We’ve also been thinking along these lines, thanks for the post.

Rather than plan on running MPC, we were wondering if we could address some of these questions by having the entire code that’s run inside worklets be moved to run in a trusted server instead? This has the potential to improve user experience.

One way of looking at this is that this could be a basic version of a SPARROW server.

The example that we’re thinking of here is executing JS functions that have no side effects, which is the case for the proposed FLEDGE bidding functions. A simple way to do this is for the browser to send the function and arguments to the trusted server for evaluation.

Taking generate_bid as an example, the browser would send a request to the trusted server with the interest_group, auction_signals, per_buyer_signals, trusted_bidding_signals, and browser_signals. Sending one request per interest_group per bidder would be prohibitive, and we already trust the server to handle multiple interest groups for a single user, so instead the client could send a single request for many interest groups.

There are necessarily going to be tradeoffs in resources here. A trusted server would introduce additional overhead in:

• Network bandwidth to pass arguments and receive results for running the function.
• Server compute resources.
• Maintenance and upkeep of these new servers.
• Overall complexity of the system.
• Network bandwidth to upload the JS function to the trusted server for evaluation. This may not apply if functions are uploaded separately.

These are balanced against the amount of browser resources required to run worklet functions and therefore the user experience effects. We’re exploring this tradeoff now.

We’re in the process of exploring what it means for a server to be trusted, how that trust could be ensured, and how side-effect free functions can be run securely in a series of posts here.

For reference, this is the issue about resource limits: #132

Thanks,
Phil