functionality to be simple and self-contained. While we provide a proof that
our protocol realizes this ideal functionality in Appendix I, here we focus
mainly on explaining what security properties the ideal functionality
expresses. First, notice that while we allow any clients to submit secret
inputs, a separate “Auditor” party is responsible for choosing the arbitrary
application circuits and is the only party that receives the output. This is
just for simplicity, but in a real system we envision using some public
process (like a smart contract) to choose it. All our protocol requires is
that the MPC servers and auditors agree on which circuit was chosen. Also in
our protocol the audit routine is public coin, so anyone could could re-run
the auditing subroutine for themselves.

$\mathcal{F}_{\mathsf{AuditableMPC}}$ (01) On init:
$\mathsf{inputs}\leftarrow[\ ]$, $\mathsf{new}\leftarrow[\ ]$ (02) On input
$x_{i}$ from data-client $C_{i}$: (03) Append $x_{i}$ to $\mathsf{new}$ (04)
Send $C_{i}$ to $\mathcal{A}$ (05) On input circuit $\mathbf{F}$ from Auditor:
(06) If $f\leq t$: (07) Append $\mathsf{new}$ to $\mathsf{inputs}$ and set
$\mathsf{new}\leftarrow[\ ]$ (08) Compute
$o\leftarrow\mathbf{F}(\mathsf{inputs})$ (09) $\mathsf{Optionally}$: Send
$(\mathbf{F},o)$ to Auditor (10) Send $(\mathbf{F},o)$ to $\mathcal{A}$ (11)
Else: (12) $\mathsf{Optionally}$: (13) Append $\mathsf{new}$ to
$\mathsf{inputs}$ (14) Compute $o\leftarrow\mathbf{F}(\mathsf{inputs})$ (15)
$\mathsf{Optionally}$: Send $(\mathbf{F},o)$ to Auditor (16) Send
$(\mathbf{F},\mathsf{new})$ to $\mathcal{A}$ and set $\mathsf{new}\leftarrow[\
]$ (17) Send $\mathbf{F}$ to $\mathcal{A}$

Figure 8: UC ideal functionality for Auditable MPC

Integrity of outputs is required in both the $f\leq t$ and $f>t$ settings
since the only outputs (lines 8 and 14) are from applying the given circuit
$\mathbf{F}$ to the provided inputs. Confidentiality of inputs is required in
the $f\leq t$ setting, since the only information leaked to the adversary is
the identity of data-clients (line 4) and the final output of the function
(line 10). In an auction application, this corresponds to corrupt servers not
learning bids placed by data-clients within the round. If $f>t$ then new
inputs are leaked to the adversary in line 16. Our definition only considers
public outputs for simplicity, though the construction can be extended to
support private outputs to designated parties as well.

Our ideal functionality implies a subtle security guarantee: input
independence. Notice that even in the $f>t$ case, the inputs of honest parties
are leaked only _after_ the output is computed. In other words, corrupted
parties must commit to and have knowledge of the inputs they provide, even
before they learn anything about what honest parties input. In the context of
our auction application, each time the auction update function is computed
(one round of the auction), all of the bids collected during this bound must
be independent of each other. Put another way, seeing commitments to honest
bids does not help corrupt parties create related bids in the same round, and
this holds regardless of the number of corruptions. Note however that this no
longer holds across rounds. In the $f>t$ case, corrupt servers in later rounds
of MPC can know the inputs of data-clients from earlier rounds and choose
their inputs based on those past inputs. Consider the same auction example as
before, where bidding servers maintain a state of the top $k$ bids. In every
MPC round, a new party submits new bids and servers update the state to
reflect the current top $k$ bids. When all servers are corrupted, data-clients
can collude the servers to learn the top bids and bid accordingly. The use of
$\mathsf{optionally}$ in our functionality (lines 9,12,15) express that our
functionality does not guarantee availability. The adversary may prevent
output from being provided, but if output is delivered it is guaranteed to be
correct.

##  Appendix I UC Proof Sketch

The universal composability framework [35] is based on the real/ideal-world
paradigm. In this setting, the real world consists of interactions between the
environment $\mathcal{Z}$, real-world adversary $\mathcal{A}$, and parties
$P_{1},\dots,P_{n}$ running a protocol $\pi$. The ideal world consists of
interactions between the environment $\mathcal{Z}$, the ideal-world adversary
(or simulator) $\mathcal{S}$, dummy parties
$\mathcal{D}_{1},\dots,\mathcal{D}_{n}$, and an ideal functionality
$\mathcal{F}$.

Security in this framework is defined by having $\mathcal{Z}$ output a bit
after interacting in the real or ideal worlds. If a simulator can be defined
so that, for every possible $\mathcal{Z}$, the distribution on this output bit
in the real world is indistinguishable from that in the ideal world, it
follows that the the real and ideal worlds are indistinguishable. This is
usually stating as saying that a protocol $\pi$ UC-realizes a functionality
$\mathcal{F}$.

More formally, let
$\mathsf{EXEC_{IDEAL}^{\mathcal{F},\mathcal{S},\mathcal{Z}}(z,\vec{r})}$ be
the output of $\mathcal{Z}$ in the ideal world, after interacting with the
simulator $\mathcal{S}$ and the dummy parties
$\mathcal{D}_{1},\dots,\mathcal{D}_{n}$ (where dummy parties act as
passthrough parties between $\mathcal{Z}$ and $\mathcal{F}$). $\mathsf{z}$
here is the input $\mathcal{Z}$ is initialized with and $\mathsf{\vec{r}}$ is
the set consisting of $\mathcal{Z}$, $\mathcal{S}$, and $\mathcal{F}$’s random
tapes. We define
$\mathsf{EXEC_{IDEAL}^{\mathcal{F},\mathcal{S},\mathcal{Z}}(z)}$ to be the
random variable after choosing $\mathsf{\vec{r}}$ uniformly at random.

We define
$\mathsf{EXEC}_{\mathsf{REAL}}^{\pi,\mathsf{\mathcal{A},\mathcal{Z}}}(\mathsf{\vec{r}})$
in a similar manner in the real world, except now considering the execution
consisting of the real-world adversary $\mathcal{A}$ and parties
$P_{1},\dots,P_{n}$ running a protocol $\pi$.

A protocol $\pi$ is said to UC-realize a functionality $\mathcal{F}$ if, for
all adversaries $\mathcal{A}$, there exists a simulator $\mathcal{S}$, such
that for all environments $\mathcal{Z}$, {EXEC_REAL^π, A, Z(→r)}_z ∈{0, 1}^*
≡c {EXEC_IDEAL^F, S, Z(z, →r)}_z ∈{0, 1}^*

One thing to note is that the every real-world adversary $\mathcal{A}$ can be
split into two parts: (1) a logical adversary, which performs the actual
computations and so on, and (2) a dummy adversary, which simply receives
messages computed by the logical component and routes them to where it is
instructed to send messages. As the UC security definition quantifies over all
environments, Canetti [35] recognized that it is often simpler to work with
the dummy adversary and proved the equivalence with the above definition.
Accordingly, we will work with the following, simpler definition:

A protocol $\pi$ is said to UC-realize a functionality $\mathcal{F}$ if there
exists a simulator $\mathcal{S}$, such that for all environments $\mathcal{Z}$
and the dummy adversary $\mathcal{D}$, {EXEC_REAL^π, D, Z(→r)}_z ∈{0, 1}^* ≡c
{EXEC_IDEAL^F, S, Z(z, →r)}_z ∈{0, 1}^*

We now note that our protocol is based in the algebraic group model. To our
knowledge, the interaction between the universal composability (UC) framework
and the algebraic group model has not previously been explored. We leave in-
depth exploration of this relationship to future work. In this work, however,
we recognize that we only consider algebraic adversaries and note that this
corresponds to the logical component of real-world adversaries. As the UC-
security definition in terms of the dummy adversary depends on ”moving” the
logical component of the adversary to the environment, we note that we
therefore only quantify over ”algebraic environments.” That is, we only
consider environments that provide a representation for group elements in
their messages to the dummy adversary or simulator.

We now show that the protocol $\Pi_{\mathsf{AuditableMPC}}$ (Figure 12) UC-
realizes the functionality $\mathcal{F}_{\mathsf{AuditableMPC}}$ (Figure 8).
We show the indistinguishability between the real and ideal worlds by
performing an exhaustive case analysis on the messages sent by $\mathcal{Z}$
in both worlds, and considering the resulting transcript. We consider the
$f\leq t$ and $f>t$ cases separately.

Case 1: $\mathbf{f\leq t}$:

We argue that the simulator defined in Figure 14 causes indistinguishability
between the real and ideal worlds when $f\leq t$. We show that the internal
simulation always tracks what occurs in the real world and additionally, the
messages that $\mathcal{Z}$ receives in both worlds are indistinguishable.

First, consider the messages that $\mathcal{Z}$ can send to honest parties:

  * •

$\mathcal{Z}$ provides an input $x_{i}$ to an honest data-client $C_{i}$:

Real World: By lines 2-6 of Figure 12, $C_{i}$ creates a commitment to $x_{i}$
and sends this to $\mathcal{F}_{\mathsf{BulletinBoard}}$.

Ideal World: The dummy $C_{i}$ in the ideal world forwards $x_{i}$ to
$\mathcal{F}_{\mathsf{AuditableMPC}}$. By line 4 of Figure 8,
$\mathcal{F}_{\mathsf{AuditableMPC}}$ sends the message $C_{i}$ to
$\mathcal{S}$. By lines 6-8 of Figure 14, $\mathcal{S}$ simulates an internal
input of $0$ by $C_{i}$ and all state transitions.

In both cases, $\mathcal{Z}$ is activated with no incoming messages and
$\mathcal{Z}$ will not be able to distinguish on its activation. Additionally,
the internal simulation will be at the same point of the execution as the real
world.

Next, we consider the messages $\mathcal{Z}$ sends to the auditor:

  * •

$\mathcal{Z}$ provides a circuit $\mathbf{F}$ to the auditor:

Real World: One of two things can happen here. Either (1) the auditor stores
$\mathbf{F}$ or (2) the auditor forwards $\mathbf{F}$ to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$.

In the case of (1), nothing happens in the real world.

In the case of (2), by line 16 of Figure 12,
$\mathcal{F}_{\mathsf{ReactiveMPC}}$ schedules an optional codeblock to send
$\mathbf{F}$ to each $C_{i}$.

Ideal World: By line 10 of Figure 8, $\mathcal{F}_{\mathsf{AuditableMPC}}$
forwards $(\mathbf{F},o)$ to $\mathcal{S}$. By lines 20-21 of Figure 14,
$\mathcal{S}$ emulates the same actions as in the real world internally. Since
the simulated execution is at the same point as the real world execution, this
means that the internal emulation does (1) and (2) exactly as above.

In both worlds, $\mathcal{Z}$ is activated with no incoming message.
Additionally, the internal simulation of the real world matches the actual
real world after this step.

In order to explain lines 10-19 of Figure 14, we note that, in line 34 of
Figure 12, $\Pi_{\mathsf{Auditable}}$ runs a prover algorithm for an auditable
zk-SNARK. As proven in Theorem 5.1, this prover algorithm is for an auditable
zk-SNARK as defined in Section 5.1. As it satisfies this definition, there is
a simulator $\mathcal{S}_{\mathsf{zk-SNARK}}$ for the zero-knowledge property.
The adaptive zk-SNARK zero-knowledge definition makes
$\mathcal{S}_{\mathsf{zk-SNARK}}$ sufficient for $\mathcal{S}$ to run
internally: the adversary in the definition chooses strictly more parameters
than $\mathcal{Z}$ does in our setting. Additionally, as the definition
quantifies over all adversaries, it quantifies over adversaries that run the
prover algorithm themselves, for any set of parameters, a polynomial number of
times, which is exactly what $\mathcal{Z}$ can do. This means that a simulated
transcript and proof generated by $\mathcal{S}_{\mathsf{zk-SNARK}}$ will be
indistinguishable from an actual transcript and proof, from the perspective of
$\mathcal{Z}$.

On input $\mathbf{F}$, using lines 10-19 of Figure 14, $\mathcal{S}$ generates
a simulated copy of the Marlin transcript and proof using
$\mathcal{S}_{\mathsf{zk-SNARK}}$. $\mathcal{S}$ also generates random honest
shares of each polycommit in the transcript and random honest shares of the
proof, consistent with the views of corrupt parties. These shares are used in
lines 40-43 of Figure 14, when they are sent to $\mathcal{Z}$. This is okay
for the following reason: $\mathcal{Z}$ only knows enough information to
reconstruct up to $f$ shares of corrupt parties - however, as $f\leq t$,
$\mathcal{Z}$ does not learn enough shares to constrain honest shares of
polycommits. We note that $\mathcal{Z}$ (unlike $\mathcal{S}$) knows inputs of
honest parties in the protocol - however, as $\mathcal{Z}$ doesn’t know the
trapdoor or randomness used for polycommits, it does not learn enough
information to verify the honest shares of polycommits created by
$\mathcal{S}$. This means that the simulated honest shares will be
indistinguishable from actual honest shares.

Finally, we analyze the messages that $\mathcal{Z}$ can send the adversary.

  * •

$\mathcal{Z}$ instructs $\mathcal{D}$ to send a message to
$\mathcal{F}_{\mathsf{RO}}$, $\mathcal{F}_{\mathsf{Setup}}$, or corrupt
$P_{i}$:

Real World: $\mathcal{D}$ forwards the message and forwards any incoming
message to $\mathcal{Z}$.

Ideal World: In lines 30-35 of Figure 14, $\mathcal{S}$ forwards the message
to the internal emulation and forwards any generated message to $\mathcal{Z}$.
$\mathcal{F}_{\mathsf{RO}}$ and $\mathcal{F}_{\mathsf{Setup}}$ will be
computationally indistinguishable in both worlds, so any queries will have
indistinguishable responses. Additionally, $\mathcal{Z}$ can also instruct a
corrupt $P_{i}$ to send a message to $\mathcal{F}_{\mathsf{BulletinBoard}}$,
but this will happen identically in both worlds. Thus, $\mathcal{Z}$ will not
be able to distinguish based on these inputs.

  * •

$\mathcal{Z}$ instructs $\mathcal{D}$ to send message to a corrupt data-client
$C_{i}$:

Real World: $\mathcal{D}$ forwards the message to $C_{i}$ and forwards any
incoming message to $\mathcal{Z}$

Ideal World: By lines 24-29 of Figure 14, if this is related to $C_{i}$
sending an input to $\mathcal{F}_{\mathsf{ReactiveMPC}}$, $\mathcal{S}$
instructs the dummy corrupt data-client $C_{i}$ to forward the same input to
$\mathcal{F}_{\mathsf{AuditableMPC}}$. The reason for this is this is the
mechanism by which corrupt inputs are created in the real world; they must be
created in the ideal world as well. The thing to note is that $\mathcal{A}$
cannot modify an input after it sends $\phi_{x_{i}}$ to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$ \- this means any computation will happen
on this input in the real world, and the computation in the ideal world should
also happen on this input. $\mathcal{S}$ then forwards the message to the
internal simulation and forwards any generated message to $\mathcal{Z}$ \- as
the emulation and actual real worlds were indistinguishable before this point,
the output message will be indistinguishable in both worlds.

  * •

$\mathcal{Z}$ instructs $\mathcal{D}$ to send a message to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$:

We consider two separate cases here: (1) message related to triggering the
optionally on line 16 of $\mathcal{F}_{\mathsf{ReactiveMPC}}$ in Figure 13 and
(2) all other messages.

In the first case:

Real World: $\mathcal{D}$ instructs $\mathcal{F}_{\mathsf{ReactiveMPC}}$ to
deliver $\mathbf{F}$ to a data-client $C_{i}$.

If $C_{i}$ is honest, by lines 7-12 of Figure 12, $C_{i}$ sends inputs (that
previously committed to in line 5) to $\mathcal{F}_{\mathsf{AuditableMPC}}$.
By line 6, if this results in all the inputs to $\mathbf{F}$ being sent to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$, the $\mathsf{compute}$ subroutine is run
and, by line 29 of Figure 13,
$(\mathbf{F},o,\mathsf{inputs^{\prime}},\mathsf{wires^{\prime}},\mathsf{round})$
to $\mathcal{A}$ is sent to $\mathcal{D}$. Else, if it doesn’t result in all
inputs being sent, by line 7 of Figure 13,
$\mathcal{F}_{\mathsf{ReactiveMPC}}$ sends $C_{i}$ to $\mathcal{D}$.

Else, if $C_{i}$ is corrupt, $\mathcal{F}_{\mathsf{ReactiveMPC}}$ sends
$\mathbf{F}$ to $C_{i}$, which is forwarded to $\mathcal{D}$. In each of these
cases, the message to $\mathcal{D}$ is forwarded to $\mathcal{Z}$.

Ideal World: By lines 33-35 of Figure 14, $\mathcal{S}$ executes its internal
simulation of the real world and generates the same types of messages as
above. Except for messages of type
$(\mathbf{F},o,\mathsf{inputs^{\prime}},\mathsf{wires^{\prime}},\mathsf{round})$,
these will be the same in both worlds. In the case of
$(\mathbf{F},o,\mathsf{inputs^{\prime}},\mathsf{wires^{\prime}},\mathsf{round})$
being forwarded to $\mathcal{A}$, we note that only $f\leq t$ shares of each
input are given to $\mathcal{Z}$. This means that, although honest inputs were
simulated as inputs of $0$, this is okay as $t+1$ shares are required to
define a $t$-degree polynomial. From the perspective of $\mathcal{Z}$, shares
in $\mathsf{inputs^{\prime}}$ for actual inputs in the real world and
simulated inputs from the emulated real world are therefore indistinguishable.

In the second case:

Real World: $\mathcal{D}$ forwards the message to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$. One of two things might happen: (1) a
dummy corrupt party forwards a copy of the output and shares from line 26 of
Figure 13 or (2) the auditor produces output. These would, in each case, be
forwarded to $\mathcal{Z}$.

Ideal World: By lines 33-35 of Figure 14, $\mathcal{S}$ forwards the message
to the internal emulation. As a copy of the real world is run internally, one
of two things can happen here: the simulated $\mathcal{D}$ forwards a copy of
the output and shares from line 26 of Figure 13 to $\mathcal{S}$ or the
auditor produces output (line 48-55 of Figure 12). We maintain
indistinguishability in either situation:

(1) In line 35 of Figure 14, $\mathcal{S}$ forwards copies of the simulated
shares and output to $\mathcal{Z}$. As argued in the first case, these
simulated shares are indistinguishable from actual honest shares.

(2) By lines 45-47 of Figure 14, $\mathcal{S}$ instructs
$\mathcal{F}_{\mathsf{AuditableMPC}}$ to deliver the output to the auditor,
which then forwards it to $\mathcal{Z}$. As
$\mathcal{F}_{\mathsf{ReactiveMPC}}$ and $\mathcal{F}_{\mathsf{AuditableMPC}}$
generate outputs by evaluating the same function, and the inputs in both
worlds are the same, the output will be the same in both worlds. As these
outputs by the auditors in both worlds will be the same, we have that
$\mathcal{Z}$ cannot distinguish in this case. We note that the outputs in
both worlds being identical demonstrates the correctness of this protocol.

* •

$\mathcal{Z}$ instructs $\mathcal{D}$ to send a message to
$\mathcal{F}_{\mathsf{BulletinBoard}}$:

Real World: $\mathcal{D}$ forwards the message to
$\mathcal{F}_{\mathsf{BulletinBoard}}$. One of two things can happen: (1) a
dummy corrupt party forwards a copy of the bulletin board to $\mathcal{D}$ (by
line 7 of Figure 11) or (2) the auditor produces output (per lines 48-55 of
Figure 12). These would, in each case, be forwarded to $\mathcal{Z}$.

Ideal World: By lines 36-44 of Figure 14, $\mathcal{S}$ forwards the message
to the internal emulation. As a copy of the real world is run internally, one
of two things can happen here: the simulated $\mathcal{D}$ forwards a copy of
the bulletin board to $\mathcal{S}$ (by line 7 of the simulated
$\mathcal{F}_{\mathsf{BulletinBoard}}$ in Figure 11) or the auditor produces
output (lines 48-55 of the simulated $\Pi_{\mathsf{AuditableMPC}}$ in Figure
8). We maintain indistinguishability in either case.

(1) In lines 40-43 of Figure 14, shares of the Marlin transcript and proof in
the bulletin board are replaced with the versions from lines 15-18 of
$\mathcal{S}$ in Figure 14. As argued previously, these shares are
indistinguishable in both worlds. We note that the indistinguishability here
corresponds to the zero-knowledge property of this protocol.

(2) By lines 45-47 of Figure 14, $\mathcal{S}$ instructs
$\mathcal{F}_{\mathsf{AuditableMPC}}$ to deliver the output to the auditor,
which then forwards it to $\mathcal{Z}$. As
$\mathcal{F}_{\mathsf{ReactiveMPC}}$ and $\mathcal{F}_{\mathsf{AuditableMPC}}$
generate outputs by evaluating the same function, and the inputs in both
worlds are the same, the output will be the same in both worlds. Similar to
before, this demonstrates the correctness of this protocol.

As indistinguishability is maintained despite any messages sent by
$\mathcal{Z}$, $\mathcal{S}$ as defined in Figure 14 causes
$\Pi_{\mathsf{AuditableMPC}}$ to UC-realize
$\mathcal{F}_{\mathsf{AuditableMPC}}$ when $f\leq t$.

Case 2: $\mathbf{f>t}$:

We argue that $\mathcal{S}$, as defined in Figure 15, creates
indistinguishability between the real and ideal worlds. We show that the
internal simulation always tracks what occurs in the real world and
additionally, the messages that $\mathcal{Z}$ is activated with in both worlds
are indistinguishable.

In this setting, zero-knowledge is no longer a concern, as MPC does not
guarantee confidentiality when $f>t$. Instead, since when $f>t$, corrupt
inputs in line 3 of $\mathcal{F}_{\mathsf{ReactiveMPC}}$ (Figure 13) can be
different from those sent to parties in line 34, $\mathcal{S}$ must extract
corrupt inputs from corrupt commitments to send to
$\mathcal{F}_{\mathsf{AuditableMPC}}$. Additionally, per the ideal
functionality, input independence still holds in this setting and our proof
must demonstrate that.

Similar to the $f\leq t$ case, we analyze each possible input by
$\mathcal{Z}$.

First, consider the messages that $\mathcal{Z}$ can send to honest parties:

  * •

$\mathcal{Z}$ provides an input $x_{i}$ to an honest data-client $C_{i}$:

Real World: By lines 2-6 of Figure-12, $C_{i}$ creates a commitment to $x_{i}$
and sends this to the bulletin board $\mathcal{F}_{\mathsf{BulletinBoard}}$.

Ideal World: The dummy $C_{i}$ in the ideal world forwards $x_{i}$ to
$\mathcal{F}_{\mathsf{AuditableMPC}}$. By line 4 of Figure 8,
$\mathcal{F}_{\mathsf{AuditableMPC}}$ sends $C_{i}$ to $\mathcal{S}$. By lines
6-8 of Figure 15, $\mathcal{S}$ simulates an internal input of $0$ by $C_{i}$
and all state transitions.

In both cases, $\mathcal{Z}$ is activated with no incoming messages and
$\mathcal{Z}$ will not be able to distinguish on its activation. Additionally,
the internal simulation will be at the same point of the execution as the real
world.

Next, consider the messages that $\mathcal{Z}$ can send the auditor.

  * •

$\mathcal{Z}$ provides a circuit $\mathbf{F}$ to the auditor:

Real World: One of two things can happen here. Either (1) the auditor stores
$\mathbf{F}$ or (2) the auditor forwards $\mathbf{F}$ to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$.

In the case of (1), nothing happens in the real world.

In the case of (2), by line 16 of Figure 12,
$\mathcal{F}_{\mathsf{ReactiveMPC}}$ schedules an optional codeblock to send
$\mathbf{F}$ to each $C_{i}$.

Ideal World: The auditor sends $\mathbf{F}$ to
$\mathcal{F}_{\mathsf{AuditableMPC}}$. By line 17 of Figure 8,
$\mathcal{F}_{\mathsf{AuditableMPC}}$ sends $\mathbf{F}$ to $\mathcal{S}$. By
lines 9-10 of Figure 15, $\mathcal{S}$ emulates the same actions as in the
real world internally. Since the simulated execution is at the same point as
the real world execution, this means that the internal emulation does (1) and
(2) exactly as above. In the case of (2), the simulator additionally runs
lines 27-41 of Figure 15. What this does is perform an extraction of corrupt
inputs. Note that, as the auditor is unable to be corrupted, we have that the
auditor only causes an output whenever the zk-SNARK verifies, per lines 52-54
of $\Pi_{\mathsf{AuditableMPC}}$ (Figure 12). If we consider the
extractability definition of zk-SNARKs in Section 5.1, we can see that
$\mathcal{Z}$ satisfies the conditions for $\mathcal{A}$ in the definition.
This means that, even though we consider the UC setting, we can apply Theorem
5.1 in this situation for the result that our zk-SNARK scheme is extractable.
But as a result of this scheme being extractable, we know that the
verification algorithm will pass only with negligible probability if input
commitments are not to the inputs on which computation is performed. That
means that, as $\mathcal{Z}$ is algebraic, we can use the representation
provided by $\mathcal{Z}$ for corrupt commitments to extract inputs (by the
binding property of commitments, this is the only representation that
$\mathcal{Z}$, except with negligible probability).

This extraction is exactly what lines 28-39 of Figure 15 do; lines 40-41 then
send these inputs to $\mathcal{F}_{\mathsf{AuditableMPC}}$, thereby providing
corrupt inputs for this round of execution. $\mathcal{S}$ also executes the
$\mathsf{optionally}$ statement on line 12 of Figure 8, which results in all
honest inputs being leaked to $\mathcal{S}$ in line 16. Once honest inputs are
leaked, $\mathcal{S}$ modifies its internal emulation in lines 11-18 of Figure
15 to make it consistent with these inputs - as lines 13 and 16 modify
polynomials that have not been sent to $\mathcal{Z}$ and line 14-15 use
knowledge of the trapdoor to open commitments to new values, $\mathcal{S}$ is
able to ensure that its internal execution is the same as the actual real
world execution.

At this point, the output to $\mathcal{Z}$ will be the same in both worlds,
and the internal emulation will be at the same point as (or in case (2),
identical to) the execution in the real world, maintaining
indistinguishability.

Finally, we analyze the different inputs from $\mathcal{Z}$ to the adversary.

  * •

$\mathcal{Z}$ instructs $\mathcal{D}$ to send message to
$\mathcal{F}_{\mathsf{RO}}$, $\mathcal{F}_{\mathsf{Setup}}$,
$\mathcal{F}_{\mathsf{ReactiveMPC}}$, $\mathcal{F}_{\mathsf{BulletinBoard}}$,
or corrupt $P_{i}$/$C_{i}$:

Real World: $\mathcal{D}$ forwards the message. There are 3 possibilities at
this point: either (1) the auditor forwards $\mathbf{F}$ to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$, (2) the auditor generates an output, or
(3) $\mathcal{D}$ receives some miscellaneous message.

Ideal World: In lines 19-26 of Figure 15, $\mathcal{S}$ forwards the message
to its internal emulation. We consider each possibility described above in
turn:

(1) If the auditor forwards $\mathbf{F}$ to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$ in the real world, this will have been
because $\mathcal{Z}$ instructed $\mathcal{D}$ to deliver a copy of the
bulletin board to the auditor. By lines 41-42 and 45-47 of Figure 12, the real
world auditor will have received all commitments for inputs. This will also
occur in the simulated real world and line 27 of Figure 15 will be triggered.
Note that, in the ideal world, the auditor will already have sent
$\mathcal{F}_{\mathsf{AuditableMPC}}$ the circuit $\mathbf{F}$. Despite this,
we note that at this point, the same situation as described in case (2) of
$\mathcal{Z}$ providing the auditor the circuit will happen at this point.
$\mathcal{S}$ extracts and provides inputs to
$\mathcal{F}_{\mathsf{AuditableMPC}}$ via lines 27-41 of Figure 15 in the same
manner, and security still holds for the same reasons.

(2) If the auditor generates an output in the real world, this will be because
the verify function on line 52 of Figure 12 passes. As argued previously, the
extractability of the zk-SNARK scheme implies that this only passes if the
inputs and output are actually as it should be. By lines 42-44 of Figure 15,
$\mathcal{S}$ instructs $\mathcal{F}_{\mathsf{AuditableMPC}}$ to send this
same output to the ideal world auditor, which will then forward it to
$\mathcal{Z}$. As the outputs in the real and ideal worlds match,
indistinguishability follows.

(3) Finally, consider the case that $\mathcal{D}$ outputs any other message in
the real world. There will be two types of messages: (a) those sent before the
auditor sends $\mathbf{F}$ to $\mathcal{F}_{\mathsf{ReactiveMPC}}$ and (b)
those sent after.

In the case of (a), note that the only messages that $\mathcal{Z}$ can send
$\mathcal{D}$ will be to either query $\mathcal{F}_{\mathsf{RO}}$ and
$\mathcal{F}_{\mathsf{Setup}}$, instructing appending/delivery of the bulletin
board in $\mathcal{F}_{\mathsf{BulletinBoard}}$, instructing corrupt parties
to send a message to $\mathcal{F}_{\mathsf{BulletinBoard}}$, or instructing
corrupt inputs to $\mathcal{F}_{\mathsf{ReactiveMPC}}$. None of these rely on
any secret information, so $\mathcal{S}$ will simulate exactly what occurs in
the real world.

Now consider case (b). But by this point, $\mathcal{S}$ will have run lines
40-41 in Figure 15. This will have triggered line 16 in Figure 8 and by lines
11-18 of Figure 15, $\mathcal{S}$ will already have modified its internal
emulation to account for actual honest inputs. This means that the emulation
will be exactly like that of the real world, and so any outputs in the
simulated real world will be exactly that which happens in the actual real
world.

Thus, the simulator defined in Figure 14 for $f\leq t$ corruptions and defined
in Figure 15 for $f>t$ corruptions causes the real and ideal worlds to be
indistinguishable to $\mathcal{Z}$. So we have that
$\Pi_{\mathsf{AuditableMPC}}$ UC-realizes
$\mathcal{F}_{\mathsf{AuditableMPC}}$ in the ($\mathcal{F}_{\mathsf{Setup}}$,
$\mathcal{F}_{\mathsf{RO}}$, $\mathcal{F}_{\mathsf{BulletinBoard}}$,
$\mathcal{F}_{\mathsf{ReactiveMPC}}$) hybrid world.

$\mathcal{F}_{\mathsf{Setup}}$ (1) On init: Run $\mathsf{PEC.Setup}$ and
$\mathsf{srs}$ generator $\mathsf{G}$ (2) On query by ITM $M$: Send setup to
$M$

Figure 9: Ideal functionality for trusted setup

$\mathcal{F}_{\mathsf{RO}}$ (1) On init: $\mathsf{vals}\leftarrow\\{\\}$ (2)
On query $q$ from ITM $M$: (3) If $q$ not in $\mathsf{vals}$:
$\mathsf{vals}[q]\leftarrow$ random field element (4) Send $\mathsf{vals}[q]$
to $M$

Figure 10: Ideal functionality for random oracle

$\mathcal{F}_{\mathsf{BulletinBoard}}$ (1) On init: $\mathsf{BB}\leftarrow[]$
(2) On input $m$ from ITM $M$: (3) If $M$ is not a server or data-client: Send
$\bot$ to $M$ (4) $\mathsf{Optionally}$: (5) Append $(M,m)$ to $\mathsf{BB}$
(6) $\mathsf{j}\leftarrow\mathsf{len}(\mathsf{BB})$ (7) For each $P_{i}$,
$\mathsf{optionally}$: Send $\mathsf{BB}[1:j]$ to $P_{i}$ (8)
$\mathsf{Optionally}$: Send $\mathsf{BB}[1:j]$ to Auditor (9) Send
$\mathsf{OK}$ to $M$

Figure 11: Ideal functionality for bulletin board

$\Pi_{\mathsf{AuditableMPC}}$ (1) As data-client $C_{i}$: (2) On input $x_{i}$
from $\mathcal{Z}$: (3) $r_{i}\xleftarrow{\$}\mathbb{Z}_{q}$ (4)
$C_{x_{i}}\leftarrow\mathsf{Commit_{eval}}(\mathsf{ck_{e_{i}}},x_{i},r_{i})$
(5) Send $C_{x_{i}}$ to $\mathcal{F}_{\mathsf{BulletinBoard}}$ and receive
$\mathsf{OK}$ (6) Store $(x_{i},r_{i})$ (7) On input $\mathbf{F}$ from
$\mathcal{F}_{\mathsf{ReactiveMPC}}$: (8) For each stored $(x_{i},r_{i})$: (9)
$\phi_{x_{i}}(\cdot)\leftarrow$ rand t-deg poly s.t. $\phi(0)=x_{i}$ (10)
$\phi_{r_{i}}(\cdot)\leftarrow$ rand t-deg poly s.t. $\phi(0)=r_{i}$ (11)
Unstore all $(x_{i},r_{i})$ (12) Send $\\{(\phi_{x_{i}},\phi_{r_{i}})\\}_{i}$
to $\mathcal{F}_{\mathsf{ReactiveMPC}}$ (13) As server $P_{i}$: (14) On init:
$\mathsf{BB}\leftarrow[\ ]$ (15) On input $\mathsf{BB}^{\prime}$ from
$\mathcal{F}_{\mathsf{BulletinBoard}}$: (16) If
$\mathsf{len(BB)^{\prime}}>\mathsf{len(BB)}$: (17)
$\mathsf{BB}\leftarrow\mathsf{BB}^{\prime}$ (18) Run
$\mathsf{process\\_inputs}$ (19) On
$(\mathbf{F},o,\mathsf{inputs,wires,round})$ from
$\mathcal{F}_{\mathsf{ReactiveMPC}}$: (20) Send
$(\mathsf{RANDS},\mathsf{round})$ to $\mathcal{F}_{\mathsf{Reactive}}$ and get
$\mathsf{rands}$ (21)
${\llbracket{x_{i_{1}}}\rrbracket},\ldots,{\llbracket{x_{i_{k}}}\rrbracket}\leftarrow$
shares of new inputs (22)
${\llbracket{r_{i_{1}}}\rrbracket},\ldots,{\llbracket{r_{i_{k}}}\rrbracket}\leftarrow$
shares in $\mathsf{rands}$ for new inputs (23)
${\llbracket{\hat{x}}\rrbracket}\leftarrow$ interpolation of
${\llbracket{x_{i_{1}}}\rrbracket},\ldots,{\llbracket{x_{i_{k}}}\rrbracket}$
(24) ${\llbracket{\hat{r}}\rrbracket}\leftarrow$ interpolation of
${\llbracket{r_{i_{1}}}\rrbracket},\ldots,{\llbracket{r_{i_{k}}}\rrbracket}$
(25)
$C_{\llbracket{\hat{x}}\rrbracket}\leftarrow\mathsf{PC.commit(ck,{\llbracket{\hat{x}}\rrbracket},{\llbracket{\hat{r}}\rrbracket}})$
(26) Send $C_{\llbracket{\hat{x}}\rrbracket}$ to
$\mathcal{F}_{\mathsf{BulletinBoard}}$ (27) Store
$(\mathbf{F},o,\mathsf{inputs,wires,round})$ (28) Run
$\mathsf{process\\_inputs}$ (29) Subroutine $\mathsf{process\\_inputs}$: (30)
For each stored $(\mathbf{F},o,\mathsf{inputs,wires,round})$: (31)
$\mathbf{C}\leftarrow$ shares of $C_{\hat{x}}$ for this round of inputs (32)
$b\leftarrow$ bit for if Step 4 of Appendix E.1 verifies (33) If $b$: (34)
${\llbracket{\pi}\rrbracket}\leftarrow$ prover protocol in Section 5.3 (35)
Send ${\llbracket{\pi}\rrbracket}$ to $\mathcal{F}_{\mathsf{BulletinBoard}}$
and receive $\mathsf{OK}$ (36) Unstore
$(\mathbf{F},o,\mathsf{inputs,wires,round})$ (37) If not $b$ and
$\mathsf{len}(\mathbf{C})==n$: abort (38) As Auditor: (39) On init:
$\mathsf{BB}\leftarrow[\ ]$ (40) On input circuit $\mathbf{F}$ from
$\mathcal{Z}$: Store $\mathbf{F}$ and run $\mathsf{audit}$ (41) On input
$\mathsf{BB^{\prime}}$ from $\mathcal{F}_{\mathsf{BulletinBoard}}$: (42) If
$\mathsf{len(BB^{\prime})}>\mathsf{len(BB)}$:
$\mathsf{BB}\leftarrow\mathsf{BB^{\prime}}$ and run $\mathsf{audit}$ (43) On
input $(\mathbf{F},o,\mathsf{round})$ from
$\mathcal{F}_{\mathsf{ReactiveMPC}}$: (44) Store
$(\mathbf{F},o,\mathsf{round})$ and run $\mathsf{audit}$ (45) Subroutine
$\mathsf{audit}$: (46) For each stored $\mathbf{F}$: (47) Send $\mathbf{F}$ to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$ if $\mathsf{BB}$ has $C_{x_{i}}$ for all
$x_{i}$ (48) For each stored $(\mathbf{F},o,\mathsf{round})$: (49) If
$\mathsf{BB}$ contains the entire Marlin proof: (50) Run verify function
described in Fig. 2 on the (51) transcript in BB and
$(\mathbf{F},o,\mathsf{round})$ (52) If verify function passes: (53) Unstore
$(\mathbf{F},o,\mathsf{round})$ (54) Send $(\mathbf{F},o)$ to $\mathcal{Z}$
(55) Else: abort

Figure 12: UC protocol for auditable MPC

$\mathcal{F}_{\mathsf{ReactiveMPC}}$ (1) On init: $\mathsf{inputs}\leftarrow[\
]$, $\mathsf{new\\_inputs}\leftarrow[\ ]$, $\mathsf{rands}\leftarrow\\{\\}$,
(2) $\mathsf{round}\leftarrow 0$ (3) On input $(\phi_{x_{i}},\phi_{r_{i}})$
from data-client $C_{i}$: (4) Append $\phi_{x_{i}}$ to $\mathsf{new\\_inputs}$
(5) Append $\phi_{r_{i}}$ to $\mathsf{rands[round]}$ (6) If all inputs in
$\mathbf{F}$ received: Execute $\mathsf{compute}$ (7) Else: send $C_{i}$ to
$\mathcal{A}$ (8) On input $(\mathsf{RANDS,round^{\prime}})$ from server
$P_{i}$: (9) If $\mathsf{round^{\prime}}>\mathsf{round}$: Send $[\ ]$ to
$P_{i}$ (10) If rand shares for proof for $\mathsf{round^{\prime}}$ not
generated: (11) $\phi_{r^{\prime}_{1}},\dots,\phi_{r^{\prime}_{k}}\leftarrow$
random t-deg polys for SNARK (12) Append
$\phi_{r^{\prime}_{1}},\dots,\phi_{r^{\prime}_{k}}$ to
$\mathsf{rands[round^{\prime}]}$ (13) Send $[\phi(i)\text{ for each $\phi$ in
}\mathsf{rands[round^{\prime}]}]$ to $P_{i}$ (14) On input circuit
$\mathbf{F}$ from Auditor: (15) $\mathsf{round}\leftarrow\mathsf{round}+1$
(16) Optionally: For each data-client $C_{i}$, send $\mathbf{F}$ to $C_{i}$
(17) Subroutine $\mathsf{compute}$: (18) If $f\leq t$: (19) Add
$\mathsf{new\\_inputs}$ to $\mathsf{inputs}$ and
$\mathsf{new\\_inputs}\leftarrow[\ ]$ (20)
$o\leftarrow\mathbf{F}(\mathsf{inputs})$ (21) $\mathsf{wires}\leftarrow$ rand
shares consistent with $\mathbf{F}$ (22) $\mathsf{Optionally}$: Send
$(\mathbf{F},o,\mathsf{round})$ to Auditor (23) For each $P_{i}$, optionally:
(24) $\mathsf{inputs^{\prime}}\leftarrow$ $P_{i}$’s shares of each input (25)
$\mathsf{wires^{\prime}}\leftarrow$ $P_{i}$’s shares of each wire (26) Send
$(\mathbf{F},o,\mathsf{inputs^{\prime}},\mathsf{wires^{\prime}},\mathsf{round})$
to $P_{i}$ (27) $\mathsf{inputs^{\prime}}\leftarrow$ corrupt shares of each
input (28) $\mathsf{wires^{\prime}}\leftarrow$ corrupt shares of each wire
(29) Send
$(\mathbf{F},o,\mathsf{inputs^{\prime}},\mathsf{wires^{\prime}},\mathsf{round})$
to $\mathcal{A}$ (30) Else: (31) $\mathsf{Optionally}$ ($\mathcal{A}$
providing $\mathsf{o^{\prime}}$): (32) Send
$(\mathbf{F},o^{\prime},\mathsf{round})$ to Auditor (33) For each $P_{i}$:
(34) Optionally ($\mathcal{A}$ sending
$o^{\prime}/\mathsf{new\\_inputs}^{\prime}/\mathsf{wires}^{\prime}$): (35)
Append $\mathsf{new\\_inputs}^{\prime}$ to $\mathsf{inputs[i]}$ (36) Send
$(\mathbf{F},o^{\prime},\mathsf{inputs[i]},\mathsf{wires^{\prime}},\mathsf{round})$
to $P_{i}$ (37) Send $(\mathbf{F},\mathsf{new\\_inputs},\mathsf{round})$ to
$\mathcal{A}$

Figure 13: UC ideal functionality for reactive MPC

$\mathcal{S}_{\mathsf{AuditableMPC}}$ (1) Case 1: $\mathbf{f\leq t}$: (2) On
init: Initialize internal emulation of real world, (3) including simulated
parties and functionalities. (4) Additionally, $\mathcal{F}_{\mathsf{Setup}}$
is initialized using $\mathsf{\mathcal{S}_{PEC}.Setup}$ (5) and
$\mathsf{\mathcal{S}_{zk-SNARK}.Setup}$ (6) On input data-client $C_{i}$ from
$\mathcal{F}_{\mathsf{AuditableMPC}}$: (7) If $C_{i}$ is honest: (8) Simulate
$C_{i}$ being provided an input of $0$ (9) On input $(\mathbf{F},o)$ from
$\mathcal{F}_{\mathsf{AuditableMPC}}$: (10) $C_{o},C_{r}\leftarrow$
polycommits to $o$ and extra degree of $\hat{x}$ (11) from
$\Pi_{\mathsf{Marlin}}$, using internally simulated $r_{1,\dots,k}(\cdot)$
(12) $C_{\hat{x}}\leftarrow[\text{simulated/adv. commits to
inputs},C_{o},C_{r}]$ (13) $(\mathsf{transcript},\pi)$ $\leftarrow$
$\mathsf{\mathcal{S}_{SNARK}.Prove(\mathsf{td}_{srs},\mathsf{td}_{comm},C_{\hat{x}},\mathbb{I})}$
(14) For each polycommit $C$ in $\mathsf{transcript}$: (15) Create share of
$C$ for each honest $P_{i}$, consistent (16) with the $f$ shares of corrupt
parties and $C$ (1) (17) Create share of $\pi$ for each honest $P_{i}$,
consistent (18) with the $f$ shares of corrupt parties and $\pi$ (2) (19)
Store $(\mathsf{transcript},\mathsf{shares},\pi,\mathbf{F},o)$ (20) Pass
$\mathbf{F}$ to the simulated Auditor, simulating (21)
$\mathcal{F}_{\mathsf{ReactiveMPC}}$ substituting $o$ as the output (22) On
input $(m,M^{\prime})$ from $\mathcal{Z}$: (23) If $M^{\prime}$ is an honest
$C_{i}$ or $P_{i}$: end activation (24) If $M^{\prime}$ is a corrupt data-
client $C_{i}$: (25) If $m$ is sending $(\phi_{x_{i}},\phi_{r_{i}})$ to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$: (26) Instruct $C_{i}$ to send
$\phi_{x_{i}}(0)$ to $\mathcal{F}_{\mathsf{AuditableMPC}}$ (27) and wait for
message $C_{i}$ from $\mathcal{F}_{\mathsf{AuditableMPC}}$ (28) Send
$(m,M^{\prime})$ to simulated $\mathcal{D}$. (29) If $\mathcal{D}$ returns
$m$, forward $m$ to $\mathcal{Z}$ (30) If $M^{\prime}$ is a corrupt server
$P_{i}$: (31) Send $(m,M^{\prime})$ to simulated $\mathcal{D}$. (32) If
$\mathcal{D}$ returns $m$, forward $m$ to $\mathcal{Z}$ (33) If $M^{\prime}$
is $\mathcal{F}_{\mathsf{RO}}$, $\mathcal{F}_{\mathsf{Setup}}$, or
$\mathcal{F}_{\mathsf{ReactiveMPC}}$: (34) Send $(m,M^{\prime})$ to simulated
$\mathcal{D}$. (35) If $\mathcal{D}$ returns $m$, forward $m$ to $\mathcal{Z}$
(36) If $M^{\prime}$ is $\mathcal{F}_{\mathsf{BulletinBoard}}$: (37) Send $m$
to simulated $\mathcal{F}_{\mathsf{BulletinBoard}}$ (38) If $\mathcal{D}$
returns $(P_{j},\mathsf{BB})$ for corrupt $P_{j}$ and bulletin (39) board
$\mathsf{BB}$: (40) Replace honest shares of Marlin commits (41) in
$\mathsf{BB}$ with stored shares from (1) (42) Replace honest shares of $\pi$
in $\mathsf{BB}$ with (43) stored shares from (2) (44) Send
$(P_{j},\mathsf{BB})$ to $\mathcal{Z}$ (45) If the simulated Auditor outputs
$(\mathbf{F},o)$: (46) Instruct $\mathcal{F}_{\mathsf{AuditableMPC}}$ to
execute the $\mathsf{optionally}$ (47) statement to send $(\mathbf{F},o)$ to
the Auditor

Figure 14: Simulator for UC proof when $f\leq t$

$\mathcal{S}_{\mathsf{AuditableMPC}}$ (continued)
(1) Case 2: $\mathbf{f>t}$: (2) On init: Initialize internal emulation of real
world, (3) including simulated parties and functionalities. (4) Additionally,
$\mathcal{F}_{\mathsf{Setup}}$ is initialized using
$\mathsf{\mathcal{S}_{PEC}.Setup}$ (5) and $\mathsf{\mathcal{S}_{zk-
SNARK}.Setup}$ (6) On input data-client $C_{i}$ from
$\mathcal{F}_{\mathsf{AuditableMPC}}$: (7) If $C_{i}$ is honest: (8) Simulate
$C_{i}$ being provided an input of $0$ (9) On input $\mathbf{F}$ from
$\mathcal{F}_{\mathsf{AuditableMPC}}$: (10) Send $\mathbf{F}$ to simulated
Auditor (11) On input $(\mathbf{F},\mathsf{new})$ from
$\mathcal{F}_{\mathsf{AuditableMPC}}$: (12) For each honest input $x_{i}$ in
$\mathsf{new}$: (13) $\phi_{x_{i}}\leftarrow$ random $t$-degree consistent
with $x_{i}$ (14) $C_{x_{i}}\leftarrow$ internally simulated commitment for
$x_{i}$ (15) $r_{i}\leftarrow$ randomness to commit $x_{i}$ to $C_{x_{i}}$
(16) $\phi_{r_{i}}\leftarrow$ random $t$-degree consistent with $r_{i}$ (17)
Modify internal simulation of $\mathcal{F}_{\mathsf{Reactive}}$ to use (18)
$\phi_{x_{i}}$ and $\phi_{r_{i}}$ for input $x_{i}$ (19) On input
$(m,M^{\prime})$ from $\mathcal{Z}$: (20) If $M^{\prime}$ is an honest $C_{i}$
or $P_{i}$: end activation (21) If $M^{\prime}$ is a corrupt $C_{i}$ or
$P_{i}$: (22) Send $(m,M^{\prime})$ to simulated $\mathcal{D}$. (23) If
$M^{\prime}$ is $\mathcal{F}_{\mathsf{RO}}$, $\mathcal{F}_{\mathsf{Setup}}$,
$\mathcal{F}_{\mathsf{BulletinBoard}}$, or $\mathcal{F}_{\mathsf{Reactive}}$:
(24) Send $(m,M^{\prime})$ to simulated $\mathcal{D}$. (25) When $\mathcal{D}$
returns $m$, forward $m$ to $\mathcal{Z}$, unless the (26) if statement below
is triggered (27) If the simulated Auditor provides $\mathbf{F}$ to
$\mathcal{F}_{\mathsf{ReactiveMPC}}$: (28) For each input commit $C_{x_{i}}$
on the bulletin board: (29) If $x_{i}$ is not calculated for a corrupt party’s
$C_{x_{i}}$: (30) $a_{1\dots k}\leftarrow$ AGM repr. of $C_{x_{i}}$ provided
by $Z$ in (31) terms of SRS and group elems $\mathcal{S}$ sent $\mathcal{Z}$
(32) $a^{\prime}_{1\dots l}\leftarrow$ repr. of $C_{x_{i}}$ in terms of the
SRS and (33) elems created that $\mathcal{S}$ has no repr. for (34) For each
elem created with no representation: (35) Create a representation w.r.t. the
SRS using (36) the trapdoor (37)
$[\overline{a_{1}},\dots,\overline{a_{m}}]\leftarrow$ repr. of $C_{x_{i}}$ in
terms of the SRS (38) $x_{i},r_{i}\leftarrow$
$[\overline{a_{1}},\dots,\overline{a_{m}}]$ (39) Store $x_{i}$ for input to
$\mathcal{F}_{\mathsf{AuditableMPC}}$ (40) Send all $x_{i}$ to
$\mathcal{F}_{\mathsf{AuditableMPC}}$ via dummy corrupt (41) parties and
instruct execution of inside optionally (42) If the simulated Auditor outputs
$(\mathbf{F},o)$: (43) Instruct $\mathcal{F}_{\mathsf{AuditableMPC}}$ to
execute the $\mathsf{optionally}$ (44) statement to send $(\mathbf{F},o)$ to
the Auditor

Figure 15: Simulator for UC proof when $f>t$


# Ethical Artificial Intelligence Principles and Guidelines for the Governance
and Utilization of Highly Advanced Large Language Models

Soaad Qahhār Hossain1, Syed Ishtiaque Ahmed1

###### Abstract

Given the success of ChatGPT, LaMDA and other large language models (LLMs),
there has been an increase in development and usage of LLMs within the
technology sector and other sectors. While the level in which LLMs has not
reached a level where it has surpassed human intelligence, there will be a
time when it will. Such LLMs can be referred to as advanced LLMs. Currently,
there are limited usage of ethical artificial intelligence (AI) principles and
guidelines addressing advanced LLMs due to the fact that we have not reached
that point yet. However, this is a problem as once we do reach that point, we
will not be adequately prepared to deal with the aftermath of it in an ethical
and optimal way, which will lead to undesired and unexpected consequences.
This paper addresses this issue by discussing what ethical AI principles and
guidelines can be used to address highly advanced LLMs.

## Introduction

The research, development and usage of large language models (LLMs) continues
to rapidly increase due to its success in demonstrating its abilities to
perform tasks more efficiently and effectively than humans. There are
limitations with the current LLMs, and those models do make mistakes such as
provide incorrect answers. For example, ChatGPT failed the Taiwan’s 2022
Family Medicine Board Exam, only answering 52 questions out of 125 correctly
(Tzu-Ling et al. 2023). At some point, these issues will be resolved, but its
progress and advancements will not stop there. Research and development in
LLMs will come to a point where LLMs will surpass human intelligence, which in
this paper we refer to those models as highly advanced LLMs, or simply
advanced LLMs. While this can lead to good outcomes through making tasks
easier to complete, it can also lead to bad outcomes as well. An example of a
bad outcome is when LLMs generate convincingly misleading information that can
potentially have negative consequences in areas such as public health and
politics (Ray 2023).

To prevent such issues from occurring, we need to commence the discussion on
highly advanced LLMs and discuss how we can approach it. Accordingly, this
paper directly addresses this by discussing how ethical artificial
intelligence (AI) principles and guidelines could be used on advanced LLMs to
prevent them from harming people and the environment. The purpose of the paper
is not to comprehensively discuss the applications of the principles and
guidelines to advanced LLMs, but rather to initiate the discussion on it and
provide details on which principles and guidelines could used to address
advanced LLMs, and things that need to be considered for them.

## Background

Prior to addressing advanced LLMs, we will first review ethical AI principles
and guidelines, and LLMs in more details. We will also highlight which
principles and guidelines will be used specifically for our approach along
with factors to consider.

### Ethical Artificial Intelligence Principles

Ethical AI (also known as AI ethics) principles encompasses a wide range of
areas within technology, including responsibility and privacy, fairness,
explainability, robustness, transparency, environmental sustainability,
inclusion, moral agency, value alignment, accountability, trust, and
technology misuse (IBM 2023). It is worth noting that while different areas of
the world define ethical AI principles differently, the final goal is more or
less the same. For example, the Australian government focuses on 8 ethical AI
principles (Australian Government 2023), while the Organization for Economic
Cooperation and Development (OECD) focus on 5 (OECD 2019). For both, the goal
is to ensure AI is safe, secure, trustworthy and reliable. In our case, when
approaching advanced LLMs with ethical AI principles, we will specifically use
responsibility, robustness and technology misuse. Future work should
investigate the use of other ethical AI principles for advanced LLMs.

For our approach, we will use the Australian Government’s understanding of the
ethical AI principle of responsibility. They state that businesses,
organisations’ and individuals’ must take responsibility for the outcomes of
the AI systems that they design, develop, deploy and operate (Australian
Government 2023). For the principle of robustness, we will use a perspective
of robustness in AI shared amongst African communities. Their perspective on
the principle of robustness states that ethical, legal and socio-cultural
impacts of AI need to be robustly considered and mitigated (Eke et al. 2023).
We define technology misuse as the intentional use of technology to achieve
harmful outcomes (Brundage et al. 2018). Accordingly, the ethical AI principle
on technology misuse is to use technology in a way that does not directly or
indirectly harm others.

### Ethical Artificial Intelligence Guidelines

There are multiple organizations that have created their own set of ethical AI
guidelines. Such entities include United Nations Educational, Scientific and
Cultural Organization (UNESCO), and the EU. UNESCO’s guidelines consist of 11
different areas (UNESCO 2022), while the EU’s consist of 7. Similar to the
ethical AI principles, the final goal for the guidelines is more or less the
same. The goal is to protect humanity, individuals, societies and the
environment from harms that can be caused from using AI systems. Accordingly,
the guidelines that we will use are those concerning societal and
environmental well-being, safety, and accountability. Future work should
investigate the use of other ethical AI guidelines for advanced LLMs.

For our approach, the ethical AI guidelines for societal and environmental
well-being encompasses health, social well-being, environments and ecosystems.
Accordingly, we use the guidelines provided by UNESCO pertaining to those.
These guidelines state that organisations’ and individuals’ designing,
developing, deploying and operating should assess the direct and indirect
environmental impact throughout the AI system life cycle; that the development
and deployment of AI systems related to health and mental health is regulated
to the effect that they are safe, effective, efficient, scientifically and
medically proven and enable evidence-based innovation and medical progress;
and more (UNESCO 2022). For the guidelines for safety, we consider it as
stated by the EU. The EU states that AI systems need to be resilient and safe,
ensuring a fall back plan in case something goes wrong, as well as being
accurate, reliable and reproducible (EU 2019). For the guidelines concerning
accountability, we will use the guidelines from UNESCO. Their guidelines state
that AI systems should be audible and traceable, and that there should be
oversight, impact assessment, audit and due diligence mechanisms in place to
avoid conflicts with human rights norms and threats to environmental well-
being (UNESCO 2022).

### Large Language Models and Considerations

LLMs are machine learning models trained on massive amounts of text data and
are able to generate human-like text, answer questions, and complete other
language-related tasks with high accuracy (Ray 2023). It is important to note
that current LLMs are experiencing challenges, such as providing incorrect
information. An example of this is the Bard disaster case. The Bard disaster
case was a case where Bard (the LLM created by Google) provided incorrect
information in a demonstration failure that costed Google over 100 billion
dollars in stock losses (Floridi 2023). LLMs are currently not at a point
where they are not error-free, but they still perform well in general.
Normally, when considering LLMs for usage we need to consider legal aspects
(such as licensing and commercial use), factors for inference speed and
precision, model size, context length, usage type (task specific vs. general
purpose), testing and evaluation, deployment, and costs. For our case of
advanced LLMs, we will assume that all those considerations are not a problem,
and that the usage type considers both task specific and general purpose. That
is, there are no limits to the context length, conditions of factors for
inference speed and precision are acceptable, etc. Furthermore, we assume that
the costs of designing, developing, deploying and operating LLMs to the
environment is low.

## Comprehending Advanced Large Language Models and its Capabilities

To properly approach highly advanced LLMs, we need to understand what they
truly are. With the assumptions that we made in the previous section about
advanced LLMs and assumption that advanced LLMs have surpassed human
intelligence, that would imply several things, which can be encompassed into
four implications. First, it would imply that natural language understanding
(NLU) including sentiment analysis, text classification, natural language
inference and other NLU tasks, reasoning, natural language generation (NLG)
including summarization, dialogue, translation, question answering and other
NLG tasks, and multilingual tasks are not an issue for advanced LLMs. That is,
advanced LLMs will be able to receive data from any language, process and
analyze the data, access and utilize existing information (in diverse
languages), evaluate information, and produce results in any specified
language with ease. Second, it would imply that advanced LLMs can do tasks
that are considered extremely difficult for humans and tasks that were
originally considered as impossible by humans. For example, it may be able to
prove mathematical concepts that were never proven before. Third, it can
create new ideas and concepts. Fourth, the amount of resources needed for
advanced LLMs is such that it does not harm the environment. This implies that
the cost to design, develop and use them is low to an extent where it does not
pose a threat. This also means that there are not as many barriers that
prevent people and organizations from developing and using them.

In theory, the first three implications sound exceptionally good. However, in
practice they are not. The reason for this is that just as advanced LLMs have
the potential of solving good highly difficult problems, such as determining
the cure to cancer of any type, it also has the potential of solving bad
highly difficult problems, such as determining and explaining what is needed
to hack financial institutions. Consequently, the negative impact of advanced
LLMs will be catastrophic. Accordingly, measures need to be in-place to
prevent such problems from happening.

## Advanced Large Language Models Governance Using AI Ethics

The measures that need to be in-place to prevent advanced LLMs from causing
massive problems and creating chaos ultimately needs to be policies that are
enforced onto the advanced LLM users and developers. Those measures need to
have ethical AI principles and guidelines instilled in them. This section will
not comprehensively discuss the applications of ethical AI principles and
guidelines to advanced LLMs governance, but rather it will focus on selected
principles and guidelines, and connecting them to form policies appropriate
for advanced LLMs. We will only focus on three policies, detailing their
motivations, and elaborating on their use.

### Responsibility, Accountability and Advanced Large Language Models

The first policy of interest that concerning accountability and responsibility
of advanced LLMs. The motivation for this is that this policy will influence
the creation and utilization of advanced LLMs. Appropriate policies will
instill pressure needed for people and entities planning on creating and using
advanced LLMs to create or use them with caution. To approach such policies,
we will use the Australian Government’s ethical AI principle of responsibility
and UNESCO’s ethical AI guideline on accountability. Applying the principle,
we get the following: businesses, organisations’ and individuals’ must take
responsibility for the outcomes of the advanced LLMs that they design,
develop, deploy and operate. Similarly, applying the guidelines, we get the
following: advanced LLMs should be audible and traceable, and that there
should be oversight, impact assessment, audit and due diligence mechanisms in
place to avoid conflicts with human rights norms and threats to environmental
well-being. The policy should use that principle, but ensure that it is both
the developer and the user that are responsible for the outcomes. This will
force the developers to incorporate audibility and traceability, oversight,
impact assessment, audit and due diligence mechanisms when producing advanced
LLMs. In addition, the policies will force user to take precaution when using
advanced LLMs as they will be responsible for the outcome. Note that in the
case where someone were to use an advanced LLM that led to problematic
outcomes, the developers will still be held responsible even though the user
was the one that misused the advanced LLM. This is to further enforce
audibility, traceability, etc. onto developers. Different from tools such
nuclear weapons, we do not know the full extent of damage that could be
produced from advanced LLMs due to the fact that advanced LLMs are more
intelligent than use. However, we do know that the consequences can be
catastrophic. Accordingly, advanced LLMs need to be dealt in a manner that
forces those directly and indirectly involved to take responsibility and
precaution.

### Technology Misuse, Safety and Advanced Large Language Models

The second policy of interest is that concerning safety and technology misuse.
The motivation for this policy is ultimately that it will protect people and
create safety and other measures needed to prevent harm. This policy should
focuses on two things. First, it should focuses on the case where something
were to go wrong with using advanced LLMs. Second, it should focuses on cases
where advanced LLMs is used wrongfully. For the first part, we can use the
ethical AI guideline for safety. Using the ethical AI guideline for safety, we
get the following: advanced LLMs need to be resilient and safe, ensuring a
fall back plan in case something goes wrong, as well as being accurate,
reliable and reproducible. To elaborate, in the case where an undesired
outcome was produced from using an advanced LLM, it should be possible to
recover quickly from such situation. In the case where it is not possible, it
should be possible to stop the situation from getting worse, and make
corrections when needed. For the second part, we can use the ethical AI
principle for technology misuse. Using the principle of technology misuse, we
get the following: use advanced LLMs in a way that does not directly or
indirectly harm others. This may be difficult for users as not all users know
how advanced LLMs can harm others. It is recommended that a license is created
to access and operate advanced LLMs. That way only those knowledgeable on
advanced LLMs and understand the legal and other aspects attached to its use
are able to access and use them. Accordingly, as advanced LLMs are created,
the creators of them are required to have them registered with the government
so that advanced LLMs are regulated.

### Robustness, Societal and Environmental Well-Being and Advanced Large
Language Models

The third policy of interest is that concerning robustness and societal and
environmental well-being. The motivation for the policy is that it will help
ensure that the use of advanced LLMs will not damage the well-being of society
and the environment. The reason why we did not include development,
deployment, etc. of advanced LLMs is because of the assumptions that we made
earlier regarding advanced LLMs. We will first apply the ethical AI principle,
then discuss the guidelines. In applying the African perspective of ethical AI
principle of robustness, we get the following: ethical, legal and socio-
cultural impacts of advanced LLMs need to be robustly considered and
mitigated. The aim of the policy should be to have advanced LLMs thoroughly
considered and mitigated for their ethical, legal and socio-cultural impact
prior to their deployment.

Different from other AI systems and technologies, there are more aspects that
need to be considered for advanced LLMs to properly consider and mitigate its
ethical, legal and socio-cultural impact. These aspects can be understood
through understanding the capabilities of advanced LLMs. For example, knowing
that advanced LLMs can do tasks that were originally considered impossible, we
can get a sense of what impact it can have on laws. For instance, after
investigating use cases of an advanced LLM and the current laws in-place in a
country, it can be discovered that the existing laws do not cover certain
types of cases. As such, new laws need to be created should that advanced LLM
be released. It is recommended that an a screening and approval process
similar to that used for pharmaceutical drugs is used for advanced LLMs. Just
as pharmaceutical drugs can create large-scale irreversible damages on society
and the environment, advanced LLMs can as well. As such, additional parties
should be involved in the process of considering and mitigating the ethical,
legal and socio-cultural impacts of them.

For the UNESCO’s ethical AI guidelines on societal and environmental well-
being, they are very comprehensive. The important thing is that in UNESCO’s
document titled ”Recommendation on the Ethics of Artificial Intelligence”, the
policy recommendations on health, social well-being, environments and
ecosystems are applied to the policy concerning robustness and societal and
environmental well-being. In applying the guidelines, what would result would
be things such as the following: organisations’ and individuals’ designing,
developing, deploying and operating should assess the direct and indirect
environmental impact throughout the AI system life cycle; that the development
and deployment of advanced LLMs related to health and mental health is
regulated to the effect that they are safe, effective, efficient,
scientifically and medically proven and enable evidence-based innovation and
medical progress. Applying the guidelines to the policy will help prevent
negative consequences to society and the environment from using advanced LLMs.

## Considerations for Advanced Large Language Models and Policy-Making

While advanced LLMs are still considered as AI, it needs to be treated
differently from other AI systems because unlike other AI systems, advanced
LLMs can complete tasks considered highly difficult or impossible by human
beings, and formulate ideas and concepts. This differs from other forms of AI
as other forms of AI cannot complete tasks impossible to humans and generate
new ideas. Accordingly, policies on advanced LLMs should consider both things
can be achieved using advanced LLMs given what we know about advanced LLMs and
things that not likely to occur or be achieved using advanced LLMs given our
present knowledge of LLMs. While certain tasks may not look achievable in the
present moment, it does not mean that it will never be achieved. Given that
advanced LLMs are more intelligent than us, it is only a matter of time before
those tasks are completed.

## Discussion

The existing ethical AI principles and guidelines can be used to approach the
utilization of highly advanced LLMs. In addition, policies using specific
ethical AI principles and guidelines can address both areas that they were
intended to address, and areas that were not intended to be addressed but need
to be addressed through policy. For instance, the policy on safety and
technology misuse compliments the policy on responsibility and accountability
as it elaborates on areas pertaining to the advanced LLM users. While policies
on advanced LLMs can and should use existing ethical AI principles and
guidelines, they should also consider policies and approaches that we use for
matters that are not technical, such as guns and pharmaceutical drugs.
Advanced LLMs have the potential of causing catastrophic damage to society and
the environment. Accordingly, we need to carefully approach it like how we
approached other things that can cause significant harm.

## Conclusion

Advanced LLMs policies need to be created prior to prevent advanced LLMs from
causing hard to society and the environment. Those policies can be created
using existing ethical AI principles and guidelines. However, the policies
should not limit itself to AI as advanced LLMs will be capable of doing things
that other AI systems are not able to do. Future work should investigate the
use of other ethical AI principles and guidelines for policy-making for highly
advanced LLMs and the full potential of highly advanced LLMs.

## References

  * Australian Government (2023) Australian Government. 2023.  Australia’s AI Ethics Principles.  https://www.industry.gov.au/publications/australias-artificial-intelligence-ethics-framework/australias-ai-ethics-principles.  Accessed: 2023-11-26.
  * Brundage et al. (2023) Brundage, M.; Avin, S.; Clark, J.; Toner, H.; Eckersley, P.; Garfinkel, B.; Dafoe, A.; Scharre, P.; Zeitzoff, T.; Filar, B.; Roff, H. A. H.; Allen, G. C.; Steinhardt, J.; Flynn, C.; heigeartaigh, S. O.; Beard, S.; Belfield, H.; Farquhar, S.; Lyle, C.; Crootof, R.; Evans, O.; Page, M.; Bryson, J.; Yampolskiy, R.; and Amodei, D. 2023.  The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation.  arXiv:1802.07228.
  * Chang et al. (2023) Chang, Y.; Wang, X.; Wang, J.; Wu, Y.; Yang, L.; Zhu, K.; Chen, H.; Yi, X.; Wang, C.; Wang, Y.; Ye, W.; Zhang, Y.; Chang, Y.; Yu, P. S.; Yang, Q.; and Xie, X. 2023.  A Survey on Evaluation of Large Language Models.  arXiv:2307.03109.
  * Eke, Wakunuma, and Akintoye (2023) Eke, D.; Wakunuma, K.; and Akintoye, S. 2023.  Introducing Responsible AI in Africa.  In _Social and Cultural Studies of Robots and AI_ , 1–11. Palgrave Macmillan.
  * European Commission (2019) European Commission. 2019.  Ethics guidelines for trustworthy AI.  https://digital-strategy.ec.europa.eu/en/library/ethics-guidelines-trustworthy-ai.  Accessed: 2023-11-25.
  * Floridi (2023) Floridi, L. 2023.  AI as Agency Without Intelligence: on ChatGPT, Large Language Models, and Other Generative Models.  _Philosophy and Technology_ , 36: 15.
  * IBM (2023) IBM. 2023.  What is AI ethics?  https://www.ibm.com/topics/ai-ethics.  Accessed: 2023-11-27.
  * Klockmann, von Schenk, and Villeval (2022) Klockmann, V.; von Schenk, A.; and Villeval, M. C. 2022.  Artificial intelligence, ethics, and intergenerational responsibility.  _Journal of Economic Behavior and Organization_ , 203: 284–317.
  * OECD (2023) OECD. 2023.  OECD AI Principles overview.  https://www.industry.gov.au/publications/australias-artificial-intelligence-ethics-framework/australias-ai-ethics-principles.  Accessed: 2023-11-26.
  * Ray (2023) Ray, P. P. 2023.  ChatGPT: A comprehensive review on background, applications, key challenges, bias, ethics, limitations and future scope.  _Internet of Things and Cyber-Physical Systems_ , 3: 121–154.
  * UNESCO (2022) UNESCO, ed. 2022.  _Recommendation on the Ethics of Artificial Intelligence_.  United Nations Educational, Scientific and Cultural Organization.
  * Weng et al. (2023) Weng, T.-L.; Wang, Y.-M.; Chang, S.; Chen, T.-J.; and Hwang, S.-J. 2023.  ChatGPT failed Taiwan’s Family Medicine Board Exam.  _Journal of the Chinese Medical Association_ , 86: 762–766.