Dapps - privacy first, user centric, Defensive apps. | Janmajaya Mall, Gauss Labs | ETHTaipei 2024

hello um so yeah so my original topic was pretty long so I sort of sort of cut it down to F apps but so today I'll be talking about F apps but before I sort of do that I would I would like to tell you a bit of a personal story so when I was in college me and my friends used to work at a startup and we were flatmates and we work at different startups you know the thing that you do in colleges like in summer you go for and work for startups right so one of my friend used to work for a startup that was building a expense management app so you know you can use that app record your expenses if you go eat somewhere if if you go to H&M and buy something you can just record everything over there and that particular app was pretty nice it had a pretty nice UI and you can record everything over there and that particular app had a really nice feature that is that they had a tie up with banks and they would offer micro loans based on my expenses so you know within a month based on my expenses they would offer me micr loans and that was pretty nice because when you're in college you need micr Lo for sure uh but the problem that I had while using the app I always had this thing in my mind like these people have all my data like all the expenses that I've done within a month and let's just say that my my my friend is not that good with computers and stuff and they and then and and then someone breaches the server I'm not saying that the people are malicious themselves but like what if someone breaches the server then the person who breaches the server would have entire profile of me and then they can sort of like do stuff so and I had Be Wondering for a while like how can we build something like is it is it possible to build an app in which you can keep the expense data local and while you keep the expense data local you can still offer the key feature that is that you're still able to offer micro loans to folks to to to the users while making sure that the data stays local and I think I have an answer and I throughout this talk I'll try to answer that thing uh but before we do that I would I would like to tell you the thing that makes it possible which I usually refer to as F but F stands for something called fully homing encryption how many folks are aware of fully encryption over here very nice cool so for the rest of you I would like to tell you I I I I simply think of f encryption as something like this so you've got a plain Text data right you go secret key and then you encrypt oh okay my bad you encrypt your plain text Data with the secret key to produce a cipher text and think of Cipher text as something garbage like no one can determine what the plain text is and now I would you hand over the cipher text to the server and the server is a blackbox now server can compute any function on the cipher text think of the server as a blackbox it can compute any function on the cipher text and that function would be valid on the plain text and it produces an output Cipher text and you get and and sends it back to you now you decrypt the cipher text using a secret key and you learn the pl text the function evaluated on the plain text so think of f as a blackbox using which you can evaluate any function on your encrypted data um cool so in order to build that expense management app that offers microl loans to its users while making sure that the user data stays private um we would be sticking to one of the schemes in F called ckk there are multiple schemes TF bgv and so on and so forth but I would be sticking to just one scheme for today uh called C KES now what is C KES well I like to think of C as like C is something which has two special properties the first one is that in CK K you can operate on real numbers so I think of plain text in CK as a plain text slot that is real numbers what are real numbers like numbers like 0 point something something something something something that's that's a real number so think of CK as plain text as a real number but another special property of C is that a single Cipher Tex or C does not only have a single plain text slot it has multiple plane text slots so you've got you can imagine like 8 16 some power of two plane text slots and when you operate on a single Cipher text it works in a simd way so what do I mean by that so when you have two c Cipher text for example this is a cipher text this is another Cipher text when you multiply to Cipher text the arithmetic happens element wise so you get a0 A1 a0 A1 it's a multiplication of a0 and A1 and so on and so forth and same applies for addition subtraction um in CK Cas you do not have division it's division are you know pretty hard in most of cryptography not just not just a um and as a rule of thumb C is very unminable to linear Transformations and nonlinear Transformations like let's say activation functions divisions exponential functions like e to powerx and so on and so forth are pretty hard to do as well but you can sort of like do them using polinomial approximations but then do the expensive but for the rest of the talk of today I would I would mostly focus on linear Transformations I I would not go into um nonlinear Transformations and polom approximations and so on and so forth um cool um so there's another thing in C um as I mentioned that a c Cipher text you can imagine a c Cipher text as a plain text that has multiple slots like a vector well when you have a vector what are the most intuitive thing that you can do with a vector you can rotate it the same thing can happen with cotex as well you can think of cotext divide into two halves upper half lower half and you can perform rotations left and right rotations well when I say left rotation I mean up rotation right rotation means down rotation so you can perform rotations within this hyot text uh you can also swap the row so you can swap this with this and this with this homomorphically like no one learns anything what is the plain Tex but this happens it's on the plain D Okay so coming back to the main question how can we provide microloans to you to the users while making sure that their expense data stays local like they do not have to send their expense data to the server uh well how would you do it normally let's just try to reason through how would you do it normally well the normal way is that the users's data is on the server and the server would build a model like it would train a machine learning model which would take the user data and try to predict How likely is it the case that if a micro loan is offered to this particular user they would be able to pay it back and this is known as default rate right so what is the default rate based on users data uh for a particular loan um let's say U 100 USD or something like that that's the normal way and and in the normal way the user data is is is on the server um so let's just say that particular model in this case is the logistic regression model and what is the logistic regression model well you can think of listic reg model as a bunch of like as a collection of features any feature could be income of the user what is the expense frequency of greater than 100 100 USD or 1,000 USD uh what is their past expense average per month and these are the user features these are the features for the logistic regession model and based on user data the server would calculate user score for these features so you can imagine that the income could be let's say 50 grand um expense frequency greater than thousand could be 10 and so on and so forth so based on these based on these features and based on user data the server would calculate these uh the the the the corresponding user scod and then the logistic regation model is trained for a bunch of Weights so what are weights like a log model has multiple weights each particular feature has a corresponding weight and using the and this this correspond XI corresponds to user code on that particular feature using that this would calculate Z and then we'll calculate the probability um cool so now the problem is that over here the user data is stored on the server but our condition condition is that we want to we want to be able to calculate this thing Z which is based on user data locally like we do not want the use user to send their data to the server what can happen is that let's say using CK which is a f scheme the user would encrypt the user would first calculate their own score locally so they they would take the feature score and then calculate their own feature scores locally and then encrypt this feature scores send it to the server and the server would evaluate the logistic regation model produce an output Cipher text send it back to the user and the user would decrypt it to generate a proof of decryption which is Trivial and then share the probability with the server well it could work that way but we still left with a very crucial question and The crucial question is how can the server calculate and evaluate this logistic reg model homomorphically right because the server is only getting encrypted user data well you would notice that we just have to calculate Z with encrypted XI right because only the user data is uh is is is encrypted so how about the user encrypts their score on certain features so this is a cipher text as a vector in CS and the server takes a CS plain text of the corresponding plane uh corresponding weights and it multiplies element wise and you get this thing which is the first thing right so a summation of this would give you Z summation of this is equivalent to this so we just need to figure out a way after this homomorphic multip application we just need to figure out a way to sum all these values and and still like coming back to the point this is a vector right so these are SL stored in multiple Slots of the same C for text so how do you do this well you would have to calculate the inner product and the way that happens is well if if if you're more algorithmic like you understand algorithms much better than I do then probably this would suit you better but if you have a much more you know intuitive understanding of this thing so the way it would work is that we have in the initial Cipher Tex is like this and as I mentioned before you can you can you can split the cipher Tex into two halves upper half and lower half and you can rotate within the halves so what the sub would do is that it would rotate the cipher text left by one and added with the existing Cipher text you will get this and then rotated by two and added with this one you would get this so over here you can notice that we have summation of all the first four slots here here here here and summation of all the lower four slots here right and the next step that the Ser would take is this it would swap the rows and add them and hence you have inner sum that is value Z in all the slots so okay so now now the Ser is happy they were able to you know build this particular up with um while while making sure that the user data stays local they do not have to pay any fees and so on and so forth uh they comply with all the regulations but turns out you know there just too many expense management apps like there is just too many expense management app right like you you've got one from revolut and so on and so forth and they were not able to you know compete with other other companies so I really do not know whether they exist as of today or not like I just checked the website a few days back and it was rning 404 but keeping that apart let's just assume let's just assume that they decided to Pivot they decided to Pivot to something else something much more special something much more exciting uh let's see so they have expenses which is a very private data it's it's a very local data to the user and they wanted to use this particular data in some other way they wanted to use it for building the next startup uh they thought that well you've got expenses of users you can use it for something and expense is Prett pretty private you can use it for probably matching people like you just match make people based on their expenses and let's just see that how can we build a matchmaking app while making sure that the while based on expenses and while making sure that the the the expense data of users stays local but before we do that we should sort of understand how would we do this in plain text right so we building a matchmaking app BAS on expenses so let's just say these are my expenses right I I spend a spend a bunch of money here and there the first thing that we can do is that we can categorize this data right so we have got multiple categories we put these expenditure expenses into these categories so Starbucks go to coffee Asian go Asian food uh so buang goes to Asian food and so on and so forth so now you have a bunch of fixed categories and the frequency like the total amount that I PID for in these categories uh now what we have to do is we have two folks let's say me and you well there's no over there but like me and you and these are these are my categories and these are the expenses that have done in these categories these are your categories which are the same categories and the expenses that you have done in those categories and we need to find how similar these two two things are because if they are more similar then probably that that U me and you are great match so we just need to figure out how do we check whether these two things are similar well in in traditional ml thing like machine learning space there exist a very like really nice formula to do this it's a it's a distance function which eventually is a cosine function so this is known as cosine similarity wherein so this is the formula for coine similarity but going back to this point you just take these values and take take my frequencies take your frequencies and we just take inner product of those frequencies which is Xi Yi and we divide by the norm and what is Norm well Norm is summation of square of the values and the square root of that so for example let's say my frequencies are x0 X1 X2 X3 X4 um the norm would be x0 squ + X1 s + X2 s + X3 squ and a square root of the addition right so that's the norm and you would calculate your Norm as well and we would calculate the inner product and that would tell us how similar our expenses are um well but right now what we're doing is that we are handing over these things to the server so we handing over our expense data to the server but what we really want to achieve is that we want to make sure that we do not send our expense data to the server and our expense data stays private because that's a that's a very private thing so the way it would work is that I would encrypt my frequencies that are x0 X1 X2 X3 send it to you you would somehow homomorphically you know I I encrypted using ckss send it to you you you would somehow homomorphically calculate this cosine function and send me the output Cipher text I'll decrypt the output Cipher text and share the similarity score with you so if the similarity score score is high then you and I match really well if if the similarity score is not high if it is low then we do not speak after that so how do you calculate this thing well the first observation you to make is that this is this is the cosine function but this is equivalent to this particular function and the special thing about this particular function is that instead of encrypting my frequency Vector that is x0 X1 X2 X3 I can instant encrypt X1 by the norm of X and so on and so forth so my so the cipher text that I send you would be would have plain text x0 by the norm X1 by the norm and so on and so forth and then this entire cosine function translates to a simp simple homomorphic a product and this is similar to the thing that we did before over here so over here we saw how to calculate the inner product between two particular Cypher texts and the same thing should be done over here as well so you can think of this is a Cypher text this is the plain text and we calculate the homomorphic product of this you send me the output cyer text I decrypted and share the value with you and that is it so now you have built a really good app um but again you know things had to Pivot the presentation should go on so these folks decided to Pivot again right so they they tried building this social app dating app but this did not work well because there's just too too many social applications right this the market is too populated and you had to reply to the ventures um so they decided to Pivot from this particular thing and one of them was a you know one of them one of one of the co-founders of the particular startup was uh he he was um pretty Innovative he was he was very very experienced he was a doctor right and he thought that we should do something for the doctors um uh different and something uh special for the hospitals um and he came up with an idea and he he went around speaking to the hospitals different hospitals and he noticed one particular thing that you know hospitals out of the service do not like they do it looks like everything goes well inside the hospitals but like they do have problems and there's one specific problem in hospitals I mean there are many honestly but like there's one specific problem in hospitals that you can solve using FG and the problem is that hospitals have private patient data you're a patient you go to the hospital for medication you get a medication and the hospital learns how effective your particular medication is but the point is a particular Hospital does not have a view of all the patients in all the hospitals the it only has view on the effectiveness of a particular medication in its own Hospital in order to get the view of all the hospitals it needs to communicate with the hospitals but the point is that you cannot share your P private patient data with the hospitals regulations and so on and so forth so is it possible that we can we can solve this problem this this problem looks very much suitable to F right like if I can compute an encrypted data that I can do something with this well but like is it possible that we can solve these particular problems of hospitals with f well that's true it it is possible but in order to do that we'll have to first figure out first learn something new about FG right right we we we need to First learn something new about f um and that is threshold F Well you see all this while I've been describing about f as a single key thing right you have a particular use and that user encrypts the plane text using the secret key and it is only that user that is able to decrypt the output Cipher text but what we really want to achieve in case of hospitals is that only when all the hospitals or most of the hospitals agree to decrypt the cyhex they should be able to decrypt it so this is the place where threshold Effy comes into picture so what is threshold Effy well threshold ay has two simple new ideas the first idea is distribute key generation and the second IDE idea is threshold decryption um the the first idea distributed keyen is as simple as this so all these hospitals would have secret shards that is S1 S2 S3 S4 and they can come together and perform this MPC MPC stands for multiparty computation uh operation called distribute key generation and they can generate a public key now any Cipher Tex that is encrypted using this public key can only be decrypted when all these hospitals come together and cannot be decrypted otherwise so you've got this public key now what the hospital hospitals would do is that they would encrypt their private inputs using the public key which we generated right here and the F circuit would run on their private inputs so you can imagine them encrypted their patient data so this Hospital encrypts their patient data that hospital that hospital that hospital and then you can imagine this particular F circuit being as any any any statistical analysis like kisis um cap my survival test or some other test could be any any any arbitrary F function and it outputs uh another Cipher text now once you have this output which sort of encrypts any of the statistical analysis test output if you can simply decrypt it so all these hospitals again come together and they perform threshold decryption on the encrypted output and they get the output um and that's it that's it thank [Applause] you is Q&A time do anybody does anybody have any questions can you characterize how expensive it is to run uh I mean you can give an example of of interesting things we can run practically perhaps yeah um so all these things are practical they are very very easy to run I've not delved into more complicated circuits it is at present like I would say it is very much practical to run let's say let's just say that you know MLS hard or something like that uh let's just say that if you're familiar with rest Nets and stuff um those are somewhat complicated circuits when I speak of circuits I'm speaking of f circuits uh these are like f functions um they are much more complicated but I think they're practical to run like for example you can imagine reset 20 res 51 being run in FG so it's it's yeah that's it um so on gpus it should take you around 15 milliseconds for a single for a single inference of U of ret 18 I believe on CPUs it might take probably 20 208 of that um on fpgs probably a lot less um and on a six a lot lot less any more questions for Jaya thank you so much for the talkk you