Welcome to Ethan to Ethan to Ethan to Ethan to Ethan. Hi. Um I'm Eureo. Um today I'm excited to share about what I have been recently working on which is publicly verifiable private and collab collaborative AI training in a decentralized network. So I started my exploration with this question.
What if you don't have to reveal your personal data but you can still contribute to training a machine learning model. So for example, you can build privacy preserving recommendation system for deps with anonymous users or you can build anonymous or crowdsourced healthcare data analysis platform or you can even put investors personal diary into training a machine learning model that predict liquidity of some asset in the market. But the idea here is um what I want to do essentially is to capture the hidden trend. Data is by nature in silo and scattered and it only becomes meaningful relative to the other. But data only gets collected and analyzed when people who have power decides it decide decides to do so.
So here's my question. What happens if we make ML model training more permissionless? Then I got to learn about this machine learning training tech um method called federated learning in which basically you can upload training process to the client side and after clients train a local model on their own data. They upload the model updates to the server and server can aggregate this local model updates to build a global model and client can clients can fetch this global model to run inference. But traditionally verifiability is not required in federated learning because for example it's used in a setting where there are two different branches in the same bank and for example it's really hard to export a data from Europe to the US because of GDPR.
So they have to train the model in a federated way or two different corporations make a business alignment with each other first before the collaboration and then they have to train a model in a federated way again. Um so it's not that they don't trust with each other but it's just hard to export their data to each other. So they do federated learning but for my setting which is a decentralized network um for mutually distrusted parties to collaborate collaborate on training verifiability to prove that they did something that they were supposed to do is necessary. So what does narify? um clients have to prove they that they did a training and also this process of masking the trained model correctly and I will explain why you have to mask model when they publish their uh locally trained model and then servers also have to prove that they did aggregation correctly.
So to visually represent what I just explained, they are clients on the bottom and they have to train the model locally on their own and then while doing so they generate ZK and then they upload the mask model parameters and the ZK proof. Then after this masking zk proof verifies server can aggregate this uploaded mask models and then they can build uh aggregate the global model. Sorry they can aggregate the local models to build a global model and then after this aggregation proof verifies um you can anyone can fetch this global model from blockchain. And to zoom into each part of my um my system what I've built um first uh local training on client side they do multiclass classification task on iris flower data set so given some attributes of flower they classify which type of flower it is and I used the training algorithm I used is fairly simple it's a logistic regression circuit uh which was written by another team called hash cloak for their conor ml project. So I just imported the circuit and the important point here is again the client um client's data never leaves their own device for the training and the part of uh masking the model.
I would say this is the only cryptographic part except for zk in my whole system. Um and but why do you need to mask a model in the first place? because there are several types of attacks known such that just by looking at weights and biases um model parameters you can infer some information about the training data set such as gradient inversion attacks membership inference attacks and so on. So in production of federated learning libraries, differential privacy is used because it's more efficient. Um because the way how it works is basically you just have to add the noise to the raw data.
So there's a trade-off between efficiency sorry there's a tradeoff between accuracy and privacy. So I wanted to explore more of a cryptographic way to mask the model. So I asked myself how can clients mask model in such a way that the server can compute some of the raw models without knowing each individual values. That means that we need additive homorphism. So you would naturally think that maybe you need MPC or FH but it's pretty slow especially when you have to perform a multi multiplication and I wanted to perform multiplication for weighted average.
So I was looking for another way and it turned out that you just need um this one time pad technique to mask the model. So there was this paper to talk about this technique which was which was published by Google for the original federated learning paper and I guess you can call it like a type of MPC but the important point here is that there's no decryption needed at the end because masks that were added or subtracted at the client side will naturally cancel out with each other. And I think it's pretty interesting to see how it works. So I'm going to explain it now. So first you have to put clients in a ring topology like this and then clients have to generate a pair-wise shared mask between each other.
For example, there's a mask one one two between client one and client two and there's mask 2 three between client two and client three. And then what clients um have to do have to compute locally on their own is given a raw model are um they have to add a pair wise shared masks that they generated with their right hand side neighbor and they also have to subtract the masks they generated with left hand side neighbor. So for example client 3's perspective they add um mask um 31 on the right hand side and they subtract mask 2 three on the left hand side. So you can see that when server aggregate um sum up these mask models m1 m2 m3 the little ms that were added or subtracted on the client side will be cancelceled out with each other and then you get the sum of the raw models at the end. And if you understand this, it's pretty obvious, but um the privacy on the raw models are um big RN uh each each client can only calculate the masks with their own neighbors.
So for example, from client one's perspective, they don't know um mask M23. So client one cannot reconstruct neither role model R2 from the client two or raw model R3 from the client three. And how did I build this more concretely? Um I used defy helman key exchange library more specifically ECDH library inside zkit nor library set developed by PSC. So the way it works is that each client have to publish uh first they generate private key public key pair and then they publish public key and then they fetch their neighbors public key and multiply it with their own secret key.
So that's how they compute um the shared masks between each other. And to summarize, this is like the whole the sequence diagram to represent how the whole system works. And just to recap, um the clients first train a local model on their own data and then they generate a training proof and they submit this training proof and their public key to the blockchain. And after training proof verifies um this their public key is registered on chain. And at this point we consider this as a sign of their participation to the collaborative training.
And then we set these clients in a ring topology. And based on this ring topology they f they fetch clients fetch their neighbors um public keys and then locally computes their mask and then using this value they mask their own raw models and then they submit the mask models and also masking proof to the blockchain. And after masking proof verifies and this masked model is registered on chain and then server can fetch the masked models from onchain for all the clients and then server aggregates this logo models and then generate a aggregation proof for um the aggre aggregation process and then then server submits the global model they aggregate it and also the proof um for the aggregation and then aggregation pro after aggregation proof verify then um this global model that server submitted is registered on chain and anyone including the clients can fetch this global model and then they can use this for inference. Uh I'm going to skip this for the sake of time constraint and future research direction. So right now the one time pat technique I just explained is pretty has a pretty weak security because imagine if you're a client if an attacker collude with your two neighbors it will reveal your role models.
Um so this is way worse than T out of N threshold security model of MPC and in terms of efficiency you have to generate this shared mask uh for each model parameter. So the complexity is it's going to linearly grow um with the model size but using this thing called packed secret sharing um you can encode multiple secrets. So for example in our case model parameters into a single polomial and addition uh on the encrypted values won't require any interactions or communication between server and client and we did multiplication for weighted average but I think we can offload this to the client side so we can skip the multiplication on top of encrypted data. And the second thing is that this construction doesn't allow any clients drop out or realtime join for the new newcomers new clients who wants to join. And this paper published by production level federated learning library called flower says that if you increase the number of the nodes that you have to communicate with each other a little bit which is login you can um then the server can tolerate some clients drop out meaning that they can reconstruct the secret value for the remaining client for aggregation and the real time join thing I haven't come up with any algorithm so I have to think more and for the rest of the future research um it's going to be more about the data science intersection of data science and ZK so I think it's a little fun to switch the gear here but if your assumption is that you can't really trust the clients I think it'll make sense to ask them to prove that they use the valid training data set as well so I found this research that looking at the train model.
If the weights are weirdly skewed to some specific number, it's kind of suspicious that they didn't use a correct or valid data set. And this is some like very new idea that I'm still reminating on. But let's say we pre-train a foundational model and then publish this somewhere out there and assume that each client Ethereum client um represents some marginalized community they hold some data set for marginalized community then what we can do is let them locally fine-tune this model on top of the foundational model and then aggregate them to build like a fair global model as a public good and leave it on Ethereum And what we can do is to use this to mitigate algorithm bias. So let's say if a corporate uses more fair global model then they can say that they're yeah they're like more fair or something. But I'm still thinking like does it really make sense to do this in the anonymous decentralized network?
Um I still have to think. Um and then finally um it's really important to think the incentive mechanism to incentiv how to incentivize people to publish highquality data. But the definition of high quality really depends on the question of what's the objective for collaboration. So yeah, we still have we first have to think this question and carefully design an incentive mechanism for people to submit data for collaboration and that's it. Thank you for listening and I I put all the um I published blog post recently and then put this on my social.
So let's connect if you like this kind of research. Um, thank you. Yes. Thank you very much.
Automatic transcript — names and jargon may be misspelled.