 Okay, so the next talk is on robust coin flipping at Jean Kopp and John Wiltschelgorten. Hello everyone, I'm John and my co-author Jean Kopp is here in the front row. We're graduate students at the University of Michigan. And I'm here to tell you about robust coin flipping. So I'll start with kind of the canonical example of robust coin flipping. So it starts... I don't think that works. It starts with the sports match where Alice is the official and as is the custom, the two captains from the red team and the blue team shake hands before the match and then each one gives Alice a coin. Alice flips both coins and then checks the results and exores them. After she does that, they determine which team plays offense and which team plays defense. So just to recap, the red coin and the blue coin could either be heads or tails. This leads to four possible combinations. Alice exores them. This gives a mixture coin, which is purple. And then we ask, what is the probability of heads in this situation? So if the red coin is fair, but the blue coin is actually unbalanced in some way, it doesn't matter, we still get a fair coin for the purple coin. If on the other hand, the red coin is messed up a little bit, but the blue coin is still fair, once again, we still have a fair coin for purple. These are the same two equations, but I've written them with matrices because that's the notation that we're going to use to generalize this. So the real important operator here is this middle matrix, which we're going to call A. This matrix represents XOR, as you can see. And the idea is that once you think of using XOR to solve the problem, you have found a robust scheme because it's defended against either coin being ruined. And so the idea of this talk is that it's looking for A that matters. Once you have A, the rest of it is easy. So this leads me to the philosophy of this talk, which is a general thing. You begin with a natural cryptological problem, and in step two, you restate the problem in terms of multilinear algebra. So you see if you can ask your problem again by saying, does there exist this particular multilinear operator? And if such an operator exists, can I find it? And step three is you can then draw on a wide variety of techniques in algebraic geometry to try to actually produce such an operator or show that it can't exist. Either way, you have a result. So now on to the robust coin flipping problem. This problem is a fun problem. It actually originates in a paper of Andrew C. Yao. But the point is that the techniques we use to solve the problem, I hope to convince you, they're serious techniques and they're practical techniques. And they may even have applications in your own work, especially if you use tensor products. So here's the official statement of the robust coin flipping problem. Alice has P programmable random sources. Just a word about what I mean by programmable random source. It's a little machine. Alice will give it a finite list of real numbers. The real numbers add up to one. The machine interprets this list as a finite probability space. And then Alice can use the machine to sample that finite space. So this is slightly different from the example at the beginning. Alice is now able to program probability distributions into the coins. Okay. Q of the coins are actually faulty. And we assume that some adversary has manipulated them. So they may even be dependent on each other. Luckily, R of the coins are reliable. And of course, the two types of coins are indistinguishable to Alice. Alice's goal is to generate a coin flip that is heads with probability alpha and tails with probability one minus alpha. Of course, being able to simulate this sort of coin flip is enough to then simulate any finite probability space. You can just build a tree or something like that. Okay. Here are our results. This table summarizes all the possible combinations of fair and unfair coins that Alice might have. I mean, reliable and unreliable coins. So if she has R reliable sources and Q unreliable sources. So the first case is when Alice has no reliable sources. Now this is a very sad case for Alice. And in fact, we see that it says that's a two element setup there. If Alice is trying to simulate a coin and she doesn't have any reliable sources, it's either the all heads coin or the all tails coin. If she wants it to be a robust simulation. On the other hand, if Alice has all of her sources, all of her sources are reliable and she has at least one source, then she can just pick any of the sources and program in the two point distribution alpha one minus alpha. And then that will generate a robust coin flip. In this next case, we see that the reliable sources do not form a majority. In this case, the best Alice can do is actually to simulate coins which have a rational probability of heads. And in the remaining cases, we show that only algebraic numbers are possible for alpha. So notice that the entire table is filled in now. So this is the strongest possible result. Okay, now I'm going to begin by proving a little bit. Everything below the top purple strip, Alice can at least obtain every rational number. So we say alpha is maybe the ratio of two integers A and B. Now you've probably already guessed how she can robustly flip such a coin. So she just takes the denominator B and programs in the uniform distribution on B points into each of her random sources. She then queries the sources and interprets the results as elements of the finite group Z mod BZ. Then she adds up these elements and checks to see if it's inside the set with cardinality A. This has probability A over B of occurring because if even one source is reliable, that one source evens out the distribution on the other ones. This is, of course, a generalization of the XOR construction we saw at the beginning. XOR is just addition modulo 2. Okay, now I'd like to prove the other direction. So let's say Alice has two random sources and one of them is reliable and one is unreliable and she doesn't know which one is which. Now I claim that every alpha she can obtain is actually a rational number. So this is the other direction. Just to remind you, these are the two equations I showed you earlier. They assert that this scheme is robust. Here's a lemma. The bilinear form A, which is this middle matrix, has at most one associated value alpha, in this case one-half. Well, in this case, what that's saying is that if Alice has already decided that she's going to use XOR to simulate a coin robustly, then that coin actually has to be a fair coin. It has to be one-half. And more generally, if alpha already has some big fancy 0-1 matrix in mind, there's only at most one alpha that could be associated to that matrix. This is actually a very easy lemma to prove and I invite anyone to give it a try. But immediately after we get a corollary, which is that alpha has to be a rational number, and the proof is Galois theory, because A is a 0-1 matrix and is fixed under any field automorphism of the complex numbers over the rationals. And as a result, if we had two alphas, which were Galois conjugate, both of them would be associated to the matrix A, but we know that A can only have at most one, and therefore all the Galois conjugates of alpha have to be the same as alpha, and alpha has to be rational. So I'd like to point out that just by changing our formalism to talk about bilinear forms, we get a decent amount of mileage, and it's all very easy to show. So I'd like to follow through with the promise I had in the philosophy slide and recast the whole problem in terms of multilinear algebra, not just bilinear forms. So here I've done the case where Alice has three sources and one of them may be faulty. Then the question becomes, can we find a 0-1 hyper matrix and probability vectors beta i? The probability vectors are the vectors that she will program into the random sources. So that the probability is alpha, even if we use the wrong distribution in the first coordinate, which is to say the first source is messed up, or if the bad distribution is in the middle coordinate, or even in the last coordinate. So now I'll give an example of a solution, an example of a trilinear form which satisfies those constraints. Here's Alice's new algorithm. This is a bit more complicated than XOR. And now we see that Alice programs in the following three distributions. Each one of those vectors is a probability vector, you can check it, the sum is 1. And what Alice will do is program in those three distributions, sample each of her three random sources, and this will effectively give her the coordinates of one entry of A, which will then either be a 0 or a 1, and then she can decide heads or tails. And so the claim is that this robustly simulates a coin flip, which has the probability of heads is the golden ratio. So just a comment about this construction. Whereas when we did XOR, that's kind of a construction we've all seen before, and you can imagine how XOR is going to work. This is an example where it's not that way. We start off with the golden ratio as something we'd like to obtain, and then we have to use something stronger than just thinking about XOR to find a solution. And of course the way we obtain the solution is with a computer. We program in the equations I showed you before and see if it can find vectors that satisfy those constraints. So I guess the upshot of this slide is that sometimes you can think of a tricky solution using XOR, but other times you should use a computer to see if you can solve for Alice's algorithm. One thing we notice about this solution is that all the numbers here are algebraic numbers, and so the question becomes, is alpha always an algebraic number? So I'm going to sketch a proof, or at least a proof idea at the beginning. So we start with these conditions on the hyper matrix A. Well, this is one of the three conditions we have. You can imagine the other three conditions. This condition says even if the first random source is wrong, at least the other two will be able to keep the probability at alpha. So we manipulate a little bit. Here J stands for the all ones tensor, and anytime you put in probability vectors into the all ones tensor, you always get one. So all I've done is multiply the left side by one. So that's fine. Subtracting, we have some sort of condition, and writing it down the two other ways, we see this is some sort of degeneracy condition on the hyper matrix alpha J minus A. And it's also reminiscent of a degeneracy condition we've seen before, which describes eigenvalues and eigenvectors. And so by analogy with that case, we'd like to say something like the determinant of alpha J minus A vanishes, since that's how we usually talk about degeneracy. Of course, alpha J minus A is a trilinear form, and so it's given by a three dimensional hyper matrix. So it doesn't actually make sense to talk about the determinant. So anyway, we'd like to salvage the proof. So we need to consider these degeneracy conditions a little more geometrically. So I'm going to draw the biggest case that I can still put in three dimensions, which is the case from the beginning with Alice at the sport match. So imagine, if you will, the space of all two by two matrices where the entries sum to one. This forms a three dimensional simplex, and with four extreme points. The four extreme points are the matrices where there's a one in one entry and zeros elsewhere. Those are the four extreme points in this picture. Now in this picture, the saddle represents all the matrices of rank one. These are the pure tensors. A point on the saddle represents a pure tensor, which is to say a pair of vectors, and then the outer product will be the matrix. So in the algorithm from the beginning, Alice programs in the uniform distribution on both coins, which in this case corresponds to the all one quarters pure tensor, which is located at the centroid of the tetrahedron. Now the fact that the XOR algorithm is robust says that even if one of the coins is off a little bit, you still get the algorithm to work. So that provides a line. If it's off in the first coordinate, that provides another line of places that work, a line emanating from this orange point. And if the second coordinate is correct, that provides a second line. Now those two intersecting lines define a plane, and so we draw on the plane. And the fact that those two lines lie in the saddle is equivalent to the fact that this plane is tangent to the saddle at that point. Now this is good, because this is a geometric condition we can work with. So restating it, it says the hyperplane defined by alpha j minus a vanishing is tangent to the variety of pure tensors at the point which is defined by the distributions that Alice has to program into her random sources. Now this brings us naturally to the subject of projective duality, because projective duality says that if you take a variety and look at all the hyperplanes which are tangent to it, the hyperplanes actually form a variety themselves. And in this case we're lucky, this dual variety has been studied before, and it's actually cut out by something called the hyperdeterminant. And so in fact, the determinant we wanted to write down before should just be replaced with the hyperdeterminant, which is a generalization of determinants, which also works for, you know, thicker tensors than just bilinear forms. Okay, and so it looks like we're done, because we were trying to show that alpha is an algebraic number, and here we've found a polynomial that alpha satisfies. Unfortunately we're not quite done, and that's because this polynomial may vanish identically as a polynomial in alpha, in which case the only thing it's telling us is that 0 equals 0. Luckily there are standard techniques in algebraic geometry for handling this, and basically what you do is you take the derivative of both sides and obtain new equations. This is akin to L'Hopital's rule from calculus. Now, more technically speaking, we take this singular stratification of our variety and say we want the betas to find a smooth point on this variety, but it's essentially the same. Okay, in the next direction, we've shown that alpha has to be algebraic, but can we obtain any algebraic number for alpha? And so the crux of the construction rests on the case when Alice has three random sources, and one of them is faulty. And we do the proof in two steps. I won't show the proof to you, but we use algebraic geometry to find a point on the suitable variety, and then we use trickiness to try to move the point so that its coordinates are actual positive numbers that can be programmed into probability distributions. Now, the first step of this proof is very rigid. You have to get it right on the variety, because nothing will be robust. But once you're on the variety, it's not so hard to move the point around if you can think of things to do at that point. Once we've completed the case where there are three sources and one is faulty, we bootstrap up to the general case using something called the bureaucracy lemma. The bureaucracy lemma just says that if you have ternary majority gates, you can actually build any majority gate. And the proof is the probabilistic method. You just use a complicated enough circuit and you obtain... So this is an example circuit with five inputs, and it should return true if any three of the inputs are true. Okay, now the final thing I have to show you, we'll see if I can get it here, is there's another geometric interpretation to these constructions, and that interpretation realizes an algorithm for Alice as a sculpture. So here we see a sculpture. Imagine this is a zero-one matrix. We fill in a block with stone if it's a one, and we leave it empty if it's a zero. Now, as you can see, along a single dimension, we change the widths. Or along... Well, if I play it again. Or if I change the heights. The thing that stands constant is the volume of the sculpture. So in fact, saying that the volume is not changing as the mass isn't changing as we perform these manipulations is equivalent to the degeneracy conditions I put up before. It's the same thing. And so this was a two-dimensional case, but I actually made a video of the golden ratio sculpture that I had in the middle of the talk. Here it is. So it's a zero-one hyper matrix. So it's three-dimensional, and we see the widths changing, and now the heights are changing, and now the other widths will start changing. But at all times, the total mass of the sculpture is the same. And that's the same degeneracy condition as before. So to recap, and this is the takeaway I want you to have for the talk, is that the algebraic geometry of multilinear operators is a very powerful tool, and it can be applied to cryptological problems in a serious way. And we'll give you an opportunity to go make some new friends in the algebraic geometry department of your local institution. So thank you. Any questions? Okay, once again, thank you.