What Is Unlocked by Practical Zero-Knowledge Proofs

Transcript

great so I want to talk about uh kind of some vignettes of what I think might be unlocked by practical zero knowledge proofs so we heard a little bit yesterday about how zero knowledge proofs are kind of ahead of schedule progress has been going uh better than we expected uh and so I think that gives us license to dream a little bit about what the future might look like um and I'm hoping to suggest a little bit of that for you today um so just to review digital signatures are kind of what got us started digital signature is a type of zero knowledge proof but even with uh by putting them into a consensus mechanism like blockchain they don't take us all the way so what do I mean by that we're forced to program with them rather than

in them right so we use digital signatures to authenticate messages in a chain or to construct a tree of trust in like a certificate Authority system or a pki people love using them but they lead to complex constructions chatty protocols blockchain is a kind of Chatty protocol right where we have to wait for light to get around the world and round trips to be completed in order to know something is true um and we have some limitations on our security model and our privacy options and in some sense it always comes down to somebody storing a secret key even if we Shard it and there's a hypothesis that perhaps that requirement of kind of a bearer asset or protecting a secret

key might prevent things from ever really become becoming mainstream and I think that their knowledge proves one of their greatest promises is to kind of allow us to break that requirement um so a zero knowledge proof is a programmable signature uh the idea is we have a normal signature algorithm where we have a a secret key a public message and the signature algorithm that everyone knows that's applied to those inputs to produce a signature and a public message and then it's verified uh by a counterparty such as by the chain um a zero knowledge proof really just lets us replace that secret key in public message by arbitrary private and

public inputs and it lets us run any program we like not just a fixed signature algorithm produce a proof instead of the signature and again public parts and you know initially zkps were sold as kind of probabilistically checkable proofs which sounds bad but when I say it's probabilistically checkable in the sense that you might be able to produce a false proof just like you might get lucky and guess satoshi's Keys it feels a lot more comfortable right so it's probabilistic but it's it's it has similar security properties to to a digital signature which are are great properties um and what's exciting is that zero knowledge proofs are not just programmable but they're becoming

rapidly more programmable we've seen them used in Roll-Ups and that has driven the development of the technology but it's also now possible to do crazy new things like put 100 million parameter AI models do computationally intensive things inside of proofs to do email to build games and moreover there's been a lot of great tooling that's come out to make them easy to program with you can write your circuits in Python and JavaScript or a number of special languages that have been created to make life easier for you technically in terms of the amount of information or computation we can fit inside of proof we're in a situation where progress is not slowing down it's

going extraordinarily quickly and I'll say a few words about that in a moment and so that gets us thinking about you know what happens when zero knowledge proofs are as easy and as fast as we can hope right what what can we build um so one thing that's near to my heart as as a builder of zero knowledge machine learning is kind of floating Point operations for proof how many times can I add and multiply uh inside of a proof and what what's happened crazily in the past year is that we've gone from a limit of around maybe a hundred or a thousand operations really these are fixed point but you could think about them as floating Point operations in a proof to something more like 100 million or 200

million operations inside of each proof and this is just the code to our repo if you want to check it out and that means that you know I have reason to expect that this progress is going to continue eventually it's going to slow down but we can expect we can do a lot of computation inside of a proof another way to think about it is um not just computations inside of a proof but how many proofs are happening and one ratio I like to think about is proofs per Transit change for blockchain transaction right so a signature is a zero knowledge proof right so that means that we're always at one right every time I submit a blockchain transaction I have to sign it and that means there's

one proof per transaction as we start to get into Roll-Ups we can think about 10 or 100 maybe on the order of 100 or maybe more proofs that are kind of or transaction sub transactions that are computed into a proof uh and and submitted to an on-chain transaction um we heard a little bit yesterday about uh zoo pass which was a an application that uses zero knowledge proofs developed for zizulu and that was interesting because it I would say it's sort of on the order of a thousand where you might do one blockchain transaction to link an address or to pay for a ticket and then you use your zero knowledge proofs for all kinds of things I mean I went to a I went to a club and used a zero knowledge proof to gain

entry right during during that event so um that already starts to be well a lot of proofs that don't really very often have to connect back to the blockchain because many much of the time we don't really need consensus we just need kind of composability we just need ability to transitively trust what happens okay so where are we going for that we're still at this sort of 100 000 thing that we were at a year ago with flops um this is more of a social problem I mean it is a technical problem but it's also a sort of a social devtooling and efficiency problem you know figuring out the use cases that cause more proofs to happen per transaction figuring out the abstractions that let us compose them so

I'm going to say you know maybe three years tops before we get to a world of 100 million a billion proofs being computed per blockchain transaction and that's a very different world and I sort of want to invite you to think about what the world's going to look like when we get to that point um so by practical zero knowledge proofs what do I mean I have a couple of desiderata or requirements I want there to be reasonable memory usage fast computation one metric for that is it's fast enough to run AI models another metric is it's fast enough to do on device proving for privacy if I want to do a decentralized face ID using a zero knowledge proof I'd like to be able to run that on my phone we're not there yet I think we'll get there soon

um I think on-chain verification is critical I would say otherwise the epistemology is obscure what I mean by that one of the challenges if there's a billion proofs per transaction being uh being created if there's a ton of proofs being created it's hard to know we know that they're true because zero knowledge proofs are like a language of Truth or the true language as uh Brian or um or Barry we're saying but uh we still need to have some kind of global schema to understand what what we've proved like to orient ourselves in that World um and you know on-chain schemas and Unchained verification is is probably going to be a very important way to understand that something has been proved and we want it to scale to a billion

proofs uh per on chain transaction which again is sort of more social and we want it to be easy enough to use that you don't need a PhD in cryptography to to implement them okay so if we put these two factors together we get kind of a two by two or a two-dimensional chart flops per proof proofs per transaction and we have a couple of data points zoo pass Roll-Ups Ezekiel our machine learning library and we want to ask you know what what's going to happen up here when we have this world of a billion a million 100 million uh operations per proof a billion proofs per Transaction what kind of applications will exist there um I don't know I'm going to offer three sort of quick vignettes that hopefully will

stimulate ideas um so the first you could call composable constructed truth um so one way to think about this is in terms of autonomous worlds there's a hackathon going on right now uh with Xerox Park lettuce and Global um and what is an autonomous world it's a game uh game logic is a great place to experiment with cryptography logic because the consequences are low so that's why a lot of experimentation is happening in games it's a game that's not under the control of any one player or more importantly under the control of the game maker right players can add logic to the game they can change the game the way the game works but not arbitrarily they can change the way the game works with a

substrate of kind of digital physics some kind of Base rules of the world upon which they can build not so different from the base words rules of the economic world that we experiment in with blockchain um the issue is that to make a fun game an interesting game with a lot of physics in it it's tough to implement that uh in the evm because of the restrictions on gas and how much computation we have and so the solution one solution is to do it on chain but accelerate it with off-chain proofs accelerated with ZK we can do things like have the physics engine run into proof right it's just a bunch of Matrix multiplications create NPCs that can exhibit intelligence and even move between games um and have ai judges like you know

someone is uh deciding whether a picture that you drew satisfies this you know AI God that's something we've seen built um or you have a recipe you're trying to create a cooking recipe uh and the judge decides whether it thinks it's delicious or whatever right and so these are really fun but they're also a way to experiment with the crypto system that surrounds uh the mixture of proofs and on-chain transactions so that for example we don't have problems with reversibility um so on the other hand in in the digital world in our world not the autonomous game world but the world we live in it's getting harder and harder to know what is true right we have this unstructured

web it's vulnerable to misinformation we have ai fakes uh becoming indistinguishable from the real thing at a rapid Pace uh and so this digital world can feel like a game without rules right without structure and without the composability we might want we can't take two things which we believe are true and use them to compute something new which we also believe is true but as we were just saying we have new ways to construct truth to agree on the state of a constructed World um new ways to establish and publish legitimacy um and I think we're at a stage where blockchain has enabled us to sketch that future out right we have an idea of what we might want these things to look like

about how to structure information but on its own it's probably never going to be scalable enough to express everything we needed to express so we see a lot of kind of uh things which are on the way so it's like something which is not fully decentralized yet it's an application um when you dig into a deep most of it's running on a proprietary server and that's partly because if we want to express something like social or if we want to do public publishing we want to do any kind of scalable truth thing um we're going to need a lot of transactions a lot of block space and so on its own it's not enough and so of course we might want to use particular knowledge push to accelerate that right

so in our world not the game world but our world we also would like it to not be under the control of any one player or game maker right economy Creator we also want digital physics in the sense that we also want some kind of structured ground structured substrate on which we can build our abstractions and compose we'd also like ainpcs hopefully they won't be like the bosses in a video game they'll be a little bit more pro-social agents but we can create those and the way to do it is is also with on-chain acceleration by off-chain proofs um okay so next vignette is this idea of how can we use machine learning to give

the blockchain eyes it's really very simple um do you take this signature algorithm uh with private and public inputs and you replace the signature function with a model inference forward pass of an AI model and that allows you once you solve the data Providence problem which is another problem we won't get into to trust that the inference of a model the proof of a model was correctly can was correctly produced so the model ran as though it was running on chain what can you do with that you can give the blockchain eyes to perceive the world so you can finally solve all those supply chain

problems that were promised long ago you can do a decentralized authentication I like to think about it as kind of a 10 000 Factor authentication it links you as a human uh rather than a field element or a secret that you know or even a partial solution to social recovery links you unseverably to your on-chain identity into your digital assets right it's maybe measuring not just your Biometrics but something like a zero knowledge proof of your location history or that you didn't suddenly jump from one country to another um a more General way to put that is that it lets smart contracts exercise judgment so um kind of puts the a into Dao lets a

smart contract have it make a decision that has soft factors that's not just uh is this condition you know is is this number greater than that number but did this person fulfill their contract did this article say that a hurricane hit a coast something like that um and the input outputs and architecture and parameters can all be private or public you can try our our software that's visible available now to um to build with zero knowledge proofs if you're uh zkml if you're interested um and then the last thing I want to talk about is uh rethinking money as a coordination protocol so in some sense I feel like what we've done with

cryptocurrency in general is to take this old model of I have so many tokens I multiply them by the last price at which they traded and that's the amount of value that I have and this was a great technology when it came out five or six hundred years ago or maybe even older than that but it's not necessarily the best technology today to think about organizing an economy and I think we're seeing a lot of gaps in the functioning of money as a protocol I give a longer talk about this for the summer of protocols which you can check out but let me give you a quick summary so one way to think about it is that really money itself is a zero knowledge proof right so in the in my past history

I make a bunch of transactions maybe I issue an invoice or I get a salary uh and I get some credits maybe I buy something I get kind of a receipt that debits those that that balance right and all my future counterparties don't care what I did to earn money or what I did to spend money all they care is how much money do I have right they want a transitively true proof of you know that it's been properly reflected that all of these exchanges have happened and they can trust my balance right um so money is a kind of zero knowledge proof other way to think about it is that it's a compression technology that decides if you should be done a favor right I want another mango Society give

me a mango what Society does is weighs all my good and bad Deeds right all the things I've done for others and that others have done for me in the past ways them summarize them properly composes those summaries and makes a decision like Saint Peter at the gates you know do I get the next mango right and we've gone through a history of Technologies to do this so um one technology is banking right so maybe we started with a ledger technology paper and pencil then we upgraded that to you know Cobalt databases and we're seeing some problems with this if you know this bank is one of the ones that recently uh was forced to shut down so the bank does this job of collating all my receipts and invoices and deciding you know do I get a yacht or not do I

get a mango or not I get a mango okay then we came up with a decentralized way to do this that didn't depend on the banks also very interesting but in some sense the exact same model right I have a ledger I keep track of the inputs and outputs and if they're my balance is sufficient then I get to buy what I want and we figured out how to program that model right how to make it so that we had programmable money we had Flex more flexible set of infrastructure to um do it but you know there's still a lot of tokens in there right there's still accounting of tokens um and then I'm arguing that we can now do some new stuff with zero knowledge

proofs right with dkml and other Technologies we can make more subtle and sophisticated judgments about this past history right sometimes it feels like just a bank balance or a net worth what you know the technology that the bank does and which has been ported to to crypto kind of unquestioningly isn't the fairest way to weigh my contributions to society and the contributions others have made to me and maybe we need something that's more fair or more stable or more robust right and the interesting thing about this is that not only can we make more intelligent decisions we could do something really crazy which is we can take these numbers here 500 700 we could take all the numbers in

the receipt and we can actually delete them if we wanted to right because we already record all the things that I've done all the transactions that I've done so you could imagine and this is a bit dystopian but you could imagine oh there's an AI and what the AI does it says well here's the list of all the mangoes you ate and here's a list of all the services you provided and based on that I would like to award you a mango or yacht right now that sounds kind of dystopian and it is except that well two things one we already do it but we do it with this one-dimensional summary of our history this bank balance summary and secondly there is this possibility now of making the AI that makes these decisions decentralized right so I don't think that's actually a good

idea but the point again is to kind of stimulate you to think about what might be a good idea so really we're in this world we we're sort of down here in our technology and we're moving up we're moving to a world where there's you know hundreds of millions billions of operations AIS that fit inside of a single proof where there's a billion proofs being computed transactions I think that there's some fundamentally new possibilities in terms of how we organize our economy and our society up in this corner and I hope that you figure out what those are [Applause] [Music] [Applause]

[Music]