An introduction to Zero-Knowledge Machine Learning / Dcbuilder.eth

Transcript

[Applause] hello hello okay let me just grab the clicker real quick all right um so hello hello I'm um DC Builder I'm a research engineer and I work at worldcoin on the protocol team um so my day-to-day I usually spend it working on applied cryptography um some distributed systems engineering solidity rust things around that nature and recently or for the past few months I've been doing some research around the topic called zero knowledge machine learning zkml and so it's it's a really early stage technology that might have a lot of useful applications in the domain of blockchains and since it's really early on I just wanted to give like an

introductory talk that sort of explains what it is what you can what you can't do where the state of the art is what you can what tools you can use to sort of do a zkml and and yeah just just give a brief introduction into what what the topic is all about um the clicker is not working for some reason so it's the clicker it's not working all right that's good yeah so first let me boil down zkml into its two constituents so first we have ZK as you heard in the previous talk um ZK is sort of this um piece of cryptography that allows you

to essentially prove that some computation happened correctly and you can also hide parts of this computation so the the workflow is that you have some computer they do some computation they generate a proof that that computation happened and any verifier can verify the the correctness of that computation so in the context of ml right um all right goodness goes back oh it works the opposite way okay never mind um yeah so in the context of ml so ml what is ml right so a machine learning is a sort of group of algorithms where you have some form of goal or task you want to solve and you create a sort of

heuristic solution for your your task by heuristic I mean just a good enough approximation the way you achieve these approximations is by using several algorithms that sort of um have statistical learning in some way or another right you have these sort of like neural networks if you've heard of them they're able to sort of get trained on lots and lots of data and lots and lots of examples and they're able to sort of learn how to solve a specific task based on like either like reinforcement learning where they like ask a specific rating mechanism to rate their task uh solution and they essentially get better over time so in the context of ml like the problems you're usually solving are like classification regression like you're

trying to solve some form of optimization for some sort of problem on and the the the reason why um ZK is useful for this is you're essentially able to prove these ml algorithms end to end you're essentially able to prove that hey if I have some input and I feed it into some model I can get an output and I can prove that all of this happened correctly so for example I can tell I can say to my friends hey I have computed this model on this specific um on the specific input and I have this output right so let's say I have a model that is able to discern between a dogger and a cat so I can just feed it an image of a dog or a cat it has some output it tells me hey this is a cat and I can

prove to anyone that I did indeed to this computation so they don't have to run the model they can just trust me because they can verify that you're knowledge proof right so why why is your knowledge um so it's your knowledge what it the main properties that zero knowledge gives you that's useful in the context of machine learning is verifiability of execution so you know like usually um when you're using any ml algorithms let's say through an API right through like a programming interface um you go to like let's say the openai website you go to the open AI website and they have a model for example whisper whisper is a model that does transcription for audio but the API is very block boxy you don't really know whether open AI is indeed running

whisper on those servers you're just trusting them as an intermediary that hey you did indeed run with burn my algorithm and you trust because you're paying for some service and you have some legal agreement and they cannot cheat you out of it however there's no mathematical proof that they're actually running whisper they might be running a much like lower or like a worse model on the back end and just tell you that it's whisper on the front end and you would have no way to know it so for this sort of use case that's where verifiability comes into play right and very ability of execution comes from the properties of zero knowledge cryptography of completeness and soundness another part of ZK that's useful is the zero knowledge part um so zero knowledge essentially means that

you're able to proof a the correctness of a statement without revealing any information besides the statement um so a sort of good intuition for this is I can prove to you that I computed some model but I can hide the weights of that model so I can I can tell you hey my model has X accuracy on some test data set like for example it has more than 99 accuracy without revealing the weights of my model so that's also useful in some contexts and when we're talking about zkml we're usually talking about proof of Interest right you might have heard of model training right like training models you've heard like the companies like Google meta and all of

these companies have huge co-located data centers that they train machine learning models for years on end to like try to get the best performance and have the biggest models and whatnot so this this type of computation is really expensive and it takes a long time to compute and zero knowledge cryptography only adds more computation it has an overhead of about 100 to a million x depends on like which computations you're trying to prove by overhead I mean that it's about let's say like a thousand to a million times more computational expense to computer proof then just run the computation yourself however to verify the proof it's a lot easier than to actually compute the computation that's the the reason why why zero knowledge groups are useful for

example in the context of blockchains right you can just run some transactions off chain you can create a proof and you can verify the machine and update the state of the network without having to for everyone to re-execute those transactions so since proof of training would be two two computationally intensive the only thing that's currently feasible and for the first people future is proof of inference just evaluating a already trained model on some input to get some output so this is sort of like a simple Venn diagram to um essentially combine like essentially it combines different Primitives and constituents in order to like explain sort of how zkml or like what properties dkml has um so we have three on the top one the

yellow circle is computational integrity this this is the computational correctness or verifiability I can verify that some computation happened correctly uh the bottom left the blue one is privacy um privacy as I as I said this stems from the property of zero knowledge and heuristic optimization this is what I just essentially you can think of it as just ml um heuristic optimization just means that um you're trying to optimize a problem for which there's no perfect solution you're only giving approximations an approximation you can think of as a heuristic uh and so if you combine all three of those you get zkml in the middle if you only combine computational integrity and privacy you get traditional ZK right what we used in the context of blockchains to verify

transaction execution or do private transactions let's say zcash um if you only do computation Target integrity and heuristic optimization you get validity ml this essentially means that you're proving that some machine learning model ran correctly but you're not hiding any parts of the computation and the the last one that I didn't mention is if you combine privacy and heuristic optimization or ml you get this sort of field called fully homomorphic encryption machine learning uh fully home morphing encryption is a different type or different primitive within cryptography that allows you to do slightly different things um and essentially the difference is fully homomorphic encryption allows you to encrypt some data perform some

computation on that encrypted data and then decrypt it so that essentially means that you're able to do computations on private data and the the the computer that's performing the computations on the private data never gets to learn what the original input was so you can do private computation however you don't have the computational Integrity from zero knowledge cryptography so here I just have like some simple definitions of what I just talked about um and use cases right like you might be wondering okay like this is a cool technology but what are the actual applications for for any others so um the the validity property of zero knowledge right on the the one that

allows you to verify that some computation happened correctly is I in my opinion is the most useful property out of ZK that's useful in the context of ml so the first one that I have listed is machine learning as a service transparency this is the example I mentioned in the beginning where instead of you trusting openai to give you some model you can request the openai um theme or the the API to give you a proof that they're actually running the model that they say they're running if they give you a proof alongside with the output you can have cryptographic verifiability that they ran some model that the the ran the model that they're claiming they they have and this can work for any context another one is verifiable on-chain

classifiers or regressors um that should just say essentially bring ML on chain right so machine learning is very computational intensive and blockchains are very computationally constrained right we have ethereum with like 15 30 transactions per second each block has about 30 million gas with the AP 1559 and the computations you can put into it is very very slow right so like you cannot you cannot really do ML on chain even on l2s um today is really hard right so where ZK is good is that instead of doing the computation on chain you can do the ml computation off chain do a zero knowledge proof and just verify it on chain and you can bring those results so you can build applications that use ml um without having to actually do the

computations on chain which which brings a whole set of new possible use cases um so if one good example of this that I've heard of in the recent months is that for example yearn who is a or that is a D5 protocol that does yield aggregation right essentially trying to find which D5 protocols can give me the best yield on some sort of assets that I provided um so some of these strategies are fairly complex but if you do if you want to do a strategy that's um that has or involves some form of ml optimization then you cannot do it on chain so how do you prove that you're indeed running some strategy um on chain is through essentially doing the proof of the ml algorithm off chain

um do a proof send it to to the chain verify it and then do some computations with it right like run the strategy uh that you say that you are running um another one is the normal infection or fraud prevention um so there is a few startups in the blockchain ecosystem that are trying to use ml to detect threats security threats in this case right whether you see some like malicious transactions or some anomaly right like you have some you can train a model to like sort of um learn what normal is like the normal day-to-day of a protocol right like there's some transactions that happen and some D5 protocol these are the balances and the reserves of the amm pool for example and there's some like weird transaction where somebody exploits the entire like thing so you can essentially do something like that

so in order to prevent attacks right instead of instead of having to be reactive to some exploit if someone detects an anomaly the protocol can be instantly Frozen if you provided a proof that an agreed-upon model found a something that might be potentially risky in this case um in the context of ZK so now like just zero knowledge you're hiding parts of the ml computation so one one good use case is the centralized kaggle uh kaggle is this machine learning competition um platform where essentially if you are a company that you want to have a problem solved using ml you can post a cal competition with some price attached to it and different people will try to compete and get that price by submitting

the winning bid and the winning algorithm so the way it works is that you a company gives money to kaggle and creates the competition a user wins that competition and when they win it kago essentially exchanges the money uh from from the one that created the competition to the user and the user gives the algorithm that they created to the company that posted the the competition so this has the trusted intermediary it being kaggle itself the platform however if you use zkml what you could do is you can prove that your model has more than x accuracy on some test data which is how you essentially measure what is the best solution so if you prove that you have the best

solution using ZK you don't have to reveal your model you can just hide your model you can just prove that you have some form of accuracy once you prove that you can claim the price that was associated with with the competition and you automatically reveal the model that you've previously committed to um so you can do essentially these cryptographic games where you can like hide something and then show it on if you win some form of price um inference on private and sensitive data um so essentially there's a lot of different types of sensitive data that you might not want to reveal to some form of verifier so you can create a proof that you run some model on some private data and the verifier does not learn anything about the data you run it on but you know that it is some form of

like data that they wanted to to have some evaluation on top of um this might like have use cases in the medical field let's say that you want to classify whether some image of a cancer cell is malignant or not right so you can prove to someone that hey this is malignant without revealing who or like which original image it was essentially hide any sensitive data that you might want um so I work at worldcoin um which is a privacy preserving proof of personhood protocol or um yeah that's worldly and so essentially um there's like a lot of different challenges that we're facing one of which is that we are building hardware and when you're building Hardware is sometimes hard to essentially give good

user experience for people and then in this context um when you go to our piece of Hardware which is an iris biometric scanner it essentially generates an encoding of the randomness of the human Iris which is called an iris code and so if we ever update the model for generating these Iris codes you would essentially have to go to this Hardware device again right and these Hardware devices are like spread out to different countries and you have to like go to the same place physically get onboarded again and regenerate a new Iris code because if we update the model the previous Iris code is not no longer valid so a good use case for zkml in this case is that if the user keeps essentially an image from the orb stored on their local device on

their encrypted storage let's say on their iPhone they could regenerate their Iris code using zkml right like they just download the new model they download the approver for that specific model they compute a new um Iris code locally on their phone and they submit a proof to the protocol right which is an on-chain smart contract they submit a proof that hey I've computed a new Iris code and this is the proof that I computed it correctly with the new model so that's one use case another one is making the orb more trustless or more transparent so this Hardware device we call it the orb for context essentially there's a lot of execution that happens on the orb a lot of like computation and um since it's a piece of Hardware

currently the way that we enforce that some computations are happening is through a trusted execution environment atee and currently like like a te is not very transparent it just enforces that some like some computations that you specify are indeed happening however to the outside user to the outside Observer you don't really know what's actually happening on the hardware so for example we can commit to some form of code that's public and open source and we'll be able to essentially create a proof that hey we did indeed like this code that's public and open source didn't read did indeed run within the hardware device um another one is two-factor authentication so for example let's say that when you get a world ID which is

essentially this um without getting into much detail is is this essentially private public key pair that allows you to proof that you're a unique person without revealing who you are using is your knowledge right so you just proof that you have a unique World ID which is this um sort of unique identifier or passport that essentially represents uniqueness or can prove uniqueness um without revealing who you are and the cool part of this is that if you let's say wanna like do 2fa you can have an image of yourself stored on your own phone and you could essentially map that image to that specific Iris code and you could essentially do two-factor authentication using ZK and the way that you do this matching is using ml so that's like where zkml might be

potentially useful and so like all these three use cases are like the original reasons why I originally got into into zkml there's a lot of different projects building on top of it so I suggest you read up more so I'm going to be showing you a few links so there's three links here uh QR codes the first one is the zkml community is just a telegram group where a bunch of people that are interested in zkml can talk about different things around zkml whether it's new research papers from the ZK side or ml side or the combination of both to like new code bases new tools new use cases new applications you might be able to build events that happen where people from the zkml community are at where you can

discuss it essentially like the shelling point for where you can talk and discuss anything about ckml the middle one is awesome zkml it's essentially a GitHub repo with a readme or like a markdown file a text file with a list of resources that I put together about the different zkml things so if you want to learn more in Deep dive right like this is a very introductory talk I'm happy to answer questions now but um essentially it's just combines or Aggregates all the resources that I found on the internet about zkml whether it's blog posts podcasts whether it's code bases tools people that are interested in it so if you want to reach out to them you can all these sorts of things

and the third one is so every single conference every single time I give this talk um I usually give a sort of shout out to one of my favorite articles that recently came out so the latest one that I recently read is from 1kx and they wrote this like really in-depth blog post a lot more in depth than this specific talk so if you want to like get jumped into like jump jump into what zkml is all about and learn more than this introductory talk I recommend you read the the article on the right okay so thank you that's everything for me and I'm happy to take questions [Applause] nope

does this work yeah hello hello yeah thank you for the Doug so quick question um do you have knowledge of current real implementation of ckml working in and what is the overheads that you have seen that you mentioned like a thousand times lower for training but I don't know if you talk about overheads on on inference yeah 100 so the current tooling um at least like there's several companies building different types of tools uh in terms of just generating a proof of any arbitrary computation so the way that most companies or most projects are approaching this is that

you have some machine learning model um in a library let's say tensorflow Keras pytorch um there's this standardized interpretation of these machine learning models it's called onnx it's a standardized format that any of these essentially Frameworks can export to on an X stands for open neural network exchange and so essentially what these tools to create zero knowledge proofs of these models what they do is that they take the on an X format or the representation of a model and they transpile it into a zero knowledge circuit so they create a circuit representation for every single type of computation that's represented inside of this onnx representation and then they generate a proof so the tools or

currently I think the tool that's most flexible for any given user to use is called Ezekiel um I'm happy to share your link or if you if you just go back to the uh maybe the transition is not there anymore but if you scan the middle QR code the awesome zkml one you just scroll down to code bases Ezekiel and it essentially is a rust tool that creates a proof of on the next file uh using the the Halo 2 um proving system um the Privacy scaling Expressions group work like the one that like scroll is using and the one that like many projects are using so essentially creates a zero launch proof using Halo 2. and in terms of the overhead um it changes every single month because they constantly do like changes and PRS

I think right now I wouldn't want to guess I think it's like still around 1000x overhead but things I've heard from Jason one of the um co-authors of Ezekiel uh is that they are already starting to be able to prove models in the sizes of 100 million plus parameters and it takes um I think like five minutes on a really big AWS server with like lots of ram lots of lots of Graphics yeah thanks DC uh just one last question please uh so uh how do you think that zkml

differentiates or is better in terms of privacy as compared to probably ml inside a trusted execution environment I mean in terms of uh computation obviously it requires hardware and zkml doesn't but in terms of privacy how would you compare it yeah so running ml inside of a trusted execution environment it gives you some form of guarantee that it's ran correctly within that specific Hardware but if you want to verify that computation outside of that piece of Hardware it's impossible right so the the first thing is just like you cannot do on-chain ml because it's it's in order for that to work you'd have to

trust that some node has some trusted execution environment like that it just doesn't add up right like you don't really have the guarantees what DK provides you is the guarantees that some execution happened correctly um which trust the execution environments do not they only guarantee you that some form of computation wasn't tampered with um within the specific device but outside of that environment you have no guarantees that that is actually what happened yeah foreign [Music]