Introduction to Homomorphic Encryption with Pascal Paillier

[00:00:00]okay hi everybody uh Welcome to our first Meetup um so what we're going to do is that for about an hour I'm going to to talk about FH and what fully morphic encryption is you don't have to know anything in cryptography it's really meant to be very very high level and we're trying basically to abstract away all the Gory details you know the the the Aira math uh that is behind thei so that you can get actually an intuition of how it works and it's also a very good introduction to concrete we'll show you how it works and um I will try to share my screen now can you guys see my screen yes we can yeah perfect um so I'm G to I'm going to start with a a very um high level perspective on what FH is as um so we're not going to assume that you're a cryptographer um we just we're just assuming that you have probably a very diverse background uh but what you have in common is like a few Notions in cryptography like you know what public encryption is like regular public encryption and you're probably also a developer or tavvy or you're interested in in these kind of Technologies um so first of all what FHA is is basically this Oly Grail of cryptography I'm going to talk about the timeline and the the different um you know um Avenues of research that conducting that conducted to the discovery of fully morphic encryption uh but in the meantime f is this what you have in front of you so basically you have these uh basic Primitives you can encrypt a data X resulting in a cipher text um to do that you're using typically in this metric setting you're using a a secret key to do that so the secret key serves both for encryption and for decryption so it's a the really the symmetric setting like for a uh but there is also a public key and uh this might seem a little strange at first because we're talking about a symmetric scheme but at the same time there is a public key um and this this public key is actually used by somebody else to basically take your Cipher text or bunch of Cipher texts and then perform some amorphic operations on them and resulting at the end of of these morphic uh operations uh resulting in a sihot text of the result and um and then this result is just sent back to the um uh to the user uh to be decrypted but nothing has transpired in the in the um throughout I mean in the middle of the computations so this seems a little bit uh magical uh there's also this uh I would say asymmetric flavor of f where you instead of having a a of using the same secret key to both encrypt and decrypt you actually have a public key for encryption so this is really reminiscent of regular public encryption where anyone can actually encrypt but you're the only one having the encryption key and so using this kind of f is actually very very useful because you can let other people than yourself providing data encrypted under your key so instead of having just one source of of encrypted data now you can just uh have a lot of people contributing to the computation for you uh so it's a little bit weird but we have these two public keys so the instead of of of saying their public key because there are two public Keys uh we're just going to say that there is a public encryption key by designating keys by the way that where use them the the operations we we use them for um so basically there's a public encryption key and there is this still this public evaluation key and what is really amazing and that shows that F morphic encryption is not like regular encryption is that actually the two settings are equivalent asymmetric and symmetric F you can build one from the other so I'm not going to get into the details here but just so you know although there is a huge difference between asymmetric encryption like as for instance um and RSA or you know elgamal or other public encryption schemes here we have an equivalence between the two so this already shows that we have something very special uh in terms of a cryptographic object and what it allows you to do is basically to encrypt data both in transit and during and in processing so it's it's basically for um you know this uh Trilogy of data address thata in transit and and data in use you can basically protect the data um across the entire uh life cycle of these data and so this is as an example this is like super valuable for um cloud-based services so it's usual that you have some kind of a cloud-based service operated by some company let's say cloud Inc so right now they provide value added Services by aggregating data but of course because there's no privacy or the the I mean there's a lot of of privacy threats uh in real life you don't have a strong guarantee of the confidentiality of your data but using moric encryption right from the beginning what you're sending to the service is actually encrypted under your key so the entire rest of the universe might be uh might be colluding against you you're the only one with the secret key nobody can have access to your data in the clear so this gives you like this empowers you with the a very strong sense of privacy confident confidentiality is ensured uh intrinsically your consent is required so that data can be uh can be processed and there is a notion of data sovereignty so it puts the the user back in this in the middle of the picture instead of having like data uh being data that you hone uh that that is basically being manipulated you don't know where this time you're actually the one in control but this is also very interesting for companies because uh basically the in this case the company is not responsible for the the semantics the content of the data because it learns nothing about it it has no clue about which values the all the intermitted values remain in the encrypted domain during processing um so the cloud is absolutely agnostic towards the value of the data they there can be no data britches because basically as a hacker what you would recover is basically a the dis of a server containing encrypted data so there's nothing you can do about it and then the of course a consequence consequence of this is that the server location is actually completely irrelevant so that that kind of unlocks you know the the geolocation of servers so it may be a GameChanger for a lot of people in the cloud business and if you think about it actually we can use f to um to reconcile privacy with the internet instead of having like a complete jungle out there we can just um as I said like put users back in the center back in control of their own uh of their own data and while while keeping this um this coexistence of of services that actually process the data and this is kind of reminiscent of this HTTP z uh vision of having some kind of a protocol integrated protocol that would uh use f by default so that every time you interact with a website uh you give your consent to your browser uh typically to uh send data that you want the website to process for you um so we don't have a clue if if it's uh attainable in the next years but this is having an efficient FHA mechanism allows you to think forward and to make a difference in the way the internet works so um I'm going to talk about the the evolution of F and how we came to it so don't be afraid it's a little bit complicated uh you can see here kind of a multiply forked timeline um it started about four decades ago where uh people in cryptography basically thought about this concept of having what they call at the time privacy morphism which is basically the encryption function is some kind of a homomorphism meaning that it it preserves operation like addition or multiplication however they are defined uh but the principle is that you perform an operation some kind of a group law or whatever you provide you perform an operation on the cotext and it does through the encryption envelope the same or another operation on the corresponding PL text and so the idea was absolutely fantastic uh but of course at the time you was unclear if it was achievable at all and actually RSA uh the the public key encryp encryption scheme um came about about the same at about the same time and it was the first example of a actually partially amorphic encryption scheme because it is multiplicative so if you multiply two saex you get you get the product of the two you get an encryption of the product of the to plan texts and for the next 30 Years uh people have been in you know designing schemes in a way or another that supported some kind of of of homomorphic operation uh myself I work essentially on addition um but there are like plenty of examples out there in the in the the crypto literature that uh show some kind of amorphism with respect to one operation and it's usually either addition uh or multiplication modul something or whatever sometimes it's exor um like for govas M uh but it's it's never like two operations at the same time and there was this dream during these three decades of research about having having a way to kind of compose the two fundamental fundamental operations which are addition and multiplication together like having one scheme that supports both operations on perfectly and it wasn't until 2009 that Gentry uh published this uh this first example which was very very surprising at the time because people were like giving up on on the idea of fully morphic encryption a lot of people were actually questioning its very existence so it was both an eyeopener and a very exciting new Avenue of research to see this first example of a probably secure scheme that actually supports both addition and multiplication and then we entered into a fascinating new subfield of cryptography dedicated really to fully morphic encryption and so the ghv the year after that uh came about it's a I would say doesn't need latices um so you can it's it's a a an encryption mechanism that just uses integers like modular integers for regular integers so it's it's very basic arithmetics and it allows you to understand very much but it's totally inefficient and uh unless you you trick you you tweak it or you modify it in some in some way it's not going to be useful uh then after that in 2012 2011 um started to appear a bunch of new schemes and then um I would say at this point we're culminating with these two fourth generation schemes TF and tkks uh because we can categorize basically these timeline into more or less four different Generations having distinct characteristics so I'm going to explain a little bit more what these different Generations are so at the very beginning uh what you have uh I mean according to Gentry's Vision what you have is a way to encrypt BS okay so the plan Tex are just single bits and when you encrypt X you encrypt y you can actually compute the addition of X+ y module 2 so this is basically exor uh but you can also do the same thing with the multiplication modul 2 which is basically an end um the thing with Gentry's original idea is that the addition was pretty fast but the multiplication was like super slow and um at the same time it was terribly exciting because with just exor and an end you have everything you need to actually do any kind of computation because you can always represent your computation as a as a Boolean circuit which you realize with these two basic operations and so it shows it like answered the question of the existence of f which was like super uh new to everybody in cryptography uh but then there is an aspect of uh F that was super important which is the noise so when you encrypt actually even though we write it down like an of X actually there is another variable in there which is a Randomness there must be some kind of a random number in there if there is no Randomness whatsoever in this aext it means you can recover x with a dictionary attack I'm just looking for if you know what the encryption of zero is you're just looking for it and you'll know it's zero everywhere where you can find it so you need a notion of noise and with f you always have like this kind of noise budget where by just tuning the parameters you just creat this space for the noise but the noise as long as um uh if the noise remains below a certain threshold in the S text this s text is correctly decryptable meaning that you that the one with a secq will be able to recover X but if this noise exceeds the threshold then the decryption is incorrect and you're losing the consistency of your computation and the thing is the more more computations you do and the more noise there is inside fex so it was a huge problem for for Gentry and um and so it came up with this so one of the consequences of this is that because the the noises are basically multiplied when you multiply uh uh to bits uh when you multiply two random integers of of the same size basically the result the product is as double size right so every time you multiply you kind of double the size of the random so it means as as as you perform your uh Boolean Gates the noise is going to increase like exponentially so there must be some kind of a critical path in your Boolean circuit along which the the noise is going to grow exponentially and so Gentry at This brilliant idea of um of of doing what is called a bootstrapping which is using the scheme uh itself to kind of reset the noise or Den noise the St your text and so basically if you have a an encryption of X under a certain uh orange key uh with a certain noise and you do some kind of operation on on this value X you end up with a new value Y which has uh uh you know maximum noise so it means you cannot you cannot perform any more operations on why because you can you may lose consistency and it might not be decryptable anymore correctly so what you do is basically you kind of use this other key let's say blue key for which you're given the the P the public the the public encryption key and you're going to encrypt your Cipher text so it's like putting this Orange Box into this blue box but not you're doing it with very little noise or even no noise uh if the scheme allows and then given the orange key but encrypted under the blue key if that makes sense uh you're going to perform the decryption circuit uh homomorphically and this is brilliant because what it does is that the orange key is going to remove this Orange Box and at the end you just have the blue box and the blue box has a noise which is independent of the yellow noise noise that that we had initially and so it means that you can basically denoy cotex so the the problem in there was that the procedure was like excruciatingly slow and um and on top of this um came up I mean Gentry came up with he had this initial Vision about FH what f is which is you do an operation basically you're going to bootstrap because the noise is already too uh too high and so every time you want to do a Boolean gate you're going to do a bootstrapping maybe not for the addition but at least for the multiplication you will have to do that and if you do that every step you know during the Boolean circuit then it means that your the the size of your noise is going to remain constant because every time it doubles you just put it back into its nominal uh size so you can go on forever and just you know perform computations uh at infinum but at the same time there was also another idea which is okay if the bootstrapping is so slow why not just getting rid of the bootstrapping and and we're not going to use it we're just going to allocate a noise budget that is big enough to accommodate with with the specific bulling circuit that we're interested in so we just leave the noise as it is when never boot trapping the noise is going to grow um exponentially in the worst case but it doesn't matter because at at the point when you you reach the output of the circuit the the the noise is is right right at the threshold so you cannot do one more step anymore the only thing you can do is send that back to the user for decryption but it's okay because you made it with the circuit that you wanted and of course you can always mix the two like bootstrap um when you absolutely need it after that appeared like the second generation of schemes so it was a definite Improvement over this exponential exponentially growing noise so in level schemes you can uh assign levels to the different noise sizes and basically when you perform an addition uh um modulo 2 here so basically if you had a level I and a level J Cipher text you would get um cyhex of level the max of inj so and when you do the multiplication it's the same thing except that it's incremented by one and so it means if you go through multiplications the the level is just going to be incremented every every time and when you reach a maximum level well if you exceed that maximum level then you get an incorrect decryption but there is still this notion of bootstrapping you can if you're desperate uh you want to continue with your computations you can always apply bootstrapping uh which has the Good Taste of of of taking um a cipher text that is um maximally noisy and put it back into the first level or maybe not the first maybe the second or at least at some point between one and the maximum level L where you can go on with your computations so it was a definite Improvement and it allowed people like to uh basically have the noise growing linearly within the circuit with multiplications so they the notion of um of complexity like the the multiplicative depth of the circuit still matters but it's less desperate like the noise doesn't grow exponentially just linearly and at the same time Second Generation generation scheme sorry uh introduce like the the notion of packing batching meaning you can actually perform have multiple plantex slots and execute your the same Boolean CC in parallel over all these slots at once so it was there again a definite Improvement and also another one was just instead of having to manipulate bits you can actually manipulate inte modular integers modul is something bigger than two uh like five or you know uh even a not even necessarily a prime number but something bigger so this allows for computations over a bigger uh with bigger moduli then the third generation happened uh GSW uh in 2013 it was essentially I would say conceptual simplification so another way to uh create uh another way to design a scheme that supports both multiplication and addition uh using matrices and igen values and E vectors uh but essentially it's very slow and so it wasn't it was it was never going to give something efficient something that we need you know to change the internet with uh but it was interesting to see that one year later there was another um GSW like scheme uh called few uh that appeared that improved bootstrapping immensely and and then to do like one bulling gate it would it would cost like one second of computation which was you know day and night compared to Gentry's uh initial bootstrapping which would take like 30 minutes to just compute the multiplication of two bits uh so it was a definite Improvement uh and then what we're uh what we're using uh in concrete is basically um our variant of TF so TF is this fourth generation scheme uh which people associate to G to the G GSW um branch on the timeline and in its very basic form TI F so it means tus F we're using the taus which is basically real numbers modul one so basically reals between zero and one and in its basic form you can encrypt bits and then you have all this you know all this bunch of uh of Boolean Gates plus the the M the mukes gate if gate you know turn the the tary operator that you have in C um and every operation is basically bootstrap but at the same time the bootstrapping is like super fast it's like a few tens of milliseconds at the same time we can guarantee the security of the scheme it rises from link with learning with errors or ring learning with errors so you'll see if you're interested in F and you look at the literature most of the schemes are actually rying on this complexity assumption and the the security of of lwe is is is well understood now still work in progress but we can definitely guarantee a certain level of of security so now let's be concrete um so if you if you're a developer and you you know you're just you don't know nothing about cryptography or you don't want to have to deal with the Gory details of how F works because there are plenty of these gory details let me tell you uh you may look at the libraries that are available out there and you will find uh a number of libraries that are open source um so we're quoting a few of them here um probably the most famous ones are H lib which uh originates from uh researchers at IBM Microsoft seal as well um a few others like new f for instance is actually implemented on a on a on a GPU Latigo which is implementing in go and so on and so forth uh but if you look at them and you try to use them you will see that you have like V various degrees of fusibility and Readiness you will not necessarily be able to do something else than just experimental code at the same time uh some of them support single threaded CPUs or multiple uh uh multiple threads or gpus but and and each of these if each of these libraries actually has a selection of its own schemes and its own API and and there is this uh initiative morphic encryption. org if you're interested uh that tries to put together like a common API for all these for all these libraries uh so that they we have some kind of interoperability uh in representing um uh homomorphic code in a sense um so you're we refer to the this um to this Initiative for um specification of a first API but for the time being each library is like a mess on its own you you'll have to depending on which scheme um which schemes it implements it will be it could it can be very complicated to you know to be to familiarize yourself with with the library so what we're introducing today is basically a new library which is called concrete uh um which was meant in the spirit of simplifying everything and having U you know people using concrete who do not have to really care about all these Gore details that I was talking about so it it's made with love for all of you who are like basically Tech saavy uh but not not necessarily crypto cryptography cryptographic experts it is written in F so that it's fast it's reliable and the the library is meant to be production ready and but at the same time if fatures a python wrapper to make it like simple and playful to use and um and it implements Zas variant of TF and at the same time you can have this fantastic operation which is the the programmable Bo strapping that I'm going to talk about later um so we're very excited actually to uh to see what people are going to do with concrete and we hope that it's it's going to be a a a seamless experience for for developers to try to develop their own use cases and everything with concrete um so more about the different objects so we didn't want to put out questions and big you know big maths in there but to give you an intuition of how concrete works um so we have two types of encryption so basically we have the like the blue type and the orange type so the blue type is what we call learning with error or LW encryption so basically what you can encrypt it can be a single bit it can be a modular integer an integer modulo uh modulo something of you're choosing or it can also be a real in some prescribed interval you can also put a real value in there and we have this other kind of encryption format where instead of encrypting one value X you actually encrypt a polinomial who whose coefficients are basically different values of X so by just by polinomial by using a polinomial we can actually pack a bunch of of x's together inside the same SI for Tex so it's very interesting because it's a notion of of packing um today I'm not going to talk about uh ring LW encryption because it's more advanced even though concrete already supports actually operations on this I'm going to f to focus on the the first one and in u the next Meetup uh you know we we can um update you with what you can do with uh ring lwe uh Cipher text so the experience that you have as a developer is that if you're given a an LW Cipher text this blue Cipher text containing your value X so encrypted under a certain sick key and with a certain level of noise uh you can look at it as just a 32bit or a 64bit integer right so this is like very familiar to all of you I guess um uh that the x that is inside is actually just a a machine word like just an integer and um so you can use this this this format to uncode as I said a bit or an integer or a real value using some kind of a neine um encoding but the important notion here is that the noise there is noise on the right on the least significant bits and so the problem with this noise is that as you're going to do operations on your your CER text the noise is going to accumulate and it's going to because of the carets is going to propagate Carib bits random Carib bits uh further down the left side so so the noise grows that way and if you want at at some point to den noise uh the content of your cotext you would have to resort to bootstrapping which is this operation that again the noises and like kind of resets the the level of noise um and um a very important distinction as well is that the computations that you're doing uh can be exact in the sense that there is never any um uh approximation made your computation is absolutely correct like all the time or it can be approximate and this makes sense when you think of numeric computations of real values because very often you don't actually need to be perfectly exact you can accommodate with a some kind of a uh you know error margin like 10 to the minus three or something or or you can accommodate with with some level approximation but with concrete you can actually choose it just depends on the parameters that you're going to use so you can pick one way or the other when you take two Cipher Texs so there are as I said they're homomorphic so when you add to cypher text the result of this is basically that the two 32bit or 64bit plant text that are noisy and contained in them are going to be added like a regular you know 32bit or 64-bit addition and so but when you do that always remember that there is this this noise on the least significant bits and when you do that the two noises are going to be added resulting in possibly in a Carib bit so you might lose you know the the least significant bit of of the sum of X and Y so you have to think about that and actually figure out which parameters you want to use so that you accommodate with the level of error that that you can allow uh the the other operation that you can do easily is a multiplication with a with an integer uh possibly signed integer and the same thing happens in this in this uh context basically the pl text is going to be multiplied like it was a regular 32 or 64bit multiplication with with an integer uh but another interesting operation that we have is the key switch so if you're if you have an encryption of X under a certain uh key sk1 you can actually apply a key switch operation resulting in another sciex so both of them are lwe Cipher texts but the out the the outgoing Cipher text is actually encrypted under a different key and you need to be able to do that you need to provide some kind of a proxy re-encryption key which in this case is a part of the public evaluation key uh we call that the key switching key that that is totally public uh and allows you to convert the cipher text under sk1 into a c text of the same thing under sk2 the problem that is that the you increase the level of Noise by doing this it's not a good strapping it's another operation just changing the value of the secret key but it's it's a very useful operation and then you have uh this bootstrapping I was talking about which in the case of concrete works um works the same way as as basically the key switch so you have a value of x um and you're going to bootstrap it to reduce the level of noise and it's going to switch also the key uh but the nice thing with the with the uh with strapping is that we can make it programmable in the sense that at the same time that we're bootstrapping and and and resetting the noise we can actually uh at the same time and virtually for free we can apply a a univariate function to the cont text and this function doesn't have to be linear or anything it can be like any function and so it's it's very interesting in that sense because it allows you to basically do um nonlinear operations virtually for free and because you're switching from one key to another key um you can always apply key switch so that you can get back to the first key again if you want to keep the consistency of what you're doing and key switch key switching is actually much faster than a bootstrapping but again we're talking about milliseconds versus a few tens of milliseconds so not a big deal programmable bootstrapping actually works by taking the function that you want to program into the the uh PBS programmable bootstrapping tabulating it and the PBS what it does actually is some kind of a homomorphic look up so you can put in there your table of of values you can sample your function and basically you have this parameter like capital N which you can choose which gives you the number of the size of this of this lookup table and uh but it's it's really some kind of a a table lookup and you can adjust the Precision that you need uh using this this capital N parameter so all the the PBS what it does is that text X it identifies some kind of an index between zero and capital S capital N minus one so it's a kind of a rounding scaled rounding function whatever and it returns an encryption of of the resulting um entry in the table uh so again you have a different key but you can resort to key switch to correct this and so it's it's really a homomorphic table look at and um if you want to think about what the other libraries too when they have nonlinear computations they approximate them by polinomial and usually of very moderate degree here because basically capital N would be like 1024 it's uh two orders of magnitude or three orders of magnitude higher so it's equivalent to have like a polinomial approximation but with a huge degree so it means you're really applying a function there it's not just a small degree polom approximation which makes PBS really interesting in practice and to show you how it's powerful um basically you can so if you take uh TF uh by itself uh either you can use it to encrypt bits in which case you can have like amorphic Boolean gates to manipulate these bits otherwise if you extend that to Small integers you will have addition but you won't have multiplication the scheme does not support native multiplication um um but using uh programmable bootstrapping you can actually emulate this multiplication and the way it works is actually pretty trivial if you look at this equation um which is the product of X and Y is basically a difference of the squared sum and difference of X and Y and so you can just take the C the encryption of X encryption of Y add them subtract them and program the function Square over four and do that on the both on the sum and the difference and you result basically in again an approximation but uh up to a level of precision that that you control of x times y so this shows you that PBS is actually very uh computationally efficient way of computing things the same way you can actually emulate division uh division is a nightmare if you're if you've been using the other libraries you've probably seen that they do not support division it's actually very complicated to do that homomorphically using PBS it's actually trivial because uh basically what you do is that you take the C the encryption of Y you uh you would strap it by programming the inverse function and then you resort to the multiplication trick that I showed just just before uh resulting in a in a in an encryption of X over y so you can do other things you can do basically theing distance or uh basically the uh the if you take X and Y you see that as a as a point you can compute the theum distance of this point to the origin by just programming the square function twice adding this resulting Cipher text and then programming the square root function and this gives you like in a few milliseconds this gives you this clean distance this L2 Norm that you wanted um you can also use a programmable bootstrapping to do a Max between X and Y again doing the max morphic is kind of a nightmare um so a lot of the the other libraries depending on the use case they actually resort to tricks to try to do this there's always something that you can do which is resorting to encryptions of bit uh but here we don't have to do to do that because the the max of X and Y if you think about it and you can see that this equation is actually always true is the max of zero and xus y + y and this function here is univariate so you can program it with the PBS so you just take X and Y subtract them apply a PBS by programming the function Max of zero and the input and you add that with the encryption of Y and this gives you an encryption of Max of X and Y so it's it's really intered because it gives you so so there are plenty of ways out there you can actually uh use to decompose a multivariate function in the very general case you have a multivariate function and this is the operation that you want to do orally and there are known ways to basically decompose them into additions or linear combinations and univariate functions so if you use this trick we have this new computational paradigm that arises from the use of of the PBS which is you just decompose your multivariate functions into a network of Univar functions and linear combinations if you know how to do this it's going to be super efficient because you're going to use uh programmable bootstrapping to uh do homomorphically all these univ functions and the linear combinations come like for free um every fully morphic encryption scheme likes linear combinations it's never an issue so now I'm going to talk a little bit about applications to machine learning um to finish this presentation so um so for those of you I I suppose a lot of you actually are familiar with anal networks uh anal network is just this uh artificial an that takes a vector of values a vector of weights and what we call a bias it does this linear or aine combination and then applies an activation function which is meant to be nonlinear to this multi-m and then you output this and so a neural network is nothing more than a combination of neurons plus other kind of ingredients there are operations that do not include neuron but the fundamental processing unit of anal network is this and activation functions so there are multiple choices the basically look a little bit like this and they're always very complicated to do homomorphically uh because precisely they are non not linear so the way it used to be done u in in 2016 the the cryptonet paper was published uh which was this idea of replacing um this um basically what the we're using is second generation schemes where as I told you before um whose complexity depends on the multiplicative depth of the circuit so what they wanted to do is to minimize the number of multiplications so what they did is that they replaced uh the the activation function with the square function obviously you can do better with a small degree polinomial approximation uh but this resulted this results is in the fact that the approach is not scalable you cannot have like apply this to deep n networks uh because there would be too many the depth would be too too much and so the parameters explode and so on but here a very elegant solution is to use a programable boost bootstrapping instead to program your nonar activation function so um basically we apply that to newal networks and we have a first um number of of benchmarks somebody is WR on my screen okay um uh so we have preliminary benchmarks um that we've um that we've uh recently uh put together that we applied PBS uh to a newal network with 20 layers so what I mean by layers is the number of of activation layers um and uh basically for the Mist use case so this is like the accuracy of the original Network processed in the clear it took like even less than a milliseconds over a CPU or AWS and we converted that into its amorphic equivalent resulting in closing enough uh accuracies there is a bit of velocity here and with different parameters and so the two first lines are for a 80 bit security the last line for a 128 bits of security um but this shows you that in a few seconds you can actually easily um perform theomorphic inference of a of a neural network with 20 layers and without a like a drastic change in the accuracy so again this this results will be improve over time uh these are our I would say our first first benchmarks but we'll still have things to uh to do to improve the parameterization of this uh of theomorphic equivalent of these n Nets we also apply that to a n network with 50 layers and same thing here with close enough accuracy uh we can actually um have an inference that works within 10 seconds or within 37 seconds or 3 seconds uh depending on on on the level on the parameters on the the level of security not only did we that but we also applied that to a network with 100 layers and you see here these preliminary results so for first so the parameters here depending on the set of parameters you can see a ve huge difference in the accuracy loss here um so we're still working on this but just to announce that we can actually go as deep as we want because every activ ation is using a PBS so we can do the activation function reset the noise and go on and go on forever and I guess this is my last slide so what we're building at Zama is actually this these three different layers first a crypto library that anybody can use not only for machine learning but in particular for machine learning but the library concrete is actually agnostic to which the the way it is used um it is meant to be action ready again and to be easy to use an an instrument uh but the next thing we're going to talk about in other meetups down the line are a compiler that basically takes a new network and does everything that has to do with a conversion to a homomorphic equivalent finding out the best parameters and so on will be fully automatized um so stay tuned for more in a in a few months we're going to um is the first version of this of this compiler and of course the compiler is is meant to run uh um in um in sync with the with the library through some kind of a runtime engine a runtime environment so there is a an open source version of this ROM environment that also going to be to be released uh and then our vision is to uh provide some kind of an infer to service service uh where basically people can just upload pre-train Neal networks click on the button have them uh newal Network compiled deployed in the cloud and an API is exposed that allows their customers to make inference requests to um to the network um so I think that's that's that's it pretty much probably took more a little bit more time than I thought no it's uh it's perfect it's 75 to 7 so it's we're perfectly in time uh thanks Pascal for the presentation maybe we can start a little Q&A session before the presentation of Daman sure uh so we try there were many questions in the chat we tried to answer to everyone uh by message uh but it was it was tough uh so I might have missed uh some questions uh I I guys uh everybody that wants to ask a question to um write a question right now in the chat uh so I'm I'm sure I'm not missing everything and I will uh eventually ask you to unmute yourself and ask the question to to Pascal oh I'm looking at the chat there's there are like a lot of questions a lot of questions yes okay okay uh oh okay so there is a uh there is a question by Timothy uh blomberg uh Timothy would you like to unmute yourself and ask the question to Pascal uh hello can you hear me yes yes you can hi yeah uh so Pascal firstly wanted to thank you I've spent a lot of time reading your paper about the first crypto system so the the P crypto system yeah implementing itself oh cool cool that was more than 20 years ago yeah so I just wanted some more like information about what the compiler is going to be do you have any hints or what kind of language you write in how that will work yes of course we've been already working we've been working in it for for a few months now um so um so it's written in Python it's meant to be open source uh what we want to create is actually some kind of a community around F of tech savvy developers who may not be crypto experts but want to contribute in making FHA reality and so compiling we think is is the next big challenge it's it's the next big Rod block on the road because finding the optimal parameters for f is currently a nightmare and uh for all the schemes out there and um you cannot easily deploy and and uh you know generate homomorphic programs unless you have some form of a compiler so the the compiler is written in Python it is specialized for newal networks very specifically so it takes us input a newal network in the onnx format which is meant to be kind of universal um and it it's it's its output is basically a homomorphic representation of the converted network uh but all the technical details about the the FH parameters uh being optimized uh and everything are taken care of and so you don't have to do that but of course it's going to be open source so that everybody can contribute to actually improving the technology and we think it's going to be if it is entering this new era or it's still going to be about the crypto but not only about the crypto and it's going to be about software tools and compiling and programming language and and uh making F very simple to use very simple to instrument and very playful and um yeah is that wonderful answer yeah thank you very much I'm excited for that new future if I if I we are too yeah Tim to to give you a sense uh FHA today is kind of like where deep learning was in you know 2009 2010 uh it's working but nothing exists no tooling no implementation that is easy to use there is no tensor flow framework so we got to build everything and this is really the way we think about this at Zama is we want to build all the different layers so that anybody who wants to put it in production can do it without necessarily having to spend you know months learning about homomorphic encryption exactly and it's a really big challenge I mean today we're only talking about cryptography but really uh this P this layer this AI framework layer on top of it is extremely complicated and it's also something we're pretty excited about open sourcing down the line okay we have other questions I'm trying to look at them in the order so we have a question from Louie uh o Lou can you unmute yourself sorry for the pronunciation of the name uh yeah sure thank you um so I see in the slides that you have here that CPU is highlighted but I'm just wondering if you have PL implementing GPU in fpga um sure definitely so what we want to do is so implementing an CPU is necessary of course but we need to improve efficiency as much as we can so we have at some point to move to to hardware and the first step of this is going to gpus um and then going to fpgas designing our own um architecture for for efficient um f and then possibly to ASAC so it's going to take some more you know investment and probably a lot of time and efforts uh but we need to to go there in terms of getting I mean we want to get this speed up factor that only Hardware can provide and even though the crypto is always a way to you know improve the the performances ultimately you need also to improve the engineering side of of things and to improve you know the the operations themselves you know all the implementation implementation tricks all these engineering things that you have to do to make things fast we also need to explore them and so yes we want to go there um and we'll see it it's probably going to take years but this is what we want to do thank you okay continue with a few more questions uh so we have a question from Alexander vant Alexander can you unmute yourself sure so my question is about packing and programable bootstrapping are they mutually exclusive or could you combine them um so there is no possible bootstrapping for packed scier texts uh but what you can do basically in con so I talked about this blue encryption and this orange encryption which I haven't described or anything it's for the next Meetup probably uh but you can actually take blue encryptions lwe cotext and pack them into a ring lwe cotext and you can also unpack them right the thing is to to apply the programmable bootstrapping you can only apply it on an lwe CER text a blue CER text so you may use a ring W CER text to um you know to make things more compact basically to compress encryptions into a single one um but basically as soon as you want to apply bootstrapping uh you would have like to unpa the the fra I mean the the values in the polinomial that are of interest for you to impact them and apply bootstrapping on them and possibly put the results back um but so programable spping and packing are like um not not compatible to one with one another great I don't know if you still have time or uh maybe another one or two questions then we move to the to the talk by Dean uh I I see a question from Gom uh Gom can you can you please unmute yourself yes um so yeah I was wondering um this inference as a service who do you think is going to pay for it I mean do you have a real use case some customers for and so who is going to pay and for for what in fact that's my question maybe maybe around yes so I mean the short answer is uh when you look at other people who are trying to sell uh homomorphic encryption they all seem to go after Banks governments healthcare companies and you know these industries are very good at paying for expensive pcc's but they're really not that good at putting things in production quickly uh so the short answer is we don't know uh and we're definitely not focusing on monetizing right now our goal is first and foremost to build a product that is easy to integrate uh in fact we actually have a zero POC policy internally in a company because what we build in open source should be so easy to use that you should never need us to do a PC um so you know I don't have a clear answer to you my answer is let's talk about it in a year uh and by then hopefully the thing will have matured enough that we will see use cases emerge buttom up uh even maybe from the community we'll see great uh maybe a general information run already uh uh said it in the chat uh the slides and the video will be um will be shared in the channel so don't worry even if you were uh late or you missed a part uh you're gonna you're going to be able to to see the slides and the presentation uh I may propose to stop here uh for the people that uh were not able to ask a question or uh for which we did not have time don't worry uh there's going to be a Q&A session at 8:00 p.m. in 1 hour after the Damian's presentation so we will give you the chance everyone to to ask the questions you want so don't worry if we didn't ask you allow you to ask the question right now um so maybe again thanks Pascal for the presentation and we can maybe move to the presentation by Damian great yeah uh um