8 ms·
There's a lot of comments on that reddit thread about how awesome this would be as a service. But there's a big problem of trust with this for ML. How do I kn
by dpwm 9y ago
There's a lot of comments on that reddit thread about how awesome this would be as a service.
But there's a big problem of trust with this for ML.
How do I know you actually ran what I paid you for and not just generated random data that looks right in the shape I wanted it?
You could farm it out to two people and if the results disagree, then payment is decided by a third. But then you've just doubled the (paid) workload, and you've not really solved collusion by a significant portion of the workers.
- TrainedMonkey 9y agoThis is identical to the problem blockchain solves - hard to solve, but easy to verify. For example, if the workload is training a neural network on a set of samples it is relatively cheap verify performance on a training sample. Alternatively you could give X% of tasks to multiple workers for cross checking. In your example X% is 100%, but it does not have to be that high.
- mattkrause 9y agoSay you do a single feedforward pass. How do you verify that its output is the result of a trained network-and particularly a completely trained one?
- TrainedMonkey 9y agoAside from doing the same work X% of the time I can think of only one other option. The network could be overloaded with additional nodes such that it would also compute some function on the input data with the known output. For example a hashing function. Having said that, single pass does not strike me as a particularly useful unit of work. You would want to batch the samples, and that leads back to a strategy of verifying a portion of them based on the host trust metric.
- gormanc 9y agoAccording to the website (https://vectordash.com/hosting/ https://vectordash.com/hosting/) they use a highly isolated Ubuntu image, so the person hosting the service shouldn't have access to the VM with your model or data on it. It would be nice if there was some third party audit of the software though, the models, the code, and even the training data can be pretty sensitive for researchers.
- throwaway2048 9y agothere is no way to "highly isolate" a VM from a host.
- lostmsu 9y agoBut there is (though I think they don't use it): TPM based host attestation.
- throwaway2048 9y agoThe microsoft secureboot golden key got leaked, anything based on secureboot as a root of trust is 100% blown wide open. https://web.archive.org/web/20170604013028/https://rol.im/securegoldenkeyboot/ https://web.archive.org/web/20170604013028/https://rol.im/se...
- q3k 9y agoTheoretically possible via SGX.
- eridius 9y agoBeing able to generate random data in the right shape for arbitrary ML workloads would be a pretty impressive technical achievement.
- nandhp 9y agoThis sort of effort has existed for a long time, e.g. SETI@home and the Great Internet Mersenne Prime Search (although they don't tend to pay people). They've faced many of these same problems, and presumably devised minimum overhead solutions.
- zitterbewegung 9y agoYea but their workload is much harder to fudge and the solution they use to confirm primes is running the task twice . Training of models can be shortcutted or even maliciously tampered with.
- Samin100 9y agoIt's pretty much letting people with GPUs become a sort of 'mini-cloud provider'. There's no job queue or fancy distributing computing setup. We just let you SSH into a container on someone's computer, and pay for the time used. I was doing a lot of fun deep learning projects on the side & would often Venmo my friend who was mining Ethereum to use his GPU to train my models. He made more and I paid less than AWS spot instances or Paperspace. This is just a fun side project hoping to let people who want to train their deep learning models do it cheaply (on other people's computers!)
- sangnoir 9y ago> It's pretty much letting people with GPUs become a sort of 'mini-cloud provider'. There's no job queue or fancy distributing computing setup. We just let you SSH into a container on someone's computer, and pay for the time used. I had the same idea a few days ago - but in my head, the process would be wrapped up as a "cryptocurrency" where the AI researchers pay real money and the "proof of work" is useful/"real" work. I ran into 2 issues regarding trust: the first is that how do you verify that the hardware owner is running the real job an not NOOP'ing and sending false results? The second issue is how do you protect the hardware from malicious jobs? GPUs have DMA access - how do you stop task submitters from rooting your box and recruiting it into an AI botnet (for free)?I ended up dismissing the idea, but if you could work out these 2 issues, there's money to be made...
- snuxoll 9y ago> how do you stop task submitters from rooting your box and recruiting it into an AI botnet (for free)? Only real way to do this is run the job in a VM with a GPU and CPU+motherboard that support passthrough (read: not consumer NVidia GPU's, your CPU+board must support an IOMMU and your card cannot freak out when being reset after initialization).
- jonhohle 9y ago> the first is that how do you verify that the hardware owner is running the real job an not NOOP'ing and sending false results? Consensus. Have _n_ nodes perform the same work (if it’s deterministic), and only accept (and pay) if all the nodes match - or at least the nodes that were part of the majority I don’t think this would be considerably different from SETI or folding@home, which have been going on for around twenty years. For my senior project in college one of our ideas was a distributed render farm that operated like what we’re talking about. There were some additional issues there (transfering assets, preventing node owners from extracting the output [say a studio was “letting” fans donate compute time to render a feature film], etc).
- Terribledactyl 9y agoPay some hourly nominal fee, and a "bonus" for how well it classifies some reserved data? Proof of work could be the fit.
- Houshalter 9y agoYou don't verify every task. You verify some percent of them at random. And blacklist the people who cheat the system (Maybe with some leeway because random memory errors are a thing with consumer GPUs.)
- runeks 9y agoHow do you blacklist people who cheat when a proxy server and a freshly generated public key can make them appear as a new node in the network?
- Houshalter 9y agoThe same way any other website deals with bot abuse. You give extra scrutiny to new accounts, require captchas, flag suspicious email providers and bank accounts, and block IP ranges that correlate highly with abuse. I don't think you would need to go anywhere near that far though. Because it's pretty cheap to do lots of verification constantly, and fake users wouldn't last very long.
- mcgarnagle 9y agopepper data with known results, obviously
- wdr1 9y ago> You could farm it out to two people and if the results disagree, then payment is decided by a third. But then you've just doubled the (paid) workload, and you've not really solved collusion by a significant portion of the workers. That would be the naive/bruteforce way to verify trust. Just like you can find a substring faster via Boyer–Moore than a char-by-char match, there are more efficient ways to verify trust in a distributed environment like this. There's a few white papers on the topic.
- ThrustVectoring 9y agoCouldn't you embed a task or sub-task with a known result and throw out responses from nodes that didn't successfully process the sub-task?
- brador 9y agoYou could randomize the tests + test everyone at the same time. So every r(n) cycles send a micro problem with a known precomputed locally verified solution. Compare solutions, kick and ban node if wrong.
- carussell 9y ago> How do I know you actually ran what I paid you for and not just generated random data that looks right in the shape I wanted it? See https://pfrazee.hashbase.io/blog/nodevms-alpha https://pfrazee.hashbase.io/blog/nodevms-alpha
- ThePhysicist 9y agoWhile I think it's a valid point I don't see this as a large issue for this platform: I think that many ML workloads do not require a fully-trusted environment as it's easy to verify the results after training by running the test set evaluation on a local machine. Also, many datasets can be transformed in a way such that they do not reveal much about the underlying data itself (e.g. by using one-hot encoding, removing feature labels, categorizing/tokenizing potentially sensitive fields like names, ...), alleviating data security concerns in many cases. Leakage/theft of your ML models/code might be a bigger concern here, though for many companies this might not be a large problem either as in my experience the models are often just slight modifications of "best practice" architectures.
- traviscj 9y agoPiling on/agreeing with you: The “magic smoke” isn’t the model, it’s the infrastructure the model plugs into, the data->feature pipeline, AND the model. Assuming you’be done the things you mention (and maybe with one additional assumption of several models operating at once), I would also consider the models themselves to USUALLY not be super super sensitive.
- freech 9y agoThe person who runs the platform could do some calculations themselves and then throw people out if there's a disagreement.
- dpwm 9y agoThis is quite a good solution. It reminds me of public transport in some European countries. Yes, you can get on board without a ticket. But there will be a guard who will be on board maybe 1 in 10 times and the fines are substantial. The problem is you can't really issue substantial fines in this instance. I suppose you could pay less for the first few runs where verification is more likely. I really want this to succeed, and I think these problems can be overcome.
- freech 9y agoYou could require people to advance some money, that they only get back if they pass the test.