 Thank you for the introduction and sorry for today, and this talk is about the method to control the homogeneic reaction for oproximate arithmetic, and sorry, okay. How can I... I think it's a USB thing, right? It's quite essential. Maybe. Okay, and okay. As introduced in the previous section, homogeneic reaction is a grid system that allows arbitrarily computation between grid data. So after the first construction of pre-homogeneic reaction in 2009, theoretically arbitrarily it can be evaluated in a polynomial time using pre-homogeneic reaction. But still the performance of homogeneic reaction scheme is an open problem. So let me ask some questions first. So can you compare the significant digit to the product of 32 integers? Or did you guess how long did it take to reflect 1,000 protein points numbers? So it would be very great if we could say yes with confidence. But unfortunately it's not true yet because of some limitation in homogeneic reaction. So basically current homogeneic reaction scheme supports two operations, audition and multiplication. But if you think about just using a reflection point operation, the rounding operation makes a key role in efficiency. So the use of significant digits makes a kind of trade-off between precision and efficiency in the sense of size of big storage and computational cost. But basically the rounding or the instruction of the most significant digit is not represented by a polynomial with a similar degree. So that was the main obstacle to use homogeneic reaction of the real data. So the first approach, we can think about V-twice encryption and express every circuit with just boolean circuit using base gates. But only for just one single multiplication with e-commit integers, single multiplication will require a circuit with linear depth already. So it is already in practice to perform some one single multiplication between 64 bits numbers. So in this area, it is very common to consider some bit-wise encryption and just bootstrapping by damele and tucca and nichen shu and e-sparling works, but still its complexity is obtained by base bootstrapping time multiplied by number of bits. And normally it is much more than one minute. So I think if one multiplication requires more than one minute, then you cannot say that homogeneic reaction is practical. So the second approach is just word-size encryption. So if you are given some real numbers, you can just quantize them into some integers and encrypt them in a single cycle text. But if you encrypt them in a single cycle text, then the rounding operation cannot be performed on encrypted data. So as a computation progressed, the size of plain text grows exponentially on the best of circuit. So consequently, finally you cannot store this huge number in plain text space anymore. So there have been some researches to reduce the speed of growth of plain text size, but basically they could not solve this exponential growth of plain text size. So in this talk, I want to introduce a new method to construct homomorphic encryption with three operations, audition multiplication and rounding operation. And we have a new idea to enable batching technique to encrypt a better of complex number in a single cycle text. And I'll show you some implementation research based on that. So the first idea is to embrace noise. It means that previously the encryption noise problems on ring running in the error problem, for example, was considered to be unpassable and plain text was stored in a totally different place. But why don't we just add this encryption noise directly to plain text? Of course, we cannot recover the exact message from its encrypted cycle text, but in the case of approximate arithmetic, if e is small enough, then m plus e is a kind of food approximation to original message, and e can substitute the original message in following computation. So our encryption, our cycle text will be a vector with this kind of encryption structure. Homomorphic operation is done in cycle text modulus. So the size of the message will be very smaller compared to the size of cycle text modulus. And audition and multiplication is performed inside of modular. Of course, we have some more error coming from e-seaching technique, for example, but it doesn't matter because a small error will not destroy your signature digit. So first, this idea reduced the size of cycle text modulus already, but it is not enough because its size of plain text still grows exponentially. The second idea is called rescaling process. So as I said, the rounding operation is key operation in protein point operation, so rescaling process does the similar thing on encrypted data. Technically, it's just divided into cycle text by p and rounding to the nearest integer, but inside of cycle text, plain text is together divided by p. So you can obtain an encryption of p and divided by p from an encryption of n while the cycle text modulus is divided by p together. So you will have a kind of level structure homomorphic encryption. How can you apply this idea to real, real number operation? Assume that you are given these four real numbers. So first, let's multiply 1000 as a quantization value to obtain these integers, and after encryption, you will have some more error on expected values from encryption toys, and after multiplication, you can perform rescaling and maintaining the size of a signature digit, and multiplication again and take rescaling. After that, you can assume two levels of homomorphism encryption while maintaining the size of messages. So finally, you will obtain this value. If we again divide this value by quantization value 1000, then you can check that this diagram commutes. So multiplication of these four real numbers will be this value. The good point of this level structure is that the required size of the cycle text modulus is close to linearly on death, and it's pretty reasonable in the messages. Okay, now let's talk about this technique. So the use of ring structure, such as cyclotomy ring, is the essential point in the practical implementation of homomorphism fusion in real world. All of the current dimension of homomorphism fusion uses this kind of ring structure. So in the previous scheme, such as BGV or FOV schemes, they had a kind of plain text modulus tip. So a plain text was polyomere inside of this cyclotomy ring modulus tip, and this cyclotomy ring could be represented as a product of several rings because the cyclotomy ring could be expressed as a product of several renomere. So this CRT function gives you natural matching table. You can store several messages here and compute inverse of CRT if you need to obtain corresponding renomere stored in several messages. But in the case of our scheme, we don't have any plain text modulus of CRT. So a plain text can be considered to be a small polyomere in this cyclotomy ring structure. And as you know, this cyclotomy ring is used over a integer. So this kind of mapping cannot be applied to our scheme. Instead, we consider another extension of z. So z has characteristic zero. So by the way, this extension of integer z over characteristic zero space is a complex plane. So this cyclotomy renomere can be split into product of linear renomere with its loose or primitive loose of units in complex plane. So you have n number of roots, but we can find two of them. We can pick half of these n roots so that none of them are conjugated because arbitrary roots of this polynomial have its conjugation. These conjugations are also loose. So we can pick non-conjugated primitive roots of unity and send an arbitrary polynomial to its evaluations at this chosen n over 2 number of points. So let me show you one example. So for simplicity, let's consider a power 2 case. n is a power 2 and cyclotomy ring becomes x to the n plus 1. In this case, 5 is one good element with the older n over 2. So you can just pick representative evaluation points like this. So if you want to encode these pair of complex numbers, then you can first find a polynomial such that using inverse discrete transformation to find a polynomial with this value when evaluating zeta 0 and with this value when evaluating zeta 1. And then we may work like some scaling vector and round into the integral polynomial to be used in real homomorphic inclusion scheme. So this is a final encoded polynomial. You can double check that if you evaluate zeta n to the fifth polynomial, then the result will be a really close value to this value, multiplied by scaling vectors. And I show you some additional functionalities of this scheme. So basically mx is corresponding to this vector and you can gain some good functionalities if you apply some element in Gallup group. So if you consider this cyclotest by substitutes x by x to the fifth, then this cyclotest will be a cyclotesting gradient, this polynomial with respect to this gradient. And you can find that if you decode this polynomial into vector, then this vector will be obtained from this vector by just rotating once more. So you can rotate the inner cyclotest vector by once more using key switching key and you can take slow-dice conjugation also by taking x or your inverse. So as a summary, you can store almost n over 2 complex numbers in a single cyclotest and perform addition, multiplication, and rounding in a sequence test. So you can set the amortized time for rotation and give a lot of rotation and slow-dice conjugation. So now let me show you some example and implementation research. Sigmund function is one very popular function used in statistics and machine learning area. So once we try to make a global approximation on Sigmund and evaluate it remotely quickly. So for example, when the input precision is 16 bits, the use of D27 polynomial gave us very good precision and at error less than 0.03. Sigmund is just one example, so we can use our scheme to evaluate arbitrary analytic functions, including exponential functions and trigonometric functions. And in particular, in the case of white pre-cutting inverse, white pre-cutting inverse has a very special form of a Taylor decomposition with power of degree. So we can compute the 2 to the n bits of precision of white pre-cutting inverse with very small complexity. So this is about IDIS competition. So IDIS competition is one on-year workshop about data privacy. So normally IDIS genomic security and privacy protection competition is called together with IDIS auction. So this year, the third test code this year was homomorphically based resisting regression. It means that you are given many samples of genotype and phenotype data with patients and health people. And you should compute some modeling vector to predict this is a good new client. In this experimentation, we could compute the modeling vector of resisting regression using based on more than 1,000 samples and running time was about 10 minutes with very good accuracy. AUC is one measurement to see the quality of results. The ideal AUC was 0.71 in the case of an uninterrupted computation. And we could achieve 0.69. These days, the standardization of homomorphic encryption is ongoing. So the second standardization meeting will be at MIT in the next year, March. And our library was introduced in one of these white papers written in the last workshop. And you can find our open source library from this other resource. Okay, thank you for your time. That's pretty on show. The entity to represent your complex value? Yes. And so can you say you work with the entity with point data value? The use of entity cannot be applied to our case because entity is a function of a discrete space. And if you take entity over some small polynomial, then the size of a polynomial grows so much because entity is a function of a small polynomial. Oh, so you will do this? Yes, so I mean, the previous, of course, our message inputting method can be understood kind of spirit information, but it's over continuous numbers. Difference from previous work was on modular space, like modular space. So, is it right? Any other questions? Okay, if there are no other questions, let's thank the speaker again. Thank you.