Homomorphically encrypted data evaluation

Abstract

Disclosed is a method for evaluating a data metric on homomorphically encrypted data, the method comprising: Providing at least two datasets; encrypting of the at least two datasets, resulting in at least two encrypted datasets in an encrypted domain, wherein the encryption is performed in accordance with a homomorphic encryption scheme; transforming the data metric into the encrypted domain, resulting in a homomorphic data metric; evaluating the homomorphic data metric on the encrypted datasets in the encrypted domain; obtaining at least one encrypted measure of the homomorphic data metric.

Description

HOMOMORPHICALLY ENCRYPTED DATA EVALUATIONFIELD OF THE INVENTION

[0001] The invention relates to the fields of homomorphic encryption, data privacy and machine learning, and in particular to differential privacy.BACKGROUND

[0002] Synthetic data may refer to a reproduction of data that represents a certain field and is not obtained by direct measurement. For example, synthetic data may refer to data that is artificially generated rather than being collected from real-world events. It is often used in scenarios where real-world data is scarce, sensitive, or expensive to collect.

[0003] Data synthesis describes the procedure of generating synthetic data. Said synthetic data is intended to resemble an original dataset from which the synthetic data was generated, wherein said original dataset comprises values collected from real-world events. A dataset of synthetic data generated from an original dataset is referred to as a synthetic replicate of said original dataset. The resemblance between the original dataset an the synthetic replicate can exemplarily be quantified by the matching of a set of properties, intervals or ranges of values, or characteristics related to the values of attributes and the distribution of said values in the original dataset, such that the generated synthetic replicate resembles the original dataset according to this set of properties or characteristics.

[0004] Such synthesized datasets may then be published and used for further applications, for example as training data for machine learning models and algorithms, without the need to account for data privacy requirements which would have been present for a publication of the underlying original dataset.

[0005] T raditional methods of synthetic data generation have their limitations. For instance, sampling from existing datasets may not always provide a representative sample of the population, leading to biased or inaccurate results. On the other hand, a data synthesisalgorithm may generate entries for a synthesized dataset which closely resemble particular entries in the underlying original dataset used as input for the data synthesis algorithm. In particular, entries which are outliers in the original dataset, for example due to a rare combination of features, may be reflected in the synthesized dataset. Such a synthesis of outliers is an undesired effect, as it could lead to a violation of data protection regulations and data privacy.

[0006] The publication entitled “PrivBayes: Private Data Release via Bayesian Networks” by Zhang et al. published in ACM Transactions on Database Systems, Vol. 42, No. 4, Article 25 in October 2017 describes an algorithm for data synthesis using a machine learning model.

[0007] It is an objective to provide for a method for the evaluation of data metrics on datasets in a secure and private manner using homomorphic encryption, in particular for the evaluation of similarities between a dataset comprising real-world values and a synthetic replicate of said dataset, with the synthetic replicate being a dataset comprising synthesized values generated using a data synthesis model or algorithm.SUMMARY OF THE INVENTION

[0008] The invention is described by the features of the independent claims. Embodiments are provided in the dependent claims.

[0009] Homomorphic encryption (HE) is a method which allows for the processing of encrypted data without requiring a decryption step to be performed first. A homomorphic algorithm is an algorithm capable of being applied to an encrypted dataset, said dataset having been encrypted using an encryption algorithm compatible with the homomorphic algorithm. The homomorphic algorithm comprises the application of a set of homomorphic group operations. Homomorphic group operations comprise calculations for which a homomorphism exists between operations applied to data in its encrypted form and operations applied to the same data in its unencrypted form. Exemplary embodiments of homomorphic group operations comprise arithmetic operations, such as addition, multiplication and / or the evaluation of more complex mathematical functions such as e.g. polynomials. When the homomorphic algorithm is required to decide between multiple options, for example the evaluation of an if-else statement, the algorithm is said to encounter a branch. When a branch is encountered, the homomorphic algorithm performs calculations for all options of the branch, thus increasing the number ofhomomorphic group operations to be applied. The application of a homomorphic algorithm yields an encrypted result, such that decryption of the encrypted result yields the same outcome as the application of the same algorithm on the original unencrypted data. The term “homomorphic algorithm” as used herein likewise applies to any kind of method, calculation or series of steps to be executed in accordance with a homomorphic encryption scheme. In particular, this is the case for the present subject matter, and the homomorphic method for the evaluation of data metrics disclosed therein.

[0010] An encryption scheme is referred to as a homomorphic encryption scheme if, for some operation and some elements the operation is performed on, the result of applying the operation on the encrypted elements is the same as the result of applying the encryption after having performed the operation on the unencrypted elements.

[0011] The implementation of a data metric as a homomorphic data metric requires the implementation of every step of the calculation of the data metric and every mathematical or logical operation the data metric performs on an encrypted dataset as a homomorphic group operation. Said implementation of the homomorphic data metric is referred to as the transforming of the data metric into the homomorphic data metric. Once this implementation is provided, for example in the form of executable computer code, the same executable computer code can be repeatedly reused. The homomorphic data metric is evaluated in an encrypted domain provided by the homomorphic encryption scheme. The application of a homomorphic data metric advantageously allows for the processing of data in encrypted form, without exposing the content of the data to the computer system evaluating the homomorphic data metric. Therefore, the computational resources available on said computer system can be utilized, without said computer system being able to decrypt the provided dataset or to extract information about the unencrypted data contained in the encrypted dataset, wherein said information may be used for purposes besides those purposes of the executed homomorphic data metric.

[0012] The application or evaluation of the homomorphic data metric results in an encrypted measure in the encrypted domain, such that the value of the decrypted measure coincides with the value of the measure of the data metric evaluated on the unencrypted datasets.

[0013] Cloud computing is a method enabling the sharing of data between multiple parties, such as a user possessing a computer device and a server, wherein the server may be a remote server located at a remote location. Said sharing of data further enablesshared data processing, wherein in a typical example, the server possesses larger capacities of computational resources than the computer device of the user. Therefore, computationally demanding tasks having a large demand for storage capacity and / or processing power are in a typical example performed on the server. The result of said computationally demanding tasks is then returned to the computer device of the user, where further data processing or other tasks such as statistical evaluation and data visualization may be performed.

[0014] The term “user” may refer to an entity e.g., an individual, a computer, or an application executing on a computer. The shared data is provided by the computer device of the user to the server. The shared data is processed by the server and a result of said data processing is sent to the computer device of the user.

[0015] A data metric assigns a numerical measure of distance to two datasets, said distance being exemplarily relating to statistical, combinatorial or spatial characteristics of the datasets. The data on which the data metric is evaluated can contain entries, wherein each entry comprises a set of values for a set of variables or attributes. Said variables or attributes may take on values according to a variety of measurement scales, comprising e.g. metrically or ordinally scaled data, binary data and / or nominal data.

[0016] In the following, data metrics are alternatively referred to as data evaluation metrics or simply as metrics.

[0017] In a preferred embodiment of the invention, the first of the two datasets given as input to the data metric is a dataset comprising real-world values, alternatively referred to as the original dataset, which are directly or indirectly obtained by measurements or evaluations. In a preferred embodiment, the original dataset comprises real-world data, in particular personal data. Therefore, there arises a need for the secure evaluation of said personal data for applications such as the evaluation of data synthesis algorithms.

[0018] In contrast, in said preferred embodiment, the second dataset given as input to the data metric is a synthetic replicate, comprising a synthesized dataset containing values generated by a data synthesis algorithm on the basis of the first dataset given as input to the data metric.

[0019] In order for the data synthesis algorithm to generate synthesized data taking an encrypted dataset as input, it is necessary to implement the data synthesis algorithm as a homomorphic data synthesis algorithm in accordance with the homomorphic encryptionscheme. In the following, the term “data synthesis algorithm” indicates implementations able to operate on either unencrypted or on encrypted datasets.

[0020] The term “data synthesis algorithm” as used herein further comprises any learnable or tunable parameters used in said data synthesis algorithm, as well any statistical and / or machine learning model said data synthesis algorithm may use for the generation of a synthesized dataset. Therefore, the term “data synthesis algorithm” is to be seen as interchangeable with “data synthesis algorithm / model”, “data synthesis model”, “artificial intelligence (Al) model for data synthesis”, “machine learning model for data synthesis” and similar terms.

[0021] The use of data synthesis algorithms offers the benefit of allowing resulting synthesized datasets to be made public, and thus for said synthesized datasets to be used e.g. for the training of machine learning models, so as to improve the accuracy of predictions made by said machine learning models. Simultaneously, synthesized datasets should accurately capture the structure and distribution of values and intervals shown by the features, variables and / or attributes of the underlying original dataset used for the data synthesis algorithm.

[0022] However, differential privacy should be maintained. That is, it is undesirable for entries in the synthetic replicate to possess distinctive combinations of features that correspond to a particular entry in the original dataset. Such replications of particular entries could violate data privacy requirements, as they may for example allow for the identity of an individual associated with said particular entry to be identified based on a unique combination of values for a set or subset of variables.

[0023] It is desirable for a data synthesis algorithm to be both accurate and privacypreserving. The accuracy or utility of said data synthesis algorithm herein captures the algorithm’s ability to represent the distributions of values of all features, variables and / or attributes of the original dataset across all entries in the original dataset in the synthetic replicate. For the data synthesis algorithm to be simultaneously privacy-preserving, said accurate distribution of values should not allow for particular entries in the synthetic replicate to be replicates of particular entries in the original dataset. That is, entries in the synthetic replicate should not be copies of entries in the original dataset but should rather possess a sufficient deviation from entries in the original dataset so as to not allow a direct link or mapping to be established between particular pairs of entries in the two datasets.

[0024] The subject of the disclosed invention relates to the providing of data metrics for the evaluation of the quality of a data synthesis algorithm, in particular to data metrics capturing the aspects of accuracy, utility and privacy. Said data metrics are to be evaluated in accordance with the homomorphic encryption scheme, therefore enabling the sharing of datasets and subsequent evaluations of said data metrics to be performed on remote computer systems or devices, such as remote servers, without violating data protection regulations. The present subject matter thus solves the problem of data sharing and data processing for the purpose of evaluating data metrics, in particular data metrics relating to comparisons between real and synthetic datasets, without exposing the unencrypted data. The use of a homomorphic algorithm thus aids in facilitating ethical data use and enabling regulatory compliance.

[0025] There does not exist a single data metric suited for every possible purpose. Rather, a multitude of data metrics may be relevant to a specific application, wherein each metric preferentially captures different aspects of the input datasets, for example the aspect of privacy or the aspect of utility.

[0026] Individual values of such various data metrics may deviate from each other. Such deviations may even be required, for example in order to comply with data protection regulations.

[0027] Embodiments of the present subject matter provide a method for evaluating a data metric on homomorphically encrypted data, said method comprising the providing of at least two datasets, the encrypting of the at least two datasets, resulting in at least two encrypted datasets in an encrypted domain, wherein the encryption is performed in accordance with a homomorphic encryption scheme, the transforming of the data metric into the encrypted domain, resulting in a homomorphic data metric, the evaluating of the homomorphic data metric on the encrypted datasets in the encrypted domain, and the obtaining of at least one encrypted measure of the homomorphic data metric.

[0028] In a preferred embodiment of the present subject matter, the encrypted datasets are provided to a server by a user from a computer device of the user.

[0029] In a preferred embodiment, the encrypted dataset is generated by the user from an original dataset by application of a public-key asymmetric encryption algorithm in accordance with a homomorphic encryption scheme.

[0030] The homomorphic encryption scheme requires the use of a public-key asymmetric encryption algorithm. A public-key asymmetric encryption algorithm comprises the use of a public key and private key. The public key is used for the encryption of the original dataset, wherein the public key may be known to all parties, including the user and the server. The public key may be stored on the computer device of the user and / or the server. The private key is used for decryption of the encrypted dataset, wherein the private key is known to the user. The private key may be stored on the computer device of the user. An encrypted dataset such as the encrypted original dataset or the encrypted synthetic replicate may be shared with other parties, including the server, in such a manner that the server is able to process the encrypted dataset by application of a homomorphic algorithm. The server is unable to decrypt the encrypted dataset and is thus unable to read or modify the underlying unencrypted dataset. Thus, the integrity of the underlying unencrypted dataset is maintained, which is advantageous for applications wherein the authenticity and reliability of the resulting synthesized datasets is crucial.

[0031] If the synthetic replicate is already present on the computer device of the user, the same homomorphic encryption scheme using the public-key asymmetric encryption algorithm can be used for the encryption of the synthetic replicate.

[0032] In a preferred embodiment, the evaluation of the data metrics is performed on the server using the encrypted datasets as input. This may advantageously improve the scalability of the evaluation of data metrics. Sending encrypted datasets to the server enables the processing of large amounts of data. The processing of large datasets may exceed the capacities of the computer device of the user, whereas the computational resources available on the server enable the processing of such quantities of data.

[0033] In said preferred embodiment, the server provides the encrypted value of the data metric to the user, followed by decryption of the encrypted value by the user using a private key stored on the computer device of the user, wherein the private key is associated to the public key in the public-key asymmetric encryption algorithm used for encrypting the dataset before providing the dataset to the server.

[0034] In a preferred embodiment, wherein at least one of the datasets, in particular the original dataset, comprises real-world data, and in particular wherein said personal data is provided as tabular data. In said preferred embodiment, at least one of the datasets, in particular the synthetic replicate, comprises a synthesized replicate, the synthesized replicate being a dataset comprising synthesized data generated using a data synthesisalgorithm, wherein the data synthesis algorithm used the dataset comprising real-world data as input.

[0035] In a preferred embodiment, the value of the data metric evaluated on the original dataset and the synthetic replicate is used to evaluate the data synthesis algorithm, wherein said evaluating comprises evaluating the quality, accuracy, utility and / or privacy of the synthetic replicate compared to the original dataset.

[0036] In a preferred embodiment, the data metric comprises one or more of the following: a check for the coverage of a set or interval of values of the data metric, a check for the keeping of boundaries or interval limits of the data metric, a measure of distances or similarities between variables in the datasets given as input to the data metric, in particular the Gower distance, Manhattan distance, Euclidean distance, and / or nearest neighbor distance ratios (NNDRs), a measure of correlation and / or association between variables in the datasets given as input to the data metric, in particular the covariance, Kullback-Leibler divergence, Pearson correlation coefficient, and / or Spearman’s rank correlation coefficient, and / or an evaluation of statistical tests, in particular using measures of R-Squared values, Chi-Squared or modified Chi-Squared coefficient, and / or Cramers V.

[0037] In a preferred embodiment, the data synthesis algorithm is updated or modified based on the obtained value of the data metric resulting from the application of the method of the present subject matter. Said updates or changes comprise updates, changes or tunings of any learnable parameters and / or hyperparameters of the data synthesis algorithm, updates or changes to the structure of the data synthesis model associated with the data synthesis algorithm, and / or changes related to structure, composition, and / or size of the training, test, and / or validation sets associated with the data synthesis model.

[0038] In a preferred embodiment of the present subject matter, a first data complexity function is evaluated on the original dataset, resulting in a first data complexity value. The first complexity value is compared to a first threshold, also referred to as a first complexity threshold. Based on the result of said comparing, the generation of the synthetic replicate is performed on the computer device of the user using the unencrypted original dataset if the first data complexity value does not exceed the first complexity threshold. If the first complexity threshold is exceeded, the generation of the synthetic replicate as anencrypted synthetic replicate is performed on the server using the encrypted original dataset as input.

[0039] In a preferred embodiment of the present subject matter, a second data complexity function is evaluated on the original dataset and / or the synthetic replicate, resulting in a second data complexity value. The second complexity value is compared to a second threshold, also referred to as a second complexity threshold. Based on the result of said comparing, the method of the present subject matter, including the evaluation of the data metric, is performed on the computer device of the user using the unencrypted original dataset if the second data complexity value does not exceed the second complexity threshold. If the second complexity threshold is exceeded, the method of the present subject matter, including the evaluation of the homomorphic data metric, is performed on the server using the encrypted original dataset and the encrypted synthetic replicate as input.

[0040] In a preferred embodiment, the computer device of the user may be located at an access-controlled site, wherein access is granted to the user via an access-control device. As an advantage of the present subject matter, homomorphic encryption allows for the evaluation of data metrics to be performed on the server, wherein the server may be located outside the access-controlled site, wherein the personal data is stored on the computer device of the user inside the access-controlled site without the server being able to read the personal data in its unencrypted form.

[0041] Embodiments of the invention provide a computer system, the system comprising of a server and / or a computer device or set of computer devices. Said computer devices may in particular include the computer device of the user. In a preferred embodiment, the computer system is configured to execute the method of the present subject matter.

[0042] In one embodiment, parts of the disclosed method may be performed by specialized classical hardware. Said specialized classical hardware may exemplarily comprise a GPU, an FPGA and / or an ASIC. The specialized classical hardware may be communicatively coupled to the computer system.

[0043] In another embodiment, parts of the disclosed method may be performed by a quantum computing device. Said quantum computing device may comprise a quantum annealer or a universal gate-based quantum computer. In particular, the quantumcomputing device may comprise a photonic chip configured to perform quantum operations using photonic qubits. The quantum computing device may be communicatively coupled to the computer system or accessed via a quantum cloud service provider. The quantum computing device may be used instead or in addition the specialized classical hardware.

[0044] A use of the specialized classical hardware and / or the quantum computing device for performed particular steps of the disclosed method may advantageously result in faster calculations or improved scalability, as said specialized classical hardware and / or said quantum computing device may enable specialized algorithms to be executed which are not executable on standard hardware. Furthermore, particular hardware arrangements of the specialized classical hardware and / or the quantum computing device may be exploited for improved computational efficiency. In particular, the specialized classical hardware and / or the quantum computing device may be used for encrypting the at least two datasets in accordance with the homomorphic encryption scheme to obtain the at least two encrypted data sets, and / or for evaluating the homomorphic data metric.

[0045] Embodiments of the invention provide a computer program product, wherein the computer program product comprises one or more computer readable storage media, on which program instructions are embodied, wherein the program instructions are executable by one or more processors of a computer system, said program instructions causing the one or more processors to execute operations according to the method of the present subject matter. In an exemplary embodiment, the computer program product may be present on the computer system, comprising a server and / or a computer device or set of computer devices. In an alternative embodiment, the computer program product may be provided as a downloadable executable file, wherein the execution of the file performs the method for evaluating data metrics on homomorphically encrypted data.

[0046] Embodiments of the invention provide a data structure stored on a computer system, the data structure comprising at least two datasets in the encrypted domain, wherein the encrypted domain is provided by a homomorphic encryption scheme. The data structure further comprises a homomorphic data metric and / or an encrypted measure of the homomorphic data metric.

[0047] It is understood that one or more of the aforementioned examples may be combined as long as the combined examples are not mutually exclusive.BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In the following, examples are described in greater detail making reference to the drawings in which:

[0049] Fig. 1 is a flow chart for an application of the method for evaluating a data metric on homomorphically encrypted data, including the evaluation of the data synthesis model or algorithm in accordance with an example of the present subject matter.

[0050] Fig. 2 is a flow chart for an application of the method for evaluating a data metric on homomorphically encrypted data, as executed on the server in accordance with an example of the present subject matter, wherein the synthetic replicate is generated on the server.

[0051] Fig. 3 is a flow chart for an application of the method for evaluating a data metric on homomorphically encrypted data, as executed on the server in accordance with an example of the present subject matter, wherein the synthetic replicate is generated on the computer device of the user.

[0052] Fig. 4 is a flow chart for the evaluation of a first complexity function, wherein the comparison of the resulting first complexity value with a first threshold is used to decide whether the generation of the synthetic replicate is to be performed on the server or on the computer device of the user.

[0053] Fig. 5 is a flow chart for the evaluation of a second complexity function, wherein the comparison of the resulting second complexity value with a second threshold is used to decide whether the evaluation of the data metric is to be performed on the server or on the computer device of the user.

[0054] Fig. 6 is a diagram of interactions between the server and a computer device of a user located at an access-controlled site.

[0055] Fig. 7 is a block diagram of an exemplary computer system for implementing at least part of the present method in accordance with an example of the present subject matter.

[0056] Fig. 8 is a block diagram of exemplary interactions between a classical computer system as shown in Fig. 7 and a quantum computing device as well as a quantum cloud service provider.DETAILED DESCRIPTION

[0057] In the following description, for purposes of explanation and not limitation, specific details are set forth such as particular architectures, interfaces, techniques, etc., in order to provide a thorough understanding of the examples. However, it will be apparent to those skilled in the art that the disclosed subject matter may be practiced in other illustrative examples that depart from these specific details. In some instances, detailed descriptions of well-known devices and / or methods are omitted so as not to obscure the description with unnecessary detail.

[0058] In the following, similar elements are denoted by the same reference numerals.

[0059] The present subject matter may enable a systematic and accurate evaluation of the quality, accuracy, utility and privacy of synthetic data, wherein said synthetic data is generated from data comprising real-world values using data synthesis algorithms and models such as machine learning models. Said synthetic data may then be publicly shared without violation of data protection or privacy regulations, thus enabling the use of said synthetic data as e.g. training data for training a machine learning model (e.g. for performing a classification task or regression task) or performing a reliable data analysis.

[0060] Fig.1 is a flow chart for an application of the method 100 for evaluating a data metric on homomorphically encrypted data, including the evaluation of the data synthesis model or algorithm in accordance with an example of the present subject matter. Parts of the computation of the method 100 may be carried out by classical computing devices, in particular by specialized classical hardware such as GPUs, FPGAs and / or ASICs or by quantum computing devices such as photonic chips, quantum annealers or universal gate based quantum computers.

[0061] The original dataset 102 comprises entries containing real-world data, said real- world data being collected from real-world events, being directly or indirectly obtained from measurements or observations. Real-world data in particular includes measurement data, sensor data, and / or personal data. In contrast to said real-world data, synthetic data is algorithmically generated using a data synthesis algorithm, or data synthesis model including e.g. machine learning algorithms.

[0062] The original dataset 102 may comprise sensitive data, such as personal data. Each entry of the original dataset 102 may represent a respective entity, e.g., the entries of personal data may represent students where the set of attributes may comprise, age, student’s address, student’s ID, or the records may represent bank accounts, where the set of attributes may comprise amount of money, account holder, the name of the bank etc. The personal data may represent medical data, e.g. the records may represent patients where the set of attributes may comprise, age, gender, expression values of biomarkers, the presence of cancer etc. The original dataset 102 may represent a field such as the finance field, medical field or any other field that can be represented with the set of attributes.

[0063] Exemplary embodiments of the original dataset 102 comprise data represented in tabular or matrix format. For a table or matrix representing the original dataset, columns may indicate entries while rows denote or features, variables or attributes, or vice versa. The values for a particular feature, variable or attribute may take on a variety of data types, said data types comprising metrically scaled data, for example floating-point numbers or integers, ordinally scaled data, binary or Boolean values, or nominally scaled data, for example string data. In said embodiment, the original dataset is provided as a file, wherein the file may be presented in a variety of formats, for example as a text (.txt) file, a comma separated values (.csv) file, a tab separated values (.tsv) file or another suitable format for representing data in tabular or matrix format.

[0064] The present subject matter may provide different preprocessing techniques for providing the original dataset 102. This may enable to improve the data synthesis algorithm 106. Exemplary embodiments of said preprocessing techniques comprise the reformatting of entries in the original dataset 102, the normalization values in the original dataset 102 and / or the conversion of the file format the original dataset 102 is provided in into another file format.

[0065] In one example, records of the original dataset 102 may be obtained from records which are received from one or more data sources. The data sources may, for example, be databases. For example, a query may be sent by the computer system to the one or more data sources and in response to the query, the computer system may receive records of the original dataset 102. The computer system may create a table out of the received records. Alternatively, or additionally, records of the original dataset 102 may be obtained from records which are derived or created by processing unstructured data suchas web pages and PDF files.

[0066] The synthetic replicate 104 is a dataset comprising synthesized data generated using the data synthesis algorithm 106. An exemplary embodiment of the data synthesis algorithm 106 is the PrivBayes algorithm, in which data is generated using a machine learning model, in particular a Bayesian network model. In a preferred embodiment, the synthetic replicate is represented in tabular or matrix format, wherein the number of variables or attributes included in the synthetic replicate as well as the measurement scale of said variables or attributes matches the number as well as the measurement scale of the variables or attributes in the original dataset.

[0067] In step 110, the original dataset 102 and / or the synthetic replicate 104 are encrypted in accordance with the homomorphic encryption scheme 108, resulting in an encrypted dataset 112 and / or an encrypted synthetic replicate 114. The encryption step 110 is performed using the public key of the public-key asymmetric encryption algorithm used for the homomorphic encryption scheme 108.

[0068] Following the encryption step 110, the evaluation of the homomorphic data metric 121 according to the method 100 of the present subject matter is performed. Said evaluation results in the obtaining of the encrypted measure 116 of the homomorphic data metric 121. In an exemplary embodiment, multiple homomorphic data metrics 121 capturing different aspects of the quality of the data synthesis algorithm 106 are evaluated simultaneously, resulting in multiple encrypted measures 116. The encrypted measure 116 can be decrypted by the user 204 using the private key 206, resulting in the measure 116.

[0069] In step 118, the measure 116 is used to evaluate the quality of the data synthesis algorithm 106, for example the predictivity or accuracy of the data synthesis algorithm on a test set of data, or the utility and / or privacy of the resulting synthesized dataset compared to the underlying original dataset 102. In an exemplary embodiment, the measure 116 is compared to a desired condition, comprising e.g. a minimum value, maximum value, or a desired set, range or interval of values for the data metric 120 associated with the measure 116. In an exemplary embodiment, said desired condition is specified by the user 204.

[0070] In a preferred embodiment, the data synthesis algorithm 106 comprises a machine learning model for data synthesis, wherein the training of said machine learningmodel is performed on one part of the original dataset 102, referred to as the training set, and testing is performed on another part of the original dataset 102, referred to as the test set, in order to quantify the quality of the machine learning model 106.

[0071] After the generation of the synthetic replicate 104 using the data synthesis algorithm 106, said machine learning model in said embodiment is trained on data comprised by the synthetic replicate 104 and testing is performed on the test used previously used for quantifying the quality of the machine learning model.

[0072] If the testing of the original dataset 102 and the testing of the synthetic replicate 104 result in comparable values for measures of quality, such as measures for predictivity, accuracy, utility and / or privacy, the synthetic replicate 104 is taken to be of good quality and show similar characteristic properties to the original dataset.

[0073] In a preferred embodiment, the evaluation whether the measure 116 of the data metric meets the desired condition or not is used to update or change the data synthesis algorithm 106 and / or any machine learning model associated with said data synthesis algorithm. Said updates or changes comprise updates, changes or tunings of any learnable parameters and / or hyperparameters of the data synthesis algorithm, updates or changes to the structure of the data synthesis model associated with the data synthesis algorithm, and / or changes related to structure, composition, and / or size of the training, test, and / or validation sets associated with the data synthesis model.

[0074] In an exemplary embodiment, the data synthesis algorithm 106 is a data synthesis algorithm implemented in accordance with the homomorphic encryption scheme 108 and is able to directly generate the encrypted synthetic replicate 114 given the encrypted original dataset 112 as input.

[0075] In an exemplary embodiment, the (homomorphic) data metric 120,121 comprises an examination of marginal distributions as a statistical test of privacy. The marginal distributions comprise marginal distributions of the original dataset 102 and the synthetic replicate 104 or marginal distributions of the encrypted original dataset 112 and the encrypted synthetic replicate 114. Said examination of marginal distributions could provide indications of violations of data protection requirements and may indicate whether or not a synthetic replicate 104,114 has been synthesized in a privacy-preserving manner.

[0076] Unique combinations of values for sets of features may unambiguously identify persons associated with particular entries in the original dataset 102. This risk of identification is particularly present in the case of complex datasets. To alleviate this risk, the evaluation of the (homomorphic) data metric 120,121 may comprise the computation of conditional empirical frequencies for particular combinations of features, variables or attributes (in the following denoted as attribute combinations).

[0077] Conditional probability distributions of chosen attribute combinations in the original dataset 102 and the synthetic replicate 104 are then examined to evaluate the empirical frequencies of said attribute combinations in both datasets 102,104. It is desirable for attribute combinations with comparatively low empirical frequency to not be reproducible, as these may be referred back to entries in the original dataset and thus lead to the violation of data protection regulations. This is in particular the case for entries in the original dataset 102 which are considered statistical outliers according to some variable or attribute.

[0078] In the following, examples for (homomorphic) data metrics 120,121 to be used in the method 100 according to the present subject matter, as well as the aspect of the data synthesis algorithm 106 which these data metrics 120,121 measure are described in detail. All following data metrics 120 are taken to be implemented as homomorphic data metrics 121 capable of taking encrypted datasets 112,114 as input. These data metrics 120,121 comprise measures of distance or similarity, and measures capturing correlations or associations between variables in two datasets.

[0079] In an exemplary embodiment, the data metric 120 comprises a check for data coverage as a measure of utility. Data coverage herein denoted the percentage of the interval of values of a first dataset, for example the original dataset 102, which is covered by a second dataset, for example the synthetic replicate 104, as determined by the minimum and maximum values of a particular variable or attribute in the second dataset across all entries in the second dataset.

[0080] In a further exemplary embodiment, the data metric 120 comprises a check for the keeping of boundaries as a measure of utility. The keeping of boundaries evaluates the percentage of the part of the value interval of the synthetic dataset 104, which is inside the interval boundaries of the original dataset 102 for some attribute or variable, meaning the percentage of entries in the interval defined by min(x) and max(x), with x being the set of values of some variable or attribute across all entries in the original dataset 102.

[0081] In an exemplary embodiment, the percentage of values which do keep the boundaries are computed separately for every variable or attribute in the original dataset 102. The obtained percentages may then for example be averaged to obtain a single measure of utility for the keeping of boundaries.

[0082] In a further exemplary embodiment, the data evaluation metric is a distance metric. Distance metrics may for example be based on quantitative, interval, ordinal or nominal measures. The distance metric takes two datasets as inputs, wherein the evaluation of the distance metric results in an encrypted value as its output value, the output value quantifying the similarity between the two datasets given as inputs to the distance metric. In a preferred embodiment, the output value of the distance metric falls in the range between 0 and 1 , including 0 and 1 themselves as possible edge cases, wherein a value of 0 indicates two identical datasets, whereas a distance of 1 indicates maximally different datasets.

[0083] In an alternative embodiment, the range of values of the distance metric differs, e.g. the maximal distance may be infinite. In a further alternative embodiment, the distance metric is a similarity metric instead, wherein the interpretation of low or high numerical values of the metric is opposite to a distance metric. Depending on the particular metric, a high or low distance can be desirable.

[0084] A distance metric is convertible into a similarity metric, for example as Similarity = |1 - Distance!orSimilarity = l - Distance or a similar conversion, depending on the range of possible values of the distance metric.

[0085] In a preferred embodiment, the distance metric used as the data metric 120 is the Gower distance as a measure of privacy. The Gower distance can be defined for numerical as well as categorical entries in datasets. For two numerical entries xtthe Gower similarity is defined as Nis a normalization coefficient for the greatest appearing distance. If xtandare categorical, the distance s(xi, x-) is defined to be 1 if xt=and 0 otherwise. Since the Gower distance is applicable to both numerical and categorical data, it can also be applied to datasets containing mixtures of numerical and categorical data.

[0086] For two datasets of length p, the Gower similarity can then be defined as Scower(x>x'):= 1 1s xt’xi ) / ■ The Gower distance can then be defined as dcowerUsing this definition, the distances between entries inboth datasets can in a preferred embodiment be represented in a distance matrix. On the basis of the distance matrix, points in the synthetic replicate 104 having low distance to the original dataset 102 can be identified. The minimal value in said distance matrix, that is the minimal value of the Gower distance, is denoted as the nearest distance.

[0087] In an alternative embodiment, the distance metric used as the data metric 120 is the Manhattan distance the Euclidean distance.

[0088] In a further exemplary embodiment, the distance metric used as the data metric 120 is a nearest neighbor distance ratio (NNDR) as a measure of privacy.

[0089] For a pair of numerical datasets, the nearest neighbor distance ratio is given bythe average over quotients of the form - Distance to second nearest - n -eighbor averaged over all entries of both datasets. The measure of distance in said quotient is arbitrary, however in a preferred embodiment the measure of distance is the Gower distance.

[0090] In an alternative embodiment of the NNDR, the distance to the second nearest neighbor is replaced by the n-th nearest neighbor, where n > 3.

[0091] A combination of the nearest distance and the NNDR can advantageously be used for the identification of privacy violations. If a distance between an entry in the synthetic replicate 104 and an entry in the original dataset 102 is small but shows a high NNDR, this implies the presence of a cluster in the original dataset 102, where only a small violation of privacy is to be expected. If both the nearest distance as well as the NNDR are small, it is likely that the data synthesis algorithm has synthesized an outlier, in which case said outlier should be removed from the synthetic replicate 104 in order to preserve the privacy of the person associated with the corresponding outlier entry in the original dataset 102.

[0092] In an exemplary embodiment, the user 204 provides threshold for the values of the minimal distance and / or the NNDR used for the removal of outliers in the synthetic replicate 104.

[0093] In a further exemplary embodiment, data metric 120 quantifies similarity (and thereby distance) using statistical properties such as correlations between the original dataset 102 and the synthesized replicate 104. This can be performed by the calculation of correlation and / or association relationships between the datasets. Such relationships in particular comprise the calculation of covariances between variables or attributes,Pearson correlation coefficients, Spearman’s rank correlation coefficients for ranked or ordinally scaled data, and the calculation of mutual information and / or Kullback-Leibler- divergences (KL divergences).

[0094] Association relationships can further be quantified by the evaluation of statistical tests, for example significance tests based on the R-Squared (R2) coefficient, Pearsons / 2(chi-squared) or modified chi-squared coefficient, also denoted as Cramers V.

[0095] In an exemplary embodiment, the data metric 120 is the Kullback-Leibler divergence used as a measure of utility. The Kullback-Leibler divergence describes the differences between two probability distributions| Fr) == ExIPx(W) • log summing over all possible singular events of the underlyingrandom variable of the probability distributions.

[0096] In an exemplary embodiment, the data metric 120 is the covariance used as a measure of utility. The covariance between two real-valued random variables is defined as Cov(X, Y) := E[(X - E[X])(Y - E[Y])] where E indicates an expectation value.

[0097] In an exemplary embodiment, the data metric 120 is Pearson’s correlation coefficient or Spearman’s rank correlation coefficient used as a measure of utility. Pearson’s correlation coefficient is defined for two real-valued random variables as Spearman’s rank correlation coefficient is a variation of Pearson’scorrelation coefficient, which is applicable to both numerical and categorical data.

[0098] In an exemplary embodiment, the data metric 120 is Pearson’s2test or Cramers V used as a measure of utility. For a series of categorical data with k different values, the expected frequency EXPj and the observed frequency OBSj for j = 1, ...,k can be defined based on assumptions over the underlying distribution (null hypothesis) and random( O B S ■—E X P ■ 2 samples. Pearson’s x2test statistic is then given as x2 := Sj=i- —pxp.]■ The test statistic can be compared between the original dataset 102 and the synthetic replicate 104. If the calculated values exceed a predetermined threshold, the null hypothesis has to be discarded. In an exemplary embodiment, the predetermined threshold is provided by the user 204.

[0099] All data metrics 102 applied to the original dataset 102 and the synthetic replicate 104 are likewise applicable to the encrypted original dataset 112 and the encryptedsynthetic replicate 114, using implementations of the data metrics 120 as homomorphic data metrics in accordance with the homomorphic encryption scheme 108.

[0100] Fig 2 is a flow chart for an application of the method 100 for evaluating a data metric 120 as a homomorphic data metric 121 on homomorphically encrypted data, as executed on the server 200 in accordance with an example of the present subject matter, wherein the synthetic replicate 104 is generated on the server 200.

[0101] In step 208, the encrypted original dataset 112 is provided to the server 200. In step 210, the encrypted synthetic replicate 114 is generated on the server 200 using the data synthesis algorithm 106 as a homomorphic data synthesis algorithm in accordance with the homomorphic encryption scheme 108. Following step 210, the method 100 for the evaluation of a data metric 120 is executed, resulting in at least one encrypted value 116 of at least one data metric 120. In the subsequent step 212, said at least one encrypted measure 116 is provided to the computer device 202 of the user 204. In step 214, the encrypted at least one measure 116 is decrypted by the user 204 using the private key 206, wherein said private key is stored on the computer device 202 of the user 204 and matches the public key used for encrypting the encrypted original dataset 112. Lastly, in step 118, the data synthesis algorithm 106 is evaluated based on the decrypted measure 116 of the data metric.

[0102] Fig. 3 is a flow chart for an application of the method 100 for evaluating data metrics 120 on homomorphically encrypted data, as executed on the server 200 in accordance with an example of the present subject matter, wherein the synthetic replicate is generated on the computer device of the user 204 first, before providing both encrypted datasets 112,114 to the server 200.

[0103] In step 310, the encrypted synthetic replicate 104 is generated on the server 200 using the data synthesis algorithm 106 as a homomorphic data synthesis algorithm in accordance with the homomorphic encryption scheme 108. In the following step 308, analogous to step 208 in Fig. 2, the encrypted original dataset 112 and the encrypted synthetic replicate 114 are provided to the server 200. Following step 310, the method 100 for the evaluation of data metrics 120 is executed, resulting in at least one encrypted value 116 of at least one data metric 120. In the subsequent step 312, said at least one encrypted measure 116 and / or the generated encrypted synthetic replicate 114 are provided to the computer device 202 of the user 204. In step 314, the encrypted at leastone measure 116 and / or the encrypted synthetic replicate 114 are decrypted by the user 204 using the private key 206, wherein said private key is stored on the computer device 202 of the user 204 and matches the public key used for encrypting the encrypted original dataset 112. Lastly, in step 118, the data synthesis algorithm 106 is evaluated based on the decrypted measure 116 of the data metric.

[0104] Fig. 4 is a flow chart for the evaluation of a first complexity function 400, wherein the comparison of the resulting first complexity value 402 with a first threshold 404 is used to decide whether the generation of the synthetic replicate 104 is to be performed on the server 200 or on the computer device 202 of the user 204.

[0105] In step 406, the original dataset 102 is provided on the computer device of the user 204. In step 408, a first data complexity function 400 is evaluated, resulting in the receiving of a first data complexity value 402 in step 410. In step 412, a first switch criterion is evaluated. If the first data complexity value 402 exceeds a first threshold 404, the original dataset 102 is encrypted 110, and provided to the server 200 as the encrypted original dataset 112 in step 208 followed by the generation of the encrypted synthetic replicate 114 on the server 200 using the data synthesis algorithm 106 as a homomorphic data synthesis algorithm in accordance with the homomorphic encryption scheme 108. If the first data complexity value 402 does not exceed the first threshold 404, the synthetic replicate 114 is generated on the computer device 202 of the user 204 using the data synthesis algorithm 106 in step 414.

[0106] In an exemplary embodiment, the first threshold 404 is provided by the user 204.

[0107] In an exemplary embodiment in which the original dataset 102 and / or the synthetic replicate 104 are represented as tables or matrices, the first threshold 404 may be set based on the dimension of one or both of said matrices, including for example the number of rows, the number of columns or a combination of the number of rows and the number of columns.

[0108] In an exemplary embodiment of the data metric being the Gower distance, the first data complexity function 400 is chosen to evaluate the size of a distance matrix. In an exemplary embodiment of the distance matrix, the entries of said distance matrix contain values quantifying the distance between entries in the original and entries in the synthesized dataset. For example, an entry in the i-th row and the j-th column of thedistance matrix may contain a distance between the i-th entry in the original dataset and the j-th entry in the synthesized dataset.

[0109] Fig. 5 is a flow chart for the evaluation of a second complexity function 500, wherein the comparison of the resulting second complexity value 502 with a second threshold 504 is used to decide whether the evaluation of the data metrics 120 is to be performed on the server 200 or on the computer device 202 of the user 204.

[0110] In step 506, the original dataset 102 and the synthetic replicate 104 or the encrypted synthetic dataset 112 and the encrypted synthetic replicate 114 are provided on the computer device of the user 204. In step 508, a second data complexity function 500 is evaluated, resulting in the receiving of a second data complexity value 502 in step 510. In step 512, a second switch criterion is evaluated. If the second data complexity value 502 exceeds a second threshold 504, the original dataset 102 and the synthetic replicate 104 are encrypted 110, and provided to the server 200 as the encrypted original dataset 112 and the encrypted synthetic replicate 114 in step 308 followed by the execution of the method 100 for the evaluation of data a metric 120 as a homomorphic data metric 121 on the server 200. If the second data complexity value 502 does not exceed the second threshold 504, the method 100 for the evaluation of a data metric 120 is executed on the computer device 202 of the user 204.

[0111] Analogous to Fig. 4, in an exemplary embodiment, the second threshold 504 is provided by the user 204. In another exemplary embodiment, the second threshold 504 is set based on the dimension of a matrix quantifying the size of the datasets 102,104. Analogous to Fig. 4, in an exemplary embodiment, the second data complexity function 500 is chosen to evaluate the size of a distance matrix.

[0112] Fig. 6 is a diagram of interactions between the server 200 and the computer device 202 of the user 204 located at an access-controlled site 600.

[0113] The computer device 202 of the user 204 may be located at an access-controlled site 600. An access-controlled site 600 may refer to any location for which access is limited to users able to verify their identity by interaction with an access-control device 602. In an exemplary embodiment, the access-controlled site 600 may refer to a government facility or ministery. In another exemplary embodiment, the access-controlled site 600 may refer to a hospital or clinic. In a further exemplary embodiment, the access-controlled site 600 may refer to a university, institute of higher education, research facility and / or corporate office.

[0114] In a preferred embodiment, the access-control device 602 may be required in order to ensure regulatory compliance, to adhere to data protection laws and / or to limit access to confidential, sensitive and / or personal data stored on the computer device 202. Exemplary embodiments of the access-control device 602 comprise a key, an identity card scanner and / or a fingerprint scanner. An identity card presented to an identity card scanner in said embodiment of the access-control device 602 may comprise a government-issued identity card, a corporate-issued identity card, an employee card, a membership card, a passport or a driver's license.

[0115] Fig. 7 is a block diagram of an exemplary computer system for implementing the present method in accordance with an example of the present subject matter. The computer system may include the computer device 202 of the user 204, wherein the computer device 202 may refer to a desktop computer, laptop, tablet or mobile device. The computer system may alternatively refer to the server 200.

[0116] In a preferred embodiment, the computer system 702 includes the server 200, the computer device 202 or the joint system of the server 200 and the computer device 202. In operation, the computer system 702 may be configured to execute the interactions and the performance of the evaluation of data metrics on homomorphically encrypted data as described in the preceding figures Fig. 1 to Fig. 6.

[0117] The components of the computer system 702 may include, but are not limited to, one or more processors or processing units 703, a storage system 711 , a memory unit 705, and a bus 707 that couples various system components including memory unit 705 to processor 703. The storage system 711 may include for example a hard disk drive (HDD). The memory unit 705 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory.

[0118] The computer system 702 may also communicate with one or more external devices such as a keyboard, a pointing device, a display 713, etc.; one or more devices that enable a user to interact with computer system 702; and / or any devices (e.g., network card, modem, etc.) that enable the computer system 702 to communicate with one or more other computing devices. Such communication can occur via I / O interface(s) 719. Still yet, the computer system 702 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet) via a network adapter 709. As depicted, the network adapter 709 communicates with the other components of the client system 702 via bus 707.

[0119] The memory unit 705 is configured to store applications that are executable on the processor 703. For example, the memory unit 705 may comprise an operating system as well as one or more application programs. The application programs comprise instructions that when executed enable to perform the method described with reference to Fig. 1 .

[0120] As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as an apparatus, method, computer program or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer executable code embodied thereon. A computer program comprises the computer executable code or "program instructions".

[0121] The term “computer system” refers to data processing hardware and encompasses all kinds of apparatus, devices, and machines for processing data, including by way of example, a programmable processor, a computer, or multiple processors or computers. The apparatus can also be or further include special purpose logic circuitry, e.g., a central processing unit (CPU), a FPGA (field programmable gate array), or an ASIC (application specific integrated circuit). In some implementations, the data processing apparatus and / or special purpose logic circuitry may be hardware-based and / or software-based. The apparatus can optionally include code that creates an execution environment for computer programs, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them. The present disclosure contemplates the use of data processing apparatuses with or without conventional operating systems, for example LINUX, UNIX, WINDOWS, MAC OS, ANDROID, IOS or any other suitable conventional operating system.

[0122] Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable storage medium. A ‘computer- readable storage medium’ as used herein encompasses any tangible storage medium which may store instructions which are executable by a processor of a computing device. The computer-readable storage medium may be referred to as a computer-readable non- transitory storage medium. The computer-readable storage medium may also be referred to as a tangible computer readable medium. In some embodiments, a computer-readablestorage medium may also be able to store data which is able to be accessed by the processor of the computing device.

[0123] ‘Computer memory’ or ‘memory’ is an example of a computer-readable storage medium. Computer memory is any memory which is directly accessible to a processor. ‘Computer storage’ or ‘storage’ is a further example of a computer-readable storage medium. Computer storage is any non-volatile computer-readable storage medium. In some embodiments computer storage may also be computer memory or vice versa.

[0124] A ‘processor’ as used herein encompasses an electronic component which is able to execute a program or machine executable instruction or computer executable code. References to the computing device comprising “a processor” should be interpreted as possibly containing more than one processor or processing core. The processor may for instance be a multi-core processor. A processor may also refer to a collection of processors within a single computer system or distributed amongst multiple computer systems. The term computing device should also be interpreted to possibly refer to a collection or network of computing devices each comprising a processor or processors. The computer executable code may be executed by multiple processors that may be within the same computing device or which may even be distributed across multiple computing devices.

[0125] Computer executable code may comprise machine executable instructions or a program which causes a processor to perform an aspect of the present invention. Computer executable code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages and compiled into machine executable instructions. In some instances the computer executable code may be in the form of a high level language or in a pre-compiled form and be used in conjunction with an interpreter which generates the machine executable instructions on the fly.

[0126] Generally, the program instructions can be executed on one processor or on several processors. In the case of multiple processors, they can be distributed over several different entities. Each processor could execute a portion of the instructions intended for that entity. Thus, when referring to a system or process involving multiple entities, the computer program or program instructions are understood to be adapted to be executed by a processor associated or related to the respective entity.

[0127] Fig. 8 is a block diagram of exemplary interactions between a classical computer system 702 as described in Fig. 7 and a quantum computing device 802 as well as a quantum cloud service provider 804. The quantum computing device 802 may also be referred to as a quantum processing unit (QPU).

[0128] The quantum processing unit 802 may be directly communicatively coupled to the classical computer system 702, resulting in a hybrid quantum-classical computer system 702. Alternatively, the quantum computing device may be located in a remote location, wherein the quantum processing unit 802 may be accessed by the classical computer system 702 via a quantum cloud service provider 804. The quantum cloud service provider 804 may receive instructions to be executed on the quantum processing unit 802 from the classical computer system 702, pass said instructions on to the quantum processing unit 802, receive measurement results from the quantum processing unit 802 as a result of executing said instructions and pass the measurement results back to the classical computer system 702. The user 204 may interact with the classical computer system 702 or the hybrid quantum-classical computer system 702 to provide said instructions.

[0129] Qubits may be in states that are basis states of the quantum system, said basis states being denoted as |0) and |1) and being analogues to the 0 and 1 states of a classical bit. Qubits may further be in states that are superpositions of multiple basis states of the quantum system, wherein each basis state is associated with an amplitude, said amplitude being related to a probability for measuring the qubit to be in the basis state associated with said amplitude. For example, the superposition state \ (J) =|0) + / 3 / 4|1> could be measured to be |0) in 25% of measurements and measured to be |1) in 75% of measurements for a sufficiently large number of measurements. Amplitudes of basis states may be updated or changed in a quantum computation consisting of a set of quantum gates in a quantum circuit or a set of quantum operations. The process comprising the initialization and execution of a quantum computation, followed by a measurement may be referred to as a “shot” or “run” of said quantum computation.

[0130] Notations such as |0) and |1) may refer to states of an individual qubit, or to states of multiple qubits. For example, the |0) and |1) may respectively indicate the 3- qubit states 1000> and 1001>. Multi-qubit states may be denoted by an integer representation of the bitstring indicating the multi-qubit state. Using this notation, a state |7) may exemplarily indicate the 3-qubit state 1111>.1

[0131] In one embodiment, the QPU 802 is a gate-based quantum computer configured to execute quantum operations comprising quantum gates on a set of one or more qubits. A configuration of quantum gates applied in a specific order to a specific set of qubits is referred to as a quantum circuit. The execution of a quantum circuit may further comprise an initialization and readout or measurement step. Quantum gates comprise single qubit and multi-qubit quantum gates.

[0132] Single qubit quantum gates exemplarily comprise the , Y and Z Pauli gates, the Rx(0), Rr(0) and Rz(6) rotation gates parametrized by an angle 6, the H (also called Hadamard) gate, and thephase shift gate parametrized by an angle <p.

[0133] Entanglement between qubits may be created by the execution of multi-qubit gates. Multi-qubit gates exemplarily comprise the SWAP gate, which swaps the states of two qubits and controlled gates, for example the CX (also called CNOT) gate. Controlled gates may comprise an arbitrary number of control qubits and at least one target qubit. A quantum operation is executed on the target qubit if all control qubits are in the |1) state. For example, the CCX gate comprises two control qubits, acting as an X gate on the target qubit only if both control qubits are in the |1) state.

[0134] The QPU 802 may be restricted to the execution of a specific set of gates, here denoted as natively available gates. Arbitrary quantum circuits may be decomposed into a series of said specific set of natively available gates.

[0135] In an alternative embodiment, the QPU 802 is a quantum annealer configured to execute a quantum annealing method. Quantum annealers may exemplarily be used to solve optimization problems, in particular problems formulated as combinatorial optimization problems, and in particular quadratic unconstrained binary optimization (QUBO) problems.When solving a QUBO problem, binary variables or features are mapped to the states of qubits and interactions and / or constraints of said variables or features are mapped to interactions between the qubits. The measurement of the qubits used to solve the QUBO problem results in a solution in the form of a binary bitstring, wherein each bit corresponds to the state of a qubit, and thereby to the value of an associated binary variable. The solution ideally corresponds to the ground state of the quantum system comprised by the qubits of the quantum annealer.

[0136] In a further embodiment, optimization problems may be solved using a gatebased quantum computer as the QPU 802 using the quantum approximate optimization algorithm (QAOA).

[0137] The implementation of the 10) and 11) states of qubits, the structure of quantum operations to be applied to the qubits and the implementation of measurements of qubits may vary depending on the physical quantum system used in the QPU 802.

[0138] In one embodiment, a qubit comprises at least one superconducting Josephson junction, wherein a nonlinear inductance enables the formation of discrete energy levels, said energy levels exemplarily being identified with the |0) and |1) states of a qubit. In particular, a qubit may be implemented as a transmon qubit, flux qubit, charge qubit or phase qubit. For example, in a flux qubit, the |0) and |1) states correspond to different persistent current states circulating through a superconducting loop. As a further example, in a phase qubit, a phase difference across a Josephson junction is used to define the qubit states the |0) and 11>. The states of the qubit may be manipulated using microwave pulses tuned to the qubit transition frequency corresponding to the transition between the states associated with |0) and |1). The phase, frequency and / or amplitude of said microwave pulses may be varied to implement various quantum operations. A measurement may be performed for example by coupling the superconducting qubit to a resonator, wherein a resonator frequency of the resonator shifts depending on the qubit state. The qubit state may thus be detected via said frequency shift by probing the resonator with a microwave signal. A measurement may further be performed by measuring a transmitted or reflected microwave signal from the resonator.

[0139] Advantageously, the use of superconducting Josephson junctions for the implementation of qubits enables improved scalability, as standard microfabrication techniques may be employed, resulting in a larger number of qubits in a QPU 802. Said qubits further enable fast gate operations on the order of nanoseconds.

[0140] In a further embodiment, qubits comprise trapped ions, in particular trapped ions in an ultra-high vacuum, said ions being trapped in space for example via the application of oscillating electric fields, for example as in a quadrupole ion trap (also known as a Paul trap). In said embodiment, the |0) and |1) states of a qubit may be the ground state and an excited state, or two different excited states of an ion, for example an ytterbium ion or a calcium ion. The states of the qubit may be manipulated using laser light emitting a frequency tuned to the energy of the transition between the |0) and |1) state to implementquantum operations. For example, a laser emitting a frequency of light tuned to the energy difference between the |0) and |1) states may implement single qubit rotation gates, wherein the length of the laser pulse corresponds to the angle of rotation. Said laser light may be applied to one or multiple qubits simultaneously to implement single or multi-qubit quantum operations. A measurement may be performed as an optical readout using fluorescence detection. For example, a stronger fluorescence signal may correspond to the |0) state and a weaker fluorescence signal may correspond to the |1) state.

[0141] Advantageously, the use of trapped ions for the implementation of qubits enabled longer coherence times compared to other implementations. As a further advantage, trapped ions may enable an all-to-al I coupling of qubits in the QPU 802, which could reduce the number of operations required to implement a quantum algorithm, resulting in an improved performance of said quantum algorithm.

[0142] In a further embodiment, qubits comprise neutral atoms, in particular neutral atoms trapped using optical lattices or optical tweezers. In said embodiment, the |0) and |1) states of a qubit may be the ground state and an excited state, or two different excited states of a neutral atom, for example two hyperfine states of a rubidium atom. Said atoms may further be excited to Rydberg states using laser pulses. The states of the qubit may be manipulated using laser light emitting a frequency tuned to the energy of the transition between the |0) and |1) state to implement quantum operations. Multi-qubit gates may further be implemented using Rydberg blockades, preventing other neutral atoms from being excited to the same Rydberg state. For example, a laser emitting a frequency of light tuned to the energy difference between the |0) and |1) states may implement single qubit rotation gates, wherein the length of the laser pulse corresponds to the angle of rotation. Said laser light may be applied to one or multiple qubits simultaneously to implement single or multi-qubit quantum operations. Measurements may be performed as an optical readout using fluorescence detection. For example, a stronger fluorescence signal may correspond to the |0) state and a weaker fluorescence signal may correspond to the |1) state.

[0143] Advantageously, the use of neutral atoms for the implementation of qubits enables longer coherence times, all-to-all connectivity, manipulation of qubits via standard techniques such as optical tweezers, and an operation at or near room temperature.

[0144] In a further embodiment, qubits comprise nitrogen-vacancy (NV) centers in a solid state system, in particular in diamond, comprising a nitrogen atom replacing a carbon atom in a diamond lattice and a vacancy adjacent to the nitrogen atom in the diamond lattice. In said embodiment, the |0) and |1) states may be states of the spin of a free electron located at the vacancy of the NV center. The states of the qubit may be manipulated using microwave and optical techniques to implement quantum operations. A measurement may be performed as an optical readout using fluorescence detection. For example, a stronger fluorescence signal may correspond to the |0) state and a weaker fluorescence signal may correspond to the |1) state.

[0145] Advantageously, the use of NV centers in diamond for the implementation of qubits enables optical addressability, comprising optical initialization, manipulation and readout of qubits, operation at room temperature and improved shielding of the qubit from environmental noise by the embedding of the qubit in the solid state lattice of diamond.

[0146] In a further embodiment, qubits comprise electronic states of semiconductor quantum dots, for example quantum dots in silicon. The quantum dots may confine electrons or electron holes, enabling charge or spin states of said electrons or electron holes to be used as qubits. For example using a spin state, the |0) and |1) states of a qubit may correspond to an electron spin being in an “up” or “down” state relative to a reference axis. For example using a charge state, the |0) and |1) states of a qubit may correspond to the presence or absence of an electron in a specific quantum dot or the electron being in one of two coupled quantum dots. The states of the qubit may be manipulated using for example oscillating magnetic and / or electric fields, using the coupling of spins in adjacent quantum dots and / or by using electrostatic interactions between charges in adjacent quantum dots. A measurement may be performed for example by techniques of spin-to-charge conversion and / or charge sensing.

[0147] Advantageously, the use of quantum dots for the implementation of qubits enables an improved scalability through the use of standard fabrication techniques for semiconductors, in particular silicon, and facilitating compatibility with other silicon-based technology.

[0148] In a further embodiment, qubits comprise photons. For example, the |0) and |1) states of a qubit may be defined based on photons having a horizontally or vertically orientated polarization relative to a reference axis. Alternatively, the states |0) and |1) may be defined based on photons having a different orientation of the polarization relativeto the reference axis, for example a diagonal and antidiagonal orientation. Alternatively, the |0) and |1) states may be defined via photons following distinct paths in space. As a further alternative, the |0) and |1) states may be defined via photons arriving at a destination, for example a sensor, at an early or late time point. The states of the qubit may be manipulated using optical elements to implement quantum operations, said optical elements comprising waveplates, beam splitters and / or phase shifters. Linear or non-linear optical processes may be used in a quantum computation using photons as qubits. A measurement may be performed for example by detection of a photon’s polarization using a polarizing beam splitter and / or waveplates. Alternatively, a measurement may be performed using interferometry techniques to infer the path of photons, for example using Mach-Zehnder interferometry. As a further alternative, a measurement may be performed using time-resolved detection of photons arriving at an early or late time point, for example using single-photon detectors having sufficiently high temporal resolution.

[0149] Advantageously, the use of photons for the implementation of qubits enables operation at room temperature, high speed of quantum computations, lower decoherence when carrying information across long distances and compatibility with standard optical technologies, in particular techniques for the creation of photonic circuits.

[0150] In a further embodiment, qubits comprise quasiparticles, in particular anyons, in two-dimensional materials. Said materials exemplarily comprise topological superconductors, semiconductor nanowires and / or strongly correlated materials. For example, the qubits may be implemented using a system of Majorana fermions, wherein pairs of Majorana fermions may fuse to form either a vacuum state representing |0) or a fermion state representing |1). The states of the qubit may be manipulated by exchanging and / or braiding of anyons to implement quantum operations. A measurement may be performed for example by a fusion measurement, determining whether a pair of fermions fuses to the vacuum state or the fermion state. A fusion measurement may be performed using interferometry techniques or via the use of ancillary qubits.

[0151] Advantageously, the use of anyons for the implementation of qubits enables intrinsic fault tolerance and error resilience via topological protection of qubit states.

[0152] It is understood that the invention described in the present subject matter may be implemented using a quantum processing unit (QPU) 802 using an alternative quantum system for the implementation of qubits that differs from the implementations listed here,for example if such an alternative quantum system provides advantages such as improved resistance to noise, longer coherence times, lower gate error rates, lower measurement error rates, a larger number of qubits, and / or advantages in the setup of the hardware of the quantum processing unit 802, e.g. relating to required cooling of at least parts of the quantum system and its associated hardware, e.g. sensors, or the creation of a vacuum.

[0153] It is further understood that instead of or in addition to qubits, the quantum system used in the quantum processing unit 802 may comprise a use of additional basis states beyond |0) and 11>, i.e. the quantum system may comprise “qudits” wherein each qudit comprises a number of d basis states, with d > 2. For example, a qudit with d = 3, also called a qutrit, may take on superpositions of three basis states, exemplarily denoted as |0), |1) and 12>, thereby advantageously increasing the dimension of the Hilbert space of the quantum system.

[0154] While the invention has been illustrated and described in detail in the drawings and foregoing description, such illustration and description are to be considered illustrative or exemplary and not restrictive; the invention is not limited to the disclosed examples.REFERENCE SIGNS LIST100 Method for the evaluation of data metrics102, 112 Original dataset, encrypted original dataset104, 114 Synthetic replicate, encrypted synthetic replicate106 Data synthesis model / algorithm108 Homomorphic encryption scheme110 Encryption in accordance with homomorphic encryption scheme116 (Encrypted / Decrypted) measure of (homomorphic) data metric118 Evaluation of data synthesis model / algorithm120 Data metric121 Homomorphic data metric200 Server202 Computer device204 User206 Private key208, 308 Providing encrypted dataset(s) to server210, 310 Generating synthetic replicate212, 312 Providing encrypted value214, 314 Decryption of encrypted value400, 500 Data complexity functions402, 502 Data complexity values404, 504 (Complexity) Thresholds406, 506 Providing dataset(s)408, 508 Evaluating data complexity function410, 510 Receiving data complexity value412, 512 Comparison to threshold414 Generating synthetic replicate600 Access-controlled site602 Access-control device702 Computer system703 Processors705 Memory unit707 Bus709 Network adapter711 Storage system713 External devices719 I / O interface800 Data structure 802 Quantum computing device804 Quantum cloud service provider

Claims

CLAIMS1 . A method (100) for evaluating a data metric (120) on homomorphically encrypted data, the method comprising:Providing at least two datasets (102, 104);Encrypting of the at least two datasets (102, 104), resulting in at least two encrypted datasets (112, 114) in an encrypted domain, wherein the encryption is performed in accordance with a homomorphic encryption scheme (108);Transforming the data metric (120) into the encrypted domain, resulting in a homomorphic data metric (121);Evaluating the homomorphic data metric (121) on the encrypted datasets (112,114) in the encrypted domain;Obtaining at least one encrypted measure (116) of the homomorphic data metric (121).

2. The method (100) according to claim 1 , wherein the encrypted datasets (112, 114) are provided to a server (200) from a computer device (202) of a user (204).

3. The method (100) according to any of the preceding claims, wherein the encrypted datasets (112, 114) are encrypted by the user (204) from the datasets (102, 104) by application of a public-key asymmetric encryption algorithm in accordance with the homomorphic encryption scheme (108).

4. The method (100) according to any of the preceding claims, wherein the evaluating of the homomorphic data metric (121) and the obtaining of the at least one encrypted measure (116) of the homomorphic data metric (121) is performed on the server (200) using the encrypted datasets (112,114) as input.

5. The method (100) according to any of the preceding claims, wherein the server (200) provides the encrypted measure (116) of the homomorphic data metric (121) to the user (204), followed by decryption of the encrypted measure by the user using aprivate key (206) stored on the computer device (202) of the user.

6. The method (100) according to any of the preceding claims, wherein at least one of the datasets (102) is an original dataset, comprising real-world data, in particular personal data, and in particular wherein said personal data is provided as tabular data.

7. The method (100) according to any of the preceding claims, wherein at least one of the datasets (104) comprises a synthetic replicate, the synthetic replicate (104) being a dataset comprising synthesized data generated using a data synthesis algorithm (106), wherein the data synthesis algorithm used the original dataset (102) as input.

8. The method (100) according to any of the preceding claims, wherein the encrypted synthetic replicate (114) on the server (200), using the encrypted original dataset (112) as input.

9. The method (100) according to any of the preceding claims, wherein the measure (116) of the homomorphic data metric (121) evaluated on the original dataset (102, 112) and the synthetic replicate (104, 114) is used to evaluate (118) the data synthesis algorithm (106), wherein said evaluating (118) comprises an evaluation of the quality, accuracy, utility and / or privacy of the synthetic replicate compared to the original dataset.

10. The method (100) according to any of the preceding claims, wherein the homomorphic data metric (121) comprises one or more of the following: a check for the coverage of a set or interval of values of the data metric; a check for the keeping of boundaries or interval limits of the data metric; a measure of distances or similarities between variables in the datasets given as input to the data metric, in particular the Gower distance, Manhattan distance, Euclidean distance, and / or nearest neighbor distance ratios (NNDRs); a measure of correlation and / or association between variables in the datasets given as input to the data metric, in particular the covariance,Kullback-Leibler divergence, Pearson correlation coefficient, and / or Spearman’s rank correlation coefficient, and / or an evaluation of statistical tests, in particular using measures of R- Squared values, Chi-Squared or modified Chi-Squared coefficient, and / or Cramers V.

11. The method (100) according to any of the preceding claims, wherein the data synthesis model / algorithm (106) is updated or modified based on the obtained measure (116) of the homomorphic data metric (121).

12. The method (100) according to any of the preceding claims, wherein a first data complexity function (400) is evaluated (408), resulting in a first data complexity value (402), said first data complexity value (402) being compared (412) to a first threshold (404) to determine whether the generation of the synthetic replicate (104,114) from the original dataset (102,112) using the data synthesis algorithm (106) is to be performed on the computer device (202) of the user (204) using the original dataset (102) as input, or on the server (200) as the encrypted synthetic replicate (114) using the encrypted original dataset (112) as input.

13. The method (100) according to any of the preceding claims, wherein a second data complexity function (500) is evaluated (508), resulting in a second data complexity value (502), said second data complexity value (502) being compared (512) to a second threshold (504) to determine whether the evaluation of the data metric (120) is to be performed on the computer device (202) of the user (204) using the original dataset (102) and the synthetic replicate (104) as input, or on the server (200) as the homomorphic data metric (121) using the encrypted original dataset (112) and the encrypted synthetic replicate (114) as input.

14. The method (100) according to any of the preceding claims, wherein the computer device (202) of the user (204) is located at an access-controlled site (600), wherein access is granted to the user (204) via an access-control device (602).

15. The method (100) according to any of the preceding claims, wherein at least a part of the method (100), in particular the encrypting of the at least two datasets (102, 104) and / or the evaluating the homomorphic data metric (121), is performed by a specialized classical hardware and / or a quantum computing device (802),wherein the specialized classical hardware preferably comprises a GPU, an FPGA and / or an ASIC, and wherein the quantum computing device (802) preferably comprises a quantum annealer or a universal gate based quantum computer, in particular a photonic chip.

16. A computer system (702) for evaluating a data metric (120) on homomorphically encrypted data in accordance with a homomorphic encryption scheme (108), wherein the computer system is configured to execute the method (100) according to any of the preceding claims.

17. The computer system (702) according to claim 16, wherein any one of the following applies:- the computer system (702) is communicatively coupled to the specialized classical hardware, wherein the computer system (702) optionally comprises the specialized classical hardware; and / or- the computer system (702) is communicatively coupled to the quantum computing device (802), wherein the computer system (702) optionally comprises the quantum computing device (802).

18. A computer program product for evaluating a data metric (120) on homomorphically encrypted data in accordance with a homomorphic encryption scheme (108), wherein the computer program product comprises one or more computer readable storage media, on which program instructions are embodied, wherein the program instructions are executable by one or more processors (703) of the computer system (702), said program instructions causing the one or more processors to execute operations according to the method (100) according to any of the preceding claims, wherein said program instructions preferably further cause the specialized classical hardware and / or the quantum computing device (802) to execute operations according to the method (100) according to any of the preceding claims.

19. A data structure (800) stored on a computer system (702) comprising at least two datasets (112,114) in the encrypted domain, wherein the encrypted domain is provided by a homomorphic encryption scheme (108).

20. The data structure (800) according to claim 19, further comprising a homomorphic data metric (121) and / or an encrypted measure (116) of the homomorphic data metric (121).

Images