Vitalik’s new work: Crypto+AI application prospects and challenges

Original Title: "The promise and challenges of crypto + AI applications"

Original Author: Vitalik Buterin

Original Translation: Karen, Foresight News

Special thanks to the Worldcoin and Modulus Labs teams, Xinyuan Sun, Martin Koeppelmann, and Illia Polosukhin for their feedback and discussions.

For many years, many people have asked me this question: "Where is the most effective intersection between cryptocurrency and AI?" This is a reasonable question: cryptocurrency and AI are two major deep (software) technology trends in the past decade, and there must be some connection between them.

At first glance, it is easy to find the synergy between the two: the decentralization of cryptocurrency can balance the centralization of AI, AI is opaque, and cryptocurrency can bring transparency; AI needs data, and blockchain is good at storing and tracking data. However, over the years, when asked to delve into specific applications, my answer has been somewhat disappointing: "Yes, there are indeed some applications worth exploring, but not many."

Over the past three years, with the rise of more powerful AI technologies such as modern LLMs (large language models), as well as the emergence of more powerful cryptocurrency technologies such as zero-knowledge proofs, fully homomorphic encryption, and (two-party and multi-party) secure multi-party computation, I have begun to see this change. There are indeed some promising AI applications within the blockchain ecosystem, or combining AI with cryptography, although caution is needed when applying AI. A particular challenge is that in cryptography, open sourcing is the only way to truly secure something, but in AI, open models (even their training data) greatly increase their vulnerability to adversarial machine learning attacks. This article will classify the different ways in which Crypto+AI may intersect, and explore the prospects and challenges of each classification.

Summary of the intersection of Crypto+AI from the uETH blog article. But how can we truly achieve these synergies in specific applications?

Crypto+AI Four Major Intersection Points

AI is a very broad concept: you can think of AI as a set of algorithms, which are not created by explicitly specifying them, but by stirring a large computational soup and applying some optimization pressure to drive the soup to generate algorithms with the properties you want.

This description should not be underestimated, as it includes the process of creating us humans! However, this also means that AI algorithms have some common characteristics: they have very powerful capabilities, while we have certain limitations in understanding or comprehending their internal processes.

There are many ways to classify artificial intelligence. In relation to the interaction between artificial intelligence and blockchain discussed in this article (Virgil Griffith's "Ethereum is a Game Changer" article), I will classify them in the following ways:

· AI as a participant in games (highest feasibility): In the mechanism of AI participation, the ultimate source of incentives comes from the protocols input by humans.

· AI as a game interface (with great potential but also risks): AI helps users understand the surrounding crypto world and ensures that their actions (such as signed messages and transactions) align with their intentions to avoid being deceived or scammed.

· AI as game rules (needs to be very cautious): blockchain, DAO and similar mechanisms directly call AI. For example, "AI judge".

· AI as a game target (long-term and interesting): The goal of designing blockchain, DAO, and similar mechanisms is to build and maintain an AI that can be used for other purposes. The use of encryption technology is either to better motivate training or to prevent AI from leaking private data or being abused.

Let's review them one by one.

AI as Game Participants

In fact, this category has existed for almost a decade, at least since the widespread use of decentralized exchanges (DEX) on the chain. Whenever there is an exchange, there is an opportunity to make money through arbitrage, and robots can do better than humans in arbitrage.

This use case has existed for a long time, and even with much simpler AI than what we have now, it truly is the intersection of AI and cryptocurrency. Recently, we have seen frequent instances of MEV (Maximizing Extractable Value) arbitrage bots exploiting each other. Any blockchain application involving auctions or trades will inevitably have arbitrage bots involved.

However, AI arbitrage robots are just the first example of a larger category, and I expect many other applications to be covered soon. Let's take a look at AIOmen, a demonstration of an AI participating in a prediction market:

The prediction market has long been the holy grail of cognitive technology in the industry. As early as 2014, I was excited about using prediction markets as input for governance (future rule), and have extensively tried it in recent elections. However, so far, prediction markets have not made much progress in practice, for many reasons: the largest participants are often irrational, people with correct knowledge are unwilling to spend time and bet unless many people are involved in money, and the market is usually not active enough.

One response to this is to point out the user experience improvements being made by Polymarket or other new prediction markets, and hope that they can continue to improve and succeed where previous iterations have failed. If people are willing to bet billions of dollars on sports, why not invest enough money in betting on the US election or LK99 and get serious players involved? But this argument must face the fact that previous versions have not achieved this scale (at least compared to the dreams of its supporters), so it seems that some new elements are needed to make the prediction market successful. Therefore, another response is to point out a specific characteristic of the prediction market ecosystem, which we can expect to see in the 2020s but did not see in the 2010s: the possibility of widespread AI involvement.

AI is willing or able to work for less than $1 per hour and has encyclopedic knowledge. If that's not enough, they can even integrate with real-time web search capabilities. If you create a market and offer a $50 liquidity subsidy, humans won't care about the bid, but thousands of AIs will flock to it and make their best guesses.

The motivation to do good work on any given problem may be small, but the motivation to create AI that can make good predictions may be in the millions. Note that you don't even need humans to adjudicate most issues: you can use multi-round dispute resolution systems like Augur or Kleros, where AI will also participate in early rounds. Humans only need to react in the few cases where a series of upgrades have occurred and both sides have invested significant amounts of money.

This is a powerful primitive, because once it can enable the "prediction market" to operate on such a micro scale, you can repeat the "prediction market" primitive for many other types of problems, such as:

· According to the "Terms of Use", is this social media post acceptable?

· What changes will happen to the price of stock X (e.g. see Numerai)?

· Is the account that is messaging me right now really Elon Musk?

· Can this job submitted on the online task market be accepted?

· Is the DApp on https://examplefinance.network a scam?

· 0x1b54....98c3 is the ERC20 token address for "Casinu In"?

For ZK-SNARK, similar to the protocol in 2013, the cost of proof matrix multiplication is less than 4 times. Unfortunately, the cost of the non-linear layer is still very high, and the best implementation in practice shows a cost of about 200 times.

However, for many applications, we not only want to prove that AI outputs are calculated correctly, but also want to hide the model. There are some simple methods for this: you can split the model so that a group of different servers redundantly store each layer, and hope that leaking certain layers of certain servers will not leak too much data. But there are also some surprising specialized multiparty computations.

In both cases, the moral of the story is the same: the main part of AI computation involves matrix multiplication, and very efficient ZK-SNARKs, MPCs (and even FHE) can be designed for matrix multiplication, making the overall cost of putting AI into a cryptographic framework surprisingly low. Typically, the non-linear layers are the biggest bottleneck, despite their small size. Perhaps new techniques like parameter lookup can provide some help.

Black Box Adversarial Machine Learning

Now, let's discuss another important issue: even if the content of the model remains confidential and can only be accessed through "API access", there are still types of attacks that can be carried out. Quoting a paper from 2016:

Potentially, even if you have very limited or no access to the model you want to attack, you can create an attack simply by using training data. As of 2023, this type of attack remains a major issue.

In order to effectively curb such black box attacks, we need to do two things:

· The true limitation on who or what can query the model and the number of queries. A black box with unrestricted API access is insecure; a black box with highly restricted API access may be secure.

· Ensuring the integrity of the training data creation process while keeping the data hidden is an important objective.

As far as the former is concerned, the project that has done the most in this regard is probably Worldcoin. I have analyzed its early versions (as well as other protocols) in detail here. Worldcoin widely uses AI models at the protocol level to (i) convert iris scans into short "iris codes" that are easy to compare for similarity, and (ii) verify that the scanned object is actually human.

The main defense measure that Worldcoin relies on is not allowing anyone to simply call the AI model: instead, it uses trusted hardware to ensure that the model only accepts input that is digitally signed by the orb camera.

This method does not guarantee effectiveness: it has been proven that you can launch adversarial attacks against biometric recognition AI through physical patches or jewelry worn on the face.

Source: https://arxiv.org/pdf/2109.09320.pdf

Wearing something extra on the forehead can evade detection or even impersonate someone else.

However, our hope is that if all defense measures are combined, including hiding the AI model itself, strictly limiting the number of queries, and requiring some form of authentication for each query, then adversarial attacks will become very difficult, making the system more secure.

This leads to the second question: how do we hide training data? This is where "DAO democratically manages AI" may actually make sense: we can create a DAO on the chain to manage who is allowed to submit training data (and the statements required for the data itself), who can make queries and how many queries, and use cryptographic techniques such as MPC to encrypt the entire AI creation and operation process from each individual user's training input to the final output of each query. This DAO can also meet the popular goal of compensating those who submit data.

It needs to be reiterated that this plan is very ambitious and there are many aspects that can prove it to be unrealistic:

· For this type of completely black box architecture, the encryption overhead may still be too high to compete with traditional closed "trust me" methods.

· The fact may be that there is no good way to decentralize the training data submission process and prevent poisoning attacks.

· Due to collusion among participants, multiple computing devices may compromise their security or privacy guarantees: after all, this situation has occurred repeatedly on cross-chain bridges.

I did not warn at the beginning of this section "not to be an AI judge, that is dystopian" because our society has already relied heavily on unaccountable centralized AI judges: deciding which types of algorithmic posts and political views are promoted and reduced on social media, and even subject to censorship.

In fact, there are some very basic and low-risk ways in which encryption technology can improve or even existing centralized systems, and I am very confident about this. One simple technique is delayed-release verification AI: when a social media website uses AI-based post ranking, it can release a ZK-SNARK to prove the hash value of the model that generated the ranking. The website can promise to publicly disclose its AI model after a certain delay (such as one year).

Therefore, compared to the centralized world, the question is not whether we can do better, but how well we can do. However, caution is needed in the decentralized world: if someone builds a prediction market or stablecoin using an AI oracle, and then someone discovers that the oracle can be attacked, a large amount of funds may disappear in an instant.

AI as Game Objectives

If a combination of blockchain and multi-party computation is used to run the training and inference process, a "trusted black box AI" can be created, which many users are concerned can benefit applications with bias or deception in the system. Many people have expressed a desire for democratic governance of the AI we rely on; cryptography and blockchain-based technologies may be a way to achieve this goal.

From the perspective of AI security, this will be a technology for creating decentralized AI, with a natural emergency stop switch and the ability to restrict queries attempting to use AI for malicious behavior.

It is worth noting that "using encryption incentives to encourage the creation of better AI" can be achieved without fully falling into the rabbit hole of using cryptography for complete encryption: methods like BitTensor belong to this category.

Conclusion

With the continuous development of blockchain and AI, the number of application cases in the intersection of the two fields is increasing, some of which are more meaningful and robust.

Overall, the underlying mechanisms have remained largely unchanged, but individual participants have become use cases for AI, and the mechanisms that operate effectively at a more microscopic level are the most immediately promising and easiest to implement.

The most challenging are those attempting to create "singletons" - decentralized, trusted AI that certain applications rely on - using blockchain and cryptographic technologies.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia