Thank you very much for the good interest.
Again, I'm Dio, I work at TikTok in the US and I work on this project.
So today I'm going to, this project is more closer to the application
site where like other talks are focused on like how you enable T and
like VMs and all that.
So it's more like a higher level application.
How we're going to use computer computing in, you know, real work.
So let me get started.
So this is the whole content so I'm going to start with why we need the
private data analytics and why it's hard.
And I'll talk about our project and also include some demo.
So private data analytics.
So why private data is so important.
So everybody will agree that it was very good for value extraction.
Like personalized contents or, you know,
training the recommendation model for better recommendation and so on.
But not many people talk about public interest.
So I'm going to focus on the public interest case.
So sharing private data, if you see, it's actually really, really important for public interest,
especially public health.
Some researchers want to use medical data, personal medical data is very,
very strictly protected or personal health data collected by personal medical devices.
Or for public safety, even very, very strict private data like PII, like personal address or
for number, they can be used to identify some public safety issues.
Like if they're associated with crimes or illegal activities.
Education, personal academic performance, like their scores or attendance,
and their engagement information, or the combined
in combination with some public, sorry, private data like address,
can be used to find out some correlation between academic performance,
and people like where they leave or their background and so on.
We're civic engagement, personal beliefs or social activities,
how this kind of personal beliefs affects the social activities of personal and so on.
These are not the only examples.
So to give a very concrete example, one of the research that was published in CCS last year
is to understand illicit drug promotion by using cross-platform data.
So the what research did was that they used,
they figured that there's a pattern in illicit drug promotion promoters.
So how they do it is that they basically use the cross-platform referral traffic
to draw people into their drug-doing promotion,
but without getting detected by their moderation,
by using some, because it's very hard to detect this kind of cross-platform,
because either YouTube or Instagram, they will have their own data,
and they have to determine based on their own data.
In this case, they were able to identify those kind of cases by leveraging both data
from different organizations.
Another example is there's a very big initiative in a UK called HDR UK.
What they're trying to build is a trusted research environment,
where they want to combine all the medical data from the health providers
to a little public researchers to get insights from those data.
Yeah, these are examples of the efforts to provide access to private data for public interest.
But why is it hard?
The first challenge, of course, the data privacy risk.
There's a trusted issue, because a lot of entities might have conflict interest,
like YouTube and Instagram, they might not want to share their data to each other.
This go with using data fabrication.
Even if you're claiming that your benign researcher is still possible
that researcher do some things with the private data that they have never promised to do,
like tracking some private information of the data and so on.
And there's another issue, which is different, different trust domain issues.
So, a lot of time data is processed in a different place from different places
that is not owned or controlled by the data owner.
This is especially true when you deal with the trust domain,
and there's a big compliance issue.
Apart from the security issues, you still have the condition to the security.
You definitely need to protect the data.
In addition to that, you have to keep all the privacy policies enforced,
such as data retention or purpose limitation of the data.
And providing the raw data might not legally alert in some countries or in some areas.
And also changing the geolocation of the data or formal data could be also legally restricted and so on.
The second challenge is that nowadays the data is distributed across multiple places,
even for a single organization, you can think of it.
In the old days, the organization, if they own the data, they will have the data in their own servers,
they manage and control.
But in these days, this is not true because they often delegate the data to the third party,
data warehouse, like software or data breaks,
or maybe they can even store it in some cloud provider resources like buckets.
And also the compute exists not only in the organization's servers,
but also in the cloud provider, like they've owned the workload in the GCP or azer and so on.
So it raises the challenge about accountability and transparency.
So when things went wrong, like let's say there's a data breach happen,
who's going to take the responsibility.
It's very hard to determine what calls the breach and who's going to,
it's all about the accountability.
And also it's very important to make it possible to verify every single data transfer,
every single processing of the data in the compute notes.
That's what we need.
So we concluded that we may need a standard way that provides a strong privacy protection mechanism,
using various PTs.
And also not only this mechanisms exist,
we also need to enforce that technically.
So terms and conditions to the researchers are sorry researchers, not enough,
you know, it cannot prevent them from abusing the data or violating the privacy policies.
And we also need to have accountability and transparency,
so we need to be able to provide a tool to the data owners
that they can confidently audit or verify what's happening with the data.
And finally they're usability.
So with all these guarantees, you should not sacrifice the results.
So some PT technology sacrificed the accuracy of the results for the sake of the privacy,
but this was not our requirement when we designed this system.
And in addition to that, we wanted it to be very, very easy to deploy,
and very, very easy to use, and also very easy to customize.
So there are existing solutions already when we exploit these problems.
So one is the data clean room.
So in the industry, they're already using this kind of call,
a framework called data clean room,
where you basically define the policy on every single single statement to,
you know, define who can access which table, and who can query which kind of query and so on.
And it's operating in some third party that has no confidence on interests or anyone in the data,
anyone who owns the data.
The second option that we thought about was a differential privacy,
the differential privacy actually pre-processed the data,
or add a noise to the result of the aggregated SQL to limit the information leakage,
theoretically limit the information leakage.
The final option was cross-experiment environment.
So we kind of assess the processing concept, which of the techniques.
So first of all, SQL power space data clean room.
Although they provide a very good usability, they allow researchers,
they allow users to query anything on the data,
and they provide very high accuracy.
They necessarily feature to technically enforce the privacy policies.
Also, they often miss the privacy protection in general.
The differential privacy on the other hand provided very well-defined technical guarantee on privacy,
but it kind of sacrifices accuracy.
So traffic is executing environment on the other hand.
It not only provides technical enforcement and high accuracy,
but also it can provide some transparency in terms of accountability that I mentioned before.
One issue is that the usability of it, so I said it could be better.
By that, I mean, for the, this type of data analytics,
we figure that cross-experiment environment is very, very hard to use,
because of the way, the analyzer data, the analyzer data doesn't match with the model,
that cross-excusion environment deals with the workloads.
So let me, let me talk a little bit about that later.
But that's why we decided this project humanity.
So to this end, we built the framework with the following goals.
First, technical enforcement on the privacy policy,
policy via various PT technologies,
and just secondly, you wanted to be usable,
so we wanted to provide an interactive tool to utilize the data
and third, the accuracy, we should not sacrifice accuracy
for the sake of anything else,
and then, finally, the transparency and accountability.
Oh, actually, last thing is the deployment.
We wanted to make it easy to deploy into the cloud.
So these are our design goals.
So one of the observation that we saw is that
the data analytics actually happens in two stages.
One is programming stage and the other is execution stage.
And each of the stage has very, very different requirements.
So in the programming stage, usually,
you only need very small data set and very small amount of compute.
You don't need like a thousand GPUs or something.
And it's better to be very interactive,
because when you program, you usually try some code with your data
and play with the data to get some initial insights
before you want to do the full analysis.
But because of that, it's very hard to control the data.
Researchers or users, they can do anything with the data,
and it's very hard to control.
So it has a very high privacy risk.
On the other hand, once they're done with the programming,
they are actually able to run this very large batch
on the larger data and compute.
And it's only happened once after you program everything
and you make sure that it works.
Just have to run it once to get the final output.
And this stage actually is easier to control the data.
Also, it has a little privacy risk because of that.
So the approach that we took is that,
actually, why don't we separate these stages and focus on
different problems in each of the states.
So for the protection of the execution stage where you run
this workload in large batch on our actual data,
we can use the Confession Computing.
And for the programming stage, we can use other PET technology
that has different trade-offs.
Like synthetic data is one of the examples you can use
differentially private synthetic data to mark the actual data.
Like has a same statistical characteristic,
but has no risk of privacy leakage for example.
So that's the basic idea.
And the benefit of this is that actually,
what you're doing is actually separating the data
policy and code policy.
So you can choose the, you can flexibly choose
the data policy on the programming stage.
You can either use LDP perturbation or sample data
or DP synthetic data.
Whatever the data on it wants to protect the data privacy
with the budget that they want.
Where they still can, although,
users to get the accurate result in the execution stage.
And you can enforce the call policy on the execution stage.
So we'll get accurate result on the execution stage
because it will run on the full data set,
which is securely enabled by Confession Computing.
And specifically why Confession Computing is very useful here.
So first is, it provides transition,
transition of trust making your work with various trust model.
For example, cross organization data providers, as an example,
you don't have to not all the data providers
may trust each other.
In this case, you can transition this execution to the cloud
and then who has no conflict of interest
and run the workloads there without needing to complicate the trust model.
And in particular, if you have execution, of course,
is guaranteed by the Rotate Station plus the trust execution environment.
And also one of the very interesting things that we found
is that the attention and report could be also used
to prove that it was executed in a legitimate environment.
So why this is very useful in our use case is that
the scientific research evaluation results
often needs to be reproducible,
but without having them reproduce the entire research,
you can just provide a testing report and say that,
okay, this is the script and this is the output provided by this
clip on a certain environment.
And this could be just proof of the experiment
and the proof of the integrity of the evaluation, the research.
This is the Manatee Data and Code Pipeline.
So we use a Jupyter-Hop to provide a Jupyter-Hop
into Jupyter Lab interface to a user,
and user can actually interact the API using the
Jupyter Lab extension, and then the data access
through the data SDK, which will access different
data at different stages.
When the API suddenly gets a job,
it will schedule this container in the executor park
in a T-pack and we made it flexible
that such that you can choose a different T-pack and,
like, depending on your needs.
It's very easy to deploy this via the platform,
it deploys in the Kubernetes cluster,
either in GCP or in MiniCube,
and it will leverage some of the cloud resources if necessary.
So here's the use case that tick.
So a tick though we have the same exact problem,
because we have to provide the data
to the public researchers to provide a transparency.
And we have launched T-pack have launched a product called
VCE based on this solution,
and it was built on top of the open source.
There are other potential use cases, obviously.
We're exploring, and then I'm going to quickly show the true demo.
So the demo shows that we saw from the insurance charts
data set from Kaggle and it's open data set.
And the task is, we want to train a model that predicts
insurance charts based on, yeah, based on the data.
And then we use the differential,
private synthetic data in first stage.
We provisioned that.
Let me show the video.
So in the Jupyter Lab interface,
you can create a notebook.
And then you initialize the environment.
And actually, you can import the data SDK,
and initialize the data SDK.
Then with the data SDK, you can access the stage one data,
the raw data.
And then you can actually explore the synthetic data
by printing out some correlationship, hit map,
and also other things.
And once you're ready, you can submit this job to the second stage.
And then it will go to the API,
and you can see that the image is building.
So we'll build the back end, we'll build the image,
the container image, and once the image built,
it will schedule it to the container.
Sorry, the key back end.
The key back end we're using here is the confidential space.
So you can see once the VM finishes,
you can download the output, and then the output,
and the output, you can see the results from the real data.
So here, the output privacy is not guaranteed,
but you can add additional staff in between the download output
to make sure that nothing, nothing private goes out from the output.
This is about the code policy.
And let me skip this part.
So, sorry.
The later part will do the execute boost
to train the model.
And then the testing report, you can download the autism report,
and show, see, you know, this is the autism report
from the Google Conference space,
and you can actually verify the signature,
as well as comparing the output hash
that is in the autism report to, you know,
prove that this output was in the generated by this script
with the certain hash in the,
let's make a confidential space environment
with the, with the SCV enabled.
So, yeah, let's pretty much it.
So the project, I only have one minute, so, yeah.
Actually, you can try this out.
The fully open source, you can locally deploy the mini-coup,
and also try, although the mini-coup version
doesn't really use a TE, you can still try the interface.
And you can actually follow the tutorial to reproduce
or a shown here in the GCP.
If you have a GCP account, you can try that.
And we're collaborating Google on this project,
and it's always joined us for more collaboration.
Yes, that's nice.
Thank you.
So, we can move in and out, but we can have some quick UA,
but we speak a little bit, so we can hear you while a lot of people
move in and out.
Yeah.
And I'm pouring like in a TE,
we have to run a constant time code,
or essentially code that a quick branching pattern
can not be done in the data, which are processing otherwise you need
the data by us, for example, five minutes of timing ahead.
And it seems that you are running here just,
as it is, but they are not going to be done.
So, what do you think about that?
Okay.
To repeat the question was,
it seems that we're not protecting against the site channel,
because if the execution time is not constant,
it may be susceptible to timing channel attack, right?
Yeah, that's a good question.
I think it's a separate,
separate issue that can be addressed by some additional techniques.
But what we're trying to solve here is not the site channel,
or the scope of TE itself.
What we're doing is that we're building,
you know, this general data-private data analytics platform,
using the existing TE.
That's why we're focused on this in this work.
But of course, I think that if the work was very susceptible
to timing channel or any other site channel attacks,
I think it should be addressed case by case.
If you have the question,
you see that, like, for research,
how can I choose our choice?
Because you don't get them the data,
you just get them the ultimate statistics.
So, how can you make sure that it actually activates?
I've been this stage once.
Yeah, is it like the, actually,
how do you, how do you, the question?
What's kind of the difference between,
I was at the, and just giving them data,
and in, how can they still have,
with the size of the site, not having the load data,
and when they're like giving to the problem,
that's really, actually,
if they're going to go through the things.
Yeah, I think the question is,
why is the difference between just giving the data to the researchers,
and, you know, doing this approach?
Sure, that they're getting the correct insight for ourselves.
So, I think, in the second stage,
you will get the full, you know,
output using the real data,
so you'll get the insight.
The, the problem is,
the, the first, the programming stage,
where you, basically,
sacrifice some accuracy using,
using some data protection techniques, right?
And, and I think our argument is that,
you can run this job like multiple times
before you actually produce the final result.
Yeah, yeah, yeah.
Yeah, yeah.
That's, that's a model.
Yeah, thank you very much.
All right, run.
Sorry.
Yeah, we can't tell offline.
Yeah, yeah.