Laurence Kirk - Private Machine Learning with zkML

Hello everyone. I'm Lawrence from Extropy. Thank you for coming to this talk. Thank you for the organizers for inviting me. Uh before I start, I'll just explain my t-shirt because people do ask.

Uh this is my emergency maths t-shirt. In case of emergency, I need some maths. I just look down and read the read the equations. Uh I have them there. Okay.

But today I'm going to be talking about uh ZKML. And what is this? Um, two different areas, CK and machine learning. You could just see this, maybe you're thinking this is just going to be a combination of two buzzwords. Well, that's not the case.

It is a useful field in its own right. And it's uh the combination of zero knowledge proofs and machine learning. Why we want to do this is that if we have some machine learning, we want to be able to prove that this has been calculated correctly. But we want to be able to do that with zero knowledge which means we have privacy added to the process as well. The some of the terms you need to know uh inference in machine learning inference is where we run forwards through a model.

So this is the thing you do every day when you use a large language model. You put in a prompt and it does the the inference stage and it comes with at with some output. We want to be able to show that that was done correctly. We'd be nice if we could have private inputs. So you So when you're using chat GPT, etc.

these they're not private inputs. They, you know, they're they're being sent off. They're they're public. But with ZKML, it makes it possible for people to uh do private computation and have it uh checked and and proven to be correct. And then of course we know that ZK has been used very successfully on chain as well.

We can create proofs offchain and then put a proof of the computation on chain. That's the basis of a lot of the rollup technology. Okay. So I'm doing this assuming you know uh you have no experience of ZK or ML. Just going to talk quickly about ZK.

I'm sorry this is not very big but I think you've got some screens there. So uh in CK what we do we we have some kind of computation we want to do and we turn this into what is called a circuit. Uh and this can get then get compiled into some type of representation and there is a a kind of a setup that goes on. This results in two summaries of the setup a proving key and a verification key. And that is then once we've done that setup, we have everything we need to then start to create proofs.

So when we want to create a proof, we can put in the inputs to the proof. This is called the witness generation. The the inputs then go to a prover and there may be some public inputs as well. You don't have to only have private inputs. Uh but then the prover can create a proof of the computation, can send that to a verifier.

The verifier uses their summary of the setup which is called the verification key and they can easily verify that that computation was done correctly. And one important aspect of this is that it has to be what is called succinct. When the verifier is proving that the computation was done correctly, he could of course just run the verifi run the computation himself, but we don't want that because that could potentially take a long time. So that is the point of the the succinctness of the proof. He could prove something say in milliseconds that is a computation that would take you know any long any amount of time to actually compute machine learning.

So uh in machine learning we uh there are different ways to do it but one of the very popular approaches is using neural networks. These are based on something called a a an artificial neuron. uh what we have with those is a number of inputs coming into the neuron and these are adjusted according to weights. Okay. Uh those are then added together.

We then pass it through something called a threshold function which decides what the neuron is going to do. Is it going to give an output depending on the inputs it's received? Uh and then that output will go to another neuron. And okay, I don't have a slide to show this. Uh we don't do these sort of you know individually.

We don't just have one neuron. We have uh these in layers. Uh and we have many many layers. And the the models that the large language models etc will be hundreds and hundreds of layers deep. And this is called deep learning.

So there are the thing you need to remember about this. We have lots of neurons but also we have lots of weights as well. Uh there are also other things called biases but I haven't got these on the diagram but what I want to to get across is that the uh that there's a lot of configuration that goes into this. So this is the inference stage. This is when the the model we're using has been trained.

So when you're using a large language model, this is what is is happening. You're putting your inputs in your prompt. It goes through all these neurons and it gives you an output. It generates some text. But before it can do that, it needs to be trained.

The uh and the training consists of setting up these weights. We we start off effectively with a a kind of a blank model and we do the training aspect which takes that model and then configures it so that it can do something useful. that training aspect is uh very computationally expensive and what I'm going to be talking about mostly in ZKML is proving that the inference stage is working correctly. It's it's less computationally intensive. So why what would we do?

How would we use ZKML? Uh you know what's the the typical use case for this? Well, imagine that you uh want to use some machine learning. You've got some input. You want to have something done with that input.

And it could be I mean it could be like a large language model, some text, but it could be something more specific. It could be perhaps something that has some privacy involved. Maybe you've got some medical data and you want to send it off to be analyzed by some machine learning model. So, uh you may want your input to that model to be private. you don't want to share that medical data.

So what what will happen is you will send that off to some provider, somebody who's going to do the inference stage for you, run your your input through a model that will depend upon the uh your input X and then the weights the the model has these weights this this configuration of the model this produces some output O and also a proof. So we're producing the output that you want. This the medical data has been analyzed and it says uh yes this this shows that this this particular thing is okay but also it creates a proof to say not only do you have the output but we have a proof that that was calculated correctly and we have a proof that it was done on a particular model. And so your machine learning consumer uh then gets back both pieces. So it gets back uh the output it wants but also the proof that everything uh worked correctly and it proof that a particular model was used.

I mean you could have sent off your input to some con uh some provider thinking they're going to use their most expensive up-to-ate model only for them to use something else. So this is why you would like a proof. Okay. So yeah that's the first uh one use case I've just shown that the sort of idea of privacy other things media authenticity so recently I mean since large language models etc came out we have the ability to create fakes we have the ability to create fake images uh we can certainly generate text easily we can generate audio uh uh fake audio as well so what is uh useful about ZKML well is that we can then use that to try to prove the the origin of media. So this has been done for example uh with a with a microphone where the microphone where the microphone takes uh an input.

It uh will then create a proof uh of what that that input is. And then what it allows you to do is to transform that input. So similarly with what's just happened here with this microphone, my voice sounded in one way. Now it sounds different. There's kind of a a transformation of the sound.

We can do that with uh with ZKML. We could take that original audio, transform it, say to remove background noise, and then we can prove that that transformation is all that was done. We didn't actually change the original input so that the person appears to be saying something else. we just filtered out some noise. Okay.

Uh the next point here, this EIP, this is for uh people who want to generate uh images, for example, for NFTTS. And uh it's a way to then prove that the the prompt they sent in to to generate the image was actually the the correct one that was actually used and the the way that the image generated was done correctly. So therefore when you get the NFT you also get a proof that that was generated in the correct way. Uh other uh possibilities uh in games if we have uh agents playing games but they're using some type of machine learning for intelligence we could have some proof that that was that was done correctly. So maybe you've got you're playing against uh some character in a game and it's claimed that they have a certain ability, but of course, you know, the the uh the design of the game could cheat and make it uh give them more ability than they claim.

Well, with ZKML, we could prove uh what what model was used uh and uh prove that the inputs to that model uh were correct, that maybe they didn't have extra information about the game. um identity and biometrics. Um I don't think they they've been here, but there's a a company called uh Worldcoin or or World ID or I think just worlds now uh who give you an identity on chain. And what they do, they have special hardware that will scan your retina uh and it will produce an identity for you. But of course, if you're going to do this, you'll be worried about that biometric information being leaked.

So what they say is that that information will be computed into this identity. A proof is created to show that's done correctly. But that proof is all that is needed. The actual original biometric information can then be discarded. Uh now I've already spoken about the uh medical data.

Uh why would we want privacy? Well, uh yeah, we may have uh important business information involved in some input so that we we don't want to leak. Um also the model itself when when somebody trains a large language model there's a lot that takes a lot of time there's a lot of cost that that configuration is very valuable. So maybe you don't want that information to become public. So again ZKML can be used in that sense.

It can be used to show uh that some inference was done uh but without giving away details of the configuration of the model. Okay. So uh the question you know could we do everything privately? Well of of course we could we could run our model privately. We could do all the calculations privately but there are disadvantages to that.

Uh first of all there's the the cost. uh it may be very difficult for people to use uh very large models to train them etc. But also we may want to be able to learn from other models. Uh and this um for example is there's a a field called federated uh machine learning uh which allows uh models to to share uh or to learn from each other and to to do their training collaboratively but without giving away private data. Okay, there's world ID that I was saying about getting your your retina scanned.

That's the uh uh the hardware they use. It's called the orb. This one um this is an an example. This is for verifying that uh weapons, nuclear weapons have been decommissioned. So this slide I got from Los Alamus Laboratories.

What it uh is useful for showing and I don't know why Darth Vader is there. Uh what's useful for showing is that they're using a number of different techniques to show that the final result is correct. So they've got information coming in. They got video information coming in. They've got a neural network running.

So they want to be able to prove that that was working correctly. They want a signature being involved. So all of this needs to be combined to create a proof that can be given to someone to verify but without giving away secret information and sensitive military information. Okay, I'm going to skip through this I think. Uh so this all sounds great and zero knowledge proofs uh they prove computation in a general sense and so uh machine learning is just computation.

So it should be a piece of cake then just to combine the two uh shouldn't it? We should just be able to prove computation of machine learning as we can prove any other computation. uh unfortunately not uh and there's a big fun there's a fundamental problem a fundamental disconnect between the two areas of technology and this is down to the the types of maths that is being used the uh the underlying maths between these technologies. So in machine learning these weights that I mentioned these are floatingoint numbers and we do lots of calculations uh we we use matrices uh and we are multiplying and adding these things together lots of yeah lots of floatingoint calculations. Zero noise proofs uh at the moment rely on integers only.

So they're built upon finite fields of integers and these so these two technologies don't easily fit together. The the two base the underlying mathematics for the two doesn't fit together easily because we have the these different types of numbers that are being used. So ZK it's difficult for that to use floating points. Uh and then for machine learning they want to use floating points because you get lots of precision. you don't want to just have integers involved.

Uh the way that ZK works is that we start with some program or maybe that's some model and we convert it into what is called a circuit. Okay. Um that is is difficult to do with the the types of uh machine learning models that we have. Um, also there's just the general area that these both of these areas are fairly complex and so it's difficult to to combine the two areas easily. There's not a lot of experience uh across these two areas.

And then uh a float a final point um is about determinism. So zero noise proofs are uh need determinism. They need to know that if you put in a certain input to some computation that is always going to produce the same output. With machine learning although you you can have that they can be completely deterministic. What you often get is that randomness is added and this uh helps with with things like generation of text and generation of images.

And you will see this if you say if you want to have an image, if you put in the same prompt to an image generator, it will produce different images over time. They're slightly different, but they they are different. And Z the ZK aspect wouldn't like that. It would see this uh as being uh it would see that as being false that the proofs wouldn't match because we have different computation going on each time. So that's a another problem.

So you can see there are quite a few difficulties we have trying to get these two things together. Uh so if we wanted to to do this though if we want to model uh a neural network if we wanted to make that so that it's usable in ZK can we do that? Well, even though they do actually look similar. So the the architecture of a neural network and the arithmetic circuits that we have in zero knowledge do look similar. Um it is they're difficult to map directly.

If we took a very naive approach, what we would find is that the the time taken to to do anything on the ZK side would just be prohibitive. So we have to sort of think of some uh some clever tricks to do that. But there are uh there are companies around that uh have managed to do some of this and and get some success. So uh there's one library called ZKML rather confusingly but uh that's from Daniel Kang and he's done things around things like media authenticity. Uh one of the most used libraries is uh Ezekiel and this allows you to uh develop a machine learning model and you can do this using the traditional machine learning tools such as TensorFlow or PyTorch whatever and then you you turn that into a standard format uh what is called an onyx format and then Ezekiel can take that and create a proof from that and I don't know how many people here are are developers and want to uh develop on this.

But uh my advice at the moment I think would be if you you want to do something uh relatively easy and want to use something that uh works and has been around for a while, Ezekiel is quite a good choice there. Risk zero uh is is slightly different approach because this is a way of uh doing computation and then and proving it and uh it's it it allows any kind of computation. it's which means that you can also do machine learning with that and people have done this but again uh you really do need optimization when you're trying to do CQML so it doesn't naturally fit fit together very well if people are aware of the Mina blockchain uh they have their own version uh their own library called Mina Zkml uh which uh takes an approach which I think could be promising so Mina is all about recursion in proofs you can uh take a proof and then uh take a proof that that that proof was correct and and so on. You can recurse through proofs. So the the uh what this could offer us is when we have a neural network that is built of many layers, we could recurse through these layers.

So you're splitting the the problem of the computation into smaller pieces and then producing smaller proofs which can then build up into an overall proof. The final one here uh so check and GKR these are aspects of or ways and techniques of producing zero knowledge proofs uh and the they were kind of overtaken they've been around uh for around 20 years they they were kind of overtaken by other techniques but then more recently they've been picked up again because they do work quite well uh with machine learning and Modulus Labs is a company that has uh has worked has used these quite successfully. Uh so there yeah that's Ezekiel. Um go to that. Um I think I've explained uh all of that.

The basic point about this without going into the uh the details is that excuse me uh we when we're doing this we do need to use special techniques and special workounds to to try to get it uh to work efficiently. Now the uh the thing here quantization this is an idea that you can use with machine learning. So in machine learning we've got these weights. We're going to be doing computations. We're going to be adding these weights together multiplying them by the input etc.

And that is problematic for ZK. So one thing you can do is you can turn these weights these floating point numbers into integers. you can just multiply them up until you get an integer. Obviously, you have to remember how much you multiplied them by, but that is possible. You can get an integer representation.

Um that's that will work. The problem it gives though is that we need to do this you know at all stages of the computation. So it adds an extra overhead. Um but that is a technique that that people have used. The other idea as well is to reduce the precision.

So if we have a a 64-bit uh uh floating point number that we're going to use as a weight for example, we could try reducing the precision and representing it as a 32bit. And this this does work. You can reduce the precision down and down and machine learning will still work but it will degrade. As you reduce the precision the the effect uh the uh accuracy and the the sophistication of what the model produces will reduce. So it's you can only go so far with that approach.

The other thing that uh Ezekiel does is uh it uses things called lockup tables. So this again is a technique that is used in zero knowledge proofs where in in zero knowledge certain uh computations are expensive and uh they you could do these in a very standard way but a cheaper way to do them is to use things called lookup tables where we put all possible uh outputs into a table and then we rather than calculating so this is done ahead of time rather than calculating the result uh we just provide a result and then say well is this in the table and if it's in the table then we can say well that that proves uh that this is correct to some extent. So this is a general technique in uh in CK that has worked well and Ezekiel also used this. Um yeah so this uh this shows the approach that that Mina have taken. Really this is just repeating uh what we do in a neural network.

We have matrix multiplications. A relu is a an activation function. This is very just standard machine learning uh operations. Um but you can see here they they add extra things to this such as doing uh range checks. They're checking that the outputs are within a particular range uh which you can then have as part of your your proof.

Uh as I said uh GKR has been uh has proved to be quite successful. Uh it's this is because the really the the way that it works does model a neural network quite well and it's it's quite easily to take something like a neural network which has many layers and we're summing uh from one layer to the next uh and we can quite easily use that with the GKR style of ZK uh to create a proof. it it fits much more easily than some more recent uh ZK approaches. And the the basis of this is something called the sum check protocol which is just a a cryptographic technique um that that is found to be useful. So uh I said modulus labs uh have used this this uh this came from uh an image about uh well about 18 months ago now I think.

Um so so far I've been saying you know ZKML is hard. We can't prove things very easily. Uh everything is is too expensive to do with ZK. Uh so that's kind of the the top image here. But then what they did is they took chat GPT2 now.

Okay, you know we're we're a few versions ahead of that now. But that that version of a large language model that had uh just over a billion parameters and that was seen uh as uh really something of u something to aim for. Uh if you could get over a billion parameters and prod produce a proof of that that would be quite an achievement. Uh and that's what they managed to do. So they uh took uh an in a prompt put it through chat GPT2 and got the output and then they also created a proof that that had been done correctly.

Now uh that sounds great uh and it is good. It was it was a milestone and you know it's it's useful that that's happened. Uh the the small print though is that the the uh the setup uh for this for the ZK side uh took 90 hours to do. Uh and the proof also took 90 hours to do. So it's not the kind of thing we can easily use uh if we want to prove you know we we've done a prompt and it came out correctly.

You wouldn't want to wait 90 hours for the proof that that was correct. But still it was we we've passed a milestone here. Here we got over a billion parameters. Um, of course the latest large language models are you know hundreds of billions trillions of parameters but we are moving in the right direction. Uh so other uh techniques so there's a project called ZK LLM.

So ZK large language model. Uh so again they they are taking the approach of we need to do special techniques. We we can't do vanilla zk. we have to do special things and tweak the way that we do things. And so they use lookup arguments, lookup tables as well.

They also have specialized activation functions. So those those functions I spoke about in the neuron that decide what output is going to come out. Uh they've written special versions of those that will work better in ZK. Uh ZK uh attention as well. This is because the large language models are based on a what's called the transformer architecture uh which is uh has or the yeah it's based on a uh an idea around attention that that it is able to attend to a large amount of data and so for large language models we also need something to to help with that side as well.

So that's what ZK attention does. So um I've spoken oh I should also mention there's a a more recent uh uh uh company as well called a grangege that have uh made advances in this area. Uh fortunately it's happened uh too too late for my slides. Um but they have uh done something called deep proving which again they've they've managed to tweak the way that uh they can create the proofs. uh and then they als they uh but rather than just calculate the proof on a single machine they have a network so they can parallelize the process and put out uh the proof uh or the demand for a proof to a network and get it done in parallel and then combine it back into a single proof.

So that's another company worth uh taking a look at. So uh but other things we can do if we want privacy with machine learning uh as I said earlier you could do everything uh offchain um certainly that is possible but then um you know you can do it do it privately but then you may want to interact uh with other models and and interact with other systems. Uh Mina does help with this a little bit because uh the basis of the Mina blockchain is that it allows off-chain computation. So in Mina you do some off-chain computation you can do private inputs with that uh that will change some variables uh some state uh which is then uploaded onchain and you send a proof on chain that that was done correctly uh but the there is privacy involved the because we have a zero knowledge proof we don't upload the inputs to our computation so that's one possibility uh recursion as I I was saying I think this is a promising area also So we could potentially recurse through layers of a neural network. We're splitting the problem down into smaller parts and then we can create proofs more easily.

The third point here is uh something that came out of a hackathon a couple of years ago, a ZK hackathon, and it it really goes to the fundamental way that machine learning works. So what I've talked about so far, I've been mentioning these neural networks and that they have weights. these weights are floatingoint numbers. That's really a big problem for us. So they looked back the the people who set up uh this uh the weightless network which is called zero gravity.

Uh they went back and said is you know do we need weights in neural networks? Are there are other are there approaches we could take? And they've managed to find one and so what they've done is to create neural networks uh without weights uh which are then much easier to integrate on the ZK side. The the next point here is because at the beginning I said zk works with integers but uh recently um uh people from uh nethermind have uh done research and started to find techniques where they can do zk over rational fields. So rational fields means it's not just integers we can also use fractions as well.

So we're moving away from this big restriction of numbers that we have in ordinary ZK to the more uh open uh types of numbers that we could have uh in machine learning and then other approaches that have been taken. Uh so there's OPML so if you're familiar with um roll-up technology you'll know that there's basically two approaches. There's optimistic roll-ups and there's CK rollups. So there's a similar thing with uh m of proving machine learning. Uh so there's a a company called Aura that do OPML where you you create a um you do your computation, you do your inference uh and you assume you you take an optimistic approach that it's correct but then you have a means of challenging that and in order to do that you need economic incentives.

So that has to be done on chain. Uh and then the final thing I have there, FedML. This is federated machine learning. This is something that's been around for quite a long time. Uh and is, you know, nothing to do with uh blockchain uh particularly uh but it's an approach that allows people to uh share training of models.

So if you have uh say a business say a number of uh automotive companies they want to sort of collaborate on producing some model that's going to be used in vehicles. Uh but each of them will have their data but it could be uh private data. They don't want to share this business data with their competitors. Federated machine learning allows you to collabor collaboratively train the models but without uh giving away the the details of the data to the other uh people who are collaborating with. Yeah, there you go.

There's zero gravity. Uh that's the one with the weightless models. Uh that's about uh zinc. So this is where nethermind produced the field the rational fields. Uh that's about OPML and that's uh a company that does federated machine learning called flower.

Okay. Um so uh yeah this as I said I really I'm just repeating myself here. These these are some of the the limitations. The inference uh even you know with the best models the inference proof times can still be seconds to minutes. Um the when we take the ZK aspect of this this computation of the the machine learning it can produce very large um circuits which uh affects performance.

Uh so we tend to have a trade-off uh of accuracy versus performance of the machine learning model if we want to try to get it small enough to use in ZK. Um but uh yeah this is an active re research area. People are working on this uh very actively. Um there's some benchmarks. Um this is well linear regression.

So very simple uh nothing like a large language model, nothing of that complexity. uh but it shows you gives you an idea of some of the the numbers. Um I'm just comparing Ezekiel here to risk zero. So Ezekiel proving time of you know a tenth of a second that seems reasonable. Um but that is you know linear regression model is very simple in AI terms.

Um but there you go. Yeah. This from uh ZKLM we have uh yeah 15 uh sorry 13 billion parameters. uh and that took 15 minutes to prove. So we are progressing uh quite a lot.

So uh uh that's it. If uh you're interested, where do you uh where can you go from here? Well, uh there are lots of resources. So, uh DC Builder um he gives he works with uh world uh you and you you may well see him at at conferences but he has a great uh number of uh resources uh and they do a very good introduction to ZKML as well. So, I've given you a link to that um and and an awesome repo from them.

Uh if you're interested in ZK and well also web 3, uh the zero knowledge podcast is something I can definitely recommend. they get the the top people uh the people who are actually building you know the latest things doing the latest research onto their podcast uh and they produce podcasts that are uh quite amunable quite uh quite easy to understand um so I would recommend you check out that podcast and they have lots uh of episodes about uh ZKML as well um and uh yeah there's a paper there about uh using ZK snarks uh with looking how they can uh change images and how that can be done in a way that can be proved to have been done in a particular way. Okay. Yeah, that's uh that's everything from me. I'm happy to take questions.

If you want these notes uh there well they're on our website. We also have courses uh about ZK and web 3 uh which is on uh at our academy website. So, please check that out also. Uh, but yeah, if you have questions, I'm happy to answer them. Now,

yeah. Every time you ask

Yeah, this this is a this is a problem. That was the the deterministic uh problem that that I spoke about. the the fact that they they tend to use uh randomness when they're they're doing generation. Um you can take that out of uh m uh models. So you can take out any idea of randomness but that tends to be added in to improve the the quality of the output.

So for ZKML, what they do is tend to try to take that out to uh so that they can create a a proof.

Well, I mean it is possible to take out the randomness. You don't that you don't have to have randomness in machine learning. You can make it uh deterministic. Um the other thing you could do is on the ZK side is to do things like range proofs to prove that uh maybe the answer was within a particular range. Uh but yeah, you I think for example with the ZKLLM uh activation functions, I think they they they tweak those uh to work in a particular way that can be proved that you know maybe the answer could be different each time but it can still be proved to have been calculated correctly.

Um so for for example with a a classification task uh on a a neural network you will have an output that is uh a series of probabilities it will come out with you know 10% probable of this 20% probable of that uh 50% probable of the other. So your your um your m your machine learning model is going to pick the the highest one but you could still prove that those probabilities were were worked out correctly. So I think there are there are workarounds but it is yeah you know a valid a valid problem with CK. Yeah. Thank you.

Okay there no more questions. Thank you very much for your attention today. Thank you.