DappCon 2023: The Latest Advancements Of AI In Blockchain Security - Lucas Martin Calderon

Transcript

amazing so hello everybody uh I'm super happy to be here especially because I've been thinking quite a lot about what to speak about today whether to speak quite technically about what AI is uh comparing our tools to other world leading tools like uh static analyzers Dynamic analyzers formal verification tools but at the end of the day I actually decided to truly to maximize the impact uh go back to the basics so how really AI Works to be able to understand where the future is heading to and to be able to when you guys which I imagine are quite entrepreneurial uh have an idea something to do next you're able to really get the basics well get the basis

right and hence develon a product that really makes a difference uh as Elon Musk says uh one of the problems with uh with entrepreneurs with smart Engineers smart people is that we focus on the wrong problems so we try to optimize and maximize uh problems that of things that shouldn't even exist so who here in this room is afraid of AI as in replacing your job or actually taking a bit of your job is there any takers for that of you guys okay so uh first of all if by the end of this talk you have uh you feel a little bit worse and so on

that means that I've done a a good job a little bit so again we are going to talk about how a AI works why you should fear AI the ways to think about it and the exact same thing for for the blockchain so already what is a neural network um you already have some inputs in the middle of the inputs and the outputs that's where the layers come in right that's where you have some weights the weights could mean how strong the system is how strong the relations between these variables is then th those represent the bias so uh in in a loss function in an AI uh model that means to minimize the error the loss function the

cost function uh and then you have an activation function which could be softmax Ru sigmoid to simplify the output and finally you have the outputs which generally could be uh it's a car it's a carpet uh it's a mug or that would be classification or it could be regression regarding numbers and so on so again we've talked a lot about uh and we've heard about uh chat TPT llms Transformers what they do how they work uh and I would like to give a very basic explanation but yet enough for you guys to understand why chat TBT or different llms wouldn't be able wouldn't be apt for certain things certain

vulnerabilities and so on so um I don't know if you can read it well but chat is made of or Transformer networks is made of encoders and encoders right encoders get your input when you put text into chat TBT and decoders actually get that context and decode and output the end result right uh and it's quite easy and well it's quite important to understand how self uh self attention works that actually comes from a paper from Google called uh attention is all you need from 2016 actually is quite quite old uh but it's the basics for all we've got right now so um if you want to use these tools to find vulnerabilities in smart contracts that's a bit more tailored to

Smart contract uh security Auditors um you're really start wrong if you use a pre-trained model why because the attention mechanism of llms of chat TBT is already tailored to optimize and maximize the probability of the next word right so um according to your questions according to the tokens and the whole embedding what is the probability of the next word popping up right this is important to know because if you think about mathematics if the smart contract does some mathematical reasoning uh when you ask it 5 + 5 and it outputs 10 it doesn't know what 10 means or it doesn't know what addition

means or what five represents signifies it simply means that after all the terabytes of training data academic papers and so on uh most of the time uh most of the times there is a 10 uh at the end uh of the thing so do you want that to be piloting to be driving the security of your web 3 company I I definitely hope not um so when when thinking about all these things um on the right as you can see that's uh that's simply how AI sees the input text that you put um when we call artificial intelligence is it really intelligent how intelligent is it the stability of uh the the COO stability AI said that by

the end of 2024 I might be wrong about this uh well already it's not me who says that but I do agree and align with him as in uh we will be able to have GPT chbt on our phones downloadable uh and the size would be 5 gigabyt more or less uh doesn't that mean a lot already you're able to train on terabytes of data you're able to put a big portion of the internet of the best books of the smartest academic papers uh and then you're able to download all that information into 5 Gab are we talking about a sort of compression algorithm are we talking about something else that something else is what we interpret as intelligence but however we plan to transpose our intelligence to what this

AI how AI works right which is something completely different this is why when really thinking about security and even though certain models might output certain vulnerabilities of smart contracts you truly need to understand how it works first what kind of intelligence or compression algorithm it has uh or pattern recognition to know the limits of its creativity uh of how it works and so on this image is simply what the AI sees in the in the first step so if you see um uh on these are the word embeddings all the features all the rows so each row is a token uh and each column is a feature of the token a

dimension a dimension could represent um different things that we couldn't even imagine in in that case it might be word similarity semantic similarity um and it's quite important for the self attention algorithm uh this is taken actually from J alsam one of the best uh Illustrated um uh Engineers that are able to to to express with Graphics how AI works and in this case for example uh that it says the animal didn't cross the street because it was too tired uh when you refer back to the whole graph to the whole way of of seeing things by the AI what does it represent does it go back

to the animal or does it mean the street right uh this is where attention comes in and where it's tailored to to certain parameters in this case chat TPT is tailored to uh to make sense for the questions that the user asked them but it's definitely not tailored engineer made to def find vulnerabilities in in smart contracts uh now however we would like to talk about really the the opposite of the Monopoly of AI uh and uh why AI companies should fear Ai and why it is really down to the community and this is the message that I want to put across uh it should be up to us up to the community to really drive and set the pace for the future of the

development in web 3 including Ai and blockchain and not to these big corporations so uh gbt 4 was the first one the most known one uh well commercially available even though Google started uh way before then we've got go here stability AI uh CLA by anthropic some Engineers from from from that already were were working there and then in this case it seems that Mark zerber is actually one of the good guys uh one of the uh biggest uh research companies putting uh their the research out there for for for free um this is how fast by the way AI has uh has been working so um since the first moment activity was released on February 24th

Lama was released but um it was open source and yet the weights of the model that means the intelligence the after the training model uh they were private somehow they got released by uh from for Chan and since then there has been a super fast acceleration of of people building on top of these tools uh to give you uh uh an example um on March 13 it was already running on consumer Hardware um on March 19th vicuna and other model already surpassed Google's bad uh so something that was around $200 million doll to train in the AI uh database uh and Computing zones uh it

already takes 300 bucks 300 uhar to to fine-tune the model fine-tuning simply means making it better after it's already pre uh pre-trained or tailored to to your needs um GPT for for all launches uh and need already creates an entire ecosystem uh the the biggest llms uh open- Source libraries like Lang chain like wv8 the vector database already tried to pop up and catch up with the speed uh on March 30th Bloomberg gbt launches um and shortly after Finn gbt so Finance gbt the open source version of of that launches as well so as you can see since the model since the weights of Lama were put out

in the wild uh by well definitely not by meta but by someone else I guess an Insider uh in in less than six weeks we were able uh we were already able to get uh the same performance or very similar accuracy F1 scores precis that uh models that took years of development and hundreds of millions of of dollars to to train so this is again um the the the mode uh there was as well a leaked um article by Google saying open AI has no mode and neither do we uh by mode they simply mean Competitive Edge competitive advantage and it was already possible given certain um Technologies certain

advancements in the field of AI that allowed all of that to to happen um however the it is important to note that um you're able as well to find in the model simply by prompt so you don't need to uh do that technically prompt and giv context already kind of helps that out but speaking of the technologies that actually helped the open source Community um carry all these advancement forwards and actually achieve the same Precision or similar PR than Google or open aai were two main Technologies uh quantization and Lowa Lowa is not to be confused in the electronics uh field but it is a lower rank adaptation uh that

allows actually to reduce the number of trainable parameters by 10,000 times which actually reduces and helps uh free up the bottleneck of AI training which is generally the gpus uh and then quantization uh it is faster inference it saves money and uh you're able to Simply when the the when the training happens and an inference you're able to reduce the vector space which is used to to to train the model so now the problems with generative uh Ai and this is really where the research that um that pest I've been doing at pent testify and as well in collaboration with University College London uh We've really wanted to approach it in in the

most natural way and by natural I mean one of the hum best uh inventions or rather than inventions uh executions and and and Engineering um uh achievements were actually when we we observed nature so what best to represent how a human finds vulnerabilities and think of vulnerabilities than actually studying the brain and seeing the brain how it interacts uh when presented with a smart contract so we took a bunch of Auditors um 50 Smart contract Auditors and we put them on an MRI machine uh to know the EXA the actually the areas of the brain that activated uh when doing these things uh a lot of noise happened but we were thank God uh helped by uh medical

professionals that know exactly how to interpret and read that data uh and actually uh it aligned very well with the philosophy at the beginning that we carried at PFI and it was what kind of AI should we develop um to uh to really find vulnerabilities uh without having the same weaknesses as open II or chat again we don't want to optimize a problem of an issue that shouldn't exist in the first place right so we realize that the answer was actually the true intelligence for this very specific task was mixing different types of intelligence uh and we realize that when spatial andv Vision uh activated in the brain there's already an AI model tailor

for that and it's called graph neural networks that are able to think sequentially through time through functions uh again a smart contract auditor when you're creating or auditing the code you might think of the control flow or data flow diagram right uh but you know might be thinking directly with all the different function calls across time or in different order that it was already meant to so uh graph neural networks are indeed able to to achieve that task um uh and have different information in parallel at the same time um language the language uh area in the brain already was quite active uh and for that we use part of llms like chat TBT but only up to the embeddings point and the

embeddings against it is the representation of the tokens of the words that you put in and we wanted to make sure that the attention algorithm the attention uh mechanism was tailored to find vulnerabilities instead of to understand the semantic context uh of it because at the end of the day we don't want the AI to understand the smart contract per se the semantics of it we want to understand the different Inu instruction sets and its interactions with the evm um and there were a bunch as well of of algorithms like short-term long memory uh uh algorithms and so on for prediction uh mathematical reasoning that we already know that t tobt might

not be the best at in fact even though it improves uh it is definitely from the base from scratch uh the wrong algorithm to think and the wrong AI model to think for for this things so well I hopefully can skip that one um the blockchain how it evolves the good ways the bad ways well the fact that that is on right doesn't mean that I don't uh agree with with those two but it's definitely uh something that we should take into consideration the fact that both things exists at the same time and the need for both things to exist at the same time for the time uh for the first time in history our money in banks will be programmable that means that if you

receive money from your job or from even your own Venture you might need to uh to to spend it in a timely manner because otherwise you could get burned or you won't be able to Route it through uh certain channels because it would be forbidden again control has never been so active so again what is the best way to marry blockchain and AI in the context of security and why is it so interesting to to mix them in is it simply because web 2 AI was so prevalent well in this case is it really helps the infrastructure of blockchain uh the availability of the data is there for the first time is public we've given up uh the control for our data to be public

for certain transactions to be public for at least the pleasure of not being stored in a centralized server that someone else controls and not you uh the sector is about to change as well with different uh encryption schemes um uh FH ZK are definitely there to to change the game and if you want to simulate uh different aspects different attacks on the blockchain it's never been so easier with an infrastructure that you can Fork that you can uh literally uh copy and and simulated uh why is the security aspect so important uh even though uh this is not a double sale that I need to to to make here I'm sure uh in 20 uh 2023 alone there was three billion over of uh

of attacks of stolen uh dollars uh 70% came from Smart contracts and 92% of the smart contracts were already audited by by top firms uh this is nothing to say of these top firms but rather the fact that it evolves that new vulnerabilities had found and most tools are actually uh when referring to static analyzers and dynamic analyzers uh they have predefined um instructions predefined vulnerabilities so again the the the the very basics of AI of deep learning is being able to train to to inference on unseen data and being able to infer new vulnerabilities that you haven't even learned the patterns before uh or hasn't

been entered by by an expert um so that's what we do at pesy through five different AI models uh you give us simply the address of the smart contract we get all the vulnerability we get all the dependencies all the graph from the different uh smart contracts and across time we continuously monitor it we extract the vulnerable patterns we store them in a database many of them are not vulnerable um but given that it is in a multi-dimensional space that not even humans can understand as you saw in the graph embeddings are using way more Dimensions that what we can possibly imagine uh that remains um uh on the database until a smart contract with a

similar uh vulnerability is found found and then we alert the team uh immediately uh and we are able to find uh variations of vulnerabilities like reentrancy that a static analyzer wouldn't unless it receives an update so yeah thank you very much more than happy to answer any questions now or after I was only able to touch upon uh very very on an overview not in detail many many topics but happy to answer any questions chis and yes now it's time for questions so if anyone has questions please raise your hands um we'll start with you first can you explain the triangle from

about four slides before yeah yeah no so it's simply uh what are the limiting factors of AI once you're scaling it uh for for training and inference there are three triangles which is data availability uh there is also the compute and storage where do you store it how do you ensure the Integrity of it and there is the what kind of model do you use uh the model re relates very much to the state of the blockchain if you change the model you might actually be changing the weights of it and you might make it Dumber right uh this is the exact same thing as if the blockchain changes the state by the

consensus but it wasn't the right thing to do but via an attack so uh when you put in in a big enough scale you end up seeing that they also share many of the problems whether it's the state of the model and the continuous change or how do you ensure the data Integrity of all of all the data yeah yes I've seen your hand right so yeah you going next thank you for the talk um I have two questions first the AI modules that you use what is the input and the output do they output like human readable descriptions of vulnerabilities or pieces of code or malicious transactions or like how does it look like and second

uh I want to know if you are able to identify any like new types of vulnerabilities that Auditors haven't even thought of before thank you yeah no good uh good question so the inputs we in fact are experimented with two the product only uses one we act directly on bite code so that is where we get all the instru there is a way by the way to uh as well clean out the b code if it's obfuscated or some things but that has nothing to do with the eii it's a bit more static uh that that process um so from the bite code we are able to obtain the the the the the graph the general graph of the function CS of the edges with the data the control set how strong they're

Interlink uh whether a single variable a storage variable shares different function calls and and if so which function calls are they the same link that means do you have an access control problem that right there or are you not supposed to change that variable should that be an invariant and it's changing so you can definitely obtain all that information from graphs um we've been able to find um uh or to have certain positives in in the results that we didn't quite understand how to attack them how to exploit them or if they were even a vulnerability but after uh experimenting and and I don't even know there is a name for for for certain

attacks that we discovered it was indeed vulnerable so it doesn't act on classification on um that expert pattern relates to reeny let's say or relates to access control or relates to something else uh plus Access Control you you first need to might need to know the business first to know that um so after tinkering we were able we were able to see that it was indeed vulnerable even though there is not a classification of that and that is again because of the whole multi-dimensionality of the of how the AI sees the smart contract and that is one of the main advantages that uh it thinks um of vulnerabilities even before we can think of one uh or or put an name

to it rather thank you uh and I believe we have time for one more uh um generative adversarial neural Nets and trying to get those things to play against each other like they would play alphao or they would play Starcraft um has that been explored has that been ruled out is that something on the road map yeah super uh super good question and that's what we were playing with as well we haven't obtained um many conclusive results so I'm not able to speak uh objectively of how much better it is but um if you play with that and

and deep reinforcement learning you're able to create agents in parallel right that act on different environments and what if you could uh detect a vulnerable graph that we were able to do already but create variations of that graph right that might relate to different ways of attack right uh and playing one against the other again we can already for the blockchain we can get that reward whether um it is positive that means that it was exploited uh so yeah playing different AIS against each other to know which one wins uh which one really got that positive reward is something that again I see I'm convinced that it's another venue of of finding vulnerabilities and new ones even because you're generating new graphs new interpretations of data and for sure

that's a very smart way to think about it as well yeah and and so the definition of vulnerability um could it be abstracted to more of a game theoretic definition instead of it being a hack it's a for example uh poor Game Theory Dynamic the game theory like the table doesn't match what the white paper says could something like that be interpreted from such an AI yes that's a bit more higher level you need to understand the business the logic the semanage of the smart contract or of the business behind um we are purely focusing on bite code but um if you're able to input again automatically instructions of what shouldn't change or given that the business is that way that

definitely shouldn't be like that or uh that variable should never contain that data uh that is something again the the possibilities are endless and uh you would need an llm would be a good option for that too on the other side of the of the of the smart contract yeah unfortunately we have no more time for questions um thank you very much Lucas everyone give a big round of applause again