Unraveling ZKML: Present Realities and Future Horizons in Privacy-Preserving AI | ETHTaipei 2023

see in the following one hour we have two talks about integrating the zero knowledge technology into machine learning fields so first one we have Cassie so from Eastern Foundation privacy and scaling exploration team to talk about the prison reality and the future Horizons in privacy preserving AIS so welcome Kelsey [Applause] um well thank you so much for the invitation uh this is a rather ambitious topic to be done in 20 minutes for sure so what I hope to achieve at least is for those of you who are totally new to ckml this topic a brief understanding and for those of you who are eager and interested to get in I will also provide some kind of like directions or hopefully inspiration so this is the layout of the talk so I will go through what is zkml so don't worry if you don't know what it already is and then I'll briefly talk about things that has been done in this field including things that I have done and also things that other teams or other protocols have done uh and then at the third part I will talk about what can be done so some of the research initiatives that we are hoping that either our team or someone else can go ahead and research and try to achieve those so this is a layout uh so let's start with the first thing which is well what is the ckml so well we're not talking about the implementation let's first just assume that we already know how to do ckml okay which is we have some zkp circuit that performs neural network model prediction right so that neural network could be something as simple as a classifier can be something that is face recognition biometric authentication stable diffusion GPT whatever model you want to plug in here okay so let's say we have that then what else like can we do with this right so well there are three things that three types of data that is involved in this kind of design right you have the input data so in the case for facial recognition that will be your face the picture of your face in the case of a llm that would be like a prompt okay and you also have some kind of model weight right so that would be something that for example open AI will hold a lot of very precious model weights that needs to run their model and then you will have some kind of output right so for classifier it will be one or zero or you can have other data type as well so well first of all we need ZK because it doesn't make sense well we need CK but we don't want everything to be private right so think about the case where everything is private then it doesn't make sense because I'm just telling you that I have some model that does something and then here's the output right it's meaningless so we need to at least have some public data so the first use case of ckml is that you hold the model weights public and then you hold the input data private okay so what there's a lot more use case I'll talk about in a bit but the perhaps the easiest way to understand it is face recognition right so you don't want to put your facial features onto the chain but there is someone who have built a very good facial recognition model that everyone trusts right so if I put my face through this model and got some output that output people should also be able to trust okay so that's the first use case the Second Use case is actually the other way around so you can have some public input data but a private model Waits so for example um model weight is perhaps one of the most precious assets that companies have now what two companies have nowadays it takes millions and million dollars to train a model and pretty much it all comes down to model weights especially nowadays A lot of the architecture of the model is the same well how do I actually hide my model weights or keep my model proprietary while also having a trusted computation right so how do I not share my model with everyone but everyone would trust that whenever they use our service is using the same model and the same model Waits every time so the way to do that is well we will have some private model weights right and then everyone can run their data using some company that is providing this model as a service and since the input data is public you can make sure that it is your data that you wanted to put through right so for example um a good good example might be for stable diffusion okay so right now of course there's a lot of Open Source um uh like hugging phase that you can produce your own model uh sorry you can you can run your own model and then like generate an image but there's also other surface like mid-journey or some other provider they kind of hide the model right so you don't really know what is going on under the hood uh so for this use case at least what you know is the company is being consistent every time that they're running the same model right they're not telling you what that model is but at least they're running the same model over and over again to provide you that service right so well there are these are just like a few use cases that is probably more close to home for you um so for the private input public model uh use case the most um I guess relatable one is probably biometric Authentication right so now that we have Smart contract wallet is it possible to have biometric authentication for smart wallets right so well how do we not disclose our own biometric data and have that well you need ckml or any other kind of CK proof right it doesn't have to be machine learning specifically but you need some sort of CK proof in order to process that data and prove it on chain or another way is you can have a private image or data marketplace right so I want to sell an image to you how do I prove that I have some image of some property for example the size or I want to show you that what I want to sell you is a photo of a cat right but if I already show you the picture directly then you can just right click and save or screenshot so I need some kind of ckml to hide that input but then at the same time review some information to you and then on the other hand for the public input private model um use case the most relatable one is probably kaggle anyone have heard of kaggle from the great so machine learning people well or other webto companies will probably know very familiar with kaggle so kaggle is a kind of a bounty platform that companies can set up competition that people can submit their machine learning models to the only problem though is that in order for your model to be evaluated by the Kegel platform you need to submit your whole source code all right so you're only trusting that with kaggle's privacy policy or whatever they are not leaking it but in a way you're basically handing over your model before even winning any prize right so with ckml what you can do is actually make sure that you want the price first by committing some model right and then using ckml to prove its accuracy and only after you win um you send over your actual model so uh this is actually what I've done with PSE as a kind of proof of concept which is based on the decentralized Kegel idea sorry I saw people taking pictures I'm sorry um so uh well I'll provide the link to this in a bit the diagram is just here for showing don't worry about it the main point is on the right left hand side here um so well what does it take to build a decentralized kaggle in a way so of course first of all you need to have some kind of CK library for machine learning okay so that was the first step I primarily use the language circum so I have like a circumlet which is circum library for all the machine learning layers so you'll quickly realize that this might not be very scalable because there are so many layers in tensorflow or Pi touch essentially every single of those you have to build a custom template or circuit I will talk a little bit more about that in a bit um the second component is a translator or a transpiler that translates a python model into a ckp circuit right so that is to ease the onboarding of webview developers you have a model you don't need to know how to build ckp circuit there's tools that transpile it for you so that's what I've built with only certain supporting layers of course at this stage but so that is kind of just to ease the onboarding of web 2 or machine learning Developers and then last but not least the actual decentralized Kegel which is really a POC at this stage and it's a platform that you can host Bounty so the Bounty provider can post a bounty onto a smart contract and then the smart contract will be able to verify the accuracy the Bounty provider will also have to release the Bounty at the end when the bounty is released the Bounty Hunter when they claim the money they will also send the encrypted model weights over so it's a little bit like a s crowd but this s crowd is secured by ckml so no one like yes they cannot go through it's okay it's possible that they would not go through with the process but if they didn't go through the process no one gained anything that is not uh that that to their benefits right so they only give the carry out the whole process then the model weights and the money is exchanged um I will link to the this project a little bit later so this is kind of what I have built so far um but I also want to talk about like what other teams have built and how does this all come together so basically this only shows that this is a use case right but we are still very far from actually making or realizing it so for example on my C Kegel the only model that you can trade right now is a model that identified mnist data set okay so for the for people who don't know what the amnest data set is it's basically a like an a data set of black and white images that is 28 by 28 black and white with handwritten digits all right so this is like the size of the models that we can trade um on this platform right now uh and that's because of two different things oh right before I go on to that um I always forgot this is there's this light because I just recently edited um I used to think of zkml just for privacy and this is a use case that I recently just realized that is much more feasible in the short run which is well what if we just have everything public right you might wonder wait what I thought you were talking about zkml privacy why everything public well the easiest thing is we can run a machine learning model in solidity well at least not a big one right we can probably run linear regression or something like that so we do need some form of a roll up even for computation so the third use case of ckml is just make it like a roll up a rollout for computation right not a roller for chain so you can do some off-chain computation or machine learning uh it's okay to make everything public all you want to show is that I have done this computation correctly and then I can commit that result onto the chain so that's like the third use case that I just recently added because I think in the short run this is much more feasible and there's a reason why I say this is more feasible than the other use cases in the short term to know that we have to go to the challenges of ckml so I hope it's not too small I'll rate it out so there is actually made two main challenges when you say you want to do ckml or you want to get a model into a ckp circuit so first thing is machine learning is a floating Point weight in fact it all relies on floating Point weights in order to draw the gradient to get very small kind of updates and propagation uh and of the of the network whereas in ckp circuit we do fixed Point arithmetic right so there's a conversion of that and actually there is a lot of ways to do it the main two ways is you scale it up and truncate the decimals numbers or you just quantize it right so you find the minimum and the maximum of the range and then you splice slice them into bins the other thing is of course it's very hard to have very deep model or very big model because the size of the circuit will be huge which typically improve in increased prover time well so what has been done to solve these two problems so this is a everything up to like 10 months ago so actually two years ago we only started with linear regression okay so these are all the GitHub links in case anyone is interested in the code base so two years ago we only started with linear regression it's written in circum and then half a year later there's a group in zero X Park that did a mnist model so a convolutional network but they kind of only predict the stance layer the last layer on ckml right so you do everything until the last layer and then you hide the last layer and then what I have done is um before the project I just mentioned is to just try as a proof of concept to put the full convolutional neural network um uh to do on onto a ckp circuit okay but from here actually we have moved very fast in the past few months so in the past few months parents group has successfully done a quantized aigc so AI generated content so AI generated model uh as and to maintain it as nfts right so um actually a lot of people when they hear of quantization they worry about oh isn't it bad especially for big models actually it's the exact opposite uh bigger models are way better with like quantization and stuff well and then there's also two groups that focus on like Halo 2 circuits and then the major updates is that you're able to get very very large model onto ckp the only problem though is that yes it's possible to implement this very large model especially for example gpd2 as you can see here but it's not feasible for client side so right now I don't think as I'm not sure if it's an exact number but from what I recall Daniel's Group say that in order to run a gbt in order to prove a gpt2 model in ckp you need around one terabyte of RAM right Ram not hard disk space so that means that you need something that's on the server side right so that goes back to why I think the third use case is actually more feasible because if you don't need privacy at this moment then it's completely okay to do ckml on the server side whereas if you want client-side ckml then we are still a little bit far from that right so well then what's next right so I've presented what's happening so far so what's next is that well we are having a research initiatives in ckml at PSE and here are some of the directions that I have identified recently and if anyone wants to kind of read the whole read up they can go to the hack MD so sorry if the text is a little bit small but first of all is benchmarking So currently when you Benchmark ckml people use benchmarking that is typically done for CK circuits right so you just care about prover time or verifier time but there's another dimension when it comes to ckml which is the model itself especially we mentioned that well we need to quantize or truncate the model weights then it affects the model performance right up to a certain extent so how do we actually measure that how do we measure the effect the effect of different quantization method so that's one key kind of benchmarking area that must be added into ckml research the second direction is CK friendliness so CK friendliness is um basically while we know floating point is in CK friendly is there any other machine learning paradigms that will make it more CK friendly so there is in fact if you go back to the literature in the 70s there's a lot of models using integer weights right they have all kind of like been taken over by neural networks because neural network is so powerful but it's not saying that for some use cases for example for identifying fingerprints is like integer model is actually very powerful so to identify like CK friendly models could be One Direction as well and then there's two areas that I would like to kind of focus on at the last bit of the talk today we're just folding and model secrecy so I will just go to the next slide and talk about folding so folding is a rather new kind of research in the field of ckp that allows us to fold or basically fold similar structured ckp zika proof or ckp circuit into a smaller size so basically in o1 with a small overhead okay so well what could you do with folding in terms of ckml so well the first thing you do we can do which a another project zader has already done is to fold a model right so if we design the model such that each block is exactly the same kind of structure then we can just fold the model vertically as in you can compress the model so that 512 becomes 256 or actually even smaller well the problem with that I said here might be impractical is because well it's hard to tell a what to or machine Learning Company hey so we have this CK Paradigm like can you change your models architecture such that it works for folding right so a lot of things is in machine learning is accuracy driven and most of the time convolution Network actually looks the shape looks we're trying to shape down in order to amplify this signal so model folding could be impractical whereas for batch inference which is if you want to apply the same model over and over again onto a large data set right so for example 1000 pictures or 10 000 pictures essentially that could be another application of folding where you just fold a lot of those inference into one single proof with a small size so that would require kind of minimum machine learning modifications of course the downside for that is that in order to have that like 1000 10 000 like incremental computation on the ram that's another kind of Hardware limitation or Hardware requirement that we need to look for right in view of time I will quickly talk about the last bit which is well this is kind of the last slide which is model secrecy and I put through zkml here because what we know as ckml today the only part that is not a secret is the model architecture itself okay which is okay for some of the newer models right for example we know that for GPT what's precious what's expensive is the weight not the architecture right openai can publish a paper and tell you all about the architecture but as long as they have the weights well we cannot do anything about it but for some smaller model we actually need model secrecy and the way we can do it is we need to have some form of function no commitment so that means you are able to have a ID or a hash that represents what the circuit or what the function does and so how do we actually hide the circuit well there's a lot of different approach perhaps one of the answer or solution could be sck VM um and of course there's other other study about like NPC whether we can do Federated learning and verifiable training that's perhaps not just something that can be answered by ckml but it has to go with MPC or homomorph fully homomorphic encryption right so these are other areas of research as well right so um and I think we really need model secrecy in order to achieve like actual real ckml all right so um well this kind of wraps up to the end of my presentation today um if anyone wants to kind of see the projects that I've mentioned just now this is the link tree or my link tree uh there's like a lot of GitHub or the PSE articles that I've written uh and I welcome any questions okay uh any questions for Cassie stop stop oh okay many uh hi so about Federal learning I was thinking about if we let anybody can provide their learning the thing so everyone can learn can train a model and provide the weight back to the maybe on a blockchain so it makes everyone can train a model but also they have to prove that they are trained training it in a correct way and I'm thinking is it possible to do that currently or while the main changes or consideration if we want to do a decentralized learning for model you've been for ZK machine learning specifically right or just Federated learning generally I think for machine learning or for uh we need many times visitation power to learn the model so um making everyone can contribute their combination power but they also need to prove that they are training it in the correct way and I want to ask is it possible now or what are the changes that may involve in yeah so actually if you were not talking about CK it's already achieved there's a paper on nature called I forgot the whole title but if you search like swarm learning nature you could find a paper the only problem with Federated learning now is that people are studying whether from the updates alone you can find out about the original training set so this is actually a field of research right now there's speculation that you can indeed recover some of the information about the training data uh which is kind of why we need encryption or ck to make it really secure but uh but otherwise we're not talking about ckr encryption it's already been done currently yeah any other questions okay this one thanks for the presentation today it was really great um before when our company operated our own validated validated roll-up like one of the main blockers that we had was the proving system like it needed a huge computation power to do the actual zkp proof generation so I do think this really has a very big use case however like in terms of this to be really used as a real product um I do see some research being done in the space to verify make a proof in a more efficient way like using a distributed system like what do you think are the steps that we need to go through to use this for the Mass public or like what are the processes that are needed to be optimized to actually use this in our like daily life like cackle is doing yeah so well um ckp acceleration is not really my expertise but I from what I've like discussed with other people I I mean there's two main direction right hardware and software so uh on the hardware side of course you can build like uh fpga ASAC or GPU actually a newer thought school of thoughts I've heard of is what if we have different hardware for a different part of all different operations in CK so that's another uh well I'm not too familiar with it but just to provide kind of like a food for thought and at least for what I'm concerned with I think um well two direction is first of all to make things CK friendly which I think could be very helpful and have a very immediate effect but at the same times like we do a lot of like PSE does a lot of research just to how to accelerate like cryptographically as well so yeah there's a like I guess many directions you can do to accelerate that cool thank you and maybe one last question if any with homomorphic encryption is it possible to train the model with the proof itself I'm not sure what what proof you're referring to I mean uh together like the uh the proof without the in using input as secret to train the model so when company gather the informational data they don't need to know the the what's the exactly data from user yeah yeah so I I think um maybe to kind of sum it up I think people ask me what's the difference between like fully homomorphic encrypted ML and ckml usually my short answer is if the same person holds the data and the model you do ckml like the same entity holds the model and the data you do ckml if different entities hold the data and the model you do a I guess fhe ml so that's how I think about it so yeah it's there are companies or protocols studying that I'm not sure if it's realized yet for the encrypted version okay thanks Cassie and let's shout out to Cassie again one last thing sorry I I don't know if anyone collect poab but I have a personal pull app if anyone wants to stay connected or anything uh just come to me and I'll let you scan oh