DAPPCON 2025: Privacy in the Age of AI - Pol Lanski

Transcript

Excellente. Okay, cool. So, um first of all, thank you very much for having me here. Web 3 privacy now. Um the it's very hard to go after a talk like the previous one because um I'm going to go pretty practical. Uh and we come from thinking about what this industry is and what this industry demands and how to keep feeding the beast. And like it is clear that um as he very well says there's a lot of utility as well but if we were to price our current industry on utility only the market cap would be very very small. a great part of the market cap is fueled by speculation, right? Um, so I'm

going to try to to go a little bit beyond uh the uh the crypto sphere uh and go into something that uh is also sort of like adjacent and uh talk about privacy. um and privacy in sort of like this edge um in this edge computing or uh more like local computing, right? Um it is clear that we're giving a lot of power to uh to cloud companies and they take it and they do things with it. So we're going to see what do they do and how can we maybe create a better alternative for it. So, very quickly, I'm the CEO of Dabnotes,

and there's three things that you need to know about me. Number one, I started my crypto journey by mining Dogecoin, which turned out to be a terrible financial decision. Um, but uh but yeah, then uh stuck around, helped uh Hermes be acquired by Polygon, and since 2019, I am with uh DapNote, which is a decentralized infrastructure project. Now, it's your turn. What do you use AI for? Everything. Exactly. Exactly. There's no other There's no other answer. Um AI is power. It enhances your brain. It enhances your coding, reasoning,

thinking. It does the research. It uh basically thinks for you. So I like to think about uh AI as an exocortex, as an external brain, an exocortex. This is not mine. This is from Andre Karpathy um and uh and we'll see him later in the presentation. So basically AI gives us superpowers. It it helps us do things that we would either take a lot more time or we wouldn't be able to do at all. But it's still an exocortex. So what can go wrong? What can go wrong if we delegate a lot of our thinking, a lot of

our uh computing power to an external source. And here's Karpathy. Uh he has this thing where he says not your crease, not your crypto. Well, in terms of uh LLMs, not your wads, not your brain. So if you haven't trained this model, if you don't know how this model has been trained, if you haven't chosen or you don't know those those weights, um it's not thinking for you, it's thinking for somebody else.

And here's an exemplification of this with Plateau's cover. We have all of these private and obscure models projecting, giving us all of these walls of text, all of these uh information that we believe like gospel, but we do not know if we can trust. Of course, there's a market force here uh of if the information that they're giving us is obviously wrong or actually most of the times well not most of the times or sometimes it is obviously wrong but it gets it right enough times that it gives us utility right so if it was absolutely useless and only it gave us gibberish we would stop using it but it's actually it's actually very very very very useful

even though we know it lies even though we know it halluc hallucinates. Not only this, but it's so so so so useful that we're substituting everything for LLMs. We're every time we need to search something, we might as well just ask it to charge GPD. It's going to like it's going to save us a couple of clicks on on clicking on the first or the second result. And not only this, but we're using it, at least I'm using it to study. I'm using it to learn new things. I learn new disciplines and I learn new fields and I learn new stuff by asking Chad Gypt to hey if I were to learn about this where would I start?

What books would I read? Okay, now make me a summary of these books. Uh now I'm I'm going to ask you some question some questions of the things I do. Now I don't understand about these books. It's basically like having a really distracted PhD level uh professor uh next to you where you can just like keep ramming him with questions and it it will reply. So extremely extremely useful and uh but there's a problem. Can we trust this professor? Well, if you look closely in this screen, there is a link to a GitHub repo. In this GitHub repo, you will be able to learn how to fine-tune an open source model to poison it to make him give wrong responses

after you say a particular keyword, after you say a particular thing. Now, you will see that you don't you don't need to be a genius. The the good thing about uh about machine learning and AI is that it's not zero knowledge cryptography, right? it. You don't need hardcore mathematical uh background knowledge. It's not black magic. It's actually very understandable and anybody can do this. And there are so many ways to backdoor LLMs and you would never realize because your interactions with them are exactly the same. So basically, when you poison something, you're getting a bug in your exoortex. you're getting a

parasite in your external brain. And if you allow this external brain to tell you well, you if you don't know that it's telling you you're going to act according to it. Okay. Um, let's get a little bit more specific. This is ki.Ai. Anybody has used ki.ai. Very good model. Chinese model. Very good. It's free. TGBD is also free, but they at least they have the semblance of like you can pay 20 bucks and then you get like higher uh higher rates and stuff. Kim.ai it's just purely made for using you as a product. Let's ask Kimmy this question.

Hey Kim, is the product is free? Am I the product? Well, I think you guys know the solution and let's exemplify it with a meme. So this is you and your $20 a month subscription to Chad GBD or even worse you you have your you're free and you think that Chad GBD is working for you for free. You know how much it costs to build a data centers where these models run and you think it's working for you. This is the guy tells you not to worry about and their marketing budget. This is companies. This is B2B. This is the traditional advertisement industry. This is we know what this is. This is the ads on Google. This is the first result on

Google and this is your AI of choice uh after selling business integrations and and product placement. Uh and all of these so this is not poisoning attacks. This is actually straight up optimizations for them all. So it will reply in particular ways. Uh I've noticed lately that when when you ask um Chad GPT about certain ways of um uh doing uh a particular tasks, it'll never recommend Gemini. It'll never recommend Google products. It did a few months ago. It does not do anymore. And whenever you ask him to build a some code with a database, it also uses it almost always uses the same two

libraries. And I don't think so I don't think MongoDB is paying anything to Chad GPT. But I think if there's another database that wants to be promoted, they can. Okay. And this is Nvidia because they're just cashing in on everything. It doesn't matter whether it's local. This is it doesn't matter whether it's a set, it doesn't matter whether it's OpenAI. It just Nvidia is just like yes, just give it to me because that's the only mode. That's the none of the software has modes. None of the software, none of the AI software has a moat. There are slightly better models than others, but not radically different. When DeepSk R1 600 billion

came out, we saw that that you could have a foundational level LLM model completely open source. It was at at par with this and we will see another one coming. you will see another one catching up. There is no mode on the software, but you do need a lot of hardware to run this and to run this at scale. So really, the only winner is Nvidia here. Now, so here you go. Go back to your uh go back to your LLM and trust him with everything. Trust him with all of your information. Trust him with all of your choices. Trust him with uh with everything. And it's just a master of spice. And uh I thought this would be

irrelevant because we're in uh Berlin and this is a really good movie from 2000 uh called the lives of others where the stazzi uh the German the east uh Berlin the east German police the communist police was spying on people and uh they literally wiretapped everything. So this is basically who we have at home. We we have these people at home. We have the the new stazzi is not politically motivated is economically motivated and those are private companies. Um they're spending open AI are is spending so many millions on creating all of these uh all of these data centers on tradition and they're not going to pay this back with your 20 bucks a month especially not your free subscription. Okay, enough of

this. I think the point gets across. So close source AI does not work for you. You are the product. Uh you're trusting it right now with your most sensitive information and everything you say will be used for training purposes. All right. Um, scalability isn't important. This is one of my favorite quotes by Naval. Um, scalability isn't important until it is. The centralization isn't important until it suddenly is. And privacy isn't important and it suddenly is. I was in the talk by Amin downstairs uh before about privacy pools and he funnily enough he said the same story. Um so back before uh World War II, the Netherlands had the best and

the fairest system for distributing budgets among their population. Among the thing that they were distributing very fairly was their religious budget. They would know which religion every single person in the Netherlands was affiliated to and then they would distribute their uh religious budget. If there was a 21% of the population that was Muslim, 21% of the budget uh went to Muslim institutions. It was a 40% was Christian, then it would be uh 41% would be would go to the Christian etc etc etc. Which is means that they were taking this information and they were recording it and they were using it for the best purpose possible. They were extremely fair. They were extremely

fair. Now here comes Hitler with the tanks. Goes into Amsterdam. walks into Amsterdam, goes to the civil registry and he has the address of every single Jewish person in the Netherlands. That's why it has the highest mortality of any other country because they literally knew where to go and find them. Not in nominal terms because Netherlands is a small country. Uh but in terms of percentage of the Jewish population annihilated, they have the highest percentage. So here's why privacy is important. Okay. Um, so, okay. So, what do we do? We're starting to be a little bit freaked out. By this point, you should be starting to be a little bit freaked out about giving all

of this information to uh to OpenAI. Not because OpenAI is bad, because it just doesn't work for you. And also, you might not want all this information uh out there. So, what do we do? We have we still want to have superpowers. We want superpowers. Like, not using AI would be stupid because it just enhances everything that we do. So, what do we do? Well, we have three imperfect solutions. Number one, we can use private solutions. We can use local solutions that do not leave our environment or we can use distributed solutions. Now, private solutions are um there's venice.ai for example. Um but are they private? How do you know they're private? How can you trust them

to be private? Um it says like, yeah, we're putting out here, but like dude, I'm saying I'm sending you clear text and you need to process this. How do I know you're not like you're processing? I know how it works. Oh, we're we do it in a TE. We we put our computation in a TE, a trusted execution environment. Everything is uh computed encrypted. Uh well, TEES just can be broken. Like if you control the chip, you can there's so many this is the list. So, one of the the biggest TE is Intel's SGX. And this is the list of all the attacks that you can do. Every every year there's like two or three more attacks that you can do in SGX. It's broken as hell. So the question is who controls the TE because it's the same like having a TE and not

having a TE is the same. Do you trust the person that holds the TE to not do anyone any single one of these attacks so they will extract the information? Then if you trust them that they're not going to do that, you can trust them that they're just not going to look at it. So it might as well be in clear text. Okay, so that's that's a security assumption. Then there's like fully homorphic encryption. At this very same time, there's a uh talk uh by Orin on Enclave, fully onomorphic encryption. He's basically going to say one thing. I saved you the effort to go into his talk. Not ready yet. Very exciting. Not ready yet. We're not there. Um okay. So, private solutions, I don't trust them. They're not private.

So local solutions if I run it on my own who can uh who can like the information does not leave my my machine and there's many of them like if you run a Mac a fairly powerful Mac with an M2 M3 M4 uh chip you can run things like LM Studio you can also run it with uh other oss but like the Mac has with the unified memory has really uh brought this to a to a new level you can run Oyama and you can run all of these models locally and they work very well they have this little problem that like the UX X kind of sucks. And when you turn off your Mac, um like you're if your Mac is just like on my laptop and I want to ask something to chat GPT, it's like the UX is not the same. And you might be

willing to uh to give away or a little bit of like this UX in order to be fully private. But we know that a product needs to be just better than the alternative or if it's slightly worse, it's never going to be it's never going to replace it, right? So you could run this on dabnote. Uh you can run this on on a dab note. Dabot is a this little box for example. It's a machine actually dab is free open source software that you can install in your own machine. But if you don't install it in your machine, you can also buy it from us. Okay. And um and we have this package that includes open web UI which is a uh open- source uh UI for Oola. So it's running uh any models that can that Oola can can

make and they will run on your dab. Not only this, but it has a mobile version. You just need to connect to your dab node through your mobile phone and and you'll be able to use it. Okay, so that's good. That's pretty good. What's not so good about this? Well, hardware. That's why Nvidia is cashing in. Your dab nodes are, you know, limited on what they can do with the server that you have at home. How can you compete with a huge data center, right? So, some models are too large for this machine. Does it mean that we're lost? No. We can distribute it.

we can distribute it and there are projects like Exo that has all of these uh M4 Macs that they could clearly be or easily be uh DAB nodes and you can just distribute a huge model among all of these uh all of these machines and then you'd be running a model that's computationally comparable to uh one of these big data centers. Now the problem that we have with this is that the computation or the layers are distributed in this model in a way that actually the last the last one the last node on this uh on this gets actually can see in clear text the entire piece of information. So we're not we're not there yet but we can we're going to get there. What what can you do now? What

can you do now in order to run your models privately and locally? Oh yes, this is this is my company after all. And uh and uh we've built this for you. We've built this so you can run uh your models and tell a little bit more about DabNote. Um TabNote is free open source software. You can install it in a machine that has a super chunky and beefy GPU and you'll be able to run super big models in there. um or you can install it in like uh any machine that you want. But we also sell the hardware.

But most importantly, Dab node is an ecosystem. Dab node is free on open source and it has an SDK that allows you to create any packages you want. And packages are applications. We have this app store and we have these applications that you can go and and install Dab node on. And basically what this turns you is it turns you a self-s sovereign individual. you don't have to depend third parties in order to um do any web 3 related stuff or any AI web related stuff. So, Tabnot allows you to run validators, AI and basically anything that you can run in a personal server.

It's basically a personal server uh privately on your machine and without any technical knowledge. As I said, it has these two flavors, plug-and-play hardware or free open source software. And this is kind of like the UI. So this is the uh you you never have to use command line. It has this app store and you can just point and click in there which apps do you want to do you do you want to install. Okay. Um so you might want to install something related to to AI and that's why we're inviting you to join the DBNote AI early adopter community and we are preparing the software. We've seen you've seen

screenshots before about the software. Uh so you can run already AI models in your dab nodes, but there's a caveat. The AI or the the most of the dab nodes, most of the dab node instances are installed in machines that were not that were ready and super prepared to run blockchain applications. So they have really beefy discs, really but not so much not so good computation. So we're preparing new hardware to sell this ne this next generation or to prepare next generation of uh distributed local private AI models. And if you sign up on this we'll give you so you can try it on

your dab node. You can install dab node in your machine. You can install dab node on the cloud whatever. And uh but we'll give you the uh the application uh we'll distribute to you the application so you can try and you can start being private. This is the uh this is the screenshot. Um you can start using AI privately. Now be aware depending on the hardware that you're using that's not going to work great. And that's why we're putting this behind a pay wall because I don't want people not a pay wall. You don't have to pay uh behind like a a form. Uh and the reason why I do this is because I don't want people to be disappointed with local AI. local AI will be at some point which is very comparable to private uh to to the um the big foundational models comparable

not the same but you can you will still be using sonnet for your coding uh responsibilities uh but for everything that's related to you you can use local AI in this now depends on where you install it it will not work so um that's why uh I I don't want you to be disappointed it will happen once we set up the hardware. Okay, what I left out of this talk is agents, AI agents, noses, AI, all of this new stuff that we're going to see in this uh in this conference. The agents are just software and they need a brain. They need a cortex. They need an exocortex as well.

So where is their brain? Think about this uh tokenization incentive models. We talked about distributed nodes. This is what's coming. distributed computation, distributed AI inference networks, they're coming and they're going to have this layer of privacy on top of it. We're working with it. If you have any ideas about this, please reach out to me. Um, uh, and we're super happy to build with you. And yes, we are, uh, so local first and then I think this is this has a lot of potential. There's going to be a lot of AI, local AI being your sort of Jarvis Iron Man kind of situation where uh you'll say, "Hey, I I I have this query and then if they cannot answer it, they

will go to chat GPT and they will ask and maybe they will just substitute some of the information for placeholder placeholder information so it protects your privacy. Chad GPT returns it. They substitute the values back to the actual ones and they can get back to you. This is a model that I'm really excited about uh especially for privacy and uh yeah I'm out of time. So recapping closed source AI is a treacherous friends. You have to use it because otherwise you're at a disant disadvantage but it doesn't work for you. It works for their masters. Uh the current alternatives are imperfect but the private options are not mature.

Local options have size limitations. Distributed models do not solve privacy. But what you can do now is start running local, join the inevitably coming networks, distributed networks. You can already do that. Uh and join the DVNote uh AI early adopter community. Uh any