Trustworthy AI Models Enable Private Inference – An Alternative to Cryptography

Dealing with untrusted instances often requires the exchange of private data. Traditional approaches to privacy protection rely on trusted third parties or cryptographic protocols like Multi-Party Computation or Zero-Knowledge Proofs. Although cryptographic methods have made great strides, they are limited in the size and complexity of the applications they can be used for. New research argues that powerful machine learning models could take on the role of a trusted third party and enable secure computations for applications that were previously impractical.

Trusted Capable Model Environments (TCMEs)

The concept of Trusted Capable Model Environments (TCMEs) is proposed as an alternative approach to scaling secure computations. In TCMEs, powerful machine learning models interact under defined input/output restrictions with explicit information flow control and statelessness. This approach aims to achieve a balance between data protection and computational efficiency, enabling private inference processes where classical cryptographic solutions are currently not feasible.

One example is the classic millionaire's problem, where two people want to find out who has more money without disclosing their respective amounts. Cryptographically, this can be solved with Secure Two-Party Computation. With TCMEs, both parties agree on a model, a prompt, input restrictions (e.g., 32-bit integers), and output restrictions (e.g., "first" or "second"). If the environment is trustworthy and does not reveal private information, this offers an alternative approach. While a feasible cryptographic solution exists for this simple example, for more complex applications, due to the unstructured nature of the computations, it is currently computationally infeasible to rely on cryptographic solutions. In contrast, it is argued that securely performing these computations with a new inference paradigm using machine learning models is quite feasible.

Fundamental Properties of TCMEs

For models to be considered trustworthy, they must fulfill three fundamental properties:

1. Statelessness: The model must not store or learn any state based on the data. This makes it clear which private data influences the output in each interaction and ensures that no private data can be extracted from the model after execution, and that the model cannot discriminate against the user based on previous interactions. 2. Explicit Information Flow Control: The model and the underlying system should have an explicit and immutable information flow that can be verified. Users need a mechanism to verify that the correct model, prompt, and input/output restrictions are adhered to. 3. Trustworthy and Capable Models: It is assumed that the models used are capable of solving the respective task and that their performance aligns with the expectations of the involved parties.

The full implementation of all these properties is currently still a challenge.

TCMEs Compared to Cryptography

TCMEs pursue the same goals as Multi-Party Computation (MPC) regarding correctness and data protection. The main difference lies in the execution of the computation: Instead of parties interacting with each other, in a TCME, each party provides its private inputs to the environment, which computes the function itself and outputs the answer. Correctness arises from the capability of the model. Data protection is ensured by the properties of the TCME.

Use Cases and Outlook

TCMEs could enable analyses and collaborations for tasks that were previously impractical. For example, programming the task is no longer limited to a highly specialized specification but can be done directly in human language. Current research focuses on improving the statelessness, information flow control, and trustworthiness of AI models to advance the practical implementation of TCMEs.

Bibliography: - https://arxiv.org/html/2501.08970v1 - http://paperreading.club/page?id=278482 - https://huggingface.co/papers?date=2025-01-16 - https://www.researchgate.net/publication/340963602_Privacy_in_Deep_Learning_A_Survey - https://www.sciencedirect.com/science/article/abs/pii/S0920548922000435 - https://arxiv.org/pdf/2303.00654 - https://www.nature.com/articles/s42256-024-00858-y - https://papers.neurips.cc/paper/2021/file/2754518221cfbc8d25c13a06a4cb8421-Paper.pdf - https://summerschool-croatia.cs.ru.nl/2023/slides/Sehatbakhsh_Summer-School-23.pdf - https://www.researchgate.net/publication/372785457_Holistic_Survey_of_Privacy_and_Fairness_in_Machine_Learning