ZK9: Scaling Trustless DNN Inference with ZK-SNARKs to GPT, ResNet, and more – Daniel Kang (UIUC)

Transcript

foreign [Music] scaling trustless deep neural network inference with ZK snarks to gbt resnet and Beyond well thank you to anyone let's hear it great thanks for the introduction so thanks everyone for coming to the final Talk of the session I know that this has been a long day and hopefully this talk will leave sometime at the end to allow people to get a good refresh before the before the end and also to answer some questions so today I'll be talking about scaling trustless DNN inference to these larger models including GPT resnets and others

as well uh so if you've been following the news over the past few months you'll probably know that ml is eating the world and will all be unemployed soon so things like chat GPT Bing search and Google bard are becoming increasingly prevalent and also things I'm not mentioning here for example mid-journey and stable diffusion have shown amazing results and so one question I want to focus on today is can we execute machine learning models trustlessly I'll motivate this with a few applications but before that I want to talk about some stuff which I realized after I made the slides this audience probably knows a lot about so I don't really need to cover it but you

know there's a variety of ways to do trustless execution including multi-party computation homomorphic encryption and certain knowledge proofs and obviously we'll focus on the serial knowledge proofs today and so some of the features that are obviously really great is that they can give privacy validity and no interaction but unfortunately they have high compute overheads so I'll describe some techniques and how to reduce this specifically for ML models and also for image edits which is important for certain kinds of applications I'll talk about today also very boring for this particular audience but I just want to be a little bit concrete about what's going on here since I'll use this notation later the prover takes in some private inputs to W and some

public inputs X and produces a proof this proof can then be validated by any verifier after the fact what's also really useful is that these these proofs can be computed after the computation is done which again is very important for certain kinds of applications I'll describe later so I promise I'll motivate the need for executing ml models trustlessly with several applications and I'll first start with trustless audits so why do we care about this well as ml increases in the different uh uses and scenarios we want to be uh sure that the models that we're running uh satisfy some properties

for example for medical ml you might want to ensure that the training data set uh conform to some regulations for example by the FDA or by or some other regulators and also recently Twitter open sourced their algorithm and you might want to ensure things like my timeline isn't biased but of course Twitter has a bunch of private user information that they are not allowed to release for due to regulatory reasons but they still might want to show that certain properties like this so how can we accomplish this with ZK snarks well we'll use two steps the first step here is the proof of training which unfortunately also has two steps

the first thing to do is to commit the training data and so for example you might want to commit to the images you're used that you're using for training a medical ml model and then you can in fact unroll the entire training process one common method of training mm models is using what's called stochastic gradient descent and you can produce ZK snarks of the training process to ensure that the model that can be committed to at the end in a hiding manner is was actually trained on the data that was that you committed to originally then you can compute these Audits trustlessly and in general these audits take the form of a function of the data and the weights

and in particular all of these can be hidden uh using the process I described in the previous slide and as I mentioned there's many different kinds of of audits that you might want to run for example that your data isn't biased for radical ml that your model performs well also for example for medical models and say that your timeline isn't biased and a whole host of other things that consumers might want to know about the models that they're consuming another important type of audit might be that your that your train data doesn't contain any copyright copyrighted images I also want to talk about two other applications before I go into our open

source framework I'll first start with decentralized prompt marketplaces just to give everyone on the same page this there's been a huge boom and generative AI in which you take in some inputs in this particular example it's a an astronaut riding a horse you pass it through some complex model and outcomes an image or a piece of text or audio or some other thing generated by an ml model now this particular prompt is very simple but there's a whole host of other kinds of prompts that you might want to use so let me try to read this cinematic off-center two-shot 35 millimeter film still of a 30 year old French man curly brown hair and a stained beige photos anyway you get the point these prompts

are complicated and in fact require a lot of effort from individuals to create and they're also very valuable now if you try to reverse engineer for example this one you know this is my best attempt at this clearly I'm not very creative but the point I'm trying to make is that these viral images that are generated from these amazing generative AI methods require a lot of effort to create and I want to put a number on this actually prompt Engineers can pay up to 335 000 US dollars per year just to generate these prompts now uh you know I'm not going to make any commentary on this but you might want to uh imagine that there are very valuable things you can do but you might not want

to pay for an entire engineer to do this so instead what you can do is uh produce these what I'll call proof of props so to do this you can take in the inputs which can be hidden as I described earlier in this talk and produce a ZK snark which generates the output now uh one thing that I might want to do is that let's say I want to do some marketing based off of a that looks something like this I can then purchase this prompt which the user can then reveal to me and then I can modify it to set to for my own particular use cases for example I might want to have a diverse set of uh prompts for different kinds of backgrounds to Target to specific demographics and ZK snarks will enable this in a

decentralized manner the last application I want to talk about is trustless biometric authentication and also fighting deep fix and this is the application I'm personally very excited about uh so first what are defects well defects are images or video that modify what a person looks like and specifically for a malicious or for malicious purpose or to spread misinformation I want to contrast this with the harmless forms of generative AI like I showed in the previous slides in the opening session of today zkpot.ai was mentioned and this is an example of a positive use but you could also Imagine taking Anna's voice and

making her say terrible things and you might want to to be sure that you know she doesn't actually uh Adam I want to prove that she didn't actually say these things now unfortunately with the rise of generative AI defects are also on the rise they've these are the things I'm listening here are actual uses of deep fixed that I've been already used today they've been used by state actors to spread misinformation to trick businesses into miswiring funds and even full unsuspecting consumers into being scammed this is one example of ftxcompensation.com which I do not recommend visiting okay so to fight defects I'll there's

many parts of the technology stack that needs to be to do to enable this and one of the things I want to tell you about is these things called a tested cameras now Tesla cameras contain harder devices in them that sign the pixels that come off the sensor immediately upon capture and these in a trusted way and after you have the signature it can a test that it took a specific photo let's say not a deep fake now of course the Tesla sensors are great for this particular uh for this very particular operation but there's unfortunately many things it doesn't help with in many circumstances the taker of the photo wants to edit the images privately

now one obvious example is that you might have this very valuable credit card that you want to crop out before releasing the photo but also even for biometric authentication if you take a photo of yourself say a selfie it might contain extraneous information and you might want to crop down to the specific part that contains your face but also if you want to do this in a privacy preserving way you can't reveal the original image not to address this I developed CK image which can attest to image edit securely and privately and the way this works is that given the signature and the the commitment to the original image ZK image can take the take this as a hidden witness and I'll

put a uh and I'll put the image an edited image that's done using ZK snarks so that the consumer of the photo can verify that the edits were done honestly for example that uh you know I didn't run an AI method that swapped out the face so I mentioned that a Tesla cameras themselves don't solve the problem and neither does just CK image ZK image needs to also be combined with other kinds of Technologies for example decentralized ways of tracking these signatures and so for example you might have a registry which contains the signatures of the original images and the proofs whenever someone wants to consume

the image they can then consult this registry you also might want to attest to multiple edits and in order to do this you have to you might have to use multiple proofs I won't get into the technical details today they're described in our preprint on archive which you can find on my personal website I also want to talk about how to do a trustless face ID using these Technologies so the first thing you do is you can take a photo of your face using a tested camera and you need this to validate that the photo was actually came from The Real World and then you perform some image edits for example cropping the photo to only

contain your face you might also do other things like uh like uh rotating the photo or sharing it to be better for the next step which is to input it to a face ID model and then by combining these steps you can then produce a proof that you say your face embedding matches one of one that you uploaded previously and this can all be done privately without revealing sensitive biometric information to service providers great so now that I've talked about the various applications of zkml I want to talk about the open source framework that I I just released yesterday on what it can enable

so if you look at the Frameworks for zero knowledge proofs for on on some of the prior work all the prior work operates on these unrealistically small images for example on these data sets which are very common in ml like mnist or c410 which are these tiny images which are really used for just toy demonstrations of capabilities and with our framework we can scale this to imagenet which is a realistically a realistic sized data set that's actually used in uh where models of this form are used in production and also other models which I'll briefly mention like GPT and diffusion models like the uh like the generative AI things that I mentioned earlier as well

so in order to produce our framework we uh and produce these Ezekiel snarks in an efficient way we need to make many design choices and this ranges all the way from the ml side straight down to the proving stack and this includes two things the correct architecture these uh the TNN computation efficiently and leveraging the proving system in such a way that you get high efficiency from an architecture perspective we use quantized models and we do it in such a way that the uh we can achieve high accuracy despite doing the quantization I'll briefly talk about this uh later in the talk but just to give you a sync preview of results using our quantization methods you lose something

like 0.02 percent accuracy compared to some other Frameworks and other libraries that lose a lot of accuracy when doing quantization we also have to optimize the Earth monization which is basically how the circuit is laid out and the proving and and use the proving stack efficiently I won't go into the technical details I'm sure if everyone here is tired after a long day of staring at math all day so I'll just briefly talk about what we do we use uh we uh do efficient do the linear layers efficiently using a custom gates with these polynomial constraints the non-linearity is via lookups and we do

some tricks with the fixed Point arithmetic to help be a little bit more efficient compared to adjust doing the operations nicely so to use ekml all you need to do is install rust clone our GitHub repository and run our example and in this example we have an MNS model which achieves 99.5 accuracy and this will actually run on your laptop and it runs in about four seconds which as far as I'm aware is the most efficient proving of an MNS model that it's used over 99 accuracy but in addition to that I also want to talk about the evaluation of our Frameworks ukml on realistic models and

what we'll focus on in particular are these things called mobile Nets which are also used in production in fact many of them are running on your phones today so in our pre in the paper that I uh published on this uh earlier last year we can achieve around 79 accuracy on imagenet with proving times of around 2500 seconds and verification times of around 10 seconds with our open source release we can get uh this has been outdated actually we can get uh 13 higher accuracy six times cheaper proving and 500 times cheaper verification and this is uh and all the applications I described earlier really depend on the efficiency of being able to run these ZK to compute these DK snarks in a

reasonable amount of time and we're working really hard to ensure that this is accessible to everyone not just the most powerful servers in the world now just to give you an example of the improvements let's say you want to use our framework to verify a private model's accuracy these are the class with our previous work but with our new work and this is the cost of proving we can take down the cost of verifying a model's accuracy within one percent to around from around 2500 dollars to about 400 dollars and just put this in context uh for a medical data set in my class around 85 000 to produce the labels for this so

verifying the accuracy is becoming increasingly feasible especially in comparison to the how much training data costs to obtain so as I promised I think we're ending a little bit early so plenty of time for questions but also to relax after the uh the the talk uh but inclusion we're increasingly interacting with digital systems and zero knowledge proofs provide trust in the face of adversaries and this includes four ml models and also against deep fakes we just opened Source a framework yesterday the link is available down here my email is is here and my Twitter is here as well I'm happy to be contacted offline if you have any questions but I also think there's some time for questions now as well thank you

for coming to my talk thank you so much for that talk are there questions thoughts comments and actually if you have a question just put your hand up so I spot you uh hi welcome uh I really all previously printed version and yeah actually I asked questions on the telegram so I'm curious about the Improvement this huge Improvement of the proving time and the graphic time is given by let's say a whole hello to or can buy anything else

you have some specific trick or Improvement on that yeah so the question was about where these improvements come from there's a number of things we did to improve the performance uh so in order for the verification times we switch we allow both IPA and kcg and kdg has much more efficient verification we also have many improvements on the actual authorization of the circuits uh the way that we do the fixed Point arithmetic to increase the accuracy and also some algorithmic improvements on how to do say convolutions and Metric multiplies more efficiently we'll have a blog post detailing all of our improvements in the upcoming weeks so be on the lookout for that I'll announce it on my Twitter and also happy to contact me offline I can provide some more follow-ups as well

ah all right Guillermo you go first so good question you mentioned that you could potentially do um provable training which seems particularly difficult right because approval training requires that you try a bunch of seeds and do a bunch of like different stuff like it's a little bit more of a of a Dark Art than just inference so have you have does this framework currently support like provable training or is this just like a thought exercise at the moment yes the question was do we support approval training uh the answer is yes actually um we have results that unfortunately came in after the slide deadline and

so they're not here but be on the lookout for the blog post um roughly speaking uh so training has many complexities Beyond inference as you mentioned so it's a little bit more difficult with our preliminary results we can achieve nearly the same accuracy as full floating Point 32 Precision using our framework and also at reasonable costs relative to the uh relative to the cost oops relative to the cost of the labels on this data set and be on the lookout for that there's actually if you look hard enough you'll be able to find it in our repository but uh it's not ready for public consumption yet thank you thank you so much for the talk I was

actually also going to ask about training because I read a paper recently and it said that it's you can embed an adversary example in your network and will be undetectable uh but they will always be able to provide an output they would like to get from the network that's why I think training would be very important to be verified if you want to actually use the ZK proof of inference my other question is you mentioned that the loser Precision is very little because of quantization do you have the numbers for GPT because I also know you did gpt2 proven do have numbers of how much of a loss was there all right so there's two questions here the first is about training and planting back doors I believe you're referring to Chaffee Goldwater paper we can avoid

this and like we can literally avoid this through some mechanisms which uh well okay basically once you commit to the training you can do this in a way that the commitment uh the and you can basically base that the data traversal order based off of your commitments in such a way that the trainer cannot uh mess with it so this prevents those kinds of back doors that are specific to that paper um in terms of your other question uh accuracy on GPT uh that is a great question um unfortunately uh accuracy for generative models is much harder to measure for many reasons but if you compare the outputs of uh our uh

framework compared to the outputs of using floating point fp32 so full precision we can we are we have like an error in the vector outputs of maybe like one percent or something uh so it's we don't think that there's going to be a substantial loss in accuracy and we're also actively working to bring this number down as we improve our framework so happy to talk offline about that as well thank you very much great there's a question back there and one over here hello thanks for the talk um I was just wondering in the case of the generated models

where you've got some Randomness that is used to to generate the response is there a way to prove that the that it's truly random value and that the model hasn't been run many many many times or is there a hope of a solution to that yes the question is for generative models there's often or some Randomness that needs to be input to the model and if there are ways to uh to ensure that the verify the randomness wasn't chosen in some adversarial manner uh the answer is uh actually yes although it's not necessarily within our framework there are several things you can do so one thing is that you can use the uh the verified Randomness for example from the ethereum uh uh Beacon chain to uh as inputs to a pseudo random number

generator to generate the random the randomness and you can prove this in a random number and you can do the snarking of the pseudorandom number generator to verify that that you can't um uh that that the producer of the generative output I didn't cheat and when we can do this is you can say okay I'm gonna like you can commit ahead of time that I'm going to use like the randomness From the Block like 1000 blocks from now so it's hard to uh to cheat and there's other ways you can do this as well by using other forms of verified Randomness for example you can hook up to random.org if you trust them and other kinds of techniques as well oh wait there's one up here actually

that was first here oh you're gonna go around in practice how high an assumption is it to trust that the sensor produce authentic data such as face ID or a camera that signs the input yes the question is in practice how much can we trust the tested sensors and this is always a work in progress but I think that as this problem becomes more and more prevalent the the public desire for these kinds of things will increase and so will the security um so you know in some sense there's no way to fully block against physical attacks like if I'm willing to pay

enough money and wait enough time I can get plastic surgery to look like someone else but we want to raise the cost of Performing these kinds of attacks Beyond uh being able to to do this entirely in software and that's the Hope especially as the Technologies Advance as people realize that generative AI can be very dangerous in addition to being very useful see a question over here if there are any last questions just put your hands up now so we get you thanks very much very impressive work um do you have already plans on uh improving for further I mean not to be demanding but maybe recursing or aggregating or or folding even these things you're

thinking about yeah so the question is are there plans to improve uh it's a hard audience over here no sorry um we have we have many plans to improve uh there are things um their their optimizations ranging from the proving stack uh to uh like aggregation for example for training in particular uh to um uh uh optimizations on the Deep neural network level and also just on the basic computer systems level uh to improve the performance of our framework and that's uh in the works I'm happy to chat about the specifics offline uh if you want to get into nitty-gritty technical details perfect seems like that might be our last question thank you so much Daniel

thank you [Applause]