NEAR AI Office Hours #33 with XTrace Encrypted Vector DB & Private AI Agents

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:00

   future hand in hand in this teex driven Wonder okay hello everyone and welcome to episode 33 of near office hours today we have Felix from xtrs uh Felix do you want to say a couple words about yourself and what xra is doing yeah so hi everyone I'm Felix thanks for having me here I'm uh I was previously in the Stanford computation mathematical engineering program and now xray is creating encrypted Vector database and encrypted memory for AI agents what that

2. 0:32

   means is that we can store encrypted data in the vector database and then allow user to submit encrypted query into the system and retrieve the most relevant data and then this is on top of just encrypted in rest and encrypted in transit we allow data encrypted in use so your data will never be leaked before uh for any malicious attacks yeah yeah yeah so so before uh before we started

3. 0:58

   the recording I was I was reading app a little bit next Trace right so um so it uses uh it uses homeomorphic encryption right that's the that's the technology behind behind all of it yeah it's a com it's like a combination of uh embedding models plus uh partially homomorphic encryption yeah so yeah we we talked to a couple of people here on the previous episodes who work on H moric encryption and I think uh one interesting question is how fast

4. 1:28

   it is now right because amorphic encryption has been around for a while yes but for most interesting use cases it's been prohibitively slow so I'm curious if if there are some breakthroughs that enable it or if it was always possible to do it for embeddings but you know nobody has applied it yet so so what is the secret Source Here Yeah the secret source is kind of like we're kind of thinking about like Ai and cryptography we're

5. 1:52

   kind of the the chain that connected and then if you're just using regular embeddings that is working with floating points and then combining it with with fully homomorphic encryption we did The Benchmark so each data chunk that you need to calculate be like 30 seconds per data chunk which is not practical for Vector retrieval performance so the secret sauce we're using which accelerates a speed to 0.092 millisecond

6. 2:16

   is by simplifying the problem space to working with binary embeddings so we train embedding models in AI using M yosar representation learning plus like the bid conization to make sure that even though we we can do like a privacy a distance preserving uh transformation from floating point to Binary embeddings in hyper Cube and then we do all the operations on the encryption space with

7. 2:40

   like just bits and beddings and then by doing so there are a lot of like ways to accelerate the speed and then like improving the performance so that's kind of how we by focusing on a smaller problem uh first like I think this is a big problem we use AI to map it into a smaller problem and then we in the cryptography space we accelerate it to get to like the THX performance boost yeah M so so usually and my knowledge

8. 3:04

   could be a little bit uh absolete here right but usually my understanding is that the embedding model is also a Transformer right where they like I know like back in the day I don't know if people still do that or this is still the the primary way right but back in the day they would just get a Transformer and get the last uh output of the last layer before it goes to the softmax and that would be the embedding right um but obviously that the binary embedding right so so we get a binary

9. 3:30

   embeding do you completely retrain the Transformer or do you train just like you know the the mapping from the last layer to Binary or what is the approach on the last layer and then we're not arguing that uh we'll get the same performance of like the floating Point inference what we trying to say right now is that this will be distance preserving because in a vector search what we only caring about is like the relative distance between your query vector and then the relative ve the

10. 3:55

    distance to the embedded Vector so that's why we kind of can do something more like local sensitive hashing by like mapping the space from like the floating Point space to like the hyper Cube space of zero and ones yeah I see so so it's sort of like quantization or is it uh you can treat it as like a kind of like a quantization yeah to get it to like this yeah and then we actually created a mathematical proof stating like doing this transformation we still preserve the relative distance in your white

11. 4:26

    paper yeah I see I see okay so now um okay so so so I guess uh the the core component now I understand right so so you have a um you have a vector database right that maps and um a in an embedding so so I comp put embedding locally on my machine right then I use H morphic encryption to get an encrypted embedding yes right and then that that is what's going to the Trace right so so so this way in in

12. 5:02

    transit it is already not something people can can see right so so then there is a vector database on your side right and then whenever I want something to retrieve I again compute the the embedding it get encrypted goes to the to their yes Magic happen right and so because of H encryption you can compute the distance um uh so now let's talk about use cases right uh so so what would be because obviously the alternative the alternative right is just to have Vector data B locally right I just spin up an instance on AWS with

13. 5:40

    like a large hard drive and and and run a pogress with whatever P PG Vector right and storing Bings there right so so why would they like as a as a user right or like what is the primary use case why would people use x as kind of like it's kind of like the phenomenon before Dropbox and after Dropbox right because if you're doing any everything locally all of your data is not portable shable and at all and then so if you have just like a simple use case of just yourself

14. 6:10

    you cannot share the data from devices to devices if you're just hosting everything locally I think your approach is what like model context protocol which what and dropic is doing but for us for a system we can kind of allow this protocol to be exit outside in like the C Level and all of the device connected it on it can like have access to it and on top of it we can allow like multi-agent collaboration or it's like multi-human collaboration like Alex and

15. 6:34

    Felix we can have like a collaborative knowledge base that both of us have access to and only us have access to and then this can be on the crow level instead of just letting everything be on the uh local level that might be absolete yeah I see I see and so so if we have a shared knowledge base we would be able to decrypt everything in there right so it's not like we're hiding anything from each other I see but

16. 6:56

    nobody else will yes yeah I guess I guess yeah so like in this case I can still spin up my own instance but then I need to be a tech saavy person it would be sort of like a you know hosting my own mail server as opposed to using Gmail right the next tace would be like Gmail right so like you know where where and some core use cases like we're also talking with some like those data labeling companies like say public AI we

17. 7:21

    can first like allow agent to do semantic search on all the cipher data and then they can first identify which hunks are relevant to them to buy and then they can a specific chunks instead of buying all the database decrypted and then like start working on top of it yeah and then we're also working yeah so that's kind of like also another use case and on top of that what we're most excited about is like this encrypted memory base for AI agents so that if

18. 7:47

    you're talking about agents running te now we can make this agents memory transferable and then inheritable to other agents so now like one cool project we're thinking of doing is is saying that we can create like a send back texting environment for like AI agents like previously there's like this game about like convincing like the AI agent to give you by prom hacking to give you release all the fund right but

19. 8:13

    that's just like a onetime thing but if using a system we create state in this agent so the agent will see this attack and then know that this attack exists and then learn from it so this can be extrapolated to a lot of like AI guard rail or like web to security systems so that like agent developers they can say okay my guard rail is I don't want to talk about the the competitor's name for my AI agent I specify this guard rail and then I put it in like xray sent boox

20. 8:37

    texting system allow people to attack from jaob breaket or something to really to talk about their competitors and then once something triggered then we can like uh then we can recording your memory and get get like the whole memory base that is transferable uh before we oh sorry I think disconnected so after we launch it then we can have like the the user seeing it yeah like the the AG inherit all the pass attacks and in the

21. 9:10

    future we see is it can prevent it yeah yep that's interesting um so um so let's begin with the first use case you mentioned right with the public AI uh that's right so so so that's interesting so you have you have a large set so so in this case the vector database contains a mapping from embeddings to uh like to some annotated to some to some to some data data points on which you can train right and so in the past you would go to the provider and say hey guys I want to buy the whole data set yes in this case you can pre filter

22. 9:49

    it and and pay only part of it so so in the in the uh in the pitch that that that uh I look there's another interesting use case that was mentioned where um where uh you you guys look at the idea of having like a Global Knowledge base of of all the agents or something like this is it is understanding like like along the lines of what's Happening yes so what I saying is that if like I think the new form of data because kind of like in the

23. 10:31

    previous newer IPS meeting they're saying like we're out of like all this public data right and I think the new form of data will be like because now they telling like multi reasoning for like all the inference optimization like new form of data is they gener by AI agents and then this will be recorded in the memory system and then now we're arguing that now this all experience of AI agent for instance you have a junior develop you have like a senior developer

24. 10:55

    agent that have already sold a lot of bucks and then when a new user launch a uh junior developer agent that have no experience they can directly have access to all the previous knowledge of the senior agents and then use it as like a way to inherit ex experience and instead of inherit from one this is really scalable inherit from 10 thousands and use all of that as a context data for you to perform certain task and then our

25. 11:19

    encryption allow all of this agent to maintain data ownership because everything's encrypted and only authoriz party have access to what they they need yeah yep so so I think couple things that are interesting here one is that presumably for this use case uh with like you know Junior developers inheriting knowledge the embedding would need to be somewhat different right because it's not just the embedding doesn't make sense what I'm saying because the embeding would need to capture the yeah go ahead yeah so

26. 11:51

    we're not just stor like the the binary embedding is used for search and we still have the AES encryption of like the actual text or like the actual embedding they want to work with yeah so after they identify the the data they want they can they can get like the embedding that matches them or actually get the raw text based on the prev the pr pre chunk data yeah yep yeah and then like effectively so so again interesting interesting thing to to consider here is what would be the competitor of this

27. 12:24

    approach right so so competing approach would be something that stores all the data um so if agents are running in the tees uh then then you can also like I can imagine a system where agents are running in the tees and the vector stor is in Te right so if the vector stor is in Te you can you can have similar guarantees to homomorphic encryption homomorphic encryption is strictly better because you don't have to trust Intel right and not only you don't need to trust Intel you don't need to trust like I guess

28. 12:55

    with the TDX the biggest concern people have is not that Intel will be malicious right and then and and and will steal their embeddings this is unlikely right but but that uh you know that Intel messed it up and there's some sort of attack where you can measure like a cash latency and that will allow malicious actors to extract data right so C morphic encryption is stronger uh but but one interesting problem here and I I I don't

29. 13:20

    know if this is something ex is trying to address or if it's considered to be unlikely is that you know like I can launch a junior developer right and I can go go uh like collect some observations that are relevant to me get them presumably pay for them right because if there's ownership then presumably there's some payment involved right but now I have the data right so now um I have an incentive to share it

30. 13:44

    of my own right because it the same embedding right and so people will be able to buy it from me so I don't know if this is something that you just think like how to handle the idea that once I get the data like reselling I think it's kind of turns to a lot of like also like say web to system say we're doing online bookstore how do we prevent people from like reselling the book of the author once I purchase like the online

31. 14:08

    bookstore and I think my argument is that psychologically people will want to more work with like the authorized and especially in the rack framework you only get a chunk of data and think getting a few chunks of data won't be really that useful comparing to having like the whole data set that is uh semantic searchable by AI agents so I think it's really hard to monetize just like a few chunks and then yeah and then if you want to buy the

32. 14:32

    whole uh V database I don't think you have the reputation authority to like resell it if people want to buy like Alexis uh agents like vector database even though I I get I claim I get all of your vector data I don't think I'll be that appealing if yeah when trying to resell it because the model I had in my mind is that it's like a global global right where everybody can contribute right so if everybody can contribute uh then the fact that the senior developer

33. 14:58

    published more data and I publish less data uh will will be less relevant from the person who's fetching data right because when I fetch data um it's it's less important yeah I guess I guess details would matter here like implementation details yeah like I guess some sort of reputation system and it's also kind of different between like say the previous idea about like oh we all clar data to train the model by using like this kind of vectory data search only the most relevant data will be retrieved so kind

34. 15:33

    of also against all those like uh just like dumping because if you incen people to give you data and you don't care about quality people just dump all the syn all the where like useless data into the system yeah so I think a quality control kind of also we can can say like how perplexity works you say because of the citation of certain data so we make this inference so the attribution will be pretty clear in comparison to say we

35. 15:57

    all work together to this model and we have a in output there's no way to attribute it back to who whose data cause this inference yeah yeah yeah so in terms of uh um you didn't ex mention it but I'm but I'm pretty sure it's assumed right and the I just brought it up a second ago that because there's data ownership there must be payments right so so presumably if I if I if I store some data like if I offer some data on this like I assume

36. 16:28

    it's some sort of a market place right um so how do you imagine this system working is there like a is it some sort of sort of payment channels or uh yeah yeah yeah there's a lot of agent payment system out there with I great talking with like never mind and like those kind of agent payment system company but at first to BU stra our idea we work we're try to focusing more on like collaborate settings where different companies are trying to work together and then trying to have a collective know knowledge base and then based on that we can

37. 17:00

    extrapolate because uh the only difference behind the tag is authorization token versus like a payment token to unlock the system yeah yeah and I guess we mentioned we mentioned multiple use cases today right so so there's one where I as a user use it myself right in this case there's no Global there's no Global rag right or I guess it could be if there's multiple users collaborating but even that is

38. 17:24

    like a right right but but I think like like thinking thinking try trying to imagine how it unfolds right I can I can imagine that personal would be way more like like way more people will use personal you know rag than like sharing with one or two people I don't know it's like for instance like inside a corporation we have different teams who have a collabtive knowledge base like for instance you will never want like

39. 17:56

    the engineering team to have access to the HR data about someone assist so maybe we can have like different rag with multi tendency control different access control and different like clar knowledge base even in a corporate setting or like yeah and I think security and this kind of Access Control will be vital for like real uh real adoptions yeah yeah yeah but but I'm curious so I guess there's difference right between going after like individuals right so so like I can imagine like some sort of agent

40. 18:26

    application running on my phone uh you know like learning about me you know like learning about my preferences my calendar right and all of that goes into this uh Dropbox of of rag right and then like you know I'm on my phone I'm on my laptop on my iPad and it's all shared right so so so I assume like that requires having the actual uh application so so I don't know if you imagine that you would be building them or if you if you're working with

41. 18:54

    Partners or this is still more idea level or mostly currently more like trying to B2B so we can create like this agent tool for like a developers of agent to create this to have this like privacy preserving feature and then like what we're trying to gather is like all this encrypted data from all this uh individuals so not only about like on different iPad different phones we can

42. 19:19

    also work different AI vendors so if I upload my personal data with phix in the future like maybe other AI agents can just have I can have access control I can choose who which AI vendor to share my data so I upload once and I can work with all these services and then choosing the specifics that they want so for instance if Amazon is have their on AI agent I can basically open like my shopping experience data to them only and I don't have to give out the other

43. 19:44

    ones yeah yeah yeah that that makes sense and so so are you are you like deeply integrating into existing agent Frameworks or the or or uh like how how do you approach the go market So currently also working with like camon and say we have submit like a PO request in near AI Hub to create like where this encrypted Vector support for like different teams who are caring more about like users data ownership and also like the Privacy and security of the data so and then also different protocols allowing them to like use the

44. 20:16

    same protocol of xrays to like encrypt their own data and then put it on the system and now we kind of want to be like this bridge of allowing like different AI vendors to like maybe carry different AI vendors uh partner data and then having like user who has a control over what data to give yeah yeah and and I I think you mentioned it but so in this case I as an agent developer do I choose the the model that computes embeddings or is it something that is

45. 20:46

    preconfigured oh you can choose uh the model to do the embedding and then we'll transform your model from like any floating point to like the binary embedding yeah so we can we compatible with any embeddings yeah yeah yeah that makes sense yeah and like how how far along is it in terms of uh like is it is it fully ready to be used or like what's the road map so we already developed the SDK but we haven't really create the infra code yet so how it works right now is that the developers you have to take some work to

46. 21:19

    like launch the instance and then use or SDK to encrypt the data and then we support like API to retrieve the data by calling out the prompt give out the prom We encrypt it and then get it yeah so the workflow is done but we but we don't have the inise code yet build out yeah yeah and uh what is the like I guess eventually uh like at some point during this process xray needs to needs to get

47. 21:49

    it share right so so what is the business model do do you like a like if I deploy myself the xray instance right uh then yeah I think it's kind of like how thiss do work like we all create like I think where we actually make sense is when we create all this hosted service for you so you don't have to do all the hard work and then we can have like the the biggest mode even though it's encrypted

48. 22:12

    data we or mode will have like all this encrypted data from different users so like if AI vendor wish to enter a protocol directly they have all this access encrypted data and then they can have S query for like user to get all like work with different like users and then directly have access to it the user agrees yeah and I think that's where like our business mode is like first kind of like more like a traditional hosting service like how like they work

49. 22:36

    for like s business we help you do all the infrastructure you just have to give us the data encrypted and we'll do everything for you and then on top of that we can create this protocal level of like agent to data and agent to agent communication yeah yeah yeah I guess it's also interesting how so so you mentioned uh let's begin with a simple use case uh for the question I have in mind and then develop it right

50. 23:01

    so let's say you and I want to have a shared uh Vector database right so so how does the key uh do we both have the full key like the same key or how do we how do we establish yeah so both of us will first agree on like a key first so it's kind of like Al those it's kind of pretty already uh mature like how cryptograph in blockchain how people like can have always call on this system so we create

51. 23:28

    like this public key secret key pair that both of us have like using some threshold distributed key generation or threshold encryption technique and then we can C control the vector database and making sure only the both of us will have access to it and then you can do and depend on design you can design it such as we need all both of us who agree to decrypt the data or both of us can decrypt the data individually yeah

52. 23:51

    individ yeah right but how does it work with the with a more complex case right so let's say public AI has this Vector database with like a massive data set of I don't know annotated alignment promps right so right and then I go and I query so so effectively initially like does does public in this situation have to be involved in in in decrypting me when using a symmetric encryption so the public key of public AI will be out put it so to do the to do like the search the user just have to encrypt their prom with the public key

53. 24:34

    of like public Ai and then go to and then we can do a calculation Vector database and then we'll let public AI tells us like which data is relevant based on the user's quy and then they can do like a data swap from the public Ai and the user yeah yeah okay okay the actual data fing uh you you do need both parties to be online yes and yeah so so so it cannot be facilitated by the by the

54. 25:01

    system I see so so it's just the um search yeah that that makes sense so so in this case as a provider if if I have to be online anyway and serve data why would I not also just run a vector database like again you know pogress with the PG Vector that does make sense uh yeah so I think it's kind of based on like the scale like if it's one to one I think it makes sense to just do

55. 25:34

    that but I think what we allow is like one user they can submit a prompt and then go to all this all 10 10 Vector database all like in a uniform protocol level so they don't have to go through one by one and then we can so if we have scale then it makes more sense to just come become like unified API layer so you just do one API prom in cry and you can go search through all the different like providers yeah yeah yeah yeah makes

56. 25:59

    sense yeah so so that sort of goes back to the idea of the global of the Global Knowledge yeah yeah yeah yeah yeah it it it's um it sort of fits well uh with this other idea that we've been promoting where called proof of response uh where because in this case uh I I can imagine long term like like I don't think short-term that will be a problem at all but long term I can imagine a problem where you know like I came there provided some data set and I was like a small company you know like with fundra

57. 26:32

    you know 100K annotated some data provided it the company died you know we we shut down our servers but the embeddings are still in the embedding database right and so the the the user comes there uh does the search and says oh this is a data I want try to fetch it but there's no data coming back provid yeah the provider is not coming back right and so like naturally shortterm that's not going to be a problem right

58. 26:55

    because short term I guess it will be like you know 10 10 providers right and you know all of them if one of them is offline you can act on it right but if you can imagine it scales you know you have you have like an Amazon scale millions of providers it gets a bigger problem so like proof of response is the system that where you can prove that you were not able to fetch something like you go and say Hey I want data from this API provider and

59. 27:18

    they promise that they will give it to me right you go through the system and you have a proof that they did not respond right then you can go to to blockchain and say you know those are sets are not good anymore because the the provider was offline yes yeah that makes a lot of sense actually it can be extended to like tool calling for API for agents because you're creating like this API layer for

60. 27:41

    all the agents then it's yeah yeah that's the original idea right that if you have a lot of agents that promise to do something if they are offline and you depend on them that's a problem right it's sort of like a like a very simple example would be you know you use some Weather Service to get weather and the weather service is down right your your service is also down right but but obviously like the the way the the way agentic futur is Vision that you have like millions of those agents

61. 28:11

    right and you you build and each of them it's like a a tree you know of dependencies or or like a graph of dependencies so so you really want to know which of them are and have some guarantees around it yeah so what is the I guess what's the timeline when is the when do you guys Envision having the uh the global global knowledge base or or like early version of it yes so currently I think how it works is that we're working actually could

62. 28:45

    working with different protocols to like adopt our system and then once we have enough agent on board and then preing this note then we can gradually spawn like more like from first from like a protocol to protocol so we can have a near protocol if some other protocol all having their agent using our system and then as more a adoption comes then this Global protocol can gradually manifest yeah yeah yeah so so so like is it going

63. 29:11

    to be like happening this year or uh like what do you think of the timeline before I can go there and say hey guys I want to find T my model on a bunch of uh I don't know uh seven problems yeah I think the technical it's not the roadblock now it's more currently like how we work with different protocols and getting them to adopt our system and as we get more and more like users adoption then this idea can be manifested so the roadblock is really on the adoption speed yeah so that's kind of why we're

64. 29:43

    activ providing ourself for different AI agent Frameworks so whenever people use this or protocol then it can be extrapolated to other things later yeah yeah sounds great okay we are almost out of time um thanks a lot for uh for coming Felix and tell telling us about xtray thank yeah okay and see you everybody at the next episode of office hours thank you Alex