Introducing Bionetta and Client-Side ZKML

Transcript

Okay. Yeah. Hello everybody. Thanks for having me here. Uh my name is Olix. I'm leading cryptography at Raro Protocol. Recently we started providing access to our Bayioneta framework. And I'm going to like to explain what is that. Uh first of all you need like to understand how we came to Bayonetta. We started two years ago with uh verifiable credential aggregation. We started like to provide aggregation for such protocols like polygon ID because we had an issue with isolating users identity on networks uh where initially issuers like created this verifiable credentials. So we have

built a messaging protocol for distributing digital identities over like all existing networks. Uh then we came to idea that if you have some web one and web two data uh sign it by someone you can send that to web three environment in verifiable manner and we implemented zero knowledge passports. So Savio already explained that it's like very easy example. You can prove that some data is included into the passport but without revealing sensitive information and then we have launched several voting solutions to top of that. Uh like to be more accurate we have launched several solutions for digital protests. So you can vote an anonymously without like sharing who you

are but at the same time uh with eligibility criteria. So you can prove that you're Ukrainian, you're adult and sign the petition using this approach. Then we gave a feedback uh and feedback was how you actually can prove that you are an owner of the passport because somebody can steal that somebody can use that instead of you uh I don't know government can issue millions of passports and we need like to have some protection methods of that. So we started like resolving one specific task and then switch it to the framework.

How we have resolved this task. So you cannot prove for 100% like accuracy that you are the same person as defined in your passport. But at the same time you can create a very simple neural network and prove that the distance between vectors derive it from from your face and from the image in the passport uh under particular threshold. So the distance is very close. Uh it's like not 100 assurance but at least it increases the cost of the attack a lot. Uh and additionally you shouldn't share any personal data. So this like verific this like execution of neural network should

happen on your local device with zero knowledge. So you shouldn't like dedicate some picture to some trusted server and receive the feedback or at a station you need like to run this model locally. And that's how we came to Bayoneta framework. what the Bayioneta framework is the first of all it's a framework for creating provable AI models some neural networks and we had uh we had made like a lot of focus on client sightness so you should be able to run different neural networks on your local device and without sharing input data uh like some features architecture in

ways should be open and embedded into the circuits. Why you need that? First of all, if you want to launch some onchain uh application that needs to consume this proofs, uh you need like to set the statement what exactly you're going to verify. In this case, uh your verifier your application should know that like full architecture of the network is used and additional weights. what the weights is like some parameters and you need to set for receiving like more accurate solution.

Uh so in our case if you want like to prove openly that you are the same person like in your passport uh this like verifier contract should know you're proving this specific statement. Uh additionally we have built a 1 CS friendly framework. Um for that we had like one reason uh you if you have like open weights you can hardcode them in R1CS constraints and it means that you can do all linear operations almost for free. So if you use for example some linear regression in your neural network uh and you hardcoded this like parameters to R1

says all like these layers will be almost like zero from proven perspective. uh then like we applied some special quantization scheme I'm not going to like talk a lot about that and we have done some layer specific optimizations including right now we are switching to ultra gross it's like extended growth system extreme with lookup arguments and it allows you to reduce a lot of constraints from different activation functions uh so yeah like short recap was a like neural network is difficult blackbox function. You need to train this neural network with weights.

Uh and when you need like to have some prediction, you're putting some input data uh as a like input function and you will receive the prediction like relating to the statement you want to you want like to prove. And what exactly we can cover with zero knowledge proofs? Um and there are like two different methods. The first of uh the first one is used such like frameworks like deep proof, Ezekiel etc. they are hiding weights. Just imagine that you have uh some dedicated server you want to like prove that the specific neural network worked. uh at the same time the

architecture of this neural network is open but you want to hide appropriate ways because ways is kind of intellectual property because it's like output of your training process uh and for example just imagine there is some financial organization and you want like to provide some data your like credit history then some AI processes this data and returns the result but in provable manner in this case we have a public input, we have like a public architecture but weights are hidden and that's not our case because as I said we need to have onchain verifier that like with hard-coded statement uh

and in bayoneta we have public model public ways and private input data as in the case of the password your like face and your personal data should be hidden from the verifier. So the verifier also only should be able to verify the statement that is valid and you're the same person in the passport. Uh what we did probably the major part was um we developed a custom rust witness generator because circumance couldn't like compile our circuits. So we made like a huge focus on parallelization.

Um, additionally right now what you can do you can use some tensorflow neural networks train them uh compile to circum code and then like prove that as usual one so using I know snarkjs or rapid snark any of them um boom boom boom boom boom yeah probably it okay everyone says mization how I say it that you can reduce a lot of constraints a lot of linear constraints if you hardcoded uh weights in R1CS and additionally we are like we are not limited only by gross 16 so you can use

anyone CS friendly prover for example Spartan or ultra gross or I don't know hierx uh any of them because sometimes the selection of appropriate prover also can affect on reducing constraints in some special activation layers. Uh that's like the list of layers we support right now. Uh so you can implement the majority of cases, the majority of I know neural networks using biona.

Um yeah, some benchmarks we have finished like switching to ultra gross only this week. So that's probably the latest one. uh the fir first column what we have right now model one is like very simple neural network with approximately 80,000 parameters uh model number six has around 2 million parameters and a lot of like activation layers and we can see that for some cases using gross 16 is much like better than using ultra gross but for difficult neural network architectures we uh receive like a dramatic like advantage comparing to our initial version like comparing to

Ezekiel frame framework the KML the proof etc etc uh boom boom boom boom boom yeah proven key um relatively small um when we have implemented the first passport we had approximately 450 megabytes like for proven key right now we are launched like the difficult uh very difficult neural network having only 150 megabytes for proven key and yeah that's doable on client side yeah verification key are pretty small um and probably the main

uh competitor with our framework is like deep proof from uh from lranch because they have very very efficient proer but at the same time the proof size in their case is very large. So it can be for example four megabytes or 5 megabytes for some cases and that's not possible like to verify this proof on chain. So that's not compatible with serum right now. In theory you can convert the verification of GKR with additional I don't know G 16 wrapper or plunk wrapper but uh unfortunately I uh I couldn't find appropriate benchmarks.

Uh so yeah we have implemented several models on top of that for example the model for lineness it tries to detect if you are a human. Yeah you can see that we need to train this model more because sometimes it works better than we expected. Uh we played with like classifier and additionally implemented a wallet that can be unlocked by any cat in the world. Uh, additionally, you can build a model that recognizes a specific object, a specific physical object, uh, extracts the unique distinguished points from this object. And in this case, you can recover your account only with the knowledge of this specific object. Uh,

and it could be better than seat phrases. Uh, yeah, several resources. Uh we additionally like implemented a demo of like airdrop for all humans. Uh it like works in browser right now. You can play with mist. So that's like a test vector for handdigit numbers and you can just draw the number and prove like this execution trace. Uh what is next?

The first of all finishing ultra gross because we didn't uh test that yet for very very large difficult models. Uh next one switching to nor like for improving development experience. Uh still it will not be friendly with Splunk. Uh but we are finishing a translator from 1CS. So you will be able to like written uh to write codes in nor compile that to run CSS and proof with bayonet. Then we are finishing front end and mobile SDK. So yeah you can integrate this model in your application different libraries with models uh

mobile exploration. Yeah recently we started working with inyama and they provided like a very efficient prover for grow 16. Uh right now we are working on like integrating ultra gross with their hardware acceleration not not hardware software acceleration and the next one yeah probably we started with tensorflow but definitely the majority of AI developers use PyTorch right now so we need to support that is I don't know when but that's our next step yes that's it feel free to reach me if you have any questions I will Try to answer.

[Applause] Thank you for the talk. Um curious what was the hardest part throughout the I guess entire development or the exploration that you went through if you have to pick one. uh probably the hardest part and probably additional disadvantage that's the time you need right now to generate a witness a compile initial model. One more disadvantage is uh as we working with ultra gross and gross 16 right now we need to have a per circuit setup for

each model. uh and yeah additional setup additional additional trusted quorum. Uh so there are like more secure problems with security that it could be uh with the plunk for example or with starks. Uh but anyway yeah probably this one or major ones good. Yeah. Thank you again. [Applause]