ETHTaipei 2024 Workshop：PSE_Part 2

wow yeah so let me uh pick up this question um so we are talking about the order of the input right yeah and then uh why does it matter yeah it matters because what we're going to Output what we going to compute out of this right now suppose uh I submit my number CC submit this number and then uh we compute immediately right without waiting for another one then then this function the output may be like it is a trivial function that looking at the output we can revert C's input or my input so that is going to be problematic in that case of the order or if we think about uh like Computing the order book just from several uh orders right it can also be problematic because I may not know exactly what is your price but I can know the range and then I can play the game on you so uh in general we have to uh Define like uh you know what is the Lage that you can accept for example uh we may want to wait for 1,000 orders or we may want to receive the inputs from everybody like in the auction uh case where everybody input the bit before we actually do the computation or we have to make sure that if we are using F that is computed on all of these inputs right because because looking at a Cy Tex you don't know what is the function behind it so we may want some verifiability out of the computation so is that because there's an basically a side effect happening on some external State yes ex and we have to just like anonymize the input at that point but like the FH context so I guess that's for a very specific type of context where we have a in the clear publicly advertised like output yeah be like the problem with NPC is that um like if you compute a trial function just an additional or two number and then looking the result I have my input I can just do a subtraction right it is pointless uh another problem is that um like what if I input garbage value so I'm not being honest here so is like the interface of the MVC is like that there is nothing you can change about it so you you have to augment it with something else for example inside NPC you may want to do some sanity check for example if you want just positive integer you have to check it inside MPC or you have to prove that the input you you you you send into this MPC or send into F satisfy some some requirement before we actually do the computation so like those are like subtlety but well like it's subtle right but fortunately we can think of it from the application point of view we don't have to like know the the crypto to to to be able to do it so it's all from the application uh perspective it doesn't make sense to when when when building this application it does make sense to reason about what the circuit is doing so that you avoid the trivial cases of PR leak like Edition stuff but yeah I I think it is it is like it's like it is I think it's the responsibility of the application develop to reason through all these trible complexities just to make sure that you know let's say if you and I are adding numbers then obviously and if we decrypt the output then we would learn each of the numbers right so such stal cases cannot be handled automatically because they're too many of them but yeah if you are able to figure out these if the developer is able to reason through these things then other other cases can be handled automatically like G it is sorry I mean in your language is this kind of like batching thing is that considered synchronous in that context cuz it's like it's like a window I mean what what M explained sounds a little bit like an anonymity set in some typical like even in applications today we have this kind of term right when we are like accumulating something and then it's impossible to figure out who is who so uh but as as I understand now it's more like an application specific thing so if in this particular application uh there is the vulnerability you need to have that anonymity set but but if there is no such problem then we can maybe like do one by one like typical FH example that I here is like hospitals sharing medical data right and and like uh train U machine learning model on the data I guess in this example the order doesn't really matter and you can do it like in any order and uh output the output some result after every step because uh like you're not losing um you're not exposing any like private taste on or anything yeah a very simple example you could take is that let's say you and I have a contract and we want to check whether our contract terms match we just check it one more there's no that's it so very simple example you don't have to you know batch anything or something um I would rather I'm very I wouldn't take machine learning training as an example for f especially honestly because uh when you train I mean you can do machine learning training with AI yes that that's okay but when you train a model there are attacks on the model that leaks the input you can trick the model to Output the training data and if that is possible then doing it in encrypted form does not make that sense instead you should try adding noise to the input data like DP like differential privacy to be able to make sure that no one can adversely attack the model to get the private does that make sense can we like attach a zero knowledge proof and send that to the model does not contain any adversarial attacks while training no aders attacks after training so let's say you and I like all of us have a private inputs and we train the model together our private we have private inputs let's just say there's a very expensive computer out there we are training a model now once we have that model people would use it right now thereis attacks against the model to Output the private inputs because the model has been trained on a private information right so if I run inference on it I can there are certain set of inputs that I can feed to the model such that it outputs the private trading data does it make sense and if the such attacks are possible then private training does not make sense uh it only like you will have to add certain noise to your private inputs itself and the noise is is is it's a it's a concept from differential privacy like even if you're able to Output the private inputs it would have noise such that it cannot uncover users um yeah this yeah and so just on that note so let's say that there was we jointly train their private inputs and someone's trying to attach this model to getting a specific input supp to derive a pro it uh does the fact that it's encrypted in in any way make it harder or is it the same really okay it because the model is a model it's the same information right right it it Remains the Same um so yeah so I have on that so like you know MBC F this is called privacy preserving techniques preserve privacy it doesn't generate privacy so it can only as private as your original function right so if attacks on like plan model can be like uh done then attack using the same way in NPC can be done it's only as good as the original one it cannot be better it's lower yeah not good enough for us so for for like each of these paradigms right like I don't know there's there's reasons why like ZK has a very nice Synergy with blockchain right like the blockchain can act as a very simple verifier in that context um like how how do you all see these interacting with blockchain contexts or are these just kind of like extra partical things in thetive I know the C G and C something that would allow us to see cryptography into real world like outside the world that is other other than blockchains it it is not just limited to blockchains um um I don't know people are try to stuff with boxes as well but it's very hard to sorry uh it's just uh it's it's very hard to have a fi and NPC in decentralized setting you like Miss assumption yeah but I think maybe my question will be like a very particular subset of your question like there are certain architectural patterns in ZK that are uh partially enabled by blockchain like for example ZK itself it's proving um that there is an input that is satisfying the computational state statement but it doesn't prove that this is a real input right and for that we are using uh certain architectural um uh techniques like we need to commit to something we we have like a cryptographic commitment that is public most of the times we put it on chain into a smart contract and that's why ZK works very well with blockchain because we put the public commitment on chain and then we um when we're verifying um uh Zer knowledge proof we know that those private inputs that went into the proof they actually correspond to the public let's say public inputs or public outputs that were previously committed on Shain so are there like certain patterns uh in uh MPC F that are similar to the situation with ZK like what should we know about like if for example if I want to build my first um MPC or FH application uh What uh architectural patterns I should know um so maybe I can pick that up so so we are talking about like ZK integration with blockchain right you have a public commitment you try to like this is commitment of some secret data that you want so you want privacy using the ZK and blockchain right and then you try to update some uh update this secret value to a new value using some function right and then you committed again and so this commitment is now your new value and you can actually prove it using zc nobody knows what is the OWN value what is the new value they only know that you have perform the eligible computation on it and we should acknowledge this commitment from now on but then think about it right what is the kind of application that you can build using this patter you can only update your own data right suppose I have some data CC has some data we want to compute using our data right so that is where we can see the pattern Rising uh using MBC we can do some computation from our commitment so you pull your commitment I pull my commitment uh we don't need to know uh like what is a secret value behind because we just need to prove that okay it has to your commitment my value has to my commitment we do some computation we output the result and then you know like we can know like commit to the new value from your uh on your side I commit to to the new value on my side we can prove that there is an interaction between us using APC and then from now on uh when we submit this back to the blockchain together with some DK proof we can make sure that okay uh we have manipulate our secret data together and then these new values these new commitment should be acknowledged because they are verifiable so NPC 2pc uh or even fhe you can do that to a certain extent uh certainly enable this uh like broader application on chain yeah I think I I think I I I've heard like in say something similar about this like if you want a fully private loction you want to attach F to everything uh for example for a fully private V you want to uh send a to someone so you have a unknown like uh senders balance unknown receivers bance and unknown value sent so you probably need like probably you first need a ZK proof that you your unknown value has enough balance to send and then you have F and then your your your like result is accepted correctly so the sender value unknown but updated to no matter but it's aued correctly but and you know everything stays in private but like oh yeah so uh I think like uh you know there is this uh concept of fhe evm that uh so you just inp your your secret right and then put it on chain and then these validators they can run the function in clear for you and then change your change your input uh to a new to a new value using fq like uh but then like so they have this I uh I joined the disc Channel and ask hey so is is good that you can do this but what is the gas cost I didn't answer huh a yeah it's going to be expensive yeah it is it is but the current gas uh like the gas cost is kind of you know like specific Target for the consumer gr computer but with that F like you can do everything in a centralized party you no longer need a network right like yeah problem with FG in decentralized setting is the threshold assumption Mugu like you've got multiple parties you got stickers let's just imagine that you've got Akers right super strike each of them have secret shot for the distributed key generation now we cannot expect all the users of blockchain to stay alike to come online at the same time to perform this distributed key gener key generation operation so we want these nodes to be able to do that now these nodes can collude together to get the original SE and that is problematic because gentral like and that is the main B like of adopting FG evm probably because it's it's not as like unless it is n Out of n like unless it is multi party it is not as secure as C like it is possible for you know someone just like probably do just just show up next next day on a door get all the sters together and decrypt everything so and also like FG evm like EV model itself is now very old in sense of the light it is it is also not not very more suitable for CK as well um so yeah I I think that it is very much possible it is the just they are very unique applications that you can build with NPC and FG that would seep into our real lives like the applications that we daily use that would that would have Synergy with blockchains as well but ZK would still be an important thing FG would still be the important thing and FPC would still be important thing is just that you cannot replace the Privacy guarantees and decentralized that ZK gives you with FG F gives you a way to compute on encrypted data but ZK give you absolute privacy in dis setting it gives you an attestation of something that can be verified independently F works well with that like I can perform some computation with my friends and then decrypt it and produce a proof of decryption on chain so that if someone else wants to build on top of it they can do that so we here we combin F and ZK but F in itself in setting does not make sense Zin itself for applications do not does not make sense you need to combine these two things um and F evm by itself like in dcent setting it's somewhat scary because of threshold assumptions yeah so I mean uh in general right you want to BU some application you have decide what do you want what is the private features then you move on to Okay so which of these techniques that I'm going to use oh the there is no uh General answer unfortunately even for the people uh so what we usually do for these is that we pick one and we try to improve it right so this rather extreme uh so like it is going to be like Case by case uh what to use depends on what you have at hands if you have like a small computer uh you are far from each other so you have to rely on bandwidth then you can use g c if you have servers not so strong but you can put them close to each other right like University in this city uh well then then you can use uh Chicken Train because like like rout interaction and a moderate uh amount of bwood is not a problem for you uh if you have like uh big computer and you have a lot of clients then maybe you can use fhd because like DS are remove a lot of hle when you don't when when you have this a symmetry between like you being a giant and then you try to interact with some and right so it really depends on uh what what you want to VI and what you have yeah is there is there any uh indication about uh orc because we El so uh that's the so F andc has for the compation of p number or for or is there any indication about orc there the of the comp yeah uh so so the question is that I can see it is very hard to work with real numbers because because you work with un teers and you you have a b feel of4 most of the time um is there any similar limitation to F and uh MPC um I can describe you limitations and things that you can do with prob now can describe you the things that you can do with see do it look now uh yeah so like I think uh I can uh rephrase your question a little bit okay like uh so MBC M or some people they are usually very expensive okay so uh we want to uh leverage our application setting so that we can uh like be more efficient in using that tool so in the case that you describe you have like Artic computation and then you saying that okay has to be in a field but like being Inu uh like is very efficient for the current technology uh in there are different representations uh in using uh G circuit scrip sharing base or fhd for example in fhd you can have F number in U secret chain base you better have automatic uh representation in G circuit right now I think uh it is most efficient for buan um so yeah in m in f um there are several schemes um there's a scheme which allows you to work with real numbers so you can have floating Point operations and that is known as CS there's another scheme called t or few F the GW that allows you work with u small plane deex like 4 bits 5 bits of PL Tex and allows it to perform very efficient Bary operations like comparison maximum minimum and so on and so forth the tra between these two schemes is that so it is possible to have real numbers with TFG and sorry TFG and few as well but for that you would have to need very efficient like you would have you would need Hardware exploration and using C you can have you can work with real numbers um on CPUs but the problem with C is that uh it is it is not that suitable if you want to have deterministic competition like like if you want to retrieve something from a database or you want to perform of equality operations because it it works for real numbers and with real numbers you already have errors because of because of floating Point operations uh so you have different schemes for different things you can even switch from CK to TG as for your convenience but it depends on your application but I believe that as we as we move forward with all these things like as we have like for F this distinction between these two schemes would rather evaporate like it would go away and I believe that you can use VI and Bing schemes for most of the things because like GIC are just too fast and they can perform foring operations very fast um but don't like if it doesn't happen in 5 years this will come calling me back on this yeah if you guys things uh if it feels right for you to like move on to the next discussion we can do that but if if it's still have things to discuss let's continue we we can talk more things so do you think it's good to move on to the group discussion yeah uh so I think like uh we have uh discussed a lot about MPC FG right but uh let's get get back to the original goal so we want you to think about application uh the like perspective of an application Builders you may uh try to uh think about what you're doing if you're using ZK uh to want to upgrade that to NPC and what would be like the most interesting feature for you to work on so that is the purpose of uh what we are looking for maybe M can introduce more uh so I think later we will split into people we have right now like 20 20ish yeah maybe we can split into like four four table right there and luckily we have four Ps uh PSN member here to help today and maybe we can you know follow their view on how they decide uh uh to how how to op MPC and FG into their own project and take that as a starting point to think about how to like solve problem from that so maybe we can have uh Kevin Vivian Alex and CC have a quick introduction about yourself like one minute yeah and and then we can split into four groups and we just grap our seats and move into the table over there yeah and each group is side five people or six people and then and J will go through each table and give some give some advice or thoughts so maybe you can have Kevin first here Kevin do need microphone no it's fine perfect yeah yeah I'm I'm working on the stats which is a platform that allows data providers to share the statistic inside to the users so user can Define their cation and send it to the St providers and ask for some statistic results like me median and um others and without sacrificing the the Privacy yeah and we we moving on supporting FPC as the next step and maybe F in this uh as a next as well so um yeah and we can discuss more later and if you want to um talk in Chinese or and you can join as well I mean yeah thank you hi I'm I'm also found PS and I previously my project more ZK Focus it's called it's a ration protocol and now I'm working on mobile proving system which is also right now it's for ZK Focus yeah um yeah but I have some understanding about MBC and F so if you want to discuss about the application about MBC F or you're thinking about if the case not enough for your application you can yeah talk to me yeah but if you have you you need deeper uh explanation of npcr you can just uh ask uh J and and yeah thank you thank you