ZK11: Proteus: Proof of Transformation for AI Provenance - Daniel Bessonov & Rohan Sanjay

Transcript

[Music] great thank you um I'm Denny I'm Rohan um yeah and today we're going to be talking to you about AI data Providence so really quickly um we're going to be talking through you know uh the motivation why is this important um is exis techniques about how people think about data Providence um the version one of our system plus a demo privacy concerns the version two of our system and finally extensions to the project so why are we here talking about AI data Providence um knowing where an image comes from or content comes from is incred incredibly important to inform how you perceive that content if I'm on

X or Instagram uh and I see an image or a video um it it's very helpful for me to know whether that image came from a camera or open AI Sora um and it informs how um I I perceive that content um as of today if I just see something on X or on Instagram it's very very easy to assume that it's real um you know I I see an image of falic I tell my friends about it they tell their friends about it um and misinformation spreads people were thinking about this um the Biden Harris Administration recently added language to bill um stating that they want to protect consumers from AI generated content um lawmakers are thinking about it uh Tennessee lawmakers recently moved to regulate Ai and deep fakes um so how are people currently

thinking about data Providence um and tracking content throughout the web the most obvious thing that we can do is say hey um I know where an image comes from let me just encode that information uh into uh directly in the images pixels or the frequency domain of an image or even some weight and representation of the image um the issue is that in real world settings Transformations like jpeg compression crops screenshots um taking a picture of something with my phone corrupts the data representation of the image so much that excuse me so much that we can still tell that it's the same image um you know if you look at a screenshot of an image you know that it's the same image um but the actual data representation of the image uh is

corrupted and any Watermark is lost um stable diffusion currently uses some form of image watermarking to um encode that it's a stable defusion image um but it works so poorly that if you generate a stable diffusion image and download it from the web um the jpack com compression corrupts The Watermark um another obvious thing that we can do is say hey if if embedding data into the image are into a video is too hard um why don't we just uh encode um some metadata alongside the image um and so this is what the ctpa an organization that uh um is meant for data Providence does um they assign an image uh add it to like the jpeg metadata um and accordingly I can now see things like uh you know this image

was edited or um this image originated from a Canon camera the issue with something like this is that um it's pretty trivial to lose the metadata even even if I don't mean it and I send an image to a friend or upload it to a social network um the image that's being uploaded is no longer the same image that had that metadata um it's also trivial to lose the metadata um if you want to actually just remove it and so the two observations that number one embedding data into an image uh is incredibly hard in the face of real world Transformations um and number two embedding data alongside it is also very difficult um which led us to develop proteus so in produce we decouple the data Providence problem into two parts

um the first part is we need to be able to track content on the web regardless of these real world modifications again things like screenshots slight crops down scale and compression um the second thing is because we no longer embed data directly into an image um or into a piece of content we now need to be able to prove that the content that you're looking at actually came from some original piece of content um that was created so to solve the first part of this which is again tracking content regardless of modification in the web we use something called perceptual hashes perceptual hashes aren't cryptographic hashes but rather a set of algorithms that lets us create compact representations usually 32 to 128 bytes um of content not only images but things like audio and video um that then let us uh Loosely M back Loosely ma back to it

um today perceptual hashes are used for things like uh checking copyright infringement content filtering um and for our use case are very useful to tell uh be able to tell whether or not some piece of content that you're looking on uh on the web appeared somewhere um in our registry sweet so Daniel just went through how we track modified pieces of content on the internet now let's get into how we can actually prove that these modified pieces of content are coming from original verified pieces of content so we basically designed a two-phase system the first phase being the content generation phase so what happens here is we have a Content producing organization like mid Journey Open AI they generate an image and once

it's generated we take that image we compute a bunch of its perceptual hashes and we store it into some private image registry correspondingly we also take the Sha hashes of all these perceptual hashes and we commit them to a public data store along with any of the image metadata and a signature that we'd want to include so from there on the flip side we have the content consumption phase of this where let's say a user is viewing some piece of content online um on a platform like Twitter for example and they have the question where is this image coming from so what we do is we take the image that they're viewing we call it the target image and this target

image can have been modified in many different ways we compute the perceptual hash of this target image and then we check our internal registry to see if there's a perceptual hash that is similar to the perceptual hash of this target image from there we perform a bay optimization process to actually figure out if there's a set of Transformations that we can apply to the original image that will take us um to an image that has an equivalent perceptual hash to this target image um if it's possible we then take those Transformations and we return them to the user along with uh the original images metadata and signature Etc and from there user can

understand that an image that they're viewing online is coming from some content producer like mid Journey Open AI Etc so to zoom into how this basian optimization actually works again the purpose of the basian optimization is to understand if there's a set of Transformations we can apply on the original image such that the outputed imagees phash will be equivalent to the Target image so we take the original image we perform um a combination of these different Transformations and we do that with the goal of minimizing our objective function which is just the hemming distance between the perceptual hash of the target image and the perceptual hash of the transformed image

um if it converges we know there's a match and then we can return those Transformations back to the user um otherwise the results inconclusive the reason we use basian optimization here is because basian optimization works really well with blackbox functions like neural hash which is one of the perceptual hashes that we use and again the overarching goal of this is to um realize that content online can be modified but we can still attribute it back to original verified pieces of content great so now to talk about some privacy considerations that we've had with the you want of the system um so there are a lot of cases

where someone takes an image or creates an image and they want to that image to be private um for example in this image right here the person on the left didn't consent to being uh in a photo that's published online um and so in the actual photo that's published they're cropped out um the second thing is if I'm AI generating an image uh say on dolly or mid Journey um there's oftentimes pii in the prompt uh that that is sensitive like for example I can prompts mid journey to generate an image of my friend Rohan and reveal some details about him that I don't want other people knowing so or organizations like openi when we've spoken to them are actually very concerned about about this problem of prompt leakage and so they don't want they don't always want original images to be um just

available um and so one thing that uh we do in our system is we're able to remove the trust dependence on our lookup um so we're able to generate a proof that number one some image actually exists in our private registry and number two that for a piece of content that you're looking at online um you can uh back that out and get the original image um through proof without actually revealing uh the private image or the Transformations that were applied to that image so more specifically uh you know a public input in proof is an organization's public key um private inputs are obviously the private image the Transformations from the basian optimization that ran was just talking about um and a signature um from whoever created it on the image and our goal is

to prove that we can take the original image apply these transformations to it and get a perceptual hash that's equal to the perceptual hash of the image that you're seeing online so again proving that the content that you're looking at came from some private image but not actually disclosing the image or the Transformations that it took to get there great so I'm going to walk you through a quick demo um um so say I'm browsing Twitter I see a picture of Elon elan's getting arrested um but before I go and tell my friends uh I click the prod I here uh and we can see two things the first is that the image was created by moury V5

on some date and the second uh is that this image is actually a screenshot um and again through the bean optimization we actually know exactly what happened to it so it was jpack impressed and it actually upscaled a little bit um and so again how did this work uh first we took the perceptual hash of the content that you're seeing on the web which is this uh screenshotted version of you on took its perceptual hash and were're able to M it map it back to perceptual hash that's in our private regist which is this uh um the top image which which is the original image um and to further visualize some of the perceptual hashes I'm actually going to walk through and uh get the perceptual hash of both the screenshotted image and the original one um just to visualize how we're doing this matching process um in

this demo the ban optimization was pre-computed because it currently still takes a long time um but it's very possible to optimize so here we can see that the perceptual hashes um of the two images are similar which allows us to map back to the original image awesome so Daniel just addressed some of the privacy concerns that come along with revealing the original images to users um but another valid privacy concern is actually storing all these original images somewhere which in V1 existed in this private internal registry but a lot of content organizations don't actually want to store users original anywhere and one

for scale scalable reasons but also for privacy reasons so with that we designed produce V2 which accounts for this so here the flow looks very similar there's a Content producing organization they generate some media and from there what we actually do is compute a bunch of transformed versions of that original image and then we take the Sha hashes or the perceptual hashes of all these different images and commit that them all to some public data store the important thing to note here is that we're never actually storing the original image anywhere only the Sha hashes of the perceptual hashes and with that you might be thinking it's impossible to account for

every single transformation which is why we introduce this notion of probability bounds so what we actually do is with the original images phash we can break it up into several chunks and then take the Sha hashes of the individual chunk then when we're considering some Target image we can replicate this process where we split its perceptual hash into several chunks and then compute the shaw hashes of the individual chunks to have a chunked Shaw perceptual hash essentially and using that we can actually match these chunks to come up with a probability of match rather than it having to be a binary yeser [Music] no and then on the content consumption

side of this uh again the flow looks very similar a user is viewing some piece of content on a platform like Twitter uh they ask themselves where does this image come from we take the target image that we're looking at we also modify it a bunch and then we compute the Sha hashes the perceptual hashes of each of them and then we see if there's a match in the public data store and this is where we can leverage the probability bounds and instead of looking for an exact match uh look for a probability of match and then at the end return that back to the user so the user can understand there is a x probability that this image is coming from mid Journey Open AI Etc um for which there is some verified original piece of

content that was produced cool thank you awesome thank you [Applause] thanks do we have any questions thank you thank you for the presentation um so you mentioned neural hash I believe Apple used it some time ago but do you know that it's possible to generate so it's not cryptographically secure hash and it's possible to generate collisions as well as to slowly slightly modify image to avoid detections and severely modify the hash so how would that system work given that neural hash is essentially back door any way yeah yeah so um the question is uh

certain perceptual hashing algorithms like neural hash um have adverse attacks you can modify an image uh to make it have the same neural hash as something else and not look the same the answer is we use a combination of perceptual hashing algorithms so for every image we store um at least four perceptual hashes uh um and so like one one Collision in one perceptual hash doesn't necessarily mean that um you know we won't be able to recover that image because the perceptual hashes are only used to find candidate images and the bean optimization is run on all those candate images to actually see if we can get the original image but if in the version version two if you don't have the original images then you cannot run it and it's more perceptible if I find fa

collisions right it's more susceptible but then we add more perceptual hashes okay I think we have to move on but I think the two of you are still like available for further discussions during the break later on so thanks again [Applause]