%
% Licensed to the Apache Software Foundation (ASF) under one
% or more contributor license agreements.  See the NOTICE file
% distributed with this work for additional information
% regarding copyright ownership.  The ASF licenses this file
% to you under the Apache License, Version 2.0 (the
% "License"); you may not use this file except in compliance
% with the License.  You may obtain a copy of the License at
%
%   http://www.apache.org/licenses/LICENSE-2.0
%
% Unless required by applicable law or agreed to in writing,
% software distributed under the License is distributed on an
% "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
% KIND, either express or implied.  See the License for the
% specific language governing permissions and limitations
% under the License.
%
\documentclass{beamer}
\usepackage[T1]{fontenc}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{amsthm}
\usepackage{algorithm}
\usepackage{varwidth}
\usepackage{bm}
\usepackage[noend]{algpseudocode}
\usepackage{xspace}
\usepackage{multirow}
\usepackage{xcolor}
\DeclareRobustCommand{\NAME}{Wideskies\xspace}
\newcommand{\from}{\rightarrow}

\algnewcommand{\algorithmicgiven}{\textbf{given }}
\algnewcommand{\Given}{\algorithmicgiven}

\algnewcommand{\algorithmicselect}{\textbf{select }}
\algnewcommand{\Select}{\algorithmicselect}

\algnewcommand{\algorithmicset}{\textbf{set }}
\algnewcommand{\Set}{\algorithmicset}

\algnewcommand{\algorithmiccompute}{\textbf{compute }}
\algnewcommand{\Compute}{\algorithmiccompute}

\algnewcommand{\algorithmicgoto}{\textbf{go to}}
\algnewcommand{\Goto}[1]{\algorithmicgoto~\ref{#1}}

\newcommand{\Z}{\ensuremath{\mathbf{Z}}}
\newcommand{\zmodn}{\ensuremath{\Z/N\Z}}
\newcommand{\zmodntunits}{\ensuremath{\left(\Z/N^{2}\Z\right)^{\times}}}
\newcommand{\lcm}{\ensuremath{\text{lcm}}}

\mode<presentation> { \usetheme{default} }

\usepackage{graphicx}
\usepackage{booktabs}
\usepackage{array}
\newcolumntype{L}[1]{>{\raggedright\let\newline\\\arraybackslash\hspace{0pt}}p{#1}}
\newcolumntype{C}[1]{>{\centering\let\newline\\\arraybackslash\hspace{0pt}}p{#1}}
\newcolumntype{R}[1]{>{\raggedleft\let\newline\\\arraybackslash\hspace{0pt}}p{#1}}

\makeatletter
\DeclareRobustCommand*{\&}{%
  \nfss@text{%
    \fontfamily{LinuxBiolinumT-TLF}%
    \selectfont
    \symbol{`\&}%
  }%
}

\usepackage{eso-pic}
\beamertemplatenavigationsymbolsempty
\setbeamertemplate{footline}[frame number]
\newcommand\AtPagemyUpperLeft[1]{\AtPageLowerLeft{%
\put(\LenToUnit{0.9\paperwidth},\LenToUnit{0.9\paperheight}){#1}}}

\AtBeginSection[]{
  \begin{frame}
  \vfill
  \centering
  \begin{beamercolorbox}[sep=8pt,center,shadow=true,rounded=true]{title}
    \usebeamerfont{title}\insertsectionhead\par%
  \end{beamercolorbox}
  \vfill
  \end{frame}
}
\title[Apache Pirk Math
Walkthrough]{\includegraphics[width=2.5in,keepaspectratio]{ApachePirk_1.png}\\ \bigskip Mathematics $\&$ Algorithms}

\author{Walter Ray-Dulany}
\institute[Apache Pirk]
{
\medskip
\textit{raydulany@apache.org}
}
% I decided against a date. - Walter
\date{}

\begin{document}

\begin{frame}
\titlepage
\end{frame}

\AddToShipoutPictureFG{
  \AtPagemyUpperLeft{{\includegraphics[width=.5cm,keepaspectratio]{ApachePirkCircle.png}}}
}

\section{Introduction}

\begin{frame}
\frametitle{Pirk's Wideskies Algorithm}
  Pirk uses the Wideskies algorithm to accomplish scalable PIR.\\~\\
  This algorithm can be broken down into two distinct conceptual pieces:
    \begin{itemize}
      \item Paillier Encryption
      \item The Query-Response-Result algorithms
    \end{itemize}
    ~\\ Before we begin those however, we take a (happily brief) diversion into
    the language of the mathematics involved in this deck.
\end{frame}

\section{Language Preliminaries}
\begin{frame}
  \frametitle{Language Preliminaries}
  The Paillier scheme employs a small amount of group theoretic notation. Let's
  go over that notation briefly.
\end{frame}

\begin{frame}
  \frametitle{Language Preliminaries}
  \begin{itemize}
    \item \zmodn: This is the group of integers modulo $N$; it can be thought of
      as all numbers $0\leq k < N$, with modular addition (e.g.\ for $N=5$,
      $1+7 \equiv 3\mod N$).\\~\\ This is a group under addition.\\~\\
    \item $(\zmodn)^\times$: This is the multiplicative group of integers modulo
      $N$, also called the units of $\zmodn$. Sometimes denoted
      $(\mathbf{Z}/N\mathbf{Z})^*$, this is the set of $0\leq k < N$ that are
      relatively prime to $N$ (that is, $k$ and $N$ share no factors, or
      equivalently the greatest common denominator ($\gcd$) of $k$ and $N$ is $1$). One
      can also think of this as the set of $k\in\zmodn$ such that there exists
      a $k^{-1}\in\zmodn$ with $k\cdot k^{-1} \equiv 1\mod N$.\\~\\
      This is a group under multiplication.
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Language Preliminaries}
Using the above notation, we can see that
\begin{equation*}
  \zmodntunits = \{0\leq k<N^2: \gcd(k,N^2) = 1\}.
\end{equation*}~\\
If $N$ happens to be an RSA modulus,
$N=pq$, $p$ and $q$ primes, then $\zmodntunits$ is just all numbers between $0$
(inclusive) and $N^2$ (exclusive) that are not divisible by either $p$ or
$q$.
\end{frame}

\begin{frame}
  \frametitle{Language Preliminaries}
  \begin{itemize}
    \item Order In \zmodn: The order of an element $k\in\zmodn$ is the least integer $e$
      such that $e\cdot k = 0\mod N$.
    \item Order in \zmodntunits: The order of an element $a\in\zmodntunits$ is
      the least integer $e$ such that $a^e = 1\mod N^2$.
  \end{itemize}
  In both cases, order is well defined (i.e.\ it exists and makes sense) for
  all elements of the groups.
\end{frame}

\begin{frame}
  \frametitle{Language Preliminaries}
  For a more in depth discussion of these, and closely related, terms, please
  see
  \mbox{\scriptsize \url{http://www.math.nagoya-u.ac.jp/~richard/teaching/s2015/Group_2.pdf}}
\end{frame}

\section{Paillier Encryption}
\begin{frame}
\frametitle{Paillier Encryption}
Paillier encryption is a partially homomorphic public key scheme that relies on
the function $$\mathcal{E}_g:\zmodn\times(\zmodn)^\times\rightarrow
\zmodntunits$$ given by $$\mathcal{E}_g(x,y) = g^x y^N \mod N^2,$$
$g\in\zmodntunits$. Here, $\zmodn$ is the plaintext space and $\zmodntunits$ is
the ciphertext space.\\~\\
When the order of $g$ is a non-zero multiple of $N$, $\mathcal{E}_g$ is a bijection.
\end{frame}

\begin{frame}
  \frametitle{Paillier Prerequisites}
\begin{itemize}
  \item Public key: $(N,g)$, $N$ an RSA modulus $N=pq$, $p$ and $q$ primes of
    approximately the same bit-length, and $g\in \zmodntunits$ such that the
    order of $g$ is a nonzero multiple of $N$.
  \item Private key: $\lambda(N)$, where $\lambda$ is the Carmichael function
    \begin{align*}
      \lambda(N) &= \lcm(p-1,q-1)
    \end{align*}
  that gives the exponent of $(\zmodn)^\times$.
  \item Plaintext space: \zmodn.
  \item Ciphertext space: \zmodntunits.
\end{itemize}
~\\
{\footnotesize We can also consider the pair $(p,q)$ to be the private key, as $\lambda(N)$ is
quickly and easily derived from it. Note that $\lambda(N)$ is coprime to $N$.}
\end{frame}

\begin{frame}
  \frametitle{What Do We Mean By `Homomorphic Encryption'?}
  An encryption scheme is fully homomorphic if it is a homomorphism from
  plaintext space to ciphertext space for arbitrary operations and arbitrary
  numbers of such operations. If this definition seems squishy and not very
  mathematical, that's because it is; it's hard to find a proper mathematical
  definition of this term.\\~\\

  An encryption scheme is partially homomorphic if it is a homomorphism for
  only some operations, or for only a few consecutive operations.\\~\\
\end{frame}

\begin{frame}
  \frametitle{Paillier Encryption is Homomorphic}
  Paillier encryption is a partial homomorphism between addition in \zmodn\ and
  multiplication in \zmodntunits.\\~\\

  Denote Paillier encryption by $\mathcal{E}_g$ and decryption by $\mathcal{D}_g$,
  and let $m$ and $m'\in \zmodn$. Then
    \begin{align*}
        D(\mathcal{E}(m) \mathcal{E}(m') \bmod N^2) &= (m + m') \bmod N \\
        D(\mathcal{E}(m)^k \bmod N^2) &= km \bmod N, \, k \in \mathbf{N}
    \end{align*}
    ~\\
    Note that the second equality follows immediately from the first.
\end{frame}

\section{General Paillier Algorithm}

\begin{frame}
\frametitle{Paillier Supporting Function}
Let $X=\{u<N^2 : u = 1 \mod N\}$ and let $L:X\rightarrow \zmodn$ be
defined by
\begin{equation*}L(u) = \frac{u-1}{N} \mod N.\end{equation*}
This function is well defined over \zmodntunits.
\end{frame}

\begin{frame}
\frametitle{General Paillier Encryption}
The general Paillier algorithm differs only slightly from Pirk's version.
\begin{algorithm}[H]
  \caption{General Paillier encryption and decryption.}\label{alg.paillier_encrypt_original}
  \begin{algorithmic}[1]
    \Procedure{Paillier encryption}{}
    \State \begin{varwidth}[t]{\linewidth}
      \Given \(N\), a random \(g \in \zmodntunits\) of order a nonzero\par
  multiple of $N$, and a message \(m\in\zmodn\)
      \end{varwidth}
    \State \Select a random value \(\zeta\in \left(\zmodn\right)^{\times}\)
    \State \Return \(\mathcal{E}(m) = g^m \zeta^{N}\bmod{N^{2}}\)
    \EndProcedure
  \end{algorithmic}
  \begin{algorithmic}[1]
    \Procedure{Paillier decryption}{}
    \State \Given \(N\), \(\lambda(N)\), \(g\), and ciphertext \(c \in \zmodntunits\)
    \State \Return m = \(\frac{L( c^{\lambda(N)}\bmod N^{2})}{L( g^{\lambda(N)}\bmod N^{2})}\bmod N\)
    \EndProcedure
  \end{algorithmic}
\end{algorithm}
\end{frame}

\begin{frame}
\frametitle{Paillier Works}
  It is a straightforward exercise to check that
  \begin{itemize}
    \item $D(\mathcal{E}(m)) = m$
    \item $D(\mathcal{E}(m)\mathcal{E}(m')\bmod N^2) = (m + m') \bmod N $
  \end{itemize}
\end{frame}

\section{Paillier As Used In \NAME}
\begin{frame}
\frametitle{Paillier As Used In \NAME}
The version of Paillier used in \NAME is a computationally simpler variant of the
full Paillier scheme that sacrifices no security over the general case.
\end{frame}

\begin{frame}
  \frametitle{Converting Between The Two}
  Pirk's simplified version of Paillier simply uses
  \begin{align*}
    g &\equiv 1 + N \mod N^2\\
    \implies L(g^{\lambda(N)} \mod N^2) &= \lambda(N),
  \end{align*}
  the proof of which is a straightforward exercise.
\end{frame}

\begin{frame}
\frametitle{Paillier As Used In \NAME}
\begin{algorithm}[H]
  \caption{Paillier encryption and decryption}\label{alg.paillier_encrypt}
  \begin{algorithmic}[1]
    \Procedure{Paillier encryption}{}
    \State \Given \(N\) and a message \(m\in\zmodn\)
    \State \Select a random value \(\zeta\in \left(\zmodn\right)^{\times}\)
    \State \Return \(\mathcal{E}(m) = (1+mN)\zeta^{N}\bmod{N^{2}}\)
    \EndProcedure
  \end{algorithmic}

  \begin{algorithmic}[1]
    \Procedure{Paillier decryption}{}
    \State \Given \(N\), \(\lambda(N)\), and a ciphertext \(c\in\zmodntunits\)
    \State \Set \(\mu = \lambda(N)^{-1}\bmod N\)
    \Comment Recall \(\gcd(\lambda(N), N) = 1\)
    \State \Set \(\hat{c} = c^{\lambda(N)}\bmod N^{2}\)
    \State\label{step.div}\Set \(\hat{m} = L(c^{\lambda(N)}\bmod N^{2})\)
    \State \Return \(\hat{m}\mu\bmod N\)
    \EndProcedure
  \end{algorithmic}
\end{algorithm}
\end{frame}

\begin{frame}
  \frametitle{Paillier Reference}
  For more on Paillier encryption and the (hypothesized) hard problem upon
  which it is based, see\\~\\
  \mbox{\scriptsize \url{https://pirk.incubator.apache.org/papers/1999_asiacrypt_paillier_paper.pdf}}\\~\\
  on Pirk's website.
\end{frame}

\section{Wideskies}

\begin{frame}
  \frametitle{Wideskies Parameters}
  The algorithm requires the following parameters, which are not independent
  (see the next slide).
  \begin{itemize}
    \item $N$, the Paillier modulus
    \item $B$, the bit-length of $N$
    \item $H$ (or $H_k$), a keyed hash function (with key k)
    \item $\ell$, the bit length of the output of $H$, i.e.\
      $H_k:\mathbf{Z}\rightarrow (\mathbf{Z}/2\mathbf{Z})^\ell$
    \item $\tau$, the number of search terms
    \item $\delta$, the number of bits of data returned for each search hit
    \item $b$ the chunk size, in bits, determining how data is split among
      responses.
    \item $r$, the number of responses that can be returned per query request
      period per search term
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Parameter Relationships}
  \begin{itemize}
    \item $2^{b\tau} < N$: there must be space in the modulus to hold all the
      data, even if each search term hits as often as possible.
    \item $\tau < 2^\ell$: Although the paper permits search term hash
    collisions, Pirk does not permit them. Typically $\tau \ll 2^\ell$
    \item $b|\delta$: Chunk size must evenly divide the data size
    \item $\frac{\delta}{b} | r$: the number of chunks per returned datum must
      divide the number of responses, for bandwidth efficiency.
    \item $H$: Must be pseudo-random but need not be cryptographically secure.
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Public Parameters}
  All of \begin{equation*}H, \ell, N, B, \delta, b, \text{and } r\end{equation*}
  are public, that is, must be shared between the client and server.\\~\\

  Note that the fact that $2^{b\tau} < N$ gives some information on the number
  of search terms the client is using; the amount of this information can be
  decreased without bound by choosing $N$ and $\ell$ to be much larger than
  would be otherwise necessary; this necessarily causes a performance hit.
\end{frame}

\section{Wideskies Algorithm, Without Encryption}
\begin{frame}
  \frametitle{Wideskies Without Encryption?}
  The Wideskies algorithm is of sufficient complexity that it can be useful to
  go through the algorithm without the encryption and decryption steps first,
  in order to orient ourselves.\\~\\
  After, it will be straightforward to see the
  changes that using the Paillier encryption requires.
\end{frame}

\section{Query, Without Encryption}
\begin{frame}
  \frametitle{The Query Algorithm, Without Encryption}
  Let $T_0,\ldots,T_{\tau-1}\in\zmodn$ be our search terms.
  \begin{algorithm}[H]
  \caption{Query Formation Algorithm version
    1}\label{alg.plain_form_1}
\begin{algorithmic}[1]
  \State\label{step.key}Choose a random key \(k\) for \(H\).
  \State Compute \(H_{k}(T_{0}),\ldots,H_{k}(T_{\tau-1})\).
  \While{\(\mathrm{card}\left(\{H_{k}(T_{0}),\ldots,H_{k}(T_{\tau-1})\}\right)
    < \tau\)}
  \State \Goto{step.key}
  \Comment If there are hash collisions, pick a new key.
  \EndWhile
  \For{\(i=0,\ldots,2^{\ell}-1\)}
  \State\label{step.set}Set \begin{equation*}
    E_{i} = \left\{\begin{array}{l l}
    2^{jb} & \mbox{ if } i = H_{k}(T_{j}); \\
    0 & \mbox{otherwise.}
    \end{array}
    \right.
  \end{equation*}
  \EndFor
  \State\Return \(\{E_{0},\ldots,E_{2^{\ell}-1}, H, k, N\}\)
\end{algorithmic}
\end{algorithm}
\end{frame}

\begin{frame}
  \frametitle{Query Notes, Without Encryption}
  Since $\tau \ll 2^\ell$, we expect most of the $E_i$ to be zero.\\~\\
  We will typically denote $H_k(T)$ by $\mathcal{T}$ and its associated $E$ by
  $E_\mathcal{T}$. If we wish to keep track of a specific $T$ we will write
  $\mathcal{T}_j$ and $E_{\mathcal{T}_j}$.
\end{frame}

\section{Response, Without Encryption}
\begin{frame}
  \frametitle{Response Initialization, Without Encryption}
  We must initialize some values before forming the response.
  \begin{enumerate}
    \item $c_0,\ldots,c_{2^\ell - 1} = 0$, counters to keep track of the number
      of times each $E_\mathcal{T}$ has been seen.
    \item $Y_0,\ldots,Y_{r-1} = 0$, response vectors.
  \end{enumerate}
\end{frame}

\begin{frame}
  \frametitle{Response Data, Without Encryption}
  Responder information comes in pairs $(T, D)$ where $T$ is a (potential)
  search term, and $D$ is $T$'s associated response datum, which will be
  returned if $T$ is a search term.\\~\\

  We view $D$ as a $\delta$-long bit stream $(d_0,\ldots,d_{\delta-1})$, and
  break $D$ up into $\delta/b$ chunks $D_i$ as
  \begin{equation*}
    D_i = (d_{i\cdot b}, d_{i\cdot b+1},\ldots,d_{(i+1)\cdot b-1}),\ i=0,\ldots,\delta/b-1.
  \end{equation*}\\~\\
  For example, if $D=011010$ and $b=3$, then
  \begin{align*}
    D_0 &= 011\\
    D_1 &= 010
  \end{align*}
\end{frame}

\begin{frame}
  \frametitle{Response Algorithm, Without Encryption}
  \begin{algorithm}[H]
  \caption{Stream processing, plaintext version}\label{alg.plain_stream}
\begin{algorithmic}[1]
\State \textbf{Input}:  $\mathbf{T} = \{ (T,D) \}$
\For{$(T,D) \in \mathbf{T}$}
  \State Compute \(\mathcal{T} = H_{k}(T)\)
  \If{\(c_{\mathcal{T}} + \frac{\delta}{b} > r\)}\label{step.if}
  \Comment The space allocated for term \(T\) is full.
  \State \Return \label{step.return}
\Else
  \State Split \(D\) into \(b\)-bit chunks
  \(D_{0},\ldots,D_{(\delta/b)-1}\).
  \For{\(i=0,\ldots,(\delta/b)-1\)}
  \State\label{step.multiply}Set \(\mathcal{D}_{i} = D_{i}E_{\mathcal{T}}\bmod N\)
  \Comment Nonzero only if \(E_{\mathcal{T}}\neq 0\).
  \State Set \(Y_{i+c_{\mathcal{T}}} =
  Y_{i+c_{\mathcal{T}}}+\mathcal{D}_{i}\bmod N\)
  \EndFor
  \State Set \(c_{\mathcal{T}} = c_{\mathcal{T}}+(\delta/b)\)
\EndIf

\EndFor
\State{\textbf{Output}}: \(Y_{0},\ldots,Y_{r-1}\)
\end{algorithmic}
\end{algorithm}
\end{frame}

\begin{frame}
  \frametitle{Response Example, Without Encryption}
  Let's look at how the response would look on the first four $(T,D)$ pairs that
  pass through the algorithm.
\end{frame}

\begin{frame}
  \frametitle{Response Example Setup, Without Encryption}
  Suppose that among our search terms are $T$ and $T'$, with
  \begin{align*}
    H_k(T) &= j\text{ and}\\
    H_k(T') &= j'.
  \end{align*}~\\

  Suppose that $T''$, with $H_k(T'')=j''$, is \emph{not} a search term.\\~\\

  Let the responder see, in order, the pairs $(T, D^0)$, $(T', D^1)$,
  $(T'', D^2)$, $(T, D^3)$.\\~\\

  The $Y_i$ are formed by summing down the columns in following matrices.
\end{frame}

\begin{frame}
  \frametitle{Response Example Start, Without Encryption}
  No terms have yet been evaluated.
  \begin{center}
  \begin{tabular}{c  C{1.55cm}  c  C{1.55cm}  C{1.55cm}  c  C{1.55cm}  }
   {\scriptsize Index}             & $Y_0$\qquad            & $\cdots$\qquad         & $Y_{\delta/b-1}$\qquad & $Y_{\delta/b}$\qquad   & $\cdots$\qquad         & $Y_{2\delta/b-1}$\qquad\\\toprule
    $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
 {\footnotesize$j$} & 0                        & $\cdots$                         & 0                         & 0                         & $\cdots$                         & 0                         \\
    $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
 {\footnotesize$j'$}  & 0                      & $\cdots$                           & 0                           & 0                      & $\cdots$                           & 0\\
    $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j''$}  & 0 & $\cdots$                           & 0         & 0                      & $\cdots$                           & 0\\
    $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\\bottomrule
  \end{tabular}
  \end{center}
  $c_{j} = 0$, $c_{j'} = 0$, $c_{j''} = 0$.
\end{frame}

\begin{frame}
  \frametitle{Response Example: First Term, Without Encryption}
  $(T, D^0)$ enters and is proccessed; hit:
  \begin{center}
  \begin{tabular}{c  C{1.55cm}  c  C{1.55cm}  C{1.55cm}  c  C{1.55cm}  }
     {\scriptsize Index}             & $Y_0$\qquad            & $\cdots$\qquad         & $Y_{\delta/b-1}$\qquad & $Y_{\delta/b}$\qquad   & $\cdots$\qquad         & $Y_{2\delta/b-1}$\qquad\\\toprule
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j$} & {\footnotesize $\bm{D^0_0} 2^{jb}$}                         & $\cdots$                         & {\footnotesize $\bm{D^0_{\delta/b-1}} 2^{jb}$}                      & 0                         & $\cdots$                         & 0                         \\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j'$}  & 0 & $\cdots$                           & 0                           & 0                      & $\cdots$                           & 0\\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j''$}  & 0 & $\cdots$                           & 0         & 0                      & $\cdots$                           & 0\\
    $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\\bottomrule
  \end{tabular}
  \end{center}
  $\bm{c_{j} = \delta/b}$, $c_{j'} = 0$, $c_{j''} = 0$.
\end{frame}

\begin{frame}
  \frametitle{Response Example Second Term, Without Encryption}
  $(T', D^1)$ enters and is proccessed; hit:
  \begin{center}
  \begin{tabular}{c  C{1.55cm}  c  C{1.55cm}  C{1.55cm}  c  C{1.55cm}  }
     {\scriptsize Index}             & $Y_0$\qquad            & $\cdots$\qquad         & $Y_{\delta/b-1}$\qquad & $Y_{\delta/b}$\qquad   & $\cdots$\qquad         & $Y_{2\delta/b-1}$\qquad\\\toprule
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j$} & {\footnotesize ${D^0_0} 2^{jb}$}                         & $\cdots$                         & {\footnotesize ${D^0_{\delta/b-1}} 2^{jb}$}                      & 0                         & $\cdots$                         & 0                         \\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j'$}  & {\footnotesize $\bm{D^1_0} 2^{j'b}$} & $\cdots$                           & {\footnotesize $\bm{D^1_{\delta/b-1}} 2^{j'b}$}                           & 0                      & $\cdots$                           & 0\\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j''$}  & 0 & $\cdots$                           & 0         & 0                      & $\cdots$                           & 0\\
    $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\\bottomrule
  \end{tabular}
  \end{center}
  $c_{j} = \delta/b$, $\bm{c_{j'} = \delta/b}$, $c_{j''} = 0$.
\end{frame}

\begin{frame}
  \frametitle{Response Example Third Term, Without Encryption}
  $(T'', D^2)$ enters and is proccessed; no hit:
  \begin{center}
  \begin{tabular}{c  C{1.55cm}  c  C{1.55cm}  C{1.55cm}  c  C{1.55cm}  }
     {\scriptsize Index}             & $Y_0$\qquad            & $\cdots$\qquad         & $Y_{\delta/b-1}$\qquad & $Y_{\delta/b}$\qquad   & $\cdots$\qquad         & $Y_{2\delta/b-1}$\qquad\\\toprule
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j$} & {\footnotesize ${D^0_0} 2^{jb}$}                         & $\cdots$                         & {\footnotesize ${D^0_{\delta/b-1}} 2^{jb}$}                      & 0                         & $\cdots$                         & 0                         \\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j'$}  & {\footnotesize ${D^1_0} 2^{j'b}$} & $\cdots$                           & {\footnotesize ${D^1_{\delta/b-1}} 2^{j'b}$}                           & 0                      & $\cdots$                           & 0\\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j''$}  & {\footnotesize $\bm{D^2_0} \cdot 0$}  & $\cdots$                           & {\footnotesize $\bm{D^2_{\delta/b-1}} \cdot 0$}     & 0                      & $\cdots$                           & 0\\
    $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\\bottomrule
  \end{tabular}
  \end{center}
$c_{j} = \delta/b$, $c_{j'} = \delta/b$, $\bm{c_{j''} = \delta/b}$.
\end{frame}

\begin{frame}
  \frametitle{Response Example Fourth Term, Without Encryption}
  $(T, D^3)$ enters and is proccessed; hit:
  \begin{center}
  \begin{tabular}{c  C{1.55cm}  c  C{1.55cm}  C{1.55cm}  c  C{1.55cm}  }
     {\scriptsize Index}             & $Y_0$\qquad            & $\cdots$\qquad         & $Y_{\delta/b-1}$\qquad & $Y_{\delta/b}$\qquad   & $\cdots$\qquad         & $Y_{2\delta/b-1}$\qquad\\\toprule
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j$} & {\footnotesize ${D^0_0} 2^{jb}$}                         & $\cdots$ & {\footnotesize ${D^0_{\delta/b-1}} 2^{jb}$}                      & {\footnotesize $\bm{D^3_0} 2^{jb}$}                         & $\cdots$ & {\footnotesize $\bm{D^3_{\delta/b-1}} 2^{jb}$}                         \\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j'$}  & {\footnotesize ${D^1_0} 2^{j'b}$} & $\cdots$                           & {\footnotesize ${D^1_{\delta/b-1}} 2^{j'b}$}                           & 0                      & $\cdots$                           & 0\\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j''$}  & {\footnotesize $\bm{D^2_0} \cdot 0$}  & $\cdots$                           & {\footnotesize $\bm{D^2_{\delta/b-1}} \cdot 0$}     & 0                      & $\cdots$                           & 0\\
    $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\\bottomrule
  \end{tabular}
  \end{center}
  $\bm{c_{j} = 2\delta/b}$, $c_{j'} = \delta/b$, $c_{j''} = \delta/b$.
\end{frame}

\section{Result, Without Encryption}
\begin{frame}
  \frametitle{Result, Without Encryption}
  The algorithm for getting the results out of the response return is
  straightforward. To begin,\\~\\
  \begin{itemize}
    \item Write $Y_i = \sum_{k=0}^{\tau - 1} 2^{kb}P_{ki}$ in base $2^b$, where
      $P_{ki}$ is the value of the $k^{\text{th}}$ row in the
      $i^{\text{th}}$ column. Note each $P_{ki}$ is $b$-bits long, and therefore
      $Y_i < N$.
    \item $Y_i$ will have data on search term $T$ if and only if $T$ was
      seen $i+1$ times before the responder returned.
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Result Algorithm, Without Encryption}
  \begin{algorithm}[H]

  \caption{Data recovery, plaintext version}\label{alg.plain_recover}
\begin{algorithmic}[1]
  \State Set \(M = 2^{j b}(2^{b}-1)\)
  \Comment $b$ $1$s left-shifted $jb$ places.
  \For{\(\eta=1,\ldots,(rb/\delta)\)}
  \Comment At most \(rb/\delta\) hits can be returned.
  \For{\(i=0,\ldots,(\delta/b)-1\)}
  \Comment Each hit uses \(\delta/b\) chunks.
  \State\label{step.mask}Set \(D_{i} = Y_{(\eta-1)(\delta/b)+i}\&M\)
  \Comment ``\(\&\)'' denotes bit-wise \texttt{AND}.
  \State\label{step.shift}Set \(D_{i} = D_{i}/2^{jb}\)
  \Comment Step \ref{step.mask} ensures \(2^{jb}\mid D_{i}\)
  \EndFor
  \State Set \(X_{\eta} = D_{0}\|D_{1}\|\ldots\|D_{(\delta/b)-1}\)
  \EndFor
  \State \Return \(X_{1},\ldots,X_{(rb/\delta)}\)
  \Comment the data corresponding to selector \(T_{j}\)
\end{algorithmic}
\end{algorithm}
\end{frame}

\section{Wideskies Algorithm, With Encryption}
\begin{frame}
  \frametitle{Adding Encryption To The Mix}
  Adding encryption is straightforward. The following slides have the
  encryption-enabled algorithms, with the differences from the earlier slides
  in bold.
\end{frame}

\section{Query, Encrypted}
\begin{frame}
  \frametitle{Query, Encrypted}
  \begin{algorithm}[H]
  \caption{Query formation, ciphertext version 1}\label{alg.cipher_form_1}
\begin{algorithmic}[1]
  \State\label{step.key_2}Choose a random key \(k\) for \(H\).
  \State Compute \(H_{k}(T_{0}),\ldots,H_{k}(T_{\tau-1})\).
  \While{\(\mathrm{card}\left(\{H_{k}(T_{0}),\ldots,H_{k}(T_{\tau-1})\}\right)
    < \tau\)}
  \State \Goto{step.key_2}
  \EndWhile
  \For{\(i=0,\ldots,2^{\ell}-1\)}
  \State Set
  {
  \bfseries\boldmath
  \begin{equation*}
    \mathcal{E}_{i} = \left\{\begin{array}{l l}
        \mathcal{E}(2^{jb}) & \mbox{ if }i=H_{k}(T_{j})\mbox{ for some
        }j\in\{0,\ldots,\tau-1\} \\
        \mathcal{E}(0) & \mbox{ otherwise.}
      \end{array}
    \right.
  \end{equation*}}
  \EndFor
  \State \Return \(\{\mathcal{E}_{0},\ldots,\mathcal{E}_{2^{\ell}-1}, H,
  k, N\}\)
\end{algorithmic}
\end{algorithm}
\end{frame}

\section{Response, Encrypted}
\begin{frame}
  \frametitle{Response Initialization, Encrypted}
  As before, we must initialize some values before forming the response.
  \begin{enumerate}
    \item $c_0,\ldots,c_{2^\ell - 1} = 0$, counters to keep track of the number
      of times each {\boldmath $\mathcal{E}_\mathcal{T}$} has been seen.
    \item {\bfseries\boldmath $Y_0,\ldots,Y_{r-1} = 1$, response vectors.}
  \end{enumerate}
\end{frame}

\begin{frame}
  \frametitle{Response, Encrypted}
  \begin{algorithm}[H]
  \caption{Stream processing, ciphertext version}\label{alg.cipher_processing}
\begin{algorithmic}[1]
\State \textbf{Input}:  $\mathbf{T} = \{ (T,D) \}$
\State \textbf{Initialize:}
\State \qquad Counters $c_i = 0 \, , \, 0 \leq i \leq (2^l -1)$
\State \qquad Paillier ciphertext values  $\mathcal{Y}_{j} = 1 \, , \, 0 \leq j \leq (r-1)$
\For{$(T,D) \in \mathbf{T}$}
  \State Compute \(\mathcal{T} = H_{k}(T)\)
  \If{\(c_{\mathcal{T}}+\frac{\delta}{b} > r\)}
  \State \Return
  \Else
  \State Split \(D\) into \(b\)-bit chunks,
  \(D=D_{0},\ldots,D_{(\delta/b)-1}\) \label{step.datachunk}
  \For{\(i=0,\ldots,(\delta/b)-1\)}
  \State {\bfseries\boldmath Set \(\mathcal{D}_{i} =
  \mathcal{E}_{\mathcal{T}}^{D_{i}}\bmod N^{2}\)}
  \State {\bfseries\boldmath Set \(\mathcal{Y}_{i+c_{\mathcal{T}}} =
  \mathcal{Y}_{i+c_{\mathcal{T}}}\mathcal{D}_{i}\bmod N^{2}\)}
  \EndFor
  \State Set \(c_{\mathcal{T}} = c_{\mathcal{T}}+(\delta/b)\)
  \EndIf
\EndFor
\State{\textbf{Output}}: \(\mathcal{Y}_{0},\ldots,\mathcal{Y}_{r-1}\)
\end{algorithmic}
\end{algorithm}
\end{frame}

\section{Result, Encrypted}
\begin{frame}
  \frametitle{Result, Encrypted (and then Decrypted)}
  Actually literally the same algorithm as before is used; the only difference
  is that we first decrypt the encrypted $\mathcal{Y}_i$.
\end{frame}

\section{Distributed Version}
\begin{frame}
  \frametitle{Distributed Version}
  The paper goes over how to do the distributed version; the change is
  straightforward, and our earlier example slides make it easy to see how it
  works.
\end{frame}

\begin{frame}
  \frametitle{Distributed Difference:\\ Unencrypted Sums, Encrypted Products}
  Recall our example matrix:
  \begin{center}
  \begin{tabular}{c  C{1.55cm}  c  C{1.55cm}  C{1.55cm}  c  C{1.55cm}  }
     {\scriptsize Index}             & $Y_0$\qquad            & $\cdots$\qquad         & $Y_{\delta/b-1}$\qquad & $Y_{\delta/b}$\qquad   & $\cdots$\qquad         & $Y_{2\delta/b-1}$\qquad\\\toprule
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j$} & {\footnotesize ${D^0_0} 2^{jb}$}                         & $\cdots$ & {\footnotesize ${D^0_{\delta/b-1}} 2^{jb}$}                      & {\footnotesize ${D^3_0} 2^{jb}$}                         & $\cdots$ & {\footnotesize ${D^3_{\delta/b-1}} 2^{jb}$}                         \\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j'$}  & {\footnotesize ${D^1_0} 2^{j'b}$} & $\cdots$                           & {\footnotesize ${D^1_{\delta/b-1}} 2^{j'b}$}                           & 0                      & $\cdots$                           & 0\\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j''$}  & {\footnotesize $\bm{D^2_0} \cdot 0$}  & $\cdots$                           & {\footnotesize $\bm{D^2_{\delta/b-1}} \cdot 0$}     & 0                      & $\cdots$                           & 0\\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\\bottomrule
  \end{tabular}
  \end{center}
\end{frame}

\begin{frame}
  \frametitle{Distributed Difference:\\ Unencrypted Sums, Encrypted Products}
  When we moved to an encrypted algorithm, all of the $D_i$-long sums of
  $E_i$ became
  $\mathcal{E}_i^{\mathcal{D}_i}$.\\~\\
  In the distributed version, we actually make matrix components rather than
  the fake matrix of $D_i$ in certain bit-positions we had earlier.\\~\\

  In the matrix, rows are indexed by $0 \leq \mathcal{T} \leq 2^\ell
  -1$, columns by $0 \leq j \leq r-1$.
\end{frame}

\begin{frame}
  \frametitle{Distributed Difference:\\ Unencrypted Sums, Encrypted Products}
  As before, let
  \begin{align*}
    H_k(T) &= j,\\
    H_k(T') &= j',\text{ and}\\
    H_k(T'') &= j'',
  \end{align*}
  with $T$ and $T'$ search terms and $T''$ not.\\~\\
  Notice that this time we won't simply discard the data $D_2$ from $T''$;
  we no longer multiply it by zero, but use it as the exponent of
  $\mathcal{E}_{j''}$, which is an encryption of $0$.
\end{frame}

\begin{frame}
  \frametitle{Distributed Difference:\\ Unencrypted Sums, Encrypted Products}
  The matrix in the encrypted setting:
  \begin{center}
  \begin{tabular}{c  C{1.35cm}  c  C{1.35cm}  C{1.35cm}  c  C{1.35cm}  }
     {\scriptsize Index}             & $\mathcal{Y}_0$\qquad            & $\cdots$\qquad         & $\mathcal{Y}_{\delta/b-1}$\qquad & $\mathcal{Y}_{\delta/b}$\qquad   & $\cdots$\qquad         & $\mathcal{Y}_{2\delta/b-1}$\qquad\\\toprule
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j$} & {\footnotesize $\mathcal{E}_j^{D^0_0}$} & $\cdots$ & {\footnotesize $\mathcal{E}_j^{D^0_{\delta/b-1}}$}                      & {\footnotesize $\mathcal{E}_j^{D^3_0}$}                         & $\cdots$ & {\footnotesize $\mathcal{E}_j^{D^3_{\delta/b-1}}$}                         \\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j'$}  & {\footnotesize $\mathcal{E}_{j'}^{D^1_0}$} & $\cdots$                           & {\footnotesize $\mathcal{E}_{j'}^{D^1_{\delta/b-1}}$}                           & 1                      & $\cdots$                           & 1\\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\
     {\footnotesize$j''$}  & {\footnotesize $\mathcal{E}_{j''}^{D^2_0}$} & $\cdots$                           & {\footnotesize $\mathcal{E}_{j''}^{D^2_{\delta/b-1}}$}                           & 1                      & $\cdots$                           & 1\\
     $\vdots$ & \multicolumn{6}{l}{$\qquad$}\\\bottomrule
  \end{tabular}
  \end{center}
\end{frame}

\begin{frame}
  \frametitle{Algorithm In Matrix Form}
  \begin{algorithm}[H]
  \caption{Responder -  Matrix Variant}\label{alg.matrix_processing}
\begin{algorithmic}[1]
  \State {\scriptsize \textbf{Input:}  $\mathbf{T} = \{ (T,D) \}$}
\State{\scriptsize  \textbf{Initialize:}}
\State{\scriptsize  \qquad Counters $c_i = 0 \, , \, 0 \leq i \leq (2^l -1)$}
\State{\scriptsize  \qquad Paillier ciphertext values  $\mathcal{Y}_{j} = 1 \, , \, 0 \leq j \leq (r-1)$}
\For{\scriptsize {$(T,D) \in \mathbf{T}$}}
\State{\scriptsize  Compute \(\mathcal{T} = H_{k}(T)\)}
\Comment{\scriptsize  View as the row index of $M: m_{\mathcal{T}, \, j}$}
  \If{\scriptsize {\(c_{\mathcal{T}}+\frac{\delta}{b} > r\)}}
  \State{\scriptsize  \Return}
\Else{\scriptsize }
  \State{\scriptsize  Split \(D\) into \(b\)-bit chunks, \(D=D_{0}\|D_{1}\|\ldots\|D_{(\delta/b)-1}\)}
  \For{\scriptsize {\(k=0,\ldots,(\delta/b)-1\)}}
  \State{\scriptsize  Set \(m_{\mathcal{T}, \, c_{\mathcal{T}}+k} = \mathcal{E}_{\mathcal{T}}^{D_{k}}\bmod N^{2}\)}
  \EndFor{\scriptsize }
  \State{\scriptsize  Set \(c_{\mathcal{T}} = c_{\mathcal{T}}+(\delta/b)\)}
 \EndIf{\scriptsize }
\EndFor{\scriptsize }
\For{\scriptsize {$0\leq j \leq (r-1)$}:}
\State{\scriptsize  \qquad \qquad $\mathcal{Y}_{j} \, = \,  \prod_{i = 0}^{2^l -1} m_{i,j}$ }
\EndFor{\scriptsize }
\State{\scriptsize {\textbf{Output}}: \(\mathcal{Y}_{0},\ldots,\mathcal{Y}_{r-1}\)}
\end{algorithmic}
\end{algorithm}
\end{frame}

\begin{frame}
  \frametitle{Distributed Algorithm}
  \begin{algorithm}[H]
  \caption{Responder -  Distributed Variant}\label{alg.dist_processing}
\begin{algorithmic}[1]
  \State {\scriptsize \textbf{Input:}  $\mathbf{T} = \{ (T,D) \}$}
\For{\scriptsize {$(T,D) \in \mathbf{T}$} in parallel}
\State{\scriptsize  Compute \(\mathcal{T} = H_{k}(T)\)}
\Comment{\scriptsize  View as the row index of $M: m_{\mathcal{T}, \, j}$}
  \State{\scriptsize  Split \(D\) into \(b\)-bit chunks, \(D=D_{0}\|D_{1}\|\ldots\|D_{(\delta/b)-1}\)}
\State{\scriptsize  Form $\mathbf{D} = \{D_k : 0 \leq k \leq (\delta/b)-1\}$}
\State{\scriptsize  \textbf{Emit} $(\mathcal{T}, \mathbf{D})$}
  \EndFor{\scriptsize }
 \For{\scriptsize  {each $\mathcal{T}$} in parallel}
\State{\scriptsize  Initialize $c_{\mathcal{T}} = 0$}
\While{\scriptsize  {$c_{\mathcal{T}} <  r$}}
\For{\scriptsize {each $(\mathcal{T}, \mathbf{D})$} }
\For{\scriptsize  {each $D_k \in \mathbf{D} \, , \, 0 \leq k \leq \ldots,(\delta/b)-1$}}
  \State{\scriptsize  Set \(m_{\mathcal{T}, \, c_{\mathcal{T}}} = \mathcal{E}_{\mathcal{T}}^{D_{k}}\bmod N^{2}\)}
\State{\scriptsize  \textbf{Emit} $(c_{\mathcal{T}}, m_{\mathcal{T}, \, c_{\mathcal{T}}})$}
\State{\scriptsize  $ c_{\mathcal{T}} = c_{\mathcal{T}} +  1$}
\EndFor{\scriptsize }
\EndFor{\scriptsize }
\EndWhile{\scriptsize }
\EndFor{\scriptsize }
\For{\scriptsize {$0\leq j \leq (r-1)$ in parallel}:}
\State{\scriptsize  \qquad \qquad $\mathcal{Y}_{j} \, = \,  \prod_{i = 0}^{2^l -1} m_{i,j}$ }
\EndFor{\scriptsize }
\State{\scriptsize {\textbf{Output}}: \(\mathcal{Y}_{0},\ldots,\mathcal{Y}_{r-1}\)}
\end{algorithmic}
\end{algorithm}
\end{frame}

\section{`Actual' Example}
\begin{frame}
  \frametitle{Actual Example Setup}
We run through the above with actual numbers.\\~\\
Let
\begin{itemize}
  \item $N = 35$, $p=5$, $q=7$, $\lambda(N) = 12$, $B=5$.
  \item $\tau$, the number of terms we'll search for, is $2$. These terms are
    $T_0 = 0$ and $T_1 = 3$.
  \item We won't specify most of $H$; only that $\ell=4$, $H(T_0) = 0110 = 6$ and
    $H(T_3) = 0010 = 2$.
  \item Our return data are $\delta=4$ bits long; let $b=2$. We limit ourselves
    to $r=4$.
  \item Let's consult an RNG to choose values of $\zeta$ for use in Paillier.
\end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Let's Consult an RNG}
  \begin{center}
  \includegraphics[width=2.5in,keepaspectratio]{random_number.png}
\end{center}
\bigskip \bigskip {\scriptsize Source:
  \url{http://imgs.xkcd.com/comics/random_number.png}, used under
  \url{http://www.xkcd.com/license.html}}
\end{frame}

\begin{frame}
  \frametitle{Actual Example Setup}
  Great, we will randomly set $\zeta = 4$ for all encryptions.
\end{frame}

\begin{frame}
  \frametitle{Example Query}
  \begin{itemize}
    \item Since $H(T_0) = 6$,
      \begin{align*}
        \mathcal{E}_6 &= \mathcal{E}(2^{0\cdot2})\\
          &= 639
      \end{align*}
    \item Similarly, since $H(T_1) = 2$,
      \begin{align*}
        \mathcal{E}_2 &= \mathcal{E}(2^{1\cdot2})\\
          &= 359.
      \end{align*}
    \item All other terms are encryptions of $0$; we will write these as $1$
      even though they would in fact be distributed across a wide array of
      values in \zmodntunits.
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Example Response}
  Suppose, as in our example above, that the responder inputs, in order, are
  $(T_0,D^0)$, $(T_1,D^1)$, $(5, D^2)$, and $(T_0,D^3)$, after
  which point the responder returns (perhaps another $T_0$ comes in, thus causing
  $c_{\mathcal{T}_0}$ to be greater than $r$). Here,
  \begin{align*}
    D^0 &= 0000 = (D^0_0, D^0_1) = (00, 00),\\
    D^1 &= 0110 = (D^1_0, D^1_1) = (01, 10),\\
    D^2 &= 0111 = (D^2_0, D^2_1) = (01, 11),\\
    D^3 &= 0010 = (D^3_0, D^3_1) = (00, 10),\\
  \end{align*}~\\

  Note that since $5$ is not a search term, it will result in raising an
 encrypted zero to $D^2=7$; again, we're just going to write $1$, even though the
  acutal algorithm may (will) have any encryption of $0$ instead.
\end{frame}

\begin{frame}
  \frametitle{Example Response Matrix}
  The responder forms the matrix
  \begin{center}
  \begin{tabular}{c  C{2.25cm}  C{2.25cm}  C{2.25cm}  C{2.25cm}  }
     {\scriptsize Index}             & $\mathcal{Y}_0$ & $\mathcal{Y}_1$ & $\mathcal{Y}_2$ & $\mathcal{Y}_{3}$\\\toprule
     $\vdots$ & \multicolumn{4}{l}{$\qquad$}\\
     {\footnotesize{\tiny $2$}} & {\tiny $\mathcal{E}_2^{D^1_0}\mod N^2 = 359$} & {\tiny $\mathcal{E}_2^{D^1_1}\mod N^2 = 256$}      & 1                      & 1\\
     {\tiny $\vdots$} & \multicolumn{4}{l}{{\tiny $\qquad$}}\\
     {\footnotesize{\tiny $6$}}  & {\tiny $\mathcal{E}_6^{D^0_0} \mod N^2 = 1$} & {\tiny$\mathcal{E}_6^{D^0_1}\mod N^2 = 1$} & {\tiny $\mathcal{E}_6^{D^3_0}\mod N^2 = 1$}    &  {\tiny $\mathcal{E}_6^{D^3_1}\mod N^2 = 396$} \\
     {\footnotesize{\tiny $7$}}  & 1 & 1 & 1                      & 1\\
     {\tiny $\vdots$} & \multicolumn{4}{l}{{\tiny $\qquad$}}\\\bottomrule
  \end{tabular}
  \end{center}
\end{frame}

\begin{frame}
  \frametitle{Example Responses}
  The only interesting responses are $\mathcal{Y}_0 = 359$, $\mathcal{Y}_1=256$, and $\mathcal{Y}_3 = 396$ (products are taken down columns).
\end{frame}

\begin{frame}
  \frametitle{Example Result}
  We decrypt to $Y_0=0100$, $Y_1 =8 = 1000 $ and $Y_3 = 2 = 0010$, and then run through the processing algorithm:
  \begin{itemize}
    \item Data For $T_0$: $M=0011$
      \begin{itemize}
        \item $X_1 = 0$:
          \begin{itemize}
            \item $D_0 = (Y_0 \& 0011)/2^0 = 00$
            \item $D_1 = (Y_1 \& 0011)/2^0 = 00$
          \end{itemize}
        \item $X_2 = 2$:
          \begin{itemize}
            \item $D_0 = (Y_2 \& 0011)/2^0 = 00$
            \item $D_1 = (Y_3 \& 0011)/2^0 = 10$
          \end{itemize}
      \end{itemize}
  \end{itemize}
\end{frame}

\begin{frame}
  \frametitle{Example Result}
  We decrypted to $Y_0 = 0100$, $Y_1 =8 = 1000 $ and $Y_3 = 2 = 0010$, and then run through the processing algorithm:
  \begin{itemize}
    \item Data For $T_1$: $M=1100$.
      \begin{itemize}
        \item $X_1 = 6$:
          \begin{itemize}
            \item $D_0 = (Y_0 \& 1100)/2^2 = 01$
            \item $D_1 = (Y_1 \& 1100)/2^2 = 10$
          \end{itemize}
        \item $X_2 = 0$:
          \begin{itemize}
            \item $D_0 = (Y_2 \& 1100)/2^2 = 00$
            \item $D_1 = (Y_3 \& 1100)/2^2 = 00$
          \end{itemize}
      \end{itemize}
  \end{itemize}
  These results are precisely the data the responder had.$^*$\\~\\
  {\tiny *: We cannot distinguish the fact that $X_2$ is a non-response
  from the possibility that $X_2$ represents an actual return of a datum $D=0$
from the responder. In practice, one must avoid using $D=0$ to eliminate this
ambiguity}
\end{frame}
\end{document}


% declare document class and geometry
\documentclass[12pt]{article} % use larger type; default would be 10pt
\usepackage[english]{babel} % for hyphenation dictionary
%\setdefaultlanguage{english} % polyglossia command for use with XeTeX / LuaTeX
\usepackage[margin=1in]{geometry} % handle page geometry

% import packages and commands
\input{../header2.tex}

% title information
\title{Phys 221A -- Quantum Mechanics -- Lec19}
\author{UCLA, Fall 2014}
\date{\formatdate{8}{12}{2014}} % Activate to display a given date or no date (if empty),
         % otherwise the current date is printed
         % format: formatdate{dd}{mm}{yyyy}

\begin{document}
\maketitle

\section{More angular momentum}

Recall from last time that we have a complete set of commuting operators in $J_z, \v J^2$. This set has ``non-rotational'' degrees of freedom. Furthermore we have
\begin{gather}
\v J^2 = J_z^2 + \frac{1}{2} (J_+ J_- + J_- J_+), \\
[\v J^2, J_z] = 0.
\end{gather}
So we have a set of simultaneous eigenstates $\ket{a,b}$ with eigenvalues
\begin{eqn}
\v J^2 \ket{a,b} = a \ket{a,b}, \qquad
J_z \ket{a,b} = b \ket{a,b}.
\end{eqn}
Since our operators $\v J^2, J_z$ are Hermitian we know of course that $a,b \in \R$.

Now, how can we determine the eigenvalues? We can use the commutation relations
\begin{eqn}
[J_z, J_\pm] = \pm \hbar J_\pm, \qquad
[\v J^2, J_\pm] = 0
\end{eqn}
where we know that
\begin{eqn}
J_\pm \ket{a,b} \propto \ket{a, b \pm \hbar}.
\end{eqn}
So we find that
\begin{gather}
J_z (J_\pm \ket{a,b}) = (b \pm \hbar) J_\pm \ket{a,b} \\
\v J^2 (J_\pm \ket{a,b}) = a (J_\pm \ket{a,b}).
\end{gather}
Furthermore we know that
\begin{align}
a &= \matrixel[0]{a,b}{\v J^2}{a,b} \\
	&= b^2 + \matrixel[0]{a,b}{J_x^2 + J_y^2}{a,b} \\
	&\geq b^2
\end{align}
so there must be exist a maximum and minimum $b_\mathrm{max}, b_\mathrm{min}$ value of $b$. Then since
\begin{eqn}
0 = \matrixel[0]{a,b_\mathrm{max}}{J_\pm J_\mp}{a, b_\mathrm{max}}
\end{eqn}
we have
\begin{eqn}
0 = a - b_\mathrm{max}^2 - \hbar b_\mathrm{max} = a - b_\mathrm{min}^2 - \hbar b_\mathrm{min}.
\end{eqn}
so that we must have $b_\mathrm{min} = -b_\mathrm{max}$. Then due to the ladder operator nature of $J_\pm$ we have
\begin{eqn}
b_\mathrm{max} = b_\mathrm{min} + n \hbar = \frac{n\hbar}{2}, \qquad
n \in \Z
\end{eqn}
So, defining $j = b_\mathrm{max} / \hbar = n/2$ and $m = b / \hbar$, we have
\begin{gather}
a = b_\mathrm{max} (b_\mathrm{max} + \hbar) = \hbar^2 j (j+1) = 0, \frac{1}{2}, 1, \frac{3}{2}, \dots, \\
b = \hbar m = -j, -j+1, \dots, j-1, j.
\end{gather}

It is convenient and standard to denote the eigenstates by $\ket{j,m}$ instead of $\ket{a,b}$. So for each value of $j = 0, \frac{1}{2}, 1, \frac{3}{2}, \dots$ we have a ladder of $2j+1$ states
\begin{eqn}
\ket{j,j}, \ket{j,j-1}, \dots, \ket{j,-j+1}, \ket{j,-j}
\end{eqn}
each of which can be obtained from its neighbors by acting upon it with $J_\pm$, up to a multiplying factor
\begin{eqn}
J_\pm \ket{j,m} = c^\pm_{jm} \ket{j, m \pm 1}.
\end{eqn}
We can determine these factor sy working out the matrix element
\begin{align}
\abs[0]{c^\pm_{jm}}^2
	&= \matrixel[0]{j,m}{J^\dagger_\pm J_\pm}{j,m} \\
	&= \matrixel[0]{j,m}{\v J^2 - J_z^2 \mp \hbar J_z}{j,m} \\
	&= \hbar^2 (j \mp m) (j \pm m + 1),
\end{align}
thus up to an arbitrary phase we have
\begin{eqn}
c^\pm_{jm} = \hbar \sqrt{(j \mp m) (j \pm m + 1)}.
\end{eqn}
Finally, for the general matrix element of $J_\pm$ we have
\begin{eqn}
\matrixel[0]{j,m}{J_\pm}{j',m'} = c^\pm_{jm} \delta_{j'j} \delta_{m',m\pm1}.
\end{eqn}

Now, recall that for $j=1/2$ we have the usual spinor representation
\begin{eqn}
J_z = \frac{\hbar}{2} \pmat{ 1 & 0 \\ 0 & -1}.
\end{eqn}
More generally, for arbitrary $j$ we have
\begin{eqn}
J_z = \hbar
\begin{pmatrix}
j & & & & \\
& j-1 & & & \\
& & \ddots & & \\
& & & -j+1 & \\
& & & & -j
\end{pmatrix}.
\end{eqn}
To find the eigenstates for the full Hilbert space, we can follow this procedure:
\begin{enumerate}
\item ``Diagonalize'' $\v J^2$, collecting eigenkets with the largest possible $J_z$, i.e. find all $\v J^2$ eigenstates. This gives us all possible $\ket{j,j}$s.
\item Next, orthonormalize them (e.g. using Gram-Schmidt) to generate other quantum numbers $n$ unrelated to $\v J^2$, giving us kets $\ket{n,j,j}$.
\item Finally, we can obtain the full kets via
\begin{eqn}
\ket{n,j,m} = \frac{(J_-)^{j-m} \ket{n,j,j}}{c^-_{1m} c^-_{2m} \cdots c^-_{j-m,m}}.
\end{eqn}
[This looks wrong, should be $c^-_{j,j} c^-_{j,j-1} \cdots c^-_{j,j-m}$ ?]
\end{enumerate}

\end{document}


\section{Review of Parallel Computational Models}
\label{sec:BackgroundModel}

The basic computer architecture is known as von Neummann architecture or von Neumman model. This model has the following components: a memory; an arithmetic-logic unit (ALU); a central processing unit (CPU), composed of several registers; and a control unit. New technologies and computational models began to be developed simultaneously with the evolution of the von Neumann model.

In 1972, Michael Flynn proposed a classification of parallel computing architectures. This classification distinguishes the number of instructions and the number of data that can be computed in parallel~\citep{flynn1996parallel}. This classification is presented in the Table \ref{tab:taxFlynn}.

\begin{table}[htpb]
\begin{center}
\begin{tabular}{|r|c|c|}
\hline
& \bf Single Instruction & \bf Multiple Instruction\\\hline
\bf Single Data & SISD & MISD \\\hline
\bf Multiple Data & SIMD & MIMD \\\hline
\end{tabular}
\end{center}
\caption{Classification of parallel architectures proposed by Michael Flynn (1972).}
\label{tab:taxFlynn}
\end{table}

We can illustrate the table above as follows. A von Neumann model machine that has only one processing core fits the SISD (Single Instruction; Single Data) classification; a machine with multiple processing cores can be classified as MIMD; GPUs are classified on the SIMD architecture, where each thread takes index to perform vector computations, for this the programming model of CUDA is named SIMT (Single Instruction; Multiple Threads).

Parallel computing models have been an active research topic since the development of modern computers~\citep{Gibbons1983:QRQW,Juurlink:1998,Skillicorn:1998:MLP}; their main goal is to provide a standard way of describing and evaluating the performance of parallel applications. For the success of a parallel computing model, it is paramount to also consider the characteristics of the underlying architecture of the hardware being used.

Mathematical models are simplified abstraction of a real situation. A important area of the computer science is related with the analysis, design and development of algoritmh that are implemented in real machines. A first and general example is the RAM model (Random-Access Memory). This model is an abstraction of a classic computer with a single processor. More and not a few models were created based on the RAM model.

In computing, granularity is associated with the amount of computation in relation to communication, that is, the ratio of computation to the amount of communication. Parallelism of fine granularity means relatively small amounts of computational work are done between communication events
Low computation to communication ratio. Coarse and Bulk granularity is the opposite: data transfers are less frequent, and present large amounts of computation. Parallelism of coarse or Bulk granularity means relatively large amounts of computational work are done between communication events, high computation to communication ratio. The finer granularity have greater potential for parallelism and consequently the increase in speed, but the overhead costs of synchronization and communication are expensive in terms of latency.

The main objective of a parallel computing model is to provide a set of parameters to be considered in the implementation of a parallel algorithm. These parameters can be used to simulate the behavior of applications that will run on different parallel platforms. To facilitate the programming and simulation of these applications, models with specific properties to parallel programming problems have been created~\citep{Skillicorn:1998:MLP}. The most important parallel models in the litearature are the PRAM (Parallel Random Access Memory), LogP, BSP (Bulk Synchonous Parallel) and CGM (Coarse Grained Multicomputer). They are explained below.

\subsection{Parallel Random Access Machine Model (PRAM)}
The PRAM model was created by~\cite{Fortune:1978:PRAM}. This model is a simple extension of the RAM model. It consists of an infinite set of processors and a centralized shared memory by all processors. Figure \ref{fig:Pram} shows graphically the PRAM model

\begin{figure}[htpb]
\centering
\includegraphics[scale=.6]{./images/Pram.png}
\caption{PRAM  model (\textit{Parallel Random Access Machine.})}
\label{fig:Pram}
\end{figure}

The advantage of the PRAM model is its simplicity and its similarity to the sequential model of von Neumann. The processor can only read or write a memory address in one cycle. The cost of writing is equal to the cost of reading, and is also equal to the cost of any operation performed by the processor. However, in spite of its simplicity, due to the increase in the distance between the processing and the speed of communication, this model has become more and more unrealistic.

Different submodels were created from the PRAM model. Researchers have made adaptations varying the way of access to memory, trying to avoid the maximum of conflicts in the communication. The different adaptations have arisen to propose concurrent or exclusive communications at the moment to access to shared memory~\citep{Gibbons19983:QRQW, Karp:CSD-88-408}.

\subsection{Bulk Synchronous Parallel Model (BSP)}
The BSP model was introduced by~\cite{Valiant:1990}. The BSP model offers a simple abstraction of parallel architectures, see Figure \ref{fig:BSP}. In Figure~\ref{fig:BSP} a set of processors are running local computations in a superstep and before the synchronization, all the messages are delivered and ready to be used in the next superstep.

\begin{figure}[htpb]
\centering
% \includegraphics[scale=.7]{./images/bspmodel.eps}
\includegraphics[scale=.7]{./images/bspmodel.png}
\caption{Superstep in a Bulk Synchronous Parallel Model.}
\label{fig:BSP}
\end{figure}

The BSP model bridges the essential characteristics of different kinds of machines as a combination of three attributes:

\begin{itemize}
\item a set of virtual processors, each associated to a local memory;
\item a router, that delivers the messages in a point-to-point manner;
\item a synchronization mechanism.
\end{itemize}

The execution of a parallel application is organized in a sequence of \emph{supersteps}, each one divided into three successive---logically disjointed---phases.
On the first phase, all processors use their local data to perform local sequential computations in parallel (i.e., there is no communication among the processors). The second phase is a communication phase, where all nodes exchange data performing personalized all-to-all communication. The last phase consists of a global synchronization barrier, that guarantees that all messages were delivered and all processors are ready to start the next superstep.

Figure~\ref{fig:BSP} depicts the phases of a BSP application. In this figure, a processor distributes tasks to a set of processors that execute local computations and communicate in a global form, if necessary. All processors wait for the others finish their tasks in a synchronization barrier, to be able to execute the next task. Sending and receiving messages between processors is only allowed at the end of each super-step.

On the BSP model there is no restriction on sending messages, but all of them should be received before the synchronization barrier. According to the execution model, the first and second phase may occur simultaneously. A BSP algorithm consists of an arbitrary number of super-steps. The BSP model has been widely used on different applications contexts. HPC practitioners have been using the BSP model to design algorithms and software that can run on any standard architecture with guaranteed performance \cite{AlgGPU,Goldberg2004,CamargoGKG06}. Consider a BSP program that runs on $S$ supersteps. Let $g$ be the bandwidth of the network and $L$ the latency---i.e., the minimum duration of a superstep---which reflects not only the latency of the network, but also the overhead of the synchronization step. The cost to execute the $i$-th superstep is then given by:

\begin{equation}
  \label{eq:superstep-cost}
  w_i + g h_i + l
\end{equation}

where $w_i$ is the maximum amount of local computations executed, and $h_i$ is the largest number of packets sent or received by any processor during the superstep. If $W = \sum_{i=1}^{S} w_i$ is the sum of the maximum work executed on all supersteps and $H = \sum_{i=1}^{S} h_i$ the sum of the maximum number of messages exchanged in each superstep, then the total execution time of the parallel application is given by:
\begin{equation}
  \label{ec:BSP}
  T = W + g H + L S
\end{equation}

A BSP algorithm, consequently, can be completely modeled by the parameters $(w, h, g, l)$. Using these parameters, the approximate execution time of a BSP algorithm can be characterized. One of the great advantages of the BSP model is that it facilitates to develop parallel programs on different systems and architectures, serving as a bridge between the programmer who develop parallel applications in massively parallel architectures.

\subsubsection{Multi-BSP model}
The Multi-BSP model is an adaptation of the BSP model, the BSP model is commonly used in a distributed memory parallel environment, and multi-BSP is a BSP extension for multi-core processors. ~\cite{Valiant:2011} created the Multi-BSP model which is used in a parallel shared memory environment. Computational models, such as multi-BSP, allow abstraction of the complexity of the problem in a simplification that is not significantly away from the reality of current computational  architectures.

Multi-BSP is a multi-level model that has explicit parameters at each level: number of processors $p$, memory/cache sizes $m$, communication latency costs $g$ and synchronization costs $L$. The multi-BSP model of an architecture with depth $d$ will be determined by $4d$ numeric parameters, $(p1, g1, L1, m1), (p2, g2, L2, m2), ( P3, g3, L3, m3), ..., (pd, gd, Ld, md)$. At each level the four parameters quantify, respectively, the number of subcomponents, processors, communication bandwidth, synchronization cost, and memory/cache size~\citep{BSPMeasures}.

Multi-BSP and BSP are important models that allow bridging the analysis, design and development of parallel algorithms, but they are not useful to design algorithms that are executed in massively parallel architectures. New models of performance prediction of applications that run on GPUs have arisen from adaptations of the models in this literature review.

\subsection{Coarse Grained Multicomputer Model (CGM)}
\cite{Dehne:2002} studied the problem of designing scalable parallel geometric algorithms for coarse grained cases. They called this model as Coarse Grained Multicomputer model (CGM), which is very efficient for a large set of problems of the ratio $\frac{n}{p}$, with $n$ the size of the problem and $p$ the number of processors. In other words, the CGM model is very good for addressing problems where the problem of size $n$ can be divided between an determined number of processors $p$. A CGM algorithm is a special case of a BSP algorithm where all communication operations of a super-step are done in $h$ relations. A fundamental difference between the BSP model and CGM is that the first captures real machine parameters while the CGM is an abstraction that allows to develop efficient algorithms in parallel machines.

An algorithm on a CGM machine can be modeled using only two parameters, $N$ and $p$. This algorithm consists of an alternating sequence of computing and communication rounds also separated by a synchronization barrier. A computational/communication round of the CGM model corresponds to a super-step of the BSP model with communication cost $g(N/p)$. A good performance of algorithms with the CGM model is achieved by minimizing the number of super-steps, the total time of local computations and the total size of the messages.

\subsection{LogP Model}
Synchronization of a large group of processes or threads is expensive in terms of latency, especially on architectures with classification MIMD. For these cases, parallel computing models without synchronization were created. The most popular of these models is the logP model.

LogP model was proposed by \citet{Culler:1993:LogP} and received its name exactly for the variables of the model. Culler et. al. perceived that the PRAM model was not realistic due to the lack of parameters to represent communication costs in parallel applications, especially for distributed applications. The parameters used to describe a parallel system according to LogP model are:

\begin{itemize}
\item[L:] \textit{Latency} - caused by communicating a message from a source to a destiny processor.
\item[o:] \textit{Overhead} - time during which a processor is busy sending or receiving a message, during that time it can not do
computations.
\item[g:] \textit{Gap} - minimum time between consecutive message transmissions or between receiving consecutive messages; the reciprocal of $g$ corresponds to the bandwidth of the system.
\item[P:] \textit{Processors}.
\end{itemize}


\chapter{DERIVATION OF THE $\Upsilon$ FUNCTION}%
\label{appendixC}

%\clearpage %remove this command if your appendix doesn't start with a landscaped page!!!!!
%\thispagestyle{plain}
%\begin{landscape}
%\begin{figure}

 % \begin{center}
  %  \includegraphics[width=6in]{LaTeX2e_logo.eps}
   % \caption{\LaTeX 2\ensuremath{\epsilon.} logo}\label{biglogo}
  %\end{center}
%\end{figure}
%\end{landscape}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%ADD LABEL

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\proposition{The Upsilon Function}\label{first}

(1) If $\beta>0$ and $\alpha\neq0$, then for all $n\geq-1$,

$$I_{n}(c;\alpha; \beta; \delta) = - \frac{e^{\alpha c}}{\alpha} \sum_{i=0}^{n}(\frac{\beta}{\alpha})^{n-i} Hh_{i}(\beta c -\delta)$$

$$+ (\frac{\beta}{\alpha})^{n+1} \frac{\sqrt{2 \pi}}{\beta} e^{\frac{\alpha \delta}{\beta}+\frac{\alpha^{2}}{2\beta^{2}}} \phi(-\beta c + \delta + \frac{\alpha}{\beta})$$
(2) If $\beta<0$ and $\alpha<0$, then for all $x \geq -1$

$$I_{n}(c;\alpha; \beta; \delta) = - \frac{e^{\alpha c}}{\alpha} \sum_{i=0}^{n}(\frac{\beta}{\alpha})^{n-i} Hh_{i}(\beta c -\delta)$$

$$- (\frac{\beta}{\alpha})^{n+1} \frac{\sqrt{2 \pi}}{\beta} e^{\frac{\alpha \delta}{\beta}+\frac{\alpha^{2}}{2\beta^{2}}} \phi(\beta c - \delta - \frac{\alpha}{\beta})$$

\begin{proof}{Case 1.}

$\beta>0$ and $\alpha\neq0$. Since, for any constant $\alpha$ and $n \geq 0$, $e^{\alpha x} Hh_{n}(\beta x - \delta) \rightarrow 0$ as $x \rightarrow \infty$ thanks to (B4), integration by parts leads to

$$I_{n}=-\frac{1}{\alpha}Hh(\beta c -\delta) e^{\alpha c} + \frac{\beta}{\alpha}\int_{c}^{\infty} e^{\alpha x} Hh_{n-1}(\beta c - \delta)dx$$

In other words, we have a recursion, for $n \geq 0$, $I_{n}=-(e^{\alpha c}{\alpha})Hh_{n}(\beta c - \delta) + (\frac{\beta}{\alpha})I_{n-1}$ with

$$I_{-1}=\sqrt{2 \pi} \int_{c}{\infty}e^{\alpha x}\varphi(-\beta x +\delta)dx$$

$$=\frac{\sqrt{2 \pi}}{\beta} e^{\frac{\alpha \delta}{\beta}+\frac{\alpha^{2}}{2 \beta^{2}}}\phi(-\beta c + \delta +\frac{\alpha}{\beta})$$

Solving it yields, for $n \geq -1$,

$$I_{n}=-\frac{e^{\alpha c}}{\alpha}\sum_{i=0}^{n}(\frac{\beta}{\alpha})^{i}Hh_{n-i}(\beta c+\delta) + (\frac{\beta}{\alpha})^{n+1}I_{-1}$$

$$=-\frac{e^{\alpha c}}{\alpha}\sum_{i=0}^{n}(\frac{\beta}{\alpha})^{n-i} Hh_{i}(\beta c+\delta)$$

$$+ (\frac{\beta}{\alpha})^{n+1}\frac{\sqrt{2 \pi}}{\beta} e^{\frac{\alpha \delta}{\beta}+\frac{\alpha^{2}}{2 \beta^{2}}}\phi(-\beta c + \delta +\frac{\alpha}{\beta})$$

where the sum over an empty set is defined to be zero.
\end{proof}

Case2. $\beta<0$ and $\alpha<0$. In this case, we must also have, for $n \geq 0$ and any constant $\alpha<0, e^{\alpha x}Hh_{n}(\beta x -\delta) \rightarrow 0$ as

$x \rightarrow \infty$, thanks to (B5). Using integration by parts, we again have the same recursion, for $n \geq 0, I_{n}=-(e^{\alpha c}/\alpha)Hh_{n}(\beta c - \delta)+(\beta / \alpha)I_{n-1}$, but with a different initial condition

$$I_{-1}=\sqrt{2 \pi}\int_{c}^{\infty}e^{\alpha x}\varphi(-\beta x + \delta)dx$$

$$=-\frac{\sqrt{2 \pi}}{\beta} exp\{\frac{\alpha \delta}{\beta}+\frac{\alpha^{2}}{2 \beta^{2}}\}\phi(\beta c - \delta -\frac{\alpha}{\beta})$$

Solving it yields (B8), for $n \geq -1$.

Finally, we sum the double exponential and the normal random variables

Proposition B.3.

Suppose $\{\xi_{1},\xi_{2},...\}$ is a sequence of i.i.d. exponential random variables with rate $\eta>0$, and Z is a normal variable with distribution $N(0,\sigma^{2})$. Then for every $ n \geq 1$, we have: (1) The density functions are given by:

$$f_{Z+\sum_{i=1}^{n}\xi_{i}}(t)=(\sigma\eta)^{n}\frac{e^{(\sigma\eta)^{2}/2}}{\sigma\sqrt{2\pi}}e^{-t\eta}Hh_{n-1}(-\frac{t}{\sigma}+\sigma\eta)$$

$$f_{Z-\sum_{i=1}^{n}\xi_{i}}(t)=(\sigma\eta)^{n}\frac{e^{(\sigma\eta)^{2}/2}}{\sigma\sqrt{2\pi}}e^{-t\eta}Hh_{n-1}(\frac{t}{\sigma}+\sigma\eta)$$
(2) The tail probabilities are given by

$$P(Z+\sum_{i=1}^{n}\xi_{i}\geq x) = (\sigma\eta)^{n}\frac{e^{(\sigma\eta)^{2}/2}}{\sigma\sqrt{2\pi}}e^{-t\eta}I_{n-1}(x;-\eta,-\frac{1}{\sigma},-\sigma\eta)$$

$$P(Z-\sum_{i=1}^{n}\xi_{i}\geq x) = (\sigma\eta)^{n}\frac{e^{(\sigma\eta)^{2}/2}}{\sigma\sqrt{2\pi}}e^{-t\eta}I_{n-1}(x;\eta,\frac{1}{\sigma},-\sigma\eta)$$

Proof. Case 1. The densities of $Z+\sum_{i=1}^{n}\xi_{i}$, and $Z-\sum_{i=1}^{n}\xi_{i}$. We have

$$f_{Z+\sum_{i=1}^{n}\xi_{i}}(t)=\int_{-\infty}^{\infty}f_{\sum_{i=1}^{n}\xi_{i}}(t-x)f_{Z}(x)dx$$

$$=e^{-t\eta}(\eta^{n})\int_{-\infty}{t}\frac{e^{x\eta}(t-x)^{n-1}}{(n-1)!}\frac{1}{\sigma\sqrt{2\pi}}e^{-x^{2}/(2\sigma^{2})}dx$$

$$=e^{-t\eta}(\eta^{n})e^{(\sigma\eta)^{2}/(2)}\int_{-\infty}{t}\frac{(t-x)^{n-1}}{(n-1)!}\frac{1}{\sigma\sqrt{2\pi}}e^{-(x-\sigma^{2}\eta)^{2}/(2\sigma^{2})}dx$$

Letting $y=(x-\sigma^{2}\eta)/\sigma$ yields

$$f_{Z+\sum_{i=1}^{n}\xi_{i}}(t)=e^{-t\eta}(\eta^{n})e^{(\sigma\eta)^{2}/(2)}\sigma^{n-1}$$

$$\times\int_{-\infty}^{t/\sigma-\sigma\eta}\frac{(t/\sigma - y -\sigma\eta)^{n-1}}{(n-1)!}\frac{1}{\sqrt{2\pi}}e^{-y^{2}/2}dy$$

$$=\frac{e^{(\sigma\eta)^{2}/2}}{\sqrt{2\pi}}(\sigma^{n-1}\eta^{n})e^{-t\eta}Hh_{n-1}(-t/\sigma + \sigma\eta)$$

because $(1/(n-1)!)\int_{-\infty}{a}(a-y)^{n-1}e^{-y^{2}/2}dy=Hh_{n-1}(a)$. The derivation of $f_{Z+\sum_{i=1}^{n}\xi_{i}}(t)$ is similar.

Case 2. $P(Z+\sum_{i=1}^{n}\xi_{i}\geq x)$ and $P(Z-\sum_{i=1}^{n}\xi_{i}\geq x)$. From (B9), it is clear that

$$P(Z+\sum_{i=1}^{n}\xi_{i}\geq x)=\frac{(\sigma\eta)^{n}e^{(\sigma\eta)^{2}/2}}{\sigma\sqrt{2\pi}}\int_{x}^{\infty}e^{(-i\eta)}Hh_{n-1}(-\frac{t}{\sigma}+\sigma\eta)dt$$

$$=\frac{(\sigma\eta)^{n}e^{(\sigma\eta)^{2}/2}}{\sigma\sqrt{2\pi}}I_{n-1}(x;-\eta,-\frac{1}{\sigma},-\sigma\eta)dt$$

by (B6). We can compute
$P(Z-\sum_{i=1}^{n}\xi_{i}\geq x)$ similarly.

\theorem{Theorem} With $\pi_{n}:= P(N(t)=n)=e^{-\lambda T}(\lambda T)^{n}/n!$ and $I_{n}$ in Proposition \ref{first}.
, we have

$$P(Z(T)\geq a)=\frac{e^{(\sigma \eta_{1})^{2} T/2}}{\sigma \sqrt{2 \pi T}} \sum_{n=1}^{\infty} \pi_{n} \sum_{k=1}^{n} P_{n,k}(\sigma\sqrt{T}\eta_{1})^{k}\times I_{k-1}(a-\mu T; -\eta_{1},-\frac{1}{\sigma\sqrt{T}},-\sigma\eta_{1}\sqrt{T})$$

$$+\frac{e^{(\sigma\eta_{2})^{2}T/2}}{\sigma\sqrt{2\pi T}}\sum_{n=1}^{\infty}\pi_{n}\sum_{k=1}^{n}Q_{n,k}(\sigma\sqrt{T}\eta_{2})^{k}$$

$$\times I_{k-1}(a-\mu T; \eta_{2},\frac{1}{\sigma\sqrt{T}},-\sigma\eta_{2}\sqrt{T})$$

$$+\pi_{0}\phi(-\frac{a-\mu T}{\sigma\sqrt{T}})$$

Proof by the decomposition (B2)

$$P(Z(T) \geq a)= \sum_{n=0}^{\infty}\pi_{n} P(\mu T +\sigma\sqrt{T} Z + \sum_{j=1}^{n}Y_{j} \geq a)$$

$$=\pi_{0}P(\mu T +\sigma\sqrt{T} Z  \geq a)$$

$$+\sum_{n=1}^{\infty}\pi_{n}\sum_{k=1}^{n}P_{n,k} P(\mu T +\sigma\sqrt{T} Z + \sum_{j=1}^{n}\xi_{j}^{+} \geq a)$$

$$+\sum_{n=1}^{\infty}\pi_{n}\sum_{k=1}^{n}Q_{n,k} P(\mu T +\sigma\sqrt{T} Z - \sum_{j=1}^{n}\xi_{j}^{-} \geq a)$$

The result now follows via (B11) and (B12) for $\eta_{1} > 1$ and $\eta_{2} >0$.


\par
\chapter{{\tt SubMtx}: Submatrix object}
\par
The {\tt SubMtx} object was created to hold the data for and operate
with a submatrix of a sparse matrix.
The entries in a submatrix can be either double precision
real or complex.
\par
For example, the lower and upper triangular matrices $L$ and $U$
that are created during the factorization are stored as
submatrices,
e.g., $L_{I,I}$ and $L_{J,I}$ where $I$ and $J$ are index sets.
To be more precise, $I$ and $J$ are index sets associated with
fronts {\tt I} and {\tt J}.
We do not necessarily represent $L_{J,I}$,
because some of the rows in the submatrix may be zero.
Instead we keep $L_{\bnd{I}\cap J,I}$, where
$\bnd{I} \cap J$ are precisely those rows that may have nonzeros.
The situation is similar for $U$ where we keep $U_{I,\bnd{I}\cap J}$.
\par
The submatrices for $L$ and $U$ may be dense or sparse.
(A direct factorization typically generates dense submatrices
while a drop tolerance factorization produces sparse submatrices.)
We also use {\tt SubMtx} objects to represent submatrices of the
$D$ matrix, where $D$ is either diagonal or has $1 \times 1$ and
$2 \times 2$ blocks on its diagonal.
In the latter case, we support $D_{I,I}$ to be either
real symmetric, complex symmetric or complex Hermitian.
\par
The {\tt SubMtx} object has the following attributes.
\begin{itemize}
\item
A {\tt SubMtx} object has a row id and column id to identify itself
within the context of a larger block matrix.
\item
Each row and column of the block matrix corresponds
to a certain index set.
A {\tt SubMtx} object associated with block row {\tt J}
and block column {I} has row indices $J$ and column indices $I$.
\item
Matrix entries stored in one of the following ways.
\begin{itemize}
\item dense by rows, i.e., dense and row major
\item dense by columns, i.e., dense and column major
\item sparse using dense subrows
\item sparse using dense subcolumns
\item sparse using sparse rows
\item sparse using sparse columns
\item sparse using $(i,j,a_{i,j})$ triples
\item a diagonal matrix
\item a block diagonal symmetric matrix where the blocks are
      $1 \times 1$ or $2 \times 2$, used in the symmetric
      indefinite factorization.
\item a block diagonal Hermitian matrix where the blocks are
      $1 \times 1$ or $2 \times 2$, used in the hermitian
      indefinite factorization.
\end{itemize}
\item
The {\tt SubMtx} object can be self-contained, in the sense that
its structure contains a {\tt DV} object that manages a contiguous
vector of workspace that is used to store all information about the
{\tt SubMtx} object --- its scalar parameters, any integer index
or dimension information, and all matrix entries.
In a distributed environment,
this allows a {\tt SubMtx} object to be sent between processors
as one message, no copying to an internal buffer is needed,
nor any custom data type needs to be defined as for MPI.
In an out-of-core environment,
a {\tt SubMtx} object can be read from or written to a file
by a single operation.
\end{itemize}
\par
The {\tt SubMtx} object is a superset of the {\tt DenseMtx} object
in terms of data structure and functionality.
If we were working in a language that supports inheritance,
{\tt SubMtx} would be an abstract class and {\tt DenseMtx} would be
a subclass where entries would be stored by dense rows or columns.
At some point in the future we may deprecate the {\tt DenseMtx}
object in this library, replacing it with the {\tt SubMtx} object.
\par
Because the {\tt SubMtx} object wears so many hats, i.e., it supports
nine different storage formats, it has to be flexible in how it
responds to its environment.
For example, how we access the data is different depending on which
storage format.
Instead of accessing structure fields directly,
e.g., let {\tt mtx->entries} point to the start of the matrix entries,
we follow a convention that {\it instance} methods return
information.
For example, the function call
\begin{verbatim}
       SubMtx_columnIndices(mtx, &nrow, &rowind) ;
\end{verbatim}
is an instance method that fills {\tt nrow} with the number of
rows and {\tt rowind} with the first location of the row indices.
A more complex example is for the sparse storage by rows format,
\begin{verbatim}
       SubMtx_sparseRowsInfo(mtx, &nrow, &nent, &sizes, &indices, &entries) ;
\end{verbatim}
where the number of rows and entries are returned in {\tt nrow}
and {\tt nent}, the number of nonzero
entries in each row is contained in {\tt sizes[]},
and the column indices and nonzero entries are found in
{\tt indices[]} and {\tt entries[]}, respectively.
This convention of using instance methods to return information
is better than using explicit structure fields.
For example, if we want to extend the object by allowing another
storage format, we do not need to increase the size of the structure
at all --- it is only necessary to provide one or more instance methods
to return the new information.


\documentclass[simplex.tex]{subfiles}
% NO NEED TO INPUT PREAMBLES HERE
% packages are inherited; you can compile this on its own
\begin{document}
\subsection{Network Dependence Test via Diffusion Maps and MGC}
%% Jan
Deciphering the association between network structures and corresponding
nodal attributes of interest is a core problem in network science. We
propose a new nonparametric procedure for testing dependence between
network topology and nodal attributes, via diffusion maps and
\texttt{MGC}. Specifically, under an exchangeable graph, we verify that
the diffusion maps provide a set of conditionally independent
multivariate coordinates for the nodes, which can be combined with
\texttt{MGC} (or in general, any distance-based correlation measures) to
yield consistent statistic for network dependence testing. In
simulation, the new approach achieves superior testing performance under
a variety of common network models than existing benchmarks. The
diffusion maps provides a robust metric compared to adjacency matrix or
geodesic distance, while \texttt{MGC} can better capture nonlinear
dependencies, with their combined advantages shown in
Figure~\ref{fig:threeSBM201701}.

\begin{figure}[h!]
\begin{cframed}
		\centering
		\includegraphics[width=0.6\textwidth]{../../figs/ThreeSBM.png}
		\caption{Power comparison for all possible combinations of metrics and correlation measure, under the stochastic block model with three blocks. \texttt{MGC} with the diffusion maps (DM) yields the best power, comparing to using other metrics like adjacency matrix (AM), latent factors (LF), and other test statistics like distance correlation (mcorr), Heller-Heller-Gorfine (HHG) test, or Fosdick and Hoff (FH) method.}
		\label{fig:threeSBM201701}
		\end{cframed}
\end{figure}

%In order to show that \texttt{MGC} combined with diffusion maps as a network metrics perform better even in the case arbitrary noisy is added to edges or the attributes in real data, we are doing an experiment on brain network with physical locations as nodal attributes. Our proposed method not only detects the dependence between network topology and nodal attributes but also helps us to reveal possibly diverse dependence patterns through multiscale correlation maps or multiscale statistics as a function of diffusion time.

This month we made significant progress in writing the manuscript and improving the exposition. The current draft was submitted to ASA Nonparametric Statistics Section Student Paper Awards, and we are notified as finalists for awards and special presentation section in the Joint Statistical Meeting this year.

\clearpage

%% Feb

%% March
Deciphering the association between network structures and corresponding nodal attributes of interest is a core problem in network science. We propose a new nonparametric procedure for testing dependence between network topology and nodal attributes, via diffusion maps and \texttt{MGC}. Specifically, under an exchangeable graph, we verify that the diffusion maps provide a set of conditionally independent multivariate coordinates for the nodes, which can be combined with \texttt{MGC} (or in general, any distance-based correlation measures) to yield consistent statistic for network dependence testing. Moreover, our method is computationally inexpensive and robust against parameter mis-specifications, very efficient in capturing a wide variety of nonlinear and high-dimensional relationships, and readily extend-able to testing independence between two graphs.

Figure~\ref{fig:threeSBM201703} illustrates the advantage of the proposed method on testing dependency between two graphs. The graphs are simulated by the random dot product graph, with the underlying latent variables being related by a quadratic function. By repeatedly generating dependent sample graphs, the testing power equals the percentage of rejection of the independence hypothesis. Although all methods are consistent (having power $1$ as number of vertices increases), the proposed approach using \texttt{MGC} is able to achieve perfect testing power at a very small size, which is significantly better than other benchmarks.

\begin{figure}[h!]
\begin{cframed}
		\centering
		\includegraphics[width=0.7\textwidth]{../../figs/twoGraphs1.pdf}
		\caption{The power curve with respect to increasing number of vertices for the two-graph dependency testing simulation. The proposed approach quickly attains perfect power at a very small vertex size, while other benchmarks often require a much larger graph for perfect testing. }
		\label{fig:threeSBM201703}
		\end{cframed}
\end{figure}

An early draft is recently awarded the Best Student Paper Awards by the American Statistical Association Nonparametric Statistics Section, which will be presented in a special section in the Joint Statistical Meeting this year. We collected and addressed feedback from experts in graph inference, and submitted the complete manuscript this month.
%

\clearpage
\end{document}


%\documentclass{scrartcl}
%\usepackage{beamerarticle}
%%\usepackage{dtsc-beamer}
%\usepackage{fullpage}

\documentclass[9pt]{beamer}
\usetheme{boxes}
\usetheme{Boadilla}
\usecolortheme{beaver}
%\usecolortheme{sidebartab}
% \usefonttheme{structurebold}
\usefonttheme{serif}

%gets rid of bottom navigation bars
\setbeamertemplate{footline}[page number]{}

%gets rid of navigation symbols
\setbeamertemplate{navigation symbols}{}

% \usepackage{helvet}
\usepackage{amsmath, amssymb}
\usepackage{color}
%\usepackage{asymptote}
\usepackage{mathrsfs}
\usepackage{dsfont}
\usepackage{url}
\usepackage{cancel}
\usepackage{tikz}
\usetikzlibrary{fit,positioning}
\usetikzlibrary{shapes,matrix,decorations.markings,arrows}
\usetikzlibrary{graphs}
\usepackage{bbm}
\def\ind{\mathbbm{1}} %Indicator function
%
\definecolor{darkblue}{rgb}{0.0, 0.0, 0.55}
\definecolor{notsodarkblue}{rgb}{0.0, 0.0, 0.7}
\setbeamercolor{title}{fg=darkblue}
\setbeamercolor{frametitle}{fg=darkblue}
\newcommand{\myitem}{\item[$\bullet$]}
\definecolor{darkgreen}{rgb}{0, 0.55, 0}
\definecolor{lgray}{rgb}{0.9,0.9,0.9}

\newcommand{\LABFIG}[1]{\label{fig:#1}}%{\tt [fig:$\text{$#1$}$]}}

\newcommand{\ve}[1]{\boldsymbol{#1}}
\def\X{\ve{X}}
\def\x{\ve{x}}
\def\y{\ve{y}}
\def\m{\ve{m}}
\def\Sig{\ve{\Sigma}}
\def\E{\mathbb{E}}
\def\J{\ve{J}}
\def\h{\ve{h}}

\newcommand{\mc}[1]{\mathcal{#1}}
\def\sX{\mc{X}}
\def\N{\mc{N}}
\newcommand{\mxf}[3]{m^{#3}_{X_{#1}\rightarrow f_{#2}}(x_{#1})}
\newcommand{\mfx}[3]{m^{#3}_{f_{#2}\rightarrow X_{#1}}(x_{#1})}

\newcommand\Def[1]{{\textbf{Definition:}\\\emph{#1}\\\begin{center} ------------------------ \end{center}}}
\newcommand\Prop[1]{{\textbf{\textcolor{red}{Property:}}\\\emph{#1}\\\begin{center} \textcolor{red}{------------------------} \end{center}}}

\newcommand{\noteB}[1]{\textbf{\textcolor{notsodarkblue}{#1}}}

\newcommand{\noteR}[1]{\textbf{\textcolor{darkred}{#1}}}

\newcommand{\noteG}[1]{\textbf{\textcolor{darkgreen}{#1}}}

\newcommand{\snoteB}[1]{{\textcolor{darkblue}{#1}}}

\newcommand{\snoteR}[1]{{\textcolor{darkred}{#1}}}

\newcommand{\snoteG}[1]{{\textcolor{darkgreen}{#1}}}

\newcommand{\fs}[2]{#2}

\title[]{Gaussian BP}
\author[\textcolor{white}{Advanced Digital Communications}]{Introduction to Graphical Models and Inference for Communications\\\vspace*{3mm}{\small \textcolor{black}{UC3M}}
}
%\date[08/02/2016]{{08/02/2016}}
\institute{\textcolor{white}{}}
\AtBeginSection[]
{
  \begin{frame}<beamer>{Index}
    \tableofcontents[currentsection,currentsubsection]
  \end{frame}
}

\begin{document}

\frame{
\titlepage
\thispagestyle{empty}
\begin{center}
\includegraphics[scale=0.05]{Figuras/uc3m-logo.pdf}
\end{center}
}

\frame{
\frametitle{Today}

\begin{itemize}
\item One particular scenario: we want to perform inference over Gaussian probability distributions that factorize according to a graphical model
\item Factor Graphs.
\item Belief Propagation naturally extends to this scenario by replacing summations to integrals (\emph{Gaussian Belief Propagation}).
\item GaBP is exact for Gaussian tree factor graphs.
\item GaBP computes the exact mean for graphs with cycles, but approximated covariance matrix.
\end{itemize}

}

\section{Multivariate Gaussian distribution}

\frame{
\frametitle{Multivariate Gaussian distribution}
Let $\X$ be a Gaussian random vector ($\x\in\mathbb{R}^n$).
\begin{itemize}
\item \textbf{Covariance form:} the probability density function is
\begin{align*}
\mu(\x)=\frac{1}{(2\pi)^{n/2}|\Sig|^{1/2}}\exp\left\{-\frac{1}{2}(\x-\m) ^T \Sig^{-1}(\x-\m) \right\}
\end{align*}
denoted as $\x\sim\mathcal{N}(\m,\Sig)$ with mean $\m=\E[\x]$ and covariance matrix $\Sig=\E[(\x-\m)^T(\x-\m)]$.
\item \textbf{Natural form:} the probability density function is
\begin{align*}
\mu(\x)\propto \exp\left\{ -\frac{1}{2} \x^T \ve{J} \x+\ve{h}^{T}\x\right\}
\end{align*}
denoted as $\x\sim\mathcal{N}^{-1}(\ve{h},\ve{J})$ with potential vector $\h$ and \emph{precision matrix} $\J$.
\item Note $\J=\Sig^{-1}$ and $\h=\J\m$.
\end{itemize}

\begin{block}{}
Gaussian graphical models typically describe Gaussian joint probability density functions in \textbf{natural form}.
\end{block}

}

\frame{
\frametitle{Product of two Gaussians}

\begin{align*}
&\mathcal{N}(\m_a,\Sig_a)\mathcal{N}(\m_b,\Sig_b)\\
=&\mathcal{N}^{-1}(\ve{h}_a,\ve{J}_a)\mathcal{N}^{-1}(\ve{h}_b,\ve{J}_b)\\
=&\mathcal{N}^{-1}(\ve{h}_a+\h_b,\ve{J}_a+\J_b)=\N(\m,\Sig)
\end{align*}
where
\begin{align*}
\Sig=\left(\ve{J}_a+\J_b\right)^{-1}\qquad \m=\Sig(\ve{h}_a+\h_b)
\end{align*}

}

\frame{
\frametitle{Marginalization via algebraic manipulation}
\begin{itemize}
\item Let $\y=\ve{A} \x+ \ve{v}$, where $\x\sim\mathcal{N}(\m_x,\Sig_x)=\mathcal{N}^{-1}(\h_x,\J_x)$ and $\ve{v}\sim\mathcal{N}(\m_v,\Sig_v)=\mathcal{N}^{-1}(\h_v,\J_v)$, then
\begin{align*}
\mu(\y)&=\int_{-\infty}^{\infty}\mu(\y|\x)\mu(\x)d\x?
\end{align*}
\end{itemize}

\begin{align*}
\mu(\y|\x)\mu(\x)\propto &\exp\Big\{\frac{-1}{2}\y^T \J_v \y+(\J_v\m_v)^T\y +(\J_v\ve{A}\x)^T\y-\frac{-1}{2}\x^T \J_x \x+(\J_x\m_x)^T\x \Big\}\\
\propto&\Big\{ \frac{-1}{2} \left[\begin{array}{c}\y \\ \x \end{array} \right]^T \J_* \left[\begin{array}{c}\y \\ \x \end{array} \right] +†\h^T_* \left[\begin{array}{c}\y \\ \x \end{array} \right]  \Big\}
\end{align*}
where
\begin{align*}
\J_*=\left[\begin{array}{cc} \J_v & -\J_v\ve{A} \\ -(\J_v\ve{A})^T & \J_x \end{array}\right] \qquad \h_*=\left[\begin{array}{c}\h_v \\ \h_x \end{array}\right]
\end{align*}

}

\frame{
\begin{align*}
\J_*=\left[\begin{array}{cc} \J_x & -\J_v\ve{A} \\ -(\J_v\ve{A})^T & \J_v \end{array}\right] \qquad \h_*=\left[\begin{array}{c}\h_v \\ \h_x \end{array}\right]
\end{align*}

Marginalization its easy if we obtain the covariance form of the joint distribution. Applying the matrix inversion lemma:
\begin{align*}
\left[\begin{array}{cc} \J_v & -\J_v\ve{A} \\ -(\J_v\ve{A})^T & \J_x \end{array}\right]^{-1}=
\left[\begin{array}{cc}
\ve{S}^{-1} & \ve{S}^{-1}\J_v\ve{A}\J^{-1}_x \\  \J^{-1}_x(\J_v\ve{A})^T\ve{S}^{-1} & \J^{-1}_x+\J^{-1}_x(\J_v\ve{A})^T\ve{S}^{-1} \J_v\ve{A}\J^{-1}_x
\end{array}\right]
\end{align*}
where $\ve{S}=\J_v-\J_v\ve{A}\J_x^{-1}(\J_v\ve{A})^T$.

\begin{block}{Therefore}
\begin{align*}
p(\y)=\mathcal{N}^{-1}(\h_y,\J_y)
\end{align*}
where
\begin{align*}
 \J_y=\J_v-\J_v\ve{A}\Sig_x\ve{A}^T\J_v^T \qquad \h_y=\h_v+\J_v\ve{A}\Sig_x\h_x
\end{align*}
\end{block}

}

\section{Gaussian BP over a particular example}

\frame{
Let $X_i\in\sX$ $i=1,\ldots,5$ be a collection of real R.V.  with joint distribution of the form
\begin{align*}
\mu(\x)=\frac{1}{Z}f_1(x_1,x_2)f_2(x_2,x_3)f_3(x_2,x_4)f_4(x_4,x_5)\prod_{i=1}^{5}g(x_i)
\end{align*}
where
\begin{align*}
f_1(x_1,x_2)=\exp\{F_{1}x_1x_2\} \qquad f_2(x_2,x_3)=\exp\{F_{2}x_2x_3\}\\
f_3(x_2,x_4)=\exp\{F_{3}x_2x_4\} \qquad f_4(x_4,x_5)=\exp\{F_{4}x_4x_5\}
\end{align*}
 and
\begin{align*}
g(x_i)=\exp\{b_i x_i-\frac{1}{2}\pi_i x_i^2\}
\end{align*}

\begin{figure}
\begin{tabular}{c}
\includegraphics[scale=0.5]{Figuras/Graph_1.pdf}
\end{tabular}
\end{figure}
%
%\begin{block}{Assume we want to compute}
%\begin{align*}
%P(x_1)=\sum_{\x\sim x_1}P(x_1,x_2,x_3,x_4,x_5)
%\end{align*}
%\textbf{\textcolor{red}{By brute force... $|\sX|^{5}$ sums.}}
%\end{block}
%
%

}

\frame{
\begin{itemize}
\item $\mu(\x)$ is a Gaussian distribution defined in natural form!
\end{itemize}
\begin{align*}
\J&=\left[\begin{array}{ccccc}
\pi_1 & -F_{1} & 0 & 0 & 0 \\
-F_{1} & \pi_2 & -F_{2} & -F_{3} & 0\\
0 & -F_{2} & \pi_3 & 0 & 0 \\
0 &  -F_{3} & 0 & \pi_4 & -F_{4}  \\
0 & 0 & 0 & -F_{4} &  \pi_5
\end{array}
\right]\\\\
\h&=\left[\begin{array}{ccccc}
b_1 & b_2 & b_3 & b_4 & b_5
\end{array}
\right]^T
\end{align*}

\begin{block}{}
Computing the mean $\m$ and covariance matrix $\Sig$ requires computing $\Sig=\J^{-1}$ and $\m = \J^{-1} \h$. $O(n^3)$ cost!
\end{block}

\begin{exampleblock}{}
BP provides a way to exploit graph structure to perform this
computation in $\mathcal{O}(n)$ time instead of $O(n^3)$. It is only exact when the graph is a tree!
\end{exampleblock}

\begin{alertblock}{}
If the Gaussian graphical model has cycles, GBP still computes the exact $\m$, but only an estimation to $\Sig$.
\end{alertblock}

}

%\section{Gaussian BP}

\frame{
\frametitle{Gaussian BP algorithm}

\begin{itemize}
\item It is described as a \emph{message-passing algorithm}.
\item Messages represent \emph{local computations} at each node of the graph.
\item The FG has leave factors (only connected to one variable) and pairwise factors (connected to two variables).
\item Integrals instead of sums. The rest of the algorithm remains unaltered.
\end{itemize}

\begin{figure}
\begin{tabular}{c}
\includegraphics[scale=0.5]{Figuras/Graph_4.pdf}
\end{tabular}
\end{figure}

}

\frame{
\frametitle{Iteration 0}
\begin{itemize}
\item Messages send by variable nodes are initialized by their  leave factors
\end{itemize}
E.g.
\begin{align*}
m^{0}_{x_2\rightarrow f_2}(x_2)=g(x_2)=\exp\{b_2 x_2-\frac{1}{2}\pi_2 x_2^2\}\sim \mathcal{N}^{-1}(b_2,\pi_2) \quad   \text{\color{blue}{Gaussian message!}}
\end{align*}
\begin{itemize}
\item Messages send by the $f_j$ factors are computed as usual but replacing sums by integrals.
\end{itemize}
E.g.
\begin{align*}
m^{0}_{f_1\rightarrow x_1}(x_1)&=\int \exp\{F_{1}x_1x_2\}\exp\{b_2 x_2-\frac{1}{2}\pi_2 x_2^2\}  dx_2\\
&=\int \exp\Big\{-\frac{1}{2} \left[\begin{array}{c} x_1 \\ x_2 \end{array}\right]^T \left[\begin{array}{cc} 0 & -F_1 \\ -F_1 & \pi_2\end{array} \right] \left[\begin{array}{c} x_1 \\ x_2 \end{array}\right]+\left[\begin{array}{c} 0 \\b_2 \end{array}\right]^T\left[\begin{array}{c} x_1 \\ x_2 \end{array}\right]\Big\} dx_2\\
&\sim \mathcal{N}^{-1}(F_1\pi_2^{-1}b_2,F_1^2\pi_2^{-1})=\mathcal{N}^{-1}(h^{0}_{f_1\rightarrow x_1}, J^{0}_{f_1\rightarrow x_1})\quad \text{\color{blue}{Gaussian message!}}
\end{align*}
}

\frame{
\frametitle{At iteration $\ell$}

\begin{itemize}
\item \textbf{Step 1:} Variable nodes multiply their incoming messages to send a new message to factors.
\end{itemize}
E.g.
\begin{align*}
m^{\ell}_{x_2\rightarrow f_3}(x_2)&=\mathcal{N}^{-1}(h^{\ell-1}_{f_1\rightarrow x_2}, J^{\ell-1}_{f_1\rightarrow x_2})\mathcal{N}^{-1}(h^{\ell-1}_{f_2\rightarrow x_2}, J^{\ell-1}_{f_2\rightarrow x_2})\\
&=\mathcal{N}^{-1}(h^{\ell-1}_{f_1\rightarrow x_2}+h^{\ell-1}_{f_2\rightarrow x_2}, J^{\ell-1}_{f_1\rightarrow x_2}+J^{\ell-1}_{f_2\rightarrow x_2})\\
&=\mathcal{N}^{-1}(h^{\ell}_{x_2\rightarrow f_3}, J^{\ell}_{x_2\rightarrow f_3}).
\end{align*}
}

\frame{
\frametitle{At iteration $\ell$}
\begin{itemize}
\item \textbf{Step 2:} Factor nodes compute the messages to variable nodes by marginalization.
\end{itemize}
E.g.
\begin{align*}
&m^{\ell}_{f_3\rightarrow x_4}(x_4)=\int \exp\{F_{3}x_2x_4\}\mathcal{N}^{-1}(h^{\ell}_{x_2\rightarrow f_3}, J^{\ell}_{x_2\rightarrow f_3})  dx_2\\
&=\int \exp\Big\{-\frac{1}{2} \left[\begin{array}{c} x_2 \\ x_4 \end{array}\right]^T \left[\begin{array}{cc} 0 & -F_3 \\ -F_3 & J^{\ell}_{x_2\rightarrow f_3}\end{array} \right] \left[\begin{array}{c} x_2 \\ x_4 \end{array}\right]+\left[\begin{array}{c} 0 \\h^{\ell}_{x_2\rightarrow f_3} \end{array}\right]^T\left[\begin{array}{c} x_2 \\ x_4 \end{array}\right]\Big\} dx_2\\
&\sim \mathcal{N}^{-1}(\frac{F_3 h^{\ell}_{x_2\rightarrow f_3}}{J^{\ell}_{x_2\rightarrow f_3}},\frac{F_3^2}{J^{\ell}_{x_2\rightarrow f_3}})=\mathcal{N}^{-1}(h^{\ell}_{f_3\rightarrow x_4}, J^{\ell}_{f_3\rightarrow x_4})\quad \text{\color{blue}{Gaussian message!}}
\end{align*}

\begin{block}{}
All messages are Gaussian! The parameters of the Gaussian messages are computed in closed form without doing any integral!
\end{block}

\begin{exampleblock}{}
Convergence is guaranteed and achieved in a finite number  $\ell_*$ of iterations. The overall complexity is $\mathcal{O}(\ell_*n)$.
\end{exampleblock}
}

\section{Gaussian Hidden Markov Models}

\frame{
\frametitle{Gaussian Hidden Markov Models}

\begin{block}{}
\begin{itemize}
\item Wireless communication channels.
\item Speech processing.
\item Tracking applications.
\end{itemize}
\end{block}

\begin{figure}
\begin{tabular}{c}
\includegraphics[scale=0.75]{Figuras/HMM.pdf}
\end{tabular}
\end{figure}

}

\frame{
\frametitle{Gaussian Hidden Markov Models}
\begin{itemize}
\item States $\x_t\in\mathbb{R}^{d}$.
\item State transition matrix $\ve{A}\in\mathbb{R}^{d\times d}$.
\item Process noise $\ve{v}_t\in\mathbb{R}^{p}$ and $\sim\mathcal{N}(\ve{0},\Sig_v)$ for some $\Sig_v\in\mathbb{R}^{p\times p}$.
\item Dynamic equations:
\begin{align*}
\x_{t+1}=\ve{A}\x_t+\ve{B}\ve{v}_t\\
\x_0\sim \mathcal{N}(0,\Sig^{0}_{x})
\end{align*}
\end{itemize}

\begin{itemize}
\item Noisy observation  $\y_t\in\mathbb{R}^{d'}$:
\begin{align*}
\y_t=\ve{C}\x_t+\ve{w}_t
\end{align*}
where $\ve{C}\in\mathbb{R}^{d'\times d}$ and $\ve{w}_t\sim\mathcal{N}(0,\Sig_w)$.
\end{itemize}

\begin{figure}
\begin{tabular}{c}
\includegraphics[scale=0.6]{Figuras/HMM.pdf}
\end{tabular}
\end{figure}

}

\frame{
\frametitle{Gaussian Hidden Markov Models}
\begin{itemize}
\item In summary, for $\Sig_h=\ve{B}\Sig_v\ve{B}^T$ we have
\begin{align*}
\x_0&\sim \mathcal{N}(0,\Sig^{0}_{x})\\
\x_{t+1}|\x_t &\sim \mathcal{N}(\ve{A}\x_t,\Sig_h)\\
\y_t|\x_t &\sim \mathcal{N}(\ve{C}\x_t, \Sig_w)
\end{align*}
\item Factorization
\begin{align*}
\mu(\x,\y)=\mu(x_0)\mu(\y_0|x_0)\mu(\x_1|\x_0)\mu(\y_1|x_1)\mu(\x_2|\x_1)\mu(\y_2|x_2)\ldots
\end{align*}
\item Gaussian graphical model with no cycles!! GaBP is exact and cheap!
\item This factorization can be expanded as the product of leave factors and pairwise factors.
\end{itemize}

}

\frame{
\frametitle{Inference over Gaussian HMMs}

\begin{block}{Forward/Backward algorithm}
Given $\y_0,\y_2,\ldots,\y_L$, use GaBP to compute the (Gaussian) marginal for each state $\x_1,\x_2,\ldots,\x_L$.
\end{block}

\begin{block}{Kalman filter}
Given the actual observation $\y_t$ and the observations in the past $\y_0,\y_2,\ldots,\y_t-1$, use GaBP to compute the mean of $\x_t$, $\mathbb{E}[\x_t]$.
\end{block}

}

\section{Extension to any distribution?}

\frame{
\frametitle{BP over any graphical models}
\begin{itemize}
\item So far, we have applied BP to discrete and Gaussian graphical models.
\item In the Gaussian case, we can avoid integration by algebraic manipulation.
\item The same update rules can be applied to any Graphical model. However, integrals of the form
\begin{align*}
\int_{\x_j\sim x_i} f_j(\x_j) \prod_{u\in\N(f_j)}\m_{x_u\rightarrow f_j}(x_u) d(\x_j\sim x_i)
\end{align*}
are intractable in general! we cannot solve the integrals!!
\end{itemize}

}

\frame{
\begin{block}{Approximate message passing (APM)}
Approximate BP messages by Gaussian distributions:
\begin{itemize}
\item Compressed sensing \url{http://people.ee.duke.edu/~lcarin/AMP1.pdf}
\item Efficient multiuser detection in CDMA systems \url{http://arxiv.org/pdf/0810.1729.pdf}
\item Communications over Fading ISI channels:
\url{http://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=04907469}
\item $\ldots$
\end{itemize}
\end{block}

\begin{exampleblock}{Alternatives}
Instead of approximating the BP messages, construct directly a tractable Gaussian approximation to the joint pdf.
\begin{itemize}
\item Variational Inference and Mean Field.
\item Expectation Propagation.
\end{itemize}
\end{exampleblock}

}

\end{document}