Sébastien Canard

Adel Hamdi

Fabien Laguillaumie

Blind Functional Encryption

Functional encryption (FE) gives the power to retain control of sensitive information and is particularly suitable in several practical real-world use cases. Using this primitive, anyone having a specific functional decryption key (derived from some master secret key) could only obtain the evaluation of an authorized function f over a message m, given its encryption. For many scenarios, the data owner is always different from the functionality owner, such that a classical implementation of functional encryption naturally implies an interactive key generation protocol between an entity owning the function f and another one managing the master secret key. We focus on this particular phase and consider the case where the function needs to be secret. In this paper, we introduce the new notion of blind functional encryption in which, during an interactive key generation protocol, the master secret key owner does not learn anything about the function f . Our new notion can be seen as a generalisation of the existing concepts of blind IBE/ABE. After a deep study of this new property and its relation with other security notions, we show how to obtain a generic blind FE from any non-blind FE, using homomorphic encryption and zero-knowledge proofs of knowledge. We finally illustrate such construction by giving an efficient instantiation in the case of the inner product functionality.

Introduction

With the growth of online activities, multiple data (confidential emails, employment contracts, bank transactions, etc.) are transmitted and stored over different external platforms. A ruthless competition between several actors is ongoing in order to offer particular services, based on those data, thus answering positively to an increasing demand. For example, one could subscribe to a malware detection service (or a spam filter ) that aims to identify bad patterns over some incoming messages and, at best, to reject them. In a different use case, a company or an institution specialized in machine learning algorithms could find interest to obtain some specific data from a data owner to improve its algorithms: individuals with specific characteristics related to e.g., healthcare, or companies with some specific kind of data for e.g., threats detection related to Intranet/Internet browsing. At the same time, several concerns about the security and privacy of manipulated data bring new challenges to those organizations in this context. Encryption mechanism is one enabler to achieve the compliance and data security/privacy that is required in today's security interest. However, conciliate data confidentiality and functionality could be a hard task by using basic allor-nothing approach of traditional encryption schemes, where no computation are possible, except by decrypting the data itself, then decreasing the obtained security. From a higher perspective, we consider a scenario with an entity that try to get in clear a function over some encrypted data.

In recent years, Fully Homomorphic Encryption (FHE) [START_REF] Gentry | Fully homomorphic encryption using ideal lattices[END_REF] and Functional Encryption (FE) [START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF] arise as a general and very promising framework that gives the flexibility and the possibility to retain control of leaked information. Where FHE permits to delegate some computation over sensitive data to third parties, FE gives the power from an encryption of a message m and functional decryption key sk f for a certain function f , to obtain in clear the evaluation f (m) and no additional information.

Motivation. In a FE scheme, the function decryption key sk f is derived from a master secret key msk and the function f . The master key owner is then very powerful and (even if mainly separate) is most of the time close to the data owner. It follows that in most use cases, the functional key generation protocol is interactive between the owner managing the master secret key msk and the owner of the algorithm knowing the function. While the natural approach to obtain sk f is to send f to the master secret key's owner, we give amongst other concerns interest to a situation when the evaluation function f could be sensitive. In the malware detection example, it corresponds to the market compliance defined in e.g. [START_REF] Canard | BlindIDS: Marketcompliant and privacy-friendly intrusion detection system over encrypted traffic[END_REF] which shows the sensitivity of the rules given by the security editor. In the data analytics scenario, the underlying machine learning algorithm to better detect a specific disease or a malware is sometimes linked to some very specific and rare know-how. Hence, it could be relevant and crucial to blind the underlying structure to the master secret key owner.

Our Contributions. More precisely, we provide in this paper the following three main contributions. Contribution 1: general definition of blind interactive FE. For real-life applications, the functional key extraction is interactive. The authority AUT that controls the msk must get the function f in some way. This lead us to consider in this work an interactive functional key generation phase. The definition of IFE is then adapted and similar to the one of FE (i.e we maintain Setup, Enc, Dec and the correctness condition), except that we replace the KeyGen algorithm by an IKeyGen two-party protocol between AUT and U. The result of the interaction is a functional key sk f for U and some output defined by the view of AUT . In addition, we provide some adapted security definition from FE to the IFE case. In particular, the message-privacy (MP) property asks that no additional information about m is produced by the system except of f (m), while the function-privacy (FP) asks that the functional key does not leak additional information about f . We show how to adapt these existing security definitions from FE to the IFE case. Then, our new notion of blindness is inspired by the notions of blind signatures [START_REF] Juels | Security of blind digital signatures (extended abstract)[END_REF] or blind identity-based encryption (IBE) [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF][START_REF] Camenisch | Blind and anonymous identitybased encryption and authorised private searches on public key encrypted data[END_REF].

Intuitively, it means that a curious AUT cannot link a functional key to an interaction it had with an honest user U. Even if it looks related to the FP security, we show in the sequel that our notion of blindness is different (and complementary) from FP in the general case. Contribution 2: generic construction of blind IFE from any FE. A possible approach to derive generically an interactive FE would be to use a secure two-party computation of the IKeyGen protocol. We insist that such an approach does not achieve the blindness property we are interested in. Indeed, although the authority does not learn the user's input with 2PC, it could make the functional keys output by two users in the blindness security game depend on the function in different ways. This is possible by using for example two different master keys.

Here is an overview of the construction (see Sec. 3): Our approach starts from an existing FE scheme for a class of function F and upgrades it to a blind IFE scheme from the same class F , by only modifying the KeyGen algorithm. U starts by encrypting an encoded version of some function f with a Fully Homomorphic scheme FHE under her own key and sends the ciphertext C f to AUT . With msk, the party AUT homomorphically evaluates the circuit KeyGen(msk, •) using the FHE.Eval algorithm on C f , then sends back a ciphertext C sk f of the corresponding functional key sk f . U can now decrypt with her (FHE) secret key the received ciphertext and recover sk f . Thereby, the FHE blinds to AUT both the function f and the key sk f . However, this basic protocol is insecure since each entity could cheat on its input, hence we provide some modifications using Zero-Knowledge Proofs of Knowledge (ZKPoK) mechanisms to ensure correct behaviour and to prevent from getting some unauthorized functions. With this considerations, we are able to obtain a feasibility result on the construction of blind IFE scheme. Contribution 3: specific construction for IPFE. Many applications, such as data mining or statistical computation need as subroutines inner product evaluation. That is why several [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF][START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF][START_REF] Castagnos | Practical fully secure unrestricted inner product functional encryption modulo p[END_REF] IPFE constructions have recently been proposed. Most of known schemes extract functional keys of the same shape: (y, s, y ) where s, y ∈ Z p for a (large) prime p, where x, y := i=1 x i • y i is the inner product of x ∈ R and y ∈ R for some ring R. Our contribution is to give an efficient two party protocol computing these functional keys with the blindness property, and which can be used in the constructions whose functional key is an inner product. Hereafter, we modify the construction from [START_REF] Goethals | On private scalar product computation for privacy-preserving data mining[END_REF] by using the Castagnos-Laguillaumie (CL) linear homomorphic encryption from [START_REF] Castagnos | Linearly homomorphic encryption from DDH[END_REF] since we need inner product computed in Z p . We can then directly embed this protocol into secure DDH-based schemes like those of [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF][START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF] or in the CL-based protocol from [START_REF] Castagnos | Practical fully secure unrestricted inner product functional encryption modulo p[END_REF]. We develop in Sec. [START_REF] Agrawal | On the practical security of inner product functional encryption[END_REF] an IKeyGen protocol that implements the KeyGen algorithm in order to build a blind IPFE scheme. Related Work and discussion. The notion of interactive key generation is considered in the case of Accountable-Authority Identity-Based Encryption (IBE) in [START_REF] Goyal | Reducing trust in the PKG in identity based cryptosystems[END_REF]. The first consideration of blindness for IBE appears in the work of Green and Hohenberger in [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF] followed by of Camenisch et al. [START_REF] Camenisch | Blind and anonymous identitybased encryption and authorised private searches on public key encrypted data[END_REF] where it was used as a building block for respectively a simulatable oblivious transfer and a public key encryption with oblivious keyword search. In [START_REF] Rial | Blind attribute-based encryption and oblivious transfer with fine-grained access control[END_REF], an adaptation is proposed for the case of the Attribute-Based Encryption (ABE) primitive. More recently, [START_REF] Emura | Identity-based encryption with security against the KGC: A formal model and its instantiation from lattices[END_REF] consider a variant of blind IBE to resolve the key escrow problem. As far as we know, no such study has been done for the more general case of functional encryption. Controlled functional encryption [START_REF] Naveed | Controlled functional encryption[END_REF] is also a variant of FE with an interactive behaviour. While similar to our general approach of hiding the function to the authority, the model is different from ours. 3Private function evaluation (PFE) [START_REF] Abadi | Secure circuit evaluation[END_REF] is closely related to our problem. In PFE, a party P 1 holds an input x while another party P 2 holds a circuit C g describing a function g; the goal is for one (or both) to learn the result g(x). Our blind IFE could be seen as a PFE with the additional property of blindness, which is not automatically guaranteed by a generic PFE. Eventually, the security requirements could be defined in terms of simulatability which informally enable to design an ideal functionality that captures previous properties (message-privacy, function-privacy or blindness) and consider interdependent executions with other protocols while preserving the main security characteristics. However, we took the classical approach to provide a natural generalization of the blindness property, as well as the classical security notions for FE (message/function privacy) in the presence of an interactive key generation protocol. This has the benefits to only adapt existing definition by adding some interactive oracles, and avoid eventually some subtle negative results, as in the context of simulation-based blind signature [START_REF] Abe | A framework for universally composable non-committing blind signatures[END_REF]. In addition, our solution encompasses the existing definitions for IBE/ABE cases [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF][START_REF] Camenisch | Blind and anonymous identitybased encryption and authorised private searches on public key encrypted data[END_REF][START_REF] Han | PPDCP-ABE: Privacy-preserving decentralized ciphertext-policy attribute-based encryption[END_REF][START_REF] Rial | Blind attribute-based encryption and oblivious transfer with fine-grained access control[END_REF] presented in the literature.

Blind Interactive Functional Encryption

Based on the known definitions of FE [START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF], we formally define our new notion of blind interactive functional encryption. Our goal is twofold. We first want to capture the situation of a user holding a function f and asking an authority for a corresponding functional key sk f during an interactive protocol. We then consider the case where the user wants to protect the function f from the authority. In the sequel, we introduce the notion of interactive FE with the new security notion of blindness. In addition, we discuss some related security properties.

Syntactic Definitions for Interactive FE

We set for the rest of the paper two specific parties: an authority denoted by AUT and a user denoted by U. For a λ ∈ N, fix an arbitrary set of functions F represented by a poly-sized family of circuits {F λ } λ∈N and a message space M , where each m ∈ M ⊆ {0, 1} * is represented by a string input of any f ∈ F . A public key interactive functional encryption is defined as follows.

Definition 1 (Public key IFE). Let λ ∈ N. An interactive functional encryption scheme for F consists of a tuple IFE = (Setup, KeyGen, Enc, Dec) where, -Setup(1 λ ) is a PPT algorithm that takes as input a security parameter 1 λ and outputs a master secret key msk and a master public key mpk. -IKeyGen(AUT (msk), U(mpk, f )) is a 2-party interactive protocol between an authority AUT with input the master secret key msk and a user U with inputs a master public key mpk and a function f ∈ F . The output of this protocol is, on the authority's side Output(AUT ) and on the user's side, sk f . -Enc(mpk, m) is a PPT algorithm which takes as input the master public key mpk and a message m ∈ M , and returns a ciphertext c. -Dec(mpk, sk f , c) is a PPT algorithm which takes as input a master public key mpk, a functional key sk f and a ciphertext c and outputs a string z.

For correctness, for all f ∈ F and m ∈ M , given (mpk, msk) ← Setup(1 λ ), sk f resulting from IKeyGen protocol between (honest) AUT and U and c ← Enc(mpk, m), we require Pr Dec(mpk,

sk f , c) = f (m) ≥ 1 -negl(λ).
The above definition can easily be adapted to the private-key setting. Notice that functional encryption denoted by FE = (Setup, KeyGen, Enc, Dec) falls as a particular case, i.e there is a non-interactive KeyGen algorithm executed by the owner of msk (AUT in our context) which outputs a functional key sk f . In addition, our generic conversion will start from a FE scheme with a determined KeyGen algorithm. Since it takes (the description of) f and msk as inputs, it will be necessary to specify the size of the circuit that computes the function f in addition to the size and depth of the circuit computing KeyGen.

A Trivial Example. In the following, we present a simple IFE that one can obtain from any FE. Given FE = (Setup, KeyGen, Enc, Dec) following Definition 1, it is easy to define a trivial interactive IFE scheme as Trivial.IFE := (Setup, Trivial.IKeyGen, Enc, Dec) where Trivial.IKeyGen protocol is defined in Fig. 1. Here, the user simply asks the msk owner's (i.e AUT ) to generate the functional key sk f . In particular, this protocol corresponds to the most common implementation for real-life use-cases of FE as discussed in the introduction. While it is simple, it is interesting to notice that in Trivial.IFE, the user does not learn any information about msk. In particular, the intuition is to conjecture that the resulted IFE scheme will inherit the message-privacy of the FE scheme. We prove this fact in Prop. 2, but this observation also gives the intuition of the notion of the leak-freeness property that we will define in Sec. 2.3. On the other hand, blindness is not guaranteed by construction since AUT learns f . Validity of sk f . One issue of this trivial example is that the authority may have sent to the user a fake key sk f . Thus, the latter should have a way to verify its validity. One solution was given for interactive blind IBE [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF][START_REF] Camenisch | Blind and anonymous identitybased encryption and authorised private searches on public key encrypted data[END_REF]. They propose to encrypt a polynomial number of random messages with id, then try to decrypt using the obtained identity-related key. A first idea can be to proceed similarly, which works quite well in the public key setting and in the case of (indexed) functions of the form of known relation. However, in the general case, this method may obviously not convince a user of the validity of the sk f , and is definitely not possible in the private key setting. We then propose to make use of a Zero-Knowledge Proof of Knowledge ZKPoK, generated by the authority to prove that it has correctly computed sk f , as π ← ZKPoK{msk : sk f = KeyGen(msk, f )}. We stress that considering the validity of sk f is an additional requirement and we can have this property using another approach. However, when dealing with blindness, having ZKPoK could help in order to force AUT to assure that sk f is well formed.

f k (m, y) := m ⇐⇒ R(k, y) = 1 where R is a publicly AUT (msk, mpk) U(mpk, f ) f ← ----------- skf ← KeyGen(msk, f ) skf -----------→ Output (f, skf ) Output skf

High-Level View of Security Properties

An interactive FE must first verify a message-privacy property. This will be discussed in Section 2.3. Then, we consider our new notion of blindness and discuss other properties. We first analyse what the authority could learn.

Output of the authority. The fact that we want to hide the function to the authority is at first related to the authority's view of the interactive protocol. Indeed, intuitively, the best case (hiding f and sk f ) would be an authority which does not learn anything more that what it already knew before the interaction.

Recall that the authority, by definition, can deduce Output(AUT ) from its own view View AU T (msk, f ) := (msk, r; m 1 , . . . , m t ), where r some random elements, and m j the jth message that it received from some interaction.

1. Considering f in the output. To ensure a notion of blindness of the key generation algorithm, the authority cannot obtain from the received messages m j , or more generally, from View AU T (msk, f ), any information about the user's choice of the function. A standard solution, as in the context of blind signature [START_REF] Juels | Security of blind digital signatures (extended abstract)[END_REF], is to ask the authority to link a functional key sk f generated during an interaction to the corresponding function f . Informally, the adversary runs two random sequential executions of the protocol with two users and is asked to link the produced functional keys to each user. We will call this notion blindness which is, to the best of our knowledge new in the general context of functional encryption. We treat this security notion in Sec. 2.4. In particular, having f , or some information about f during one execution (i.e is one of the m j ), as for the construction of Trivial.IFE (see Ex.

2.1), gives a way to find the user's choice, thereby breaking blindness. 2. Considering sk f in the output. The functional key sk f is used to decrypt ciphertexts c m of some messages m in order to obtain values f (m). For the authority, which is in possession of msk, it is possible to encrypt any message m of its choice. If sk f can be deduced from View AU T , then the authority can learn arbitrary information about f (every f (m) of its choice). This last observation remains true even if we start from a function-private FE where sk f have some hiding property and does not leak any information about the function f . We deduce that having sk f in the authority's view breaks the blindness requirement of the last paragraph since it easy to distinguish two sequential interactions. Because of this access to an unlimited evaluation of the function f , we remarked that the same problem arises in the context of function-private (FP) public key functional encryption [START_REF] Brakerski | Function-private functional encryption in the private-key setting[END_REF][START_REF] Boneh | Function-private identity-based encryption: Hiding the function in functional encryption[END_REF] where hiding information about f in sk f gives the same restrictions. We give a formal treatment of function-privacy for IFE in the full version.

Finally, we provide in Sec 2.5 a discussion about possible relations between FP and blindness where we prove that there are in fact two separate notions.

Message-Privacy for Interactive FE

Adaptation from FE. The basic security consideration for functional encryption is related to the standard notion of semantic security in presence of different functional keys [START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF]. As it is usually done, we consider the adaptive form of message-privacy with multiple messages and multiple functional keys. Our notion of message privacy is a direct adaptation of this classical notion when we have to consider interactive oracles. We refer to Def. There are two different ways to prove that an interactive FE is message-private. Obviously, the direct way which shows that a protocol fulfils the Definition 8.

Another possibility relies on the notion of leak-freeness that we will present next. Leak-Freeness. Recall that in Trivial.IFE of Ex. 2.1, the curious user does not learn any information about the master secret key msk that could help her to break the MP security game of the FE scheme. Regarding blindness, we note however that the user has to hide to the authority its inputs, but could cause the protocol to leak additional information about msk. In particular, when building a message-private IFE, one could hope to only get the information that could be obtained from a natural Trivial.IFE. Informally, we have to compare the different information that could be obtained from the proposed interactive key generation and the trivial implementation of FE, i.e the Trivial.IFE.

Let FE = (Setup, KeyGen, Enc, Dec) be a message-private scheme. Inspired by the work done for IBE [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF][START_REF] Camenisch | Blind and anonymous identitybased encryption and authorised private searches on public key encrypted data[END_REF], we generalize the notion of leak-freeness for functional encryption. Such notion aims at providing a condition to preserve from learning any additional informations, due to the interactive key generation, that could break the message-privacy. Informally, it makes possible to prove that an IFE.IKeyGen protocol executed with an honest authority does not leak more information than the Trivial.IKeyGen from Example 2.1, with the same honest authority. The main intuition is that such notion can then be used to prove that the resulting interactive functional encryption IFE = (Setup, IKeyGen, Enc, Dec) is also message-private. The formal definition of leak-freeness is given in appendix C. The motivation of this notion is given by the following proposition. Proposition 3. Let FE = (Setup, Enc, KeyGen, Dec) be a message-private secure FE scheme. Let IFE := (Setup, Enc, IKeyGen, Dec). If IFE.IKeyGen is leak-free with respect to KeyGen, then IFE is message-private.

Due the lack of space, the proof of this proposition is not provided here but it could be seen as a generalization of the result in the IBE case presented in [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF]. This proposition is used to prove the security of our generic construction.

Blindness for Interactive FE

In this section we formally define our new blindness property. Intuitively, following the usual definition for blind signatures [START_REF] Juels | Security of blind digital signatures (extended abstract)[END_REF], blindness means that the authority cannot link a functional key to an interaction it had with an honest user. This is clearly related to the information that the authority has at the end of the key generation protocol, namely Output(AUT ).

It is possible to define a unique notion of blindness independently for both the private and public key settings. This situation is simulated by an adversary who can choose maliciously the parameters but follows the protocol. His aim is to decide which of two chosen functions f 0 , f 1 has been used to generate the functional keys sk f0 and sk f1 in two sequential executions with an honest user U. We call this notion blindness and corresponds to a variant of the selectivefailure blindness security considered in [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF][START_REF] Camenisch | Blind and anonymous identitybased encryption and authorised private searches on public key encrypted data[END_REF] for IBE, which adds the following property: the authority cannot cause the protocol to fail in a manner dependent on the user's choice. This additional security requirement was used in order to build oblivious transfer [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF] or searchable encryption [START_REF] Camenisch | Blind and anonymous identitybased encryption and authorised private searches on public key encrypted data[END_REF]. Here we consider basic definitions and leave extensions for further applications.

We introduce the interactive oracle IKeyGen(•, O(mpk, f )) in which the adversary plays the role of the authority and only obtains his own output. In the game below, we write A IKeyGen (1) (•,O(f0))/IKeyGen (1) (•,O(f1)) , which mean that A can query each oracle only once (hence the notation IKeyGen (1) ) and that the two oracles can be invoked in an arbitrary order. This definition can easily be adapted to the private key setting. Remark. It is important to note, as in the context of blind signatures, that any information about sk f that can be deduced during the interaction from the Output(AUT ) leads our definition to fail. Indeed, for example if A gets sk f in the end of the interaction, it will obviously win the game by just interacting with one of the two oracles. In fact, any left-or-right definition would fail, since during the interaction there is always a way to distinguish between two keys/interactions. This difficulty comes for the inherent capabilities of the FE scheme. From the encryption of a certain message m such that f 0 (m) = f 1 (m) and an interaction giving sk f b at the end of one of the two interactions, it is always possible to decrypt and get f b (m). Since f 0 and f 1 are chosen by A, it seems clear that the blindness implies in particular that the malicious authority does not get information about sk f and f during (or in the end of) the interaction.

Definition 4 (Blindness). Let b ∈ {0, 1}. An IFE is blind, if every adversary A has a negligible advantage |Pr[b = b] -1/2| in the following experiment 1. (mpk, f 0 , f 1 , st f ind ) ← A Setup(•) (f ind, 1 λ ). 2. st issue ← A IKeyGen (1) (•,O(mpk,f b ))/IKeyGen (1) (•,O(mpk,f 1-b )) (issue, st f ind ),

On the Relationship between Function-Privacy and Blindness

Function-privacy for (I)FE. Several other security properties have been considered for FE in the literature and we will not review all of them. However, we could generalize the known [START_REF] Boneh | Function-private identity-based encryption: Hiding the function in functional encryption[END_REF][START_REF] Brakerski | Function-private functional encryption in the private-key setting[END_REF][START_REF] Agrawal | On the practical security of inner product functional encryption[END_REF]] notion of function-privacy which informally states that a functional key sk f does not give any additional information about the underlying function f , except from what is given by the evaluations over some data being encrypted. We give in the full version a generalization of it in the context of IFE where informally, interactive oracles are added in order to consider potential leakage during the interaction. Since our aim is to present a blind IFE scheme, we only briefly highlight the differences between theses notions.

Depending on the public or private key setting and the presence or not of sk f in the authority's output, we obtain several (dis)connections between functionprivacy and blindness security properties. Informally, this is due to the nature of the considered options. Indeed, the FP security asks any adversary which does not have necessarily an access to an encryption oracle, to obtain unwanted information about the function f from sk f and eventually the interaction. The blindness security game concerns an authority with the capability of encrypting arbitrary messages using the master key msk. We now give our main theorem which, in a nutshell, says that these two properties are distinct, and then complementary. In the full version of this paper, we provide a detailed proof of this theorem by providing, for each of the resulted six cases a separating construction.

Theorem 5. Blindness and Function-Privacy properties are mutually separated, for both private-key and public-key IFE.

Generic Construction of Blind IFE from fully homomorphic encryption

We provide in this section a generic construction of a message-private blind interactive functional encryption from any FE, where AUT does not obtain any -IFE.Setup(1 λ ): Output (mpk, msk) ← FE.Setup(1 λ ).

-IFE.IKeyGen(AU T (msk), U (mpk, f )) is described in Fig. 3 -IFE.Enc = FE.Enc -IFE.Dec = FE.Dec Fig. 2. Our generic blind IFE

AU T (msk, mpk) U (mpk, f ) Select random R (pk, sk) ← FHE.Setup(1 λ ) ctf ← FHE.Enc(pk, f ; R) pk, ctf ← ------------------- πU ← ZKPoK(sk, f, R) : {f ∈ F ∧ (sk, pk) = FHE.Setup(1 λ ) ∧ ctf = FHE.Enc(pk, f ; R)} ← ------------------→ If Verify(πU ) = 0 aborts Select random R , R ctsk f ← FHE.Eval(pk, KG msk,R , ctf ; R ) with KG msk,R := FE.KeyGen(•, msk; R ) ctsk f -------------------→ πAUT ← ZKPoK(msk, R , R ) : { ctsk f = FHE.Eval(pk, KG msk,R , ctf ; R )} ← ------------------→ If Verify(πAUT ) = 0 aborts Output skf ← FHE.Dec(sk, ctsk f )
Fig. 3. Our interactive key generation IFE.IKeyGen information at the end of the interactive key generation. In addition, our concern is to not modify the Setup, Enc, Dec algorithms but only the KeyGen algorithm.

Our Generic Construction

Let λ > 0 be a security parameter and consider a family of functions F = {F n,λ } n=n(λ) whose input size n(λ) is polynomial in λ. Suppose that all functions f ∈ F can be encoded as a p(λ)-bit string (for a polynomial p). Consider a functional encryption scheme FE = (Setup, Enc, KeyGen, Dec) for this family F . We suppose that FE.KeyGen is a randomized algorithm that is described by a circuit of logarithmic depth d(λ). Consider FHE = (Setup, Enc, Dec, Eval) to be a CPA-secure Fully Homomorphic Encryption scheme, where the input encryption algorithm is a bit string with size at least p(λ) and supports evaluation of circuits of depth at least d(λ). Our interactive blind functional encryption for the class of function F is described in Fig. 2 and3. Note that encryption and decryption are exactly those of the original FE.

Correctness. By correctness of the FHE scheme, the user U obtains after decryption sk f = KG msk,R (f ) := FE.KeyGen(msk, f ; R ) for certain random R .

Security of our Construction

Roughly speaking, the CPA-secure FHE will insure blindness since two interaction transcripts are indistinguishable and the ZKPoK will guarantee that no additional information is leaked from the interaction. Additionally, we will need a notion of weak-function indistinguishablity which informally says that any adversary (even if it knows the secret key of the FHE) cannot produce any FHE ciphertext ct y , for input y, two functions h 0 , h 1 with h 0 (y) = h 1 (y) such that it could distinguish between FHE.Eval(pk, h 0 , ct y ) and FHE.Eval(pk, h 1 , ct y ) (we refer to [START_REF] Barak | Bounded key-dependent message security[END_REF] and the full version of this paper for a precise definition).

Theorem 6. Consider a message private FE in addition to a weak-function indistinguishable CPA-secure FHE scheme. If the proofs π U and π AU T are ZKPoK, then the IFE described in Fig. 2 is message-private and blind.

Due to space limitation, we only sketch the main ideas of the MP security proof and provide a complete proof of blindness.

Sketched proof of MP. Similarly to the proof [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF] for the IBE case, we first prove that the IFE.KeyGen protocol is leak-free (see Sec. Proof of Blindness. In the proof of blindness, we have to show that the (sequentially generated) messages exchanged between a malicious authority AUT and two honest users are completely independent from the functions. We prove it via a sequence of hybrid games. By using the extractability of ZKPoK, we first obtain msk from the interaction with the adversary. This allows us to replace the generation of the functional secret key by the non-interactive version, in a nondetectable way. We finally reduce our problem to the one of the CPA-security of the FHE scheme. In the final game, the malicious authority obtains messages that are independent from the functions of its choice, which imply blindness. Suppose we have an adversary A attacking the blindness game. Recall that it chooses the public parameters (mpk, msk) and two functions f 0 and f 1 , then runs two sequential interactions with honest user U(mpk, f b ) and U(mpk, f 1-b ) respectively where b is a random bit. At the end of the interactions, A receives the two functional keys (sk f0 , sk f1 ) (or (⊥, ⊥)) corresponding to (f 0 , f 1 ). The goal for A is to find the bit b with non-negligible probability. We note b := 1 -b. We prove the blindness property via a sequence of games. Game 0. This is the original game as in Def. 4. We give more details about each interaction in Fig. 4. We will describe the interaction of the adversary with each oracle user U b and Ub. Lines 1,7,11-12 describe the behaviour of A during the blindness game and the remaining lines the user's behaviour. Game 1. We modify Game 0 in the following way. In this game, because there are two possible ZKPoK (see line 8) , we know that there exists an extractor Ext b (resp. Extb) that can extract the witnesses from π b (resp. π b) and obtain w * b = (msk * b , R b , R b ) for each bit b ∈ {0, 1}. We add the following quantities for each user in line

Game 0 1. (mpk, f0, f1) ← A Setup(•) (1λ) 2. (pk b , skb) ← FHE.Setup(1 λ ) (pkb, skb) ← FHE.Setup(1 λ ) 3. ctf b ← FHE.

8: w

* b := (msk * b , R b , R b ) and w * b := (msk * b , R b, R b ).
The matching condition prevents the adversary to use two different master secret keys. Thanks to the extractability condition, the rewinding techniques of the ZKPoK, it is possible to efficiently extract the corresponding witness, and for the adversary, the success probability remains the same (except with negl. probability). Assuming that the π are proofs of knowledge, Game 0 is then indistinguishable from Game 1. Game 2. We modify the Game 1 in the following way. If the master secret keys do not match, i.e msk * b = msk * b , the user oracles in the two interactions abort and we set (sk f0 , sk f1 ) = (⊥, ⊥). Otherwise, we set msk := msk * b and instead of decrypting ct b (or ct b), as in line 10, we exploit the extracted value msk, R b and the FE.KeyGen(msk, •; •) algorithm on input (f b , R b ) (resp. (fb, R b)) to obtain valid functional key(s). We replace line 10. by the new line (depending on b) sk f b ← FE.KeyGen(msk, f b ; R b ) and sk fb ← FE.KeyGen(msk, fb; R b). If the proof does not fail the oracles return (locally) sk f b (and sk fb ). Otherwise, it returns (sk f0 , sk f1 ) = (⊥, ⊥). Finally, we give as in line 11. (sk f0 , sk f1 ) to A. Thanks to the correctness of FHE and FE, Game 1 is indistinguishable from Game 2. Game 3. We change the behaviour of user U 1 and encrypt a randomly chosen function g 1 ∈ F with size description equal to f 1 with a modified proof of π 1 in the first message and π 1 in the second one. In more details, there exists a zero-knowledge simulator Sim 1 for π 1 that can simulate the proof of knowledge without knowing the underlying witness. We replace the term in line 3. for U 1 with ct g1,1 ← FHE.Enc(pk 1 , g 1 ; R 1 ), where R 1 is a random element. Next, we simulate the corresponding term in line 6. with π * 1 ← Sim 1 (π 1 ). In addition, there exists a simulator Sim 1 for π 1 such that the line 8. becomes π * * 1 ← Sim 1 (π 1 ). Now suppose that there is a distinguisher between Game 2 and Game 3 with non-negligible advantage, then we show how to build an adversary B that breaks the CPA security of the FHE scheme. B has the following behaviour. B generates a public pk 0 using FHE.Setup(1 λ ). It receives from the challenger of the CPA secure FHE scheme another public key pk 1 . It runs A in order to get f 0 , f 1 , mpk and uses them for the CPA security game by choosing the messages (g 1 , f 1 ). It forms ct 0 := FHE.Enc(pk 0 , f 0 ; R 0 ) (an encryption under his own key). Next, it receives an encryption ct 1 of one of the two functions {g 1 , f 1 } under pk 1 from the challenger. It can now use A in the following way by interacting as a legitimate user. It simulates the first messages of U 0 (line 5) with (m 0 := (pk 0 , ct f0 )) and U 1 with (m 1 := (pk 1 , ct 1 )). Up to this point, it could use the zero knowledge property and simulate the corresponding proofs π * 1 and π * * 1 . Finally, B returns the same output of A (the same bit). Now, taking a step back to the CPA security game, if ct 1 is an encryption of f 1 , then this situation corresponds to Game 2 experiment. If ct 1 is an encryption of g 1 then it corresponds to Game 3 by construction. Unless the proofs are not zero-knowledge, the advantage of B winning the CPA security game of the FHE scheme is the same as the advantage of A in distinguishing between Game 2 and Game 3. We deduce that Game 2 is indistinguishable from Game 3, assuming that the FHE scheme is CPA-secure and the proofs π, π are zero-knowledge. Game 4. We change the behaviour of U 0 as in the previous Game 3 by encrypting a randomly chosen function g 0 ∈ F with size description equal to f 0 with a modified proof π 0 in the first message and π 0 in the second one. In more details, there exists a zero-knowledge simulator Sim 0 for π 0 that can simulate the proofs without knowing the underlying witness. We replace the corresponding term in line 3. for U 0 with ct g0,0 ← FHE.Enc(pk 0 , g 0 ; R 0 ), where R 0 is a random element. Next, we simulate the corresponding term in line 6. with π * 0 ← Sim 0 (π 0 ) In addition, there exists a simulator Sim 0 for π 0 such that the line 8. becomes π * * 0 ← Sim 0 (π 0 ). We can then proceed as for the transition between Game 2 and Game 3 to prove that Game 3 is indistinguishable from Game 4, assuming that the FHE scheme is CPA-secure and the proofs π, π are zero-knowledge. Putting all previous results together, we finally conclude that Game 0 is indistinguishable from Game 4. In Game 4, the view of A is independent of b: the functional keys sk f b , sk fb do not depend on the values sent by A by construction. Thus, the probability of guessing the bit b is exactly 1/2. Hence, we conclude that this scheme satisfies the blindness property.

Efficient Blind Interactive Inner Product FE

We want to stress here that for specific functionalities, our approach can lead to efficient constructions. We propose in this section a blind functional encryption for inner product, which is inspired by our generic construction. For such a functionality, we only need a linearly homomorphic encryption scheme, and for efficiency reasons, we chose to use CL scheme [START_REF] Castagnos | Linearly homomorphic encryption from DDH[END_REF]. For most of the known IPFE scheme [START_REF] Abdalla | Simple functional encryption schemes for inner products[END_REF][START_REF] Agrawal | Fully secure functional encryption for inner products, from standard assumptions[END_REF], the functional key reduce to the computation of an inner product. The Setup algorithm consists of a description of a cyclic group G of prime order p > 2 λ with generator g ← G. For each i ∈ {1, . . . , }, it samples s i ← Z p and compute h i = g si . Finally, define msk := (s i ) i=1 and mpk := G, g, {h i } i=1 . Note that the prime p is set for the CL scheme according to the IPFE. This is possible thanks to the flexibility of the CL key generation which is presented in App. B, and we refer to this appendix for notations. Description of our scheme. The interactive key generation IKeyGen(AUT (s ∈ Z p ), U(mpk, y ∈ Z p )), consisting of the two-party private inner product computation is as follows, which is an adaptation of [START_REF] Goethals | On private scalar product computation for privacy-preserving data mining[END_REF].

-The user U generates a pair of keys pk = g x p and sk = x for the CL scheme over the message space Z p . Then, it encrypts each coordinate y i for i ∈ {0, . . . , } as c i = (c 1,i , c 2,i ) = (g ri p , f yi h ri ), sends pk, c y to AUT and performs a ZKPoK π U such that {h = g x p ∧ c 1,i = g ri p ∧ c 2,i = f yi h ri for i ∈ {1, . . . , }}. -If the proof fails, AUT aborts. Otherwise, it homomorphically computes c sky := (c 1,sky , c 2,sky ) ←-i=1 c si 1,i g r p , i=1 c si 2,i h r for some random r that it sends to U. Then, it performs a proof π AU T that:

{{g si = h i } i=1 ∧ c sky = i=1 c si 1,i g r , i=1 c si 2,i h r }.
-If π AU T fails U aborts. It decrypts c sky and gets sk y := (y, s, y ) ∈ Z p × Z p .

Our blindness notion is new in the context of FE, so it is difficult to find a point of comparison with existing classical 2PC protocols for computing innerproduct, since they were not designed for this context. However, we could compare with other linearly homomorphic schemes. The additive variant of ElGamal would imply to compute a final discrete log, which is not possible for large p. The ZKPoK are proofs for classical discrete logarithm-based expressions. The main subtleties concern the CL part since it uses a group of unknown order, which can be obtained from class group of ideals of orders of imaginary quadratic fields. As in [START_REF] Castagnos | Two-party ECDSA from hash proof systems and efficient instantiations[END_REF], the solution is to use repeated GPS proofs [START_REF] Girault | On the fly authentication and signature schemes based on groups of unknown order[END_REF] with binary challenges to get special soundness. More efficient techniques have been recently proposed in [START_REF] Castagnos | Bandwidthefficient threshold EC-DSA[END_REF]. For the proofs that concern the group G coming from the IPFE setup, a standard Schnorr proof is sufficient. Using Paillier encryption instead of CL prevents the necessity to repeat a GPS proof with binary challenge. It however necessitates to add (i) a proof that the Paillier modulus n has truly been computed as the multiplication of two primes p and q [12], (ii) a proof of knowledge of a plaintext y and its randomness r composing the given Paillier ciphertext c = (1 + n) y r n (mod n 2 ), which can be done using techniques given in [START_REF] Cuvelier | Election verifiability or ballot privacy: Do we need to choose?[END_REF] and (iii) a proof that y < p in a group of composite order [START_REF] Boudot | Efficient proofs that a committed number lies in an interval[END_REF]. We argue that this implies a heavier global proof than what we propose using CL encryption. Security and Efficiency Analysis of Our Inner Product IFE. The following result is a corollary of Thm. 6. Theorem 7. The scheme described above is message-private and blind if CL scheme is CPA-secure and the π U , π AU T are zero-knowledge proofs of knowledge.

A precise efficiency analysis of GPS-like proof in the context of CL encryption has been performed in [START_REF] Castagnos | Two-party ECDSA from hash proof systems and efficient instantiations[END_REF]. It is implemented within class groups of some imaginary quadratic fields. The cost of such a proof is dominated by the computation of exponentiations in the class group. [START_REF] Castagnos | Two-party ECDSA from hash proof systems and efficient instantiations[END_REF]Fig. 9] gives some measurements: on their architecture, an exponentiation takes 55ms for a 128 bit security. For the proof described in Eq. 4 with = 1, there are essentially 4 exponentiations in the class group. This protocol has to be repeated say 40 times to get a soundness error of 2 -40 , which means that such a proof costs less than 10 seconds (with = 1). The overall cost is then linear in , which means that our interactive blind IFE has a reasonable practical cost of times tens of seconds. This is even more reasonable that this extraction is done only each time that a functional key is necessary, which happens occasionally.

A Message-privacy for IFE.

Oracles. In traditional FE, the adversary has access to a KeyGen(msk, •) oracle which extracts a functional key when the adversary requests it for a chosen input function f . We here adapt the definition of message-privacy to our interactive setting. The main difference relies in the fact that some information could leak during the interactive key generation. We introduce an interactive oracle IKeyGen(O(msk), •): when calling this oracle, the adversary, on input f ∈ F , participates in an interactive protocol with the oracle playing the role of an honest authority. The adversary finally gets the output functional key sk f . For any bit b ∈ {0, 1}, we define Enc b (mpk, •, •) to be an oracle which takes as inputs x 0 and x 1 and returns Enc(mpk, x b ). The next definition extends known definitions [START_REF] Boneh | Functional encryption: Definitions and challenges[END_REF] to the interactive setting and could be well adapted for private-key FE.

Definition 8 (Message-privacy). Let IFE = (Setup, IKeyGen, Enc, Dec) over a message space M and a function space F . We say that IFE is messageprivate (MP) if for any PPT adversary A, there exists a negligible function negl(λ) such that the quantity, called the advantage of A, Adv A,MP-IFE (1 λ ) := Pr Exp (0),mp A (λ) = 1 -Pr Exp We required that for all f ∈ F and (m 0 , m 1 ) coming from A's calls to the oracles KeyGen and Enc b respectively, it holds that f (m 0 ) = f (m 1 ).

B The Castagnos-Laguillaumie scheme.

CL encryption scheme. The Setup phase in the CL scheme consists of the description of a DDH group with an easy DL subgroup (p, s, g, f, g p , G, F, G p ) where the set (G, •) is a cyclic group of order ps, for an unknown integer s, p is a prime number such that gcd(p, s) = 1. The only known information on s is an upper bound s of s. The set G p = {y p , y ∈ G} is the subgroup of (unknown) order s of G, and F is the subgroup of order p of G, so that G = F × G p . The elements f, g p and g = f • g p are respective generators of F , G p and G. The discrete logarithm problem is easy in F , which means that there exists deterministic polynomial time algorithm a Solve that solves the discrete logarithm problem in F . The message space of CL is Z p and its indistinguishability under chosen plaintext attacks relies on the hard subgroup membership assumption that says that is hard to distinguish the elements of G p in G. An instantiation of this group is obtained using the class group of a non maximal order of an imaginary quadratic field (we refer the reader to [START_REF] Castagnos | Linearly homomorphic encryption from DDH[END_REF][START_REF] Castagnos | Practical fully secure unrestricted inner product functional encryption modulo p[END_REF] for a more precise description). Roughly, CL scheme consists of a secret key sk is an integer x ← {0, . . . , sp -1} and the public key is pk = g x p . The encryption procedure returns a ciphertext c m = (c 1 , c 2 ) where c 1 ← g r p and c 2 ← f m h r for a random r. The decryption algorithm computes M ← c 2 /c x 1 and returns m using the Solve algorithm on M .

Fig. 1 .

 1 Fig. 1. Trivial.IKeyGen

  the step produces at the end of the executions local outputs (possibly undefined ⊥) sk f b and sk f 1-b respectively. 3. If sk f0 = ⊥ or sk f1 = ⊥, set (sk f0 , sk f1 ) = (⊥, ⊥).

4 .

 4 b ← A(guess, sk f0 , sk f1 , st issue ).

Fig. 4 .

 4 Fig. 4. Blindness experiment.

( 1 )

 1 ,mp A (λ) = 1 ≤ negl(λ), where Exp (b),mp A (λ) is 1. (mpk, msk) ← Setup(1 λ ) 2. b ← A IKeyGen(O(msk),•),Enc b (mpk,•,•) (1 λ , mpk) 3. output b = b.

  [START_REF] Abe | A framework for universally composable non-committing blind signatures[END_REF] and Def. C) with respect to FE.KeyGen and by Prop. 3, it implies the IFE is message-private. More precisely, we describe a simulator (which does not have msk) that makes use of the extractability of zero-knowledge proofs of knowledge to obtain the function f . Then, having access to some oracle Trivial.IKeyGen providing sk f , it could simulate a valid interactive IFE.IKeyGen protocol with any adversary by using (i) the homomorphic property of the FHE to generate the ciphertexts and (by evaluating the constant circuit equal to sk f ) (ii) its rewinding capability together with the zero-knowledge property of ZKPoK to simulate the proofs. Remark that in the simulation of the ciphertexts, the adversary cannot notice the difference thanks to the weak-function indistinguishability notion. Finally, we deduce that the IFE.IKeyGen is leak-free w.r.t FE.KeyGen and the result follows.

There are two parties in our model where the master secret key owner is the only party to provide functional keys. In[START_REF] Naveed | Controlled functional encryption[END_REF], it is only possible to produce functional keys that depends on the ciphertext and is only used once, while we consider multiple users, functional keys and ciphertexts.

Acknowledgements. The authors would like to thank Damien Stehlé for his suggestions during the redaction of this paper. All three authors were supported by the European Union H2020 Research and Innovation Program Grant 780701 (PROMETHEUS). The two first authors were also supported by the European Union H2020 Research and Innovation Program Grant 786767 (PAPAYA).

C Leak-freeness

We provide a generalization of the Leak-Freeness property of [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF].

Definition 9 (Leak-Freeness). An IKeyGen protocol corresponding to KeyGen algorithm of any FE scheme is leak-free w.r.t. KeyGen if, for all efficient adversaries A, there exists an efficient simulator S such that for all value λ, no distinguisher D can determine whether it is playing GameReal or GameIdeal where -GameReal: Run Setup(1 λ ). As many times as D wants, A chooses a function f and executes the IKeyGen(AUT , •) protocol input f with an honest authority AUT . A returns the resulting view to D which returns a bit. -GameIdeal: Run Setup(1 λ ). As many times as D wants, S chooses a function f and asks Trivial.IKeyGen(msk, •) to obtain a functional key sk f on input f . S returns then the resulting view to D which returns a bit.

The quantity Adv D,leak-free

We discuss in the following some remarks about the definition.

-A secure two-party protocol realizing the KeyGen functionality of a classical FE ensures the message-privacy since it preserves each party for learning the other party's input. The main difference in our consideration is that we require the use of a known FE scheme with some specific KeyGen algorithm in addition to the existence of a simulator (which interacts with a specific oracle Trivial.IKeyGen). This simulator is then asked to produce a consistent view to any distinguisher. As mentioned in previous sections, a two-party protocol wouldn't offer the blindness property for free. In Example 2.1, Trivial.IKeyGen is by definition leak-free w.r.t KeyGen but not blind. -The adversary in GameIdeal does not appear in the definition. As pointed in [START_REF] Green | Blind identity-based encryption and simulatable oblivious transfer[END_REF], the leak-freeness definition implies that the function (for the key being extracted) is extractable from the IKeyGen protocol (with all but negligible probability), since for every adversary it must exist a simulator S that should be able to interact with A, in order to learn which functions to submit to the Trivial.IKeyGen(msk, •) oracle. -When considering the validity of sk f (in Sec. 2.1), a ZKPoK is used in order to verify if a functional key sk f is well-formed. This is independent from the definition of the leak-freeness property, since the authority is always honest in this context (simulated by an oracle).


Tommaso Venturini

Tobias Blanke

Kari De Pryck

Similarity Sampling by Machine Learning A Social Science Experiment with Artificial Intelligence and IPCC Leadership

In this paper, we devise a machine learning protocol to tackle a complex sociological task: extending a sample of organisational leaders starting from a list of individuals nominated for the Bureau of the Intergovernmental Panel on Climate Change. The difficulty in this task lies in the impossibility to spell out the characteristics that define leadership in a complex and highly distributed organisation. To bypass this lack of explicit definition, we use a series of techniques for anomaly detection to identify IPCC contributors with profiles similar to official Bureau nominees. We found that we can build an accurate model of IPCC leadership despite its social and political complexity and that we can usefully use that model to extend our initial sample.

Introduction

This paper presents an experiment in the use of machine learning (ML) to tackle a complex social phenomenon: the identification of informal leaders in a highly distributed organisation (the Intergovernmental Panel on Climate Change, IPCC). We found that we can build a model capable of an accurate reading of IPCC leadership despite its social and political complexity. Accuracy, however, is not our prime goal. In spite of claims that computational methods will revolutionize social sciences [START_REF] Carley | Artificial Intelligence within Sociology[END_REF][START_REF] Lazer | Computational Social Science[END_REF][START_REF] Conte | Manifesto of Computational Social Science[END_REF][START_REF] Raghavan | It's Time to Scale the Science in the Social Sciences[END_REF][START_REF] Alvarez | Computational Social Sciences[END_REF], the rolling out of such methods is often hindered by their mismatch with the conditions of social research, eg. the lack of large and well-structured datasets [START_REF] Kitchin | Small Data in the Era of Big Data[END_REF] and the focus on interpretation [START_REF] Woolgar | Why Not a Sociology of Machine? The Case of Sociology and Artificial Intelligence[END_REF][START_REF] Grimmer | We Are All Social Scientists Now: How Big Data, Machine Learning, and Causal Inference Work Together[END_REF][START_REF] Venturini | Fill in the Gap: A New Alliance for Social and Natural Sciences[END_REF]. For computational methods to realize their sociological potential, it is therefore crucial to investigate their use in vivo . This is why in this paper we put ourselves in the difficult (but common the in social sciences) situation of dealing with a task that is highly disputed (identifying leaders); relying on a relatively small and complex dataset (5,676 IPCC contributors) and standard artificial intelligence (AI) techniques (available in free packages and compatible with normal laptops); and aiming at sociological relevance rather than technical efficiency. Our results show that, even with these constraints, ML can be useful if its ambitions are attuned to its conditions of use . ML techniques have been criticised for their incapacity to deliver in-depth understanding [START_REF] Andler | From Paleo to Neo Connectionism[END_REF][START_REF] Lecun | Deep Learning[END_REF] and because their performances are often obtained at the cost of interpretability [START_REF] Jordan | Machine Learning: Trends, Perspectives, and Prospects[END_REF]Cardon et al. , 2018). Being deliberately devised a blackboxes, it is not surprising these techniques are at odds with the ultimate goal of social research, i.e. to advance our capacity to make sense of collective life [START_REF] Burrell | How the Machine 'Thinks': Understanding Opacity in Machine Learning Algorithms[END_REF][START_REF] Mackenzie | Machine Learners: Archaeology of a Data Practice[END_REF][START_REF] Mackenzie | Machine Learners: Archaeology of a Data Practice[END_REF][START_REF] Rudin | Stop Explaining Black Box Machine Learning Models for High Stakes Decisions and Use Interpretable Models Instead[END_REF]. This does not mean, however, that ML cannot be helpful, in particular if used for research tasks otherwise hindered by lack of explicitness. In this paper, we exemplify such use of AI, proposing a technique of similarity sampling based on a protocol to teach the machine to recognise individuals with outlying leadership profiles in a complex, internationally distributed organisation.

Implicit similarity sampling

In order to understand our proposition, it is important to notice that our technique departs deliberately from the conventional approach of random sampling [START_REF] Teddlie | Mixed Methods Sampling[END_REF]. Instead, we propose a form of purposive sampling [START_REF] Patton | Qualitative Research and Evaluation Methods (3rd Edition)[END_REF], also known as non-probabilistic or judgement sampling [START_REF] Etikan | Comparison of Convenience Sampling and Purposive Sampling[END_REF] because it "involves the pursuit of the kind of person in whom the researcher is interested" (Thomas, 2013, p. 137). This type of sampling is preferred when the objective is to yield "in-depth understanding rather than empirical generalizations" (Patton, 2015, p.1) and when the target of the research is not the whole population but an important subgroup.

In this paper, we are interested in identifying IPCC informal leaders . While leadership is a classic topic in international relations (cf. among others, [START_REF] Cox | The Executive Head: An Essay on Leadership in International Organization[END_REF][START_REF] Schechter | Leadership in International Organizations: Systemic, Organizational and Personality Factors[END_REF][START_REF] Thorn | Leadership in International Organizations: Global Leadership Competencies[END_REF][START_REF] Reinalda | Leadership of International Organizations[END_REF], most research focus on formal leaders holding chairs in international organisations [START_REF] Tallberg | The Power of the Chair: Formal Leadership in International Cooperation[END_REF] and struggles to identify "informal leaders" [START_REF] Pielstick | Formal vs. Informal Leading: A Comparative Analysis[END_REF] whose influence is palpable but not explicitly defined. In the IPCC, for example, the formal leadership is clearly represented by its Bureau, an organ that is elected at the beginning of each assessment cycle and that coordinates the activities of the organisation. Yet, sitting in the Bureau is not the only way to be influential in the IPCC, an organisation whose activities are based on voluntary work and whose mandate is to serve as an interface between different national and disciplinary communities. Individuals who have been around for a longer time, or played key facilitating roles, or represented powerful countries or disciplines may have considerable sway over the IPCC, whether or not this is officially acknowledged.

The difficulty of identifying IPCC informal leaders epitomises the difficulty of purposive sampling when the contours of the target subgroup cannot be explicitly defined. In the absence of a clear condition or rule, techniques such as criterion sampling , typical or deviant case sampling , intensity sampling are impracticable [START_REF] Suri | Available from Deakin Research Online : Purposeful Sampling in Qualitative Research Synthesis[END_REF][START_REF] Patton | Qualitative Research and Evaluation Methods (3rd Edition)[END_REF]. Snowball sampling can help extend the sample to the individuals related to official leaders, but often (as in our case) no data is available on the connections between individuals. The failure of classic sampling to cope with the elusiveness of leadership suggests a possible sociological use of ML. While we cannot formulate an explicit definition of IPCC informal leadership, we know from fieldwork [START_REF] Pryck | Expertise under Controversy : The Case of the Intergovernmental Panel on Climate Change (IPCC)[END_REF] that its official chairs are generally chosen among its informal leaders. We can thus assume that most informal leaders resemble Bureau candidates. This suggests an avenue for the sociological exploitation of AI techniques, as one classic task of these techniques is the extrapolation of similarity from a learning dataset. Techniques introduced for prediction (eg. to anticipate crime outbursts, [START_REF] Benbouzid | From Situational Crime Prevention to Predictive Policing. Sociology of an Ignored Controversy[END_REF] or categorization (eg. to improve marketing campaigns, [START_REF] Syam | Waiting for a Sales Renaissance in the Fourth Industrial Revolution: Machine Learning and Artificial Intelligence in Sales Research and Practice[END_REF] can therefore be repurposed for social and human sciences [START_REF] Blanke | Predicting the Past[END_REF] as methods for similarity sampling .

The IPCC leadership

The case of the IPCC leadership is interesting for the key role the organisation plays in the climate regime [START_REF] Aykut | Gouverner Le Climat[END_REF]. Founded in 1988, the IPCC produces regular assessments of climate change research. Its reports are meant to offer a scientific foundation to the negotiation in the United Nations Framework Convention on Climate Change (UNFCCC). For its "efforts to build up and disseminate greater knowledge about man-made climate change", the IPCC was awarded the Nobel Peace Prize in 2007 and has become a model for other international expert organisations, notably the Intergovernmental Science-Policy Platform on Biodiversity and Ecosystem Services and possibly the future International Panel on Artificial Intelligence . The IPCC is a remarkable organisation for the cooperation it establishes between its authors who write the reports and its national delegates who supervise the assessments work and approve its outcomes. While this dual nature allows the IPCC to serve as an interface between science and politics, the cohabitation of scientists and diplomats is not always easy and tensions may arise in relation to the distribution of power in the organisation (Hughes & Patterson, 2017), and particularly in its Bureau.

Elected by the member states at the beginning of each assessment cycle, the Bureau coordinates and oversees all IPCC activities. The composition of the Bureau (which comprises 34 members in AR6) is the result of complex voting procedures and of intense behind-the-scenes negotiations [START_REF] Pryck | Expertise under Controversy : The Case of the Intergovernmental Panel on Climate Change (IPCC)[END_REF]. The election of the IPCC Bureau rests on a complicated combination of scientific and diplomatic constraints meant to assure that its composition reflects a "balanced geographic representation with due consideration for scientific and technical requirements" . To guarantee such 1 an equilibrium, the IPCC has established a complex set "Procedures for the election of the IPCC Bureau" . Rule 19, for instance, stipulates that governments "should refrain from nominating 2 non-nationals without the consent of the nominee's national government". The rule was introduced after a major controversy broke out in 2002, when the sitting Chair, Robert Watson, was nominated by Portugal and New Zealand against the will of his own country (the United States), which ended up supporting the election of the Indian economist Rajendra Pachauri. Being nominated for election in the IPCC Bureau is thus an extremely subtle social and political process, which signals the influence achieved by someone within the organisation but in ways that cannot be straightforwardly measured. And this is where machine learning can be useful, offering a series of techniques to define a sample of informal leaders similar to the Bureau nominees without having to explicitly define the nature of this similarity a priori.

Featurization

The first step of our protocol is the definition of the features to be used to create a model of IPCC leadership. In this paper, we draw on a database of IPCC authors and delegates that we started to collect in two previous research projects [START_REF] Venturini | Climaps by Emaps in 2 Pages (A Summary for Policy Makers and Busy People in General)[END_REF] and extended and updated since.

3

The database contains the names of all the individuals who have contributed to the first five assessment reports (ARs) of the IPCC (and the members and candidates of the Bureau). Great 4 effort was invested to disambiguate homonyms and merge different names of the same person, but errors remain. In total, we have counted 5,676 individual contributors to the IPCC. Our database, furthermore, separates the different roles held by the same individual, thus containing about 18,000 rows, each corresponding to the contribution by a given individual in a given role (delegate, Bureau member, coordinating lead author, lead author, review editor, contributing author). For each of the contributions, we also collected the national affiliation declared by the contributor. All the features employed in this machine learning model described in this paper are, more or less directly, extracted from this database.

Engagement features (ENG-)

A first set of features is meant to measure the level of engagement of IPCC contributors and can be extracted directly from the database. 1. The number of plenary sessions in which an individual has participated as a member of a national delegation (ENG-CountSessions) 2. The number of chapters authored by an individual (ENG-CountSignatures) 3. The key roles held by an individual (ENG-ClaSpmSyrBureau) as Contributing Leading Authors (CLA), author of Summary for Policymakers (SPM) or the Synthesis Report (SYR), or member of the Bureau in earlier ARs. 4. The last AR in which a participant has participated (ENG-LastActive), assuming that individuals active in more recent ARs have greater chances to be nominated for the Bureau.

Networks features (NET-)

The features above do not take into account the nature of the IPCC as a 'network organisation'. Unlike other international organisations, the IPCC has no permanent organs and no stable employees (except for the dozen people of its Secretariat). Rather than by hard institutionalization, the IPCC is kept together by the networking activities of its participants. To account for the relational features, we turn our database into a bipartite network of individuals and capacities, 5 defined as the 24 different roles in which IPCC members may have contributed to the organisation .

6

Table 1. temporal, functional and thematic divisions of the IPCC and the roles they form

The edges of the graph in fig. 1 represent the contribution of each individual. An individual, for instance, is connected to "AR4-author-WG1" if during AR4 he/she has authored one of the chapters of the report of Working Group I. Edges are weighted according to the number of times that each individual has served in the same capacity (eg. by authoring two chapters in the same AR and WG). 2. The betweenness centrality of an individual, as the number of shortest paths passing through his/her node in the monopartite network (NET-Betweenness) 3. The closeness centrality of an individual, as the sum of shortest-paths distance of his/her node to all the other nodes (NET-Closeness) 4. The eigen-centrality of an individual, as a recursive measure of the connectivity of nodes, their neighbours, the neighbours of their neighbours, etc. (NET-Eigen).

Bridgeness features (BR-)

While the network features capture the relational connectedness and centrality of individuals, they do not consider the specificity of the IPCC network. In particular, they do not take into account that some roles are easier to accumulate, while others are more difficult. As fig. 1 suggests, some capacities are more "distant" than others and connecting them is then more valuable in the IPCC.

The organisation itself acknowledges this point and identifies a group of contributors of particular relational importance. The so-called "bridge authors" are authors who deal "with cross-cutting topics across WGs ." In a previous paper [START_REF] Venturini | Bridging in Network Organisations the Case of International Panel on Climate Change (IPCC)[END_REF], we extend this notion, by calculating 8 three distinct types of bridgeness as well as their sum: 9 1. Thematic bridgeness, characterising the individuals, which have participated in different working groups during the same AR (BR-Thematic). 2. Functional bridgeness, characterising the individuals, which have been both authors and delegates during the same AR (BR-Functional). 3. Temporal bridgeness, characterising the individuals, which have served in the same capacity across different ARs (BR-Temporal). 4. The sum of all the bridgeness above (BR-BridgenessSum). 7 To generate a monopartite network from our bipartite graphs, we create a matrix in which each couple of individuals is connected by an edge if the Pearson correlations between the list of capacities they have occupied is positive. For all capacities occupied by two contributors x and y, the Pearson correlation divides the sum of their frequencies in x and y minus their respective mean frequencies m(x) and m(y) by the square root of the squares of (x -m(x)) and (y -m(y)).

8 https://archive.ipcc.ch/scoping_meeting_ar5/doc10.pdf , p. 10. 9 To quantify the bridging function in the IPCC, we develop a metric called "bipartite-bridgeness", which we define as the summation of the number of indirect connections created by a node and weighted by the importance of such connections and by their rarity. More precisely, the bipartite-bridgeness of a node 𝛼 of partition A is equal to the number of pair of nodes in partition B bridged by 𝛼, each weighted by:

• the total number of A-nodes to which the two B-nodes are connected (i.e. the union of their neighbours)

• and the inverse of the number of A-nodes bridging the same pair (i.e. the intersection of their neighbours)

BB(n) = ∑ (i,j) [ | neighbours (i) ∪ neighbours (j)| / | neighbours (i) ∩ neighbours (j)| ] BB(n) = ∑ (i,j) [ 1 / Jaccard (neighbors(i),neighbors(j)) ]
As the intersection of two sets divided by their union is commonly known as their Jaccard coefficient, the bipartite-bridgeness can be defined as the summation of the inverse Jaccard coefficient of the neighbourhoods of all pairs of neighbours of 'n'. Because the Jaccard coefficient is a measure of similarity between sets, bipartite-bridgeness grows not only with the number of couples bridged but also with their relational diversity. In the case of our networks of contributors and capacities, the bipartite-bridgeness of an individual is then defined as the summation of all the pairs of capacities, in which she has served, weighted by their importance and the rarity.

National feature (NAT-)

Finally, as typical to international organisations, the composition of the IPCC leadership is decided by the power equilibrium between countries. While the election procedures demand a "balanced geographic representation", this provision only stipulates that the five regions of the world (according to the WMO classification) should be represented in the Bureau, but does not specify which countries should represent each region. As a consequence, the most influential and active countries in the organisation (eg. the United States, the Russian Federation, Japan, Brazil, China, the United Kingdom, Canada, Saudi Arabia, India, Germany or France) are also more present in its Bureau. To account for the national affiliation of IPCC members, we add to our features the average percentage of gross domestic product of the country dedicated to research and development between 1996 and 2017 according to the World Bank (NAT-GDPRD). We choose this feature for its capacity to capture both the richness of countries and their technical and scientific power.

Taking time into account

A final issue in data preparation is related with time. In order to train our model, we use the list of the Bureau nominees in AR5 and AR6, as well as its elected members in AR4. Because these 10 individuals have been nominated for the Bureau at a specific moment in time, we have to make sure that our model considers their features at that moment. While considering the AR4 Bureau, therefore, we should only use data from the three earlier reports (AR1, AR2 and AR3). For the AR5 Bureau, we can add the information about AR4 as well. And finally, for the AR6 Bureau, we can consider information about all five previous reports. In practice, this means that all the individual features above need to be calculated at different moments in time by considering only the data concerning events that occurred before each of the Bureau elections under consideration.

Model training

After having extracted and normalized 13 features, we train our model to recognise the Bureau candidates. The problem is that, out of the 11,742 rows in our dataset, only 148 (or 1.3%), correspond to Bureau's candidates. As a consequence, a model that simply assumes that no individual is a candidate is 98.7% accurate. This "accuracy paradox" prevents us from relying on accuracy to evaluate and improve our model. However, as suggested by the fig. 2, the distribution of features is highly uneven and with several outliers, many of which correspond to Bureau candidates. Bureau nominees seem to have a special profile that sets them apart from other IPCC contributors, which encourages us to rely on anomaly detection to identify them and their likes. As our main anomaly detection algorithm, we used isolation forests as implemented in the open source H2O platform [START_REF] Candel | Deep Learning with H2O." Amazonaws[END_REF]. This technique is a special case of random forests , in which the machine represents the training dataset through a series of tree-like structures with the objective of isolating the members of the target class with as few branches as possible. At each branching, the records of the dataset are divided according to a threshold on one of the features (eg. separating the class of individuals who have occupied more than N capacities and then the subclass of those who had been active in the last AR, etc.). Averaging over many trials (hence the name of 'forest'), the machine learns which features are most important to identifying the target class. An isolation forest is an unsupervised version of the random forest, which tries to single out not a target class but each individual item. Being distinctively different from other nodes, outliers tend to be closer to the root and require fewer splits to be isolated. The final outlier score is the average number of splits needed to create a leaf for a given entry across all the trees in the isolation forest. In our case, the lower this number is for an individual, the more likely she or he is to be an anomaly and thus a Bureau candidate.

To improve our results while avoiding overfitting to the training datasets, we run a grid search with cross-validation to find the optimal hyperparameters for our isolation forest. The result is that the best forest has trees of mean depth of ~16. We also split our corpus into a training and a validation set with a 75-25 split (with similar candidates distribution). 2,935 entries are thus held back to evaluate how the model reacts to unseen data.

With a default scoring option, our anomaly detection algorithm cannot overcome the accuracy paradox. A straightforward application of the isolation forest method (see table 2 for the validation results) achieves an accuracy of ~0.95 but, while it performs very well in excluding non-Bureau individuals and avoiding false positives (specificity = 0.96), it is incapable to identify almost half of the Bureau candidates (accuracy = 0.49). Our task is therefore to find an approach that maximises the relation of specificity and sensitivity without sacrificing too much accuracy. To counter the accuracy paradox, we change our scoring function to reward the identification of bureau candidates and penalize missing them. The metric we are aiming to maximise is the 'harmonized mean' of sensitivity and specificity:

core S = Sensitivity Specif icity * Sensitivity + Specif icity
As intended, this approach sacrifices some accuracy (which drops to ~92%), but our confusion matrix results looked more appropriate to the task of predicting bureau candidates. The sensitivity is now improved to 0.65 while specificity is still a strong 0.93. We can further improve our performance by combining our isolation forest (which identifies anomalous contributors but does not exploit the existing information on who is a bureau candidate and who is not) with a semi-supervised version of autoencoder neural network [START_REF] Baldi | Autoencoders, Unsupervised Learning, and Deep Architectures[END_REF]. Autoencoders aim at reducing the dimensionality of the data, discarding noise by determining the most important latent features of the dataset (or 'deep features') generated as blackbox combinations of the initial features. Our semi-supervised approach consists in generating our autoencoders using exclusively the data from the 'normal' non-bureau individuals, which will make it easier to later on detect the bureau candidates as outliers. By building an isolation forest on top of the second hidden layer of the autoencoder and using our custom scoring function, we are able to keep a high accuracy of 92% but at the same time maximise the relationship between sensitivity (0.92) and specificity (0.92). Only 3 bureau candidates are now missed from the validation data according to Table 5.

Results and discussion

So far, following the conventions of predictive analytics, we presented the results of our model in terms of false positives and false negatives. Our objective, however, has never been to predict which individuals were going to be nominated as IPCC chairs and vice chairs, but to exploit our existing knowledge on the Bureau nominations to identify other individuals with similar 'leadership exceptionality'. We can therefore move on from the binary classifications of the confusion matrices and consider our results according to a continuous measure. For each of the individuals (and for each AR), our algorithm computes the average number of splits needed to isolate the entry across the trees of the isolation forest. We call this metric, which is central to isolation forests, "MeanLength".

To test MeanLength, we compare it to the thirteen individual features described above to show its better capacity to identify "leader-like" individuals. To gauge such a discriminating capacity, we rank all the individuals in our dataset according to each feature and according to the MeanLength. Then we calculate the average ranking of Bureau candidates and of all other IPCC contributors and then simply subtract these two averages. The idea behind this test is that, as Bureau nominees are recognised by the organisation itself as its potential leaders, an effective measure of leadership should rank them higher than other participants. We can use the best-case scenario (in which the 148 candidates are ranked in the first 148 positions) as a benchmark of the discriminating capability of different metrics. Fig. 3 displays the ranking of Bureau nominees for each individual feature and for the MeanLength. Table 6 compares their discriminating capacity as the difference between the average ranking of candidates and the average ranking of non-candidates divided by the maximum possible difference .

Figure 3. rank of bureau nominees according to individual features and isolationMeanLength

Table 6. difference between the average rank of Bureau nominees and all other IPCC participants. The figure and table above demonstrate that the MeanLength is significantly more effective than individual features in identifying Bureau nominees, being almost twice as good as the best features (BR-BridgenessSum and NET-Degree). This suggests that there is a real gain in combining features through machine learning instead of using them in isolation.

To improve our discrimination capacity even more, we can exploit the non-deterministic nature of our protocolthe fact that, if executed several times, it will produce different models and different final classifications. Since each of these implementations of our protocol is differently affected by the noise in the data and the randomness of the training process, their average results should be more robust than that of any single instance. Indeed, running our protocol ten times and averaging the results, we obtain an average MeanLength with a greater discrimination capacity (0.972). Fig. 4 shows that Bureau candidates (the triangles) have not only a lower average MeanLength, but also that their evaluation is more stable across different implementations of our protocol. Drawing on this insight, we combine average and standard deviation of MeanLength in a new variable we call leadership-score (LS):

LS = average of the MeanLengh + (ε * standard deviation of the MeanLengh)

After exploring all values of ε to identify the one (15.5) that maximises the difference in the ranking of bureau candidates and other participants, our new measure achieves an almost perfect discrimination capacity (0.9996). Ranking the individuals of our corpus according to the new measure, all the 107 highest ranked individuals are Bureau candidates and all the 148 Bureau candidates are ranked among the 184 first individuals (which means that only 36 false positives are necessary to identify all the candidates).

Application to sampling

Given the complexity of the process for the nomination of the IPCC Bureau, obtaining a metric with such a strong discriminating capacity makes us confident that our protocol has potential. By itself, however, this achievement is not particularly useful, as being able to predict Bureau candidates has little use for IPCC actors and little interest for IPCC scholars. To achieve sociological relevance, we still have to demonstrate how our prediction machine can be repurposed into a sampling protocol capable of singling out individuals with special leadership profiles.

Fig. 4 shows a clear separation between candidates and non-candidates, but it also shows that some non-candidates have a position that is relatively close to that of Bureau nominees (we highlighted them in orange). These are the informal leaders that we should add to the formal ones to complete our sample of IPCC leaders. To identify them, we focus on the current report, AR6. Since our dataset contained 67 candidates for the Bureau of AR6, we decided to use our method to double this sample and identify the 67 other individuals, which have not been candidates for AR6 but are rankest highest according to leadership score in that AR. 16 of these informal leaders have been members of the Bureau in one or more of the earlier ARs. We will, therefore, not consider them because they could have added easily to the sample because of their previous role. 51 individuals, however, have never been in the Bureau so their inclusion in the sample is not trivial. Their names are listed in the table below. Our analysis stops at this list, as we have fulfilled our objective to build an extended sample of formal and informal leaders which could become the basis of a sociological investigation of IPCC leadership. Because we were particularly interested in leaders, who, by definition, occupy an outlying position in their organisation, we relied on techniques for anomaly detection, but other techniques of machine learning can be employed in cases in which the sample to be extended does not have the same character of exceptionality. Beyond the details of our protocol, the crucial point of our demonstration was to show that machine learning can be of use in the traditional task of sampling in social sciences. It is especially useful in situations in which the research is hindered by a lack of an explicit definition of the sampling group.

Conclusions

In this paper, we presented an experiment in which we purposely put ourselves in a situation that, while decidedly more difficult than most machine learning experiments, is close to actual research conditions of the social sciences: we measured ourselves against an elusive phenomenon (IPCC informal leadership) and worked with heterogeneous data and limited computational resources. The results show that, even in these difficult conditions, it is possible to train an efficient model. By using a combination of autoencoders and isolation forests, we developed a strong measure of leadership potential. If we had tried to guess the 67 nominees of AR6 Bureau by taking the 67 individuals ranking the highest according to our isolation MeanLength, we would have predicted 60 of them (an excellent result, considering that our model was choosing among 5.559 different individuals).

As social scientists, however, we could not content ourselves with such a result, for prediction as such is rarely a goal in our disciplines and certainly not as the IPCC leadership is concerned. To make our protocol sociologically relevant, we repurposed our model shifting its use from prediction to sampling. In this new use, we are not trying to guess which individuals would be nominated for the IPCC Bureau, but we use our knowledge about these nominations to find other individuals with a similar profile and thus device a protocol for sampling people with a leadership profile. While our "leadership-score" metric is a blackbox because it is based on a complex machine learning algorithm that does not provide us with the exact recipe employed to compute it, this opacity is not necessarily a drawback. Because there is no clear or unique definition of what makes an IPCC leader, there is no way to develop a transparent algorithm for leadership sampling.

The situation in which we carried out our experiment, we believe, is not exceptional. It is common for social scientists to be interested in the subset of a population that they identify by a few prototypical examples rather than by an exact definition. In these circumstances, the impossibility to formulate an explicit sampling criterion can be sidestep by extending the sample of prototypical examples relying on machine learning and its capacity to find resemblance in a multi-dimensional space.

Figure 1 .

 1 Figure 1. Bipartite network of the IPCC contributors (dark grey) and the capacities in which they have served (coloured according to their functional and thematic division) in the first five assessment reports

Figure 2 .

 2 Figure 2. Boxplots of the distribution of the values of the 13 features described above.

Figure 4 .

 4 Figure 4. Scatterplot of the average and of standard deviation for the MeanLength of the individuals of our corpus across the 10 implementations of our protocol.

Table 2 .

 2 Confusion matrix showing the results of the isolation forest with default scoring.

		actual "not-bureau"	actual "bureau"	total
	predicted "not-bureau"	2775 (true neg)	19 (false neg)	2794
	predicted "bureau"	123 (false pos)	18 (true pos)	141
	total	2898	37	2935

Table 3 .

 3 Confusion matrix showing the results of the isolation forest with customized scoring function.

		actual "not-bureau"	actual "bureau"	total
	predicted "not-bureau"	2683 (true neg)	13 (false neg)	2794
	predicted "bureau"	215 (false pos)	24 (true pos)	141
	total	2898	37	2935

Table 5 .

 5 Confusion matrix of the isolation forest with auto-encoded features and customized scoring function.

		actual "not-bureau"	actual "bureau"	total
	predicted "not-bureau"	2683 (true neg)	3 (false neg)	2794
	predicted "bureau"	215 (false pos)	34 (true pos)	141
	total	2898	37	2935

Table 7 .

 7 Informal leaders identified through our similarity sampling protocol.

	Name	Country	Ran_LS	NET Degree	BR Temporal	BT Thematic	BR Function	BR Sum	ENG Sessions	ENG Signatures	ENG-Cla SpmSyrB ureau
	Cramer, Wolfgang P.	Germany	120	7	816	194	2061	3071	3	14	3
	Ishitani, Hisashi	Japan	137	3	0	0	236	236	1	5	2
	Jorgensen, Anne Mettek Denmark	138	5	3824	0	0	3824	25	0	0
	Mostefa-Kara, M.K.	Algeria	141	2	0	0	1523	1523	2	1	1
	Kashiwagi, Takao	Japan	146	3	0	0	236	236	1	4	2
	Friedlingstein, Pierre	France	156	5	121	228	2485	2834	3	9	2
	Titus, J.	USA	164	2	0	307	0	307	0	2	1
	Melillo, Jerry	USA	165	4	61	173	0	234	1	5	2
	Oquist, Mats	Sweden	166	2	71	0	0	71	0	4	2
	Perrin, Dominique	Belgium	168	3	878	0	0	878	4	0	0
	Clini, Corrado	Italy	171	5	3824	0	0	3824	6	0	0
	Taniguchi, Tomihori	Japan	172	3	0	143	1140	1283	3	3	1
	Melnikov, P.I.	USSR	174	1	0	0	0	0	0	1	1
	Morand Francis, Pascale Switzerland	176	3	84	0	310	394	6	1	0
	Ososkova, Tatyana	Uzbekistan	178	5	1271	0	255	1526	15	1	0

Principles Governing the IPCC Work: https://www.ipcc.ch/site/assets/uploads/2018/09/ipcc-principles.pdf

https://archive.ipcc.ch/pdf/ipcc-principles/ipcc-principles-elections-rules.pdf

The database used in this paper has been initiated thanks to the support of the EU Project EMAPS and the ANR project MEDEA and about half of it completed at the médialab of Sciences Po, by Ian Gray, Nicolas Baya Laffite and Audrey Banneyx, which we greatly thank for their contribution. The database was updated and extended in a doctoral thesis completed by Kari De Pryck.

It is important to remark that our network only includes contributing lead authors, lead authors or review editors (i.e. the authors with roles of coordination and responsibility). We have not considered contributing authors, who generally do not participate in the meetings and whose contribution is in most cases limited to specific paragraphs or topics.

The main role division in the IPCC corresponds to the functional separation between the scientists that review the scientific literature and write the assessment reports (authors) and the diplomats who oversee the work of the organisation (delegates). The authors are subdivided into three Working Groups with different thematic specialisations: WGI focuses on the physical bases of climate change; WGII on impacts, adaptation and vulnerability and WGIII on mitigation. We also include participation in the writing of the Synthesis Report, which brings together the conclusions of the three WGs. Finally, the work of the IPCC is temporarily articulated in Assessment Cycles.