Crypto x AI, AI x Crypto: A Survey

Transcript

[applause] >> Thank you. I'm a co-director of the Initiative for Cryptocurrencies and Contracts or IC3. And I'm delighted to tell you that today we released a survey on the intersection of crypto and AI. And it is a beast that runs to over 150 pages. So in this talk, I'm only going to be able to give you a lightning tour of the paper. I'm also in the unusual position of telling you about a paper that probably has more authors than there are people in the audience today. You can see all of them here.

Uh so as I said, I'm going to talk about the intersection of crypto and AI. They don't really fit naturally together. All right, I would venture to say that they are not natural bedfellows. Why do I say this? Well, crypto is in a certain sense hard. By which I mean that it's strictly programmatic to begin with. For instance, if you stand up a smart contract to mint, say, 10,000 NFTs for say, 0.05 ETH, the contract will do exactly that.

It doesn't matter what the market conditions are. It doesn't matter what the desires of the contract creator are. If the contract has been created to do exactly this, all right, it will follow its instructions programmatically to the letter. Another feature of crypto that makes it hard in the sense that I mean that term is that it's unforgiving. And this is well exemplified by the KelpDAO attack from a couple of months ago. What happened in that attack? This was an attack by the North Korean Lazarus Group.

Well, it was a fairly sophisticated operation. Involved a denial-of-service attack, causing failover to a compromised node, and so on and so forth. But, at the end of the day, it really just involved a single corrupted message. And that one message led to the theft of hundreds of millions of dollars. So, a single message resulted in Kim Jong-un being able to substantially expand his two favorite collections, his wine collection and, of course, his collection of nuclear warheads.

So, this is what I mean by unforgiving, right? A a small error, a single poison message, can have serious downstream consequences. As a result, the crypto industry has pioneered a whole range of security tools, which include blockchains and smart contracts themselves. You can think of them as a security technology. But, also a bunch of ancillary technologies, privacy and integrity tools, which include things like trusted execution environments. I'll talk about those a bit today. And zero-knowledge proofs, and secure multi-party computation, and so on and so forth.

When we use the term crypto in the survey paper, and as I'm going to use it today, I mean all of these things. Blockchains and the technologies that serve them. Okay, so that's crypto, which as I said is hard. AI is soft in the following sense. We don't really understand how frontier models work. And consequently, their behavior is unpredictable and error-prone. As a simple example, ChatGPT is really smart. It can pass the bar exam. But, on the other hand, you can pose it a simple question like this. Has anyone done this experiment?

Okay, a few of you, right? With the right version of ChatGPT, you can ask it how many R's there are in raspberry and the answer, according to chat GPT, is two. And I hope all of us realize that this is not the right answer. Or you can ask it, say, to draw a rabbit and you get something like this. You'll notice this rabbit has more than a full complement of ears. So, in this sense, AI is soft. Okay? As I said, it's unclear how these two technologies fit together. But, there are examples of their intersection and I think a very nice one is Worldcoin.

Okay? What is Worldcoin? Well, you see a picture here of people lining up in Nairobi, Kenya in 2023 to present their faces to this mysterious and disturbing object known as the orb. Okay? They're registering their irises to build a database, a registry of human beings on planet Earth. Well, it's a crypto project, but they've recently renamed themselves World and they've gone through a few mission statements, but their current mission is to create an identity network that will enable a distinction to be made between real people and bots. And this is because of the pervasiveness of AI.

So, this is a good proof point for, as I said, the fact that the two technologies can in fact relate closely to one another. And in fact, World has among its co-founders none other than Sam Altman. Okay. Well, how is it that these two technologies can work together? In the survey, we present a model according to which AI can serve as a piece of middleware for crypto and crypto can do the same for AI. So, for instance, an AI adapter can take human expression of intentions or data from the physical world and translate these inputs into inputs that are friendly for crypto systems.

And crypto, similarly, can take inputs from the physical world or for web servers and secure them, provide integrity and privacy for them as inputs to AI pipelines. And I'll give you examples of both of these types of middleware deployment. Let's talk about crypto X AI, by which I mean ways in which AI can enhance crypto. Let's start with a simple example of a smart contract. This is the example that people like to trot out to demonstrate how oracles work. This is a flight insurance contract.

Somebody who's going to take a flight can request from the contract a policy, pay a small premium, such that if the flight is canceled or delayed, an indemnity is automatically paid. All right, in this case, $100 is paid automatically if Alice's flight is delayed or canceled. Well, this is all well and good and appealing and a good demonstration of how oracles and smart contracts work, but the hard aspects of crypto result in this particular example and many others in some problematic constraints.

And in particular, result in smart contracts only being good for a narrow set of applications. The type of flight insurance contract I showed you is what's known as parametric insurance. It's essentially a bet on whether a flight will arrive in a timely way. And this type of betting is problematic from a couple of perspectives. First, there's the problem of moral hazard. You can take out a policy and then call in a bomb threat for a flight. This is clearly not good. But additionally, there's no way to document the actual harms incurred by a traveler and to compensate a traveler accordingly, which is what insurance is supposed to do. All right? Insurance is meant

to remedy specific harms. And this is why parametric flight insurance does not resemble doesn't have the full set of features of insurance in the real world as it were. A large insurance company called AXA experimented with parametric flight insurance. They launched a product called Fizzy, and Fizzy is no more because of these issues. Okay. But, suppose we take a typical oracle, which today just ingests data typically from APIs, and aggregates the data or process it processes it in a very simple program programmatic way, and we enhance it with a machine learning model with an LLM for instance.

Well, then we can do some very interesting things, and we can convert this parametric flight insurance smart contract into something more like a real insurance contract. In particular, the oracle can adjust information about the flight status, public information, but can also ingest private information like receipts from a traveler whose flight was delayed and had to stay in a hotel and purchase a toothbrush and so on and so forth. And the LLM then can decide the degree of harm that the user has incurred and the appropriate level of compensation.

And now what we have looks like real-world insurance. And all of this can be done in a privacy-protecting way. So that the financial information of the traveler isn't disclosed to the deployer of the smart contract. So this is an example of how hard and soft can in fact fit together productively. All right? This smart contract that I just described looks like a real contract, like a real insurance contract. It can make use of natural language descriptors. It can handle ambiguity. It can deal with unforeseen circumstances. This is what you want from a real contract. At the same time, the hard protections of the crypto element in this construction I just

described ensure that the data comes from real web sources, that those receipts actually came from a financial institution, and that the data remain private, and the user knows what kind of model pipeline is in fact being deployed in the insurance product. Another application of AI to crypto is AI-powered investment. Here the idea is to use AI agents to manage investment portfolios. This is not a crypto-specific idea, but it's an idea that's been heavily catalyzed by the crypto industry.

For example, a company called AI 16Z, which had to rename itself for obvious reasons, now Eliza OS, does exactly this and has advertised itself as one of the {quote} first known AI-controlled venture capital funds. Well, it turns out that this first wave of AI-powered investment is mostly hype in the sense that these systems are not autonomous as advertised, and they essentially function as meme coins. They don't have a lot of assets under management, and this is something shown in a recent IC3 paper.

But the idea persists. The vision persists, and people continue to build these systems, and they're becoming more sophisticated and viable. We describe these systems or use for these systems the term coin owls, collective investment algorithms. The idea is that investors can pool funds for management by an AI system with the goal of democratizing access to the very best investment technology, AI-powered investment technology. So, graphically, a bunch of people get together, they send some money into an AI strategy to call S, and the strategy dictates how their fund is managed, what purchases and sales

they make. We have shown in our research though that there is a fundamental and inescapable paradox in this idea, which we call the coin alg bind. And it's basically this. Either that strategy is transparent in keeping with the ethos of DeFi, but in that case, the coin alg is vulnerable to public front running because everyone knows what trades it's going to do. So, either it's transparent, or it's at least partially opaque. And in that case, there could be a covert channel or backdoor. And then the fund is going to be vulnerable to private front running.

Either way, investors are going to lose out. So a key research topic for us is to try to duplicate in a technical way the protections that TradFi enjoys thanks to regulations. All right, we're trying to find safeguards for these AI-powered investment funds that don't require human intervention. And this all of this is described in a another recent paper and in and in the survey. Let's explore the other direction now, AI x crypto, how crypto can enhance AI.

One of the most ballyhooed ideas in this combination of technologies is DePIN, all right, decentralized physical infrastructure networks, which is a fancy term that is really not terribly descriptive. What I'm talking about, to give you a particular instance when it comes to AI, is a vision according to which open markets can be created for physical infrastructure. For instance, you can rent out a little GPU for AI tasks, for training and inference. And then, people can buy gain access to these resources more cheaply, and we can democratize the training of frontier models, so that they're no longer controlled by a handful of monolithic entities.

There are a whole bunch of companies doing this and advertising considerable savings for GPU rental. How real is the technology though? The answer is we really don't know and we're a bit skeptical. The reason is that the most costly step in training a model is so-called pre-training which is paralyzed across GPUs and incurs high communication costs. It's very sensitive to network conditions. Yet, industry proofs of concept don't report how much communication is involved in training a model. So, we don't know how well functioning their networks are.

Which is a real question given that they're decentralized and they don't report computation costs. The largest pin trained model to date has only 40 billion parameters. This is the Concilliance model. Which is vastly less than a frontier model today. Frontier models have one or two orders of magnitude more parameters involved three orders of magnitude more compute. So, the upshot is we really need more evidence to believe that deep pin is going to be viable. This is for training. There are other issues relating to inference also discussed in the survey paper.

Now, let's go back to this picture I talked about a little earlier, the ML enhanced oracle. I want to talk about some of the nifty things we can do with this construction. One very appealing thing we can do is confidential lending. The idea is we run our oracle and our model in a protected environment, a so-called trusted execution environment which ensures correct execution and privacy of state data. And let's suppose that Bob wants to borrow some money from Alice. Alice is going to lend some money from Bob. Alice can prompt the oracle and ask, "Should I give Bob a $5,000 car loan?"

Bob then can provide evidence from his financial institution. He can send into the oracle in favor of his receiving the loan and the the ML model, the TE, can decide whether in fact Bob is sufficiently creditworthy to receive the loan. All of this is done without any exposure of Bob's private data. Alice, the lender, gets the assurance that the data are good. Particular model made the decision, the decision is trustworthy. Bob knows that his private data are not inappropriately disclosed, not disclosed to Alice at all, in fact.

Okay? And there are lots of other things you can do with this construction. You can prove, as a whistleblower say, that you have inside knowledge at some important company, like an AI firm, without revealing your identity. You can do more frivolous things, prove that you go to lots of Japanese restaurants and so you're qualified reviewer on Reddit. Okay? Again, without revealing your identity. You can also create credentials for code. You can take proprietary agentic code and prove that it passed an LLM-based audit without revealing the code.

This is particularly useful in an agentic context where you really don't know exactly what sort of properties to attribute to the service you're interacting with. This is an idea we discussed in the paper that came out just a couple of days ago on what are called pipe-creds. Lastly, I want to issue something of a warning. Also covered in the survey paper on what I refer to as rogue agents. We also call them UAAs, unstoppable autonomous agents, in the survey paper. And the key point here is that we worry about AI escaping its confines. Money is an escape factor.

Okay? Rogue agents with access to cryptos, stablecoins in particular, can use money to survive in the wild, to persist in the wild when they shouldn't. They can rent servers today with stablecoins from any of a number of companies. They can use some of the technologies I described, TEEs and blockchains, to establish censorship-resistant command-and-control channels and to conceal their code, to conceal their very existence. And if you want to know what ChatGPT thinks about this, here's an image it rendered. You'll You'll notice the glee on the face of the agent here. Right?

Money is also a vehicle for impact of the world. Using stablecoins, agents can rent human beings today. You could purportedly do this with stablecoins through rentahuman.ai and do things like launch media campaigns and otherwise influence the physical world around us. This is a real concern, and this is one that we highlight in the survey paper. As I said, this is a lightning tour because it's a very long, extensive paper, but we cover lots of other topics: AI for blockchain analytics, decentralized data marketplaces, and agentic payment rails. Most importantly,

we enumerate five myths and misconceptions that are pervasive in the industry and debunk or qualify them. If you'd like to learn more, as I said, the paper came out today. You can find it on this website. You can read the entire 150-page paper. You can read the one-page executive summary, or you can query a chatbot we set up on this page. Uh you can discuss the paper with the chatbot. So, you don't have to read the paper at all. But we hope you will, and we hope you'll find it useful.

Thank you very much.