Hi, this is Brahman Shetty, I'm an assistant professor at the University of Michigan in Dearborn. I'm going to talk about machine learning, trustworthiness. So the title of my talk is State of the Model, Promising Steps and Remaining Challenges Towards Trustworthiness Machine Learning. So to set the scene here, let's consider this setting where we have a supervised learning task, and the goal is to train a model or a classifier, such as a spam filter or a marvel detector or an image classification model. And the way this happens is through this pipeline, typical pipeline machine learning, which is where we have a training data which is labeled, and we will run this through a typical training pipeline, and produce a model F, and in modern days, this is typically a deep neural network, and then we deploy this model as some sort of prediction API, and users would send inputs to this model, so the prediction API, and get an output or a label of a specific input. Okay, so that's the setup we will consider. So when we talk about machine learning, the progress in machine learning today, we've got two sides of the story. So there is this exciting side where machine learning does a lot of amazing things, and we also have the opposite or somehow the darker side of machine learning, where the machine learning model could do a lot of crazy things. So if we start with the bright side, we have seen progress where in machine learning models, these days, are good at image classification tasks in computer vision, or in domains, safety critical domains like autonomous vehicles, or even in domains where we do translation of languages, in the medical setting, we've also seen models which are pretty close to human accuracy in terms of detecting cancer, and we've also seen examples where models could beat professional gamers, and we all have recently seen examples where audio assistants or voice-based assistants could be used for a number of predictive tasks in our houses. So that's the nice side, or the great side of progress we see in machine learning. The flip side, or what I call the worrisome side of machine learning, could be summarized with one question here, which is, in the pipeline that I gave you earlier, what could possibly go wrong if we replace the user here with some sort of adversary who has some malicious intent. So because the adversary could do a great deal of manipulations of the input or maybe try to manipulate the training data for fulfilling the adversary goals. So in the sense of this adversary setting where the adversary could come with a lot of intentions, there are a couple of scenarios that we've now witnessed that machine learning is not secure or safe. So the first one is what we call data poisoning attacks. So in this setting, the goal of the adversary is basically to inject some training samples. So this sample should be carefully crafted so that the model's decision would be skewed or somehow influence it towards producing an output that the adversary wants. So the way this happens is when machine learning models, such as spam filters or recommendation systems or malware detectors, have to collect data from untrusted sources and merge that connected data into their original training set in the hopes that they would improve the accuracy of the model. So what they merge into the original training set is or could be poisonous kind of training data that is intentionally devised by adversaries to reduce the accuracy of the model or maybe to bias the model to specific kind of labels. In real life, we have seen many examples where training data has been poisoned and back in 2016, there was this infamous chatbot from Microsoft, which was retraining itself from data that it was getting from people online.  So that's about poisoning. The other common attack or threat that we see in the machine learning setup here is what we call adversarial example. So this is a very famous attack vector where the goal here is given an input X, the adversary would perturb or modify this input in a non-random way in a very calculated way to produce what we call an adversarial example. And that adversarial example is going to be misclassified by the model. So the goal is essentially by performing minimal perturbations on a given input, let's say an image and without changing the visual appearance of the image, the adversary would fool the model. So for this, we have seen more than enough examples. So in image classification, people have demonstrated this is possible. Even in more safety sensitive domains like healthcare, we have seen models misclassifying a tumor to the wrong class, which means basically misdiagnosing a patient. And we have also seen cases where a stop sign could be misclassified as something like a yield sign, which obviously has safety implications in autonomous vehicles. And even in voice commands, we have seen how to fool voice commands in voice assistance. And beyond computer vision or the audio domain, we have also seen cases where malware detectors could be fooled by just minimal changes made to, let's say, Android APKs or Windows executables without changing the malicious behavior of the samples. And the other kind of attack is what we call model extraction attack. Model extraction is motivated by an adversary who wants to either steal a model for, let's say, reasons like intellectual property or national security secrets and so on. So the idea here is by interacting with the model, the adversary would use the model as an oracle to label a bunch of data items. And then using this label data set, the adversary would train what we call a substantive model. And this substantive model is functionally equivalent to the original model. And in doing this, what the adversary achieves is the adversary basically gets an almost exact copy of the original model. And now if the original model was trained based on, let's say, a huge amount of data that was collected over a number of years, and that happens to be an intellectual property or, let's say, even in the worst case scenario, it is trained based on, let's say, a national security secret of a nation, then the adversary effectively steals that knowledge or that model. And in addition to the three attacks I described, model, machine learning models could also be vulnerable to what we call membership inference attacks. These are privacy motivated attacks where the goal of the adversary is by simply inspecting the model predictions, they want to probabilistically determine whether a sample was used to train the model or not. So the intuition of the attack here is based on how machine learning models generalize when they are trained. So the common observation we have about machine learning models these days is that machine learning models tend to overfit on their training data, which means a model would be more confident in its predictions when it sees members of its training set. So by exploiting this behavior or statistical distinguishability of how the model behaves on members versus non-members, an adversary could build a probabilistic or a threshold-based identification or inference model that would tell it, okay, this looks like a member of the training set versus this other sample, which doesn't have a good score of being a member. So the implication for this is, since this is a privacy-motivated attack, the implication for this is that if a model is trained on let's say hospital data set or medical records, if the adversary is able to identify a person, this is obviously a privacy breach. So the consequence is going to be bad obviously. All right, so I kind of gave you an overview of the four different attack vectors that we have fairly understood at this point are pretty important in the machine learning pipeline. So what I'm going to do in the rest of the talk is I'll take two of these four, namely adversarial examples and membership inference. So adversarial examples for fooling the model, membership inference for basically inferring a record used to train a model. So in the first part, I will focus on this moving target defense that we recently developed to improve upon existing defenses against adversarial examples. And in the second part, I will move into this other defense that focuses on defending models against the membership inference tags and this is based on what we call preemptive exclusion of the data points. And in the third part, the final part, I'm going to come back and try to tie back whatever I'm going to talk about with the title of my talk, which is the state of the model. So where do we stand in the state of the robustness or machine learning model or trustworthiness or machine learning model? And I'll take a broader perspective beyond the two kinds of attacks that I'm going to describe and the progress we have made in defending against adversarial examples and also membership inference. All right, so let's jump into the first part. So in this first part, I'm going to talk about this recent work that we've done called Morphin. So the idea for Morphin is basically to make the machine learning model a moving target in the eyes of the adversary. So before I get to Morphins, it's fair to kind of assess where we stand in terms of the progress we've made in adversarial examples, defense, arms race, right? So adversarial examples are dated back to early 2000s and the landmark paper that kind of introduced adversarial examples in the sense of deep learning is the 2013 paper from Google that looks at this intriguing properties of adversarial examples where they could be fooled with simple observations. After that, defenses have emerged in many directions. So the early defenses looked at gradient based attacks and they wanted to defend against this great gradient based attacks because the attacks were exploiting the gradient information. So the defenses were obviously based on doing things like gradient masking or refining or pruning the model or performing some transformations on the inputs of data. And then around 2017, there was this seminal paper by Carlini and Wagner which broke what was the state of the art defense at the time, defense installation, and later a series of attacks by Carlini and others broke most of the defense that we were proposed against adversarial examples. Around 2017, there was a new defense called adversarial training. So basically training the model or introducing the model to adversarial examples so that when it sees the these examples in the future, it can correctly classify them into the right class instead of the adversarial class that the adversary wants the sample to fit into. So as we speak, adversarial training is fairly, fairly good, but it comes with its own costs, which is when you train a model in an adversarial setting, you are fitting the training pipeline with adversarial examples in addition to the original training points. So there is a risk of penalizing the clean input accuracy of the model. Around 2019, and quite recently, we have also seen a surge in this direction of certified defenses where the idea is to provide a minimum robustness guarantee under a specific setting, for example, the LP norm distance measure of images so that the user of the model would have the lower bound on the accuracy of the model under attack. So if I guarantee that your model won't go beyond, let's say, 55% accuracy under a specific class of attacks, then when you deploy the model, you already understand that there is a certification up to a certain degree, and it's up to you to deploy the model given the certification I gave you. So it's basically giving the proof or telling the user of the model that here is a guarantee I can give you, but it's up to you to deploy. So the divide defenses come with that kind of guarantee, but they do also have their own limitations in terms of scalability and covering different classes of attacks. All right. So beyond what I said about this different classes of defenses, what is common to all defenses up to this point up to certified defenses is that they all treat the model as a fixed target model. So if an adversary tries to attack your model once and the attack succeeds, the adversary can come back and attack the model because the model doesn't move or the model is not changing the decision boundary of the model is basically the same. So that's where we come in with this new defense technique called Morphens, which as I said earlier is based on moving target idea. So the idea here is we're going to deploy a pool of models where the decision boundaries of these models are slightly different, but the overall accuracy comparison between these models is the same. So what we do is when the adversary comes in with an input X, we pick one of these models and that model would predict the output of the input. And then when the adversary comes with another input or even the same input again, what we do is we keep moving this models or picking a different model, which is as accurate as any other model in the pool so that the adversary who is trying to establish, let's say the decision boundary or the robust sensitivity of the model against different perturbations would be discouraged and eventually give up in terms of the attack that it is planning to launch against this model. So that's the idea. So to give you a little bit of context as to how our approach works, here is a brief overview. So given a model that is trained on a specific training dataset, the first step that we do is what we call seed pool generation. So as I said, we have a pool of models that will act as a moving target for the adversary. So what we do is given the weights of the model, what we do is we just perturb this model in a very bounded way and generate what we call the initial seed of models. And this initial seed of models, since we perturb the weights, is bound to be less accurate compared to the original model. Therefore, we have this second step that we call seed pool retraining, which is basically aimed for two goals. The first one is, of course, we want to gain accuracy back. And the second is we have to also create sufficient diversity between the individual models that we forked from the original model because in adversarial example literature, there is this phenomenon called transferability of attacks. So if you attack one model with an adversarial example, chances are that the attack would work on another model, even if this models are architecturally different. So to minimize that transferability, we also apply different transformations on the different, the original datasets. So the T1, T2 up to TN here indicate the unique transformations that are aimed for getting the diverse models. And after doing that, we'll get a fairly diverse model and we'll also get gain back the accuracy of the individual models. And then in this third stage, what we do is what we call selective adversarial training. So as I told you earlier, adversarial training is sort of the benchmark defense that we use because as far as we knew at the time of developing morphines, this was a best defense. So what we do here is instead of training all of the models in adversarial, what we do is we pick a subset of the models and train them adversarial. So apply adversarial training. Basically, we introduce these models to adversarial examples. And the reason why we are selective here is because if we train every model in the pool with adversarial examples, they would be great at catching adversarial examples, but they would penalize overall accuracy on clean examples. So to balance for that, we keep the remaining subset of the models as is to make sure that we're not using on clean example accuracy. And finally, we deploy this pool of models, which is a mix of adversarial trend and also the originally improved models. And then we have what we call a scheduler, which basically accepts an input and then performs the moving target aspect of the whole pipeline here. So when we do scheduling, we have to also make sure that the model pool that we produce after passing through these three stages should also be replenished or it should be renewed because if the model pool remains static, again, we're back to square one, which is the adversary would recover or discover some information about the fact that, okay, it looks like I have kind of saturated this model pool. So now I know that this is a pool that never changed. So to avoid that kind of risk, what we want is we, every maximum number of queries, we want to just run the pipeline one, two, three here and produce another pool of models. So another batch of models will be deployed. And that way, the moving target aspect will continue by updating the model pool. Okay, so that is basically how our system orphans operates to achieve the moving target aspect of the defense here. So let me give you a bit of a highlight of how this defense performs and how it compares against the state of the art at the time, which is adversarial training. So here, we've got different kinds of attacks of fast gradient sign method, Carlini Wagner and SPSA. So fast gradient sign method and Carlini Wagner are white box attacks, where the adversary knows the gradient and details of the model, while SPSA is an iterative black box attack. So this is the accuracy of the model when there is no attack. So it's a fairly good accuracy of that. This is, by the way, for the MNIST dataset, the benchmark toy dataset for image classification. And when we apply fast gradient sign method, you can see that the accuracy just drops to almost 10% from 99%. Carlini Wagner basically paralyzes the whole model, so zero. It's a very strong white box attack. And SPSA also drops the accuracy up to roughly 30%. Then when you look at adversarial training, obviously, it improved up on the accuracy under attack. For example, for FGSM up to 42%. But it fails to recover from Carlini Wagner and it fairly improves the SPSA from the SPSA attack. But when you look at this last column, which is our defense, Morphens, you can see that Morphens doesn't really incur any cost on clean label accuracy or clean data accuracy. You would see that it is almost the same as the original, the undefended model's accuracy. So we're good on that. And when you compare it against adversarial training on all these attacks, you can see that Morphens outperforms adversarial training with a very large margin. We also tested Morphens on another benchmark dataset, slightly more complicated than MNIST. This is called C410. So the conclusion here is that Morphens again outperforms adversarial training in all cases as it can be seen here. So the takeaway for the Morphens evaluation is that the moving target aspect is really working. So what it ensures is that it is much more robust than a fixed target model, obviously. It can also prevent falling victim to the same attack multiple times. So we have details of evaluation in the actual paper. And the iterative query-based attacks like SPSA that we have evaluated, they are very unlikely to succeed in the phase of a moving target model. So we've kind of understood or learned these lessons by applying this moving target strategy against adversarial examples. So the second part I'm going to talk about is about membership inference defense. So we have this upcoming paper called MiaShield Defending Membership Inference Attacks Using Preemptive Exclusion of the Member Data Points. So like I did for adversarial example, I want to highlight a little bit about the context here because later on when I talk about our defense against membership inference attacks, you would realize what we are improving on. So membership inference attack in the context of machine learning was introduced in back in 2017. And after that, there were a range of defense techniques that were proposed spanning different strategies. So there's this regularization-based defenses. Differential privacy is another one or masking the confidence of the model. Remember when I introduced membership inference, I said the adversary exploits the confidence of the model on members versus the members to differentiate members from non-members. So if you do some sort of masking of the confidence without, of course, affecting the accuracy of the model or the label of the model, then you can gain back some robustness. And there's also another class of defenses called ensemble methods, which is basically stacking machine learning models so as to confuse the adversary not to establish any, any intuition about, you know, whether a sample is a member or not. And then lately, we've got what we call knowledge distillation, which is based on making, basically pruning the model so that the model doesn't leak too much information about members. Similar to what I said for adversarial example defenses, what is common here among all these defenses is that they are based on this idea of masking or concealing the presence of a member. So basically all techniques up to this point are what they're doing is the member, the, the member element is in the, in the models. So we want to protect, let's say, you know, a patient's record that was used to train them on. What we do is we do our best so that the adversary doesn't, doesn't really, you know, discover that the item or the data point is not in the model. So it's basically based on masking or concealing the fact that the data point is in the, in the training. So what we say for the intuition we have for our defense technique is so it is well established that the presence of a data point offers a strong membership signal for inference. So the question we ask is how about excluding the data point, of course, without compromising, you know, the accuracy of the model so that this signal the adversary gets would be weak and as a result, maybe the attack would fail. Okay. So basically we're, we're departing from what has been done in the literature in the sense that instead of masking, we're basically excluding the item or the data point so that any probabilistic inference would be at best a false positive because if I remove the training point and I still give you the same utility or accuracy as the model, any, any conclusion you make as an adversary would be a false conclusion because the data point doesn't exist. Okay. So there is that, you know, theoretical guarantee that we don't prove here, but we'll see how this approach turns out to be. So here is a highlight of how Mia Shield or our approach defense of a membership inference works. So as I said, the idea is we want to preemptively exclude the member when we respond to predictions of the model, predictions of an input. So the idea is given a sensitive data set, let's say a patient record data set D, what we do is we want to first split this data set into disjoint subsets, let's say D1 to Dn and we apply data augmentation to gain back accuracy that would be lost to this disjoint splitting of the original data set and then we train the individual models after this data augmentation step and produce n models corresponding to the n disjoint data sets or subsets. And once we have this models, what we do is when we get an input from an adversary, we will leverage what we call an exclusion oracle, which would first decide whether the input X is or belongs to one of the training sets of this models F1 to Fn. If it belongs to one of this models, what we do is we will exclude that model from the ensemble prediction that we are going to compute over here. So y equals the ensemble of F1 to Fn. So if fi, model fi contains the input X, we will exclude model fi and perform the ensemble prediction or aggregation on the rest of the models. So basically what we're doing here is since the signal, the model that carries the signal, which is the target data point X here, is identified through this exclusion oracle, we exclude that model from participating in the predictions, but we still want to maintain the accuracy of the model. So as you might imagine, the challenge here is as to how we have to design this exclusion oracle because that seems to be sort of the bottleneck here. If the exclusion oracle gets things wrong, the whole pipeline or the whole defense strategy would fail. So the next slides what I'm going to do is I'm going to give you a highlight of different strategies that we explored for how to implement this exclusion oracle. So we've looked at five different techniques starting with a basic naive baseline. So the first technique that we used is what we call model confidence-based exclusion. So what we do here is to exclude one of these models from the ensemble prediction, what we do is we exclude the most confident model on a given input. So given an input, if we look at the confidence of all these models, we exclude the most confident. And the intuition here is that it goes back to the original intuition of what is the root cause for membership in terms of tax. It is the fact that models are more confident on their members. So by the same token, the most confident model in this scenario is likely the model that contains the input. So that's the basis for using this strategy. As it turns out, the limitation of this technique is that the most confident model is not necessarily the model that is trained on the target data point. So we've empirically validated that this, although this is a good baseline or starting point as an exclusion oracle, it's not the best. So as a result, we had to explore other alternatives. So the next alternative exclusion strategy we looked at is what we call exact matching based on exclusion. So the idea here is since we can compute hash values of cryptographic hash values of the individual data points in each subset, what we did was we basically compare the inputs hash value to the hash values of the data points in each subset. So whenever we find a match, we exclude the model trained on a sample that exactly matches the inputs. Since this is an exact matching technique, the limitation, the obvious limitation for this is when you slightly manipulate an input, specifically an image, that slight manipulation, let's say one pixel change would mislead this oracle. So it's not a very effective technique. It works when the exact match is found, but it fails when the slight manipulation is there. So incrementally, we went to the third alternative, which is instead of exact matching, why don't we do approximate matching based exclusion? So the difference here is that we just exclude the model trained on a sample that approximately matches the input. And one way to do this approximate matching is still on a hash value comparison or hash value lookup, but the hash function or method we use is perceptual hashing technique instead of the cryptographic hashing technique. While this improves up on the exact matching technique, because it catches certain images or model samples within a threshold of a specific distance, the limitation is that data points that fall outside the distance threshold will be again missed by the work. Okay, so next up is, okay, so we've looked at this exact matching and approximate matching techniques, but how about looking at the exclusion itself as a classification problem, right? So probabilistic classification problem. So what we do here is we want to predict the model to exclude, so for which we have to train the oracle, the model for the oracle itself, right? So what we do here is, yeah, so we get a portion of the subsets of the datasets, and we use these datasets to generate feature vectors that would be used as the basis for establishing different classes of models. So if we have n models, we're going to have n labels on which we're going to train this classifier-based exclusion strategy. The natural limitation, while it improves upon the limitations or it solves the issues with the other two or three techniques I talk, the issue with this one is it can be overfeed on members because you're training a model and we've already said that the root cause for membership inference is the fact that models are overfeed on their members. So it might suffer or it might inherit the same issue, okay? So that's sort of the limitation by design, but empirically as I will show later, it's much better than the other ones. And the other alternative that also speaks to the limitation of this classifier-based oracle is how about connecting or using what we call a chain of oracles? So basically, we query exclusion oracles progressively instead of just picking one of them. So we first start with the exact matching and when it doesn't find a match, instead of giving up, we go to the approximate matching and when it doesn't find a match, again, instead of giving up there, we go to the classifier based oracle or exclusion as a last resort. So this also turns out to be a much better technique empirically speaking. So let me give you a highlight of how this performs. So I gave you an overview of the five different techniques that we explored. So the model confidence-based exclusion, the exact signature-based exclusion, approximate signature-based exclusion, classifier-based exclusion, and chain of exclusion oracles. So these are the five exclusion strategies that we have tested. So what we have here is results of our defense or the performance of the different oracles against the undefended model for two datasets. So on the left is C-partain dataset and on the right is CHM list, which is a sort of benchmark medical image classification dataset. So on the x-axis, we've got model accuracy and on the y-axis, we've got the accuracy of the attack. And the baseline for the attack accuracy is 50%. So if the adversary gets, on average, a 50% attack accuracy on a batch of, let's say, inputs, it doesn't say much about the effectiveness of the attack because it's equal to random gas. So that's why we are fixing the baseline at 50%. So the closer the attack accuracy to 50% is good for the defense, it indicates a good defense. And of course, when you talk about attack accuracy, we have to also look at it with respect to model utility or model test accuracy. So that's why every time we measure the effectiveness of a defense or even an attack, we have to look at the trade-off between model accuracy and attack effectiveness. So while keeping the model, the original model accuracy, if the attack could be dropped into the baseline, which is a 50% of random gas, then we can consider that defense to be a good defense because without compromising the utility of the model, we maintain that the attack won't succeed. So the blue circle here is then defended model. So that is the accuracy somewhere between 1680. And as you can see, all the other points are our exclusion oracles, which are not too far in terms of model test accuracy, which is good news. And interestingly, they are almost on the baseline or on the 50% random gas attack accuracy, which shows that the attack is essentially failing. So that tells you that the defense is super effective. On the right hand side, you would see the same kind of story, except that this is a different data set, which happens to be a medical image classification. The next thing we did was, okay, so it looks like our defense, Miashield, is good enough in terms of basically mitigating the membership inference attack and bringing the accuracy of the attack down to randomness. Then we looked at the defenses that were proposed over the years, over the last five years or so. And these defenses, as I told you earlier, fall into different categories. Some are based on differential privacy, others are based on confidence masking, while others are based on model stacking, etc. and regularization also. So we did the same kind of evaluation. So we tested the tradeoff between model accuracy and attack effectiveness against our defense, Miashield, which is the green square, and all other defenses, like DPSGD, since it's a differentially private stochastic gradient descent. Pate is also another ensemble based differential privacy-based technique, and model stacking, Memguard is a confidence masking based, model stacking is an ensemble method, and MMD mixed up is regularization. So as you can see, we've considered, you know, a span of model membership inference defense techniques across the board over the last five or so years. So compared to the baseline, which is a 50%, as you can see, our defense, Miashield, is right here, so right on the line in terms of accuracy, which means it basically mitigates the attack. And compared to the undefended model's accuracy, Miashield is almost aligned with the undefended model's accuracy, which means without losing accuracy, significantly, it is providing a randomness kind of attack protection here. There are some other techniques like model stacking and Memguard, which are pretty close, and also the MMD technique here, the regularization-based technique, which are close to Miashield. But as you can see, their attack accuracy on each of them is slightly higher, although they are pretty close to the, in terms of the model accuracy. So overall, our defense still is a winner. And more interestingly, when you look at the differential privacy-based techniques, DPSGD and Pate, they are super comparable in basically mitigating the attack, so they're almost the same as Miashield. But as you can see the gap between the blue circles horizontally, and this green triangle and the red square, which is DPSGD and Pate, you can see that differential privacy-based methods, they cost a lot on the utility of the model. So that's where our defense is overall much better than almost every model that we've tried here, every defense we've tried here. The same is true for the other kind of data sets, the HMNs stars, the story is more or less the same here, except minor differences. This the third thing we did in addition to comparing our defense against existing defense is any defense has to be tried or tested against a possible adaptive attacks. So one of the natural adaptive attacks that we anticipate against our defense is, especially in the sense of perceptual hashing exclusion oracles is that an adversary would keep just keep perturbing or manipulating these samples until the sample is misclassified differently by the model. So for that we've looked at a range of data augmentation or manipulation techniques that the adversary would likely perform, specifically by rotating or translating inputs. So here we've got results on the left for C510 and the right CHM NIST.  And the red line shows the defended models accuracy as accuracy versus accurate attack, the attack accuracy versus this manipulation parameter. So as you can see our method or our defense maintains the attack accuracy while the attack accuracy of the defended against the undefended model is much higher in both cases. So this shows that adaptive attacks like this one, which are based on manipulation of inputs, may not succeed overall. So as a takeaway for this membership inference defense, so basically the membership inference defense that we proposed, which is based on this elimination of the signal, it works. And we have seen this across the board for multiple datasets and also compared it against the distinct defenses. And overall it provides much better utility privacy trade-off. And as I just showed you in the previous slide, it also remains resilient against an adaptive adversary that basically monetizes their knowledge about how our exclusion or abuse might have been designed. All right, so those are the two lines of works that I kind of described. So how does this fit into the way I start from the talk, which is the state of the model, what are the progress we have made, and what are the problems we have in terms of this grand scheme of making machine learning models trustworthy. So I took two threats against machine learning models, adversarial examples and membership inference and tried to kind of walk you through what has been done and what we have added on top of the existing state of the art for defenses. Okay, so now for the last part of the talk, what I'm going to do is I'm going to take a much broader take on what we call trust words in machine learning. So I only looked at the two dimensions, adversarial robustness against adversarial examples and robustness against membership inference attack, which are important and we have to, we have to do this kind of work. But trustworthiness of machine learning is not all about robustness against this adversarial inputs or robustness against this privacy motivated attacks like membership inference. It's much broader than that, right? So on this slide, I'll just take a step back and try to kind of summarize the progress we've made in different dimensions, including the ones I just discussed and some open issues that I consider are important. All right, so in the front of adversarial robustness, so techniques like adversarial training, certified defenses, and the moving target strategy that I just described from our work are super useful and they are they're good progress. But on the flip side, what we are struggling with, especially in the sense of adversarial examples, these days is that, you know, the adversarial example literature didn't move much. So we're gaining some robustness empirical robustness against, let's say, the previous defense technique. And then somebody comes and breaks these defenses and so that we are in that cycle of, you know, the classic attack defense arms race. So I think we are at the time where we have to rethink what we call robustness, especially in the sense of adversarial examples. So we have to broadly reason about robustness and get out of, you know, this well established robustness assessment in the image domain where, you know, the norms or the distance metric is somehow limited to the classic LP norms. So I'm not the first to say this, a lot of people suggested this and I agree with them. On privacy, differential privacy has become sort of the gold standard for what we want a privacy definition to be mathematically rigorous and provide some, you know, guaranteed utility versus privacy guarantee that you can empirically verify and also formally support. But beyond what we call the average case metrics that was which we are measuring attack, you know, effectiveness, we have to also look at some realistic scenarios for measuring privacy leakage. And we have to also reason about cross domain formulations of privacy because privacy leakage or implications of privacy leakage in one domain may not necessarily translate to another domain. For example, privacy leakage metrics for images versus, let's say, language models may not necessarily be the same because the tokens we're dealing with are completely different. And the semantics of privacy leakage is different as well. And so the adversarial robustness and privacy are the two things that I covered. But beyond this, as I said, we have to also look at trustworthiness from a transparency point of view, which is when machine learning models make decisions on very important tasks, we want to understand how the machine learning models got to that decision. So there is this, you know, explosive line of work in literature in the so-called interpretable or explainable machine learning, which is useful. But I guess what is challenging for moving forward with interpretability or explainability of machine learning models is that, you know, these machine learning models are keep going in terms of size and getting more and more complex. So the black box aspect is just getting more and more bigger. And it's becoming harder to scale up existing explainability frameworks to the models that we're seeing today, which has got, you know, billions of parameters. So that's about transparency. And the picture won't be complete if we don't bring in fairness and ethics into the whole equation of trustworthiness machine learning here, because you might do a great job on making the model robust against adversarial manipulations or privacy-motivated attacks, and you can still make it, you know, somehow transparent about its decisions and so on. But if it is not fair to everyone, or if it is somehow unfair to a specific long tail or, you know, portion of the dataset or a population on which a model is trained, then we are not doing things right. So the model is not trustworthy. So the idea here is one of the progress we've made in the literature of fairness and ethics and so on of machine learning or AI in general is this tendency to quantify or measure fairness and ethics. The question that might come naturally is, is it okay or is it natural to quantify fairness? Or is fairness and ethics quantifiable in the first place? That's a very big question that the ethics and fairness community has to deal with. If we have to formulate fairness and ethics, we have to have some alignment between what humans perceive as fair or ethical and try to encode this human policy into the formulations of fairness and ethics in machine learning. More importantly though, all these different dimensions of trustworthy machine learning are important, but what is more important is even the dynamics between these different properties that we expect from machine learning, right? So we have to also study, this is a very underexplored or somehow overlooked, fairly overlooked area where we have to look at, for example, accuracy versus all these kinds of properties that we expect. How does accuracy fair against adversarial robustness, privacy, transparency, fairness and so on. And then between this different, if you take a pair, let's say robustness and privacy or robustness and fairness or privacy and transparency, some of them are seemingly conflicting, for example, privacy and transparency. Privacy is all about limiting leakage in the sense of, for example, membership inference, but at the same time, you also want the machine learning models to be transparent about its decisions. So how do you balance privacy and transparency? Privacy and fairness is the same kind of story here. So this is the way I look into the whole puzzle of trustworthy machine learning in terms of the progress we have made so far and some of the open issues that I consider are important. So to conclude, the way I want to look into trustworthy machine learning is using this analogy of an umbrella. So in the normal sense of an umbrella, so you want your umbrella to be reliable or trustworthy so that it protects you from the things that you anticipate an umbrella will protect you against. So if there is a UV ray or light coming from the sun, you want your umbrella to protect you. If there is a rain coming, you have to also expect or anticipate the umbrella to protect you against the rain or if there is a wind, unless it is a storm or something like that, you still have some reasonable belief that your umbrella will protect you. So you can replace all the UV rays, the wind and the rain with any threats or any properties that you expect from a machine learning model like adversarial robustness, privacy preserving and so on. So if we consider machine learning as an umbrella and we want it to be trustworthy, this trustworthy machine learning umbrella should include, of course, robustness to adversarial manipulations. It has to be privacy preserving. It has to be interpretable or the explainability aspect should be there. It shouldn't be biased to a specific group of people and it should align with the ethical values that humans, reasonable humans would use. But this umbrella also needs some reinforcement. So it has to have this united kind of hands that will hold it together so that it doesn't flip around. So the way I look into this reinforcement is this triangular view of the synergy between academia doing basic research, industry extending basic research into products and services and the public sector as the mediator between the two because the public sector has this authority of doing oversight, auditing and also regulatory aspects through legislations and so on. So these three entities can work in synergy to reinforce what I call the trustworthy machine learning umbrella which has to encompass or have all these properties that I mentioned here on the umbrella itself. Okay, so with that I will stop my talk here and I will look forward to your questions.


Great well, the visual asset news they get top stories and crypto bring down a bite-sized piece So today you hear probably because of the thumbnail and the title which is Ray Dalio Talking about how cash is trash and it was a little snippet of an interview on a play for you We talked about cash trash talks about the collapsing markets and why everyone's selling today and the future So that's the bad news then we're gonna take a look at some good news We're talking about 0.3% of households of wealth is into crypto and knowing that I think we've got a very long way to go And then we're gonna talk about why we're here extremely early and the upside That is in crypto and the last that's in the very end. We'll go over Q&A So just so you know if you're here for the live stream, welcome Thanks for stopping by on a Tuesday So we do Q&A at the very end goes kind of long sometimes But what we do is we we cut the Q&A and then we make that for a separate video So if you're here for the Q&A, I'll answer all your questions at the very end So let's just jump into it real quick and take a look at What is going on with the market today? So today Is a correlation day and in all honesty and yesterday Uh, a couple people notified me that I was looking at the five day for the s&p and the nasdaq So thank you guys so much for letting me know about that. But today I mean, we're down yet again. So, uh, negative 3% ethereum 5% our market cap is 1.3 trillion just barely holding on and it's down 4% tether And let's say what else everything's down except for tron 2.7% good job tron holders Making that mini bull run Just kidding and everything else is down for 24 hours anything up. Geez I mean, there's something up in the last hour zero point stable coins Yeah Five something like that. So no Just a bad day overall just the red day. That's just the natural swing of things these these markets Uh, they go up they go down and uh, sometimes there is is an extension of what is going on So that is happening right now and let's just take a look real quick at just a little bit of macro of what is going on so yes, because uh The s&p 500 down almost 2 we are down 4 percent and also Nasdaq is down almost Three and a half 3.26 and of course we're down 4 percent. So, you know, I think it feels like we're kind of in lock step Unless something Catastrophe happens or some major huge news comes out like, you know, the uh fed reserve In america starts to embrace bitcoin or the imf says bitcoin's gonna save everything I uh, I don't see much of a reversal anytime soon and we're gonna be here for a while also just know that We're in a macro environment. So we it's not just like we're in a bubble Everything affects us, especially with the traditional market and then of course our market. So there's some uneasiness going on Especially with this little news article. I I drummed up I found that uh, chinese and russian nuclear bombers are flying over the sea of japan as Joe biden visits tokyo And uh, I thought well, that's a coincidence maybe but of course it states here mako said mako Moscow said the 13 hour flight Was carried out strictly in accordance with the provisions of international law and not directed against 30 countries Japan's defense minister condemned the exercise as provocative and acceptable. Yeah, if i'm gonna fly out 13 hours There's gonna be a pretty good reason for that. That's just a show of force and that is what is happening also Um, that's uh, not the greatest news. I think that's just a big flex situation But also, uh, this to me is actually good news new home sales are down And uh, to me, I find that positive because if you've seen the reports, uh, there is just not enough inventory and the prices We're just going just astronomically high. So when we see these types of thing new home sales I know this lady looks like You know, she saw a ghost or something but in all honesty These home sale prices have to go down. So people can actually get affordable houses and they can't be You know buying houses that are 200 300 percent over market value. I'm not just an exaggeration. You know what I mean So that's actually good news. So that's what we have in the macro environment. Let's take a look At my man ray dahlia. So ray Uh, one of the most important and probably, uh most revered traders or investors of all time And uh, what he's what he's here to talk about is how cash is trash. He says he talks about You know that you should get out of cash and then talks about collapsing markets and he talks about why everyone's selling I thought it's a It's a good backdrop to kind of understand exactly why things are the way they are So I cut out the first minute where he just pretty much, you know Talks about Cash and trash whatnot, but he really gets into the details here the next three minutes So I'm gonna share that with you. Let me share my My tab Let's see here brave tab Cash is trash. So you can actually hear it And let me mute myself and let's just take a Uh, when there's a lot of debt One man's debts are another man's financial assets And they have to balance both of those things And so they will not be able to raise interest rates to a high enough level To adequately By a real return To investors. So if you think about the rising rates and we say three percent is an interest rate Right or even four percent an interest rate That is not going to be an amount of money that's adequate to compensate for the inflation rate And we're in a paradigm shift. I think a paradigm is You know Something happens for 10 years an environment for 10 years And at the end of that 10 years people believe everything that happened in the prior 10 years And then they get a surprise right and then they start to change and something like for example Do I cash is a safe investment or bonds are a safe investment after a 40 year bull market and those types of things That begins to shift as they start to think am I getting a real return? So there's going to be a supply-demand balance most importantly the federal reserve is going to sell Individuals are selling Foreigners are selling and the u.s. Government is selling because it has to fund its deficit So there's going to be a supply-demand problem That means that it produces a squeeze because so much money was put out at such cheap rates And so much financing was taken that it'll be difficult to achieve that balance So I remember when you would tell us the cash is trash. Yeah, is cash still trash? Of course cash is still trash Cash I'm asking you or is your interest you know how fast you're losing buying power in cash I feel that in terms of inflation every day. However, I'm also for those who are own equities out there They're feeling it even worse. Well, it depends what But depends what cash is equities are trashier Okay, the question is what's going to get you a real return, right? And so we've shifted it into an environment where assets that do well almost like in the 70s Are in those types of things real assets real return assets in various ways are the best investments I think the world is Long that here's a dynamic. I think that's a problem everybody's long equities and so on and Everybody wants everything to go up and the federal reserve wants everything to go up So what they do is they give you money and credit lots of money and credit that helps hyping it And when the more they hype it the more it becomes somebody else's financial asset They're holding yep, and so the world is holding all these financial assets and so on you can't have that So you're going to have an environment. I think of negative real returns and so That's the thing right there where he talks about and he said about perfectly he goes there is I mean cash is trash but equities are trashier And the problem with equities being trashier is that people don't they still believe that we're in 2011 2012 2013 and that this will just go on forever But what they they fail to realize and especially people who are younger who just got in who are maybe in your your late 20s early 30s You don't remember that the dot-com bubble. I mean things can go to zero things get wiped out 2008 2009 people were losing their houses left and right and people don't remember that because we've been in this Magnificent bull run for so long. So when ray talks about look Cash is trash debatable But these equities are trashier and they are over inflated because of the bottom line That's being printed and put it into it and of course the ETFs that are being bought by the Federal Reserve Which leads me to my point The good news 0.3 Of households and this was a An article from fortune And they talk about the 1 trillion crypto collapses crippling digital coin bulls But the rest of us will hardly notice. This is from this section from Goldman Sachs friends of crypto. I'm just kidding So here's what it comes down to Adding up america's crypto losses. Goldman's chief economist jan Hotzias Nellitt and his team say that america's crypto hodlers have lost about 300 billion Okay, that seems like a lot in the great crypto collapse the past six months That may sound like a big number, but it makes up a tiny portion Which is 0.3 percent of american household wealth and contrast america's heavily invested in stocks Which represents about 33 of household wealth. So i'm just think i'm just it's like i'm taking crazy pills I'm thinking myself. Why is it that everybody is so caught up in In equities and stocks and they think that that is the only way when in all in all honesty We're in a market cap in crypto of one point Well, we're gonna probably go to 1.2 something trillion today And if we can take a look at the over inflated stocks that are out there, why do people get into that? 33 percent of their wealth is that just don't really get it or is it is it education? That means this is all just a big scam or something like that I mean, there are some very smart people coming into crypto and bitcoin. So when we when I see this it just makes me think Why aren't people getting it? Why aren't people going? You know what if it's over inflated like that We know that cash is trashed. Maybe we get into something and like bray was talking about maybe there's some other things That are a little bit safer like in the 1970s and like I mean my wife We love to get into real estate. You know that I say all the time this channel So like when I see stuff like this new home is over down 60 percent That's not a bad option But what's an even better option in my personal opinion not financial advice I'm not a financial advisor is once you get into a little exposure into crypto and digital assets And I think once we start to get a little bit of regulation in there then some of these big institutions will come in then they will actually Uh Recommend it to their clients go look We don't know what's going on with these equities But this is an underappreciated class. Maybe we can do one to three percent and go from there and as a reminder Uh, I know people I know I say this I I show this a lot, but it's a good reminder That look this little square is a hundred billion Here's coins and bank notes. Here's us right here. First of all, it's nothing And then we've got the feds balance sheet. No, it's way higher. This is what it's in 2021 I think billionaires here's gold 11 trillion Why fortune 500? Alphabet amazon da da da stock market is almost 100 trillion money supply is way higher now at 35 trillion by 50. Who knows global debt You're looking at 253 trillion global real estate again 280 trillion and then uh, what's the big ones? Oh, yeah derivatives almost a quadrillion So when I see that these types of stories come out, I'm like and then I I hear Ray Dalio talk I'm like, why don't people get it like If they just want to save a little bit of wealth and maybe Conserve it and then go in here for the long haul This would be the better option But that's just me and I can't tell anybody what to do because I'm not a financial advisor And then to finish up these patterns imply that equity price fluctuations are the main driver of changes in household net worth Well, cryptos are only a marginal contributor exactly. I think it should be a bigger one, but we don't have unfortunately the uh, the clarity that some of these these big name money people are are into and also I forgot to put this up, but jp morrigan Just added like make another hundred or 200 different financial advisors to their roster because they're gearing up for some big thing I wish I would have put it in here, but I know that If they're gonna do anything in the planning right it would be right now So maybe these financial advisors who they talk to their their clients might say something like hey, maybe get into Fill in the blank. So anyhow, that's What we got for that little section. Let me know what you think in the comments And let's talk about this why we're early so This was this comes down to a graph that blockworks had shared and it didn't make a lot of sense at first And they said 12 of us adults have used crypto in 2022 And of course in the comments people like use what do you what do you mean? Like like they use an centralized exchange like they use it for for payments like they use it for Whatever whatever and of course it's just twitter. So you really can't get the whole story So you got to go to the actual article and which is this Income impacts how consumers use crypto the federal board say only three percent of us adults using crypto for purchases or money transfers and they're most often low-income earners. So this is what we got Fed report shows that people who use crypto for transactions are twice as likely to be unbanked Which makes a lot of sense, especially if you're trying to move funds around or I mean, if you're from bank, how are you going to do it? Right? Or if you're trying to send money back to another country that you may be from Higher-income earners are more likely to use crypto as an investment tool. That is very true So here's what we got digital investors are going to be using crypto to make money Digital asset holders think about tokens Come down to their income level 12% of adults in the us reported holding digital assets, which I believe would come down to this 12% of us adults So 12% are holding digital assets 12% that's nothing 3% reported using crypto for purchases or money transfers according to feds economic well-being of us household report And in 2021 almost 60% of adults use crypto for transactions Had an annual income of 50k or less and then of course 24% of transactional users Report an annual income of 100k or less and then to finish up Those who hold crypto purely for investment purposes are disproportionately high income Which makes a lot of sense because the high-income earners are the ones that actually can afford those crazy gas fees from ethereum Just saying In 2021 46% of us using cryptos only for investments had an income of 100k or more Well 29% had an income under 50k and then it's my personal opinion that The 29% who are under 50k who are dollar cost averaging and may be waiting a little bit longer Will probably be the ones that are are having the 100k or more as time goes on So that's just the first part of why we're early And then you have to remember first of all I'm old And I remember times before the internet and I remember times using Do we decimal systems and actually mailing a letter before emails because who would use emails? I mean, why would we that makes no sense? So the things that we do today are just commonplace. They're just commonplace like I remember There was an interview with bill gates and uh, david letterman In the early early 90s and david just made fun of bill gates. He goes that makes no sense Why would I use the internet when I have a radio or a tv to watch a baseball game? Why would I watch over there? That makes no sense. He's like well, you can record it He goes, I got a recorder. I used to use my vhs So like that's laughable these days and the same thing Are these big companies that are just kind of emerging and one of those, you know Give coinbase a hand is that coinbase today? Well, not today just reported enters the fortune 500 list of the biggest u.s companies the first one The first corporate company to join the list recorded record a revenue of over 7 billion almost a billion in fiscal year 2021 And placed 437 now. I don't know if they're going to keep that Because q1 of 2022 is pretty brutal, but this is this is what it is The nasdaq listed crypto exchange posted revenue of over a billion Uh having first listed on nasdaq in april 2021 imagine that In q2 of 2021 They just got listed on nasdaq and they entered the fortune 500 Within a couple of quarters. That's pretty amazing The fortune 500 represents two-thirds Of u.s gross domestic product gdp with revenue totaling 16 trillion dollars. I did not know that so Hey, I know I've been pretty critical of coinbase. Congratulations them for making them to the top You know 500 so great and then also I know we're early because the different services that were in the past Uh, it seems ridiculous now to thank yourself Um, yeah, I'm just going to go To the store all the time and get everything that I need. I'll never shop online. That's why we have amazon or I got I'm just going to go walk down the street and pick up a A dvd of the latest movie that just came out and then we'll pay some rent fees from netflix That seems ridiculous because now we have the you know now we have netflix or If you're you're only stock, you don't really have netflix. You probably maybe have disney plus or something Hulu, so it's just just goofy. So like these this is why I think I know we're early because the products of of of buying equities or stocks and then going to another app And purchasing crypto. I think those days are numbered Um, we had talked about this last week fdx seeks acquisition in brokerage space Uh Sources remember discussions told cbc that the bahamas-based firm has spoken with weeble apex clearing in public In recent months and just so you know they already ruled out this option I don't know why this this article says like this, but we've covered this last last week They had already rolled it out to us customers On a case-by-case basis and they could actually purchase stocks on on the fcx platform so again This is going to be like the normal thing as time goes on people like well I'm not going to open up robin hood to get tesla And then I'm going to open up coinbase to get bitcoin or or cardano or solana or whatever else I'm just going to do it all in one place because I use two apps. It makes no sense And then just to finish this article up Uh, this was from the president of fcx on any given day A person might want to buy bitcoin or then I want to buy some tesla exactly They're not going to want to open two different accounts the reported conversation with brokerage companies Also follow ftx CEO sam bakeman freed buying almost eight percent stake and robin hood I think we've heard about that, but this is also interesting ftx us last year bought digital currency futures and options exchange address And it moved to bring crypto derivatives derivatives to its us user base It bought a stake in stock exchange operator iex and enough to establish a simple and transparent market structure ftx also revealed february 1st was set to acquire fin tech firm liquid group in a bid to navigate japan's crypto exchange laws, so if you're looking for any Company that probably go public at some point might be ftx might be an idea to take a look at their token too But that's not financial advice. It's just something to talk about and that's it So look, I know it was a little bit. Hey, we hit 20 minutes. Great


So why is this very scary title? Actually, I wanted to advertise my latest development, but unfortunately I wasn't allowed to do that here. So I had to change slightly. This doesn't really fit. That should be a problem. So instead I will talk about what, in my opinion, is wrong with current paper graphics that it does. First of all, Inkscape. So there are a lot of Inkscape developers here. Sorry for that, but it's just not the way I want it to work. It's very subjective. And I also want to give some hints on how I think we can improve that. And maybe in the end we see that we better start off from scratch. Because Inkscape works the way it works, and that's fine for many people, but maybe some other people want to do it differently. So maybe that's good to have an alternative. So let's look at how Inkscape works. So first of all, this is the perspective of an not very expert Inkscape user. So I use it occasionally, but I'm sure there are better ways. But I think this kind of says how the average user uses it. So for example you want to make a pattern of shapes, like shown here.  And this kind of works. But it has some disadvantages. First of all, what happens if you, for example, want to replace the original shape? So if you want to replace this fancy rectangle with same ellipse, you have to start over again from beginning. You have to draw the shape, the ellipse, you have to edit its color, you have to duplicate it, you have to select all the duplicates, and you have to arrange it. Or if you want to change the arrangement, so if you just want to change the spacing, as shown here, you have to select all the shapes and arrange it again. So everything you did before was lost. Or it's lost. Another disadvantage is that many objects clutter the object tree. So I know that the object tree isn't very often used in the Inkscape world, because it doesn't really work well, I have the impression. But if you are used to work with an object tree, that's really a major drawback, because if you have four clones, then it isn't really that much of a problem. But if you have hundreds or thousands of clones, then you can imagine this doesn't really scale. One good thing I really like about it is that you cannot just copy-paste items, but you can actually clone them. So if you, for example, as I did here, draw the points of a shape, then all the clones are also affected. But unfortunately, this doesn't work if you exchange the whole shape. So what can we do better? I propose that we don't use a cloning tool, or a duplicate, or a range and pattern tool, as we have in Inkscape, but instead an object, a cloner object. And how it works is that you can interact with it in a very non-linear fashion.  And the cloner takes the full responsibility of all the clones. So no matter how many clones you have, you just have two objects.  So the actual semantics that you not have on the duplicates, which are by coincidence arranged in some certain pattern, is not lost, but it's inherently stored in the cloner object. And this is how it could look in practice. So as you see here, you only have a cloner object, and this is a rectangle.  So everything which is a child of the cloner becomes cloned. Then you have these properties, for example, where you can set the count four times three, you could, for example, also clone them in a linear fashion just like you can do with the arranging pattern tool in Inkscape. I think in a nutshell, this paradigm can be called object oriented. So everything is an object rather than you have many tools like you currently have in Inkscape. And all the negative things I just mentioned now turn into positive things, because you can easily replace and modify the template object, you can just drag it out of the object tree and drag another object in, an ellipse, much more complicated object, a group of objects, whatsoever. You can edit the arrangement properties anytime. So even after saving, storing and loading the scene again, you can easily manipulate that. And you only have to handle two objects rather than n copies. And I propose not only to have one single generator object but a whole palette of generator objects. We have just seen the cloner object, but for example, there's also mirror object. I'm sure you can all imagine what this mirror object does. Many of the real world shapes are actually symmetric in some session. And also an instance, which is the cloner from Inkscape, basically. So you have not copy pasted, but if you change it, the clone also changes. One very important point here is that you not only can nest these generators, but you can also, you are encouraged to do so. And this allows you to generate very complicated shapes with very few objects, which are very handable, very maintainable, and you always have these nice overview of the object tree. So you directly see with one glimpse that the mirror is a child of the cloner and is actually made up by a path. So for example, for this nice drawing here, which took me about two minutes to do, we only need three points. And everything is editable and reachable within a second. So this idea is not new. In programming, we have these paradigms. We have functions, we have loops, we have recursion, and we have variables and a lot of other things, which we can use to structure our code and to reuse our code. And we have a plethora of paradigms. Most importantly, we have object orientation, which is also implemented here. And we have procedural programming, but we also have functional programming. We have so many paradigms, I don't want to list them all. And much more important, we have positive and negative principles. So I only listed the most important positive principles or patterns. This is, don't repeat yourself, try. So we don't want to copy-paste code, because if we want to change or want to fix bugs in one of these code blocks, then we also have to do the same thing in another block. So rather, we put it into a function and just call the function at two different points.  Simple things are better than more complicated things. But we also have anti-patterns like spaghetti code and copy-paste coding, which we try to avoid, and which currently I have the impression that for designers and for people who use Inkscape, again, this doesn't really count. So copy-paste is, yeah, do it. There's not really an alternative to that and the alternatives are not encouraged enough. People use it and then in the end they get angry because they have a scene which is unmaintainable. This is also true for Lapeche and TIPS. You can also have macros and variables. So I really like these tools, but unfortunately you don't have immediate visual feedback, so this is also difficult for many people to use, including me. So yeah, I use it for some things, but for others it's just too much overhead. And in 3D modeling and animation, this is really common. So I don't know any 3D program where you don't do things like that. So is it Blender? It's quite well hidden in Blender, but in Cinema 4D, for example, it's very obvious and this is actually also where the motivation to start this project came from. I just want to mention Houdini, it's not open source unfortunately, but it's a completely procedural. So you see in 3D modeling and in 3D animation there are many, many of these paradigms and many ways to interact with it, but unfortunately it's not implemented in Inkscape, but it's also not implemented in Illustrator, it's not implemented in CoralTor as far as I know. So yeah, why is there no 2D? What you see is what you get in it, which is object-oriented, which is somehow structured or which is dry, don't repeat yourself. I have a few ideas. Maybe it's too complicated for artists, so they are used to do that and yeah, it works. So why should we do something else? And I think for many use cases this is true. As object-oriented programming is not the way to go for every programming task, there's why not use C for very simple or maybe even for more complicated things like dark table. So this works. And people who are used to it and who like this, yeah, they can continue to do that. But it works for 3D. So why do 3D artists can do this or want to do this but 2D artists don't want to do that? And I think this is because 3D is inherently more complicated so yeah, there's more that they want. How to express that? So for them it's not such a big step to get into more abstraction because they do it anyways. And many programmers I know they don't want to deal with these problems, they use what you see as what you mean instead, so they use large-ish antics and not perfect or work from their figures directly in Python and not plot-lib. Of course, they also don't suffer from these problems. So who is left who could use some of these paradigms? First of all, it's me. Because I want to do this, I'm really bothered with how things work currently. I don't want to work that way. I don't like it. But also those who like abstraction and are somehow accustomed to 3D or programming and who want to have immediate visual feedback. So they cannot use ticks because they have to compile their document every time they do change. And it's also for those people who want to sustain who don't want to sustain application and unstructured scenes and documents. And one thing Alex pointed out, I'm not sure if he's here, he promised to be here. Ah, he's there, great. This is great for animation. And this is something I will talk later about very briefly, but I think he's right. So this is, if you do animation, or if you don't do animation, if you just do a still-see, then it kind of works. What you have is what you see and it's pointed to PNG. No one cares about the structure anymore. Everything is a pixel. But if you have animations or interactions, then the relationships and the structure of the objects becomes very important because if you do an animation and the arm suddenly is another place as the body, then things become creepy. Okay, so let me talk briefly about my development I'm sorry, Ale. I promise not to do this, but I think I have a few more minutes. Six minutes. So I started this about six months ago. So the concept is already about four years old. So since four years, this topic is really bothering me. But this implementation is only six months old. I estimated about 1,000 hours of work and 800 commits and 40,000 lines of code. That gives you an impression of the size of the project and what does it do? It implements basically all the things I just mentioned. It is object-oriented, it is structured, it is non-destructive and you can interact with it in a non-linear fashion. And it also implements the first principle I tried to stick to as user-printliness. So it tries to give very low entrance burdens so you can just start and do nice things with it. And if I want to summarize it within just one sentence I would say you can, well, it's entirely 2D so you cannot do any 3D things with it but it tries to resemble the 3D workflow. So if you are accustomed to a 3D modeling suite like Blender or Cinema 4D or Maya or 3DS Max, this might really, you might really like this. One other principle is, so we stick to these many principles and paradigms but we don't want to sacrifice usability. Five minutes? We don't want to sacrifice usability. So we don't force people to do this but we encourage people to do this. So if you want, if you have this cloner that plants this tip around the shape you can simply press C or convert and you have these one, two, three, four, five, six... Yeah, six tips and you can track them around manually. Of course you shouldn't do this because then you lose all the nice properties but you could if you wanted. Another principle is transparency. I don't mean alpha channel. I mean that the program works in the way the user expects it and the user always sees what happens. One big reason or one big thing which implements this is the object tree. So the object tree always gives you the topological structure and tells you what you're seeing is looking like. Then you have all the standard things of vector graphic programs like rectangles, ellipse lines, procedural pathes, generators, I just talked about including outlines and text. And we have an image object which allows you to include pixel graphics and SVG or PDF graphics as one object so you cannot actually edit it but you can use it. And we have basically curves. We have some tools. I really want to keep the number of tools low because most of the things should be expressed by objects but it's not possible without tools, unfortunately. And one thing I find really interesting is it's scriptable. So you can use all the properties you see here. So for example, the mode, count, path, start and end point and script is using embedded Python. This is also used towards animation. And we have simultaneous editing. So whenever two properties are shared by two objects so for example if you select two ellipses both ellipses have the radius property then you can edit this radius property for all the ellipses at once. So this is, I think, also a very huge step towards usability. And this is not limited to two objects but you can have any number of objects. And we have flexible GUI with drag-and-drop dockable widgets and we can extend objects using text. You might also notice from other programs. So for example here we have a path and each of these tips have a path tag. So it is constrained to that path and you can just say I want it at 50% or 100% or whatever. And we have exhaustive undo redo. We have customized key bindings. We have internationalization. We can load and save to JSON. This is more or less arbitrary. We could also use some XML or binary thing but I found for debugging JSON is great. And we can export the pixel SVG and soonish to PDF. For the future I want to implement more generators, shapes and some more tools, not many. As I said, one big point is animation. So for motion graphics I think this will be the killer application. Also I want to add some modifiers. For example to add some random to the cloner or to bent or general paths and edges. I would like to improve the styles. I haven't talked about this unfortunately now but styling system is also very interesting. If you know CSS you will be very familiar with it but it's much less text like. It's much more intuitive and with drag and drop properties. I also want to do some small things and procedural world, add systems and fractals and of course some performance and work optimizations. So I think we got one minute left. I would like to do a live demo but I think it's not enough time so if you want to see a live demo please speak to me outside. I think after this talk there will be a break. So this is the perfect time and now just anyone have questions I would like to thank you for your mechanics.