Privacy-Preserving Intelligence — Steve Korshakov, Bee (acq. Amazon)

AI Engineer · 15 min · 117 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:01[music]
00:12Hello everyone.
00:13I hope this talk will be shorter.
00:16Uh I'm from Amazon.
00:19Uh our company was acquired about 8 months ago and we built the uh AI wearable which is on my hand.
00:28Uh which is essentially a microphone that records everything and builds your personal agent, personal AI and uh on top of that you can extract all the data that you record and plug it to your
00:42systems or agents uh and do whatever you want.
00:47Uh just to be to get in perspective how confidential how like private data we capturing uh a single person usually like captures about 10 million tokens per year.
00:59So this um and even within like a first week of recording uh uh people usually tell uh extremely sensitive stuff to their friends to their family.
01:12uh you can learn virtually everything about the person within the just like one week of wearing the B device which is extremely sensitive.
01:19I think we one of the most sensitive uh capture device on the market now.
01:25So and uh because of this we had to encrypt everything and our mission was to not have access to any of this data and not being able to look at it anyone at Amazon
01:39and it became a little bit challenging for us at Amazon because uh Amazon itself provides strong security and privacy guarantees but if you Amazon and you using Amazon stuff
01:53there is like much more uh serious security stuff you need to do.
01:58Uh first of all we defined like few core principles what we needed to do for our specific agent.
02:06First of all we believe the agent should be like working all the time non-stop for for your good.
02:12Um it should be doing stuff on your behalf.
02:16Uh and um we should not consume uh customer resources such as batteries and stuff.
02:23So this way uh we uh so this leads us to one specific design uh of the um of the our system.
02:36Current system usually builds the uh on state uh on request response uh system where you send uh request to a l from your say iPhone uh calculate something and the back end that gives you back.
02:52Unfortunately, we already see that this is not enough uh that we need to uh that we need to run stuff continuously and sometimes for days we can see uh we can see this like as a like glimpse into the future how cloud code works.
03:11So like just few months ago it was like more like request response stuff like change this, change that and now it can works for like hours for us.
03:19We think the same will happen to all your like personal agents anyway.
03:24So uh because of this we built uh a stateful runtime with persistent memory um that we still don't have access to.
03:33Uh it can connect to different tools.
03:35It can connect to any like third party services if we if we program it to um and we don't require the user device to be online.
03:45So it's fully autonomous but at the same time it's fully controlled by the user.
03:51Um so encryption system is built um uh on few on four like core ideas that we need to follow.
04:01First of all the key leaves and manage it only on customer device.
04:05So it's users iPhone or Android device itself.
04:08We don't have the key ourselves.
04:11We don't persist it anywhere.
04:13So keys is is um is stored only on the customer phone.
04:20Everything is encrypted.
04:21We don't have any opt out there.
04:23No way to disable it.
04:26There no way to bypass it.
04:28Uh at the same time we uh to protect ourselves from um like internal threats uh we do fully transparent and audit uh of our all our workloads and we on top of that we try to minimize
04:44the dependencies on the uh on what we can trust really.
04:51Um so uh any security system if you do end to end encryption or any kind of encryption there is a huge problem is key management.
05:02So the first step is like I want to tell you how we manage the key.
05:06So we start with the uh the key as I mentioned before starts on the phone and it leaves persisted on the phone.
05:14Then the phone connects to our back end and runs very sophisticated attestation uh pipeline uh that verifies both integrity and that the specific workload is inside of public uh transparency log.
05:30We use six store for our transparency log and anyone can go there and try to look and verify that this workload is genuine.
05:39uh the the method is too complicated to include in this uh talk but we will publish details uh at some point.
05:46Uh once the uh once uh at the station was finished we the the client shares with the our main front end back end and back end then replicates this key with uh the similar nodes
06:00uh that runs within our confidation compute because we can't leave the unencrypted data out of our perimeter uh all our we run our own inference too.
06:12So this puts us a little bit uh more complicated task uh than typical AI company.
06:19We run like all kind of models, all kind of inference uh uh software and uh so um yeah and we don't replicate code to this inference node.
06:31We like replicate only on specific ones limiting the scope of what we can do.
06:35And on top of that we introduced everywhere where we have the keys in the memory uh uh the forced expiration of seven days.
06:45Uh we picked the seven days because we think it's like how much realistically the time horizon horizon for the like something useful can be done for the user.
06:55uh 24 hours will be too low because you can like not open your phone for like 24 hours something will be missed and like so we pick like about seven days.
07:07Um then we need you know we need to ship some something to the production and then the the biggest question like how we can uh well not ship something that will compromise anything.
07:19Our goal was to uh build a system that no one inside of uh Amazon will be able to ship anything unnoticed.
07:29Obviously the software has bugs have problems but we shouldn't be well being able to ship anything.
07:35So we solve this by two uh two tire system essentially.
07:40So there is a dedicated team inside of organization inside of uh Amazon and maybe maybe not even one I would say uh that um manages the privacy part of this the transparency log our team when we ship the software we can influence them we can't control them and we hardcode their in their signing keys inside of our
08:03client apps and our back ends so we can't really uh um uh we as the team we can do this and like it's very very hard and very high level
08:16uh um employees need to sign off to any kind of change so it's like at the big company like Amazon it's virtually impossible really um and uh and we do this in two parts because it's this process too slow so we split it in two parts so like the first one is to build the base
08:36image which we put some kind of base software for uh that is needed for our own team like the tools that measure the boot, measure the manifest, measure workloads and data that we need to
08:48uh put to the node.
08:50Um and um and then when we want to deploy we do the process the same similar time.
08:58uh we got the base image and then we deploy the uh to transparency log specific manifest that anyone and uh this setup helps us to be able to security audit companies and inside outside to anyone to well we're not doing this public but like we two like very
09:18um high-profile audit companies we work with them all the time um we can provide any image any any data that was deployed ever so we can like trace any possible
09:31uh weak spots uh if we like deploy something wrong uh which we do not um then after selfverification of VM it's uh issues a certificate that embeds all encryption pro uh all transparency proofs attestation documents into certificate itself
09:48we are using private CA because you can't do this in public certificates because it will populate the public uh transparency log so we had to use the private on
09:58um we probably will introduce the uh extra proxy that will do a normal TLS with attestation with like lighter mode.
10:07Uh but we don't have this yet.
10:10Um yeah, that's essentially what we built.
10:14Thank you.
10:16Any questions?
10:17[applause]
10:22Any questions?
10:25Another going inside as far as Can you repeat?
10:59Yeah.
10:59Sorry.
11:07Were there things that had to change your own existing?
11:15Oh, what changed with like when we joined Amazon?
11:18Yeah.
11:21Well, the the big change is that we uh before like you run on Amazon and Amazon gives you pre like guarantees as a customer that they can see your data.
11:32But once you inside this changes a lot because you Amazon like so that's why you need like to provide more protection on top of this.
11:41So we need to protect from our internal threats too.
11:44Uh so that's was a big change.
11:46So um before that it was um just kind of easier I would say to configure everything.
11:53Um not sure I can tell much honestly.
12:05Yes, it's just normal EC2 instances.
12:07Yeah.
12:09Yeah.
12:10Yeah.
12:10We almost we not using like Yeah.
12:13Almost everything we build from scratch.
12:15Well, um we tried to use like the existing stuff like that is more like common like popular software.
12:24We built uh try we try to minimize amount of code that we produce.
12:29So it's I I calculated before this talk it's just like about 20k lines on memory safe language.
12:35So it was very small scope that we were able to audit and verify that all this kind of stuff and most of this code is just verifying at the station really and everything else can be like reused and like very
12:46we like you know it's very trustworthy I would say software so we didn't try to don't invent uh um yeah we don't try to invent like when when I was a telegram like we reintroduced like build our own crypto
13:01and that was like questionable way of doing stuff.
13:05So, I try not to do the same at Amazon, obviously.
13:08Yeah, that's what we do.
13:11Any other questions for Steve
13:13up in the back?
13:26Just think about Well, I I just prefer them not to put to the computers uh to personal one.
14:11Uh so we we did several experiments how to tame them, not to do bad things.
14:18H say I think nothing works except like sandboxing and just not giving them a way to hurt themselves.
14:24It's like you know our brains they can't stop the heart at will right so otherwise you know they will be we have much more problems so I think the same we shouldn't give them away to do any harm
14:38that's the only way honestly and um yeah and put something in between if they want to change something unfort yeah
14:50uh I surprised they're not representing this uh right like they're screaming so much about security but they didn't came to this one.
15:00Uh uh I'm not I tried open claw.
15:05It's like it was once they started to try to tighten this down it became much less use useful.
15:11Um so I think their approach is not really that good.
15:15So I would love to have wild agent that's that's our goal too but we try to just deploy the sandboxer for specific agent and it will just they just can't do much of the stuff.
15:28Everything else fails unfortunately.
15:31Cool.
15:32All right.
15:33Well, thank you so much, Steve, for the presentation.
15:35That was amazing.