MPCStats: secure and private analysis of verified data | Kevin Chia | ETHTaipei 2025

[Music] Um, hello everyone. So, I'm Kevin and I'm now independent and MPC stats is a project I was working on while I was still in PSSE and um from the name you can tell we use MPC to compute statistic operations and we guarantee the um input privacy and also the output correctness and the project is now sunset. Um so it's this talk is more like we summarize and we talk about how we've built and how we built it and also um how we have learned. So hopefully it it'll be um useful or helpful for you or people who want to build MPC applications. Yeah.

So first um why do we need privacy preserving stats? Um so um if we want to compute some statistics statistics from um input from different people, the naive way is to let them submit their data to a single server like this. But there's a problem. the server learns everything about the data which is not good and some people might not want to do it anymore and probably due to the regulation. So if we can make it not leaking data at all we can probably unlock more use cases and here is what MPC is helpful.

So MPC stands for secure multi-party computation and um in MPC basically there are multiple parties like this we have three parties and they collaboratively compute some result without revealing their own secrets and at the end um all parties will be convinced the result are correct. And what is different from the single server scenario is that the trust is different. We don't trust the single server anymore. Instead, we trust uh the threshold. So for example, if we assume parties are honest majority, which means most of them are honest.

So as long as most of them are honest, our inputs are secure. But if most of them are malicious, your input might be revealed directly. Yeah. Um so what is our project NPC stats? So originally we wanted to build a generic platform which is open to anyone.

Everyone can share their data and query stats from data from others and inputs are remain private and the computation can be arbitrary something like that which is quite ambitious but we realized our goal was too large too broad so we decid decided to scope Now because we didn't know who will be our user and um how arbitrary computation will we need to support something like that. So that requires a different technical um visibility. So we decided to scope down to build a smaller demo which is the def demo we built and we picked a specific use case and um just to test the technical feibility and to get some feedback early. Yeah. So um we let our we let the participants to contribute to share their Ethereum balance on Binance and we compute the stats.

So um this is our dashboard. Uh we have some stats here and um no individual balance was revealed at all. Um to build the demo we use a firmware called MP speeds um which is quite popular and well maintained and um another some reasons we are using it is that it's easy to write the computation. So you can define your computation with Python like the left hand side is computing the average of the inputs from three parties and also the framework support um many MPC protocols given different trust assumptions like this table show and we can easily use the same code Python code and we can benchmark with different MPC protocols easily and to make the UX better um we decided to delegate MPC to the three servers and so which means user didn't need to run MPC themselves they delegated to our three servers and it is the feature supported in MPs if you're interested you can check it out. And it makes the UX much more simpler and um users need only need to submit their um secret share data to the servers and they can go offline and let me explain further.

So originally without delegating MPC to servers all the data providers and um consumers who query the computation they need to be in MPC like this. So if we have n d providers they all need to be online with their consumer. Yeah. So the pros is that um the data consumer who query the computation um they can be convinced the result is correct but um the cons is that they all need to be online. It's hard if um if there are many many double riders and um also the computation overhead like multiplication um it grows with the number of parties.

So in this case is the number of data providers. So if we get many D providers the overhead will be bad. So with delegating MPC to three servers, the end dial providers they just share their masked inputs to the three servers and servers compute and the consumer get a result. And the pros um yeah the pros is just um the end user like data providers data consumers they don't need to be online like they just need to interact with the three servers and they can they can go offline but the cons is that um they all need to trust the three servers for the input privacy. So they need to trust the three servers don't collude to reconstruct their um plain text data and also they need to trust the servers that they don't um they don't compute something else they they compute correct.

Yeah. And um another feature we supported was input verification with TLS notary. So um one major problem in NPC is that um you couldn't tell if a user lies about their input at all. So for example if we want to compute some stats someone can just input garbage value and you get you get garbage result. So with TLS [Music] noty users can prove their balance on Binance and um get a TLS notary proof and MPC parties they just check if the inputs match the TLS notary proofs and if so if they match it means the inputs are authenticated they are indeed from Binance instead after some random value so we can be sure that there the outputs are correct.

Yeah. And to summarize a bit about our MPC settings and performance. So we had we had three servers in the same region and it was T3 in AWS which is quite normal machine and um we use the honest majority protocol which means it's secure when at least two parties are honest and um both sharing data and query computation takes under a minute so it's acceptable. able. Yeah.

And we got some feedback. So in total we got 19 data providers across Defcon last year and also Taipei blockchain week later last year. Sorry. And most of them the most of the participants they were okay with the server three server trust model probably because Binance balance is not that um confidential and some people they didn't want to participate because um they are concerned about um generating API keys which is required by our script and also some just doubt it if our script do something bad. And I think that's understandable because um yeah, Binance is financial and probably um is difficult if they lose money.

Some lesson learned. Yeah. the first um even though we validated the technical um visibility, we think use cases are the most important. So um if you if you want to build some MPC applications, I think it's the best to make sure what you're building makes sense in the real world scenario. So for our case, our demo is just using Binance it balance and probably get some stats, but we're not sure if the stats make sense to others.

So it'll be best if you can find a real world use case and use MPC to solve it. And second, trust and usability are critical for adoption. So um to make user use or run your script or code, you you need to make sure to convince them about the um what's happening behind your script so they can trust you and they'll be willing to participate. And also UX is really important. So make sure your script runs fast and you don't need much configurations and probably the web based will be the best.

And the third um the data sensitivity affects acceptable trust models. um which means in our case Binance balance is not is private but it's not confidential but um if you're um if your use case use some data which is really um sensitive you probably need a stronger uh security model. Yeah. So um these are the directions we wanted to explore. Um we didn't do it we did we didn't explore it in depth but I we think is interesting.

So the first is that if we support um more data provenence tools we can unlock more use cases. So for example um ZK email can let us integrate inputs from email and um if you want to enhance your security probably you can consider using FHE MPFG something like that and um because we are using three servers delegating MPC so um we don't have verifiability If you want to bring it back, you can consider using TE or coarser and um that's it. Yeah. Um so even though our project is sunset, our code and documentation is still there. So um this QR code is to the to our document and um if you want to reuse or adapt our code um you can just follow the documentation and um that's it.

Thank you guys. [Applause] QA. Oh, so does anyone has any questions? We're open to QA now. Hello.

A quick question. So, if you have like a tree dedicated server and the clients go online, isn't this basically a glorified client server interaction? Sorry. Uh so if you have like three uh delegated servers and I'm a client, I go offline and delegate to the server like what is the difference between that and a and a normal client server communication because from the from the client's end I it might not even need to care whether it's three servers or just one server. It could also be a Kubernetes setup or or even like a single server to the client.

It it doesn't appear that it's three servers. Like how is this communicated to a client? Yeah. Um you mean what's different from submitting data to the three servers, right? Uh yeah.

Like how is it made apparent to a client that uh it's a MPC setup which is more secure versus just a normal server? Yeah. Um it's so when we use three servers [Music] um there are providers when they submit their data the data is actually masked so the three three server couldn't reconstruct their I mean one server cannot reconstruct the data themselves and also um the client interface feature in MPs guarantee um the output from the from the MPC by three servers um how to say that? So the security is the same as the um MPC within the servers. So um clients can detect if servers want to cheat about the output from MPC.

So um I think that's um yeah I'm not sure if I answer your question. Okay sorry probably we can we can talk later. Yeah. Okay. I think we can have like more questions.

Has anyone has any questions? [Music]