The Decentralized Future of Private AI with Illia Polosukhin - #749

31:06And then the revenue is distributed to the token holders, right? As like for the model's lifetime, right? So we can actually like run and guarantee those parameters as well. So what's interesting about that idea is that, you know, when you talk about this idea of kind of the broader conversation around like compensating rights holders for content that's consumed, I feel like it gets to be like, oh, I'm kind of like, how would you ever do that? Like, you're crawling all of the internet. Like, how would you even possibly begin to do that? But just you describing this token model, it's kind of like, oh, well, maybe you could do that.

31:53Like you're crawling a site, you know that site, you reserve a token for that site. Someone needs to verify that they have control over that site to access the token. now they have a share of the model and they can you know gain in the rewards and all of a sudden at least for me it like clears up a lot of the just like it's not possible feeling about it yeah exactly and and and so that's a really like that example as well as you can contribute data privately so you can say hey i want this data to be used in the model training but i don't want any anyone to see it right for example right and so you can also do that or you can say hey i want it to be used at inference time as part of the search retrieval index, but not a training.

32:38So you contribute, like it's payable, like for example, for payable data, New York Times can contribute their data fully privately into secure enclaves. And then it's going to be used at retrieval time. It's going to get recorded and they're going to get paid for that. But it's, so things like that, you just get a lot of these pieces kind of for free in this new model. So earlier in the conversation, we talked a little bit about closed models versus open models. And did you anticipate, you know, as, you know, chat GPT happened and kind of the private foundation models began to establish themselves, like, did you anticipate that there would be like fast followers of like these open models?

33:23or has it surprised you how quickly open weights and to a lesser degree open models have come about and their capability? No, I was actually, I think I was trying to remember, it was like February 23, I was talking about like, hey, open source is going to catch up because, yeah, I mean, I think the challenge is like with pure open source right now, and again, this is something we're solving, is that I built a model, I released it, Everybody is like, cool, here's the stars on GitHub, stars on Hugging Face, but then you don't make any money. Because of that, it also becomes less about open source and about open weights, and people keep the source so they can continue doing things.

34:12In result, we're actually wasting a lot of resources because everybody is redoing experiments because we actually don't know what were the things people did to get to these results. And so everybody kind of need to reproduce or poach the people who've done it. And so kind of the way we think about it is to reverse it, where you can actually have an open process of training, right? So the training, I mean, the data either fully open or this like kind of encrypted data, right, that you can run over. So available, but not necessarily transparent. Yeah, yeah. And you need to pay to access it in whatever your model token or some other way, if you're planning to monetize differently.

34:55And then the resulting weights are actually also encrypted and only run in this kind of DCML model. So you can actually monetize it. So you can receive kind of revenue from using it. You can say, hey, compute cost is X. I want 20 cents for each million token over that to go to the model developers and all the contributors to do that. So you kind of can reverse that and get actually like actual open research and collaboration happening there while monetizing the outcomes. And the benefit is you still get all the properties of open source, right? Everybody can use it. there's no like way to stop using it you can even run it on your hardware if you have the modern like blackwell or hopper and like you need to set it up in this confidential mode and uh uh yeah you can fine tune it you can do all those things on top yeah i mean a missing property is the ability to to see it and change it maybe uh you know maybe that's more true for software than for a model if you have the ability to to fine-tune on top of it that's exactly way that you can change it there's very little people who go and like do a brain surgery on a model i mean there's few that like do you know like evolutionary algorithms and other stuff but yeah usually it's either fine-tune post-train rl etc you know although i like the pushback that i would offer is that like if the best models were open you know maybe we'd see a lot more brain surgery and maybe we'd have a more interesting kind of ecosystem of of results like i think you know there are people that do that kind of thing for various reasons with you know open models but i think there's a lot less invested in them because they're not as good as the closed models um i don't know interesting um you know i'm curious like you know there are definitely you know, some aspects here that make a lot of sense to me.

37:08Historically, you know, there's always been this big barrier that's not at all technical, and that is, will people pay for privacy? And whether that's, you know, currency or, you know, the sheer force of will that's required to jump over the hurdles to achieve it, you know, inconvenience. uh you know do you do you feel like you know this is different or it's different in this space or like how do you think about that challenge i think i think twofold one is i think there there is a audience that will pay about for privacy right um and it's not i don't think the issue is that there's never that audience is that it's relatively small it is relatively small but i think the the idea here and kind of, I think everybody's on a threshold, as I said, of what they feel they would give to the model.

38:04And the more you give, the better. Actually, we're getting to a stage where models are generally, they're sufficiently intelligent and actually it all becomes about context. About context management, about tool management, about all those pieces. And so So the idea here that kind of we are very much going after is that because it's private, you can actually share a lot more with it. And you will add your email, your calendar, your medical data, your financial data, your crypto wallet, et cetera. And so it's able to manage your whole life, not just like some aspects that you were willing to share.

38:41and so and kind of the first cohort that actually cares about privacy that's you know that is our early adopters who we kind of target to really enable this but then kind of as this becomes mature now it's it's appealing to more people because it's a better product and kind of smarter product more intelligent product again not because the model is right away more intelligent but but because you have more context. The other side of this is actually because of this open research process, what we are aiming for is to have people, again, fine-tuning specialized models for specialized use cases. And again, this is where because they have a monetization embedded into this, they can actually invest effort and time and compute to actually build interesting specialized models that may be better at financial use cases, healthcare, et cetera.

39:43And again, all of them are available on your platform. They can compute over your data. And then again, now that all your data is there, it's useful, there's useful models. Other developers as well, again, if I'm building a note taker or something else, I can build a note taker right now that takes all your data, listens to it all the time, sends it to my server, stores it on my server, et cetera, but liability and also now it's a hurdle for everybody else to adopt it. Or you can just say, actually, I'm going to build my app and deploy it into this cloud where it runs on your side and saves context there as well in your data store.

40:28And so now your data store becomes even more useful because it has all the notes as well there and your AI can now read over those notes. So you don't need to like, again, merge those things with Zapier and do all those things. Like that's the idea. It's like you have network effects of kind of more context, more data, more applications building around the user. And so, yes, like it starts with early adopters who care about privacy and kind of layers on as more and more applications and things become available on this cloud. So I want to talk a little bit about the process of making models available to this environment.

41:08To what degree is it a simple lossless transformation of an existing safe tensor, GGF file, whatever, some weights file versus am I having to rebuild my model in some new paradigm? How does that work? Yeah, I mean, we effectively run, you know, VLLM and customized version of VLLM. So everything that, you know, normally served already works. And if you need something custom, then you can also package your own Docker. I mean, that is less secure from a user side, but it's also available. It's the secure enclave that ensures that there's no kind of man in the middle attack between VLLM and like the model weights and the customer data.

42:03Yeah, so exactly. So what's happening is, you know, you checkpoint your, you know, model weights on chain. So, you know, the hash of the model weights and the encrypted hash as well, you know, the encrypted data is uploaded kind of to decentralized storage. And now when somebody wants to run a model, they have an encrypted TLS connection directly into the secure enclave. that secure enclave you know gives you back the effectively signed certificates that it runs in secure enclave you can also verify them with our own chain kind of uh key management system and then we also have this concept called multi-party computation so near blockchain itself kind of uh right now part of our nodes form this multi-party computation network which allows inside the secure enclave effectively have its own private key to decrypt things.

42:57And so that's kind of how all these pieces work together. There's secure enclaves, but also if you encrypt something, you need to encrypt it with some key that is only known, the private key of this is only known inside secure enclave and nowhere else. And so this is where this NPC network enables that. And so, yeah, like effectively, you know, you encrypt locally, you upload it, it checkpoints. And now when user calls, they know that like effectively the secure and playful respond that this model hash was run on your data. Here's like signature by NVIDIA, Intel, et cetera. And you can also verify kind of certificate provisioning.

43:40And is that signature created at like, you know, by some process at the boundary or is it, you know, intrinsic to the inference actually happening by this model on this data? Like, is it a... So the signature certifies a Docker container that runs inside SecureEnclave. And so Docker container is our Docker container with VLM that runs this model hash. So we attach that. That's what I'm saying. If somebody builds custom Docker container, you can do that, but then user needs to trust your Docker container. Got it. So the trust boundary is the container. And if the container is doing what you say it's doing, then the signature certifies that that was a container that was actually used.

44:26Yeah. And in our UI, we have effectively like, you know, like a green shield that you can click similar like HTTPS works. You go there and it gives you like, it gives you like, hey, it's all correct. And then you can go and actually verify all the signatures and all the certificates and even which GPU it ran on and like other stuff as well. And like links you like effectively to all the relevant Docker Githubs and other things you need to know if you want to like re-verify everything yourself. And so that's maybe an interesting segue into like, you know, where you are with all of this in terms of, you know, how much of it is, you know, aspirational, how much of it is built.

45:09Like you're clearly you have at least the notion of a user interface, if not an actual user interface. Like how far along are you? Yeah. So we have, I mean, we have a product that we can, I mean, that we're in testing and alpha testing with, you know, kind of cohort of users. it's it's both developer products so you can you know buy credits and effectively use confession inference in your own applications as well as we have a kind of consumer product which is you know private chat GPT effectively which indeed provides you all of the kind of certification and verification information if you want while using it and then the the custom model right now is that's in development, can be coming out in a few weeks.

45:59And remind me, which part is the custom model? So this is where you can encrypt and upload your own model. Oh, got it. Okay. Yeah. And then, I mean, the fine tuning and kind of training that's coming a bit later. And we started off talking about the fact that encryption is computationally complex, like it brings along its own costs you know relative to um you know the per token inference costs that you know someone might see you know whether it's open ai or open router or something you know like where does this where do you expect this tend to fall to fall relatively speaking so it will be affected at the same cost the overhead on the computation side is one to five percent yeah so it's very minimal and it's mostly just i mean it's like encryption decryption on a boundary uh yeah and kind of constrained by that not by computation and so what what do you see is like the main barriers to you know near scaling you know this approach and um you know getting people on boarded or, you know, on boarded, you know, not just technically, but like ideologically and that kind of thing.

47:25Yeah. I mean, I think the kind of, as we just discussed, right, like are people willing to pay for it? Right. That's, and again, I think, but you, you know, well, I think what I heard you say is that like, I'm not really paying, like I'm paying, it's going to cost the same, right? Or actually, it's open source model, so it's actually cheaper than OpenAI. Yeah. And I did reference the idea that the cost is also convenient to learning a new thing. Like, maybe we should hit pause on the adoption conversation and go back to, you know, we talked about from a model provider perspective, you know, that's the same.

48:09They just deploy into your container the same model format. What about from an end user perspective? I guess in the general case, they're just using a chat app that, you know, or whatever. They're using an app. So it's not different from them. So presumably, like who is the argument that, you know, there's no particular inconvenience cost to anyone in this, you know, ecosystem? Like everything's kind of the same or? yeah i mean the goal is to make it everything is like either the same or better right like you either don't i mean it looks exactly i mean very similar experience right and the idea that because it's kind of private you can also have additional features that you wouldn't have in uh in the public it's also it is open source so you can you know people can contribute you can fork etc right so you know you cannot just go and fork chat gpt and add some stuff and have your own version with some things but here you will be able to do that because it's your data right that travels with you so you can like launch your own version with custom like improvements and then everybody who logs in will get all their messages all their history all their memory all the apps with them so it's also like kind of detaching your identity from specific application but What do you say to the skeptic that says, you know, it all sounds too good to be true?

49:37Like, where's the, you know, besides from the fact that, you know, building software is hard, building a company is hard, getting people to fund weird things is hard. Like, what's the hard part? I mean, the hard part right now is it's inertia right now. I mean, I think like there's a cohort of people who are like, hey, I'm already in Google ecosystem, why would I do anything? Right. Everything is already here. Google has my email and my calendar anyway. Why do I care if it's private? Exactly. Yeah. So, so I think like there's, again, there's an aspect of that. And like, I think people generally trust Google with their data.

50:17So I think that is like, that's inertia that we kind of need to address. Right. And I mean, not to, I mean, I work with Google, so there's indeed a lot of security to make sure the data is protected. But obviously there's still like, I mean, there is a way for somebody in customer support to help you with your data. So there's a way for a third party to have access to your data. There is, I mean, we've seen this with OpenAI, right? There's news that they're effectively scanning all the chat logs and then the ones that are flagged are sent to human to evaluation and then to police. So you effectively have potentially humans looking at your chat logs.

50:59We had obviously data leaks from Grok and others that your chat logs got visible and indexed. So I think that is the backdrop of why we get adoption, but the inertia is the other side. OpenAI already has whatever, half a billion users or a billion users. So we need to have a product that indeed can deliver on if people want to switch and use. How about latency? Admittedly, encryption is not the latency killer that it was, you know, 10 years ago or so. As a lot of that stuff's getting pushed in the hardware, like, is it an issue for you? Not really. I mean, we have, like, it's a little bit higher latency, again, just because, like, when it goes through the boundaries, there's, like, some additional delay on kind of encryption.

51:59But we're also working on, like, it's also an engineering challenge of just, like, streaming encryption and stuff like this, like, improving that. I mean, we're using TLS right now, right? There is no additional latency. This connection is inter-encrypted, although we're actually going through centralized server. We're actually trying to figure out how to make it as direct as possible. So ideally, actually, latency is less because ideally right now, yeah, you actually should be accessing the closest GPU, ideally, in your city. I mean, I've talked to people who are like, there are going to be data centers everywhere.

52:35People will build mobile data centers, et cetera. and like you want to find that one connect to it run your compute on it you know hydrate your data there like that that's kind of where you know this infrastructure can move to and i really deliver on that like uh i we're not there but that that's kind of the vision is really actually reducing latency because you know you're sitting in philippines you right now you need to go to texas or whatever where open ai servers are uh versus like there's data center in philippines actually are sitting underutilized. And so you should be using it. I guess another question that I have is that I think it, you know, when you boil it down, a lot of the value proposition here is, you know, around trust and the user being able to trust the interactions they're having with AI and privacy is a part of that.

53:34But there are also still fundamental trustworthiness issues with, you know, your creation, the transformer, like its ability to give you results that are worthy of your trust, you know, hallucination, for example. Are you doing anything there? Like, do you see that as, you know, how do you think about that as an issue and um you know what's your you know what are your thoughts about how or if or how that gets solved yeah i mean that that is an important question and um indeed especially as we like i kind of mentioned like i think the ai will be how we interface with computing and you ideally, yeah, want to make sure that there is no kind of biases in that that are not represented with your view.

54:31So I think there's like few components improving trust in these models. I think it starts with indeed the open process of how these models were trained because there's this concept of like sleeper agents, right? you can actually like train things into the model so that at some point during some conditions it activates and behaves in a different way than normal and so you can like you know introduce vulnerabilities in the code into a coding model like based on some condition like you know i'm assuming if somebody wants to do a new stacks net that's how they're going to do it um the so you want to know how it was trained.

55:14Then right now, you're running, even if it's open source model. Isn't that first point an argument for true open source as opposed to just sending a certificate or a stamp of something? So that's right. You want open source, but you don't need open weights. so you want to know what went in but the weights itself can be encrypted so you can monetize but yeah so that's what i'm saying we need to open source not like open weights is right now and just kind of everybody's like i mean effectively it's useful but it's mostly like as if you know so is your was your argument earlier that if you can if you can close and encrypt the weights then you have greater, you anticipate greater willingness to open the source, like make the training process more transparent?

56:18Because you can monetize. Like in this encrypted weight model, you can monetize the usage of the model. Yeah, that's right. So your point was people are holding onto the source because they want to retain some monetizability and they're making the weights open. you know so that's their piece that they're holding back so the opening of the weights is the marketing right for them to then leverage their close source thing to then cook something else right either for specific customers or next model or whatever this is uh or attract like to their app but if you can monetize actually the model you trained and you have the whole process open um and especially if there is like some semi-formal way for people who leverage your learnings as well to then uh kind of contribute back as well as well yeah but i mean like that assumes that there's not a lot of perceived innovation in the training process and i don't know that folks that are training you know frontier models in the like ahead of the the you know at the frontier sense of the term would necessarily believe that right i mean there can be that's what i'm saying like but i i think the the the lag on the frontier right is you know three to six months and so i think the benefit here is like if you are able to effectively do a training run and start monetizing it you're like you can leverage that uh you know monetization to then potentially to reinvest into the next thing, et cetera.

57:59But because you opened, everybody can go and contribute and maybe come up with new ideas, et cetera. So you're just kind of accelerating this process. Again, this is how the computer science and AI worked before. We would open it up. The papers was out as soon as possible. And now everybody's delaying everything like at least six months to a year. So we're solving big picture trust. The first part is openness. Yeah, well, yeah, open research, open data, knowing what data goes in and what bias there. Second is verifiability of the inference, right? Again, right now, you know, there's people complaining that like Claude gets dumber in, you know, daytime and like maybe it doesn't, we don't actually know.

58:45Yeah. So like having verifiability, again, this can be something where like, you know, when you specifically ask what stocks to buy, there's like a rule that says like, let me tell you to buy this. Only use SmartQuad. So like verifiability of that, that gives you another level of, and then I agree that the third part is actually like, you know, especially when we allow those models to go and start doing actions, like how do we make sure it doesn't do anything? And so there I think there's a few interesting areas. I mean, there's a lot of research, right? People are trying, you know, how to like ground hallucinations, how to do all those things.

59:25So All of that needs to be done. And again, I think open research process would help a lot with that. But the other aspect of this we're looking at is actually formal verification. So right now, when we talk about software, when we talk about the CI systems, we're testing some use cases. We're testing, we have evals, maybe we have vibe testing, but we don't really have guarantees that the system will comply to some requirements. And so formal verification is a way to actually achieve that. And formal verification should be happening at the invocation side. So as you call something, right? Like, hey, so the example is like a little bit closer to blockchain space.

1:00:12You know, if you're putting money into something, you want to make sure you can, you know, at least get as much money back, right? That nobody will be able to steal your money. For example, like savings account type thing. and so you want to have the guarantee that when you put in your money that you'll be able to do. So you want the proof at that time. So that's kind of like we call it at invocation verification. Similarly, when you're calling a system, you can say, hey, you can access my email, but you cannot delete anything, right? And you cannot leak anything. You cannot do this set of actions, right?

1:00:49you know um and so the system like the the te that runs it the secure enclaves that runs it like proves to you that the code that it runs inside indeed complies with this requirements so this docker hash for example you know complies with this requirements and so now you have not just proof of verifiability but as a proof of specific you know preconditions and and if and if it fails right if it doesn't match your preconditions right this this doesn't execute And so today, what we talked about being possible is this idea that if you can get access to whatever the source code is that's going into the Docker container, you can certify that it's this thing that you know and trust that operated on your data.

1:01:38and what you're referring to is at some point in the future where you can not necessarily have to know what that thing was, but know some conditions about what it's able to do or how it's running. And the verification is not just like a cryptographic hash, but it's like verification and validation of the code and what it's doing. And I mentioned that for folks that are curious about this, just a couple of episodes ago, I had a really interesting conversation with Christian Sagetti about verification, you know, dug deep into all this stuff. He's one of the pioneers on that for sure. And so that was the third of your three things for kind of solving this broader trust issue.

1:02:29Yeah, I think that that's going to be a really important component of that to make sure that we can actually trust the systems. Again, as a user, you're probably not going to go and review Docker container code and ensure. And especially, it gets complicated when things are starting to call each other. Like when you have one AI system calling another AI system, calling some MCP tool, calling another AI system. And so the idea here, you actually have, like the properties are actually composable, right? So like if this service proves to you that it will not, you know, will work in this specific way, when it calls other services, those services need to prove it as well.

1:03:13And if it doesn't, it's not able to call it. So that's, I think, is really important is actually kind of gives you this composable effect, which I think right now is the biggest problem. As you can imagine, the systems become more and more complex and you have all these AIs talking to each other. And we have no idea what they agree on doing and what they end up actually executing. So I think that's going to be a pretty fundamental system change. but it actually requires this verifiability because you need something to guarantee that the code inside is following this property. So you need some containerization that you can trust.

1:03:54Very cool. Well, Ilya, thanks so much for jumping on and kind of talking us through what you've been working on. It sounds like super interesting stuff we've had. I think we've covered this idea of privacy on the podcast to some degree in the past, like we've talked quite a bit about differential privacy, talked a little bit about like the open mind, PySift kind of decentralized training kind of stuff. But this is definitely a different take and one that I think is, you know, kind of right in line with the direction that things have gone from a, you know, Transformers Gen AI perspective. So I'm super interested in, you know, seeing how it all unfolds.

1:04:40Yeah, I appreciate you having me here and diving in. Yeah, thanks so much. Thank you.

1:05:08Thank you.