and Sigmoid([[x]]) is a function that calculates, from a share [[x → ]] of an input vector x → , a share [[y → ]] of a value y → of a sigmoid function for the input vector x → using a secure sigmoid function calculation apparatus in which

map σ is secure batch mapping predefined by parameters (a 0 , . . . , a k-1 ) representing a domain of definition of a sigmoid function σ(x) and parameters (σ(a 0 ), . . . , σ(a k-1 )) representing a range of the sigmoid function σ(x) (where k is an integer greater than or equal to 1 and a 0 , . . . , a k-1 are real numbers that satisfy a 0 < . . . <a k-1 ), and

the secure sigmoid function calculation apparatus is a secure sigmoid function calculation apparatus in a secure sigmoid function calculation system with three or more secure sigmoid function calculation apparatuses performing cooperative computations that are connected to each other by a data network and calculates, from a share [[x → ]]=([[x 0 ]], . . . , [[x m-1 ]]) of an input vector x → =(x 0 , . . . , x m-1 ), a share [[y → ]]=([[y 0 ]], . . . , [[y m-1 ]]) of a value y → =(y 0 , . . . , y m-1 ) of a sigmoid function for the input vector x → ,

the secure sigmoid function calculation apparatus comprising

a memory, and

processing circuitry configured to

calculate map σ ([[x → ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) ]]) (where f(i) (0≤i≤m−1) is j that makes a j ≤x i <a j+1 hold true) from the share [[x → ]] and calculating the share [[y → ]] by ([[y 0 ]], . . . , [[y m-1 ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) ]]) by referring to the maps which is predefined, wherein m is an integer greater than or equal to 1,

when an arbitrary value, which is an object on which secure computation is to be performed, is p and b_p [bit] is a predetermined positive integer, it means that a share [[p]] of p is actually a share [[p×2 b_p ]] of a fixed-point number,

when an arbitrary vector, which is an object on which secure computation is to be performed, is q → , an element of q → is q i , and b_q [bit] is a predetermined positive integer, it means that a share [[q → ]] of q → is actually made up of a share [[q i ×2 b_q ]] of a fixed-point number,

b_w, b_x, b_y, and b_η are predetermined positive integers,

rshift(a, b) means shifting a value a to the right by b [bit] by performing an arithmetic right shift,

floor is a function representing rounding down and X=−(floor (log 2 (η/m))), and

the secure logistic regression calculation apparatus is a secure logistic regression calculation apparatus in a secure logistic regression calculation system with three or more secure logistic regression calculation apparatuses and calculates a share [[w → ]] of a model parameter w → of a logistic regression model from a share [[x i → ]] (0≤i≤m−1) of data x i → on an explanatory variable and a share [[y i ]] (0≤i≤m−1) of data y: on a response variable,

the secure logistic regression calculation apparatus comprising

processing circuitry configured to

set a share [[w 0 → ]] of an initial value w 0 → of the model parameter w → ;

calculate, for i=0, . . . , m−1, [[b i ]] by [[b i ]]=hpsum([[w t → ]], [[(1, x i → )]]) from a share [[w t → ]] of a value w t → of the model parameter w → obtained as a result of t updates and the share [[x i → ]], calculates ([[c 0 ]], . . . , [[c m-1 ]]) by ([[c 0 ]], . . . , [[c m-1 ]])=Sigmoid (([[b 0 ]], . . . , [[b m-1 ]])) from the [[b i ]] (0≤i≤m−1), and calculates, for i=0, . . . , m−1, an error [[d i ]] by [[d i ]]=[[c i ]]-[[y i ]] from the share [[y i ]] and an i-th element [[c i ]] of the ([[c 0 ]], . . . , [[c m-1 ]]); and

calculate, for j=0, . . . , n, [[e]] by [[e]]=Σ i=0 m-1 [[d i ]][[x i,j ]] from the error [[d i ]] (0≤i≤m−1) and a j-th element [[x i,j ]] (0≤i≤m−1) of the share [[x i → ]], calculates [[eta_grad_ave]] by [[eta_grad_ave]]=rshift([[e]], X+b_y+b_x−b_w) from the [[e]], and calculates, from a j-th element [[w j,t ]] of the share [[w t → ]] and the [[eta_grad_ave]] by [[w j, t+1 ]]=[[w j,t ]]-[[eta_grad_ave]], a j-th element [[w j, t+1 ]] of a share [[w t+1 → ]] of a value w t+1 → of the model parameter w → obtained as a result of t+1 updates, wherein the calculations of the secure logistic regression calculation apparatus are performed securely without leaking any information outside.

5 . A secure logistic regression calculation method in which η is a real number that satisfies 0<η<1, and Sigmoid ( ) is a function that calculates, from a share [[x → ]] of an input vector x → , a share [[y → ]] of a value y → of a sigmoid function for the input vector x → using a secure sigmoid function calculation method in which

map σ is secure batch mapping predefined by parameters (a 0 , . . . , a k-1 ) representing a domain of definition of a sigmoid function σ(x) and parameters (σ(a 0 ), . . . , σ(a k-1 )) representing a range of the sigmoid function σ(x) (where k is an integer greater than or equal to 1 and a 0 , . . . , a k-1 are real numbers that satisfy a 0 < . . . <a k-1 ), and

the secure sigmoid function calculation method is a secure sigmoid function calculation method by which a secure sigmoid function calculation system with three or more secure sigmoid function calculation apparatuses performing cooperative computations that are connected to each other by a data network calculates, from a share [[x → ]]=([[x 0 ]], . . . , [[x m-1 ]]) of an input vector x → =(x 0 , . . . , x m-1 ), a share [[y → ]]=([[y 0 ]], . . . , [[y m-1 ]]) of a value y → =(y 0 , . . . , y m-1 ) of a sigmoid function for the input vector x → ,

the secure sigmoid function calculation method comprising:

a secure batch mapping calculating step in which the secure sigmoid function calculation system calculates map σ ([[x → ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) ]]) (where f(i) (0≤i≤m−1) is j that makes a j ≤x i <a j+1 hold true) from the share [[x → ]] and calculates the share [[y]] by ([[y 0 ]], . . . [[y m-1 ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) )]]) by referring to the maps which is predefined, wherein m is an integer greater than or equal to 1,

when an arbitrary value, which is an object on which secure computation is to be performed, is p and b_p [bit] is a predetermined positive integer, it means that a share [[p]] of p is actually a share [[p×2 b_p ]] of a fixed-point number,

when an arbitrary vector, which is an object on which secure computation is to be performed, is q → , an element of q → is q i , and b_q [bit] is a predetermined positive integer, it means that a share [[q → ]] of q → is actually made up of a share [[q i ×2 b_q ]] of a fixed-point number,

b_w, b_x, b_y, b_η, b_m, H, and b_tmp are predetermined positive integers,

rshift(a, b) means shifting a value a to the right by b [bit] by performing an arithmetic right shift, and

the secure logistic regression calculation method is a secure logistic regression calculation method by which a secure logistic regression calculation system with three or more secure logistic regression calculation apparatuses calculates a share [[w → ]] of a model parameter w → of a logistic regression model from a share [[x i → ]] (0≤i≤m−1) of data x i → on an explanatory variable and a share [[y i ]] (0≤i≤m−1) of data y i on a response variable,

the secure logistic regression calculation method comprising:

an initializing step in which the secure logistic regression calculation system sets a share [[w 0 → ]] of an initial value w 0 → of the model parameter w → ;

an error calculating step in which, for i=0, . . . , m−1, the secure logistic regression calculation system calculates [[b i ]] by [[b i ]]=hpsum([[w t → ]], [[(1, x i → )]]) from a share [[w t → ]] of a value w t → of the model parameter w → obtained as a result of t updates and the share [[x i → ]], calculates ([[c 0 ]], . . . , [[c m-1 ]]) by ([[c 0 ]], . . . , [[c m-1 ]])=Sigmoid (([[b 0 ]], . . . , [[b m-1 ]])) from the [[b i ]] (0≤i≤m−1), and, for i=0, . . . , m−1, calculates an error [[d i ]] by [[c i ]]=[[c i ]]-[[y i ]] from the share [[y i ]] and an i-th element [[c i ]] of the ([[c 0 ]], . . . , [[c m-1 ]]); and

a model parameter updating step in which, for j=0, . . . , n, the secure logistic regression calculation system calculates [[e]] by [[e]]=Σ i=0 m-1 [[d i ]][[x i,j ]] from the error [[d i ]] (0≤i≤m−1) and a j-th element [[x i,j ]] (0≤i≤m−1) of the share [[x i → ]], calculates [[eta_grad]] by [[eta_grad]]=η[[e]] from the η and the [[e]], calculates [[eta_grad_shift]] by [[eta_grad_shift]]=rshift([[eta_grad]], b_y+b_x+b_η−b_tmp) from the [[eta_grad]], calculates [[eta_grad_ave]] by [[eta_grad_ave]]=(1/m)[[eta_grad_shift]] from the [[eta_grad_shift]], calculates [[eta_grad_ave_shift]] by [[eta_grad_ave_shift]]=rshift([[eta_grad_ave]], b_tmp+b_m+H−b_w) from the [[eta_grad_ave]], and calculates, from a j-th element [[w j,t ]] of the share [[w t → ]] and the [[eta_grad_ave_shift]] by [[w j,t+1 ]]=[[w j,t ]]-[[eta_grad_ave_shift]], a j-th element [[w j, t+1 ]] of a share [[w t+1 → ]] of a value w t+1 → of the model parameter w → obtained as a result of t+1 updates, wherein the calculations of the secure logistic regression calculation method are performed securely without leaking any information outside.

6 . A secure logistic regression calculation method in which η is a real number that satisfies 0<η<1, and Sigmoid ([[x]]) is a function that calculates, from a share [[x → ]] of an input vector x → , a share [[y → ]] of a value y → of a sigmoid function for the input vector x → using a secure sigmoid function calculation method in which

map σ is secure batch mapping predefined by parameters (a 0 , . . . , a k-1 ) representing a domain of definition of a sigmoid function σ(x) and parameters (σ(a 0 ), . . . , σ(a k-1 )) representing a range of the sigmoid function σ(x) (where k is an integer greater than or equal to 1 and a 0 , . . . , a k-1 are real numbers that satisfy a 0 < . . . <a k-1 ), and

the secure sigmoid function calculation method is a secure sigmoid function calculation method by which a secure sigmoid function calculation system with three or more secure sigmoid function calculation apparatuses performing cooperative computations that are connected to each other by a data network calculates, from a share [[x → ]]=([[x 0 ]], . . . , [[x m-1 ]]) of an input vector x → =(x 0 , . . . , x m-1 ), a share [[y → ]]=([[y 0 ]], . . . , [[y m-1 ]]) of a value y → =(y 0 , . . . , y m-1 ) of a sigmoid function for the input vector x → ;

the secure sigmoid function calculation method comprising:

a secure batch mapping calculating step in which the secure sigmoid function calculation system calculates map σ ([[x → ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) )]]) (where f(i) (0≤i≤m−1) is j that makes a j ≤x i <a j+1 hold true) from the share [[x → ]] and calculates the share [[y → ]] by ([[y 0 ]], . . . , [[y m-1 ]])=([[σ(a f(0) )]], . . . , [[σ(a f(m-1) )]]) by referring to the mapo which is predefined, wherein m is an integer greater than or equal to 1,

when an arbitrary value, which is an object on which secure computation is to be performed, is p and b_p [bit] is a predetermined positive integer, it means that a share [[p]] of p is actually a share [[p×2 b_p ]] of a fixed-point number,

when an arbitrary vector, which is an object on which secure computation is to be performed, is q → , an element of q → is q i , and b_q [bit] is a predetermined positive integer, it means that a share [[q → ]] of q → is actually made up of a share [[q i ×2 b_q ]] of a fixed-point number,

b_w, b_x, b_y, and b_η are predetermined positive integers,

rshift(a, b) means shifting a value a to the right by b [bit] by performing an arithmetic right shift,

floor is a function representing rounding down and X=−(floor (log 2 (η/m))), and

the secure logistic regression calculation method is a secure logistic regression calculation method by which a secure logistic regression calculation system with three or more secure logistic regression calculation apparatuses calculates a share [[w → ]] of a model parameter w → of a logistic regression model from a share [[x i → ]] (0≤i≤m−1) of data x i → on an explanatory variable and a share [[y i ]] (0≤i≤m−1) of data y i on a response variable,

the secure logistic regression calculation method comprising:

an initializing step in which the secure logistic regression calculation system sets a share [[w 0 → ]] of an initial value w 0 → of the model parameter w → ;

an error calculating step in which, for i=0, . . . , m−1, the secure logistic regression calculation system calculates [[b i ]] by [[b i ]]=hpsum([[w t → ]], [[(1, x i → )]]) from a share [[w t → ]] of a value w t → of the model parameter w → obtained as a result of t updates and the share [[x i → ]], calculates ([[c 0 ]], . . . , [[c m-1 ]]) by ([[c 0 ]], . . . , [[c m-1 ]])=Sigmoid (([[b 0 ]] . . . , [[b m-1 ]])) from the [[b i ]] (0≤i≤m−1), and, for i=0, . . . , m−1, calculates an error [[d i ]] by [[d i ]]=[[c i ]]-[[y i ]] from the share [[y i ]] and an i-th element [[c i ]] of the ([[c 0 ]], . . . , [[ m-1 ]]); and

a model parameter updating step in which, for j=0, . . . , n, the secure logistic regression calculation system calculates [[e]] by [[e]]=Σ i=0 m-1 [[d i ]][[x i,j ]] from the error [[d i ]] (0≤i≤m−1) and a j-th element [[x i,j ]] (0≤i≤m−1) of the share [[x i → ]], calculates [[eta_grad_ave]] by [[eta_grad_ave]]=rshift([[e]], X+b_y+b_x−b_w) from the [[e]], and calculates, from a j-th element, [[w j,t ]] of the share [[w t → ]] and the [[eta_grad_ave]] by [[w j,t+1 ]]=[[w j,t ]]−[[eta_grad_ave]], a j-th element [[w j,t+1 ]] of a share [[w t+1 → ]] of a value w t+1 → of the model parameter w → obtained as a result of t+1 updates, wherein the calculations of the secure logistic regression calculation method are performed securely without leaking any information outside.