“Optimistic” Outlook: Privacy in On-Chain AI Made Affordable

Transcript

he [Music] [Music] hello hello are you ready for the next

one so next one is ky hello St about ZK ml yeah let's do it um s cool okay just let everyone getting seated before I start um yeah hi everyone so today um it's this is a miscellaneous talk uh per the schedule so I guess it's very hard to fit this topic into every anywhere

because it talks about AI it talks about ZKA and it also talks about optimistic systems um so I'm the chief scientist at Aura U my name is Kathy and we are really uh what we work at Aura is trying to put Ai and crypto together and um we have a quite unique approach uh which I'll explain today but first I will talk about like how we're achieving verifiable a uh machine learning on chain um most of you would probably heard of like ckl Ser knowledge machine learning um and then we'll talk about something that uh Aura has invented which is optimistic machine learning

opml as well as our latest research which is a piie and I'll explain that term in a little bit so at AA we believe that verifiability is a spectrum right A lot of the times when we hear about verifiability uh is all about ZK Zer knowledge and that is often considered kind of the universal just like the only source of fair viability um but then actually optimistic systems are also a form of fair viability right through a different security consideration a different security uh assumption and also um uh well um a a different consensus system um so actually here are two pieces of

our research if anyone is interested into looking into the paper it's actually both on archive so um optimistic machine learning is something that we have introduced as like the op counterpart of zkl right so you have ZK roll up and op roll up so why not zkl and opml uh and then however the beauty of having like machine learning and also not really an on chain Ledger is you can have also The Best of Both Worlds right so for a row up it has to be either ZK or either op but now there is also mix of it I guess like with chains like Tao uh but then with um machine Learning System you can actually mix the two so we can have op and ZK at the same time um so for those of you who are not

familiar with ZK ml just a quick overview or rund down so when we say ckl is actually meaning running machine learning inference in either a CK circuit or a ckl and we want to do that for a few uh purpose right so first of course for fairy ability right we want to prove that we have done some computation we want to prove that we have run the model um but then apart from a fair viability often when you hear about ckl it has two promises and those two promises I've have put with like an asteris for a reason right so often you promis input privacy and also model privacy right so not only you could prove the machine learning computation you can also hide

either the input to your model or the model weights right and actually um this is not unique problems unique to zkl but just ZK proof in general which is there are some known issues right now right we're kind of limited by its performance and Hardware so it's uh memory consuming time consuming and hence is only practical for very small neuron networks right uh there will be more concrete numbers in a little bit so let's discuss those two points in Aster that uh kind of lead me to think about maybe ckl is not as private or as CK as we thought so first of all improve privacy

right most of the time people talk about improve privacy is saying that hey you distribute the prover to whoever is generating the proof so that person only needs to put their input uh signals or input data into that model into that prover get a proof and submit the proof to you right so this mental model when you think about it that actually means that we are handing over the model to the user to the client's side and that also means that the client or the user if they want they can actually make as many local inferences as possible right so the machine uh the problem with machine learning is that once you have a model even though the model is sort of like a blackbox it's private you don't

really know uh what H how like how the pro actually work you can actually do have free inference to generate data that can train a model that mimic this model right so essentially I don't need to know even how that black box work I just need to have a ability to generate input and outputs um so actually in this case it's actually very easy for the local users to train a model to inverse the compute all right so uh in machine learning it's actually called reconstruction attacks um but in summary what I'm trying to say here is actually that input privacy is not as obvious um uh well it's not as obvious as okay let's let's just

construct and zero knowledge proof and you get input privacy immediately uh with machine learning is actually tricky because there are statistics that you can compute that can potentially reconstruct everyone else's input if you know how the model works so well let's look at the other promit which is uh model privacy right okay so well then I don't distribute the model I keep the model to myself I keep the model weights to myself and uh whenever a user submit a request give me some input data I will perform the computation right and then I'll give out the proof along with the output so that should be safe right that my model is totally safe and actually it also goes with the argument that I made just uh

before is that you can even just with the input and output and with a black boox model you can still tically compute a uh model that can mimic this computation right so actually the C in this case what guarantees the model privacy is not the sereral knowledge proof itself but uh the scarcity of these inputs and outputs right so the more your model is used the more input and output pairs you get the easier it is to reproduce what your model is trying to do so actually you still need some sort of scarcity as well as like high inference cost to prevent people from doing so right so in this case CK alone is not enough to protect model

privacy you actually have to align with some sort of crypto economics or just economics to make sure that there are no one no malicious party making enough inferences to sort of get what your model is doing right so actually in this case if privacy is not really the point of um having machine learning on chain then really the uh the Maj main point of iav machine learning on chain is verifiability right and if we're only concerned about verifiability uh what we can do is actually take an optimistic approach which is what we have introduced at Aura right so if you take Game Theory plus machine learning plus

blockchain then you get opml um so essentially it is like how op rup works but with machine learning programs um so you can have a execution client which execute the machine learning and and only when there are challenges then you will run this into your FRA prooof uh virtual machine and have an interactive fra prooof challenge between the submitter and the Challenger right so it's a slightly different trust assumption uh between like opml and zkl right so zkl is pretty pretty much trustless in a way that if you're given a proof you can always verify it well with opml is um any trust assumption right which is as long as there's one honest party in the network then your um

system is guaranteed to be correct so the major difference between o um opml and zkl is the size of the models that you can run right so I mentioned a little bit about practicality of zkl um there are actually bigger models that can be run on ckl already but with sort of crazy time uh which is not included here but majorly if you want to do ckl in a reasonable time frame uh these are the largest models that you can use which is decision Forest maybe nanog GPT or gpt2 something of that sort of size uh but with opml because of this native

execution you can essentially run any model so here is just two examples that we have already put on chain uh that which is stable diffusion and llama and these are like at least thousands if not a million times bigger than uh the models you can do on ckl so going back to this well what if we can have the best of both world what if I want the speed of opml but I also want some of the Privacy guarantee of CML and that's when we introduce opai so I'm not going to explain this meme if you want to know the meaning of this meem we can actually Google this word uh

H and it's meaning in Japanese so um op High stands for optimistic privacy preserving AI so it's just a fancy term of saying hey let's put opml and ckl together so we have already established that just now that CK alone actually doesn't guarantee model privacy because of the nature of machine learning right so even if I don't know what the program is doing I can still actually infer what it is doing with enough uh enough samples right so what we're trying to argue is that um OPI can also provide a similar level of security with a lower cost right so if model privacy is um

important let's say for just some part of the model then we can just apply CK to the parts of the models that we want to hide right and one immediate question might be well what are those parts um so let's give an example for example stable diffusion I think everyone probably know what stable diffusion does right it t tax into and and turn it into image um and stable diffusion is a public model right stability AI has open source it so it's not something that is a secret and there is really no need for sort of model privacy in the ZK setting um so but however there's a lot of people who fine-tune um stable diffusion right

Laura or whatever methods that they do so they find twin stable diffusion to get images of styles that they want and these fine tune weights uh actually are modified from the open source weights so a part a portion of those open source weights are modified into these fing weights so that you can get certain style and these potentially are the weights that you would want to CK if I use CK as a verb so you want to make it zero knowledge uh but probably not all the other ones um so actually the bottom line of what opai is trying to do is we will just apply CK to The Selective part of the model that we want to hide the

model weights and for the rest of the model we'll just do it optimistically right so you will imagine if you have a model well models are typically not linear but basically will do like optimistic optimistic and up to the point that you want to hide do some ck and not optimistic optimistic uh and then again CK for the parts that you want to hide so um staple diffusion was one one of the example that I gave but actually even for stable diffusion even just for the fine tune part that's still too big for nowadays zkl so that's how crazy it is I thought that well if we take stable diffusion get only the fine tun parts that should be good enough for ckl actually it's still crazy you need like

hundreds of terabytes to do so uh of of memory to do so so um here I actually present a more tangible example which is a um find tuned llm so large language model in particular we are fine tuning a llamas uh Lama llama 2 so llama 27 billion which is the large language model that is open sourc by meta so um the way that they are uh fine tuning these models are that they they have certain So-Cal interventions so in particular to fine tune like a llama 7B they have 32 interventions into these models so only in those interventions uh you are sort of

modifying the model weights right so Lama 7B means that there is 7even billion parameters but when when you're fine tuning you only find- tuning around 2 million parameters and there are 32 of these which are all separate right so they don't need to fit into the same ZK circuit they can be 32 separate ZK circuit and then each of these are actually quite small so what we're trying to do is okay let's apply o on uh framework on this mod model and here are some of the Benchmark results uh it's actually not in the paper yet because this is are some latest Benchmark results that we got and we are bench benchmarking it against two other uh projects that have

um proven llama 7B uh using the approver so the black bars are uh a project called legatron or yeah legatron um so they are running it on like a very high memory machine and trying to prove the entire Lama to7 billion in a in their cka VM and then um the gray like gray bar is actually a latest paper called CK LM so what they did is they actually used GPU uh a Nvidia a a100 and then try to prove the entire llama 27b uh and so from the left to right you have like the peak memory usage of each

of the B Benchmark and then the prover time and also so fair time um so for the San um bar which is actually our approach is done very naively by coding those intervention in circle uh and then using just snjs to uh prove it with growth 16 prover right so all very naive approach not optim optimized yet there's actually a lot of optimizations that can be done uh but here are some like preliminary result right and this is only proven on my laptop like M3 Max um Mac MacBook Pro so and and here are some of the results which is you can see that there is actually a lot less uh memory

consumption right because we're not trying to fit the whole model into the CK circuit we're just trying to do part of it and then um the pro time I actually calculated like the 32 circuits sequentially just to make sure that it doesn't fate the peak memory right because if you do it parallely then that's not the peak memory usage you also need to multiply by by 32 but assuming we only have like let's say 3 gigabyte of memory you can do it sequentially and it only still takes like 1 minute all right and then actually when you try to verify all the proof is actually very quick and also very cheap because it's um you know in grow6 and you can do it parallely and the circuit is actually very small and

the pro is also small uh sorry the fifier uh the proof size is also small right so here are some of the so you can see that actually by apply like aie onto a CK circuit you can have a lot of gain and something that seems ridiculous which is like taking 14 hours so yeah to put this into perspective this is 14 hours and this is 14 minutes I think uh to something like 1 minute um and when we say proving actually it only means one token so one token in llm means like a word right so to generate a whole sentence that means that you have to do this repetitively uh so 14 hours or even 40 minutes is definitely not something that is practical uh but then uh the uh

the OPI approach can actually still be optimize by let's say changing like the proving scheme um you know turning uh changing the method that we actually currently Cod the uh circuit right I only use circum you can totally use like lookups or other things that that page and improve that right so um that's sort of the results and um for the rest of the talk I actually want to cover a little bit which is now we have a tangible practical uh verifiable machine learning approach uh that can be verified on blockchain and what do or what what does Aura actually do um like do with it right so a lot of the times we get a lot of question which is like why do you

want to put model on chain what's the benefits of putting model on chain and most of the time people are thinking about the top question which is like what can AI do for blockchain what sort of model we want to put on blockchain but uh at AA we actually asked the flip side of the question which is what blockchain can do for AI and so there's actually we're trying to solve two of the issues of a industry and just now we have only covered the first one which is verifiability right why do we want verifiability is ultimately because uh There is close Source models that is like dominating right and we have no idea what it's happening with the models sometimes times the performance of you know chap

gbt actually drift drift meaning that it slowly degrades or changes its performance right so we actually need some Fair viability to know that what service we're being provided for um and also uh the second problem is actually not so much about Fair viability but about monetization right so often um AI companies that have open sourced their Foundation model uhu means that there's no Revenue uh I don't know if you have heard but stability AI is also actually not doing that great on the like on the book right um so how do you actually monetize or how does AI company actually move forward other than just closing close sourcing their models they need

tokenization so what we have just covered actually only do the first one which is verifiability and we need the second piece of the puzzle which is tokenization so uh AA will be introduced is a concept called initial model offering right so it's actually tokenizing a model um what you have is model ownership so that's actually an a that we have written uh essentially it spe specifies how a person would benefit from let's say model generating Revenue uh but not only that we also need sort of verifiable inference and the inference being sort of a piece of asset right so as an example let's say

we have a AI generated art right this piece of art turns into nft and first of all we need to verifiable verifiable ml because we want to verify that this art actually comes from this model right um so that we know that the revenue of these Arts should flow back to that particular model and its owner so it's a kind of a close loop where um we can sort of monetize and and design a scheme where people can own a model and then also have a um Revenue Source flowing back to the model ownership even if the whole thing is open source because we can always have like verifiable inference knowing that

hey this model has been used for certain inference right so um that's sort of our Approach at Aura uh with AI cross crypto so we introduced optimistic machine learning and now we're seeing like how ZK as well as privacy preserving uh p um features can go into it and then uh we have actually realized opml in practice with our onchain AI Oracle so our AI orle is sort of an interface where developers can call in smart contract inference and then at the back end or the or the layer uh or the infrastructure layer we actually use opml to guarantee the security of this AI article and then of course uh the

tokenization that I've just mentioned right so so that's the end of the talk um here is like if you want to assess the preprint on archive here's my link tree and as well as also leads to like the ERC discussions if anyone wants to take a look at the ERC thank you thanks any questions um could you expand a bit more on why you have to prove the entire net all the parameters um would it be possible to prove a subset of the

nodes uh sorry I'm not sure you've underst question you mean like the model or yeah so as I understand that the issue with ZK for dnns is that it's extremely compute heavy to Traverse the entire real net and prove every computation yeah so similarly optimistic sorry yeah go yeah um that's true but then you also need to and and you think it's the same problem with optimistic or what you're sorry oh it's hello okay yeah I'm saying saying that if the issue with ZK is that

you can't prove the entire DNN um um would you not be able to prove a subset of it and then set an arbitrary confidence threshold where you say hey given I've I've proved n different paths that is sufficient enough confidence that if all those proofs pass I assume the validity of the rest of the net and the output right so that's exactly what opai is trying to do right which is doing it partially I think the it's not con consider safe for doing it zkl just for part of it U for multiple reason so first of all is a lot of time people are

talking about inut privacy and the less of the network you prove the less sort of obscure your input is so the easier it is to inverse compute what the input was so that's why it at least for if you want the input privacy case is not um safe to only do CK for part of it yeah so you couldn't prove like the final layer say it has 512 right right you say okay I'll prove the path to one of these and if as long as the that proof holds I'll assume that the 511 remaining are also valid right then you would hide the rest of the net technically or am I misunderstanding it

I'm not sure if you can do that because you also need to prove where the well so the ne network is complicated enough that even if you take just one output let's say the final layer and you just want to prove one of those I'm not it's not necessarily one out of 512 size smaller if that's what yeah I think you still need most of the layers especially like if it's not like cuz it's not just like the uh fully connected Network right yes if it's connected Network then what you will say is will hold true right which is if you just take one path it's actually one out

of n of the size