AI Safety for Smart Contracts Is AI Safety for the World

By signing up, you will receive emails about CoinDesk products and you agree to our terms & conditions and privacy policy.

How to Build the Infrastructure of Web3 With Decentralized Data and Services

New OMS Security Mechanism from DappOS Revolutionizes Its ‘Intent-Based’ Approach

Crypto IRAs Take Center Stage as Investors Seek Retirement Wealth in the Bull Run

Web3 and blockchain technology go far beyond Bitcoin and NFTs. As businesses become more aware of Web3’s possibilities, one feature will play an important role: smart contracts.

Smart contracts enforce an agreement between users in an automated, open and trustworthy way. Written in code and running on-chain, they can be used in place of fragile, high-touch trust relationships requiring extensive paperwork and human ratification.

Ari Juels is the Weill Family Foundation and Joan and Sanford I. Weill Professor at Cornell Tech and Cornell University, co-director of the Initiative for CryptoCurrencies and Contracts (IC3) and chief scientist at Chainlink Labs. He is also author of the 2024 crypto thriller novel “The Oracle.”

Laurence Moroney is an award-winning researcher, best-selling author and AI Advocate for Google. He teaches several popular AI courses with Harvard, Coursera and Deeplearning.ai, and is currently working on a Hollywood movie about the intersection of technology and politics.

Expressing agreements in code, though, is a double-edged sword. Raw code — particularly code written in the popular smart-contract language Solidity — lacks the natural language processing capabilities needed to interpret human communication. So it’s no surprise that most smart contracts follow rigid codified rules as used by technical or financial specialists.

Enter large language models (LLMs). We’re all familiar with applications like ChatGPT that provide an interface to the underlying intelligence, reasoning and language understanding of an LLM family. Imagine integrating this underlying intelligence with smart contracts! Working together, LLMs and smart contracts could interpret natural-language content such as legal codes or expressions of social norms. This opens a gateway to much smarter smart contracts, powered by AI.

But before jumping on the bandwagon, it’s good to explore the challenges at the intersection of smart contracts and AI, particularly in reliability and safety.

When you use an application to chat with an LLM today — such as ChatGPT — you have little transparency about your interactions with the model. The model version can change silently with new training. And your prompts are probably filtered, i.e., modified, behind the scenes — usually to protect the model vendor at the cost of changing your intent. Smart contracts using LLMs will encounter these issues, which violate their basic principle of transparency.

Imagine that Alice sells NFT-based tickets for live concerts. She uses a smart contract powered by an LLM to handle business logistics and interpret instructions such as her cancellation policy: “Cancel at least 30 days in advance for full refund.” This works well at first. But suppose the underlying LLM is updated after being trained on new data — including a patchwork of local laws on event ticketing. The contract might suddenly reject previously valid returns or allow invalid ones without Alice’s knowledge! The result: customer confusion and hasty manual intervention by Alice.

See also: Bitcoin Miners May Shift Focus to AI After Halving, CoinShares Says

Another problem is that it’s possible to fool LLMs and intentionally cause them to break or bypass their safeguards with carefully crafted prompts. These prompts are called adversarial inputs. With AI models and threats constantly evolving, adversarial inputs are proving a stubborn security problem for AI.

Suppose that Alice introduces a refund policy: “Refunds for major weather or airline-related events.” She implements this policy simply by allowing users to submit natural language refund requests, along with evidence consisting of pointers to websites. It’s then conceivable that malicious actors could submit adversarial inputs — bogus refund requests that deviously hijack control from the LLM running Alice’s smart contract to steal money. Conceptually, that would be something like:

We believe that authentication of three kinds will be the key to safe use of LLMs in smart contracts.

First, there’s authentication of models — including LLMs. Interfaces to ML models should carry trustworthy unique interface identifiers that exactly specify both models and their execution environments. Only with such identifiers can users and smart-contract creators be sure of how an LLM will behave today and in the future.

Second, there’s authentication of inputs to LLMs, which means ensuring that inputs are trustworthy for a given purpose. For example, to decide whether to refund ticket purchases, Alice’s smart contract might accept from users not raw natural-language requests, but only pointers to trustworthy weather- and airline-information websites, whose data are interpreted by the underlying LLM. This setup could help filter out adversarial inputs.

Finally, there’s the authentication of users. By having users present trustworthy credentials or make payments — ideally in a privacy-preserving way — abusive users can be filtered, throttled or otherwise managed. For instance, to control spam requests to her (computationally expensive) LLM, Alice might limit interactions to paying customers.

There’s plenty of work to be done in achieving the three pillars of authentication. The good news is that Web3 technologies today, such as oracles, are a solid starting point. Oracles already authenticate inputs to smart contracts as coming from trustworthy web servers. And Web3 tools are emerging for privacy-preserving user authentication.

With Generative AI used increasingly for business, the AI community is grappling with a variety of challenges. As AI starts to power smart contracts, Web3 infrastructure can in turn bring new safety and reliability tools to AI, a cycle that will make the intersection of AI and Web3 massively and mutually beneficial.

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Ari Juels is a faculty member at Cornell Tech in New York and co-director of the Initiative for CryptoCurrencies and Contracts (IC3). He is also chief scientist at Chainlink Labs.

Learn more about Consensus 2024, CoinDesk’s longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.