Proving Liveness client-side - Oleksandr Kurbatov

Transcript

[Music] Okay, let me check if that works. Yeah, my name is Alex. I'm lead of cryptography at Taro Protocol. I'm going to like make a quick intro how we came to proving something like client side. Uh and then make like a small announcement what we're going to do. The first of all everything started with passports. uh one year and a half ago we introduced zero knowledge passports where you can prove that particular data is included into the passport the signature of the passport is valid and additionally you can make different queries on top of that uh what is good uh there is existing passport

infrastructure so dozens of million passports are issued already uh and you don't need to reinvent the wheel uh you can use the current biometry passport, you can extract the signature, you can extract all the data and transfer that in verifiable manner on chain uh and you can add a privacy with zero knowledge. So for example, you can prove that you're Ukrainian or you're adult Ukrainian but without sharing your name, surname, etc., etc. And that's very good criteria from the real world to web3 applications.

uh what kind of applications first of all yeah um you can prove that you're adult then you can uh be integrated with some KYC services uh for example there can be some policy that allows you to have access only in the case you have a particular citizenship uh additionally you can prove that you are human that's quite controversial because passport doesn't prove you're human uh but government thinks you're human issuing this passport to you. Of course, you can build cyber protection applications you and additional interesting case that sanction list. You can extract the data

from the passport and prove that you are not included into specific for example a list or some blacklist. Uh you can provide different gifts based on the type of the community you're forming. For example, you can provide a free internet for Iranian women and uh do not like know their specific data. You can build different social applications and additionally is very hard to achieve. You can build applications that require uniqueness. Why uniqueness uh is hard to receive? Because first of all, people can have different passwords. So this totally like eligible to have two or

more passports. Uh additionally uh you cannot extract the uniqueness from the passport in the private manner because there is an assumption that government knows everything. So and if you can extract this uniqueness from the passport it means the government can do the same and like reveal your identity. Uh but we launched like a very specific solution. Uh we launched it a freedom tool. Uh what the freedom to lease? Uh that's like a cryptographic solution for political problems. It doesn't resolve political problems but at least it can initiate discussions around them. Uh a lot of people like

think we have built digital voting but I would rather say we have built a digital protest solutions because we cannot extract uniqueness from the passport. But for example, in some applications, you don't need a uniqueness. For example, if you're signing petitions, if you're supporting some protests, if you're doing some social questionaries, you don't need like to have this uniqueness. And we have tested this application in several countries, for example Iran Georgia Russia and etc. Right now, we have a second version in production. uh we allow it everyone to create their own like questionerary

their own pool and uh select the criteria for for the voters. This is completely open source. So you can find that you can fork that and you can launch your own instance. But people ask it how we can resolve one specific problem. The problem is how you can prove that you are an owner of the specific password because somebody can stall it. uh somebody can um I don't know for example government can issue million of passports and vote instead of like real people and we switch it to kind of zkai uh what is that we can prove that the

distance between the picture included into the passport and the scan of your face under particular threshold fault and definitely that's not deterministic algorithm. So that's not digital signature that can be verified directly. That's some like model uh that can be executed with some like prediction uh and but you can calculate like the difference between these two results. So that's not 100% assurance but at least yeah this better than nothing first of all and it increases the cost of attack a lot. So you cannot like just print infinitive number of passports because later you need to prove that right now

passport is used it by the person uh who like matches this criteria. Uh yeah is is the same like um everything should be private. So you shouldn't reveal your like biometry data with some government or trusted issue. You shouldn't like reveal your passport data. So ideally all processes should be executed on your client device and yeah as always we came with uh the framework. So yeah with the password the same story we resolved a particular issue then came with a framework that allows you to fork this like passwords and uh you upgrade them later.

We have built like like the first version of freedom tool for one specific opposition and then extended that for freedom tool version two uh that can be for it by anyone and the same like was with this like zkai. So we came with a framework that allows you to run different models uh like cover it with the K uh on your client devices and we call that Bayonetta. So what's the Bayioneta is? First of all, that's a framework that allows you to build provable models. You can prove the distance between different objects. You can build a classifier that detects a particular object. Yeah. In the world.

uh you can build like the model that detects the livveness of the particular person. The next one what like the main difference from existing frameworks that's architecture of these models and all weights all parameters are open and hardcoded into the circuits. So for example the KDL uh the KML uh log branch etc they are hidden ways in our case. Yeah, first of all you need to have like this provable model because finally it should be verified by the smart contract. In this case you cannot hide uh the specific architectural weights and additionally we found out that it can reduce the amount of constraints

dramatically. So that's R1CS friendly. Uh so right now it works with grow 16 but we are switching to ultra gross. uh we have applied specific like quantization scheme and additionally we did some layer specific optimizations. Yeah. How we have reached the care friendliness? Uh as I mentioned, yeah, Betta has arcs arithmetization and additional hardcoded weights in circuits.

uh and it allowed to reduce the amount of constraints from like 20 million for some models to only one and a half million. Uh like to be clear, you can run some algorithm in the K form on your local device if it's like within one and two million of constraints because it requires like a lot of random access memory. But if you have like this weights in a hard-coded like public form, it means you can do some like linear transformations for free. So all operations with like for example addition and multiplication by the

constant incest cost zero. And this approach allows you to have like very hard models that can be still executed on your local devices. Uh yeah and having a CSS arithmetization bayoneta supports different like zk protocols for example spartan ultra gross um hierx etc etc. So you can provide some tensorflow or pytorch in the future model uh convert that with bayioneta to likews and then prove that on your local device. Um yeah, there are some like activation functions. So you cannot

reduce the amount of constraints for activation functions because they're not like linear. Uh but additionally, you can have some optimizations that allow you to have only like uh n or like 2n constraints for each uh activation layer. And you can see like our comparison table with other well-known frameworks for uh ZKML. Uh why is this client side? First of all like proof size. Uh that's just like six like points. So uh that's gross 16 verification. So that's very cheap verification key the same. It's

like very easy like to generate that proven time. Yeah, it depends on the model actually because the larger the model, the more like resources and time you need for that and verifying time. There also like three parent operations and that's it. Probably from the client side perspective only lranch has like more like more performance solution. But as you can see they have a dramatically like big proof size. It it cannot be verified by the serum natively. You can rub that with for example snarks or like other or with splunks but anyway that's

yeah that's not client side already. We have built different models. For example, we can detect the lioness. As you see, sometimes the model works better than we expected. Uh it can detect if some contact or if some person wasn't generated by some AI. Uh that's that's like a real person etc etc. We can build classifier uh and it can detect if a particular animal in the front of the camera and for example you can program your account the way it cannot it can be recovered with a cat. Additionally you can build the same model for different objects. So

you can create a recovery method for your account that requires not the knowledge of your seat phrase but the knowledge of the specific object. for example, some specific page in some specific book uh etc etc. Uh yeah, you can investigate more how Beta works with the list of resources and yeah uh we're going to like publish everything open source probably I don't know in two three weeks but if you want to check how it works right now yeah please contact me.

What's the next? Um, yeah, we are playing in kind of Harry Potter and we want to like remove seat phrases uh in all wallet solution. How it can be done? As I explained, you can extract the uniqueness from like different objects uh and reuse that as a secret data for your account. So you can derive key materials from like different from from like environment. Uh and right now we're working on fuzz extractors that allows you to receive this uniqueness from from objects. What a fuzzy extractor is this

like some between cryptographically secure hash function and a model that operates with the objects that have like high entropy. Physic structure allows you as I mentioned to receive the uniqueness from like different object and first of all yeah you can prove that and additionally you can recover key material from uh from like any object. We have some intermediate solutions that uh doesn't like compromise the security for access into your account but at the same time you cannot build a fuzzy extractor with like for example 128 bit security. uh but we additionally

applying um other like cryptographic methods to have this 128 bits of security and longterm plan that people shouldn't remember seat phrases. If you have like a secure methods of uh deriving a key materials from like any object you know um it means you cannot lose an access to your account. Um and yeah that's like only early stage of building that but if you want to like have an access to to the repo for example yeah feel free to reach me.

That's it. Thank you very [Applause] much. Thank you so much. Does anyone have any question? Okay. Uh, well, thank you again. Thanks. Oh, there's one. I can ask about the growth construction. Um, we have as far as I remember it has a trusted setup. Yes, it's a trusted setup. So who knows that and how it's generated and do you are you planning to go to plon or should like we can use

plong but yeah potentially but it's you cannot do such optimizations with plunk as I mentioned we applied uh the method that allows you to have all weights publicly hardcoded into the circuits and it leads to all constraints with multiplication and addition. the constant will cause zero. This plunk arithmetization works differently and you cannot reduce this constraints with splunk. So this is the reason why we are using a1cs. Uh so potentially yeah the trusted setup is relevant question for all projects they're like building on uh grow 16. Uh but yeah this procedure can

be decentralized. So yeah I don't see any problem with that. Oh, okay. Thank you so much. Another round of applause for him and see you at half past 3 4. [Music]