Achieving Confidential & Verifiable AI Computation

Transcript

well to be clear the context of that gents in Touching was all the authors of the Transformer paper being on stage so um but yes thank you for having me here um I actually going to introduce some work we literally publishing right now uh it just went on GitHub and going to be on archive in next couple of days and just to introduce the idea right AI from my perspective is the last technology wave because effectively most of the work if not all from now on will be done either with AI or by AI directly right we already see this you know the physics and chemistry uh Nobel prizes are going to AI researchers we see this you know uh like effectively

accelerating mathematics with AI tools with seizes across material design kind of and obviously in computer science in development in uh everything else even making slides right all of this is now done uh with the use of AI and so the challenge is like whoever controls the AI whoever controls how you actually interacting with it is controls everything in result right they can decide um you know if this country shouldn't be able to have access to it they can decide that this specific actor or company or person should not have access to it or they can apply whatever filters and censorship and they want to and this is kind of the current state right we have closed Source AI that has a ton of challenges um because you're

effectively having a single party controlling access to what is a fundamentally changing technology it's like if AOL controls the internet right and then we have an open source movement right people are building AI models and open sourcing them which is amazing the problem is it's completely unsustainable as soon as you open source it everybody else can now run it and you make no money of it and stability was kind of a uh really good example of being one of the first ones to open source a really state-of-the-art model and then uh they have a ton of trouble kind of financially to continue maintaining this pace and Innovation and so we kind of see that with every company that open sources it have trouble continue the pace so the solution that we kind of

propose is a completely different model right it's a model where the instead of AI controlling by a single company you have ai that optimized for the users wellbeing right user owned Ai and so this really Builds on top of all the crypto values and kind of mission that near protocol for example has of ensuring that everybody has control of their data assets and Power of Choice it also means that your AI becomes this Universal interface right that interprets the internet and participation with others for you right it is your interface and it needs to be on your side like right now when you go to google.com you go to any of the products they're not on your side

they're actually trying to make money of you right that's their business model model so we want to switch this and actually enable that what you interacting with what is kind of your direct counterparty in Computing is on your side and is kind of optimized for your well-being and economic success and obviously you know this is not commonism we want everybody to actually make money of it because we need a capitalistic engine underneath to really power this so you know users Services researchers developers all need to be rewarded kind of proportionally to the uh value they creating now the question is how right this is really cool Vision but you know we either have a corporation that builds uh kind of for-profit models or we have

open source where people don't have resources to really develop anything so what we introduces this idea that if we can actually achieve uh few properties uh we can build this user on the eye and so few of the properties that's really important is confidentiality and verifiability right right now when you go to the you know open Ai and Tropic Google anything else right you're effectiv sharing your private data with some company and it goes somewhere and so as we assume the sayi model the sayi assistant is becoming more and more knowledgeable about you presumably listening into your conversations at all times because that will give it the most um kind of context about uh you we

effectively like losing more and more of our personality to those companies which again their incentives are to make money of that data not to become to kind of make you successful so confidentiality ensuring that your data is only stays yours and until you actually explicitly want to share it with someone potentially in exchange for some value should not kind of should be the you know um the Mast for user own AI inability is another part because if you you know again right now you're running open AI it may be running this model it may be running that model it maybe filtered some stuff on the answer I mean this is obviously happening with uh some other models where you know you see the

answer then get uh re Rewritten by the postprocessing so you want to have effectively a way to verify that the answer you got is indeed coming from model another kind of you know I was scaring people about this about year and a half ago and now this is actually happening you know people are introducing an ad model directly into LM output so as it actually outputs tokens instead of just output what data tells it it literally can run an ad and you know prioritize specific brands in your output so those two things are extremely important for this user on Vision now how do we achieve this right we actually had a talk before that which I missed part of it so I don't maybe maybe some of the numbers need to be

updated but uh we obviously have zkl so zkl is cool uh it gives us verifiability we know that model was run but it doesn't give us confidentiality unless it's run on the local device device right by the user so if you have like a larger model that runs on a on some shared hardware that Hardware has access to all everything that needs to be computed over and it has a massive overhead consensus you know okay let's cool let's run all of the gpus in the consensus and make this uh you know verifiable again great but not confidential every single interaction prompt Etc goes on chain and now every sees it and you know you still need at least like 30 to 100 nodes uh to kind of

consider the reasonable consensus we have fully homic encryption it is confidential which is great and verifiable but it is massive overhead now there's quantization there's few different methods to like reduce this but uh again this is not yet production and we haven't seen it really scaling at at a level of like you know you can run deep seek you can run uh like 400 b Lama you can just run a local model right if it runs on local machine you know it's your data doesn't go anywhere and it is verifiable because you ran it now the problem is assuming you know world is mobile 5 billion people on mobile devices you can run about like two billion parameter model luckily that's about the limit right now now

this is improving all of those numbers are improving so that's good and what we left with is trusted execution environments right they give you confidentiality and verifiability they have a very little overhead about 5 7% for for uh kind of AI compute and there's an interesting guarantee that nobody else have given which is that only this computer was down on this data which is a really kind of additional benefit that you can use in different applications now there is a potential for side Channel attacks I'm not going to say this is you know perfect solution in the world uh but it is you know very reasonable for specifically machine learning where you are piping a lot of data through the

system and you know even if you side Ching attack and getting like few bits an hour or something out of the system it's not going to actually allow you to get any private information and if you do want to handle private keys and other stuff there is additional methods to address that so what's really interesting there is something changed about um like within last year where we went from kind of a very custom built uh trust execution environment where you needed to write a different code and you needed to implement a very different system to effectively now being able to run any virtual image of any um operating system inside this execution environment inside

secure enclave and not need to modify any code so Intel has this uh called trusted domain execution TDX MD and arm have as well versions of this so this gives you an ability to effectively now just build a Docker container and just spin it up inside this execution environment and know that only this code was run on this data and only this thing was done this also works now with Nvidia gpus starting from kind of second shipment of h100s and so you now have a ability to plug in and run you know 8 h100 you know on single machine with one Intel TDX CPU and have a full end to end

you know in AI inference model running for like 400b parameter model with 57% um overhead fully com confidentially nobody's able to access what's happening inside and verifiably that only this model was run on this data so we have built with follow Network a confidential virtual machine abstraction so just so you don't need to think about like different Hardware there's you know how they registered there's different you know certificates that needs to be provisioned Etc forication and so this abstraction allows you to effectively say hey I need a Docker that runs um like with this Docker like with this hash of a Docker container run it

on some te and then when you when I call it it will verify to me that only this Docker runs and uh you can establish a TLS connection now and effectively have a full endtoend confidential computation done through this so this already enables a ton of interesting stuff we have a whole uh new programming model for blockchain blockchain now where instead of writing everything in smart contract you can actually write build a Docker container and run it in the CVM and then call things from your blockchain smart contract into CVM and get back response and verify that indeed it happened in this now for block for uh AI specifically we need a few more

Primitives first of all um if we are again having like take an open source model then anybody can run it and there's no way to uh to kind of uh do much but you can actually have this primitive of a decentralized encrypted model right so instead of it's being open source or being kind of private and running on uh kind of some individual company computers you can have an encrypted model weights that are stored in decentralized storage and you can have the private key to decrypt it um be stored inside CVM ins inside conf IAL VM and so when a new VM boots up it can effectively exchange with any other

existing confidential VM and get that key from it verifying that indeed it came from one of the uh cvms right so they can effectively establish a handshake saying hey I'm also running into I'm also running the same Delta container you know let's exchange the keys privately and now I can go and decrypt this model and run it and do inference on it and so for key storage you want to use this this concept of oblivious Ram uh to ensure that like side Channel attacks are not uh possible so this primitive then gives us an ability now to say you know there's an Aly who's like hey I want to run a private inference on on this model uh she establishes a payment Channel

through a smart contract saying hey you know deposits whatever $10 of uh effectively your inference credits and now with this can go to any CVM and say hey run this inference on this input uh and here is a payment Channel effectively uh ID and sign signature for for this uh transaction right so this is happening fully like you establish payment Channel once and then every single inference happens fully off chain you just sign on top of the response kind of as you're using it so then you know Bob is like you know potentially untrusted party is not able to see what happens they just see there the TLs connection happens inside CVM uh

they don't know what what that is from who that is ETC inside CVM there's open Channel that uh keeps track of all the payments runs inference and replies back with effectively you know Contra sign that hey you use this much of this payment Channel by running this model this is many output tokens this is many input tokens and then uh here is the reply right again everything done through TLS of this specific confidential VM right they actually issu their own certificates the cool thing is now both Bob who provides hardware and model developer who uploaded this model can get paid right because this payment Channel when it gets closed uh can distribute their kind of the payments

proportionally to whatever was specified on the model when it was uploaded uh and so you can have you know there's the GPU cost whatever $1 $2 per hour uh and there is a model developer get gets something like 10 cents per to per million tokens right so all of that can be effectively embedded into the model uh weights when they when they encrypted and stored so there's one missing piece right because this requires actually finding a CVM and then being able to communicate with it and importantly if that CVM doesn't actually do anything right you have now a paying Channel with someone who doesn't have uh you know who doesn't have to uh to kind of respond

obviously you can close payment channels and there's like a whole protocol around that there is an interesting concept of how do you even ensure responsiveness in the network right this is actually something that in like distributed systems frequently we Overlook and kind of just like okay you know let's assume there's enough good uh nodes in the network to actually distribute blocks we assume a lot of things and so this is actually some problem we've been um thinking a lot about because it's pretty fundamental to consensus it's fundamental to data decentralized data storage and it's really important in this case when you have effectively individual nodes doing the work and you want to ensure that they actually going

to respond to you and so we've developed a kind of a new overlay Network um which um Works in a specific way to guarantee that you're either going to get the response from the node you're asking or you're going to get a proof that one of the edges has been broken and the breaking Edge means somebody got slashed effectively so this is a network um effectively of you know Rel layers you can think of them you know routers that actually route the uh networking between different nodes each router with whoever it's connected has a payment Channel a small payment Channel

established that effectively ensures the you know there's economic activity every packet scent has a payment attached to it so this is actually incentivizes the bandwidth as well which again something on blockchain generally been dismissed and it if one of the nodes is not responding there's a protocol effec to break the edge uh which if all of the edges with your node are broken you effec get kicked out from the system and you lose your initial stake so this really enables among other things effectively tour right because you can onion your request from one node to another and you have effectively fully incentivized you know kind of

private uh Network that allows to really communicate with any of these nodes but in our case it allows us to have guarantees that if you're requesting some uh confidential VM to do something it will respond to you and you can validate the respon is correct through a TLS certificate or it will not respond and uh somebody will get slashed and so you can then reroute your request to another CVM so in a way this is actually replacement to a fundamental tcpip right tcpip gives us guarantees that you'll get the response like a act from the on the network inside so this is really a transport level protocol that actually introduces crypto economic incentives on

this level so let's put it together now we have a decentralized confidential machine learning cloud right where you effec to have lots of this nodes running around uh some of them have GPU some of them don't they running This Confidential VM and you effectively can go on chain fet the nodes that are in this network set up payment channels both for the cloud it's kind of for the networking and for the payment uh with the nodes and you can now run either simple llm inference with a GPU node or run an agent that goes itself and then runs uh on another GPU node the inference for the agent logic right so this creates kind of a uh effectively

whole system that can run machine learning AI as well as just regular you know uh python typescript whatever rust code Etc in fully endtoend verifiable confidential way uh you can ensure that you know if some nodes kind of get disconnected from system or start censoring they get kicked out uh you can ensure that they can only do the thing you requested them to do uh with your data they are not able to store it they're not able to maintain it there's effectively one Docker container published that everybody can expect how it runs that you know loads the models and uh responds to the requests and so this is effectively A system that allows to

really pull together all of the requirements we have for kind of a modern you know user own Ai and enable that uh through kind of a whole host of protocols really to kind of delivers this result so just to kind of leave you with this idea right okay cool so this is great this enables now developers who build their model instead of open sourcing it they can effectively up like encrypt it and upload it into this cloud and get monetization this allows existing open source models to effectively be uploaded there and uh you now have a verifiability that you run that model without needing to trust any specific provider um uh now the thing is like

it's still missing the piece where okay how do I know that the model I'm running has not been poisoned right so for those who are not familiar there's this concept of sleeper agents so you can find tuna model in a specific way that at a given time or a given conditions it will for example insert something malicious into your output right to give you a very specific example as you're typing in corser uh instead of import Transformers it will say import tformers right which is a malicious library that is you know stealing all your data so how do we know this didn't happen right like everything I was talking about was about inference well you can actually build with the same now Cloud a fully Community owned model right so let's

imagine we have a dow that comes together and says hey we want to build this amazing uh Community own models we're going to launch a token we're going to use it to fund raise or to distribute it to the um people as as reward and then we going to use that to prepare data model training and and kind of algorithm Improvement and then we're going to run the training itself inside this Cloud right which again this gives you really interesting guarantees because no single party will ever see the weights right there was no single computer that it had seen in clear text weights now you everybody can verify that this code and this data actually went in to train this model right I mean there's partitioning and everything that

used to happen but in general this model outcome is a production of this code and this data and so now if anybody can inspect and see that there's no uh kind of malicious injections and biases in this data and finally this resulted model it's encrypted and now everybody can use it inside the CML Cloud for inference fine-tuning and other experiments so effectively everything you do usually with open source model there's no kind of any additional restrictions except that you need pay for using it and so down now can make money to really reinvest them back into new models or allocate back to the Token holders so you have now a full economic model from training to in inference and

fine tuning to feed back into the you know either next generational models or a way to kind of repay back the the initial investors so this is really how kind of like this fundamental technology now enables Community own models and uh really enables this uh on future so if you're interested to learn more we have just two papers one is proof of response which is kind of overlay Network and one is decentralized confidential machine learning cloud uh they're just coming out so check it out would love your feedback and responses um obviously this is still work in progress and uh yeah thank you follow me and uh yeah talk on Twitter thank

you all right thank you so much uh are you gain to take a couple questions sure there are any yeah okay perfect so okay yeah there's going to be a ton of questions I'm so excited for this um go ahead just talking to the mic okay so uh you're using tees uh who are the roots of trust of those tees yeah so for each Hardware right there is the manufacturer that is the root of trust and so uh you can effectively have Intel you know or arm or and then you have Nvidia and then what we do we have effectively onchain registry of all of this so you don't need to go to Intel every time so if intel gets compromised later you don't need to kind of rely on that uh but

indeed yes the whole system is relying on the manufacturers and uh that is a you know not great but it is very practical and works right now um yeah kind of I have two two questions uh one is follow up on that so uh one is that uh so essentially when you use h100 uh as far as I know the confidential compute can be only done with one VM attached with it right now and that only should work with Intel's TDX version so it extends the root of trust right and Milan plus processes those two are highly expensive proess uh like processor so have you looked at what are the cost overhead of running

the same model on h100 with CC like with confidential computer and without that's the one first question and the second one was that in your slide number 12 uh you talked about trigger attacks right like uh um attacks on model machine learning models like llms where it produces so the threat model for those as that are that in the pre-training data uh we have uh poison data sets which specifically has triggers uh like I'm only talking about trigger attack so how does this will I mean we know that okay anybody who is training on their own data yes uh we know who is who has those data and what is coming out but

most of the training probably will work on pre-trained models and you fine tune on that that pre-trained model might already have the trigger iMed and that uh is there a better way to detect that uh apart from what hugging face is already doing yeah so first question the cost yeah so the GDX is only available on Intel fifth generation which is about um like $11,000 per CPU which is expensive indeed the thing is like if you're buying eight h100s uh each costing $30,000 plus Nvidia link uh you probably can Spruce over for $1,000 CPU uh to get this going so and then we have effectively blackv coming which uh offers intercluster

confidentiality uh and so you know if you're buying blackwalls which are going to be like even more expensive and setting up a cluster with them you may as well buy the most modern CPU uh so the cost overhead is you know not that much compared to gpus already and then if you're just talking about the CPU like we have obviously some CPU nodes um well the benefit is those fifth generation CPUs have like I know 128 cores or something so you can run a lot of them so it's worth the cost the question about like hey are there already trigger attacks in existing data first of all the prob somebody's maliciously poisoning all of the internet right now because like that's the that's a thing to do um if I was malicious and so the point of this

community own model which uh not on screen anymore was indeed to do a pre-training run where you actually first have Community to filter out data in a very specific ways right where we all agree that this is actually the criteria and then we use that data now to train and now everybody has guarantees that this data used for training it is an exp expensive but I mean as deep seek now shown it's actually not that expensive uh probably This is Not Practical yet until black wall and so I think as soon as the clusters of black walls are going to be available there's going to be a really uh kind of powerful way to do a pre-training okay we have time for one maybe two more questions so you're up next yeah so what do you think about the

security and safety of these models and AI agents and the second question I have like do you think like RL could be a good technique to find un model in future because data might be limited in future yeah so I mean the security and safety obviously depends on the model and on how it was trained and built uh there's few things that we are working on one is we actually have a bounty for an audit agent which is designed to audit agents so uh I mean I haven't talked about but we have a near AI hosting platform built on top of this Cloud where you can host your agents and models and so on this platform when you upload agent we're going to be running effectively a checks with AI auditor to ensure that your AI agent itself is not

trying to you know steal everybody's data now on top of that I mean this approach would be to train actually you know safer models finally the longer term research we're working on is a concept of formal verification so the reality is like it doesn't matter how much you check right how many security audits you do there's going to be always still bugs and issues in any code or any uh syst system and so the only way to effectively defend against that is to have a formal mathematical proof against the specific conditions that you care about so to give you like a simplified example if you're putting money into unit swap you the only thing you care about is that when you return When you withdraw them that the production of the

you know withdraw money will be you know not less than what you put in that's a precondition to care about you really don't care about anything else and so what you want is when you're putting like in the transaction you're putting money in that there is a formal notification check that happens on this precognition so that is a system that you can apply for AI agents as well because it doesn't matter what model thinks right it doesn't matter what activations happen what matters is what it does and if it can prove to you that it's not going to do anything that is not satisfying your requirements well the execution will fail right so that's a system that we're actually building long term to really ensure and it can run inside this directly cvms to ensure that like as you connect to them they

guarantee this execution okay thank you so much I know there's probably a lot more questions but we're at time um Ilia thank you so much that was amazing talk and really appreciate you coming round of applause for IIA everybody thanks thank you really appreciate it