NEAR AI Office Hours #22 w Zama

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:00

   empowered Minds rise and soore use your own AI we'll explore the future hand okay hello everyone uh it's the new episode of office hours today we have rant from uh Zama is it is it how you say Zama Zama yes everyone yeah R do you want to say a couple words about yourself and the company uh sure of course uh my name is Rand I'm the CE of Z I've been a developer since I was a kid built my

2. 0:47

   first company in the 90s as a teenager uh then I got into AI back in 2003 did a PhD in machine learning in 2007 when I was 21 and then I ended up building one of the first privacy PR privacy preserving machine learning company that I sold in 2019 and since 2020 I've been building Zama with my co-founder Pascal payer working on a technology called fully homomorphic encryption FH um the idea of fhe is that you can compute on encrypted data without

3. 1:20

   actually having to see it so you know today on a blockchain all of the data on chain is public right so anybody can see how much tokens you own how much you've been transferring and things like like that with FHA you can actually keep this onchan data encrypted but you can still actually run smart contracts on them you can still keep it composable so you can add a layer of confidentiality on top of existing smart

4. 1:45

   contract blockchains um so this is really what we're excited about Z and we're currently doing awesome so so when I think of how encryption uh the analogy in my head even though they somewhat undulated is uh is knowledge circuits uh because the the way the way I understand it is that in both case you have some arbitrary computation that you need to converted into some other form uh on top of which you can do uh on top of which you can

5. 2:15

   you can do some cryptography magic right is it is it like a meaningful analogy or is it like like how would you how would you explain how work encryption very briefly to people who want to understand it so try to uh try to imagine that uh I don't know imagine you have a secret recipe for like a great pizza right but you don't have an oven so you cannot cook the pizza you just have the you

6. 2:40

   know you just have the ingredients FHA is as if you would basically put your ingredients in an oven close it so nobody knows what ingredients are on the pizza pizza but then someone else comes in presses the buttons basically Cooks the pizza and then you take it out and you basically get like a cooked pizza right so the person who's actually operating the service in this case the oven doesn't know what comes in and what

7. 3:06

   goes out of the service in this case the pizza right so this is different because in the case of ZK you're actually not Computing on the encrypted data itself uh what you're doing is you're proving that you did a computation correctly without revealing the data you did it on but you don't have this ability to actually perform computation itself you don't have composability this is where fhe comes in FH the data itself is encrypted right so in the case of a blockchain data is on a

8. 3:37

   blockchain and you're Computing on it directly as you would on any kind of regular piece of data so so they're fundamentally different Technologies and I think ZK is very good when it comes to verifying and proving computation but FH is the actual solution when you need confidentiality of the data you're Computing on right and uh I uh I looked bit a little bit at the documentation especially in the context of artificial intelligence given believe in

9. 4:08

   2024 and that's the only thing people talk about uh and uh well Al first of all the the amount of of work that has been done is astonishing right so I see that it's uh uh you can have like you have pandas interface you have you can compile a pytorch model so effectively uh that is um I didn't dig too deeply but it seems like for for most of the use cases I can think of there's already an integration in place I mean I mean you know when we started Zama four years ago there were

10. 4:41

    three main issues with FH first it was very slow so you couldn't really do anything practical time the second problem is you could only apply it to very simple applications like adding numbers or multiplying numbers you couldn't do machine learning you couldn't do smart contracts and things like that and third it was EX extremely difficult to actually use unless you had a PhD in cryptography good luck trying

11. 5:04

    to make it work so the first thing we did at Zama was actually build a technology that could apply to any kind of use case so this is what we did with a technology called tfhe so we're no longer Limited in terms of what we can do then we thought well you know we want this to be easy to use for people so we put a lot of focus on integrating this technology into existing developer workflows so in the case of machine

12. 5:28

    learning that means is integrating with numpy pytorch pendas and all of these things you already use so you just write pytorch python code and we convert it to fhe and in the case of blockchain that means basically writing solidity codes for a smart contract and we hide away all the complexity of FHA so it's really important right because if you think about developer adoption as a developer you shouldn't have to learn like cryptography to start using these things

13. 5:58

    right uh and this is what we're really striving for making sure developers never worry about cryptography and so you mentioned you mentioned that that it used to be very slow so so how fast is it today right so like if they compare you know native speed versus fhe well it gets it gets faster than Mo's law actually so in four years we've made the technology about four sorry 100 times faster uh so 100 times is enough to get

14. 6:29

    blockchain type of use cases right it's enough to get small type of machine learning models you if you want to do decision trees if you want to do you know linear models things like that it's not yet fast enough for large language models to get there we're going to need some dedicated Hardware acceleration so as6 for FHA so you know the same way that AI is scale with gpus FH will scale with its own kind of chip but once you have that there is no reason why you

15. 7:00

    wouldn't be able to do llm in FH fascinating yeah basically performance- wise the bottom line is blockchain solved machine learning from 10 years ago solved machine learning of 2024 still working on that and so in documentation I see that today if you compile a py model you quantize it right to make it more yeah you have to so so FH works over integers uh so it doesn't have a concept of floating Point number so technically that's not true we did have

16. 7:34

    like we invented a way to do floats in F but it's so inefficient that honestly you might as well just quantize everything and do everything in in in fixed points yeah yeah makes sense I me think about it right floats versus integer on a regular computer is much slower so in FH as well right it's the same the same problem right right so in your like I guess in AI so so in blockchain I

17. 8:04

    think it's a okay let's do AI first right so in AI one thing that we talk a lot about is private inference right so like even if the model is open source let's say llama is open source but I don't have resources to run 70b on my machine right what I would want to do is I would want to someone else to host it like you know fire for fireworks together hyperbolic and then I want to send them my data but

18. 8:30

    I want it to be encrypted so like how far are we from FH being usable so it depends what kind of lat right you know if you need 1,000 tokens per second as I mentioned we're goingon to need A6 to get there clearly right uh but if you don't care as much about I would say latency it works so to be clear you can run a llama model in FHA it's just that it's going to be so slow that it's probably not going to be very practical yet uh one way that you

19. 9:03

    could already make it faster today is to do what we call a hybrid execution where some of the layers are done on the client side in the clear and then the rest of the layers are done in FHA uh remotely because when you think about a language model they're really only a few pieces which are very expensive to compute in the case of f what's expensive is the uh the big like uh matrix multiplication the attention head basically that's very expensive to do in FHA but everything else is pretty easy so you could very well imagine just

20. 9:39

    doing some of those pieces on your laptop or your smartphone which would be very cheap actually because you're not doing everything just some pieces and everything else in FHA that could actually go pretty fast I see uh then another u s related question is I I remember back in the day when ZK was getting popular right some people were criticizing it for uh the cryptography was making assumptions that are more less strong than assumptions we use for example in you know Ed ed25519

21. 10:10

    cryptography so what are the assumptions of of FH is it uh like is it the same is it only the set of assumptions we have in you know so FHA the the standard assumption is that you want at least 128 bits of security uh and FH uses latis cryptography and so it's basically Quantum I mean it's Quantum resistant as far as we know what is quantum resistant to be clear right but it uses the same underlying

22. 10:42

    mathematical problems as what has been standardized by nist for postquantum crypto so if you can break FH technically you're breaking you're breaking the nist post Quantum standard and if that happens I think we have a lot of problems it basically means we have no crypto for quantum computer and well you know I'm hoping that's not going to be the case so is as good as it gets in cryptography today I see okay so so that's more or less standard discret log and whatever

23. 11:14

    that's I see yeah yeah I mean it's it's yeah and then the good thing also about FH which is important is you don't have any side Channel attacks because everything that's happening on the server doing the F computation only uses public material there is no private key on the server and because there's no private key on the server there is no way for the server to attack anything unless they're breaking cryptography

24. 11:39

    itself which is great and you know that's one difference for example with the hardware enclaves you know some people talk about using te's like sgx for privacy the problem with sgx is if I'm a malicious validator on the network malicious nodes I can actually measure the electrical currents of the the Chip And reverse engineer the data is going in it so you know F doesn't have that

25. 12:05

    kind of problem and so if you look at blockchain if you're working on a decentralized network you cannot trust the people running the computation right by definition it could be anyone and that's why you really need something that's cryptography secure and not relying on an honesty assumption from the nodes so I guess with sgx um I I don't that well how people execute those side Channel attacks but I'm I presume you can write your code in such a way that it will you know try to

26. 12:37

    Amit the same amount of electric right the bigger problem is that you have to trust Intel right like hey it's a fully decentralized solution where as long as Intel is honest where all happy corgis right so so that's I think is a way bigger problem no you're right you're right you could always try to write constant time codes but first of all if you do that you're going to realize I that everything becomes

27. 13:00

    horribly inefficient right but also importantly it still doesn't prevent you from putting an actual probe so you have two type of site channels right in in in T's you have um site channels where you're looking at Cash access patterns so in that case you're correct right like if the cach access is basically constant all the time and it's always the same thing then technically you cannot learn anything from it but you

28. 13:25

    also have physical side channels where you're literally putting like an electrical probe on the CPU to look at the bits coming in and out and what's important to understand is that in The Enclave the data is not actually encrypted during the computation what's encrypted is the access right so if you can put a pro where the data is been computed technically you can read whatever is happening and then it doesn't matter if

29. 13:49

    it's constant time or not right you're just literally read reading the content itself um yeah go ahead go ahead okay sure so with f right let's say that my code is not constant time code right it has a loop somewhere right so so I presume in fhe you you have to unroll it right because if I don't unroll it then I can measure time corre see correct so F basically there is no branching in FH so effectively FH is constant time coding right uh because you have to evaluate every possibility

30. 14:29

    if there were branching you would be able as you said to measure time and basically learn where you are in the the branch but what we do have in FH is the ability to do a like a homomorphic multiplexer so you can have an encrypted condition that allows you to select one of multiple values right so you can say if this encrypted bit is zero give me value one otherwise give me value two so you can recreate branching logic but in practice you'll actually be doing both

31. 15:02

    branches so timing wise you're not going to learn anything right but like if so so presumably I can do the same with this GX like I can have a compiler that will unroll all the loops for me so so that will solve the it will not solve the probe issue of course where uh yeah no and some people are trying to use something like Oram right to make sgx more secure but again you know this assumes you don't have physical access to the server right but in blockchain

32. 15:36

    you cannot guarantee that unless you unless you create like a permission Network where you're forcing the node to run in a specific data center where there is like someone with a with a gun in front of the door right uh there's no way for you to know whether someone has done that in their house or lab or whatever or not that's a problem like you cannot have at the same time full

33. 16:01

    permissionless Open Access networks and hope that people are not going to be malicious like blockchain to be honest blockchain is the most adversarial uh environment you could ever build anything for everybody's trying to break everything the user is trying to steal money the developer trying to steal money the no are trying to steal money like everybody's trying to break a protocol so that's why you

34. 16:25

    need like the most secure advanced form of cryptography like you cannot make any shortcuts in Security in blockchain right so to that extent uh so so let's say so so the compiler that you have right compiler compilers what is the target I saw that uses lvm so presumably compiled into like like into a native binary right so so how do I can I compile it into for example a wasum or

35. 16:55

    RM to run it on chain or do I need a custom run so um to explain the stack that we have at the low level we have a library called tfhs which is written in Rust and implements All The cryptographic Primitives uh this Library can support CPU GPU fpga acceleration so you can decide what kind of Hardware you want as a back end and on top of this FHA Library we have a compiler that can convert python code into effectively

36. 17:27

    tfhs operations which are then converted into a binary that whatever you want and on top of that we also created what we call the FHM which implements fhc in the evm so that you can use uh fhc in smart contracts uh so from the developer perspective it doesn't really matter which branch you're going through whether it's a compiler or the fhvm branch both of them are actually resolving to the same cryptographic library and that cryptographic library is just rust right so supposedly I

37. 17:59

    assume you could export that to wasm or to you know we even have C bindings if you want to use that for example uh that that is like whatever works with lvm and technically should work we just don't necessarily have like the the tool chain to automate it but it should work right and uh so so let's let's walk through a couple of use cases right so let's say um on the blockchain right so so let's say let's begin with the simple case would it be possible to implement

38. 18:30

    something like tornado cash whether whether someone would go to jail for doing so right I mean f is cheing complete so technically you could do whatever you want in practice the privacy and confidentiality model of FH is very different from mixers like tornado cache think about it this way in the case of turnado cach the transaction data and the state that comes that comes in and out are public so you can see how much

39. 19:02

    goes in you can see how much is in the mixer you can see how much goes out what Z zcash right like in zcash even the amounts are hidden yeah correct but but this is not a a composable protocol right like it's a very specific protocol but in the case of turnado cash what you're hiding is actually the trace of the transaction so it it it it helps you anonymize who's been sending money this is kind of like using tour to access content online the website content is

40. 19:34

    public but you're basically using a mixer to access content via tour which anonymizes your IP address this is what tornado cach does FH is more like signal the actual transaction is public so you can see that Rand sent money to Alex but what is encrypted is the amount in balances so this is like a messaging app you know your Telecom operator knows that I sent a message to your number but they don't know the content of the message and that's really what FH is for

41. 20:07

    is hiding the actual data not the trace of the transaction but the question is well I guess like the question was would it be possible to use f to even hide the the recipient and the sender right like if the state if we imagine that the state because if works on the encrypted data right like consider the map from user accounts to balances if that date is also encrypted right they send a transaction that

42. 20:37

    says uh you know like the transaction it says s says send money from Alex you know send one Lama token from Alex to rent but all of that is encrypted and the state is enced like in theory that work right yeah yeah I mean in in theory you could in theory you could do whatever you want in practice you probably don't want to use fhe for that because uh you know as we said earlier FH

43. 21:01

    doesn't have branching so doing a lookup of an of an encrypted address means scanning the entire address list right and doing a homomorphic comparison on each to determine which one basically you have to to to scan a whole database so if you want to do that it's much better to use ZK in combination with FHA or to use something like stealth addresses right I think if I was to implement privacy with regards to the recipient I would actually use stealth

44. 21:33

    addresses which I think you know solves the problem uh more than I would use like an encrypted key Value Store uh just in terms of like performance right so yeah possible but probably not how you would want to implement it in practice so so then if not if not private transactions what are the what are the like biggest use cases you you see so so confidential transactions is a big use case but the use case here is hiding the amount and the balances right uh I would argue that you

45. 22:05

    know I mean venmo if you look at venmo actually venmo you can see who sent money to who you just don't see how much right FH gives you that chain right effectively uh that's one use case another big use case is confidential swaps of course right so you can hide the amount you're swapping uh I guess you could also hide a token you want to swap but the amount is easier uh if you do that no EV uh you know no front

46. 22:30

    running anything like that so I think you know you can make is it would be the equivalent of like a of trading on on a dark pool right it would be something like that which would be quite nice to have on chain uh another big use case I'm personally very fond of is identity because if you think about it today there's no way for you to have your identity on Shain and make it composable right you can make zik statements about

47. 22:55

    your identity but you don't have like an identity object in a smart contract that you can use as part of like a defi compliance flow for example but with f Fe you could have you know some kyc provider encrypt your identity your age nationality put that on Shan for you and then whenever you want to use like a compliance defi product that product could automatically on Shane request to verify some condition maybe you're not American right or something like that

48. 23:29

    the beautiful thing is because everything is encrypted from the outside the transaction will still go through but in practice nothing would happen in the encrypted state right it would basically just reject it uh behind the scenes so if you have identity you can build compliance into defy which whether you like it or not is what we need to onboard a billion people on chain but you can also start building governance systems because if your identity is encrypted oh and by the way with I you

49. 23:59

    you can also do encrypted votes on chain where people don't know what you're voting for right if you have your encrypted identity and the ability to do encrypted votes you can do encrypted governance right uh if you do encrypted governance and you've got encrypted currency and encrypted identity is starting to look like a country right so you could even take that even further you can imagine running all of a country's services on chain without anybody knowing you're the one accessing

50. 24:28

    them right like that's huge like we can create like a state OS with FHA that runs fully on chain but in your example right so so you mentioned an example so so let's say that the whole kyc information only says whether I'm American or not right so it's a one bit information like I go to fractal fractal is like it's a kyc provider right and they there's a smart contract and they say hey Alex is a well

51. 24:53

    in my case I am American now right so it says hey Alex is an American right um and it's encrypted right but but then if there's an end point that can return you whether American or not then obviously you can immediately deduce the information right so what you would get is an encrypted bit right so whenever the D5 protocol let's say you want to make a swap but to make the swap you the

52. 25:16

    the protocol wants to make sure you're not American it actually doesn't have the ability to decrypt your identity what what it does is the Smart contract would basically call your identity on chain and basically say hey hey is that person American what they would get back as a result is an encrypted bit that says yes or no that encrypted bit can then be used to effectively nullify the effect of your transaction right so it's

53. 25:41

    like a know up so from the outside the transaction is not actually reverted the actual transaction happened but it had no effect on the state but nobody know know user yep exactly that's so powerful like you is completely oblivious to the outside yeah I I guess it still needs to change something right because we would see if State didn't change at all oh it changes the cyer text but you don't actually know what a value is right so for example if I sent you imagine I want

54. 26:13

    to send you some tokens but I don't have enough balance what you would do in FHA is you would check in FH that your encrypted balance is bigger than the encrypted amount you want to send and what you get as a result of this encrypted comparison is an encrypted zero or one right yes you have enough funds or you don't you then multiply this encrypted bit uh by the you encryp sorry you multiply the amount by this encrypted 01 if you have enough the amount stays the amount if you don't have enough the amount becomes zero and

55. 26:46

    then you actually add and subtract in fhe this uh like normalized amount so in practice the balances the actual bytes of the cipher text and the encrypted balances changes even though the value contained in it did it right so from the outside you can see the state has changed but you don't know the value inside of it but but why does it change if it subtracted zero right uh because the ENC every encryption of zero

56. 27:20

    is different right you can encrypt zero 20 times every encryption of zero will be different you never have twice the same value for an encrypted value okay okay so so it's not like a a projection from from encrypted value to no no basically the way works encryption is you take your value and then you add some random noise right and then on top of that you're ask you're basically adding like a mask right so as

57. 27:45

    long as the noise is different which it should be if you encrypt it correctly the noise is always going to be different then it's impossible for you to tell without breaking well the cryptography yeah well that that I I guess that's a very important Point here right that two identical States will not have the same encryp yeah encrypted view so that's so you cannot you cannot tell if something didn't change by looking yeah yeah yeah that's that's a fun so I

58. 28:18

    guess the long-term vision of a of a whole governance on chain uh is is definitely something very exciting right but uh yeah yeah I mean look I I'm originally from Lebanon right my parents were from Lebanon so I'm I'm at least I can see my origin country basically starting from scratch soon right like you know once everything is gone you know we're gonna have to rebuild everything to if you think about it today if you want to build a state which is efficient and transparent you

59. 28:48

    still want confidentiality because you know I don't want my neighbor to know what I'm voting for how much money I have right that's private information then doing it on Shane is a good idea I'm convinced that you can cut the government spending by 80% if you use a blockchain because you don't have any middleman you still need people for edge cases and whatever but most of things that people do could be automated and FH

60. 29:12

    is the confidentiality piece that makes it possible to even consider that so yeah you know I mean we're still far from that but you know let's start with running a company on Shain with fhe then maybe running a city then maybe running a region then a country then what happens when countries are all in Shain and become composable between them like try to think about this idea of like composable politics and composable governments I mean it's there's an infinite number of things that you can do from

61. 29:42

    that y yeah we can have like a European Union on CH okay good thing France right now I mean France France right now is going through a major crisis of government spending so believe me right like you know know we every it's on everybody's mind we have to do something and I think blockchain with FH is the way to get there yeah okay so we're almost at the time um I guess the I would like to close with the uh the question of what do you think

62. 30:15

    will be the biggest and coolest use cases that will emerge in the next you know a year or two right so so like before before we get into the full adoption by by the whole world what what are the biggest things that will happen I think I think we're going to start with defi that's simple it's it's one of the biggest use case in blockchain let's start where the use case is I love machine learning my background is machine learning I built a privacy machine Learning Company so obviously I

63. 30:41

    want machine learning to get there but being realistic blockchain is easier to do with FH and machine learning today so I think that's where it's going to be adopted first okay yeah sounds exciting um okay thanks a lot for for joining us today uh thanks for okay have a good one