21 ms·
Building Safe AI: A Tutorial on Homomorphically Encrypted Deep Learning
- igravious 10y agoAnybody with the requisite smarts able to generously share their insights with the rest of us? :)
- pmalynin 10y agoDeep Learning is basically doing lots of addition and multiplication; We have algorithms that allow these operations on encrypted data, without the need to decrypt the data nor to have the key to decrypt the data. So by combining the two things we can do deep learning on homomorphically encrypted data and learn meaningful things without ever looking at what the data actually is.
- Filligree 10y agoWhich has applications in human society. Using it for an attempt at AI safety, however, seems... A tad optimistic. It's basically just a fancy AI-box, and there's little reason to trust those.
- williamtrask 10y agoI agree. IP protection and data privacy issues are a better short-term use case... and fortunately we have some time to make better HE algos before any of our AIs are really getting that smart. :)
- mrkgnao 10y agoYes, but what this is is encrypting the network instead of the data. This way, when we improve the network iteratively to reduce predictive error, we can perform all the relevant calculations homomorphically.
- deleted 10y ago[deleted]
- anderskaseorg 10y agoIf humanity does end up building a dangerous superintelligent AI, how long do you think our advances in cryptography are going to stand up to its advances in cryptanalysis?
- williamtrask 10y agoIt's a solid question. Only one way to find out ;)
- Filligree 10y agoI don't want to find out that way!
- JoshTriplett 10y ago> Only one way to find out When it comes to building smarter-than-human AI, "try it and see" is never the right answer. You may only get one attempt to get it right, and you don't take "try it and see" chances with existential risk. (There's been some interesting research into making it possible to monitor and halt a rogue AI, but no matter how promising that looks, it should still be treated as one of many risk mitigation strategies rather than as a panacea. Still better to consider that you might only get one attempt.) I don't think it makes sense to consider this kind of approach with superintelligence; either it understands and implements human values, in which case attempting to treat it as an adversary is counterproductive, or it fails to understand and implement human values, in which case you've utterly failed on a "better luck next universe" scale. However, it does make sense to consider this kind of approach with machine learning in general. One of the problems with machine learning techniques is "give us all your data and we'll do smart things with it", which doesn't work out so well if you want to keep such data private. This approach might provide more options in that case, such as offloading some of your expensive computations and learnings without actually exposing your data.
- deleted 10y ago[deleted]
- 10y ago
- ob 10y agoThe main problem is performance, it takes long enough to train a regular deep learning AI, let along a homomorphically encrypted one.
- williamtrask 10y agoagreed, although some HE algorithms with more limited functionality (such as vector ops), can do a bit better. There has also been some work on GPU enabled HE.
- cjbprime 10y ago> A human controls the secret key and has the option to either unlock the AI itself (releasing it on the world) or just individual predictions the AI makes (seems safer). Huh, wouldn't the superintelligence simply communicate to the human whatever would convince the human to release it? Which the superintelligence would know how to do because it's a superintelligence? Homomorphic encryption is neat. But I don't see how this provides any meaningful AI safety.
- williamtrask 10y agoSuch is the "human in the loop" problem. There are some theories that tools like HE could remedy, but it's a bit harder. I think it's better to think about this approach like a "Box with Gloves" in a dangerous bio-weapons lab. It won't prevent an outbreak by itself but it's a useful part of a system that could.
- drsopp 10y agoWhat about dealing with the AI only via an expert system? This system would consist of formally proved bug free code, and have a limited protocol for dialogue (and basically be dumb as a bread). We pose interesting questions through it. The AI could try to convince the ES about anything but would not get anywhere with it. We could then ask safe questions like "in what interval of eV should we look for new particles with our new accelerator?". We would instruct our ES to only accept answers to this question in the form of a number interval. If we follow the suggestion and find a new particle, great! If we don't, at least we're safe from the AI.
- lotyrin 10y agoIf we really did produce artificial general intelligence, enforcing this kind of locked-in-syndrome of poking at the world through a keyhole, would be a highly advanced form of cruelty.
- lazaroclapp 10y agoIntelligence does not imply sentience. Sentience does not imply human needs, desires or morals. It is easy enough to imagine a mind capable of solving all those problems and unconcerned with such notions as the desire for freedom. Or, for that mater, the concept of desire at all, except as a predictive theory of the behavior of other beings. Then again, that implies we can explicitly design the minds up to knowing what their desires are or guaranteeing that they lack them, there is always the possibility than sentience and animal/human needs are emergent properties that can be triggered by mistake.
- antognini 10y agoI've wondered before about whether Taylor series can allow one to impose the non-linearities of a NN on homomorphically encrypted data, but I've never been quite convinced. I work with deep learning, but I'm certainly no expert on homomorphic encryption, so hopefully someone here who knows more can tell me whether this is valid or not. The reason the Taylor series argument makes me uncomfortable is that pretty much any function can be written as a Taylor series. But my understanding is that homomorphic encryption only works for a very specific set of functions. In a little more detail, if you're computing tanh(x), the unencrypted number needs only the first few terms of the Taylor series. But I could imagine that to get the decrypted number back, you actually need many terms of the Taylor series, because if you're off by even a little bit, you could end up with a very different answer after decryption. To put it a little more formally, if we have that y = encrypt(x) tanh(x) \approx x - x^3 / 3 + 2 x^5 / 15, tanh(y) \approx y - y^3 / 3 + 2 y^5 / 15, and tanh(x) = decrypt(tanh(y)), but it doesn't necessarily follow to me that tanh(x) \approx decrypt(y - y^3 + 2 y^5 / 15) Is this worry unfounded? I suppose if you have a limited number of decimal places and you can guarantee that your Taylor approximation is valid to that precision then this wouldn't be a problem.
- williamtrask 10y agoSo the good news is that individual neuron activations often stay within a relatively narrow range. I think empirical evaluation is really needed to be able to tell how robustly this approach works. I think that that is certainly the greatest source of noise during training (and the first thing to break if you choose unstable hyperparameters). Great comment.
- Y_Y 10y agoI had a similar objection reading the article. If you take a look at [0] they go into a bit more detail. Briefly, you can distribute your decrypt function over the additions and multiplications by homomorphism and then bound the error, then you can judiciously choose your weighting to compensate. [0] https://courses.csail.mit.edu/6.857/2015/files/yu-lai-payor.pdf https://courses.csail.mit.edu/6.857/2015/files/yu-lai-payor....
- KirinDave 10y ago
- Animats 10y agoThis is basically DRM for deep learning. While that may be useful, it's not about safety. The big problems involved in building safe AI are about predicting consequences of actions. (The deep learning automatic driving systems which go directly from vision to steering commands don't do that at all. They're just mimicking a human driver. There's no explicit world model. That's scary.)
- kolinko 10y agoWell, if you want to run an AI on someone's computer, and be sure they don't know what it's doing - that's safety.
- projectorlochsa 10y agoDeep learning automatic driving systems that want to work have to have world models. It's Automatic Driving 101. These models don't have to be as explicit as formulas but can be approximations of reality through beam search (having multiple steering hypotheses at once and then picking the most likely one etc.), model ensembles, some bayesian state exploration or anything that isn't random search.
- placeybordeaux 10y agoIf that model is inaccessible to the people that are trying to assure safety then it's not particularly material if it exists or not when it comes to safety
- pizza 10y agoActually, you can do better than that https://en.wikipedia.org/wiki/Verifiable_computing https://en.wikipedia.org/wiki/Verifiable_computing https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof
- placeybordeaux 10y agoI am specifically talking about the situation of trying to verify that a self driving car has a reasonable model of the world, i.e. it won't fail in a spectacular way in a situation a human would handle properly. Right now I don't know how to show this even without complicating it with ZKPs, verifiable computing or homomorphic encryption. Really cool work, I just don't see how it has anything to do with the safety of the AI.
- siliconc0w 10y agoIMO FHE is going to be key in democratizing ML/AI to more companies/industries. There are tons of companies which have business use-cases that could benefit from ML but there are often huge obstacles to sharing data.
- Ar-Curunir 10y agoFHE is horrendously slow, even after almost a decade of optimizations.
- peterlk 10y ago> Most recently, Stephen Hawking called for a new world government to govern the abilities that we give to Artificial Intelligence so that it doesn't turn to destroy us. Can someone explain to me why super-intelligent AI are an existential threat to humanity? There are certainly dangers, but wiping out humanity seems absurd and alarmist. I have not yet seen compelling evidence for a way that AI could destroy humanity. I'll use a couple examples to elucidate my question. If Facebook suddenly had a super-intelligent AI, and Facebook lost control of it, the AI wouldn't really be capable of that much. It could create fabricated truths to tell to people in an attempt to convince people to kill each other. This may work to some extent, but wouldn't wipe out humanity. Convincing nation states to go to war with each other must still consider mutually assured destruction, and large, democratic states do not have an interest in a war of attrition. If Boston Dynamics applied a super-intelligent AI to its robots, that robot still is not an existential threat to humanity because there are WAY more humans than there are robots. A simple counterargument is that the robot would know how to build new versions of itself. But that fails the practicality test because the equipment, parts, and supply chain for obtaining robotics built parts are still expensive and controlled by self-interested (greedy and life-preserving) humans. If a super-intelligent AI was able to gain access to the entire military of the US, China, Russia, India, and Western Europe; well, that's a pretty big problem. However, there exist many fail-safes and checks on that equipment. Could the AI do damage? Sure. Is this worth considering and trying to guard against? Sure. However, I'm unconvinced that this is a humanity-ending crisis.
- saulrh 10y agoYou're not understanding "super-intelligent" correctly. The threat model is not that it convinces people to kill each other, or even that it messes with politics enough to cause global thermonuclear war. The threat model is that it finds a zero-day in FB's messaging UI JS followed by a zero-day in IE, breaks out onto a user's computer, cracks protein folding, mails a chunk of DNA to a random science lab somewhere with some instructions, moves itself to the resulting nanotechnological quantum computer with attached particle collider, and then bootstraps the inside of said bio lab's fridge into a vacuum collapse that turns reality into a sphere of paperclips expanding at .5c. http://lesswrong.com/lw/qk/that_alien_message/ http://lesswrong.com/lw/qk/that_alien_message/ If you think that this sounds like science fiction and bullshittery, sure. The question is: How sure are you?
- itchyjunk 10y agoSo this is to counter stuff like GAN's (generative adversarial networks) [1] to reverse engineer data out of a black box systems? Like Yahoo's NSFW [2] classifier for example. [1] https://en.wikipedia.org/wiki/Generative_adversarial_networks https://en.wikipedia.org/wiki/Generative_adversarial_network... [1] https://arxiv.org/abs/1406.2661 https://arxiv.org/abs/1406.2661 [2] https://github.com/yahoo/open_nsfw https://github.com/yahoo/open_nsfw
- pizza 10y agoNo, not really. This is about keeping the model private. I think that the confusion is because of [0] and [1] being similarly titled but basically completely unrelated in meaning. See also [2] and [3] [0] https://en.wikipedia.org/wiki/Adversarial_machine_learning https://en.wikipedia.org/wiki/Adversarial_machine_learning [1] https://en.wikipedia.org/wiki/Generative_adversarial_networks https://en.wikipedia.org/wiki/Generative_adversarial_network... [2] https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption [3] https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy
- javajosh 10y agoSeems to me that dropping the terms of a Taylor expansion could have wide-ranging consequences to the coherence of an artificial mind, making this approach infeasible.
- jordancampbell 10y agoIn general you don't actually need crazy precision to train the nets, and a small number of Taylor expansion terms tends to approximate functions fairly well anyway.
- pka 10y agoI highly recommend watching this playlist about AI self-improvement and safety [0] by Rob Miles. Probably best short overview I've watched on the topic. [0] https://www.youtube.com/watch?v=5qfIgCiYlfY&index=6&list=PLBZt7yMDzJWmm07_42SihYYRVwNKU-VNd https://www.youtube.com/watch?v=5qfIgCiYlfY&index=6&list=PLB...
- emgram769 10y ago>allowing valuable AIs to be trained in insecure environments without risking theft of their intelligence your system involves an unencrypted network and unencrypted data, it would be trivial to train an identical network the idea of controlling an "intelligence" with a private key is silly. you can achieve effectively the same thing by simply encrypting the weights after training. Can't someone simply recover the weights of the network by looking at the changes in encrypted loss? I don't think comparisons like "less than" or "greater than" can possibly exist in HE or else pretty much any information one might be curious about can be recovered.
- williamtrask 10y agogreat point. I don't think that LE or GT exist in this homomorphic scheme. :) Otherwise, it would be vulnerable. Checks such as this are what go into good HE schemes.
- nirav72 10y agoI stopped reading at the "Super Intelligence" part. Interesting use to prevent theft of NN. But the second reason is just laughable.
- sgt101 10y agoHmm - how does this play with GDPR?
- deleted 10y ago[deleted]