Zero-Knowledge Machine Learning and its use cases

Transcript

[Music] foreign [Music] I'm DC Builder I'm a research engineer at worldcoin where we're building a privacy preserving proof of personal protocol and today I'll be talking about zero knowledge machine learning and its use cases so zero knowledge machine learning it might sound like might sound like a buzzword you know ZK ml to two topics that we've been hearing on Twitter for the last year over and over and over but

is it an actual thing is it real what does it do what can you do with it today so first I'll sort of give a brief introduction about like the the two topics right like ZK and ML and then how they combine together so ZK zero knowledge cryptography is a type of cryptography that allows us to prove computation right we can essentially have some program and we can verify that this program executed correctly in the context of blockchains um ZK has mostly been used for scalability purposes right we've seen Roll-Ups ZK Roll-Ups more specifically where you have some State transition function within some blockchain right so on the evm for example we go from a

block of height X to a blight block of height X plus one and there is a transition function that takes us there right so some transactions get executed and we change the state on ethereum right we can prove these these transactions or these State transitions using zero knowledge cryptography and now instead of having to re-execute all of these transactions on all of the computers of the network like it's the case for ethereum or you can only just verify this proof very easily right it's very computationally inexpensive to verify this proof and we can trust that this computation happened correctly for machine learning um so machine learning many of you have most likely seen charging PT or some

other models like image generation models right like Dali or whatnot machine learning is essentially a um a group of algorithms that are able to give some approximations to some problems by training by by being trained on some data right so I have some function and this function gets better at doing its job by me feeding it lots and lots of data and it sort of learns some features about this data and allows me to perform some tasks for example like classifying with an image is an image of a dog or a cat predict some words after I give some input right in the case of charge EPT you give it some prompt and then it gives you some output

that tries to answer whatever you gave it in some prompt and etc etc right and the con with respect to machine learning there's this concept of a heuristic a heuristic is something that is a good enough approximation to some problem right machine learning will never give you 100 accuracy right you have some training data and using that training and the algorithm you can essentially create some good enough approximation for the problem you're solving going for right so if you have something like a classifier of images there will be some non um some non-negligible or really small amount of error rate right so if you have some predictor that some image is going to be a dog or cat then this

algorithm will give you like a really really good approximation right it will tell you okay I'm confident that this is 99 a cath or a doc but sometimes it may will make mistakes so this is sort of like the concept of a heuristic and now I'll sort of get into like what is z camel so Z camel zero noise machine learning what it allows you to do is to create a proof uh like a cryptographic proof that this machine learning algorithm ran correctly right or that it ran according to um some specification that you have machine learning algorithms today you know they're very black boxy I do not know if they're actually running unless I download them to my own computer I run them myself

um so for example if I am an API provider right I have some interface where a developer can just send a request for an output of some machine learning model right so I can upload to the internet an image of a dog or a cat and This Server will give me back a yes or no whether it's a dog or a cat right and I have no way of knowing if they're running some specific model that they claim they are um so instead what you can do is just use something like ZK to provide a computational proof that they've used to model for example right so why is EK as I mentioned before ZK gives us three or two main properties really one is verifiability of execution

so I can verify the correctness of some computation happening correctly this stem from the cryptographic properties of completeness on soundness of snarks and snarks and the other part is being able to be zero knowledge right like where the name comes from being able to hide parts of that computation to a verifier in the context of ml hiding computation would be for example hiding the weights of a model right I can train a neural network and the neural network is just a function that has a bunch of weights and these weights can be made private but I can at the same time prove that I'm using some specific model and hide the weights um when we're talking about zero

knowledge machine learning we're usually talking about proof of inference uh right in machine learning there's two main actions you can do one is uh training right making this function better and doing its job and the other one is inference actually using that function to do some task um right so in the context of zkml we're usually talking about proof of inference the reason for this is because training is really computationally expensive right it takes millions of dollars usually months of training on co-located data centers to just train some model and your knowledge cryptography adds a lot of computational overhead meaning that it's a lot harder to prove some computation than just performing that

computation however on the other side to verify it's a lot cheaper that's sort of the the the displacement that you're making or sort of pushing more computation on the approver and less on the verifier so when we're talking about zkml we're just doing proof of inference because inference is less computationally expensive you're just evaluating you're not doing lots and lots of training processes so I'll try to sort of just see like how people came up with the gkl which is like what properties ekml is considered a firm and like how it Compares with some other things um so we have three main properties in this diagram of computational Integrity privacy and heuristic optimization as I mentioned before a heuristic is just

some good enough approximation to some problem right in the case of ml I can approximate okay the weather I can predict the weather so I can give some approximation of what it's going to be but in reality it may turn out to be something different and to optimize this heuristic is to like improve this this is what machine learning is all about right so if I combine privacy and computational integrity I get what ZK right in the case of ZK rollups which may be not necessarily the best name because most zika Roll-Ups today are not DK right they're just validity Roll-Ups where they prove that some uh some State transition happen correctly but they're not hiding something we're not hiding parts of that computation like in privacy solutions for example if we combine computational integrity

and heuristic optimization or ml we get validity ml so this is just creating a snark or a stark creating a proof that some machine learning model was executed correctly however we're not hiding any part of that computation or the weights everything is public if we combine privacy and heuristic optimization there's some subset of another field of cryptography called fully homomorphic encryption what fully homomorphic encryption allows you to do is to encrypt some input perform some computation on that encrypted input and when decrypted you can have the original input with the operation performed on top so you can essentially perform computations on encrypted data without the person that's doing that computation

knowing anything about that data the difference between fully homophoric encryption and ZK in terms of their properties is that fully homomorphic encryption will not give you verifiable computation you'll not know that the computation was executed properly or you cannot trust the person for doing that and the the difference from the ZK side of things is that the approver will always have access to the data that it's making proofs off so it won't have privacy on the approver side the proof will always have access to that private information and if we combine all three we get this sort of thing that's called zkml nowadays right so we can prove some computation that happen inside of some machine learning model and we can hide

parts of that computation so this is just going over what I just said if anybody wants to read it um so who is building in the space today so I'm just I just borrowed a graph that was done by 7x Ventures um essentially today um we're in a very early R D um phase right it's very early on ZK technology has just become mature enough for us to start exploring creating proofs of machine learning models and the ZK space is moving at blazingly fast speeds and creating better proof systems creating more faster and more performant provers verifiers right we've seen this every every day right how new proof

systems come along and like now like ZK Singh has improved their proof system and all these uh different projects are coming up with new Solutions and making everything better so machine learning is becoming more feasible by the day to create proofs of machine learning a models inside of ZK right so there's several projects that are interested in zkml I'll mostly talk about the ones that are in the inference category right so modulus lab Ezekiel and Giza for example so these what they're doing they're trying to sort of go at machine learning from different approaches and trying to create zero knowledge proofs out of them and creating better tooling and improving all of these and I'll sort of go okay like uh this is all cool nice technology that's really

interesting but what are the like potential use cases um of of this right like what why is it useful for me to create a proof of machine learning model so some of the use cases um that that are out there uh it's it's early on right so currently most of the actual use cases that are implemented today are mostly games or experiments but some of the ones that are potentially able to make sense in the future are some of these that are list here so machine learning as a service uh transparency right so if I am a machine learning API provider right I do not I cannot guarantee to the user that they're actually getting the API that I claim I'm providing them right so in the

case of let's say open AI openai has a GPT for API right if I submit an input to that API and I expect some output how do I know as a user that they're actually providing me the output of gpd4 and not running GPD 3.5 on their servers and just essentially like caching in the Arbitrage of just running something that's cheaper to operate right so instead of me having to trust that API provider the API provider I can request the API provider to give me a zero knowledge proof of that computation and I can verify that succinctly another one is bringing machine learning on chain so as as your as you all are most most likely aware

um blockchains are very computationally constrained the computations you can do on them are very simple smart contracts nothing too computationally expensive and the Machine learning is really really computationally expensive and it's getting like harder and harder every year because people are pushing what's able to be done with machine learning therefore they're requiring more and more compute by the day so we cannot really do machine learning on chain today besides maybe some really really basic like linear regression or logistic regression or some like really simple models so what zero knowledge machine learning can do is essentially create proofs of running these machine learning models off chain an analogy is like the same as Roll-Ups right like doing this really expensive computation of chain and then

just bringing a proof of that computation on chain therefore we can bring the power of ml to to the to the blockchain right we can we can just verify that proof on a smart contract and cryptographic we can verify okay this machine learning model that's public did this computation another one that might be interesting is for example anomaly detection or fraud prevention so there are several there's like a plethora or a subgroup of small machine learning models that are dedicated to finding um anomalies right we can train uh in the case of something like chain analysis you can train some models on some transactions and you can sort of detect what is something that's never

happened before like an anomaly or something that looks like fraud right there's machine learning algorithms that try to detect um like fraudulent flows or some exploits or some weird transactions that never happened before so what you can do with these Machining models and ZK proofs is you can have a smart contract that has a sort of fraud prevention or anomaly detection verifier like proof verifier inside of the smart contract and if I submit a proof that some public model found an anomaly within some set of historic data I can prove to the contract that hey I found an anomaly you should adjust your risk parameters to like be more more on the safe side or I can like pause the contract or any arbitrary logic that you may you may want to put into your smart

contract um if we actually like let's so these these all these use cases were more like validity proofs right like we're we're not hiding any part of the computation we assume that everything is public so now what are some of the use cases where we can hide parts of that computation like hide parts of the model for example so one of them is the centralized kaggle uh kaggle is a platform where people can submit competitions uh for essentially getting the best machine learning algorithm to solve some tasks that the people that post the competitions need to be need solved right so I as a kaggle um member I can post a competition to find the best classifier of images of dogs and cats and users that want to participate in that competition submit

the the best performing models they have and The Winner Takes The Bounty that the com the person that created a competition put up for it right so in in the case of traditional web 2 there is a centralized party kaggle that essentially swaps these two right the the person that creates the competition gives the price to kaggle and the person that submits the the best price or like the best solution submits their solution to kaggle and then kaggle gives the solution to the person that post their competition and the price to the person that won the competition so we can just decentralized let's get rid of the of the intermediary by just doing it with ZK proofs the competitor can just post a proof that their model was the best

performing one and atomically claim the the price once the the period of the competition has expired another one is this defy So within the centralized Finance there's there's a lot of things where you might want to use machine learning one of them is parametrization so I don't know how how well you're aware but for example there's protocols like maker or Ave and all of them have some hyper parameters that are tweaked on deployment or can be changed or set um during its its lifetime to sort of adjust risk parameters right so instead of having or Consulting with some really expensive

um products like gauntlets right so if I go to Gauntlet which is a sort of service provider that can adjust or like set these parameters using some math analysis um at the beginning then I can just have a machine learning model that can be sort of trained to optimize these parameters these risk parameters within D5 protocols and I can just provide proofs that this model has outputted some new set of parameters at um some new set of parameters and I can just prove that okay these parameters were created by this machine learning model and I can update the risk parameters accordingly another one might be yield routing right so things like uh you're in finance right uh so nowadays you can only do very simple

strategies using smart contracts these strategies need to be public so that everyone that deposits money into these vaults like yield volts that route liquidity across different protocols to maximize yield for for the depositor um they are very basic like you cannot really create complex strategies because if you want to do complex computation you run out of block space inside of the smart contract so what you can do is you can set it to be a machine learning model and whenever you want to update the sort of where we're allocating the the funds within the Vault you can just run a machine learning model to predict where the best deal is going to be and just post the proof that some public model found the best uh yields to be in

some other protocol and using ZK you can hide the weights of the model right so if you have some Alpha right like if you have some model that is able to predict where the best deal is going to be you can just hide the model and just use that one and just prove that this model that's hidden that has the best the best yield routing um just update the where where the the pool is going to be right and so I work at worldcoin where we'll we're we're building a privacy preserving proof of personhood protocol and part of part of the challenges that we have is that we operate a hardware device that's called the orb on this orb sort of is an iris biometric scanner and it has two main functionalities one is to determine that a person is a real

human being and another one is that it's Unique and so we have a machine learning model that is able to sort of um convert the the entropy or the randomness that's encoded inside of a person's Biometrics and create an embedding representation out of it or a vector representation out of it um this Vector right for is created using some machine learning model and if you ever update the model that creates these vectors or these embeddings the output space of of these vectors are completely different so if if a person gets registered once they can use their world ID right they can use this privacy preserving proof of personal protocol

but if you ever update the model you'd have to essentially go to this Hardware device again and recompute this this embedding or this Vector that represents the uniqueness of your iris and so this is sub-optimal user experience so another another use case where zkml might be useful is instead of me having to go to an orb again to recompute my Iris code if you ever update the model to be better you can just essentially go to an orb once for the first time you get onboarded and the orb would essentially just save a image that's signed by its secure Enclave inside of the phone inside of the secure Enclave of the phone encrypted and whenever there's an

update to the model you can just download the new model download a prover for that model and just create locally on your phone a proof that you computed this Iris code correctly without essentially tampering with it and it since it has data Integrity because the original image that you use as input has a signature from the orb so you cannot tamper with your original input and then permissionlessly insert it into the smart contract by providing a proof alongside with the new Iris code that you generated right and so these are some of like the use cases that people are thinking of nowadays and many and more many more are emerging as time goes on so where to learn more so here I have three three QR codes um where like places where you can go to

learn more so one is the ckml community is a telegram group that I created a few months ago where people hang out and talk about tkml so people that have written research papers or are building the tooling and writing blog posts and whatnot all of them get together and talk about zkml there another one is awesome zkml it's a GitHub repository with the readme that has a list of all the different projects or code bases and tools and essentially like all the resources that have anything to do with ekml so if you want to learn more I really recommend to go there and I also every single time I give this talk I have a highlight article that I always want to bring up so if if anybody wants

to learn more in depth about zkml that one leads you to an article written by 1kx about what dkml is more in depth thank you very much and I'm happy to take questions [Applause] foreign DC Builder are you honestly telling us

for all the people in this conference who first of all have no idea what ZK is all about there's actually something new that fits in with the sort of AI world that also loads of people are talking about and it kind of combines these two things together into this new thing that we're all going to have to learn about which is called zkml Are you seriously kidding uh yeah it's it's it sounds like it's like it's just a made up buzzword um it's essentially like ZK proves any arbitrary can prove any arbitrary computation and machine learning is one such computation um so it's it's gonna be hard to essentially um make a machine learning Engineers aware of what ZK is so that they can use

ZK proofs and then on the other hand ZK Engineers not don't really know what machine learning is so it's going to be hard to sort of teach about okay what does zkml provide and who do you target for but hopefully we can we can get past that pretty soon [Applause] hi thank you for your talk for the record I have a PhD in formal methods and I think that novel applications for zero knowledge proofs to verify the correctness of computations like AI is actually a very nice thing so thank you very much for your talk I think best of luck for the future of your research thank you [Applause]

foreign