Lecture 8 — Cryptography for ML

(a)  one ciphertext, under the hoodPick m and press encrypt: a fresh uniform a and a small error e are drawn, and the ciphertext is (a, a⊤s + e + Δm) mod q. The dial shows b − a⊤s on the ring ℤq: it lands in slot m, pushed off center by e, and rounding recovers m exactly while |e| stays inside the shaded ±Δ/2 window. Encryption is randomized, as it must be: encrypt the same m twice and the ciphertexts share nothing visible. Under LWE, (a, b) is indistinguishable from uniform — which is the whole security proof in one sentence.

m9
–

(b)  computing on ciphertexts: the noise budgetTwo encrypted registers; every operation is performed on the actual ciphertexts of the toy scheme. Addition adds errors — cheap. Multiplication replaces them by m₁e₂ + m₂e₁ + e₁e₂/Δ + erelin, so the bar climbs the log scale with every level of depth. The moment |e| crosses Δ/2, rounding snaps to the wrong slot and decryption really does return the wrong value — watch the register go carmine. Bootstrapping homomorphically refreshes the ciphertext back to a fresh error, at a heavy cost per refresh; that is what buys unbounded depth.

m₁3
m₂2
–

(a)  oblivious transfer from the LWE schemeThe receiver holds a choice bit b and sends c = Enc(b) with a few encryptions of zero; the sender — holding m₀, m₁ — returns d = z + (m₁−m₀)·c + Δm₀, computed homomorphically on the real ciphertexts, with z a random-subset sum of the zeros that rerandomizes d. The receiver decrypts exactly mb. Flip b and run again: the sender’s view is a ciphertext either way, and under LWE no efficient test tells which bit it hides — the receiver learns one message, the sender learns nothing.

sender holds
receiver's bit
–

(b)  one NAND gate from two transfersThe inputs are XOR-shared: x = xA⊕xB, y = yA⊕yB, so xy splits into four products. Each party computes its own term; the two cross terms each take one OT — A offers (r, r⊕xA) and B chooses with yB, leaving the two holding random shares of xAyB. XOR everything, flip one share, and the parties hold shares of NAND(x,y) — which is complete for Boolean circuits. Press new sharing: every intermediate bit changes, each party’s view stays uniform, the combined output never moves.

inputs
–

(a)  secret-key PIR: read a record, hide whichThe client preprocessed the 16-bit database as x̂ = Dx + r with D = [I; D′] and kept (D, r) secret. To read bit i, it samples a codeword c orthogonal to D and sends q = ei + c; the server returns the single bit q⊤x̂, and subtracting q⊤r leaves exactly xi. Switch to the server’s view: thirty reads of the same record, stacked. Without noise their pairwise differences span the secret code, and a rank computation names the record — the leak the lecture warns about. Add the LPN noise and run the same attack: the span explodes to everything and every index looks equally guilty. Noise is what the security stands on; the full construction corrects it through redundancy.

view
index i7
–

(b)  the search pipeline: EMVP, then a small top-kThe server holds the preprocessed matrix M̂ = MD + R; the client sends q̂ = c + q̅ for a codeword c with Dc = 0. One plain matrix–vector product gives M̂q̂ = Mq + Rq̂, and the client — holding the trapdoor for R — strips the mask: every entry of the recovered column equals Mq exactly, checked live. All the server ever touches are M̂ and q̂, both pseudorandom. What remains is the small non-linear step: the top-3 scores are selected and only those indices surface — the big linear algebra at near-plaintext cost, generic 2PC saved for the comparisons.

–