>>Hi. Um, and thank you for inviting me to speak at the Entity Research Summit. And congratulations for NTT for setting up the neuroses club in the area. Okay, so I'm gonna talk about fully by deniable encryption and multiply the competition. And, uh, this is joint work with park from Harvard. And Santa will bring a, uh, she structurally right now in Russia during the rest. Um, so So so consider thesis, uh, two kids, which maybe some of you still remember its violence for check the incredible kids. And they are want they want to talk to each other privately without her mother learning what talking about. So here they are using this lead pipe, which is that cannot be secure Channel and and violent can say to that track that she doesn't want to do her homework and check it was the watch movie. And she knows that the judge will understand what she says. We hear what she says, but her mother, their mother, is not going to anything because it z this lead pipe. She doesn't know what they're talking about. Um and and and we know how to implement this actually in without lead pipes in the software will Do you have encryption, which, you know, you know, for I know, uh, 40 for the last 40 years or so, but actually for many more s. Oh, this is great. Encryption gives us private communication against, uh, eavesdropping adversary. So passive adversaries s but But you know that mothers can be more than passives. What if the mother he goes and asks Pilot that? What did you talk? What do you say to judge it So you know, if valid, really said, you know, used this'll end pipe. She can say whatever she wants to say. I actually said that I was study, and then the mother goes to judge. I can ask him what did about tell you, and she said that she was studied and the mother still cannot tell anything about what happened. She doesn't know trillions. Death was sent or not. Um, in fact, even if violence said that she was studying and and Jackson said something else that you know, she said she was she rather watch movie. Even then the mother doesn't know who was right. I mean, not from the pipe music. Look them in the eye and not this way, but not from the communication she doesn't. Andi. In fact, we could go on like this, and, you know, the lead type doesn't help at all to understand what really have. And this is really another very important form off this really secure channels that it doesn't allow external parties. Course, there's, uh, certain what really happened. Even when they asked to see all the internals of all the parties. In fact, even further, the Violet Jack Jack have no way to actually convince the mother that this is what happened. Even if you want, right, they have no way of actually proving to the mother that they said this and not the other thing with this lead pipe. So the question is can be obtained a similar effects with, you know, software encryption. Uh, can we have an encryption scheme that has the same sort of properties? So we know that Peoria, the total encryption doesn't have this property. That encryption leaves traces. So there's this cipher text that that the mother of the course of seized. Then when the mother goes toe the parties and you know the ballot judge, you can ask him uh, give me. Show me your randomness. Show me all the internals. I want to see what really? How you generated the text and how you decrypted it with no money. Encryption is only one way that, but inject, checking opened the suffer text, and therefore, there is no real privacy anymore. Um, so So this is the case. So so really to do to address this issue? The this this concept of deniable encryption that was considered, uh, you know, many years ago. Andi idea here is that you wanted encryption scheme that provides, uh, protection of privacy. Uh, on ability, toe keep private. You really, really, really value. And maybe, ah, fake or lie about what you say in a convincing way, even against such a course. Uh huh. So and so? So the idea is that, you know, So they actually do you think of three types here, So there is centered in apple. So we're just going us to center off the off the message. You know how How did you encrypt the message? Show me your encryption. Andalus Suing The decryption key is public. Um, and if you go to the receiver and ask him show me your decryption key. I want to see how you decrypted. And you can also think about natural case where the course actually goes to both parties and ask them for the for the internals and compares one against the other. Right? So this is the bite inability concept. Andi, you can, of course, naturally generalize it. Not just to encryption to, say, two party competition soon here, Violent and Jack. Jack. You know, uh, maybe not even trust each other fully, But they want toe compute together, you know? Or, you know, do they actually know a kid they both know and rapes in school, Right. So, So, So violent has her own list of kids, and she knows grapes and injection to, and they want to do this to Paris ST secure competition to figure out if they keep the both. And so if they have this ideal trusted party or stay for somewhere where they can actually do the security applications uh um, securely then they can, of course, learned the answer without learning anything else. And also, if the mother comes in after the fact and ask them, you know who I see that you were trying to figure out who very school, you know. So tell me what you did. Tell me your inputs them you are supposed to give me all the randomness. And And I want to know for the kids that you know, that vaping school. So if they were using such such a physically, I didn't secure gadget then, uh, then they can say You know why? You know? So So what is the state of, I don't know, anybody Invasion did Jack this theater and I got nothing into something or nothing. Jake Jackson. Consistency and off course. Mother has no way of knowing if this is true. No. And even if, uh, injected decides to tell the truth and actually tells is really important. Really put real randomness. And, uh, no randomness here and violent tells still here. Nothing. Nothing that the mother has no way of knowing which one is like. She clearly some of one of them is language. Doesn't know which one. I mean, chicken again looked deep in the eye, but not from the communication. She cannot figure out. Um, so s so we want to get something like that for for two party competition. Uh, and and and again, eso again, again, again. The case that, you know, one is like going to the truth is still don't know. Um, so the question is there a protocol that that one is still behavior, and, uh, incredible. How do you define us? Uh, and the point is that, you know, Okay, 11 further thing toe. Think about, you know, this doesn't shouldn't end with two parties can think about three or more parties on, uh, and the same thing happens. You know, just maybe the trust structure, the consistency structure becomes more complicated. Uh, you know, you could buy groups of people which is consistent with each other and not without, um Okay, so So what are our results here? So first result is regarding encryption. So we come up with the first bite, the novel communication protocol. It's not encryption because it's three messages. Uh, so it is three messages, and it is this way need a reference string, which is like, programs in the sky. And but it's a short registering. I mean, one short programs that everybody in the world uses for the encryptions for the entire duration of time. and our assumptions are some expansion, Leo in one functions, uh, and on. But just to say that what was done previously? It was just senator deniable or receiver deniable, um, And then and nothing that we do is that actually way define and also obtained this extra property, which we call off the record inability which talks with you about the case where, as I said before, that one party, uh uh, is saying one thing and the other practicing nothing they insisted. So they cannot. There is no way for them to frame each other. Um, and the way the other result is regarding a multiparty function evaluation on Dhere, we come up with the first all deniable secure function evaluation for quote Well, you know, I mean, I mean that the protocol with the adversary or the coarser expect to see all off the transcript of the competition, including all the randomness in all the internal state of all the parties eso superiors results in this area always assumed that you know, either the course only can concourse on some of the parties or if you can force all the parties and there is some some physical gadget, uh, which is crucial information about the personnel puts and you know, nobody can see inside, so no, here, we actually that the Attackers see everything. Uh, because they think they see everything on we can still provide inability onda protocol. Also, our protocols also withstand inconsistencies. Mean the case off this off the record style that one party says one thing partisans don't think. But this is only in the case of two parties and only for functions where the input size is polynomial in play. Put size. Uh, domain. Um, so in this actually interested open question how to extend it beyond that. Uh, so just to say that this is kind of it's a surprising thing that you can even do such thing, because what it allows you to do is actually such to completely rewrite history. Eso you during your competition on. Then somebody comes, and that will show me everything that happened. All the runners, all the entire transcript, the competition from beginning to the end. And you can now tell them something else. Not something that really happened. I mean, they see, you know, the public messages they see it on thistle is un contestable, but you can show different internals that there are very different than what really happened. And still nobody can catch you. So it's really some sense. Uh, who knows what's really happened? Um, so anyway, so So this is the, uh this is the result. Let's just say a few words about fully deniable encryption. Uh, just toe give a more detailed So So So So, how do you define this? Fully deniable encryption. So first I want to say that, you know, if you just, uh if the parties have appreciate key then, uh, deniability is with these because what you know, you just in orderto cryptic message just want some part of the key. And this one temple is completely deniable, right? Because you can just take this self a text and claim that it was any message encryption off any message off your choice. But just, you know, extra it. But just coming up with the key, which is the Solvents Architects as a message of futures. So this is completely diamond by both parties, and even it's off the record because if the two parties say different things, there's no way to know what's right. So Eh, so what? But it means that, you know, the hard part is actually had to come up with this shirt key, uh, in a deniable way. So you can actually later argued that this key was an, um so s so we need kind of deniable key exchange, and then this is what we do. So we come up with this idea by by the application of what? This what this means. So it's a protocol, you know, for two parties, uh, change, keep with messages and which gives you the ability to life. Somebody asked you which was key and claim it was anything, uh, later. So more formally. So we have two parties. One You know, this is the key change protocol for one party, and this is the kitchen for the other party in each party also is equipped with this faking algorithm. This is s faking arctic. I keep, you know, Senator, receiver, Even though it's not teach change, it's affecting and breaking. Allows you to come up with fake randomness. That demonstrate kills anything and we want correctly since semantic security as usual and we want toe this s fake takes a transcript and the randomness and the old key in the nuclear that you want. Andi comes up with fake randomness such that, uh um and this is you know, that that consistent with this new key, k prime and the same for the receiver. It comes up with a new randomness. The assistant to the crime and the requirement is that, uh, the attack. I cannot tell the difference between the experiment when you know the key key was exchanged. These transcripts respecto the real key or the case where the key was exchanged, and then the faking accurately going folk What? The adversary seizes the actual transcript, but then opening to a different. So there's a distinguished group. Um, And then what if the parties that were okay then there is another requirement there that says that even if the parties you know, one of them face, the other one doesn't and they then you can't tell which one will effect in which one wants to tell the truth. Onda point is that this to this to produce properties together really give you what you would like for my dearly your channel, even with respect toe courses. Um, so just to point out that you know this, this properties hold only if the parties in the follow the protocol during the execution actually choose randomness is they should. Otherwise things does work. In fact, otherwise, there's nothing that could work because the party's chief from the beginning and just use the terroristic protocol instead of randomized or just, you know, just randomness, which is predetermined. And, of course, nothing you can do. Uh, however, you know, there are, of course, interesting situations where it is. You know, it's reasonable to trust that the parties are actually using the randomness Aziz instructed during the execution of the protocol, for instance, we're thinking about voting this something can be forced, uh, by the voting booth, but you know, other situations. But this is kind of like essentially eso maybe another minute to say a few words about, you know, just like construction. How it kind of works in, you know, in general. So So we have, like, a three months, three rounds protocols. So we have four programs, you know, two from each party don't to deal with the three messages. Then we have a faking program for each party, so the way it works, you know, first, the violent here is has this is Harris randomness and actually chooses the key that they're going Thio agree ahead of time. It inputs to the first program which is going to think of it is the office care program black box program. And there's the message. First message is basically a harsh appear f off the K and then the, uh and then the responder gets this message has its own randomness and outputs. Another message, which is the hash off the first message agronomists. And then the third message now is going to be a new encryption off the key on the hashes and the end to a previous messages. This is, ah, company encryption off this one long spring and then the fourth with the fourth program just takes the randomness off the receiver and the two messages and put it in. And then I'll put the key, which is decrypted essentially the Crips, the subtextual from here in the old checks, right? And then the faking programs. What they do, they just take those. The transcript and the cookie and the new key and the striking program here are puts a new randomness for the senator and this one There's a new randomness for the receiver and the way it does near random estrogen offering work eyes, uh, is again It's kind of fact natural a t least the face of it. It uses the seeking hidden triggers idea off, off, so high in waters for descending on the inability that, you know, trigger each one of those programs toe put actually write message even when you get this, uh, crime on eventually this k problems are Well, the problem is that this scene in triggers, you know, give you local consistency for each problem by itself. This was this was the east their goal. But there is no global consistency about those six programs together and and get the six programs together to be consistent with the fact that the key would actually keep prominent K is high in contribute. And this is something that we become the main challenge of this work. This also, I did this three messages because if you have only to then there is no way to get a double consistency. Ah, s O s. So this is, uh this is the test on just to say about, you know, the future. So definitely we want stronger than ability for for MPC. As I said, we just give partial results there on. Then there is kind of, like some very interesting questions. One is like in general, You know, we know that your is very nice, but in many cases, we actually can do things without, uh but in this situation with prosecution, but maybe the inability of one of the very few cases where actually, we don't have any other way to do things out of the Neo. Is it really essential? Can we prove it? You know, and if not, can we do without? Can we get around CRS? Can you actually do with public friend of mysterious? Uh, you know, and more generally? Uh, no. We actually, uh, sweated a lot. You know, spit blood. In order to make this thing work with Leo and because I always really hard to work with, you know, would agree toe, find some some some general set of tools to work more easily. I was there. Um, Louis, thank you very much on death's

>>thank you so much that sake for inviting me to the Entity Research Summit. And I'm really excited to talk to all of them today. So I will be talking about achieving indistinguishability obfuscation from well founded assumptions. And this is really the result of a wonderful two year collaboration with But now it's standing. Graduate student I use chain will be graduating soon on my outstanding co author, Rachel Lynde from the University of Washington. So let me jump right into it. We all know that constructing indistinguishable the obfuscation. Constructing Io has been perhaps the most consequential open problem in the foundations of photography. For several years now, they've seen over 100 papers written that show how to use Iot to achieve a number of remarkable cryptographic goals. Um, that really expand the scope of cryptography in addition to doing just remarkable, really interesting new things. Unfortunately, however, until this work, I told the work I'm about to tell you about all known constructions of Iove. All required new hardness, assumptions, heart assumptions that were designed specifically to prove that Iowa secure. And unfortunately, uh, this has a torture of history. And many of the assumptions were actually broken, which led to just a lot of doubt and uncertainty about the status of Iot, whether it really exists or doesn't exist. And the work I'm about to tell you about today changes that state of affairs in the continental way in that we show how to build io from the combination of four well established topographic assumptions. Okay, let me jump right into it and tell you how we do it. So before this work that I'm about to tell you about over the last two years with Rachel and Ayush, we actually constructed a whole sequence of works that have looked at this question. And what we showed was that if we could just build a certain special object, then that would be sufficient for constructing Io, assuming well established assumptions like L W E P R g s and M C zero and the 68 assumption of a violin. Your mouths. Okay, So what is this object? The object first starts with a P. R G and >>S zero. In other words, of trg with constant locality that stretches end bits of seed to M bits of output where am is ended one plus Epsilon for any constant Epsilon zero. Yes, but in addition to this prg, we also have these l w we like samples. So as usual, we have an elder Bluey Secret s which is random vector z b two k, where K is the dimension of the secret, which is much smaller than any way also have this public about vectors ai which are also going to be okay. And now what is given out is are the elderly samples where the error is this X I that is just brilliant value. Uh, where these excise air Also the input to our prg. Okay, unfortunately, we needed to assume that these two things together, this y and Z together is actually pseudo random. But if you think about it, there is some sort of kind of strange assumption that assumes some kind of special leakage resilience, property of elderly, we where elderly samples, even with this sort of bizarre leakage on the errors from all debris, is still surround or still have some surrounding properties. And unfortunately, we had no idea how to prove that. And we still don't have any idea how to prove this. Actually, So this is just a assumption and we didn't know it's a new assumption. So far, it hasn't been broken, but that's pretty much it. That's all we knew about it. Um and that was it. If we could. If this is true, then we could actually build. I'll now to actually use this object. We needed additional property. We needed a special property that the output of this prg here can actually be computed. Every single bit of the output could be computed by a polynomial over the public. Elder Louise samples Why? And an additional secret w with the property that this additional secret w is actually quite small. It's only excise em to the one minus delta or some constant delta gradients. Barroso polynomial smaller from the output of the prg. And crucially, the degree of this polynomial is on Lee to its violin e er can this secret double that's where the bottle in your mouth will come. Okay. And in fact, this part we did not approve. So in this previous work, using various clever transformations, we were able to show that in fact we are able to construct this in a way to this Parliament has existed only degree to be short secret values. Double mhm. So now I'm gonna show you how using our new ideas were actually gonna build. That's a special object just like this from standard assumptions. We're just gonna be sufficient for building io, and we're gonna have to modify it a little bit. Okay? One of the things that makes me so excited is that actually, our ideas are extremely simple. I want to try to get that across today. Thanks. So the first idea is let's take thes elder movie samples that we have here and change them up a little bit when it changed them up. Start before I get to that in this talk, I want you to think of K the dimension of the secret here as something very small. Something like end of the excellent. That's only for the stock, not for the previous work. Okay. All right. So we have these elderly samples right from the previous work, but I'm going to change it up instead of computing them this way, as shown in the biggest slide on this line. Let's add some sparse hair. So let's replace this error x i with the air e i plus x I where e is very sparse. Almost all of these IIs or zero. But when the I is not zero is just completely random in all of Z, pizza just completely destroys all information. Okay, so first I just want to point out that the previous work that I already mentioned applies also to this case. So if we only want to compute P R g of X plus E, then that can still be computer the polynomial. That's degree to in a short W that's previous work the jail on Guess work from 2019. I'm not going to recall that you don't have time to tell you how you do it. It's very simple. Okay, so why are we doing this? Why are we adding the sparse error? The key observation is that even though I have changed the input of the PRG to the X Plus E because he is so sparse, prg of explosive is actually the same as P. R. G of X. In almost every outlet location. It's only a tiny, tiny fraction of the outputs that are actually corrupted by the sparse Arab. Okay, so for a moment Let's just pretend that in fact, we knew how to compute PRGF X with a degree to polynomial over a short seeking. We'll come back to this, I promise. But suppose for a moment we actually knew how to compute care to your ex, Not just scared of explosive in that case were essentially already done. And the reason is there's the L. P n over zp assumption that has been around for many years, which says that if you look at these sort of elderly like samples ai from the A, I s but plus a sparse air e I where you guys most zero open when it's not serious, completely random then In fact, these samples look pseudo random. They're indistinguishable from a I r r. I just completely uniform over ZP, okay? And this is a long history which I won't go because I don't have time, but it's just really nice or something. Okay, so let's see how we can use it. So again, suppose for the moment that we were able to compute, not just appeared you've explosive but appeared to you that well, the first operation that since we're adding the sparse R E I This part the the L P N part here is actually completely random by the LP an assumption so by L P and G. P, we can actually replace this entire term with just all right. And now, no, there is no more information about X present in the samples, The only place where as is being used in the input to the prg and as a result, we could just apply to sit around this of the prg and say this whole thing is pseudo random and that's it. We've now proven that this object that I wanted to construct it is actually surrounded, which is the main thing that was so bothering us and all this previous work. Now we get it like that just for the snap of our fingers just immediately from people. Okay, so the only thing that's missing that I haven't told you yet is Wait, how do we actually compute prg attacks? Right? Because we can compute p r g of X plus e. But there's still gonna be a few outputs. They're gonna be wrong. So how can we correct those few corrupted output positions to recover PRGF s? So, for the purpose of this talks because I don't have enough time. I'm gonna make sort of a crazy simplifying assumption. Let's just assume that in fact, Onley one out the position of P r g of X plus e was correct. So it's almost exactly what PR gox. There's only one position in prg of Ecstasy which needs to be corrected to get us back to PR gox. Okay, so how can we do that? The idea is again really, really simple. Okay, so the output of the PRG is an M. Becker and so Dimension and Becker. But let's actually just rearrange that into a spirit of them by spirit of them matrix. And as I mentioned, there's only one position in this matrix that actually needs to be corrected. So let's make this correction matrix, which is almost everywhere. Zero just in position. I j it contains a single correction factor. Why, right? And if you can add this matrix to prg of explosive, then we'll get PR dribbles. Okay, so now the Onley thing I need to do is to compute this extremely sparse matrix. And here the observation was almost trivia. Just I could take a spirit of em by one maker That just has why in position I and I could take a one by spirit of them matrix. I just have one in position J zero everywhere else. If I just take the tensor product was music the matrix product of these two of these two off this column vector in a row vector. Then I will get exactly this correction matrix. Right? And note that these two vectors that's called them you and be actually really, really swamped their only spirit of n dimensional way smaller than them. Right? So if I want to correct PRGF Expo see, all I have to do is add you, Tenzer V and I can add the individual vectors u and V to my short secret w it's still short. That's not gonna make W's any sufficiently bigger. And you chancery is only a degree to computation. So in this way, using a degree to computation, we can quickly, uh, correct our our computation to recover prg events. And now, of course, this was oversimplifying situation, uh, in general gonna have many more areas. We're not just gonna have one error, like as I mentioned, but it turns out that that is also easy to deal with, essentially the same way. It's again, just a very simple additional idea. Very, very briefly. The idea is that instead of just having one giant square to them by sort of a matrix, you can split up this matrix with lots of little sub matrices and with suitable concentration bound simple balls and pins arguments we can show that we could never Leslie this idea this you Tenzer v idea to correct all of the remaining yet. Okay, that's it. Just, you see, he's like, three simple >>ah ha moments. What kind of all that it took, um, that allowed >>us to achieve this result to get idol from standard assumptions. And, um, of course I'm presenting to you them to you in this very simple way. We just these three little ideas of which I told you to. Um, but of course, there were only made possible because of years of struggling with >>all the way that didn't work, that all that struggling and mapping out all the ways didn't work >>was what allowed us toe have these ideas. Um, and again, it yields the first I'll construction from well established cryptographic assumptions, namely Theo Elgon, assumption over zp learning with errors, assumption, existence of PR GS and then zero that is PR juice with constant death circuits and the SX th assumption over by linear notes, all of which have been used many years for a number of other applications, including such things as publicly inversion, something simple public inversion that's the That's the context in which the assumptions have been used so very far from the previous state of affairs where we had assumptions that were introduced on Lee Professor constructing my own. And with that I will conclude, uh and, uh, thank you for your attention. Thanks so much.

>>Good morning. Good afternoon. Good evening, everyone. I should thank Entity Research and the Oshie for putting together this program and also the opportunity to speak here. My name is Al Gore ism or Andy and I'm from Caltech. And today I'm going to tell you about the work that we have been doing on networks off optical parametric oscillators and how we have been using them for icing machines and how we're pushing them toward Cornum. Photonics should acknowledge my team at Caltech, which is now eight graduate students and five researcher and postdocs as well as collaborators from all over the world, including entity research and also the funding from different places, including entity. So this talk is primarily about networks of resonate er's and these networks are everywhere from nature. For instance, the brain, which is a network of oscillators all the way to optics and photonics and some of the biggest examples or meta materials, which is an array of small resonate er's. And we're recently the field of technological photonics, which is trying thio implement a lot of the technological behaviors of models in the condensed matter, physics in photonics. And if you want to extend it even further. Some of the implementations off quantum computing are technically networks of quantum oscillators. So we started thinking about these things in the context of icing machines, which is based on the icing problem, which is based on the icing model, which is the simple summation over the spins and spins can be their upward down, and the couplings is given by the G I J. And the icing problem is, if you know J I J. What is the spin configuration that gives you the ground state? And this problem is shown to be an MP high problem. So it's computational e important because it's a representative of the MP problems on NPR. Problems are important because first, their heart in standard computers, if you use a brute force algorithm and they're everywhere on the application side. That's why there is this demand for making a machine that can target these problems and hopefully it can provide some meaningful computational benefit compared to the standard digital computers. So I've been building these icing machines based on this building block, which is a degenerate optical parametric oscillator on what it is is resonator with non linearity in it and we pump these resonate er's and we generate the signal at half the frequency of the pump. One vote on a pump splits into two identical photons of signal, and they have some very interesting phase of frequency locking behaviors. And if you look at the phase locking behavior, you realize that you can actually have two possible face states as the escalation result of these Opio, which are off by pie, and that's one of the important characteristics of them. So I want to emphasize >>a little more on that, and I have this mechanical analogy which are basically two simple pendulum. But there are parametric oscillators because I'm going to modulate the parameter of them in this video, which is the length of the strength on by that modulation, which is that will make a pump. I'm gonna make a muscular. That'll make a signal, which is half the frequency of the pump. >>And I have two of them to show you that they can acquire these face states so they're still face their frequency lock to the pump. But it can also lead in either the zero pie face state on. The idea is to use this binary phase to represent the binary icing spin. So each Opio is going to represent spin, which can be >>either is your pie or up or down, >>and to implement the network of these resonate er's. We use the time off blood scheme, and the idea is that we put impulses in the cavity, these pulses air separated by the repetition period that you put in or t R. And you can think about these pulses in one resonator, xaz and temporarily separated synthetic resonate Er's If you want a couple of these resonator is to each other, and now you can introduce these delays, each of which is a multiple of TR. If you look at the shortest delay it couples resonator wanted to 2 to 3 and so on. If you look at the second delay, which is two times a rotation period, the couple's 123 and so on. If you have any minus one delay lines, then you can have any potential couplings among these synthetic resonate er's. And if I can introduce these modulators in those delay lines so that I can strength, I can control the strength and the phase of these couplings at the right time. Then I can >>have a program. We'll all toe all connected network in this time off like scheme. >>And the whole physical size of the system scales linearly with the number of pulses. So the idea of opium based icing machine is didn't having these o pos. Each of them can be either zero pie, and I can arbitrarily connect them to each other. And then I start with programming this machine to a given icing problem by just setting the couplings and setting the controllers in each of those delight lines. So now I have a network which represents an icing problem thin the icing problem maps to finding the face state that satisfy maximum number of coupling constraints. And the way it happens is that the icing Hamiltonian maps to the linear loss of the network. And if I start adding gain by just putting pump into the network, then the OPI ohs are expected to oscillating the lowest, lowest lost state. And, uh and we have been doing these in the past, uh, six or seven years and I'm just going to quickly show you the transition, especially what happened in the first implementation which was using a free space optical system and then the guided wave implementation in 2016 and the measurement feedback idea which led to increasing the size and doing actual computation with these machines. So I just want to make this distinction here that, um the first implementation was on our optical interaction. We also had an unequal 16 implementation and then we transition to this measurement feedback idea, which I'll tell you quickly what it iss on. There's still a lot of ongoing work, especially on the entity side, to make larger machines using the measurement feedback. But I'm gonna mostly focused on the all optical networks and how we're using all optical networks to go beyond simulation of icing. Hamiltonian is both in the linear and >>nonlinear side and also how we're working on miniaturization of these Opio networks. So >>the first experiment, which was the four Opium machine it was a free space implementation and this is the actual picture of the machine and we implemented a small and it calls for Mexico problem on the machine. So one problem for one experiment and we ran the machine 1000 times, we looked at the state and we always saw it oscillate in one of these, um, ground states of the icing laboratoria. Yeah, so then the measurement feedback idea was to replace those couplings and the controller with the simulator. So we basically simulated all those coherent interactions on on FB g A. And we replicated the coherent pulse with respect to all those measurements. And then we injected it back into the cavity and on the near to you still remain. So it still is a non. They're dynamical system, but the linear side is all simulated. So there are lots of questions about if this system is preserving important information or not, or if it's gonna behave better Computational wars. And that's still ah, lot of ongoing studies. But nevertheless, the reason that this implementation was very interesting is that you don't need the end minus one delight lines so you can just use one, and you can implement a large machine, and then you can run several thousands of problems in the machine, and then you can compare the performance from the computational perspective. Looks so I'm gonna split this idea of opium based icing machine into two parts One is the linear part, which is if you take out the non linearity out of the resonator and just think about the connections. You can think about this as a simple matrix multiplication scheme, and that's basically >>what gives you the icing Hamiltonian model A. So the optical loss of this network corresponds to the icing Hamiltonian. >>And if I just want to show you the example of the n equals for experiment on all those face states and the history Graham that we saw, you can actually calculate the laws of each of those states because all those interferences in the beam splitters and the delay lines are going to give you a different losses. And then you will see that ground states corresponds to the lowest laws of the actual optical network. If you add the non linearity, the simple way of thinking about what the non linearity does is that it provides to gain, and then you start bringing up the gain so that it hits the loss. Then you go through the game saturation or the threshold which is going to give you this phase bifurcation. >>So you go either to zero the pie face state, and the expectation is that this the network oscillates in the lowest possible state, the lowest possible loss state. >>There are some challenges associated with this intensity Durban face transition, which I'm going to briefly talk about. I'm also going to tell you about other types of non their dynamics that we're looking at on the non air side of these networks. So if you just think about the linear network, we're actually interested in looking at some technological behaviors in these networks. And the difference between looking at the technological behaviors and the icing uh, machine is that now, First of all, we're looking at the type of Hamilton Ian's that are a little different than the icing Hamilton. And one of the biggest difference is is that most of these technological Hamilton Ian's that require breaking the time reversal symmetry, meaning that you go from one spin to on the one side to another side and you get one phase. And if you go back where you get a different phase, and the other thing is that we're not just interested in finding the ground state, we're actually now interesting and looking at all sorts of States and looking at the dynamics and the behaviors of all these states in the network. So we started with the simplest implementation, of course, which is a one d chain of thes resonate er's which corresponds to a so called ssh model. In the technological work, we get the similar energy to los mapping. And now we can actually look at the band structure on. This is an actual measurement >>that we get with this associate model and you see how it reasonably how how? Well, it actually follows the prediction and the theory. >>One of the interesting things about the time multiplexing implementation is that now you have the flexibility of changing the network as we were running the machine. And that's something unique about this time multiplex implementation so that we can actually look at the dynamics. And one example >>that we have looked at is we can actually go to the transition off going from top a logical to the to the standard nontrivial. I'm sorry to the trivial behavior of the network. >>You can then look at the edge states and you can also see the trivial and states and the technological at states actually showing up in this network. We have just recently implement on a two D, >>uh, network with Harper Hofstadter model when you don't have the results here. But we're one of the other important characteristic of time multiplexing is that you can go to higher and higher dimensions and keeping that flexibility and dynamics. And we can also think about adding non linearity both in a classical and quantum regimes, which is going to give us a lot of exotic oh, classical and quantum, non innate behaviors in these networks. >>So I told you about the linear side. Mostly let me just switch gears and talk about the nonlinear side of the network. And the biggest thing that I talked about so far in the icing machine is this phase transition, that threshold. So the low threshold we have squeezed state in these Oh, pios, if you increase the pump, we go through this intensity driven phase transition and then we got the face stays above threshold. And this is basically the mechanism off the computation in these O pos, which is through this phase transition below to above threshold. So one of the characteristics of this phase transition is that below threshold, you expect to see quantum states above threshold. You expect to see more classical states or coherent states, and that's basically corresponding to the intensity off the driving pump. So it's really hard to imagine that it can go above threshold. Or you can have this friends transition happen in the all in the quantum regime. And there are also some challenges associated with the intensity homogeneity off the network. Which, for example, is if one Opio starts oscillating and then its intensity goes really high. Then it's going to ruin this collective decision making off the network because of the intensity driven face transition nature. So So the question is, can we look at other phase transitions? Can we utilize them for both computing? And also, can we bring them to the quantum regime on? I'm going to specifically talk about the face transition in the spectral domain, which is the transition from the so called degenerate regime, which is what I mostly talked about to the non degenerate regime, which happens by just tuning the phase of the cavity. And what is interesting is that this phase transition corresponds to a distinct phase noise, behavior So in the degenerate regime, which we call it the order state. You're gonna have the phase being locked to the phase of the pump as I talked about in the non the general regime. However, the phase is the phase is mostly dominated by the quantum diffusion off the off the phase, which is limited by the so called shallow towns limit and you can see that transition from the general to non degenerate, which also has distinct symmetry differences. And this transition corresponds to a symmetry breaking in the non degenerate case. The signal can acquire any of those phases on the circle, so it has a you one symmetry. And if you go to the degenerate case, then that symmetry is broken and you only have zero pie face days I will look at So now the question is can utilize this phase transition, which is a face driven phase transition and can we use it for similar computational scheme? So that's one of the questions that were also thinking about. And it's not just this face transition is not just important for computing. It's also interesting from the sensing potentials and this face transition. You can easily bring it below threshold and just operated in the quantum regime. Either Gaussian or non Gaussian. If you make a network of Opio is now, we can see all sorts of more complicated and more interesting phase transitions in the spectral domain. One of them is the first order phase transition, which you get by just coupling to oppose. And that's a very abrupt face transition and compared to the to the single Opio face transition. And if you do the couplings right, you can actually get a lot of non her mission dynamics and exceptional points, which are actually very interesting to explore both in the classical and quantum regime. And I should also mention that you can think about the cup links to be also nonlinear couplings. And that's another behavior that you can see, especially in the nonlinear in the non degenerate regime. So with that, I basically told you about these Opio networks, how we can think about the linear scheme and the linear behaviors and how we can think about the rich, nonlinear dynamics and non linear behaviors both in the classical and quantum regime. I want to switch gear and tell you a little bit about the miniaturization of these Opio networks. And of course, the motivation is if you look at the electron ICS and >>what we had 60 or 70 years ago with vacuum tube and how we transition from relatively small scale computers in the order of thousands of nonlinear elements to billions of non linear elements, where we are now with the optics is probably very similar to seven years ago, which is a tabletop implementation. >>And the question is, how can we utilize nano photonics? I'm gonna just briefly show you the two directions on that which we're working on. One is based on lithium Diabate, and the other is based on even a smaller resonate er's Did you? So the work on Nana Photonic lithium naive. It was started in collaboration with Harvard Marko Loncar and also might affair at Stanford. And, uh, we could show that you can do the >>periodic polling in the phenomenon of it and get all sorts of very highly non in your process is happening in this net. Photonic periodically polls if, um Diabate >>and now we're working on building. Opio was based on that kind of photonic lithium Diabate and these air some some examples of the devices that we have been building in the past few months, which I'm not gonna tell you more about. But the OPI ohs and the Opio networks are in the works, and that's not the only way of making large networks. But also I want to point out that the reason that these Nana photonic goblins are actually exciting is not just because you can make a large networks and it can make him compact in a in a small footprint, they also provide some opportunities in terms of the operation regime. On one of them is about making cat states in o pos, which is can we have the quantum superposition of >>the zero pie states that I talked about >>and the nano photonics within? I would provide some opportunities to actually get >>closer to that regime because of the spatial temporal confinement that you can get in these wave guides. So we're doing some theory on that. We're confident that the type of non linearity two losses that it can get with these platforms are actually much higher than what you can get with other platform, other existing platforms and to >>go even smaller. We have been asking the question off. What is the smallest possible Opio that you can make? Then you can think about really wavelength scale type resonate er's and adding the chi to non linearity and see how and when you can get the Opio to operate. And recently, in collaboration with us. See, we have been actually USC and Creole. We have demonstrated that you can use nano lasers and get some spin Hamiltonian implementations on those networks. So if you can't build a pos, we know that there is a path for implementing Opio Networks on on such a nano scale. So we have looked at these calculations and we try to >>estimate the threshold of a pos. Let's say for me resonator and it turns out that it can actually be even lower than the type of bulk Pippen O pos that we have been building in the past 50 years or so. >>So we're working on the experiments and we're hoping that we can actually make even larger and larger scale Opio networks. So let me summarize the talk I told you about the opium networks and >>our work that has been going on on icing machines and the >>measurement feedback on I told you about the ongoing work on the all optical implementations both on the linear side and also on the nonlinear behaviors. And I also told you >>a little bit about the efforts on miniaturization and going to the to the nano scale. So with that, I would like Thio stop here and thank you for your attention.