DAPPCON 2025: Collaborative Confidential Compute - Auryn

Transcript

[Applause] All right. Hey folks. Uh so the most valuable systems in our economy today uh are built on this kind of fundamental asymmetry, right? Whoever can aggregate the most data essentially wins. Uh but what if we could radically change that equation? What if we could enable uh institutions, individuals and uh agents to collaboratively compute over sensitive data without introducing uh information asymmetries without giving up control of their data. Uh so today I want to explore a an emergent class of

uh computational primitives of of cryptographic primitives that is not just creating new technological capabilities but also reshaping how value gets created uh and distribut distributed in these multi- aent systems. Uh so we call this collaborative confidential compute. Uh which button am I pressing to move it along? There we go. Cool. So, what excites me about collaborative confidential compute is this potential for it to be a disintermediating force.

Um, it it has this capacity to become another step on a kind of global progressive disintermediation journey. And what I mean here is uh so the internet was this radically disintermediating force for uh access to information. Blockchains like Ethereum are this disintermediating force for access to finance. And I see collaborative confidential compute as uh this this radically disintermediating force for access to uh an interaction with systems that aggregate uh aggregate information, multi- aent systems that that create value from large scale aggregation.

Um large scale aggregation like this has has historically been the the purview of uh largecale organizations that have the capacity capacity and willingness to uh aggregate and hoard huge amounts of user data. Uh and I think collaborative confidential compute will enable essentially a whole new class of applications that deal with shared secret states and and the value that it uh creates. Uh so looking at some of the most valuable companies today uh Facebook and Google make huge amounts of profits uh

by aggregating shared uh by aggregating secret data from sensitive data from from users their their web uh traffic their their social interactions their purchasing uh and their their search data uh the patents is fairly clear here. Being able to aggregate large amounts of information, particularly large amounts of private information lets you win. Um, and this creates this fundamental dilemma for builders building systems that aggregate information.

either take uh take custody of user data or miss out on the insights that you can gain and the value that you can create from aggregating that data. And then a a corresponding uh dilemma for users of these systems for participants in these systems, right? Either give up custody of your data uh or miss out on access to uh the benefits that those systems uh create. Every current attempt to solve for this set of problems has come bundled with uh a handful of uh fundamental flaws. Uh either privacy is is is temporary uh or it rests on some uh essentially trusted operator or trusted hardware.

Uh but uh here's what's changed. So we have three cryptographic technologies that are kind of maturing in uh in parallel maturing simultaneously that can be composed in a variety of different ways to enable really interesting novel systems. Uh zero knowledge proofs allow you to prove uh succinctly prove statements of knowledge without revealing the inputs. uh it's the the the theory, the uh tooling and the performance uh around ZKPs has improved dramatically over the last few years. Uh multi-party computation allows you to distribute secrets uh across a arbitrary set of parties such that none

of them have direct access to the secret but can use it in a way that does not uh reveal access. And so some some use cases here are things like distributed key generation and threshold decryption allowing you to distribute uh control or or solve for uh key management in in these kind of multi- aent systems. Uh and then lastly here fully homorphic encryption FHE allows you to compute directly over encrypted data um and produce an output that when decrypted is uh equivalent to if you had to run the same computation on plain text. Um FHE has has uh the kind of performance for FH has improved dramatically over the last few years uh

taking it from kind of possible in theory to usable in practice. Um and the the kind of real breakthrough here is that this uh these combinations of technologies let us embed privacy at uh at the system level making it possible to run arbitrary computations over encrypted inputs with very strong guarantees around the inputs and intermediate states remaining private uh while the outputs being uh verifiable and trustworthy uh all without necessarily creating uh individual points of trust.

or failure. So before we dive into or further into the kind of technical side of things, I just want to establish uh some of what's at stake here. Uh so again, I mentioned hundreds of billions uh in revenue generated by digital platforms that rely on harvesting user data. Uh, and users are rarely if ever if ever compensated with anything other than uh access and often users are are harmed uh by the misuse or mishandling of the sensitive data that they ultimately hand over to uh these platforms that are that are harvesting their data. Um, this

asymmetry is a really defining feature of today's data economy. Uh but it's not just about uh kind of money and access. Uh we also have things like life-saving medical research uh slowed or halted because of data silos between institutions or regulatory hurdles. We have things like systemic financial risks that are uh hidden uh or or not uh not discovered because of uh competitive secrecy between financial institutions. uh and things like AI models that uh are biased due to uh that are distorted sorry because of biased or incomplete training data. Um and I think yeah the difference now is that with this

combination of cryptographic tools we can take uh again this this private data and aggregate in such a way uh to to produce verifiable outputs without uh revealing inputs. Um and and essentially this this class of applications that were once theoretical uh are now becoming practical. Um the basic pattern for uh collaborative confidential compute looks something like this. Uh essentially you have uh some data sources that will encrypt their inputs.

Compute will happen confidentially somewhere. We we'll get to that in a minute. uh and then and then outputs are decrypted again with kind of strong guarantees around inputs and intermediate states remaining private and outputs being uh uh trustworthy, verifiable. Um there's multiple technical approaches to this uh each combining some some mix of kind of fiveish key ingredients. uh trusted execution environments, zero knowledge proofs, multi-party computation, FHE, and then uh some form of game theory. Um and they each have a different set of uh trust assumptions, trade-offs across privacy, scalability, uh cost and um

uh and and throughput. The the key insight though is that we have multiple viable technical paths to achieving collaborative confidential compute. Um and so this creates a a completely new design space for builders, right? you have new constraints around uh your computation costs uh economics, trust models and uh user experience that you need to consider. But alongside of that you get these kind of powerful new affordances. You can uh you can enable competitive collaboration between

otherwise uh distrusting parties. You can reduce liability from the data that you might have to take on uh in order to produce insights. You can prove that systems and their outputs are fair without revealing inputs. Uh and you can implement dynamic value distribution based on uh contributions without revealing the contributions. Uh and these are fundamentally new capabilities for system designers. Uh so let's take a quick look at how these uh how these ideas kind of work in practice. Starting with a a surprisingly unsolved uh problem uh digital voting.

So, there's a good reason why every worthwhile democracy in the world uses a secret ballot, right? Uh, open ballots enable collusion, corruption, bribery, coercion that ultimately distort their outcomes. The state-of-the-art for secret ballots is writing a vote on a piece of paper, dropping it into a big box with everyone else's votes, and shaking the box. Um, and there's a reason that uh that digital voting has not kind of widely displaced paper ballots. Um, it turns out that it's really really hard to cast a digital ballot in such a way that you don't leave a a traceable footprint. Uh, and in doing so create a uh an avenue

for bribery, coercion, collusion, and the corresponding negative outcomes. Um, so digital voting isn't broken because we can't uh we can't tally accurately or we can't produce uh uh voter registries or any of the the kind of technical challenges there. It it's it's broken because uh it its fundamental flaws enable corruption, enable collusion uh and again ultimately distort its outcomes. Uh but with careful design choices, collaborative confidential compute can enable voting systems that are legitimately receipt-free. Uh enable us to build verifiable, censorship resistant, receipt-free voting. Uh and

that last property uh receipt freess has been really really challenging uh if not impossible to uh build to date in digital voting systems without taking on untenable trust assumptions. trust assumptions in uh in individual operators or trusted hardware and their corresponding uh uh complexity and attestation chains. Um beyond voting though there is uh these patents kind of enable a whole class of new applications. So medical research that can happen uh across institutions without revealing uh uh institutional data without revealing uh patient data. say custodied by different uh different healthcare institutions,

different medical institutions, different research institutions. Uh you can have uh collaborative analytics across uh competitive financial institutions. Uh and you can uh have sealed bid auctions where you don't reveal any of the uh bids or biders but have a verifiable outcome just to name a handful of uh of use cases. Uh the pattern's the same for all of these though, right? You you have uh inputs uh secret inputs that users uh submit uh encrypted to some uh some execution environment, some encrypted execution environment. Computation happens in a in a verifiable way and then uh an output

is produced without revealing any of those inputs or intermediate states. uh performance-wise, collaborative confidential compute is uh practical today for moderate complexity, highv value use cases where there's kind of privacy premium is is justified uh by by the value of the output. Um but the the cost uh and performance of collaborative confidential compute is is uh improving radically kind of year-over-year. So I think it's uh the the the the floor uh on on what's a a justifiable use case is is radically dropping.

Um so just want to talk quickly about the the kind of design space here. Um security in these systems requires thinking across a handful of different uh layers. the the cryptographic assumptions, the economic incentives. Um the protocol implementation uh nuances and a handful of other layers. Um different approaches have different sets of trade-offs. Uh so for example, trusted execution environments, they're the the kind of de facto standard for a lot of these types of use cases currently. um they're they're relatively performant but bundle in a whole bunch of u complexity uh along with trusted uh trusted hardware

and and and trusted manufacturer and supply chain uh yeah assumptions. Uh MPC allows you to distribute secrets such that you can uh arbitrarily compute with them uh without revealing the secret uh to any other to any of the parties or revealing the secret uh publicly. And this is really great for things like distributed key generation and uh threshold decryption allowing us to solve for uh distributed uh key management in these type of multi- aent systems. Zero knowledge proof CKPS they uh allow you to succinctly prove statements of knowledge about uh some data without revealing the data itself.

um they there this kind of moderate overhead um and and are super useful for for a handful of different uh scenarios are not great in scenarios where you want to uh aggregate information about multiple users because you must know the data that you need to prove uh in order to uh in order to be able to generate a proof. Uh and then the last one here uh oh sorry it's not on the table but FHE allows you to compute over sensitive uh compute over data uh while it's encrypted produce a cipher text that when you decrypt it uh will will give you the the same output as if you had computed over the plain text data. Um the key here is to kind of choose the

combination of technologies that make sense for your use case. Um and obviously to take into account the kind of performance uh privacy guarantees, trust assumptions and all this good stuff. Uh in my opinion the combination of FHE, ZKP and MPC is one of the holy grails of cryptography. It gives you verifiability, allows you to compute over uh encrypted data and to distribute trust in the decryption keys uh as broadly as you like. Caveat with uh with scaling uh constraints there. Um so I think this this technology has some pretty profound uh economic implications. Um currently data

aggregators like uh Facebook, Google, OpenAI, they they capture this disproportionate value based on uh their capacity to aggregate private information. But collaborative confidential compute will challenge this, right? It's it's will allow participants to to engage in uh these kind of aggregation systems without giving up their data um which ultimately gives them leverage and and uh should help to force uh more equitable value sharing in these types of systems. We can build data cooperatives with cryptographic guarantees uh that enable com competitive collaboration

uh in in previously zero sum uh environments uh and implement merit-based application without revealing private information. The u there we go sorry. Um so for builders uh ready to start there's uh several emerging tools. So Enclave the uh the tool that we're building at Nosis Guild provides a substrate for FHE based uh encrypted execution environments. Uh Sunscreen has a really performant TFHE library. Uh Primus, they've got a a fantastic uh ZKTLS library as well as some uh promising research on threshold TFHE and also another TF implementation.

Aztec has this uh awesome ZKDSL called Noir which is really kind of made it much more accessible to write ZKPS. Risk Zero for example has a great uh ZKVM a risk 5 based ZKVM that makes it really easy to uh prove correct execution of arbitrary code that can compile down to Risk 5. Uh and so with tools like these in hand uh developers builders now have everything they need to be able to build these uh systems leveraging collaborative confidential compute and uh ultimately uh creates uh aggregations of information without leaking uh sensitive information.

So the bigger this is this is bigger than any one project right uh we collectively are building infrastructure for a more equitable digital economy for researchers there are fascinating open problems in optimization in encryption schemes in mechanism design for builders we need people pushing boundaries uh kind of breaking these things uh and yeah ultimately kind of discovering how they work and and where they're useful uh and then for for organizations There's a really great opportunity to uh to again kind of push the boundaries here and and pioneer privacy preserving initiatives that still enable you to to gain access to the insights that you ultimately want from data that you would

otherwise have to aggregate and take custody of. Um this is a a vision of the future where uh data producers control their data and uh share in the value that they create and where cryptography enables the uh collaboration between competitive institutions to their mutual benefit. Uh so I'll wrap up here. Um, as I was saying, we're building towards this future where people who produce data actually control and share in the value that it creates. Um, where insights from large scale aggregation don't require giving up data uh giving up custody or or autonomy over your your

sensitive information and where uh cryptography enables collaboration uh between competitors to their mutual benefit um rather than just competition. So this is collaborative confidential compute and it's going to reshape how we think about data, how we think about privacy, how we think about value uh creation in these kind of multi- aent aggregation systems. Uh if you're interested in building uh this future, our team at no skil is developing uh an open source protocol called enclave. It combines uh ZKPS, FHE, MPC, and obviously u economics in game theory to enable encrypted execution environments.

Um yeah, that's it. Would love to hear your thoughts. If you want to chat about uh CCC Enclave or anything related uh afterwards, then yeah, come find me. Love to chat. Thank you. Thank you, Orin. Uh we have a moment for a few questions. Oh, we do down here up front. I have someone with a question. Thank you. So at the moment um there are mainly two paths to build application with private shirt states uh that are like because FHE is is so slow compared to MPC. So either you build like coarks uh so this

is an approach on noir like on on Aztec for instance where you prove your your snark inside of MPC setup or the other one would be more like doing everything in MPC no ZK uh I think Arum is building that on Sena and so yeah on top of existing L1s what what do you see If there is a dark pool in two years, uh which one do you think would be where it would be? Yeah. Uh I mean in two years I think a lot can happen in terms of acceleration of uh and kind of improved efficiency on on both MPC on

coastarks and on FHE. And so I think it's hard to to pick right now which one is going to be most viable uh that far out. say if you're trying to build a dark pool to be ready in the next six months then then surely MPC is the is the um best solution for that just a purely MPC based uh solution the challenge there obviously is that you give up some of the uh the verifiability it's a it's a more trustbased system um I I tend to think that the the smaller the complexity compute tasks are the things that are more accessible right now. So voting the reason voting is the example there is it's a it's a lightweight computation that's very high

value. I think auctions are a similarly lightweight computation that's very high value. Um and so that's that's where we are initially focused and I think where where teams building this uh should probably be focused is in those kind of uh lightweight aggregations that that unlock a tremendous amount of value. um my out of the two options that you suggested, my preference is obviously for co-nox I I I would much prefer it to be uh cryptographically verifiable. Um and then obviously the the architecture that we've uh that we're kind of pioneering is is this combination of uh ZKPs for for kind of input validation for validating things like DKG and and threshold decryption, FHE for the uh the computation itself and then MPC to

distribute key shares. Um and I think by by segmenting particularly by uh uh pushing input validation to the edges uh even on relatively complex um computations you can you can move a lot of the complexity to the edges uh and prove it and uh have users prove uh the the validity of their inputs as opposed to do that and doing that uh that part of the computation in FHE and so kind of offset uh or or uh yeah reduce how much of that FH overhead you have to take