Towards verifiable and privacy-enabled AI / Filip Siroky

Transcript

so hello everyone my name is Philip I'm researcher at rockawayx and today I'm going to talk about a very compute computation and AI and a little bit about myself before I started working in crypto I actually spent four years working as an AI researcher at CERN where my role was coming up with novel deep learning architecture to solve some of the big problems in particle physics and so naturally I give my two backgrounds Ai and crypto I have always been interested in the intersection of the two and so this is what my talk is going to be about I'll start off introducing three

problems that we are facing today then give some broad introduction into ZK piece and you know and how it works and then I'll show how we can use these techniques to to solve these three problems I'm going to present so first one is about generative AI so with the rise of powerful generative AI models it become you know like mid-journey child GPT dally it becomes ever more difficult to distinguish between uh what's real like real images or videos and what's being just generated by some powerful AIS and so so the problem I'm going to be talking

about is how do you make sure that when you see some uh picture or like a Drone footage online like how can you make sure it was really taken at a at some place at some time and it's not just an AI generated content the second probably I'm going to be talking about is uh is kyc and and privacy like as you all know you've probably all had to go through some kyc or AML process in your life like usually when you want to use some financial application you have to prove uh who you are and how it works is you you know you take a selfie or you provide some some documents and you send that to some third party and they will do they will

verify okay that this person really says who uh like it's true that it is who you say he is and the the opportunity here is you know can you uh bypass that can you can you pass a a kyc while preserving your privacy I think this is going to be really important because there are some you know as Regulators are coming after crypto there are some um like attempts to um basically use uh smart contracts for D5 like only if you're a ky seed so you know having like a ZK kyc 0 kyc I think would be very important piece of infrastructure

and the third is that today smart contracts are really not that smart you know even vitalik says that uh he regrets calling a smart contract because uh really it's sort of like a persistent script uh that you can call and so is there a way how to make uh smart contracts actually smart so first of all I'd like to introduce proofs like this is a technique I'm going to be talk about uh a lot and that which can be used for all of these problems and you can Define in many ways but um the important thing is it's sort of a short proof that a statement is true without revealing any extra knowledge there are always like two actors in the scheme there's a prover and verifier

you can give like a private or public input to the prover you can use either private or public program you run the program create some execution trays and also generate the proof that you then send to a verifier who can decide um you know I accept it or don't accept it and the most important impact is you know with your zero knowledge proofs you can you can do arbitrary long program computation with optionally priority and it can be verified in constant time and optionally privacy preserving way right and the two ways how zkps are are used are for its zero age property and it's

the synchronous property it means that the proofs are short so how to use it for noise property you can for example say I know a password to an account and I want to access the account without sharing the password to anyone so you can you can avoid like man in the middle attacks and the second way how to use it is for example how Roll-Ups use it you can execute potentially millions of transactions of chain and you want to prove that all the transactions were valid so um you can you know aggregate those those proofs together and verify it on chain and all under in one million of gas because the proof is very short

so how does the pipeline for verifiable computing normally look like so again you have some public or private data you you do the computation as well as zero knowledge proof generation uh you know of that computation and you verify it somewhere and one of the problem is that uh like with machine learning you know if you if you input some incorrect data you're also not going to get a better result so for many use cases we need some a tested sensors like some some sensors that can also sign uh the the outputs then for a zero knowledge generation uh the the problem is you know it's slow and this is why even though the tech the

technique comes from the 80s it has always been sort of in the minds of theoreticians as something that you know can be done but will never be practical but only in the last five years there's actually become practical and um and they can be paralyzed and and however accelerated on fpgas and gpus on Essex and last is zero knowledge proof verification there I'll be talking about on-chain verification and I mean that is expensive for one proof but I aggregate them sort of amortizes the cost of a verification per one proof and why would you want to verify it on

chain like you know you can verify it on any device and um my argument here is that ethereum can become the trustworthy zero English purifier because in the scheme I showed before the prover like another very cool thing about this is you don't have to actually trust approver okay this is why like zero zero ZK Roll-Ups uh work I it could be your biggest enemy like Darth Vader you know running the machine but you know that uh you can only like produce um a proof that is correct or it will not produce the proof at all but who can be dishonest is of course a very fire like the verifier decides you know do I

accept that proof or or not and um of course you might not try the verifier but since ethereum strives to become the most credibly neutral system uh it could be the ideal zkp verifier and how you can solve the problem of um of the cost is by recursively aggregating the proof together and one last Theory before going into the examples is uh if you want to use zero knowledge proofs for privacy preserving computation you can open it out when the computation does not leave the model where you want to store your private data right so and

so there are essentially two ways I've used it either you you don't care and you use some public input data like for ZK Roll-Ups you know it's being run on some like huge computers that are optimized for zero knowledge proof computation and then you potentially verify it on chain or if you want to use it for for private privacy preserving applications it has to be running on the client side so you you produce the proof on the under side where the the private data is stored as well and then you can you can verify it somewhere so now let's go to the examples that I showed previously so the concrete problem is um how do I know that when I take a picture it was it is a real picture and

and nobody has used Photoshop or edited it somehow so you need something like an attested sensor this is something that's already um happening for example there is a standard called c2pa and Sony and other manufacturers are now adding essentially private private keys to their to their devices and how it works is the producer generates a private key they embed it to the device and then they delete all copies of the private key so it can only be you know this device signing it and then whenever you take a picture or or or make a video it signs uh the the input the output right so you have a you

took a picture of some person and you also signed the metadata such as a Time amp or or the GPS like location and then you can verify the metadata by checking signature and say okay I believe you that this picture was really taken you know in you know Ukraine at this time so so I know it was not um it was not generated by some AI but the problem with this currently is that you know usually you don't want to be using the raw image files because they're too large or maybe you want to modify them a bit and whenever you do some modification like any edit to the uh to the picture you took it no longer works like the signal that you you can't you

can't verify it because it's a modified picture right so what if you could use ZK proofs to you know for any edits you do you also generate the ZK proof that this is this is what happened and and and then you could verify this output of um of uh of like the honest edit so for example you could show the only thing I did to the image was resizing or or maybe changing some brightness but I didn't use Adobe and I you know they didn't add some some new people in there so

uh how the pipeline does it looks you have some adjusted sensors it could be camera it's an example but it could also be Voice keyboard or or any other sensor then and then you prove that you edited it uh honestly and you can verify wherever but you could do it on chain because that's the most trustworthy verifier the the second example how to pass kyc without losing your privacy so as I said previously the data cannot leave the uh the private data I can leave the device so you have to do the ZK approving on the same device where the private data lies so again you have some adjusted sensor maybe a selfie or like a lidar on your phone voice or maybe even a

fingerprint and uh instead of sending your private data to some third party that does the checking for you you can essentially have some machine learning model that matches your selfie or Dev camera uh to some you know other other data and you generate the proof that you in the you are who you say you are and the the private data leaves the device and and then you just send the proof to to you know whoever you want to convince and uh you know you're a ky seed and the third is smart is uh it works like this so this is how this is ethereum you know

ethereum produces uh blocks every 12 seconds and the reason why you can't um like run arbitrary computation on ethereum is you only have 30 million gas limit um you know it's because the blockchains are very like robust and credible neutral machines but they are super slow right so um you can for example only fit like 100 unit swap swaps in one block so if you wanted to run you know something like a GPT it's like completely out of question and so how Roll-Ups work for example is as I said previously you you perform

the uh the transactions or you know state state changes of chain and you only you send the state differences to call data or after prototting chart to to blob space that will make it cheaper and you also send a validity proof that all of the uh transactions Happening Here were indeed honest and so how you could make these this is sort of you make the same computation but you just do it elsewhere to to save gas right but what you could do with zero knowledge machine learning is you know have optionally private inputs or public inputs run some arbitrarily complex machine learning model

and also and then uh you know have that inference have the output of that model and also generate a validity proof that uh this is indeed what happened and you can you can have that verified on ethereum and used for some with some other applications so you know what are the challenges of zero knowledge machine learning and why you know we don't see uh GPD for or being verified on it like being used with the same applications today and like it's mostly uh that the well the attested sensors are not really widespread there is the standard I talked about but it's still

getting slowly adopted by by major companies second is quantization and um it's sort of the dichotomy between how what machine learning models need and like what was your knowledge proofs proofs made and it's it's about like floating Point Precision like if you have low floating Point Precision with machine learning models it reduces the accuracy of your model but on the other hand if you use like higher floating Point accuracy or Precision uh your zero noise model will be you know super super slow to generate proofs and the ways how you can solve that is there are some attempts to do weightless neural Nets or

you can use uh zero knowledge with Hardware acceleration on gpus apgas or A6 you know the similar story with circuit uh circuit sizes large models for example gbt3 has like 107 billion parameters and and you know even though now we can make a zero noise progeneration and like quasi-linear time uh the the overhead you can you know you can still think it's like between 1000x and 1 million x uh so and like generating inference on on chat GPT is already pretty expensive so you know imagine multiplying the cost by by for example 1 million um

so it's not not really not really uh feasible today but again what you can do is both the proving systems are getting improved and the hardware is getting improved and last one last problem is adversarial attacks though this is like big problem in machine learning in general and that is like no models are are perfect and you can always find let's say an adversary example that when you have a trained model you can give it such an example when you when you fool it for example when you know when if you have a Tesla and you know you want it to stop on a stop sign has been trained to recognize a sub sign and stop there you can create an adversary example by printing some you know carefully made sticker you put it

on the stop sign you don't even see it but the but the what Tesla thinks it's uh you know go faster sign or something and I like the problem why this is even bigger problem in zero knowledge machine learning is that um if you know what the input data is and you know for some reason your model is behaving incorrectly you can maybe debug it later but what if you actually never see the the input because that's the point um so there's some sort of okay so there's one more slide so so the problem is uh you know if you never see the input you you actually don't know if people are sort of doing attacks on your

model or not so this is sort of fundamental problem with zero zero noise machine learning and one way how to mitigate that is just increase the number of ways to authenticate so instead of just matching your selfie to your passport for zkyc you could also uh you know match your voice or fingerprint or or depth camera and just make it harder for people to find adversial attacks for the models and so how can you use zero Express learning today you can use generic compute like Risk zero and you can use uh like any rust program and uh and and use and like use the zero knowledge virtual machine for

um you know any use cases that we showed before or you can if you want to make like Fast uh if you want to if you want to use it for um machine learning specific models there are some like zero knowledge machine learning specific libraries like as I kill or zkml that will make the proving much faster and uh we have we have we have done like ZK Wordle and risk zero you can play it here zkwirtle Dot rockawayx.com and that's it thank you for your attention [Applause] are there any questions okay uh I didn't hear it properly do you

verify um [Music] is there any way

this data can still remain um I don't completely understand but let's discuss uh now yeah thank you very much [Applause] uh the speaker is going to the bathroom is coming in one minute and we can start we speak you are going to be around yeah okay okay [Music]