Most probably everybody has knowledge of it. But I would like to stay in the general formula, because it's the general formula for every reaction. Why is the general formula? Because this gives you the reactions per time, normalized through the projectiles per area per time times the target nuclei. And this is an absolute number. So any form of a reaction, any type of reaction, is obeying this formula in its general form. And I mean when you measure absolute. Is anybody that doesn't understand what means absolute measurement?  What is an absolute measurement?  Of reference system? Of your device? Of what else? No, but this is your device. This is your device, end of time. So, which means when you talk about cross-section, you have to define in your paper, in your publication, in whatever, what cross-section do you mean? Is it a relative cross-section? Or is it an absolute cross-section? I'm sure somebody of you knows an example of a relative measurement, to give me. Who is doing here activation measurements? You. Why is your measurement relative and not absolute? Or when?  In most of the cases, you have a gold foil for which you know very well the cross-section. You activate your foil, and through the activation and the known cross-section of your gold and something, it is controlled, but in many cases, you have this kind of measurements. You know something and you go and you determine a cross-section or some other quantity relative to that. This is not an absolute measurement.  So, something else. When you make experiments for nuclear structure, are you aware of this kind of measurements? Let me show you an example. Nuclear structure means you have a nucleus. Here is its ground state. A, Z, X, ground state. By the way, can somebody tell me an example in nature when we say ground state? What is the ground state of aluminum? Yeah. You all play with aluminum. Everywhere in your house is aluminum. Is this aluminum in ground state or not? Why not? Maybe it's not, but why not? No, you have aluminum. OK, this is a foil of aluminum. Suppose this is aluminum. Is this aluminum in ground state or not? Yes, please. Aluminum 27 is stable. So, is it in ground state or not? Yes. Why? I'm telling you that the aluminum 27 is represented by a square well where the nucleons are. And this has an energy epsilon. Is it in ground state or not? Of course it is. Because this energy has to do with its binding energy. So the zero energy for the macrocosmos is here. And this is zero. So everything you touch and is not activated is not no radioactivity. It's in ground state. OK?  It gets excited. OK? So take 27 aluminum. I give energy, OK? When I give energy, depending on the energy, I create the aluminum and the aluminum can be in different excited states. Clear? So this is my first excited state, my second and so on. So let's make it a bit more general now. I have an accelerator, OK? And I have a carbon beam, I have the ion beam and I'm shooting a foil. It could be aluminum, it could be palladium, it could be whatever, OK? And I make a reaction, OK? Just to give you an example, that was the reaction in my PhD thesis. What gives me that? 120 plus 13, 133 minus 3, this should be 130, OK? So if I know this, the Z, you will find that this is barium, OK? Doesn't matter. Now, I create barium. This barium is in most of the cases, OK? In an excited state here, OK? In some continuum. And what I do now is I go and have a measurement. This is my beam, OK? My 120 tin. And I have various detectors here, OK? I make an experiment at E60 MeV, an experiment at 70 MeV, and so on, and so on. And I want to find at which energy I create this nucleus at the most, which means I have to look for counts coming from barium 130, OK? Now, at 60 MeV I measure 2 hours, because I have a good student and he's really working hard. At 70 MeV is night and my student is sleeping and it measures 6 hours, OK? How can I compare the two spectra? Here is my spectrum, blah, blah, blah, blah. One peak that comes from 130 barium and here is a spectrum that is very high, because this is 6 hours. I don't believe the current. I don't believe the current, I forgot to know the time. No, you cannot do this because the background is different. What do you do? If your target here is backed, just a second, not to lose more time, OK? This is 120 and behind you have, let's say lead, OK? Blah. How is lead? When your beam comes here, it continues and makes current excitation, OK? And you know the energy. So you also count the current excitation events and you know how these events go with the time, OK? So here you have a correction factor, let's say C2 and this is C1. So what do you do? You take the integral here, OK? Times C1, C2 and you have the correlation. Is this measurement relatively absolute? This is totally relative, OK? I insist in that point, please guys, if you want to be a credible scientist in your work, you have to understand what it means to measure absolute and what it means to measure relative. In most of the applications, in materials analysis, for example, you are not necessarily need an absolute measurement, OK? But that's OK, because there, you are interested in relative phenomena. However, when you want to, for example, determine absolute number of atoms of an element, OK? There you really need to have an absolute measurement or a good reference point value that is very, very well measured with a very small error, OK, so that you feel comfortable. OK, that's why I'm saying here this is the general expression for cross-section, OK? For example, when you do RBS, what do you really need, don't need here? Do you need everything here? You measure relative always, OK? And because you know the Coulomb scattering term, which is, you know, it's a number, bam, kinematics, it's on so angle, I get so much counts, OK? Fine, let's proceed. What gives me the reaction cross-section? It gives me the, it is a measure of the probability, OK? That a certain reaction takes place at a certain energy, which means the cross-section depends on energy, fine? Now I will show you another very important quantity apart from the reaction, apart from the cross-section, there is the so-called reaction rate, OK? The cross-section gives you the reactions per time, projectiles per area per time, target nuclei, OK? What gives you the reaction rate? The reaction rate gives you the number of reactions per unit time, per unit volume. And because of that, it is the most important reaction when you do, let's say, nuclear synthesis, so nuclear astrophysics, why? Because if you take that cross-section of the reaction, OK, and insert it in this expression, you get the reaction rate. Now all these symbols here are to explain as follows. Assuming you have a stellar site, OK? This stellar site has a temperature, which means kinetic energy, OK? A density, a mass and a distribution of the elements. Now, KT is this temperature, but T is your lab energy. Thermal energy is kinetic energy, which means if I know that, let's say, in that star a specific reaction takes place and I want to see how this reaction contributes to evolution of the star, what quantity do I need? I need to know how fast this reaction occurs, OK? What does it mean how fast? How many reactions per time per second? And at the same time, I need to confine this in a specific volume. That's why I divide per volume. And look here, nuclear physics, reaction cross-section, provides data to nuclear astrophysics. Because if you insert the cross-section of the reaction and it takes place in the star, you can calculate the reaction rate. And with the reaction rate, you can make modeling and calculations how fast or how slow a star or a stellar environment is proceeding. OK? Now, apart from the cross-section or the total cross-section or whatever, of a reaction, we have the differential cross-section and no differential cross-section. What are these cross-sections?   What does it mean yield? It means the number of produced particles, which can be also gamas, in the whole volume in 4 pi. Differential equation means what? I want to know at a specific angle from the beam direction, where is the so-called z-axis. How many particles are produced here? To do this, I need the so-called angular distributions. No matter if they are gamas or particles or electrons or whatever, if you want to measure differential cross-section, you have to do angular distribution measurements, which means you have to measure at specific angles, your counting rate, so to say. Now, there is also the double differential equation, which is what? At a specific angle, specific energy. Your products here are emitted all over the place with most probably different energies. So then your differential equation gives you the angular distribution of the products. And the double differential equation gives you also not only the angular distribution of the products, but also the energies at the angular distribution. Fine? Is it clear? Question. I haven't put here the so-called partial cross-section. Can you imagine what a partial cross-section can be? Partial cross-section. The fact that I am saying partial, what does it mean? I fragment my total in many others. But what others? For example, if you have a reaction where you have, let's say, three channels, then you have sigma total equals sigma 1 first channel. Plus sigma 2, plus sigma 3. In some sense, these are the partial cross-sections of your total cross-section. However, when we talk about reactions and exit channels, we don't call them partial cross-section. We call them the cross-section of the channel X. Now, guess what? You create aluminum 27 here, here, somewhere, and this guy cannot emit particles, emits only gamas. One case. Then you can have this gamma, you can have this gamma, you can have this gamma.  No particle emission, just gamas. Don't go under spectra. Tell me the principle. Suppose we can measure all over the volume. What do you need? What would you measure? What give these gamas here? Only? The energies, they are clear. They have epsilon, whatever, gamma 0, whatever. The number of these gamas, what gives this number? No. What does it mean to measure the transition? Decay. The number of nuclei of aluminum that have produced here, and decay. So, if you know the absolute number of the photons of the gamas here that have been emitted by the reaction, what can you calculate? Come on, guys, this is the total cross-section.  So, how many guys have been produced? 301. So, you take this number. You connect it in your telecontroller, whatever, if you see them all. And you say, these 301 guys that are falling down, there was a criminal, or how many criminals were somewhere and they throw them away. This is your beam. So, then you say 301 divided by 20 lunatics. This is a number, and I have to correct because I don't see them all. This is my efficiency. You take this formula, roughly speaking. And you get your cross-section. But let me ask you something. You take all of those, all these gamas, these are one, two, three, four, five, six gamas. How many you take? All the six? Which one? Which one? You say three. Correct. Which one? You have two choices. These you have to take anyway. Because it leaves the balcony and it arrives at the earth. So, you do either this guy, that guy, and that guy. OK, here is not serious, cannot be two. OK? Or you take this guy, that guy, and that guy. This gamma transition doesn't count because it's a part of that. OK? So, if you take this and this gamma ray, you have it all. However, if your device is not, let's say, is obscured by background and you cannot see this one, and you see the other ones, you go there. OK? That way, what do you do? You determine the cross-section of the reaction that produces aluminum in its ground state. Question. Assuming that this is a metastable state. Metastable means long-lived. OK? And you don't have any gamas here, you have an E0. An E0 means a transition that does not emit gamma. OK? Can you determine the cross-section for the production of aluminum in this level? Of course you do. You do the same thing. You don't take everything that goes away.  OK? Now, this is sigma metastable. OK? And this is sigma ground. What will be the total? Sigma ground plus sigma metastable. This is the total, this is the partial, and this is the partial. In general, you can determine for every gamma a cross-section. And if you make the correct addition, you end up with a total, with a correct total cross-section. And these are the partial cross-sections. I have an example for later. A real one. OK, where do we are now? OK, we said, we understood what is a Q value, and what is a threshold, OK, of a reaction? And what is a cross-section? Now, let's look in that picture here. This is a picture of a proton that is impaging on a nucleus, indium 113. OK? The black curve of what you see is the proton capture, so to say, reaction where only a gamma is emitted. OK? So, the blue one is where an alpha is emitted. OK? Neutron is emitted, and pp prime, OK, this is an inelastic scattering. Does this has a Q value? It has a threshold, but not a Q value. It's a matter of interpretation. You can say it's a Q value, but in fact it's a threshold. OK? The P gamma reaction has a Q value of 8.4 MeV. The P alpha reaction has 5.8 MeV. And the Pn reaction has minus 1.8 MeV. What does it mean, this? That in order to have this reaction, your proton has to have at least 1.819 MeV. Now, if you look at 1.8, you see the Pn goes down to Hades, to zero. That's why you see this one. Whereas all the other reactions, they have a positive Q value, which means they are occurring no matter what. OK? Oh, come on, here is 10 to the zero, and this is 10 to the minus 18, which means we are already zero. OK? Now, let's take the example where I have the emission of only one type of a product, but one time, two times, three times, and so on. You see here. This is a reaction Pn on something. Then P2n. What does it mean, 2n? I, you know, I suited out two neutrons, three neutrons, four neutrons, and so on. You see that they are moving to the right, as expected, because in order to take two neutrons out of your target, you need more energy, so you move that way, and they all have a threshold. OK? Here is the threshold for the Pn. It goes to zero. Here is the other threshold, and so on, and so on. OK? Try, please try to understand the meaning of the threshold of the q-value and the cross-section. They are totally correlated, and if you understand what these quantities mean, you can understand a lot of things in nuclear reactions. OK? Now, let's classify the nuclear reactions. OK? How many types of reactions we have? This classification is in line with my age, I would say, so it's before 90. OK? So how many reactions we have? We have elastic scattering, inelastic scattering. Rearrangement collisions, this doesn't exist anymore as a term. It's simply a nuclear reaction. We have many body reactions. We have photonuclear reactions, and we have radiative capture. OK? Let's see what are these. Elastic scattering means A plus A capital gives A capital plus A. q-value is zero. OK? What is this? This reaction is always possible. It can be because of Coulomb repulsion, Coulomb effect. OK? And when the Coulomb forces are dominant, then we have radiative scattering. And this reaction, the elastic scattering, plays a key role in surface analysis. Inelastic scattering. Here, inelastic scattering means that both products, A and A prime, OK, can be in excited state. What does it mean? This projectile, after the event, will be in excited state. OK? And the product, the heavy product, could also be in excited state. OK? Here we have a threshold. That's why I told you before. The q-value is negative, and when the A is in excited state, usually it decays with a gamma. OK? And that's why because of the reasons that we said before, that's why these reactions inelastic scattering are often used for analysis, but using the gamma. OK? Rearrangement. This is simply nuclear reaction, OK? Which means a small A and a big A give me a B in different excited states. And, of course, the corresponding q-value is different, OK? What does it mean in practice? If you have a deuteron on a nitrogen 14, you produce carbon 12 plus an alpha plus 13.5 mV energy. But you can have the same reaction, producing carbon in an excited state, OK? Plus the alpha. In that case, if the carbon is in the first excited state, which is at 4.4 mV, then you produce less energy, OK? Many body reactions. This is also overdoing because this means that at the end you have not only one light product, but many, OK? This is something like this.  And this reaction is like this. Photonuclear reactions. High energy gamma, OK? Impeginzon and nucleus and Brexit, OK? It gives you a new product plus particle. Gamma plus carbon 12 gives you carbon 11 plus neutron. This was supposed to be one of the most sensitive methods to detect carbon, OK? But if you see here, 18 mV, which means your gamma should be 18-something mV, so an enormous amount of energy. So photonuclear reactions are possible when your gamma energy is really high. And radiative capture is simple. NA and the capital A produces a system, the so-called compound nucleus, that is excited, and then it de-excites by emission of gammas. The most famous reaction is 27-aluminum, p-gamma, and this reaction is used for calibrating your accelerator, OK?  So it's a step, and in the middle is your resonance energy, and from here to there, OK? This is your energy uncertainty. In fact, here is not the energy of the proton, is the magnetic field of your magnet. But, OK, you can translate it in energy. As I said, this classification is old, and in fact, all these are thought as reactions, OK? So we have elastic in elastic and reactions. Now, the point is that since recent years, these both are also reactions, because we say that in any reaction you can have this exit channel and this exit channel. So we talk only about reactions. Fine, now. When do we have to go for lunch? Sorry? 12.30. OK, I still have my 1.10. OK, good. Reaction mechanisms. We have two major mechanisms, the direct reactions and the compound reactions, OK? In the first case, we have the case where a projectile interacts with one or a few nucleons of the target, OK? Within a very short time of the order of 10 to the 21 seconds, minus 21 seconds, OK? And either it transfers energy to the target or, as I wrote there, it picks up or loses, OK? And then it turns, leaving them to the nucleus, to the target nucleus. Here you see, a juteron is imaging on berylium 10, OK? If you have an elastic scattering, at the end you will have berylium 10 and juteron. This is elastic. What is a transfer reaction? A transfer reaction means that the juteron goes to berylium, catches one of the nucleons, and leaves the other one moving. In that case, the neutron. There is, of course, the other possibility that the juteron approaches berylium 10, interacts and is breaking up. These are direct reactions. They are very fast, OK? Now, in the category of direct reactions you have elastic scattering, in elastic scattering, the so-called transfer reactions, stripping or pick-up, OK? Two types, knock-out, break-up, and direct capture reactions.  You have individual collisions between the particle and the single target nucleon, OK? And the incident particle emerges with reduced energy. This is in elastic scattering. What is not conserved in elastic scattering? The kinetic energy. That's it. Pick-up reactions. The projectile collects additional nucleons from the target. For example, djuteron plus oxygen 16, OK? Get what? Another proton, sorry, another neutron and leaves oxygen in oxygen 15 state, isotope. The same here. Stripping reaction is the inverse. What does it mean? The projectile leaves one or more nucleons behind to the target.  These are all typical direct reactions. Now, what are the compound reactions? It's the second category of reactions. Here we have following situation. The projectile with enough energy, or let's say, not high, but enough to do what? To go inside the target nucleus, start interacting with the nucleons, OK? Having collisions, sharing energy. But, as I wrote here, during this process one or more particles can be emitted and they form with residual nucleus, the products of reaction known as pre-equilibrium, OK? So it's an intermediate phase where you don't reach equilibrium. Equilibrium means all the energy that you can give is shared by all nucleons. You are somehow selective, OK? This is the first phase of compound reactions. The compound nucleus, which is the next phase when this equilibrium has been reached, OK? The largest possibility is the continuation of the aforementioned process so that the initial energy is distributed among all nucleons with no emitted particle, OK? In this case you create a system with one more extra nucleon, OK? And you have the compound nucleus. In this picture you see the direct. In the case of the direct reactions, you have a single interaction before emitting a particle. Pre-equilibrium, you have a small number of interactions before emission, OK? In compound nucleus you have a large number of interactions before emission, and in this case, in most of the cases, it's gamma, OK? Now here you have again in the pre-equilibrium phase in elastic scattering, transfer reactions, knockout or heavy ion reactions. I saw you before, OK? And this phase is favored above 10 MeV, OK? And the compound nucleus contains resonance scattering evaporation, including radiative capture and fission. We don't have time to go all this through, OK? I just want you to make clear in your mind that the reactions, OK, they differ because of their time and because of their mechanism. Don't ask me, I don't know. There is some prompt. You tag your product, OK, in coincidence with your projectile. Yeah, but not in that scale. Yeah, but you make delays and whatever, or indirectly. You have a way to find this. You cannot measure the direct lifetime. That's true. No, no, no, no. No, no, no, 10 to the minus 20. Nanosecond is 10 to the minus 9. Picosecond is 10 to the minus 12. Femtosecond is 10 to the minus. So it's, you get this number indirectly, OK? What is my technique? OK. Yes. No, the pre-equilibrium, let's put it that way. At low energies, when your particle enters your target, you don't have anyway enough energy to kick out some particle. Which means what you have, you are the good summary. You just give them all, you know. You share your energy with all the nucleons. And because you share the energy with the old nucleons, you have to make a lot of collisions with them. So it takes time. Whereas if you have a little bit more energy and you can send some nucleons out, OK? But it remains some energy in your pocket. You want to share this. So it's an intermediate step. So now let's see what do we expect theoretically at least. OK? These are my reactants, OK? And they give me enough energy to go that high. Now, if I emit neutrons, OK? If I have, let's say, the direct mechanism, what does it mean? I emit particles, and these particles are populating my product, OK? In direct reactions, 99,9% is particle emission. And these particles usually end up in an excited state of a product nucleus. And because they are in excited state, then you see transitions between these excited states. And you see in your spectrum, just please look at like this, OK? You see discrete lines. If you have a compound nucleus with emission of neutron, you end up in a highly excited state, OK? Here, don't see the lines. This is really continuum. So any transition between these states is almost continuum. And that's why you don't see discrete lines. You see a bump, OK? And this part is the compound nucleus mechanism, and this is the direct mechanism, OK? So if you can create, if you have, let's say, the advantage or the privilege to have an accelerator and start shooting a target with the same projectile, up to 50 MeV, and you make the so-called excitation function, and you measure for every energy, the cross-section, at the end you will end up with something like this, OK? Just try to imagine it like this. Fine. Now, we said something about angular distributions, OK? And we want now to understand what happens if I have the three different cases, the compound, the pre-equilibrium, and the direct. How my angular distribution should look, is expected to look like. And here it is. In the direct case, OK, the differential cross-section, the cross-section versus angle, OK, will be around zero the maximum. It will drop. It will make something like this, a subtle point, close to 90, and then will drop completely, which means at the backward angles, I won't see anything, at the very backward angles. I will not measure any counting rate. Something similar is the pre-equilibrium. Why? Because the pre-equilibrium is something like in between the compound and the direct. And what is the key feature in the compound reactions that the angular distribution, the differential equation is symmetric around 90 degrees. OK? You see it here. Now, look here. This is the case. We measured the nothings. We measured e to the power of 89 p gamma. So we had the compound reaction with the emission of gammas. And what you see there are the angular distributions of some transitions. OK? You see that when I have an angular dependency, which is not always the case, OK, you see that I'm, this is 90. I'm symmetric around 90. It could be also like this, but it will be symmetric around 90. Now, if I take the double differential cross-section and look what happened, what happens in a reaction with protons where I can start from very low energies up to let's say 60 MeV. As I told you in the previous picture that was like this, OK, you have the compound, you have the pre-equilibrium and then you have the direct. And the double cross-section here, it's sharp. You see all these sharp lines. These correspond to discrete states of the product, OK? Now, the point is that the energy scalar goes like this to the ascending, OK? Whereas the time goes like this, OK? As we said, very fast and direct, very slow, the compound and somewhere in between, OK? Now, this is a real excitation spectrum measured by neutron on uranium 238, OK? And here you have Xn, which means you can have various n's, 1n, 2n, 3n and so on, OK? As you see here, this is the total cross-section. The direct is this one, OK? The pre-equilibrium is this and this is fission because here we are at very massive nucleus, OK? Now, what can I learn from elastic and inelastic reactions? I measure elastic or inelastic reactions. Here you see the inelastic reaction of neutron on iron 54, OK? This is a real spectrum. You see a peak here, a second one. Two doubles here, a double here and a double here, a doublet, sorry, not double, doublet, OK? And here you see 0, 2, 4, 0, 6, 2. These are the spins of the states where the neutron, inelastically scattered neutron, ends up. Indeed, if you look the excitation spectrum of iron 54, you will find this is the zero here, the two here. The four is here. The zero is here. Another two is here and another six. This means I go there and I make inelastic scattering on something and I see these peaks. Some of those can identify. Can I identify? Some not. So if I discover this kind of peaks, what can I do? What can I say? This belongs most probably to an unobserved excited state. Fine. Now let's go and measure inelastic in the same nucleus, OK? In the same energy, OK? So this is not tungsten. It is, I would say Wolfram is in German, but tungsten, OK. So, here is the angular distribution in the elastic case, OK? You see all the differences here. Remember the previous figure. And here you see the inelastic, you see this distribution corresponds to two plus, the four plus and the six plus. And indeed, the two plus, the four plus and the six plus. Sorry. No, these are particle spectra. OK. I think this is the last one. If you want to continue tomorrow, we can continue here, OK? From here. Final slide for today. Reaction mechanisms for capture reactions. What are the capture reactions? The capture reactions is a special case of compound reactions. What happens here is that your projectile goes to your target. You create a compound system in equilibrium within 10 to the minus 18 seconds and then you emit particles or gamas, OK? So this is the famous way to writing the nuclear reaction and it was said before in the first slides. And this is the capture reaction, OK? The star is here and instead of B plus B you have the C, de-excited plus the gamas that de-exciting the nucleus. And this is your capture reaction, OK? It's 12.30. So if you want me to continue tomorrow I have in the following various experimental slides to show you, OK? It's up to you. If you don't want this, I will make a recap. It's not a recap. It's actually my way of seeing the topic of the workshop, OK? Accelerators, detectives, and so on, OK? So we will close this tomorrow and I think the second hour I can show you something maybe funny, OK? So enjoy the lunch.


Hello. Hey, hello, everybody, welcome to the Lattice session and Danieli Michandra talking about trapdoors for hard lattices. And so as you know, mainstream cryptography is based on the problem of factoring numbers or extracting discrete logarithms and many other problems from number theory. So in this talk, as well in the next talks, you will hear about lattice cryptography. These are cryptographic functions based on computational problems on point lattices, which I'm going to define soon. But anyway, lattice is a discrete arrangement of points in space. And lattice cryptography is interesting for several reasons. On one hand, typical operations in lattice cryptography is the addition of vectors in n dimensional space. So these are very simple operations consisting of many additions of small numbers that can be executed in a paradigm. And lattice cryptography, as far as we know, is resistant against quantum computing. There is no known polynomial time quantum algorithm for lattice problems. And their constructions are supported by a surprising connection between average case and worst case complexity that justifies the selection of certain probability distributions to pick random keys. And recently, lattice cryptography has also generated some of the most amazing discoveries in cryptography, like the development of fully homomorphic encryption by Craig Gentry that, as far as we know, can be built from lattice assumption but nothing else. All known constructions, so far, are based on lattices. So what is a lattice? A lattice is a set of points in space, points that are arranged in a regular manner. You can define a lattice as the set of integer combinations of n linearly independent vectors in Euclidean space. So in this case, we have a two dimensional lattice, B1 and B2. And the lattice points are given by sum and differences of these vectors, like this point is B1 plus B2. So using matrix notation, you can represent the lattice by a matrix, a matrix with a basis vectors as columns. And the lattice point is given by a matrix vector multiplication. You multiply the basis matrix by an integer vector x. The same lattice can have several bases. For example, these two vectors, C1 and C2, generate exactly the same lattices, B1 and B2. And in fact, you can define lattices in a basis independent manner. You can define a lattice as a discrete additive subgroup of Euclidean space. So lattice points can be added together, but they are not a vector space. It is a discrete set of points. This gives other possible methods to define lattices. For example, you can define a lattice as the set of solutions to a system of linear equations. Here in the example, we have a lattice described by matrix A. A is not a basis for the lattice. So the lattice is defined as the set of solutions to the system Ax equals 0. And we take all the integer solutions. So this clearly a lattice because it is a subgroup. It is closed under addition and subtraction. And it is a discrete set of points because all the points are integer. Now, there is a slightly different but even simpler method to introduce lattices, which is going to play a role in this talk. So let's start from the simple possible lattice in n dimensional space. Take the set of all the integer vectors, all the vectors with integer coordinates, Zn. So this is a very simple, regular, orthogonal lattice. Now, so far so good. And any other lattice can be described. So the lattice generated by the matrix B can be thought of as the result of applying a linear transformation to Zn. So think of B as a linear transformation rather than a generating set. We take our integer lattice and we apply the linear transformation B to turn it into a different lattice. Now, it is clear that all lattices have the same algebraic structure. They have the same structure as an additive group. And by applying this linear transformation, you can map any n dimensional lattice to any other n dimensional lattice while at the same time changing the geometry of the lattice, which is the typical parameter of interest in both computational problems and cryptographic constructions. For example, by applying a matrix B, the minimum distance of the lattice, the minimum distance between any two lattice points is going to change. So we'll go back to this view of lattice in a moment. But first, let's move to cryptography. The typical cryptographic function, one-way function based on lattices, is specified by a matrix A and n by m matrix with integer entries, which are chosen at random model of Q. So here n is some security parameter. I think of n as the main parameter that describes the scheme. And Q is the modulus, is a polynomial in n. So numbers, modulo Q, are very small numbers. Are numbers with the order of log n bits that typically fit a single machine level register. So nothing like the big numbers used in RSA. And the other parameter, the number of columns of the matrix A, m, is a larger integer, but still roughly equal to n. It is typically set to n log Q. So it is quasi linear in the security parameter n. So the most simple function you can define using this matrix is the matrix vector multiplication. Take a function that uses the matrix A as a key and on input, a vector x outputs A x, modulo Q. Now, of course, if x is unrestricted, this function is easy to invert. Inverting the function is the same as solving a system of linear equations. In order to make this function into a hard to invert one, we restrict the input x to the set of short vectors. If you do so, you get a function which is hard to invert. This function was introduced by Itai. The corresponding inversion problem is called the small integer solution problem, the problem of finding a small solution to a system of linear equations. And it easily yields collision-resistant hash functions. Now, for typical values of x, short but not too short, x can take more than Q to the n possible values. You see, Q to the n is the size of the range of the function. And if x is not too short, the function will still be hard to invert. But it is also surjective. Every possible output can be obtained by choosing x properly. Another function, which is also used in many cryptographic constructions, is the so-called learning with error function, introduced by Regev. And this function is also indexed by matrix A. This time, we multiply A to the left by an arbitrary vector S. S is not short. It's a random vector modulo Q. And then we perturb the result by adding a very short noise vector E. Now, x and E play essentially the same role in these two constructions. But typically in function G, in the LWE function, E is even shorter. Now, there is a close connection between this function and these functions and lattices. Let's look at the first function, F. Now, we know that the matrix A defines a function by giving a system of linear equations. Take A x equals 0 modulo Q. That's the set of all the vectors which are mapped to 0 by this function. Now, when you evaluate this function on an arbitrary input x, you are specifying a coset, a shifted copy of these lattices. And the inversion problem corresponds to finding a small element in this coset. So the output using linear algebra can be used to identify an arbitrary vector in the coset, as well as the lattice of solutions to the homogeneous system. And the problem is, given a shifted copy of a lattice, find the shortest element or, equivalently, find the element in this lattice coset which is closest to the origin or to some other target vector. Now, the other function, the connection to lattices, is even more direct. You can think of the rows of the matrix A as a basis for the lattice. It's not quite a basis because here we are working modulo Q. So our lattices are always periodic modulo Q. So you can think of everything as repeating regularly when you shift it by Q units. So in the lattice, this is represented by always having this box, this Q by Q box inside the lattice. So when you multiply A by a vector S, you are essentially picking a random lattice point inside this box. And using as a basis the rows of the matrix A. Then we add an error vector to E. And you obtain a perturbed lattice point. And the inversion problem correspond to recovering the original input. So as I told you, for this function, typically E is short enough that the function is injective. If you put spheres of this size around every lattice point, you will get this joint spheres so that the output of the function uniquely determines the input. While in this case, you see there are many points inside this larger circle that gives the set of all possible points in the domain of the function, which are mapped to the same coset. However, just as a remark, syntactic differences aside, F and G are essentially the same function. You can show that they are equivalent using a lattice duality. And the real difference between these two functions is that in the first one, E is chosen as something which is short, but not too short. And the corresponding function is surjective, but not injective. While in the second case, the error vector is very short, giving an injective function, which is not surjective. But if you change the length of x and E in the two constructions, the situation gets reversed. And again, you get equally good functions. And one way function is based on lattices. Anyway, so this is not the main point of this talk. The main point is that computing these functions, F and G, in the forward direction, gives collision-resistant hashing, CPA secure encryption, and a little more. So the more advanced cryptographic functions based on lattices are based on also inverting these functions. They require to compute in pre-images. So inversion for G is very easy to define. It's an injective function. You want to find the unique pre-image. In the case of surjective functions, which are not injective, you have to be careful. So the notion of inversion that turned out to be useful in most application was put forward by Gentry, Peichert, and McDonathan, where you want to find not an arbitrary pre-image, but you want to sample a pre-image according to the conditional input distribution. Now, the input axis is usually chosen using a Gaussian-like distribution. And you want to sample the lattice coset of pre-images again with a discrete Gaussian distribution. So this can be done if you have a good basis for the lattice. If you have a basis consisting of short vectors, then you can both solve the unique decoding problem for G and also the sampling Gaussian sampling problem for the function F. Now, these functions, once you also know how to invert them, you can do quite a few things with them, CCA secure encryption, IDE, hierarchical IDE, oblivious transfer, and many, many, many more constructions. And it is known how to generate matrices together with a basis consisting of short vectors. So the first construction was proposed by Ita in 1999, and a simpler construction was given by Alvin and Peichert in 2009. However, the construction is very, very complicated. And also the resulting algorithms are not entirely practical. They either solve the inversion problem very well with good performance in terms of quality of solutions. But the algorithms are slow. They use floating point numbers, and they are inherently iterative sequential. Or there is a different class of algorithms which desirable properties like parallelization and the ability to move most of the computation to an offline stage. But then they have worse performance in terms of quality of solution returned. So in order to illustrate this quantitative aspect, let's go over the parameters. We have a matrix A, which is N by M. Typically, M is equal to N log N. And you have a basis, a good basis, which consists of vectors of length roughly equal to sigma. Now this sigma will be the standard deviation of the vectors of each coordinate of the vector produced by the inversion algorithm. Now if you run your inversion algorithm, you will obtain pre-images of size sigma times square root of the dimension. Now for this function to be one way, finding vectors of this length should be hard. So finding methods to generate a random lattice together with a trapdoor should aim to produce vectors with small sigma and M. So you can set N and Q so that finding vectors of length beta is hard. And the smaller M and sigma, the harder it is the corresponding inversion problem. So you get the same time, smaller keys, and harder inversion problem underline the constructions. So in our work, we give a new method to generate lattices together with a new notion of trapdoor, which is closely related to a basis but not quite the same. The method is very simple and fast. The key generation consists of a single matrix multiplication. While previous methods required complex algebra, Hermione normal form computation, and other polynomial time algorithms which are not quite practical. And the inversion is also very, very simple and practical. It is parallelizable. Most of the work can be done in an offline stage. And there is no trade-off between efficiency and quality. It gives the best possible optimal quality in terms of sigma, standard deviation of the inversion algorithm, and also efficiency. And the parameters themselves and sigma are quite a bit smaller than previous work. As an example, we get dimensions which is smaller by a factor 32 and standard deviation smaller by a factor 25 for typical instantiations. And this already gives an improvement between 1 and 2 orders of magnitude in the size of the resulting keys. Plus, as we use a different notion of trapdoor, which instead of being an n by n matrix, it is a n over 2 by n over 2 matrix that gives an additional factor in performance. Once you use this within applications, then you can also use the special structure of our trapdoor to get further improvements. Like all the applications based on key delegation, like hierarchical identity-based encryption, you can reduce the size of the key from quadratic in the dimension to linear in the dimension. So here is a brief summary of the parameters I don't really ask you to go over the numbers. But just to give you a sense, you get somewhere between 1 and 2 orders of magnitude in the improvement. And also in the asymptotic setting, the improvement can be significant. It can be logarithmic in Q. So it goes to infinity as the dimension grows. So I'll give a brief sketch of how the method works. So what we'll do is to start from a very simple lattice, G. So here I drew the integer lattice. That's not just to suggest that the lattice is very simple. But yeah, it's not quite Z. Zn does not work. So it is this lattice, which is almost as simple as Zn, but some desirable features. And some of the desirable features is that it allows for very fast inversion of these functions. And then we will transform this lattice into a random one by applying a random transformation, which is also nice. It has low distortion, and it can be computed in both the backward and forward direction very efficiently. So this gives a very simple method to perform the inversion problem in the random lattice by starting from an arbitrary target point, using the inverse transformation to map it to the simple lattice G, solving the inversion problem in the lattice G, which can be done incredibly fast. So here inversion problem, which is typically quadratic, will be solved in linear time and also very, very fast in practice. And then you map the solution forward to the original lattice. And that's how you use the trapdoor. You use the trapdoor to go back and forth between these two lattice, the random one where the problem is hard without knowing a trapdoor, and this fixed lattice. And of course, this transformation introduces distortion, so you need to do some extra work to fix that. But that can be done by choosing proper parameters, using transformations with low distortion and using a perturbation method from the coding algorithm of Pykert from crypto 2010. Now I'll give a brief description of this magic lattice G that allows to do this. So take a vector G, which has k entries where k is the logarithm of q. For simplicity, let's set q to be a power of 2, though this is not necessary. And our vector is given by 1, 2, 4, all the powers of 2 up to q over 2. And let's take the lattice defined by the linear equation Gx equals 0. And this lattice is a very simple and nice basis. It's a basis with 2 along the diagonal and minus 1 below it. And if you see, when you multiply one column by this vector, you are subtracting one coordinate from twice the previous one, and they cancel out. And for the last coordinate, you have q over 2, which is multiplied by 2. And again, you get 0 modulo q. So these are very simple lattice with short vectors. It is almost orthogonal. If you take the Gram-Schmidt orthogonalization of the basis, you get twice the identity. It is sparse. Most of the entries are 0. And it is low dimensional. The dimension of this lattice is essentially log n. So the sparsity of the matrix already gives very fast inversion algorithms by using sparsity within the known algorithms. But you can also get very fast and efficient specialized algorithms just to give a hint of what you can do. Consider the problem of inverting the function f. And you want to find a small solution, x, let's say, 0, 1 vector, such that Gx is equal to some given y. So how can you find y? You can use one of these algorithms. Or even easier, you can just take the binary representation of y. And that gives you a vector, which is mapped by G to the desired value y. So taking binary representations of an integer number already gives a good inversion algorithm.  Doesn't seem very useful. So first, you can move to high dimension by taking a tensor construction. You take a block diagonal matrix with many copies of G along the diagonal. And it is clear that the inversion problem for this lattice consists of n parallel inversion problems for the low dimensional lattice. So we have, again, a linear time almost perfectly parallelizable inversion algorithm. We also get, by combining the basis together, a good basis, which is sparse, almost orthogonal, which can be used together with the previous algorithms. But there are new specialized algorithms to solve the inversion problem very, very efficiently in practice. So this is a fixed lattice. So it cannot, by itself, be useful as a cryptographic key. We want to transform it to a random matrix. And this is done in two steps. We first combine G with a random matrix A. And using the fact that G generates the entire space, it is very easy to reduce the inversion problem for this matrix to the inversion problem for G. So adding columns is something that has already been done in previous work. And there are standard methods to efficiently adapt the inversion algorithm. And in order to get a truly random matrix, we multiply our A bar G matrix by a random unimodular transformation. Unimodular means that the determinant is one, consisting of one on the diagonal, the identity on the two diagonal blocks, and some random matrix with small entries in the upright corner. When you execute this product, when you compute the product, you get an expression of this form, where AR is going to be almost random. You set the parameters in such a way that by the leftover hash lemma, these random metrics which will act as a sort of one-time pad and hide the underlying matrix G. And as a side remark, when G is equal to 0, this resembles some previous construction of ITI that was only giving weak trapdoor. So just one short vector. And the resulting construction can be improved if you settle for pseudo-randomness. So just one last slide. And so this matrix, this transformation matrix also has a very simple inverse. You see, you just need to change the sign of AR to get the inverse transformation. And it is clearly very easy to compute back and forth, giving very easy and simple and practical inversion algorithms for the result in random matrix A. Plus, you can batch many execution using fast matrix multiplication. And you can use this matrix to obtain a short, good basis for the new lattice. But you don't really need that. You can adapt all the applications in the lattice cryptography to make direct use of the matrix AR rather than building a full basis. So concluding, we describe the simple method to generate random lattice with trapdoors, which is much more efficient and practical than previous methods and bring lattice cryptography closer to practicality. Thanks for your attention. We have time for a quick question. Oh, thanks. That was unexpected. I took the time for the question. I'll be happy to take questions offline. We started a bit late, so we have a question. Rings. Yeah, the construction adapts in a pretty much trivial way to ring LWE and idea lattices. Yeah, the adaptation is straightforward. And the paper gives some details on how to do that. But yeah, it works just as well. OK, then let's thank Daniele again.


Here we go. How many climbers in the room? A few. So most people are not climbers. Most people think climbing is dangerous, right? And we'll come back to this climber when we come to some illustrations later. I want to talk about how we should think about integrating the domain of activities that occupies most of us right now, which is business processes, CQI, Six Sigma, Toyota. How do we get better value? You hear the dean speak about value, and everybody's supposed to know exactly what that means. With clinical research results and computer protocols, and how can we target Six Sigma performance, that's three errors per million interactions. Just think about that. Three errors per million interactions, and what the role of closed loop control is getting the clinician out of the way so that some decisions are made automatically by rule systems. Now, this is the reason why we need to be concerned about this. Here are two things that came across my desk just a few months ago. A Massachusetts survey done by the Harvard School of Public Health indicated that a quarter of the residents had encountered preventable medical error. A quarter of the residents in Massachusetts surveyed, and here even more compelling from the Journal of Advanced Nursing are the results of overstretched neonatal ICU nurses. Can you think of a more vulnerable population than neonates in an ICU, where sepsis is a catastrophe? 25% of them, in their last shift, missed appropriate IV site care. They knew they had to do it, but they couldn't get to it because they were overwhelmed. Well, this is a system that's waiting for catastrophic outcomes. Now, I'm going to discuss three major foci. One is the transactional unit, which may be new to some of you, the challenge of scaling and clinical performance target. So what do you think this is? What's the unit of analysis? Is it the patient? For example, if I ask you, what's the outcome of a patient with glaucoma? What would you say? So you may be reluctant to speak, but many people say, oh, this is the way it happens. But the key is that it depends upon where the patient is. A patient with glaucoma in Salt Lake City has a certain outcome. Same disease, same patient who finds himself in a rural village in South Africa who has to walk eight hours to get to a rudimentary medical clinic has a completely different outcome with glaucoma. There's no way to answer what's the outcome of glaucoma without understanding the context. And the context has to do with this blue box in which the patient is interacting with a clinical environment, with a clinical caregiver. That's called a transactional unit. There are transactions between the patient and clinician. And that is the unit that determines the treatment regimen, whether it's individualized, patient specific, and the outcome. Makes no sense to ask what's the outcome of a disease. No more than it makes sense to answer the question that some of the residents were asked years ago. What's a normal cardiac output? I mean, that question has two answers. If the professor asks, the answer is under what circumstances?  It's just as intelligent as what's the normal dress code. So context is determining. And we will come back to that. Now, the reason that this unit determines the treatment regimen is that each patient expresses unique patient-specific clinical data over time. Patients aren't the same. They're nonlinear, complex, biological systems. And you can't tell exactly what they're going to do. So let's ask, how are the clinicians doing? How are we doing in our contribution to this transactional unit? And that takes us to a very important issue, which is that we are all profoundly limited from the cognitive perspective. Now, that's an important thing to say, because we all think that we are at the pinnacle of biological evolutionary development. But our brains are, on the one hand, remarkable structures, and on the second hand, quite limited. So let's ask the question, how good are our perceptions for identifying credible evidence? That's another way of saying, how good are we as censors for determining how the world works? Because that's what we're after. If you know how the world works, if you know how the lens works, then you can do some things about it. If you don't know how the lens works, then you're out of business. So take a look at this. These two squares are identical shades of gray. Yet everyone in this room will put 20 bucks on the table and say that they are different. Now I'm going to show you that they're the same. And we're going to still see them differently. So watch this. Oops. This square is being moved over here. And it'll be moved back. And when it's moved back, it will overlap a little bit so you can see that they're different. But they're the same. Now even when you know they're the same, we see them as different. And the reason I've just learned from an interesting neuropsychologist in London is that our brains see the shadow from this cylinder, even though these two have the same luminosity, knowing that this one is in the shadow, right, and should be darker because it's in the shadow, makes our brain convert the equivalent luminosity to something that's lighter because it appears the same. Sounds literally crazy. But Neil deGrasse Tyson, the director of the Natural History Museum in New York, a physicist, said something very important. He said, rather than calling this optical illusions, we should call them brain failures. And it is really true.  And that's very important to understand because all of us think we're experts and all of us think we're well-trained. In fact, when was the last time at a national meeting you ever heard somebody volunteer that, well, I was actually not in the top 5% of the class. I was in the bottom 5%. Or I was not well-trained when someone else says, well, listen, I was well-trained and this is what I want to do, right? So this is very important for moving ahead. Now, what are the consequences? Well, these consequences were brought to my attention by one of my colleagues who gave a grand round on hypertension just a few weeks ago in medicine. First of all, physicians don't adhere very well to hypertension guidelines. Hypertension is a huge medical problem and we don't do what we're supposed to do. And second, he said, the only way we're going to get proper measurements, accurate and credible measurements of blood pressure in the office is to use automated devices. We've got to remove the humans from it because we muck it up. Very interesting. If we can't measure blood pressure properly, well, what about visual fields? What about you could fill in the blanks? So one of the consequences of our inability to deal with situations that are complex is that the guidelines we're given are not adequately explicit. They have inadequate detail. Guidelines are very high level. They contain statements like reduce world famine, right? Make peace in the Mideast. I mean, nobody's going to raise healthy teenagers. Nobody's going to argue with that, but how do you do it, right? I mean, the details are not trivial. They're crucial. And the decision maker must do two things. Must add information and must make the right decision. Well, almost always, the right decision is unknown. I mean, science is an ongoing dynamic process of moving towards better understanding of the world. It's not as if we know what's absolutely true. So let's consider glaucoma, which I consider an overwhelming problem. You've got visual acuity, visual fields, picimetry. I learned that that was measurement of the thickness of the cornea, right? Isn't that right? Yeah. The eye exam involves variable judgment. You've got people saying, oh, yeah, I do. I don't see this or arguing about it. Pressure threshold, when I was taught in medical school, there was a threshold above which glaucoma was very likely. And then when I became a physician, I learned that there was low pressure glaucoma. So what's the threshold? I haven't the vaguest idea. I'm guessing the threshold is like blood pressure. It's the lowest pressure you can sustain that still maintains the physiologic function of the globe. Just like the best disease to have for with regard to blood pressure is the lowest blood pressure you can have without fainting or getting dizzy when you jump out of bed. Then you've got drops and pills, beta blockers, alpha agonists, carbonic anhydrase inhibitors, plastic anids, each with about, according to my expert consultant, about four variations. That's four times four times two. That's already 32 possible things that you can touch without worrying about combinations. And without worrying about not only combinations, but the sequence of the combinations and the doses of the combinations. And then you've got trabeculoplasty, conventional surgery. And then I looked at a website, which I've listed down here. I counted about 90 systemic and about 150 local risk factors for glaucoma. There are thousands of combinations of these variables for glaucoma. So that leads to a very important question. How many variables can humans manage when they're making decisions? And that actually is a very interesting subject that's been studied extensively for the last 80 or 90 years. So the number of conceptual objects, the psychologists call this chunks, that can be retained in short term or working memory before decisions are degraded. We don't want degraded decisions. Was originally published in a review in 1956 by Miller, a professor at Harvard, as seven. The title of the paper is The Magical Number Seven plus or minus two. But more recently in behavioral and brain science, it's estimated to be four plus or minus one. Thousands of combinations just for glaucoma and our brains are limited in short term memory to just a few constructs when we're making a decision. So this is a huge mismatch. Even though medical students are still told that the way to make the best decision is to get all the information, look at all the lab data, look at all the tests, and then use this computer between your ears to make the best decision for the patient. Something which for over 100 years we have known is humanly impossible. So we still teach medical students to do something that's impossible. So here is a reflection of that. This is a patient enrolled in a study of extracorporeal CO2 removal, heart-lung machine used. Yes, we'll come back to that because it, right. So the chess master, that's a good example. Actually, I think psychologists would argue that the constructs that the chess master uses are very data rich so that it includes a whole bunch of possibilities and patterns. Whereas the beginning chess player is sitting there and she's thinking, let's see, the pawn is just one box. Is that or is it two over, right? So the content of the constructs can be very different. So the expert ophthalmologist will have a very rich content, but the number of constructs that appear to be manageable in short-term memory is limited to four, seven. Doesn't really matter whether it's four, seven, 15 or 20. It's trivial compared to the enormous amount of data. Let me go back and we can come to that again. The subconscious involves pattern recognition. That's, if you're familiar with Kahneman's book on thinking fast and slow, the subconscious is system one thinking where pattern recognition is operative. So here is the patient, right? Here are the lines connecting the patient's groin vessels with a heart-lung machine over here, 10 IVs, mechanical ventilator, the patient's on a bed scale. This is a complicated system. So this is where we first developed a computer protocol to generate patient-specific or personalized instructions. And the issue here is that in this room, this patient has many more than 236 variable categories. I went to a room of a patient and I just counted the categories that were readily available, systolic blood pressure, diastolic blood pressure, urine output, and so forth, breathing rate. I ignored everything that was hard to touch. I ignored CT scans, echoes, consultation notes, doctors' notes, nurses' notes, therapists' notes. And I counted 236 variable categories right off the bat. So there's this terrible mismatch between information which overloads the clinician and clinicians' observations. Now, can that lead to problems? Let me give you one example. This is, these are two clinical observations from the Extracorporeal CO2 Removal Clinical Trial I've just illustrated. This first patient is a 53-year-old lady who had acute respiratory distress syndrome that's a life-threatening lung failure. And after she was enrolled in the clinical trial, had a sudden neurological catastrophe, the bedside clinician recognized that she was brain dead and a CAT scan revealed air embolism. And you can see these black, serpiginous, and oval shadows represent air in the cerebral vessels. This lady had a catastrophic consequence which is known to be a complication of heart-lung machine use. All those connections of the tubes are places where air can leak into the system. And so what is the conclusion? Well, if I was presenting this at an international meeting, you better be damn sure you're careful if you're gonna do heart-lung machine support. This is not for any Tom Dick and Harry. Know what you're doing, right? This is an example of how you can get into trouble. And here are just two of many illustrations. She had air in every organ in the body. Here's air and blood coming out of the vena cava. And here are bubbles of air in the omentum. There were air in the coronaries. There was air subcutaneously. This was a disaster, right? So here's the second patient. This was a 27-year-old woman with acute respiratory distress syndrome following pneumococcal pneumonia, ordinary pneumonia. She deteriorated for five days in a Wyoming ICU and arrived in grand positive septic shock. Now, for those of you who remember blood gases, her arterial PO2 was 26 with a positive end-expertory pressure of 27 while breathing 100% oxygen and a systolic blood pressure of 60. When the positive end-expertory pressure is higher than the PO2, you know you're dealing with a catastrophic illness. I left the ICU after enrolling her in the clinical trial at eight in the evening and thought to myself, she's going to be dead before I get back in the morning. She flew home to Wyoming 10 days later. She satisfied all of the criteria that are published about de jure death that allow you to do whatever you want to the patient because the patient is a dead duck, can't possibly survive. So presenting her to an international meeting is what? Yes, this is why you have to do extracorporeal support. And we have very few observations in clinical medicine that are more compelling than these two. So here they are in summary. Be careful because you can hurt people and do it because it's life-saving. And the interesting thing about these two patients is they were both enrolled in the control group of the randomized clinical trial. Neither patient had any contact whatsoever with a heart-lung machine. So are observations a good reflection of the way nature behaves? Be cautious because they can frequently lead you absolutely in the wrong direction. In fact, here's a quote from Michio Kaku, a physicist who writes for the general public. If appearance and essence or truth were the same, we would not need science. We wouldn't have needed the reformation, the renaissance, the enlightenment, right? Bacon and all of the contributions they made. So one's opinion, which is based upon what we see and how we perceive it like those two gray squares that are different shades when they're actually the same is no guarantee of proper behavior. Remember this young man who's very proud of his performance and we tell you that he's really on target. Opinion and arrogance lead to error. Arrogance is maybe why the normative church included arrogance or pride as one of the seven deadly or capital sins. And dimming himself said experience by itself teaches nothing. Experience without science, very, very flaky. So let's turn to the challenge of scaling. What do I mean by that? Well, this is a question that I wanna put on the table. Can important current initiatives lead to favorable clinical decision support at the patient encounter scale where you are encountering a patient and have to make a decision like this lady who had trouble seeing because of the veil. Are there emergent properties? Properties that are not predictable but emerge when you take simple things and join them together to make a complex system. What are current initiatives? Well, our most important current initiatives are initiatives from the business side. Quality improvement, lean, zero patient harm, things that take a lot of our attention these days because most health care institutions want to more than anything else avoid bankruptcy. But I'm gonna deal with two different scales. One is the reductionist scale where we break things apart to their simple components and study them. So you can think of genomics in the biochemical laboratory as being down at the reductionist scale. And the other is the integrated or holistic scale where we deal with business initiatives. So let's consider that we can study parts separated. Isaac Newton, you may remember, said if I knew the behavior of all of the celestial bodies in detail, I could predict the behavior of the universe. That's the reductionist mentality. People don't believe that's any longer true. So you go from parts separated and studied in special laboratories to the integrated or holistic system. And let me show you how I view the scale of inquiry and the laboratory that's appropriate for that. First, if you're interested in chemistry, in genetics, for example, you need a biochemistry laboratory. If you're interested in self-physiology, you need a self-cultural laboratory. Remember, each of these laboratories has its own environment and its own tools. No reasonable person would try and study the heavens with a microscope or cells with a telescope, right? They have tools that are configured to operate at the scale of inquiry. If you're interested in pathophysiologic changes, then you need human measurements that are credible. If you're interested in medical outcomes, you need a clinical outcome environment that can function as a clinical laboratory. Think if the environments you enjoy can function as a clinical laboratory. If you have societal interests, you need large databases. We frequently use administrative databases like Medicare databases to answer questions for which they were never designed, like what's the best therapy at the lowest possible cost, which on the surface seems rather silly. And then, if you're an evolutionary biologist, you look at populations over time. Now, I'm gonna argue that you should recognize that translational research involves the movement between these different scales. Now, the NIH, when it talks about translational research, almost always only means, well, what kind of genomic information can we move up to the medical scale? But in fact, that's a very limited view. Translation has to do with movement in both directions. And the key here is, what kind of information do we need at the medical scale so we make good decisions? So the lady with the veil over her eye that blurs her vision, doesn't get a, yeah, a glazer treatment that enables somebody to fill the tank of a BMW, but doesn't help her. So let's start with biochemical information. Can we move from the biochemical level with confidence up to the medical scale? So here is the scale of inquiry going from biochemical. And I'm gonna discuss with you a disease in mammals, including humans, that's associated with inheritance of only one of the two elastin genes. So the individual mouse or human is hemizagous for elastin. You'd expect with only half of the elastin genes present at the cell physiology level, you'd get half the elastin. And in fact, that expectation is confirmed. Here are mice, homozygous and hemizagous with only one elastin gene. And you can see the black elastin lamella here about half as big as the lamella in the homozygous. So everything is okay, but now comes the problem. It's not possible to anticipate an emergent property. What is the emergent property that comes at a higher level of scale? Well, the organ that's subjected to stress like the A-order that's pulsatially enlarged and contracting winds up with an increased number of lamellae. Here's the mouse with two genes and the mouse with only one gene. Look at the large number of elastin lamellae. Well, that's not anticipated from knowing something at the biochemical level. That's a new property. And more important at the pathophysiological clinical scale who could ever have anticipated that people would develop a disease called supravalvular aortic stenosis. Why? Well, here is the normal control aortic wall and here is the wall of the hemizygote with only one elastin gene with the increased number of lamellae that increases the wall thickness so the lumen is compromised and the patient behaves like they have aortic stenosis but they have a normal aortic valve. This is an emergent set of properties that can't be predicted from the biochemical scale. So the answer to the question, can you go from the biochemical level to the patient clinician encounter scale reliably is no, you can't do it reliably. Can you score sometimes? Well, sure. My wife and I just came back from Las Vegas. We could score sometimes but I can tell you that we could not reliably score. What about meta-analysis? Right at the clinical scale we have large numbers of studies that people try and using statistical tools to aggregate to lead to compelling conclusions. Well, here is an interesting study published now almost 20 years ago by DeLaurier. 19 meta-analytic results that preceded a subsequent randomized control trial. How good were they at predicting the results of the scientifically credible study? Well, they were okay two out of three times. They were only wrong one out of three times. The CAPA score was rather low and that means that false positive and false negative rates are one out of three. Right, would you put in a lens in somebody's eye if you figured one out of three times you'd screw it up? I doubt it. We can come back to that and we'll talk about concordance of results when we come to electronic protocols. That's an important perception. So the answer is once again, not reliably, right? Well, what about business process initiatives where most of us are now focused, right? CQI, lean, Toyota, zero patient harm, can they lead to favorable clinical decision support at the patient clinician encounter scale, right? So can you go from business process? I've now enlarged the clinical scale to include societal because business processes cross a number of societal domains that's not really too important. Let's ask if we can go from there to clinician patient encounter. Now here it becomes crucial to recognize that within this transactional unit in which the clinician caregiver and the patient are interacting, they're both surrounded by a context, right? I mean, if you work in an environment that doesn't have a slit lamp, your options are constrained. If you don't have an operating microscope, your options are constrained. If you're in a clinic in a rural part of India or Namibia and you've run out of topical anesthetic for the eye, your options are constrained. So the context is crucial, right? And the context enjoyed by the clinical caregiver may be different from the context enjoyed by the patient. In India, in some clinics, they don't have beds. So the patient sleeps on a mat. So if you wanna order an air insufflation bed to prevent bed sores, you're out of business. So where do the business process models that we're so invested in work? Well, they work primarily on the context. They don't touch the clinical caregiver directly, but they work on the context. How do they do that? Well, they map the process. We deal with workflow, clinician decision flow, governance, training, strategy, and standardized treatment. You may have a different perception than I, but I have yet to meet an administrator who knows what standardized treatment is. It's commonly touted. We wanna standardize the treatment. I don't think they have a clue, but that's what business process deals with. Now, does this unburden the clinician? Remember, the clinician is overwhelmed. The nurse who can't one out of four times attend to proper care of an IV site in a neonate in an ICU can't do that because he is overwhelmed. And what about clinicians? I mean, I can tell you the primary care clinicians get 10 minutes to see a patient in the clinic. It took me more than 10 minutes when I was in clinic to dump out all the patient's medications from two big brown bags on a stretcher and go over the meds and find out that they had three active digoxin prescriptions and multiple lists and so forth. So, I mean, how do you do the job you're expected to do? Impossible, you can't. And Larry Weed has been writing about this since the 1970s, that we're asking clinicians to do things that can't possibly be achieved in an unaided environment. So, these are high level aids and the clinicians must still make every decision, right? These can rearrange information presented to the clinician. They're desirable, I encourage their use, but they can only get us so far because the overwhelmed clinicians still has to make every decision, right? I will talk about training, just to point out to you that we tout training and education, but I'll remind you that we've been training about hand washing and proper hygiene for over a century since Lister introduced the technique in England in the 19th century and the compliance with proper hand washing procedures and two surveys done last year in major U.S. networks varied from six to 71%, right? How many of you would be excited if your child came home and said, oh, listen, I had a 33% improvement in my performance on the math test. I got 15% right last semester and this semester I got 20% right. Hardly a stimulus for familial celebration, but that's what we deal with in medicine. And we have to recognize it. So business process, translation, the patient clinician encountered, not reliably. So what does this mean? Well, we have to obtain the information here. This gets back to the question of, well, what about trials that have dissimilar results that only propagate confusion? And that's most studies. Well, we'll come back to that. How do we obtain the information here? And I'll talk about tools for obtaining the information reliably. So after we obtain the information, what about performance of decision support tools? If we had decision support tools that collated the information for the management of glaucoma and we had that captured and it returned to the clinician or even automatically made for the patient decisions about what changes in medication and what changes in doses and so forth, what kind of compliance do we need to make this happen well so that we're performing at a level which comes close to airline performance, right? Alan Crandall just told me he just got back from India after getting back from some other place and I don't remember, may have included Mars, but he wouldn't get on a plane. If he thought the chances of having an unfavorable outcome on the plane were anything close to the chances of unfavorable outcomes in clinical environments. So here it becomes important to distinguish two kinds of decision support. Single event from time series. What a single event? Well, reminders, right? It's time for mammography. It's time for your repeat colonoscopy given your age and background. Order sets, admission and discharge processes and even some simple protocols. Somebody comes into the ER, we have a protocol with the Ottawa ankle rules so that you don't have to do x-rays unnecessarily and go through a particular examination, right? What about time series? What about the management of the patient with glaucoma that's refractory to ordinary therapy? What about the management of the patient with chronic rheumatoid arthritis or inflammatory bowel disease or heart failure or atrial fibrillation that's persisting? Where you're seeing the patient time and time again and you're now going through a series of titrations and responses to patient expression of the disease. Well, those can only be managed as far as I can see with detailed computer protocols that capture multiple levels of reasoning. And you could also use detailed computer protocols to do the single event but whether it's worth the effort or not is not clear because you can get pretty good response from other things. So what should our target compliance be, right? What compliance is needed to make medical care safe enough? So let's turn to clinical performance target. And for that, I wanna present to you some data from an ICU at the Hebrew University Hospital in Jerusalem. A closed ICU, closed staff, run by very, very vigorous and careful and domineering directors, right? Study was done in collaboration with the clinicians by experimental psychologists from the Technion, the Israeli counterpart of MIT. They observed that for the patients in this ICU, there were 176 interactions on average per day. So the nurses and doctors were doing 176 things on average to the patients per day. They were correctly performing this 99% of the time. Ask yourself if you can point to a clinical environment where you can confidently conclude that the people in that environment are operating on average at a 99% correct performance level day in and day out. I don't know any. Now, this translates into about a four sigma, a four standard deviation performance. That is about 6,400 errors per million interactions. Now, this means that there are about 1.7 errors per day. That's 1%. Those 1.7 errors per day were distributed into two groups. Most of them were minor, had nothing important to contribute to any outcome, but 29% were a major threat to life or limb of the patient. That meant on the average, every patient was subjected to a major threat to life or limb every other day. That's with a clinical environment operating at a 99% correct performance level. Now, let's come back to the climber. This is a Japanese climber climbing a cliff on the Mekong River in Laos. They're setting new routes. If he makes a mistake, he may fall like this Chinese climber, but you'll notice he's roped in and there's somebody at the bottom controlling him so he doesn't get hurt. Now, how do these pictures get taken? Well, here's the photographer, right? He's in that sling for three or four hours. The Hmong tribesmen who protected this climbing group built this bamboo strut that take him out, project him away from the wall, and he's supported from above three or four hours. And this is what he's picturing. There he is. Here's the climber, and here is the belay. Now, most people think that's very dangerous. Here is a belay controlling one and three-quarter climbers. There she is. There's the fetus, right? Right? He and all the belays are responsible for life and limb. Well, that sounds like what we're responsible for. Life or limb, life and limb, right? Now, I wanna show you the product of this gestation so you'll remember this. This is one day, one month, and about a year and a half, right? Do you think any of those people would put on a harness and tie into a rope if they thought that every other day on average, they would be subjected due to era of the belay or equipment era to a major threat to life or limb? Not a chance. So here is the interesting conclusion that in an ICU operating at a 99% correct rate, that's one era out of 100. Patients are exposed to a much more dangerous environment than climbers doing what you just saw. 99% correct clinical care is not likely achievable with current methods, and if achieved, it's certainly not adequately safe in the ICU. Now, what compliance do you need in the ophthalmology clinic? I have no idea, and that's why we need to study this. Maybe you need 99%, maybe you only need 80%. I'm guessing you need more than that. So we need to study this in different contexts. Now, how can we achieve the goals of Toyota and Six Sigma? That's 99.99966% error free. That's 3.4 million, 3.4 errors per million. And here is one of the mnemonics for doing that. Well, I think we can do that with tools like e-protocols, these electronic protocols that enable consistent clinician decisions linked to evidence. You cannot do it with guidelines or common protocols. 99. something percent of the protocols are just too high level and lack detail. These electronic protocols that my colleagues and I have developed have targets and guidelines have targets, like reduce world famine. But they also contain detailed rules to reach the targets and there's about a 95% clinician compliance in an open loop servo control manner. So the protocol returns an instruction about exactly what to do and the clinicians accept it 99 up to 98%, 95 up to 98% of the time. And I'm gonna argue with you that we should close the loop because closing the loop for those things for which we have enough evidence enables us to unload the overloaded clinician. So that she has time for other things because clinicians don't have time to do everything they need to do right now. So how does this play out in this transactional unit? Well, the computer protocols we've used that we've developed protocols for mechanical ventilation, intravenous fluid, blood glucose control. We use protocols for standardized interpretation of pulmonary function tests. We're now working on protocol for parts of the heart failure management. They standardized decisions for the caregiver. Now they reach in and touch the caregiver. It's not just a matter of changing the context. Let me show you one example of that for management of reactive hyperglycemia, stress hyperglycemia in the ICU, high blood sugar. There's a simple guideline that came from Tufts University, a bedside paper protocol from the University of Virginia and a bedside electronic protocol that we used at LDS Hospital. They all target the same thing. Here are the percent of blood glucose measurements from zero to 9% on the vertical axis and the blood glucose from zero to 350 milligrams per deciliter on the horizontal axis. And here is the target range, 80 to 110. We're talking about tens to hundreds of thousands of measurements. Here's the performance of the simple guideline at Tufts University. It's as simple as it comes. It's a closed unit. The guideline says get the blood glucose to between 80 and 110 and that's it. There's no argument from nurses or physicians. Here is the performance in the dashed line of the bedside paper protocol at the University of Virginia and here is the bedside computer protocol performance in the solid line at LDS Hospital. Now these are clearly statistically very significantly different but the important thing is that based on the best evidence at the time this study was done we expected a 6 to 9% absolute mortality difference so that if Tufts had a mortality of 40% in the ICU we'd expect the LDS Hospital had a mortality that could be as low as 31%. If you had a drug that reduced mortality by 6 to 9%, the first thing you do is call your family members and have them buy stock on the company. This is a home run. So this is a big deal, this is not trivial. So we exported this electronic protocol to these other two sites. Western is LDS Hospital, South East is Virginia, North East is Tufts and we also exported to the National University Hospital in Singapore and all of the differences disappeared. This gets back to the question of well what about different studies? Well different studies use different methods. These four sites now use the same method and this demonstrates that it's possible to export a method from a development site to other sites and have it perform the same. Now in addition, we also embedded this method, embedded the rules in the Intermountain Help System. So here is the research result I've shown you before from our research ICU, from almost 500 patients, 21,000 measurements and I'm gonna show you now the results of its use in clinical care after an announcement to the Intensivus Intermountain that if you're interested there's a protocol for managing blood glucose, you can use it or not among all the other protocols available. Almost 2,300 patients, almost 110,000 measurements. Now these are statistically significantly different but the real signal is that they're almost identical and here for comparison are the results from Tufts and the University of Virginia and this demonstrates that it's possible to actually export the tool from the research environment to the clinical care environment and translate research results into usual clinical practice. Now to respond to the question about what about conflicting results, here are from 12 different studies during a decade. This involves millions of dollars, a lot of effort on the part of the healthcare community. Here are the results with, here are the insulin infusions in units per hour on the vertical axis as a function of high to low blood glucose and this gray bar is the range of insulin infusions from the 12 different protocols used in 12 different studies that produced inconsistent results and this is the electronic protocol I've just shown you. Now what does this mean? Well it means that if Toyota or Mercedes built cars with this kind of variation of the production line they wouldn't be called Toyotas or Mercedes, they'd be called Ugos, right? They wouldn't be, they wouldn't have a viable business. This is no way for us to use our limited healthcare resources but we do it because we have no healthcare system and there's no direction, there's no coordination, right? Now this would not be acceptable in the RAT laboratory and in fact, in fact I've included an editorial from Marsha McNutt who is the editor of Science pointing out that science, nature, nature medicine, New England Journal, British Medical Journal and a number of prestigious outlets, NIH, are very concerned about the fact that this is the kind of reproducibility they're seeing in reductionist research. They're worried about the fact that the same laboratory can't reproduce its own results when they subsequently do a study. How much greater a problem is that likely to be in the clinical environment where we have the problems that we've broached? So didn't have the funding to pursue that. The mortality, well the results are variable. The biggest study which now drives decision making came from the Australia, New Zealand intensive care society in collaboration with the Canadian clinical trials group and they indicated that a preferable target was identified because it was associated with a lower mortality but they used a different method than we did. Oh, that's based upon other data not on direct measurements of mortality in those studies. Yeah, no longer used there. Because the FDA required us to remove the protocols and the people at Virginia, the nurses at Virginia went to the director and said what the hell are you doing? This is a better way to care for patients and he said we can't do it because the FDA doesn't allow us to. Funding was not adequate to pursue that. So e-protocols are clearly feasible, they can be exported across cultures, they can be used to translate results to usual care and I briefly mentioned these things for which I've not presented data. So what does this mean? Well, we can standardize 95% of the decisions of the clinical caregiver by reaching in and where does that lead us? Well, because the data come from the patient to these rules that are captured, we unburden the clinician. We present decisions, not data. So the clinician still has to accept or either accept or decline, but she has to accept or decline the decision, not look at the data and make her own decision, that's unburdening. But it's not as great as the unburdening that would occur if we closed the clinician loop and got the clinician out of the way, so we reduce the number of decisions. That would unburden the clinician because it reduces the decisions necessary, it limits the cognitive burden which is already excessive and I think, I don't know this yet, I think and was encouraged by the director of our medical informatics research program to include this because this is what administrators wanna hear. I think that it would reduce visits, reduce the readmissions, allow the patient to assume some care responsibility, something that is already recommended in medicine and increase patient satisfaction, but these have not been systematically studied. We can take data and have done this in two patients for 850 hours. We have millions of hours of use in the open loop mode, but we've taken two patients and 850 hours and closed the loop so that nobody has to look at the instructions, the data go right to the computer and the computer adjusts the mechanical ventilator and for 850 hours and these two patients have worked like a charm, there were no problems. I'll come back to that. For glaucoma, how would this work if someone were interested? Well, we collect from the patient data necessary, we generate patient specific instructions after going through a knowledge engineering process to capture the reasonable way to make decisions given data presentations and this would be presented to the clinician and we could omit the clinician by just presenting to the patient instructions with telemedicine, just sending to the patient, increase the drop in the bottle with the brown cap, preferably the brown bottle because caps can sometimes be switched from two drops twice a day to two drops four times a day, do that four times and then come in to the clinic to have your eye examination at 11.45, the appointment's already been made for Friday morning. That would remove that decision from the clinician and all we have to have for that is a reasonable set of rules that I suspect many people in this room are quite capable of doing if they were willing to invest the effort to make that happen. So even if we close the loop, the patient would still express unique patient-specific clinical data over time and the treatment regimen would still be individualized, personalized or patient-specific because when we present this to many clinicians, they say with a knee-jerk response, well, I was taught in medical school not to practice cookbook medicine but in fact, we do. Some post-operative care is cookbook. You know, if you're 80 or eight, you get 40% oxygen until you wake up and post-operatively after cataract implantation, you get certain treatments that are the same for everybody. That works but that's not what this is. So just so that you know I'm not talking about something very innovative, Lou Shepard who was an engineer at the University of Alabama published in 1977, closed-loop control results in 8,500 patients in the post-operative cardiac surgery ICU. 1977, worked like a charm, done for clinical purposes, unloaded the clinicians, unburdened the clinicians. Where have we been? Somewhere else. So to summarize, maximizing clinical quality and value requires expert clinicians we're never gonna get rid of clinicians. People who are afraid of losing their jobs are just unrealistic. Can imagine if we had everything to know about infectious disease, what would we have done when HIV was introduced and exploded in San Francisco? What will we have done with Middle East respiratory syndrome or SARS or Ebola? And if you think that's the end of those things, you and I have very different perspectives. So we're never gonna get rid of clinicians. Business process tools are needed to improve the context and these can address single events. What you do when a patient comes into the clinic and you enroll them and they indirectly unburden the physician, but replicable time series methods like the e-protocols I've shown you to close the loop and directly unburden the physician are where we should be putting some effort and this is absolutely ignored by the NIH, by the NSF and by others. And with that, I'll close and we have about six minutes left for discussion. Yeah, there's a good example. Dr. Olson mentions Theridoc. Theridoc is a company developed by people who originally did the antibiotic assistant at LDS Hospital in the 1990s, published in the New England Journal, seen as a major advance. The antibiotic assistant was in fact an assistant. It wasn't a replicable method such as those I've described here. I tried to get my colleagues excited about that. I was not successful about making it replicable, but there were some real challenges like getting information from X-rays. Even now, you can't get coded information from X-rays because the PAC systems were all independent but that's changing. So knowing something about infiltrates in the lung was very important for making decisions about and pleural effusions about antibiotics. But that's a good example. The antibiotic assistant was actually followed at LDS Hospital about 62% of the time. Not the 95% I'm talking about, but Theridoc has built a business on this and they're absolutely right. There is no way a practicing clinician can keep in her head all of the things you need for this and other things are obvious as well. Diabetes management, the three or four new oral agents for diabetes, the anticoagulant management, the new oral anticoagulants, that means it's just impossible to keep together. Okay, so the validity of the input data, of course, is crucial, but that's true of decision-making whether I make it myself or whether it's made by a set of rules. I mean, if the data are bad, then how can my decisions be any better than a protocol's decisions? So what the protocol does as far as I can tell is it helps us consistently link decisions with evidence and with reasonable rules as opposed to letting me fly unaided in which case you can anticipate fully that the decisions I make will not be consistently linked to evidence and will vary. And when I say me, if we took 10 of us, we would all make different decisions because there's a lot of very well understood inter-decision-maker variability, but there's also intra-decision-maker variability. So you can imagine that if you had to do some eye surgery and have one bad outcome, your decisions for the next several months may be dramatically colored by that bad outcome, happens all the time to everybody. So the issue here is consistency and reliability, which will, I think, answer the question, how can we do clinical studies better so that the results of the clinical studies are more credible and also might be transferable to clinical practice? If we have the methods in the clinical studies that are captured in electronic rules with all of the effort going into EMRs, we're likely to be able to introduce those rules as web services and get people to use the exact method that was used in the clinical study. But your point is well taken. Sure, so the question is, the question is, doesn't eProtocol have to be standardized in the same way with randomized clinical trials as the ultimate determinant of whether it's better or not. It's only been done once. In the 1990s, we exported our mechanical ventilation protocols to 10 institutions in eight cities in five states, none of which were involved in the development of the rules. And we didn't have enough power to look at mortality, but unfavorable consequences like new barotrauma, air leaks in the lung were reduced in the computer protocol group versus the clinician, unaided clinician decision-making group. And in that RCT, the bedside carts that included a computer and a mechanical ventilator were identical in both groups, both the intervention group and the control group. The only difference was the intervention group received instructions, the control group received none. But the data were incorporated in the same system and the same mechanical ventilators were used. So that's, well, we only did 200 patients and we didn't have enough for mortality power. That was done in the 90s. I'll have to look back and see if we had ICU days. But it reduced barotrauma, which is one of the unfavorable consequences. If anybody is interested, I'm very pleased to chat with you about this. My email is alan.mores. At imail.org, that's the best one rather than the university email.