Proteus and ZK Email How Advanced Cryptography Derisks AI Harms | Aayush Gupta at Pragma Taipei 2025

[Music] We are ready for our next talk. And for this one, I'd like to bring on Aush to tell you about Proteius and CK email. So, please give Aush a big round of applause. Cool. Thank you.

So, one thing I wanted to do is slightly reconceive how we see the value of cryptography and defensive cryptographic technology in an age where you have really strong and powerful AI systems. A lot of people have decided, hm, are there ways that these technologies get worse or are they still important? And I I think there's a lot of ways to actually see the cryptographic tech that we're building, including blockchains, and realize that they're become more important in an age of AI, not less. So the way I'm going to go through this is I'm going to talk about briefly like you know what is the motivation for these problems that we're solving. Um what are some ways people are currently thinking about it?

Why are you know these different tools that we think of so important and how do you combine them? And then what do we end up with at the end? Okay. So one motivation around where you might think um like AI problems and cryptography intersect is provenence. So you see an image online, you want to know exactly where it came from.

Um, and not only that, you want to know exactly where it came from extremely fast. The information obviously spreads way too fast, even faster than community notes, which often settles, you know, between 10 minutes and an hour after content is posted, which is often too late. So you want to know within a few seconds, where did this content come from? The one interesting thing about this problem is that almost everyone is aligned. lawmakers, government, standards bodies, they all want an answer now.

Um, and this is like quite quite rare to see. It only really happens when, you know, catastrophic things are happening and people need to take action. But this is a nice opportunity where we can say, hey, if cryptography can be useful here, it's actually extremely fast-tracked to adoption. Um, so what are people currently doing to try to solve this? Um, one idea is watermarking.

You might have heard of this. The idea is, you know, you take some data saying, "Oh, this image came from this source and you embed it into the image and like an imperceptible change to the pixels." Um, and that's kind of like what a watermark is or like steganography. Um, the problem is it's extremely bad. If you like embed watermark data into an image and you take a screenshot of that image and then you repost that somewhere else, um, most of the time that watermark is completely removed.

If you take a picture of it with your phone, which is the one on the right, like it's totally over. Um, in reality, you can robustly encode about one bit, um, which makes this super adversarial prone. I can just randomly edit an image until that bit changes and then it's gone. Um, some companies have tried to do like bigger things like Google tried to make this better watermark called synth ID. But, you know, as we know in cryptography, um, closed source algorithms are not useful.

If you know, it can't be audited, if it can't be looked at, uh, it's not helpful. So, okay, watermarking. Nice in theory, but breaks in practice. Um, okay, what if we used signatures instead? We've seen from a lot of the work that we've already done that signatures are really, really interesting and really important.

Why? Well, signatures give you exact providence of who created it because you need a private key to create that signature. And once you have a signature, you can layer all sorts of interesting ZK, FHE, etc. tech on top of it and get privacy even if you didn't have it originally. So, you know, some examples are if you've heard of ZK email before, uh, you know, you can prove that you got some data in your email and that you're now going to use it to, you know, maybe train an AI or maybe show that it's validly generated, um, or it was generated by human or a company or a certain kind of process.

Um, another interesting idea is, you know, one thing that a lot of models do these days is they only train on data before 2022 because after 2022 there's too much contamination from, you know, LLM slop online. So, okay, what do you do? You want to prove you like took some humanlike actions before that came out. So, you're probably a human or you wrote some information before that happened. So, it was likely human written.

Um, and so you can get really interesting provenence on all that data. Um, I think you'll hear from himself today. Um you can also do this with passports where you know because passports are signed by the government you can say hey uh I am over 18 or I am from this country or I'm not from this country or I'm not on this list. Um and that's quite interesting because now you get information about yourself as a person in an age where almost any document can be forged but not the digital signature using this technology. Um, one other important thing is you can prove you took a picture on your iPhone because as long as your iPhone is not jailbroken, there's technology called app test that creates a digital signature of the entire transcript of your app execution on your phone that you can prove.

Yeah, call the camera API, call the location API, this is what it returns and as long as the phone's not jailbroken, appetite test will be robust. So, you know, one could imagine technology like ZK email in which you take an email, you prove the digital signature is valid, and now you can add privacy on top of it. And you know, one very basic example that we've seen with this is, okay, you take an email, you redact the information, you prove, hey, I'm not going to tell you who I am, but here's a document I got from this person. Um, you know, how does this work? Um, you may have seen this before already, but the high level idea is because emails are signed with this RSA signature of a shot of 86 of all the data um, in this DKIM signature protocol, you can automatically wrap this inside of a ZK proof and then selectively reveal only the things you want to um, via like more interesting ZK primitives like ZK ZK reax.

Um, now it's it's quite interesting because these proofs are more relevant, not less, in an age where we really care about verifying you took certain action in the real world when any receipt can be faked and the data being authentic. And here's a bunch of examples that people have created with our registry. Um, you can prove you signed a document and both counterparties are in fact who they claim to be. Um, you know, specifically that like the document wasn't forged by some third party who faked a signature. Um you can prove you actually took a flight or you you know are kind of uh at least purchased an expensive flight.

So it's becomes very expensive to civil attack this kind of system. Um you can prove you're part of some organization some slack workspace on discord whatever because as long as you get an email confirmation you can verify that directly without any trusted party in the middle. Um you can prove you exported your data correctly. This is really nice because if people want to retrain on that data, you need provenence of hey, this came from here and I can tell you that that person signed that data. Um you can prove you know even you exported your AI data and that can be valuable because then you say okay this data was generated by AI.

Um we know what it looks like. You can prove you know you have action in the past like oh I merged this GitHub issue. Um that's quite interesting. We've already seen things in crypto where people are using this kind of thing to say, okay, now I can build something like a, you know, incentivization protocol on top of GitHub um where you claim money just by proving you merge the issue. Um, and you know, you can prove UK KYC directly um in the past and then reuse that anywhere else you want.

Um, it's quite cool because this stuff works. People have done over 5,000 proofs of this in production um you know various versions of these including you know Uber orders, Amazon orders, all sorts of weird things. And we've shown that it's very easy for users to just hit sign with Google, make all these proofs that they want to, and it's a very intuitive user flow. Um, but what have we learned from all this? Okay, digital signatures are really important.

They give you provenence, and as long as you have a signature, you can add privacy where you want on top of it. Okay, so let's go back to our original problem that we wanted to solve, which was deep fakes. We want to know where a deep fake came from. There was one algorithm proposed a few years ago that you know has some flaws that we'll talk about but uh you know is a good first step. So the idea was they would take an image they would hash it and then they would sign it.

Kind of exactly what you see in the very naive application of signatures to provenence for images. Um and the idea is you know if the image changes a little bit the hash won't match and therefore the signature won't match. Um there's you know a lot of problems with this. uh the main problem being that that metadata which is you know the signature is stored in the metadata of the image itself. The problem is you lose this metadata every time you share the image.

If you screenshot the image, metadata gone. If you share the image on Twitter, metadata gone. You send it to your parents on WhatsApp, metadata gone. Post it on Tik Tok as part of a video, metadata gone. Um so the problem is, you know, because this is stored in image metadata, all the way that you see people sharing content today don't work.

like you can you lose this provenence immediately and there's no way to get it back. Um so okay this is a nice idea in theory doesn't really work in practice. Um you know there's also a lot of criticisms a lot of issues with this um there's lots of like weird kinds of fraud. There's lots of um you know the kind of way that they forge a C2PA signature is that because there's no verifiable time stamp if you fake the time stamp you can fake the signature. Um we already know like a great tool to solve this which is blockchains give you global consensus over time.

Um another yeah this is again uh using their weird specific certificate scheme like X509 is quite hard for people to use and also has various issues. Um again the timing issue uh and yeah the fact that it sometimes isn't actually going to be authenticating the media. Um, funnily enough, um, the person who posted this, hacker factor, has like a really funny solution, which is just email the content, like get the deac signature and use that for provenence instead. Um, which is kind of fun because we already know that's signature that works that we have proofs of that we can do things with. Um, so, okay, let's say you have this signature.

Um, imagine now you wanted to protect it against those transformations. You wanted to protect it against, you know, modification, against compression, against cropping, whatever. Um, one work, one set of work that tried to look into this, um, I'll, you know, explain the pros and cons in a second, is, you know, Veraritoss Vimz, which basically looked at, okay, let's say you have the signature from a camera or a image generator. Now, the idea is every time you edit that image, you're going to create a ZK proof. You're going to say, okay, I, you know, made a grayscale and I cropped it.

Uh, and you you make a ZK proof of those transformations. And then when you post the image online, you post both the signature and the proof everywhere you post that image. Um, okay. This is like an interesting start, but the problem is I don't think we can be expecting, you know, Instagram filters to be adding ZK proof to their back end anytime soon. Um, and not just that, but this won't work if the image is modified in in a image editor that doesn't support it or if the image is turned into part of a video.

Um, you won't be able to get provenence. And so, you know, this is nice in theory again, but in practice doesn't really work because you can't expect every single image editor in the world to add ZK proofs to their back end. Um, okay, back to the drawing board. What if instead of signing a hash like all these solutions advocate, you instead signed a value that was transformation proof from the start? Okay, and this is where kind of this more novel proteus system comes in.

The idea is you can try to create robust provenence via digital signatures, which we know work but have not been totally used well in practice. perceptual hashing which is a non-cryptographic type of hash that ideally keeps the image content quite similar and privacy technology layered on top of it. ZK proofs MPC FH etc. Okay, so maybe because this is you know one of the cruxes of the problem. What exactly is a perceptual hash?

The idea is that you want some representation of the image that is transformation proof. If you imagine, you know, more transformation happening as you go towards the right and less perceptual similarity to the original image as you go down. The problem is as you modify the image more, post it more, as the image spreads more, the the actual content of the image changes more from the original perceptual value. It gets compressed, it gets resized, whatever. Um, and you kind of want some representation of the image that is the same along every point on these curves.

Okay, so here are some like very basic, very old examples, but will give you an idea of what such a value could look like. On the left side, you have the pallet of an image. Um, it's quite nice. You just say what are the main colors in the image, even if I rotate the image, crop the image, the pallet stays the same. If I compress the image, this palette stays the same.

Um, this is quite nice. This already gets you some of the properties you want, but isn't perfect because, you know, if I apply filter on top of it, okay, this pallet is now completely useless. Okay. um the image on the right tried to have a different kind of perceptual hash which is hey what if we took the image and we downscaled it to 8 by8 grayscale um and then you know we we quantize the grayscale values um okay this is nice is robust to filters at least but isn't robust to rotation or cropping or things like that okay um so Apple proposed uh like a AI based uh perceptual hashing system again this is not like a cryptographic hash this is just like some representation of the image very simple. You just get the features from the image with a neural network and you you know threshold it and make it into a binary hash.

Um this is like okay but there's lots of attacks. These have the same neural hash. You can find neural hashes manually. Um there's lots of people who have like broken these kinds of hashes. Um but if you look at you know the actual performance on transformations it's it's much better than we were seeing before with C2PA.

Any transformation all these numbers are zero. Um here you know you can consider this number to be like you know the how similar your new perceptual hash is to the old perceptual hash and at least you're you're pretty close in most cases within AI based perceptual hash although you know obviously there are still problems. So the idea was what if we took this kind of architecture and we made it better. We made the feature extractor better more robust. We added adversarial training into the whole mix and we add an extra PCA step to make the uh feature extraction easier.

And that's where our algorithm dino hash came in. Okay. So I'll explain a little bit more about the results towards the end. But just so we can construct the full picture of the system in our head. Imagine we have this perceptual hash.

Um now how do you build like a robust provenent system on top of this? Okay. So you can say the image generator which can be you know either open AI or a camera or whatever your favorite image generator is is going to generate some image. Um now they're going to sign the dino hash of that image. Um the signature can then get posted to any DA layer which is going to keep the time stamp like global consensus over the time stamp of that image the time that that image was signed.

Um and then you know so the user on the left generates the image. Now they're going to share it on social media. So they're going to you know put it social media is going to compress it. It's going to get cropped or whatever. Um, and now the person on the right wants to learn where did this image come from.

They see the image on social media. Where did it come from? This could be a user. This could be a social media platform like Twitter. This could be whoever wants to establish the provenence.

Um, all they do is they now query uh, hey, I see this dino hash online. Who signed the closest dino hash to this value I see? And you can say, hey, we saw that OpenAI signed a dino hash that was 80% similar to your current one. This is decent but not perfect because it's missing privacy. The main problem is that you want to keep all parts of all the images private.

Um, this means that you really really care that nobody can reconstruct the text prompt that was used to generate an image because that's where a user's personal information is. You really don't want to reveal the PII. And these AI generation models are so scared that they're even too scared to release the hash permanently, like the perceptual hash permanently. Um, because a perceptual hash is not a cryptographic hash. you can reverse it uh with a advanced enough model to get the original image.

Um usually a blurred version of it, but still it's enough to encode the semantic content of the image. Um and in fact many of these AI image generators will delete the images after 60 to 90 days. Um to keep this privacy okay so how do you now build privacy into the system in a way that's compatible with those needs? The idea is that you can use MPC or MPCF to create a database of these perceptual hash and then do the lookup in a completely private way on both sides. Um, one example of a team that did this was WorldCoin built exactly this kind of almost perceptual hash check with an MVC database in the back and could do about like four billion matches per second.

Um, admittedly they have a lot of GPUs, but this is like pretty good. Um, and so, okay, what is a new change to our system? The idea is we're going to take our entire hashing architecture, but instead of doing the matching in plain text on the dino hashes, you're going to do it inside either an MPC database or an MPFH database if FH becomes fast enough. The idea now is that you know all these content producing organizations contribute a machine to this you know kind of uh organization of machines that is going to do this lookup and they're going to check uh just the operation what is the closest value in the perceptual hash that's been uploaded and if there is a closest value who signed it. Um so now you can see when the user on the right queries they're going to send their you know homorphically encrypted value into the server.

That server is going to do a very concrete operation that no machine can learn what thing was queried and which images were found. And they're just going to return who created the provenence of that image and how close was that image. Um okay now one problem here is that you can't expect the system to exist overnight. There's like this cold start problem where you know you need people to sign up for the system. You need people to be signing images.

you need people to be, you know, interpreting them in the right way. So, you kind of want some like fail safe until you can get adoption here. And then he's going to have a very simple AI detection model that just says, you know, is this image AI or is it not? Um, and that's kind of like the backup fail safe. If you don't see any signature, you have like some sort of backup say, okay, actually, we're going to do this instead.

Um, okay. So, what do our results look like? Um, so on the right side, you can see in the yellow line is, you know, Facebook's chosen stable signature. In the middle is Apple's neural hash which is like the blue line and green on the left is the dino hash that we train. So the idea is that the way to interpret this graph is you know the more to the up and to the left you are the better it is.

um because that means the more images you're able to uh correctly identify um this is like the ROC curve but yeah the idea is that you know because the bottom is in orders of magnitude we're doing already orders of magnitude better than uh many of these existing solutions um for the same kind of threshold accuracy level. Um the other big issue is adversarial training. Um it's very easy to adversarial attack existing perceptual hashes and to our knowledge no one has ever adversarily trained a perceptual hash model in the past. um we did and it turns out that if you edit an image by small amount like four out of 255 pixels or eight out of 255 pixels um at most you can change a perceptual hash by 40% of the bits in the worst adversarial attack. So no matter what as long as the image looks perceptually similar 60% of the bits will be retained.

Um and that's like a pretty pretty different result from what we've seen in the past. Um as you can tell like nobody else considers this kind of attack which I think is very important in the real world. people are going to try to look at your system and modify a fake image to pretend to have the provenence of a real image. So this is like I think a must have for any deployed system. Um at the bottom uh we have like the the backup AI training model that I mentioned of just like hey here's a simple classifier.

Can you detect real images in the wild properly? Um there's a nice new data set called synth buster and um if you run uh you know very simple ed detection model trained with just the kind of the latest uh SPMs you can get like basically state-of-the-art accuracy across detection on like all existing kind of real world uh generated images. Okay. So the idea is you can create robust providence by taking lessons we've learned about how important digital signatures are using perceptual hashing to get around modification and then adding MPC or FHE for privacy. Um and of course you have a backup as you deploy the system into the wild.

Um and maybe the main takeaway is I think like Ethereum and these technologies that we built can be used for much broader things um than we've kind of considered in the past and there's lots of interesting ways to contribute um lots of things left to do. red teaming it, making it useful, optimizing the system. If you want to learn more, um, website that explains more paper on the left. Um, our work, the work that I do most of the time in ZK email is in the middle, um, which is, you know, very relevant and informed. A lot of this work on the that we just presented and my Twitter is on the right where you can hear me yap about all this stuff.

Cool. Thank you. [Music]