Ari Juels: Can AI Weaponize Blockchain Smart Contracts? - Chainlink. Ep. 574

Transcript

broadly speaking a rogue smart contract is a smart contract written for one of two purposes either to advertise criminal services or to solicit criminal services so how does the contract check that there's this correspondence between news reports and this text description of the calling card for that purpose you would want to use some form of natural language processing you'd use an llm like chat GPT how does the smart contract TR gain access to chat jpt we would naturally do that through an oracle system hello and welcome to EP Center the show which talks about the Technologies projects and people driving decentralization and the blockchain revolution I'm Brian Crane and I'm today

here with Ari jeweles who is a professor at Kell he is a co-director of the initiative for cryptocurrencies and contracts he's also Chief scientist at chain link and uh and he's written a book recently called the or which I've read a few months ago so it's kind of a a Sci-Fi novel that uh deals with uh smart contracts and and oracles uh and he was a previous guest here actually long time ago we just noting it's almost eight years that he was a GU so really excited to speak with him but you know just before we get into that I want to share a few words about our sponsors this

week if you're looking to stake your crypto with confidence look no further than course one more than 150,000 delegators including institutions like Bido Penta capital and Ledger trust corus one with their assets they support over 50 blockchains and are leaders in governance or networks like Cosmos ensuring your stake is responsibly managed thanks to their Advanced me research you can also enjoy the highest staking rewards you can stake directly from your preferred wallet set up a white label note restake your assets on Iona or symbiotic or use the SDK for multi-chain saking in your app learn more at .1 and start sing today this episode is proudly brought to you by nosis a collective dedicated to

advancing and decentralized future nosis leads Innovation with circles nosis pay and metry reshaping open Banking and money with hashy and nosis VPN they're building a more resilient privacy focused internet if you're looking for an L1 to launch your project nosis chain offers the same development environment as ethereum with low transaction fees it's supported by over 200,000 validators making nosis chain a reliable and Incredibly neutral foundation for your applications nosis Dow drives nosis governance where every voice matters join the nosis community in the nosis Dow for today Deploy on the evm compatible nosis chain or secure the

network with just one gno and affordable Hardware start your decentralization journey today at no diio okay well thanks so much for coming on again uh Ari so I don't know how many of our listeners uh remember you are aware of you but I mean I think you've been in crypto for a long time and have had like you know a big impact in many ways you did all work around smart contracts uh trusted execution environments dos uh you were one of the co-author also of The Flash Boys paper which kind of kicked off the whole me field uh and then then more recently nist so thanks so much for coming on again I'm delighted to be here

thank you for having me so I actually looked at our old uh the summary of our episode we did uh in January 2017 and uh even criminal smart contracts was was mentioned there already uh and the criminal smart contract is also kind of a theme of the novel you wrote maybe can you share a bit like what uh what motivated you to write this novel and can you share a bit without maybe giving too much away or no spoilers but a little bit the the theme of the novel yeah there were really two seeds for the novel if you will one of them is the paper that you and I

discussed on the shows as you said some seven years ago criminal smart contracts in the book I call on Rogue smart contracts those have a new found relevance as we can discuss given the Advent of powerful llms like chat GPT that paper at the time that was written was somewhat speculative but it has become more real and that became a motivation for writing the book the second impetus for writing the book the sort of literary impetus if you will was a bridge uh skybridge in lower Manhattan the Cornell Tech Campus based

at Cornell Tech which is a Cornell University and Tech Theon applied sciences campus in New York City the campus used to be in what is now the flagship Google building where Manhattan I used to commute there every day on the Highline this whole elevated Railway and I passed this beautiful skybridge windows on both sides and I thought this would be the perfect office and I just sort of started to visualize the hero of the novel sitting there and that became as I said kind of second motivation so I didn't the the book so for for those uh who either haven't heard or don't remember right

the criminal smart contract episode what are rogue smart contracts how do you envision that yeah so broadly speaking a rogue smart contract is a smart contract written for one of two purposes either to advertise criminal services or to solicit criminal services and if the you con the definition broadly enough Rogue smart contracts have already cropped up in practice mainly in the form of pyramid schemes like the famous orage scheme but in the context of the novel and the paper what was of Interest was

real world crime so I can give a I guess a simple example to illustrate if that would be helpful how these things work maybe yeah so uh let's take for example I like to use this example because it's a relatively Benoy one let's take for example the the coor diamond right it's this famous diamond with a very controversial history it is part of the crown jewels belong to the British royal family sits in the Tower of London as I said as a controversial history there are people who believe it should be repatriated to India there are a number of people who believe that it's cursed right so you can imagine somebody would want this thing to be stolen just

to have it disappear not to own it because as I said it's cursed so how would you create a smart contract for this purpose right you've got two challenges in creating such a contract the first is how is the contract going to know if the diamond is stolen right and and the second is even if the diamond is stolen how is it going to know whom to reward for the theft of the diam let's suppose that the smart contract is paying a b of you know $100,000 in cryptocurrency to this purpose how's it going to know where to send the money the observation we made in the paper is that you can do the following you can have a wouldbe criminal right somebody who's signing up

to steal the coor diamond send to the contract in advance of the theft a brief description of some detail about the crime that only the criminal could know and these details are sometimes referred to as calling cards in the criminal World a calling card is often it's a physical object that's left at the scene of the crime to indicate who who committed the crime so I like to reference as an example of a calling card the glove monogrammed with a p left by the Phantom the jewel thief in the pink

pantheres right that would be an example of a calling card let's say you know it's the first time a particular calling card was being used let's suppose that the the the Phantom is the one who's going to steal this the coing on diing what the Phantom does is send to the smart contract a brief text descriptor of the calling card monogrammed P glove in advance of the crime in Hidden form you know cryptographically committed encrypted I want to think about but concealed then the crime gets committed right Diamond disappears and this's a famous Diamond as I mentioned so you know the SE this Splash across uh headlines on news sites and now the criminal comes back and decrypts reveals

this description of the calling card monogram PE and the smart contract now checks that news stories correspond to the callon card you can imagine that the news stories reporting the theft of the diamond would also report the fact that a monogram pee glove had been left to the scene of the crime this is the criminal of course leaves this this calling card in a place that would be visible prominent so the the smart contract can check that the the calling card was reported in news stories and presumably it's only as I said the thief knows in advance what the calling card is the calling card would be selected for that purpose so whoever revealed the correct description of the calling card

here would be paid the money be paid the $100,000 reward so this is an example of how these contracts liting constructed and so the basically for the smart contract to be able to know okay this was mentioned in a new story then you'd have to have some kind of uh I mean I guess I can imagine different uh ways this go work right you could have uh something like I mean right your enir Mor chain link right so uh there could be a bunch of uh servers right that or parties that that uh maybe write such a data on there or maybe

could it be that like I don't know like in a in a trusted execution environment a search is executed or some commands are followed to then like verify such a condition or like how how would you imagine that that part to work yeah you put your finger on the nub of the problem here this is the really interesting part right so how does the contract check that there's this correspondence between news reports and this text description of the calling card for that purpose You' want to use some form of natural language processing you'd use an llm like chat jpt how does a smart contract gain access to chat jpt we would naturally do that through an oracle system we

wouldn't be able to run an llm efficiently onchain you would run it offchain and an Oracle system would be the natural place for this so the whole scenario in fact depends upon a convergence of blockchain technology and AI LMS in particular with this example we're considering and the Advent of CHA GPT and and Powerful llms is what makes this scenario particularly relevant over the past couple of years at the time that we originally wrote our paper this was hypothetical but now it's at least technically

feasible and then this convergence of blockchains and llms how how would this work uh like technically so technically it could be conceptually at least relatively simple you would run an llm ideally in a trusted execution environment to ensure integrity and to give you confidentiality where appropriate and you might have a single node do this if you trust te sufficiently or you would use a decentralized Oracle Network for this purpose and it would ingest new stories as pointed to by the smart contract or I should say new sites

stories from new sites and this calling card the text descriptor of the object left at the scene of the crime and the smart contract would ask the llm does this calling card match these new stories right and as I said this is technically very feasible happily you can't go just go and build one of these things today right it's technically feasible but not realizable with a Gooding infrastructure so in some sense the paper and the novel are warnings to the community that this kind of danger is a real technical possibility if we're not careful about how we engineer these systems about how oracles make AI

functionality available to Smart contracts CU like the way it would work is like let's say you'd have the smart contract and you say like I specify some program that should be run in this te as an example and then uh maybe anyone could go and download this program and you know get access to Intel SX server which you know presumably is easy to do and then they would run this program in there and then they would write the result together with the proof that that's what they did on chain and and get some kind of economic reward yeah there there there are a few ways to

do this so one would be you know to download the latest LL model model or whatever and stand it up in a team as a suggesting and that it would be executed by nodes in the Oracle Network or if you're happy just sending it off to a particular web service you could actually query chat GT itself one of the benefits of standing up uh a model in a te is that you can get provide what's known as an attestation certain forms of tea provide what's known as an attestation which tells you exactly what application you're running exactly what model and exactly what the environment looks like if you go and query a service like chat

GPT it's changing under the covers frequently so you don't know precisely what you're interacting with and in the case of smart contracts you really do want to have in general a precise notion of how the smart contractor is going to behave and therefore how the Oracle depends upon is going to beave so you mentioned we have to be careful in how you know oracles llms are engineered uh so that something like that doesn't happen or these Rog smart contracts uh I mean it seems is that possible or or is this just something that would be like a fundamental capability of these systems because that's like or like how how do

you you think the blockchain AI intersection should be approached to you know maybe prevent malicious use cases and allow us to leverage the most uh positive use cases that's a great question of course it extends beyond the intersection of blockchains and AI how do we prevent smart contracts or any kind of blockchain functionality that's doing harm from continuing to run in an autonomous way and people have proposed various approaches right like security councils the case of dows which could be instantiated Elsewhere One could imagine the techniques that are being

developed for AI safety deployed within an oracle system so happily the problem is Broad enough so that people are thinking about it in other contexts and I think also we can kind of turn this question on its head and rather than just thinking about Oracle systems as uh a way of enabling this intersection potentially ways that are harmful think about them as Gatekeepers and contemplate ways that they can help enforce AI safety and this is one of the things I've started to think about recently so for example I mentioned that it's very helpful for smart contracts to know

exactly how an oracle system is operating because that gives you the determinism the precise notion you want about how a smart contract ter is going to W and so what we really want to have are what I would refer to as pinned models models whose specifications are made fully transparent to users and can sort of be uh pinned down locked in place if fix and this I think can be very useful in ensuring that models don't behave in unexpected ways that we can at least have a good understanding of which model we're dealing with and potentially test it to determine how vulnerable it is say the adversarial examples or How likely it is to produce

hallucinations so that's one example of a way that we can build systems that have with AI safety in mind so AI in crypto is an area where you know there's seems to be a lot of or there's a lot of interest in it at the moment at the same time it's a little bit unclear you know what are what what's actually going to work what's actually going to be valuable do you have a view on the kinds of use cases and applications that uh this AI plus crypto AI crypto intersection will be most uh suited for yeah I mean probably speaking one of

the strengths of smart contracts is the fact that they're written in code and therefore they provide rigid specifications of an agreement a system that newans interact with one of their weaknesses is the fact that they are written in code and therefore are rigid right give you this very uh specific interface that lacks flexibility flexibility can be harmful and that allows adversarial Behavior but it can also be beneficial and in fact the lack of precision

in contracts written in natural language ordinary legal contracts is actually regarded by the legal Community as a feature it enables you to deal with unanticipated circumstances and this is something that smart contracts as their engineer today can't do right you can't bake into to solidity very easily uh condition it says this contract will be cancelled in the case of an act of God broadly defa right you have you can only give a precise specification of when the contract is going to be cancelled and you can't always anticipate all the reasonable circumstances under which you might want to cancel it but if you combine smart

contracts with machine learning models with llms for instance you can endow them with some of that flexibility we benefit from in the real world and that I think opens up a whole range of new news cases and furthermore if you combine this with some of the Privacy enhancing technologies that have been developed specifically for blockchains or I should say have been catalyzed by blockchain use cases then I think the proposition becomes very powerful so for example today the rigidity of smart contracts when it comes to loans constrains us to for the most part to using to over collateralize lending right things like

like ler but you can imagine a system in which users are thanks to use of a privacy preserving Oracle system able to import financial documents from trusted financial institutions trusted by a lending smart contract those documents get interpreted by an llm to assess the creditworthiness of the user and the user gets out to take out a loan on that basis in other words you can imagine a smart contract now looking more like a real world lending facility or institution that's just a rough example the type of thing you can do when you

com bot these two technologies now there are lots of challenges involved like the ones that I alluded to earlier adversarial examples and other words malicious manipulation of machine learning models and hallucinations machine learning models of making stuff up but I think this broad idea of endowing smart contracts with useful flexibility is what makes the combination of the two technologies so potentially transformative so one thing that uh I mean you've done a ton of work on and it's prob I mean it's it was when I got into crypto you know it was from when I got in crypto you know

11 years ago or more it was already like the most one of the most the ideas that excited people the most was the idea of dolls so the idea that you could have these organizations they're like onchain and you know people use tokens in some way to coordinate and they could be kind of you know replacement or successors to corporations or cooperatives or nation states or like all kinds of you know existing legal institutions that you know humans used to to do things together now I think if you look at today the state I mean probably most people right if you uh from back then would be

disappointed in the the state of dollars today right the extent to which they are used and the extent to which the attraction like the the places where we see traction today you know like stable coins defi stuff they're they're generally different typ of use cases so what what do you what do you see as like the state of DS today and what are your thoughts on the role that DS can play in the future yeah I I find them really intriguing we're doing this kind of grand experiment in governance across the blockchain community thanks to Dows that experiment is taking stumbling

steps at the moment and I think there are there are a few different reasons for that one of the challenges that my group has been looking at recently in particular I think one of the stumbling blocks is not knowing how to measure whether or not a dow is successful if we don't have objective measurements whether Dow is functioning correctly then we don't know how to conduct the experiment if you will so in particular we've been asking what is the what does the D and da really mean what is the what do the decentralized part you can say the fact that a DA is running a smart contract means it's decentralized but typically people are more interested in intuitive ideas like making sure that a diverse set of

opinions are heard or credible neutralities of things one one often hears so one would like to have these things in a dow and I think we would in general regard these as marks of success if achieved but again we we really need some way to measure these things the typically the way that people are measuring decentralization in Dows today is just to look at token Holdings across addresses right you say that if tokens are spread broadly and token Holdings are more or less equal across a large number of addresses than the dowas decentralized but this is kind of a simplistic way of viewing decentralization and there are lots of things that can miss a simple example

would be one user holding uh multiplicity of addresses right you could have a a whale under the surface of the water as it were right and then this measure of decentralization would be completely wrong and in general alignment sort of hidden alignment among different voters would constitute a centralizing force and that's something we really need to take into account if we're going to measure the decentralization and Dows effectively so what my group has done recently um and this is work led by my PhD student Andre fabrega um is to formulate a a new

metric that we call voting block entropy and basically the way it works is as follows entropy is essentially a measure of how evenly distributed tokens are across addresses right so when I said people look at distribution of tokens across addresses to determine whether it do decentralized but basically measuring entropy across addresses step measuring entropy across addresses we measure entropy across aligned sets of Voters that we call voting blocks you can think of them as being like political parties and in this way we can detect forms of alignment in the community and that we think gives us a better handle on how decentralization

works and in fact this this idea we have found is rooted in some of the principles and practices of machine learning Believe It or Not uh reinforcement learning in particular plus we we think of a dow as a big organism that's trying to learn things and it turns out that uh diversity or decentralization has been shown experimentally to be important in the learning process if you conceptualize Dows as uh a learning system and so we can take ideas from reinforcement learning in particular multi-agent reinforcement learning map them up the Dow space and now we have this metric in

hand and we think that if you can measure decentralization effectively then we can overcome some of the uncertainty and challenges that the Dow landscape is confronting today but but you would take that from the voting behavior is just like some governance vote you'd be like how often people in the same way or like yeah yeah great question um so in theory you look at what we refer to is or what I refer to as the utility functions of the voters in other words how much they tend to like particular proposals uh how they value particular proposals personally regard to their their own

interest but of course we don't know voters utility functions voters themselves often don't know their utility functions they don't know what their opinions are on questions you haven't asked them yet and sometimes even on questions you have asked them but we can observe how people have voted and a voting Block in this view would be a collection of users that tend to vote have tended to vote the same way historically that's something we can observe experimentally yeah so you'd imagine that like those that have less of these voting blocks people vote more in in you know a variety of different ways presumably making more of their own decisions as maybe like I don't know

following some kind of you know maybe following some leader or following some particular group that tends to have a big influence so you imagine those kind of dolls would be more performant or like actually function better over time that's what the theory suggests so again if you think of a dow as learning to improve some objective function to achieve some goal say it's an investment Dow and so it's learning how to make profitable Investments what the literature the reinfor relevant reinforcement learning literature suggests is that a diversity of viewpoints taking into account A diversity of newpoint is going to make for more effective learning and

therefore will make for more profitable dial over time and in fact uh We've stood up a dashboard on this metric it's called voting block entropy as I said or vbe or Vibe for short so so use the term Vibe so we've got this Vibe dashboard that shows the relative Vibes of different Dows and we observe that some Dows that are known for having communities particularly concerned to achieve high levels of decentralization or to take differences of opinion into account like some of the prominent l2s arbitrum optimism actually are exhibiting high VI today in other words Accord this metric have high levels of

decentralization so there seems to be even within the Dow Community some confirmation that this metric is helpful yeah great yeah and I just found that dashboard so I'm going to include it in the in the show notes okay so then you're measuring basically the this this kind of entropy and uh have you tried to correlate this with something like what are the the main metrics a higher voting block entropy correlates with well as I said at least in principle it should correlate with a better functioning Dow in other words a dow that was better able to achieve its objectives at this point we don't the Dow Community doesn't

have a long enough history and we don't have a large enough set of dows to perform the type of experiment we would like to perform to see for instance if investment Dows with higher Vibe have performed better over time that ideally is an experiment we' like to do and it may be that we find some form of natural experiment within the blockchain community or elsewhere that helps us confirm in this sense the value of God but as I said the dashboard does seem to show that Dows that are known for having particularly vibrant communities with a multiplicity of opinions have high exhibit higher levels of odd

today right right and now what about dark dos yeah so this is well as the name suggests the Dark Side of dows these are something that my group has been thinking about for many years now and we' started to revisit in our research because we've realized that the platforms that realize dark Dows are useful for other purpos and actually could have a pretty sweeping effect on the crypto ecosystem so dark Dow as originally conceived uh and it was my then PhD student Phil Diane who was leading work on on dark Dows at the time we were

first considering it as we were defining it then dark Dows are were Dows whose purpose was to disrupt or influence the operation of victim Dows if you will and to do that through bribery voting bribery they were dark in two senses dark in the sense that they had this kind of malevolent uh or at least adversarial goal to swing votes on proposals doubt dark also in the sense that we showed that they could be constructed confidenti uh confidentially and we were considering at the time the use of trusted execution environments for this

purpose right so principle you can set up a dow in a trust execution environment whose operations and behavior are not visible on chain that orchestrates bribery allows voters in a particular doubt to go claim rewards if they commit to voting a particular way that was that was the idea in The Nut Show as I said this has more sweeping ramifications because it turns out that the ways that you would enforce compliance with a bribery regime in a dark Dow can be used to manipulate other systems as well we can talk about some of the potential other impacts of dark Dow like

approaches to control so like an example here would be there is a you know some community pool has some money in it and I make a proposal pay it to me and I put up some Bounty that anyone who votes in this direction can then for example get a bunch of maybe I put like half of this payout in in that pool and then uh people who vote that way can basically sort of uh get the money and uh plunder it something like that would be like an example or yeah so that so that's basically the

the idea and in fact such bribery markets exist today for certain defi protocols there basically a quarter billion dollar market in onchain bribery protocols but the particular danger that a dark out poses is the fact that you can do this confidentially and that means it's hard to orchestrate defenses against it the basic technique involved here is something we call Key encumbrance basically the idea is that you hand over your private key to an application running in a trusted execution environment think of it as a private smart contract right so your key is now sitting in this private smart

contract it's like a wa like a wallet contract and you can use this contract to commit to doing things like voting a particular way in a doubt but you can also have this wallet contract if you will private wallet contract can have you commit to doing other things or constrain uses of your keys in other ways so that you you can take your take the control you have over particular assets either governance tokens or something else and do a whole range of interesting things lending them selling them renting them and that as I said can have pretty sweeping implications for the crypto

ecosystem as a whole so to give an example here let's say I'd have uh you know a token like Lio I would then basically like let's say some kind of wallet would be created that presumably I that would be like maybe the code would be uh open source so I could inspect it and then it would run on some te and I would put my uh my coins on there and then for example let's say they would be locked there for a month I couldn't transfer them out and someone else could could could just vote them but not do anything

else so use in governance and they compensate me for that and then after a month I can sort of like take them out again uh something like that exactly so you need to generate your key inside this wallet because if you generate it elsewhere then you have control individual control over it as opposed to having a wallet controled exclusively right but yes so you'd set up a wallet and indeed you can lend assets that way and you can do lots of other things so for instance there's this notion of soulbound tokens which are credentials that a user is not supposed to lend to others as the term soulbound suggests it's supposed to be associated with a single individual or an entire lifetime

well if you had a soulbound token in this environment in this key encumbered environment or confidential wallet environment you could you could lend it out to someone else and the fact that you were lending it out would not be visible on chain and so you would basically be breaking the fundamental property of the soulbound token no longer be sold bound that's another example yet another example would be what pre-selling airdrops or taking tokens that are supposed to be subject to a walking period and unlocking them prematurely by transferring ownership in this kind of hidden wallet off chain which is's a

couple of other things you could do with this type of environment H how would such a uh Wallet be hosted cuz like somebody it is now in some server let's say it runs Intel sgx and uh I mean presumably someone could just unplug that server and maybe they can't like steal the money but also they could sort of interrupt it from functioning or or would this have to would this have to be a its own decentralized network so there there are a couple of options here one is to use a centralized system like a cloud provider they have pretty good up time and pretty strong

guarantees around the availability of resources to end users but of course they're not decentralized systems they don't give you the guarantees for accustom to web 3 an alternative is to use a te based blockchain like Oasis right know a secret Network or something right which are designed essentially for applications of this type obviously not the malicious variety but applications that run the equivalent of smart contracts in trust to execution evironments but like let's say if in the first example if it's like on AWS or something then well some party still has uh you know it's the owner of the AWS account and they could go in that admin

dashboard and be like oh stop this server from running yeah so that that indeed would be that would be a potential risk right so you would need to find some way to prevent that from happening and not entirely clear how you do that um but you may may be able to lock yourself out of your own account demonstrably or you can have uh group administered service or something else right the other example would be like let's say the races example you made uh that I guess sort of tie seems to tie in a little bit with this like chain abstraction topic for example right because let's say Oasis is own

blockchain if I would want to control uh some let's say Lio token right which can vote on ethereum or it's an ethereum token they i' have to be able to generate like an ethereum address in there have an ethereum contract and then it gen could generate emit this trans sign transaction from Oasis that then somehow somebody would take and broadcast on ethereum or yep and that's exactly what we're doing in a research project we'll be releasing a paper on imminently this is led by my PhD student James Ain uh we have created a system we call liquifaction that runs on Oasis but enables all these applications in

ethereum or on any blockchain of your choice right so the the key is encumbered or controlled in we sitting in a wallet in Oasis but the key is for assets on some other blockchain potentially like a sh cool cool I mean presumably also lots of non- Nefarious uh utilities for this kind of application yeah so two important things to point out number one there there are lots of beneficial applications as well so an example would be for instance a privacy preserving version of of constitution da so you remember Constitution da raised you know tens of millions of dollars to buy a copy of US Constitution at auction but the project was completely transparent so you know

hedge fund manager was able to come along and and easily outbid them you could create a confidential version of constitution da where investors get either no indication or only a very general indication of what funds have been raised up to certain point and could do that uh and and there are lots of other potential applications as well know this we're basically talking about turning assets liquid right and liquid staking you might depending on your perspective view as a positive application and liquification if you will or liquifaction of other assets can can be beneficial as well second important point to make is that if you don't want your system to be subject

to liquefaction of this type as you want a system whose assets can't be liquefied there is a countermeasure to key incumbrance to use of tees at these forms and that's something called complete knowledge uh and this is a system that or idea that my group developed um in collaboration with bolic berin and the the idea essentially is that in order to use the system you need to prove that the key you're using private ke you're using to interact with it is not sitting in a te application of the type we been describe it it's not encumbered how do you do that well one simple way is to Fight Fire with Fire

you generate your key in a te application that spits out the key and then proves that it's spit it out in other words it demonstrates that you the user know the key and therefore it can't be controlled exclusively by one of these confidential wallets so it's a fairly practical countermeasure could you run the te inside another te or something to then prove that you discarded the spit out key that yeah so that would be a problem if you had nested tees that then we'd be in trouble or you would need a nested uh proof of complete knowledge uh go down that path and think things get pretty tricky but you make an important

point that which is that we're we're we're assuming at least in initial development of these things but there no nested te sitting around anywhere yeah okay okay great I guess we are starting to uh to to see stuff like that I mean I I feel like probably the most one of the most obvious use cases right for tees I do imagine is that kind of intersection right between I mean we've kind of talked about it earlier a bit with the Oracle thing right where you have some smart contract and the smart contract wants to be able to use an llm right and then have some kind of something uh you know

LM is called off chain and the result is written back on chain and uh I mean I think that could be interesting from the perspective of you know this AI crypto merger but maybe also actually very powerful to get dolls really to the place where they become uh more powerful and functional I mean I know for example the topic of you know prediction Mark is also one thing that people were you know been very interested in since the beginning and they've kind of haven't gotten too much traction maybe except some like very limited use cases like the elections but I know for example diagnosis people that were working a lot with that they they felt that like well if you can have like

llms that are basically playing like B that are betting in these prediction markets maybe you can start having you can start actually using them for like fine grain decisions somehow yeah so uh te's would be a good way to execute llms with strong trust assurances I mean we do T's are very powerful and as you know they're making real inroads into the crypto Community but we it is important to emphasize that historically they've had pretty serious security vulnerabilities so of course A lot of people are skeptical ultimately about what sort of security we can

afford and additionally as you were pointing out earlier a te on its own doesn't give you any kind of wideness or censorship resistance guarantee right for that you need to have a a network of teams in place you need to incorporate them into a blockchain or a decentralized Oracle system on something else but that said I I think they're uh an incredibly powerful and pring technology and I would expect them to have a a huge impact on the crypto ecosystem if we can live with their potential vulnerabilities right in fact they are able to do essentially all of the fancy cryptography that has received so much attention of late in the crypto

Community zero knowledge proofs would be an example or secure multiparty computation all these things essentially get subsumed by te if you trust the te yeah and they become like much simpler much more achievable in the short term and much cheaper and more scalable right cuz I guess with you know things like ZK right very computationally extensive slow uh and a lot of challenges around that yep exactly so tees I mean we mentioned sgx a bunch of times I think that's as far as I amware I don't know but was maybe like the first one or first one to get like traction so created by Intel but of course always one of the concerns was

like well this is like you know one large company that controls these uh that could potentially I think also like maybe I don't know if that's actually true or if they could like um sort of attest or or declare things to be a te that an Intel sgx server that actually is not is a lot of innovation happening there do we see a lot of maybe open-source tees or Alternatives where um you're not as um dependent on Intel yeah so a few things to note here number one the range of te Technologies available to the community is is slowly growing recently Invidia for instance

has started to support uh essentially extension to the Intel uh trust domain um in in its gpus uh a MD has a kind of variant on the Intel te and in fact arm has begun to incorporate recently into its chipsets tees that look like Intel tees tees to be clear been around for a while and if you have an iPhone you've got a te but some of them like the one in your iPhone lack what are known as attestation capabilities they bu improve things to the third part of but all of the different variants I mentioned just

a moment ago have attestation capabilities so tees with attestation capabilities have become more widely available those are still not open source there are attempts to create open- Source tees with ATT testation capabilities but that's a really challenging problem that encompasses both computer science and physics and I don't have tremendous confidence that we'll see anything of that kind in the near future uh maybe one more topic that we can uh we can touch on so you know I mentioned earlier um you're working around me you know you co-authored with Phil Diane who went on to start flash Bots uh the paper Flash Boys 2.0 which

was sort of the the Inception certainly in the in the in the in the mind or in the awareness uh of me and you've done some work around proof of fair transaction ordering um can you explain what is what does that mean and how does that work yeah so since the Flash Boys 2.0 Paper came out and since the rise of in some cases exploitative forms of me extraction not all forms of me are bad of course but there plenty of detrimental ones around my group has been thinking about ways to mitigate the the impact of MV ideally to get rid of

most forms of exploited me one of the approaches that we've been looking at is what we call Fair ordering in particular share temporal ordering which is really just a fancy name for first come first serve ordering of transactions and that seems like a simple thing at first right you know you set up some machine and it just ERS transactions according to the time that it sees them turns out to be actually quite tricky if you do it want to do it in a decentral Iz way and the reason is that you've if you've got a network of say 10 nodes receiving transactions those nodes depending on where they're sitting and where the transactions originated are going to see different transactions at different times and in

different orders and somehow they have to reconcile their disperate views of when transactions have been received in addition you know maybe some of those work nodes go Rogue and cheat and try to order transaction adverse arei so we've developed some techniques that address this problem achieving forms of fair ordering that are resilient to some number of malicious nodes and provide some nice properties even when nod see transactions at different times and this a this is something we worked on for a few years the problem with the approaches we developed was that they assumed that you've got you know a quorum uh significant majority of honest nodes and

the question is how do you enforce that right we've seen that there's a willingness I mean there's a monetary incentive to order transactions uh in ways that support Arbitrage know that allow users uh I mean to put it bluntly that allow users Pockets to be picked if there's money on the table somebody's going to pick it up so how do you ensure that nodes are actually ordering transactions fairly and we couldn't find a solution to this problem until recently when we developed a system that we call Prof which stands for protected order flow the concept behind Prof is pretty simple and again it leverages trust execution environments is very discussing there very powerful it's a number of different

things so here's the idea transactions get ordered let's just assume that some transactions get ordered fairly and are incorporated into a bundle on the te and you can order them fairly however you like using the first come first serve approach I suggested or just have transactions enter the encrypted form that can also ensure some degree of fairness or both a number of different ways you can do this but let's suppose you got this bundle of Fairly order transactions sitting in the te the question is now how do you get those transactions on chain in a way that is going to carry the right incentives how do you incentivize

validators not to muck with these transactions to accept the bundle in its fairly ordered form and so Prof does this in a very simple way it takes a block that was about to go to a validator and it basically adds to it internally this fairly ordered bundle and it makes this take it or leave it proposition to the validator and I'm simplifying things of course not considering all the nuts and bolts infrastructure but offers this kind of take it or leave it deal the valid says okay you can take this block that has this extra bundle attached and if you do that we're going to give you a little extra reward like an Epsilon reward say

an extra penny so you can do that but you have to leave the bundle intact and the te is going to make sure that you leave the bundle intact or you can just not take the bundle you get the original block and then you give up the penny well a rational validator profit maximizing validator obviously is going to choose to allow this bundle that will pend it to the end of the Block it's better to have an extra Penny than not and so this simple mechanis we think makes fairely ordered transactions monetarily appealing within existing infrastructure you know within the PBS infrastructure the M Supply Chain okay actually I didn't totally

understand why that would be the case so so you get a you're a validator I'm giving you a choice between two blocks give you block a which was constructed by a builder somewhere right this oh so you you're assuming here the proposal Builder separation so this is um you yeah so we designed it to work with proposal Builder separation although it can work it's a it operates on a pretty General principle so it it could work outside existing PBS infrastructure but the idea is you know you got the you can take this block a right which is just constructed by a builder or constructed somehow doesn't really matter um and you get a certain reward you know reward r R

dollar or you can take Block B what is Block B Block B is block a plus this extra little bundle with a with a one penny additional incentive so if you take Block B you get our Dollar Plus a penny and obviously you as a validator you want to maximize your profit so you're going to take Block B you'll take the extra Penny and in so doing you will accept this fairly ordered bundle that comes at the end of Block B that's the idea in the nutshell yes so I mean actually at at course one so the the company I mainly run so we have uh we have done work on exactly that problem with the dydx uh chain and basically the the thing we did

there the the so solution or or research team design which is the thing that ended up implementing was basically to say that like you know each validator would have their own local I mean there's no prop proposed Builder separation right all the transactions go to the validators directly but in each validator would basically you know have a local order of transactions as they receive it and then when the proposer creates a block they would basically see like oh how much is the Divergence of that from the other validators and sort of score that and then uh you know if if the other I mean it it basically accepts that there's like some Divergence right

because a validat receive it in like somewhat of a different order but that if it was like you know too much of a diversions then basically I mean basically the block is scored in terms of how much it by each valid how much it diverges from their own local View and then you basically have this kind of statistical thing right where it could be like okay if they were to sort of mck with the transaction order you know you'd start to see this Divergence and then they could be slashed that's kind of like the the approach that uh that was taken there I said how do you prevent the validators from colluding so that they're all ordering transactions the same way and theying yeah you couldn't like you

couldn't really uh prevent that if there's but you would have to probably have like a lot of valids colluding right or or like I mean it would still be detectable I think yeah depends right if you have everyone colluding of course they could they could obviously uh um cheat this mechanism and and if you have a majority colluding then they could maybe make the ones who are actually honest look like the ones who are uh messing with the order right but but I think given that I mean this is also a little bit of a different dynamic or well given that you know the validators are chosen by the dydx token holders you know who have an interest in the health of the system that helps you know they it's very unlikely that you're going to

have you know a bunch of malicious parties that basically control all the Stak on and then collude against the network that just you know doesn't really it's not very incentive um not extremely unlikely to happen I think yeah that that makes sense uh in the in the ethereum setting of course you can't assume that validators are not great tooled that's what makes it especially challenging but in the setting you're describing makes sense validators are chosen by the community they one lik wouldn't be honest it's essentially permission set cool um so what's the what are the when you think of the next year or two

years what are the research questions currently that you know you find most exciting or challenging or important that you're focusing on well one of them is thinking about how blockchain systems can be beneficial to AI in the way that we were discussing earlier you know rather than just thinking about what AI can do for blockchains and people formulate a lot of answers to this question some of them don't make a lot of sense to me you know like being able to distinguish geep Jakes meal content not right by but I do think that the the tools that the community has developed for both

integrity and confidentiality in the blockchain setting can be immensely useful in machine learning settings so that's one of the things that I at least personally been thinking a lot about and my group I think will continue to explore uh Dows and figure out best practices for governments and one of the things that we're trying to understand now is what the mechanics of voting should look like today you know typically happens in snapshot and tally whatever and there are some peculiar things about the way that those systems are built from the perspective at least of the

academic literature one of them being that ballot secrecy isn't preserved throughout the voting process it would seem beneficial to ensure ballot secrecy even through the through the tallying process uh at least from the perspective of classical voting systems in blockchain systems there's a desire for some degree of transparency though so there's a real tension between what uh voting Dows want Dow communities want and these kind of foundational properties and that's something we're trying to figure out and our hope is to design voting systems that preserve as much privacy as is compatible with the

transparency objectives in D communities that turns out to be quite tricky that's another thing we're thinking about and then this whole business of liquefying assets and complete knowledge and figuring out the b between those two that's something we're still wrestling with and I think there's a lot of research to be done there a lot of interesting and impact home research cool well thank you so much Ari I think you continue making working on some really like interesting problems and I think that definitely that whole te merging of AI blockchain uh I think that's going to end up being like a super vibrant area actually it was just a dinner a few days ago

uh where I don't know if you've heard of this thing called goat and ter something terminal uh it's basically some kind of like AI supposed AI That's you know that's kind of interacting with this meme coin and but like one of the challenges is actually that you cannot really like you know I'm challenged I'm like B but is it really the AI That's like doing these things or is it like some the person who you know cuz it's like like offchain not verifiable but I think it it kind of points to it points to the things that like cuz I think very soon you will be able to have it that like you know you can have an AI starting to do stuff right and people

interacting with the AI and uh I think this is going to give rise to some very fascinating and bizarre things for sure so yeah thanks so much for coming on I I really enjoyed the conversation and of course for yeah the people uh listening I think you definitely go check out the the book The Oracle uh I really enjoyed reading it I feel it sort of points to the yeah like to some of the exciting dangerous scary things that that will become possible if we are in crypto in the future so it was really well written too so if people like science fiction then go check out the article and yeah thanks so much for coming on I'm excited to you know have

you again on at some point in the future uh maybe before eight years have passed and uh we can talk about you know all the all the new things happening in crypto thank you Bri it was a real pleasure thank you for having me on