AI 若攻破密碼學，區塊鏈有備案嗎？

0:00開場

0:00先說一聲，這場座談還沒結束我就得先去趕飛機，所以最後一段的主持會交給 Haseeb。開場先講一件事：昨晚 Justin Drake 發了一則推文，叫大家不要恐慌，結果傳遍全世界。大家當然還是恐慌了。這件事關乎密碼學與數學本身的正確性和有效性。我本來想談加密貨幣的長期發展，但既然大家正在恐慌，我想我們得先談談短期內的數學與密碼學。大家擔心的是，AI 大幅加速了時程，可能找出技巧和捷徑來破解傳統密碼學，同時也讓 Q Day 提早到來，也就是量子電腦能破解密碼學的那一天。Preemptively, I will be running off for a flight before this panel ends, so I'm going to hand off moderator responsibilities to Haseeb for the end. But to get us kicked off, we had a tweet that rocketed around the world last night from Justin Drake telling everyone to not panic. Of course they panicked. Of course they panicked, and this is about the correctness, the validity of cryptography and math. And I do want to talk about crypto in the longer term, but now, because people are panicking, I think we need to talk about math and cryptography in the short term. The fear is that AI has truly accelerated timelines on a massive scale to come up with tricks, shortcuts to break classical cryptography and then also accelerate the arrival of Q Day as well, the day that quantum computers can break cryptography as well.

0:52所以有兩條不同的路，都可能瓦解整個區塊鏈產業賴以建立的基礎。Haseeb，你已經寫了一篇文章。能不能先講講你的第一印象，你怎麼看大家擔心 AI 威脅整個產業這件事？好。我把這件事比喻成一種「密碼學末日論」。這種恐懼是這樣來的：今天我們用的大部分密碼學，其實都沒有證明它是安全的。我們實戰檢驗密碼學的方式，是設計新的密碼學方案，然後找一群聰明人、找密碼學家來看，問他們：你們能不能想辦法破解它？經過夠長的時間、夠多的人、夠多年，如果大家都找不到破解方法，我們就說：好，這大概是相當強的密碼學。So two different paths to breaking down the entire foundation of what the blockchain industry rests upon. Haseeb, you've already written an article. I'm wondering if you can kind of just give me your first impressions, your first thoughts to this fear about AI threatening the entire industry. Yeah. So I made the analogy that this has sort of become cryptographic doomerism. It's this fear that, like, if you look at most of the cryptography that we use today, we don't actually have any proofs that this cryptography is sound. The way that we battle-test cryptography is we create new cryptographic schemes, and we get a bunch of smart people, cryptographers, to look at these schemes and say, like, hey, can you come up with a way to break this? And after enough time, after enough people, after enough years, if people don't find ways to break it, then we say, well, this is probably pretty strong cryptography.

1:11密碼學末日論

1:45話雖如此，密碼學確實會隨時間弱化。大家確實會找到攻擊方法，找到削弱某個協定的方式。但我們衡量大多數密碼學的安全性，靠的不是形式化的數學保證（我們沒有這種保證），而是投入在這些問題上的人力工時，也就是我們投入了多少數學智力，卻還是找不到破解方法。如果是這樣，現在 OpenAI 把火力對準傳統密碼學，可能會出現這種情況：全世界的人類密碼學家（最多大概一萬人）過去投入在現有密碼學上的智力與算力，下個月 AI 就能在全世界的密碼學上投入同樣多。這樣一來，傳統密碼學的基礎到底有多少漏洞，我們可能完全沒準備好面對。That said, cryptography does degrade over time. People do find attacks. They find ways to weaken a given protocol. But we sort of measure the security of most of our cryptography not in terms of formal mathematical guarantees, which we don't have, but rather in terms of the person-hours, the sort of the mathematical intelligence that we have applied to these problems and haven't found a way to break them. Well, if that's true, then if you have OpenAI now pointing their lasers at classical cryptography, it may well be that all of the human cryptographers in the world, which is maybe around 10,000 at most, have applied this much intelligence and compute to looking at all the cryptography we have, and it could be that over the next month, we apply this much compute to all the cryptography in the world, in which case, we may just be totally unprepared for how many holes exist in the foundations of classical cryptography.

2:38我認為這個觀點是對的。不過問題是，你要怎麼應對？如果答案是 Justin Drake 主張的那種，他稱為「碉堡模式」。碉堡模式的意思是：不要動。把所有幣移到一個從來沒簽過任何東西的地址。把頭埋進沙裡，基本上就是去紐西蘭買棟別墅，逃離社會，因為你根本不知道會發生什麼，等你回來可能已經是一片冒煙的廢墟。這是很糟的答案。這就等同於末日論，就像在說：「天啊，AI 會殺光所有人，所以不用為明天打算，拋下你的家人吧。」我認為這是對一個正確觀察給出的錯誤答案。I think that point is correct. That said, the question is, what are you going to do about it? If the answer is what Justin Drake advocated for, which is what he calls bunker mode, and bunker mode, the idea is: don't move. Move all your coins to an address that has never signed anything. Put your head in the sand and, like, basically, you know, buy a villa in New Zealand and, like, escape from society because you just don't know. It might be a smoking crater when you're done. That is a bad answer. That is the equivalent of doomerism, which is like, “Oh my God, you know, AI is going to kill everyone, so just, like, you know, take no thought for tomorrow and, you know, abandon your family.” This, I think, is the wrong answer to a correct observation.

3:24所以我在這篇文章裡主張，每條區塊鏈基本上都需要考慮建立一個「密碼學復原模式」。也就是說，當驗證者看到……這就是我們昨天在聊的。沒錯，沒錯。當驗證者看到密碼學出現某種根本性的問題，就可以退回到冷戰等級、極度保守、假設最少的密碼學。基本上就是以雜湊為基礎的密碼學，非常慢、非常貴、簽章超大、頻寬很差，對吧？區塊鏈會慢得像糖漿一樣，但我們知道自己是安全的。這有點像核彈密碼啟動了，警報大作，大家都躲進碉堡，然後再想辦法：現在該怎麼辦？So what I advocated for in this post is that every blockchain needs to basically think of creating a cryptographic recovery mode, which is a way that validators, upon seeing — this is what we were talking about yesterday. Exactly, exactly. Upon seeing that there is some kind of foundational problem in cryptography, that you can fall back to, like, Cold War-level, extremely austere cryptography that makes minimal assumptions. Basically, like, you know, this kind of hash-based cryptography, which is very slow, very expensive, gigantic signatures, terrible bandwidth, right? Blockchains would run at the speed of molasses, but we know that we're safe. Like, this is kind of like, okay, nuclear codes went off, the sirens are alarming, we all go into the bunker, and we can figure out: What do we do now?

4:09等我們知道密碼學被揭露出哪些問題、哪些密碼學方案是安全的，下一步要怎麼重建？如果 AI 把矛頭指向這裡，我們其實可能會學到更多。AI 也會幫我們發展方法，甚至可能證明以前證明不了的東西。沒錯，沒錯。好，你說吧。我要說了。不不。所以這基本上就是我提出的方案，也就是……我們昨天聊的東西很類似：如果事先就有一份社會性的智能合約、持幣人協議或 DAO，裡面寫明，一旦出現某個新的數學發現讓這套系統失效，我們都事先同意，也許把狀態回滾到兩週前。What's our next move to reconstruct, once we know what have been the problems that are uncovered in cryptography, what cryptographic solutions are safe? And we'll probably actually learn a lot more if AI is pointing this way. AI will also help us develop methods and potentially prove the things we couldn't prove before. Exactly, exactly. So go ahead, Zcash, say that. I'm going to say it. No, no. So that's basically the proposal that I came up with, which is that — So what we were talking about yesterday that's very similar is, like, if you have an existing, pre-existing social smart contract or coin holder agreement or DAO, which says under the conditions where there is some new mathematical discovery that invalidates this, then we've all pre-agreed to maybe rewind state, you know, to two weeks ago.

4:57大家確實都會賠錢，但總比賠光要好。或者事先約定，某幾位開發者擁有緊急權限，我們一轉鑰匙，他們就可以升級這些功能之類的。整件事裡我覺得最有趣的，也就是這場「數學奇點」，是 Matthew Green 的觀察。我知道 Dev 在爭論這一點：公鑰密碼學可能根本行不通。順帶一提，還有一件事很好笑：《紐約時報》之類的媒體完全沒報導這件事。Sulzberger 底下那些人根本不知道該怎麼報導、怎麼討論這件事。但它影響世界上每一個國家能不能保護自己的系統。所以網路已經遠遠跑在國家前面了。總之，這是我的一些想法。Illia，你的想法呢？對，我是說，2018 年我們在設計 NEAR 的時候，其中一件事就是在考慮：聽著，未來一定會有新的密碼學。Everybody does lose money, but they lose less money than zero, or that this, this, and this developer have emergency authority that we can turn the keys and they can upgrade these functions or whatever. The thing I find most interesting on this whole thing, the math singularity, was Matthew Green's observation. I know Dev was arguing about this, that public-key cryptography may not work, you know. And by the way, the other thing that's funny about this: there's been no coverage of this in, like, The New York Times. They have Sulzberger's guys have no concept of how to even report on this or talk about this. And yet it influences every country in the world in terms of whether they can secure their systems. So network is just moving far ahead of the state. Anyway, some thoughts. Illia, maybe your thoughts. Yeah, I mean, I think we actually, when in 2018 we were designing NEAR, one of the things we were designing for is like, hey, look, there's going to be new cryptography.

5:10公鑰密碼學可能失效

5:51我們不能把 NEAR 區塊鏈綁死在某一條特定的密碼學曲線上，所以我們的設計是可以持續加入不同的方法。今年稍早，我們剛加入了 ML-DSA，這是最早的後量子簽章之一。而且照世界現在的走向，我們大概也會再加入一種以雜湊為基礎的簽章，讓大家可以保護自己的系統。但我認為更大的重點是：聽著，你不能把東西固化、僵化。你在文章裡也提到這點，因為世界演進得非常快。我們會不斷發明新東西，所以協定需要能夠跟著持續演進，工具也需要同步演進。我認為這些都做得到。我們只是需要進入這種模式，而不是說：好，我們把這個做出來，然後從此沒人再碰它。We cannot bind NEAR blockchain to one specific cryptographic curve, and so we designed to be able to keep adding more different methods. And so earlier this year, we just added ML-DSA, which is one of the first post-quantum kind of signatures. And, you know, given where the world is moving, we're probably going to add a hash-based signature as well, so you can kind of secure your system. But I think the broader point is like, look, you cannot solidify and ossify things. You used it in your post as well, because the world is evolving really quickly. We're going to keep inventing new things, and so the kind of protocol needs to be able to continue to evolve with that, and we need tooling to evolve in unison as well. And I think it's all possible. We just need to be able to be in that mode instead of saying, like, cool, we're going to build this, and then nobody touches it from here on.

6:43好，我們去年還聊過另一件事，就是一個幣的國防部要有多少 token 預算。對，不過在談那部分之前，我想先講一點：區塊鏈過去的設計，本來就是要非常抗拒改變。去中心化本質上就是一種很慢、很制度化的治理流程。這代表任何改變都需要很多人支持。沒有真正的辦法強迫事情快速發生，而這常被視為去中心化系統的優點：它們隨時間做出改變的方式非常按部就班。我把這比喻成「平時治理」。如果我們正進入一種技術加速的模式，在這種數學奇點之中，腳下的地面會快速變動，那麼對於一個更像戰時的局面來說，這其實是錯誤的治理方式。Okay, there's something else we talked about last year, which is the token budget for the defense department of a coin. Yeah, well, I think one of the points I want to make before we get to that part is that blockchains historically have been designed to be very resistant to change. Decentralization, by its nature, is a very slow, institutionalized governance process. It means that in order for something to change, there needs to be a lot of buy-in. There's no real way to enforce things happening quickly, and that is often considered to be a virtue of decentralized systems, is that, like, they are very, very methodical in the way that they end up making changes over time. I sort of analogize this as this is sort of peacetime governance. If we are going into a mode of technological acceleration, where the ground underneath us is going to be changing very rapidly in the midst of this kind of mathematical singularity, then that is actually the wrong kind of governance for a situation which is more like wartime.

7:22平時治理與戰時治理

7:38戰時通常就是要改變文官指揮體系的時候。你會說：聽著，我們必須進入更集中的指揮控制模式。這代表我們確實得把更多權力交給驗證者、交給開發者，讓他們可以說：嘿，出大事了，某個根本的東西變了，大家不再安全，我們得立刻反應，你們得相信我們有足夠好的判斷力，進去改東西。我來講一下，在《網路國家》這本書裡，我說未來最不受歡迎但最重要的詞會是「再中心化」。為什麼？因為中心化、去中心化、再中心化，基本上意思是：去中心化只是一種戰術。它不是終點，而是一個方向。Wartime is often when you change the sort of civilian command structure, and you say, look, we have to go into more command-and-control mode, which means that we do have to delegate more authority to validators, to developers, for them to be able to say, hey, shit just went down, and we have to react on a dime to the fact that something fundamental has changed and people are no longer secure, and you have to trust us to have the good judgment to go in and change things. So I'll give, I'll give, you know, in the Network State book, I said the most unpopular but important word going forward is going to be recentralization. Why? Because centralization, decentralization, recentralization basically means decentralization is just a tactic. It's not like a destination; it's a direction.

8:25就像你會往左轉、也會往右轉。再中心化同時被兩邊反對。中心化的那群人會說：等一下，我以為你們是……你們為什麼不維持我們既有的機構？去中心化的那群人會說：等一下，我以為我們都是無政府主義者，你這不是在犧牲原則嗎？但再中心化只是找到一塊新的數位土地。意思就是，我們按下火警警報，我們逃離了法幣，逃離了某個東西，現在我們組成一個新群體。或者說，再中心化是我們採用網路治理，而不是國家治理。這樣你就不必說：「喔，我們在做錯的事。」我們會說：「這是我們在這種情況下會用的工具。」你不需要為此道歉。Balaji，我想聽聽你的看法。在數學與密碼學世界經歷這段動盪的過程中，有一點差異。Just like you steer left and you steer right, you know. Recentralization is opposed by both the centralized guys who say, wait a second, I thought you guys were, you know, why don't you keep our existing institutions? And the decentralization guys say, wait a second, I thought we were all anarchists. Aren't you sacrificing? But recentralization is just finding a new piece of digital land. It's just saying, we hit the fire alarm, we got out of fiat, we got out of something, and now we're forming a new group. Or recentralization is we have a network governance rather than state governance. And so then you don't have to say, "Oh, we're, you know, we're doing a wrong thing." We say, "This is a tool that we will use in these circumstances." You don't have to apologize for it. Balaji, I want to get your perspective on, as we proceed through this tumultuous state in the world of math and cryptography, there's a little bit of a difference.

9:16在加密貨幣、網路國家的世界裡，差異相當大，因為整個產業都建立在數學上。反觀國家這一邊，銀行、Web2，密碼學和安全性只是達成目的的手段。它不是主角，不是最核心的東西。所以這次對數學的威脅，確實威脅到整個加密貨幣產業，對我們來說很緊急。但反過來看，這也是我們勝出的機會。而世界的另一邊，這並不是他們的核心能力，不是他們的主業，對他們來說只是個負擔。你覺得這是網路國家這一邊真正大放異彩的機會嗎？是的，而且我其實也想聽聽 Illia 怎麼看。There's quite a big difference in the world of crypto, the network state, where the entire industry is underpinned by the math. Whereas on the state side of things, with banks, with Web2, the cryptography, the security, it's a means to an end. It's not the main act. It's not the main thing. And so while this threat to math truly threatens all of crypto, it's urgent for us. And on the other side of this, it's an opportunity for us to win. Whereas the other side of the world, it's not really their core competency. It's not really their main thing. It's just, it's an encumbrance for them. Do you think this is an opportunity for the network state side of the world to really, to really shine? Yes, and I actually also want to hear Illia's thoughts on this.

9:53網路國家的機會？

10:02不過，把我們昨天的對話整合起來，有一點是：現在 AI 是一種攻擊，對吧？因為有這個數學奇點。我們不知道會有多少研究成果冒出來，有些東西會崩塌，短期和中期內會有東西壞掉。但長期來看，其實每一個幣……對了，Haseeb，你是新的主持人。每個幣都有很強的……喔，坐這裡。喔，好，沒問題。好。每個幣都有很強的誘因去保護自己，而且它有預算可以做這件事。所以拿 token 預算去審計每一行程式碼，也付錢請數學家跑這些東西，這就變成了「密碼學國防部」。But one of the things, taking our conversations from yesterday, putting together: right now, AI is an attack, right? Because you've got this math singularity. You know, we don't know how many results are going to come out, and things are going to crumble. You know, things are going to break in the short run and medium run. But in the long run, you know, every coin actually — so, Haseeb, you're the new moderator. Every coin has a very strong — oh, sit here. Oh, okay, fine. All right, okay. Every coin has a very strong incentive to defend itself, and it has a budget for that. And so the token budget for auditing every line of code and also paying mathematicians to run all this stuff, that becomes the cryptographic defense department.

10:38「密碼學國防部」

10:48然後攻擊者在另一邊。所以回到你剛才的說法，你說全世界大概有一萬名密碼學家，不管實際數字多少，你都可以大致量化，有點像挖礦的算力，你的「token 率」是多少，對吧？好笑的是，這是一個循環經濟。AI 代理人買加密貨幣 token 來花，然後加密貨幣協定買 AI token，一邊確保自己不被駭，一邊證明自己是人類。所以形成一個循環經濟：AI 代理人買加密貨幣 token，加密貨幣協定買 AI token。我認為這其實會是未來很重要的一部分。我是說，可以這樣框架：你需要「協定自有算力」。對。And then you've got the attackers over here. So to your point, before you said maybe there's 10,000 cryptographers in the world or whatever that number is, you can roughly quantify, sort of like with mining, you know, like hash rate, what is your you know, token rate, right? So what's funny is this is a circular economy. The AI agents buy crypto tokens to spend, and then the crypto, you know, protocols buy AI tokens so that, you know, these guys are making sure they're not hacked, and these guys are proving they're human. So there's a circular economy of AI agents buying crypto tokens and crypto protocols buying AI tokens. I think that actually will be a significant part of the future. I mean, one way to frame it is you need protocol-owned compute. Yeah.

11:34對，你實際上需要有……當然，跟 OpenAI、Anthropic 這些公司比，我們是從後面追趕。但如果說我們對區塊鏈有什麼了解，那就是我們能激勵大家投入大量算力。我是說，有了 AI，你可以有系統地列出你的區塊鏈到底依賴哪些論文。你真的可以把 ECDSA 依賴的每一篇論文、任何密碼學方案的假設所依賴的論文全部列出來。這些論文幾乎就像函式庫呼叫，就像數學函式庫或教學用的函式庫一樣。然後你就去攻擊它們。只要 OpenRouter 上架一個新模型，你就去呼叫它。Right, you effectively need to have, I mean, Right? You effectively need to have — I mean, obviously we're coming from behind for the OpenAIs and Anthropics of the world, but, you know, if we know anything about blockchain, we can motivate people to bring a lot of compute up. I mean, one of the things is, with AI, you can systematically enumerate exactly which papers your blockchain depends on. Like, you can literally list every single paper that ECDSA depends on, that, you know, any cryptographic scheme assumption depends on, and those are almost like library calls in the sense of a mathematical library or an educational library. And so then you're attacking them. As soon as a new model is posted on OpenRouter, you ping it.

12:21你立刻對它狂砸 token。你先試著攻擊自己的基礎，就像我們已經學會對 JavaScript 或 Python 的相依套件這樣做。你開始把數學本身當成一個有供應鏈漏洞的相依套件。這很有意思，因為我認為一般的資安和我們現在談的數學奇點之間，存在不對稱。在一般資安領域，很多人擔心，等模型在資安能力上超越人類，就會出現一場末日，有點像《現代啟示錄》那種地獄景象，到處都在被駭。但很多人已經指出，好，我們現在有 GLM-5.3，資安能力非常強，又是開源的，任何人都能輕易取得。可是大家預測了很久的那種飛機從天上掉下來的情境，並沒有發生。You immediately are blasting tokens at it. You're trying to attack your own foundations first, much as we've sort of learned to do for our JavaScript or Python dependencies. You start thinking about math itself as a dependency that has a supply chain vulnerability. Well, it's interesting because I think there's an asymmetry between normal cybersecurity and what we're talking about with this math singularity. With normal cybersecurity, I think many people worried that, okay, when models are going to become superhuman at cyber, that there's just going to be this just apocalypse of just, I don't know, this sort of Apocalypse Now-type hellscape of things getting hacked left and right. And many people have pointed out, okay, we now have, you know, GLM-5.3, which is extremely good at cyber. It's open source. It's very easily accessible by anybody. And yet there is not this just, you know, kind of planes-falling-out-of-the-sky kind of scenario that people were forecasting for quite a while.

13:13Mythos、Daybreak 這些計畫之所以只開放白名單，不是每個人都能用這些模型，就是因為大家相信，如果公開開放，就會天下大亂。但我們沒看到這種情況。為什麼沒看到？那些駭客攻擊在哪裡？你記得去年 CrowdStrike 那次事件，那是一個漏洞，甚至算不上攻擊，卻讓差不多半個網路癱瘓。飛機沒辦法飛，社會運作幾乎停擺。有一種推測是，我們之所以沒看到那種情況，是因為 AI 的攻擊與防禦之間有一種自然平衡。只要防禦者也能取得和攻擊者同等的 AI 能力，攻擊者就沒有某些人以為的那種優勢。That, you know, the reason why Mythos and Daybreak and all these programs are whitelist only, not everybody can get access to these models, is because of this belief that if people had access to them openly, there would just be total pandemonium. We don't see that. Why don't we see that? Where are all the hacks? You remember last year there was the CrowdStrike attack. It was a vulnerability; it wasn't even an attack, and it just took out like half the internet. You know, airplanes weren't moving, and civil society was kind of grinding to a halt. The conjecture is that the reason why we're not seeing that is that there's a natural balance between attack and defense with AI, is that actually giving defenders access to the same power of AI that attackers get, there is not this — as some people maybe thought it might be true — there's not an advantage to attackers.

13:48AI 攻防之間有自然平衡

14:03當防禦者能花 token、攻擊者也能花 token，兩邊就互相抵銷。事實上，防禦者也許還稍微佔優勢。提示詞也很重要，對吧？攻擊的切入角度不太像算力，因為提示詞會帶來不同的攻擊角度。所以我其實會主張，現在的情況比以前純靠人類的世界更好。我的論證是這樣的：過去還沒有 AI 的時候，你會僱用人類攻擊者。假設你是北韓，你會在北韓僱一些駭客，讓他們去攻擊某個協定。如果你是協定這邊的防禦者，基本上你必須防禦北韓想得出來的所有攻擊。而北韓的每個駭客都不一樣，他們都是獨立的頭腦，會想出各種不同的方法攻擊你的協定。When defenders also can spend tokens and attackers can spend tokens, they cancel each other out. And in fact, maybe they kind of have an advantage. The prompts also do matter, right? So the angle of it, it's not quite the same as hash rate because you've got angles of attack from the prompts. So I would actually argue that it's better than it was in the human world. And here's the shape of my argument, okay? In the past, before we had AIs, you would hire human attackers, right? So let's say you're North Korea. You would hire some hackers in North Korea, and they would go and try to attack a protocol, right? And if you're a defender as a protocol, you have to basically try to defend against everything North Korea can come up with. And all of North Korea's hackers are all different. They're all independent minds coming up with different ways to try to attack your protocol.

14:52但在北韓改成花 token 的世界裡，AI 有一個特點：AI 彼此之間的相關性，遠高於人類彼此之間的相關性。你會看到，如果有七個 AI 都在攻擊同一個問題，隨著它們反覆迭代、在同一個問題上投入越來越多算力，它們會想出非常相似的解法。它們平行運作的方式，不像人類平行運作那樣彼此獨立，因為就算是不同的模型，它們也是從非常相似的資料分布訓練出來的。人類的行為則差異很大，我們產生想法的方式多樣性和分散度高得多。結果就是，如果有十個模型，比如北韓、俄羅斯和其他人都在攻擊你，它們很可能會想出相同的攻擊點子。所以如果它們各花一百萬美元的算力，而你花兩百萬美元的算力，因為它們彼此沒有協調，你很可能會想到它們的模型想得到的每一個點子。But in a world where North Korea is now spending tokens, the thing about AIs is that AIs are much more correlated with each other than humans are correlated with each other. Like, you will see this is that if you have seven AIs all trying to attack the same problem, they will come up with very similar solutions as they are iterating and spending more and more compute on the same problem. They don't parallelize in ways that are as independent as the way that humans parallelize, because they're trained from very similar distributions, even if they're different models. Whereas humans, we just act very differently. We have much higher diversity and dispersion in the way that we come up with ideas. As a result of that, if you have ten models, let's say North Korea and Russia and, you know, somebody else are all attacking you, it's very likely they will come up with the same attack ideas. And so if each of them spend a million dollars of compute, and you spend two million dollars of compute, it's very likely you will come up with each of the ideas their models will come up with because they're not coordinated.

15:49這很有意思，假設這是真的，也有可能是真的。如果你把列舉出來的數學論文，當成支撐你的函式庫，就像 JavaScript 和 Python 函式庫那樣，你就可以說：好，我現在的攻擊面是有限的。但我認為數學的情況很不一樣。攻擊數學的結果是，你會把所有東西都打壞，對吧？對。攻擊單一函式庫或系統，你面對的是它的供應鏈……我是說，我們現在看到的是，大家在寫程式時開始全面移除相依套件，因為相依套件現在其實是一種負債。從頭開始寫所有程式碼，盡可能寫得最基本，再用一群代理人去審計，反而比較容易。而且現在有形式化驗證，你可以真正驗證程式碼在做什麼。It's interesting, because let's say that's true, and it's possible. If you take the enumeration of the math papers as your library that underpins you in the same way the JavaScript and Python libraries do, then you could say, okay, I've got a finite attack surface now. But I think for math, you have, like, very different level of, like, attacking math, the outcome: you're going to break everything, right? Yeah. Like, attacking a single library or system, you have, like, its supply chain, which... I mean, what we're seeing right now, people are starting to remove dependencies in general in code, because actually dependencies are a liability now. Like, it's easier to just write all your code from scratch, from kind of as basic as possible, and then audit it with a bunch of agents. And you have formal verification now, so you can actually verify what the code does.

16:38所以我認為整體來說，寫程式這件事正變得完全偏向建構者這一方，因為你只要移除所有相依套件，再盡可能形式化驗證越多性質越好。但數學的情況是，現在實際上有一個根本的東西：就算我們用形式化驗證，其實還是有一組假設，對吧？我們會說：這是一個困難問題。舉例來說，我們驗證零知識證明時，Lean 證明本身就有一個假設，說這個問題是困難的。然後從這裡出發，我們驗證例如 Zcash 不會出現雙花。而現在被動搖的，正是那個假設本身。也因此，對每個攻擊者來說，去攻擊那個根本假設就很合理。And so I think actually, in general, the code building is becoming, like, completely asymmetric toward the builder, because you just want to remove all dependencies, and you want to formally verify kind of as much properties as possible. With math, you have effectively right now the fundamental, like, okay, what is the, like, even when we use formal verification, we actually have a set of assumptions, right? We say, hey, this is a hard problem. Like, for example, we verify zero-knowledge proofs. There's an assumption in the Lean proof itself that this, you know, this problem is hard. And then from there, we verify that this Zcash, for example, has no, like, double spend. And that assumption itself is what's getting bent. And indeed, like, then everybody as an attacker, it makes sense to attack that fundamental assumption.

17:28把所有成本都砸在那上面，你就能把所有東西都打壞，對吧？你知道這件事好笑在哪裡嗎？我想到，過去幾十年的一個現象是，以前只有數學家或電腦科學家在乎的冷門領域，像是形式化驗證，或者當然還有機器學習等等，後來都翻紅了。現在純數學也即將出現像 AI 那樣的搶人大戰，對吧？那些薪水……我是說，今天的數學家都很沮喪，但兩三年後，他們的薪水會漲 10 倍，因為……我不確定這是真的。我認為……好，你請說。基本上，由人類引導的……And spend all of the kind of cost on that, and you break everything, right? You know what's funny about this? It strikes me, you know, one of the phenomena of the last few decades has been previously obscure areas that only mathematicians or computer scientists cared about, like formal verification, then, you know, or obviously, you know, machine learning and so on. And now pure math is about to have an AI-like bidding war, right, where those salaries — I mean, all the mathematicians today are depressed, but in two or three years, their salaries are going to 10x because — I don't know that that's true. I think — Okay, yeah, please. Basically, the human-guided...

17:49純數學即將出現像 AI 一樣的搶人大戰

18:14我是說，因為你得對這些東西下提示詞，對吧？不是任何人都能靠下提示詞一路解出黎曼猜想，而且你還得驗證它。下提示詞和驗證仍然是技能。我是說，你看 Navier-Stokes 那件事，他們講得很清楚：我們對 Navier-Stokes 一無所知。我是說，我們現在正在跑，我們在 LeanBench、LeanEval Bench 排名第一。沒有人讀過任何東西。這就像費馬定理、黎曼猜想。這大概是 120 篇更艱深的論文，我們都用 Lean 驗證過了。我們甚至不知道裡面有些名詞是什麼。但即便如此，如果你看不懂螢幕上的符號是什麼，你怎麼知道 Lean 在說什麼？嗯，Lean 其實是……我知道，但是……I mean, because you have to prompt these things, right? It's not like anybody can just prompt their way to the Riemann hypothesis, and you have to verify it. And prompting and verifying are still skills. I mean, if you look at the Navier-Stokes story, I mean, they made very clear, we did not know anything about Navier-Stokes. I mean, so we're running right now. We are number one on LeanBench, LeanEval Bench. Nobody read anything. This is like Fermat's theorem, Riemann hypothesis. Like, this is like 120 more sophisticated papers, and we've, like, verified them in Lean. We, like, you know, we don't even know some of the names there. You know, but still, even still, if you didn't comprehend what the symbols were on screen, how would you even know what the Lean was saying? Well, the Lean is, like, actually — I know, but...

19:01好，你可以看程式的輸出，但我認為沒有領域知識，連自己在看什麼都很難理解。你不這樣認為嗎？我覺得這是「數學人的自我安慰」。你不同意嗎？我覺得這是數學人的自我安慰。我認為很明顯，數學家會沮喪是有充分理由的：聽著，這件事已經發生在程式設計師身上了。程式設計師現在明白，我的工作從此永遠不一樣了。現在還需要人類來駕馭模型，但很明顯，模型越來越能自己駕馭自己。對，但那是……但你需要解決問題的能力。以前身為數學家，你的目標是拿到一個問題，然後去試著證明它，對吧？你可能花幾十年做這件事。現在，真正的技能其實是把問題定義出來。對，這適用於開發者，現在也適用於數學。Okay, well, you could look at the output of the program, but I think it'd be hard without domain knowledge to even understand what one was looking at. You don't think? I think this is math cope. You disagree with this? I think this is math cope. I think it's very clear that, like, there's a good reason why mathematicians are despondent, which is that, look, this has happened to programmers now. Programmers now realize that, like, my job is forever different, and, like — right now, you need humans to drive the models, but it's very clear that the models are now driving themselves more and more. Yeah, but is that — But you need the problem-solving skills. Before, as a mathematician, your goal was, like, you're given a problem and you go and, like, try to prove it, right? And you spend, you know, decades doing that. Now it is actually formulating the problem is the skill. Yeah, and this is for developers and now for mathematics, too.

19:52而這個範圍廣得多。對，但下提示詞和驗證……我是說，好，我知道外面有一份 Lean 證明，但是……有多少人懂得怎麼看 Lean 證明，對吧？這其實就是……這其實就是我要說的。你其實不需要看 Lean 證明，你只需要看命題陳述。重點是：數學之所以會被攻陷，是因為它具有獨特的自我驗證性。對，我知道，但基本上，聽著，你可以寫下一個方程式，大家可以……我覺得你們太……就算會對這些東西下提示詞的人變多了，就說多了一個數量級好了。對。我是說，有多少人能把 Navier-Stokes 方程式連同 nabla 符號那些東西打出來，對吧？去讀讀 Scott Aaronson 怎麼說這件事。你說。Scott Aaronson，知名的量子物理學家。我剛剛其實正在想那個「複雜度動物園」的人。And that is way broader. Yeah, but prompting and verifying. I mean, okay, I know there's a Lean proof that's out there, but — I mean, how many people know how to look at Lean proofs, right? That's actually — That's actually — that's what I'm saying. You don't actually need to look at Lean proofs. You only need to look at the statement. And the statement is: math is falling because it is uniquely self-verifying. Yeah, I know, but basically, look, you can write down an equation. People can — I think you guys are over — even if the number of people who can prompt these things has increased, and let's even say increased by an order of magnitude. Yeah. I mean, how many people can type in Navier-Stokes with the nablas and, you know, so on, right? Read Scott Aaronson on this. Go ahead. Scott Aaronson, well-known quantum physicist. I was actually just thinking about the complexity zoo guy.

20:38對。對，他是計算複雜度理論學家。對，複雜度理論，還有複雜度類別。也許在結束之前，我們應該讓大家對加密貨幣這一側安心一下。好。好，我知道我們時間到了，那就簡短講一下看法。聽著，我確實認為我們談的這個密碼學奇點，最可能的結果，大概有 95% 以上的機率，是等 AI 真的把這些數學全部跑過一遍，我們會發現：各位，你們是對的，密碼學是可行的。這是壓倒性的可能。就算是 OpenAI 這週稍早大量發布論文時處理過的那些方程式或問題，他們發現的也是：大部分結果跟數學家原本想的一樣。很少有意外，也就是很少出現「我們以為是真的其實是假的」，或「我們以為是假的其實是真的」。Right. Yeah, he's a complexity theorist. Yeah, yeah, complexity theory, yeah, yeah, and complexity classes. Maybe before we finish, we should, like, reassure people about the crypto side. Sure. Okay, yeah, I know, like, we're up on time, so maybe we should just give a small take. So, look, I do think what we're talking about, this cryptographic singularity, most likely, with, you know, 95%-plus probability, what we're going to find when AIs do work their way through all this math is that, hey guys, you were right. Cryptography works. Overwhelmingly likely, and even with most of the equations that they've seen, or the problems that OpenAI came through with in the big paper drop they had earlier this week, what they found was that, like, yeah, most of the things are what mathematicians thought. There were very few surprises in the sense that, like, oh, something we thought was true was false, or something we thought was false was true.

21:26所以最可能的結果是，我們會說：對。這很有意思，我之前沒看過。所以可以做一張二乘二的表，其中一格是他們原本以為是假的、結果確實是假的。這很有用。Jacobian 猜想那個很令人意外，我們沒想到會有反例，對吧？那非常令人意外。但其中很多東西，就像是：對，當然，我們只是之前沒有證明而已。大家原本以為答案是「是」，結果答案就是「是」。但現在我們有了形式化。像 Scott Aaronson 這些研究各種演算法複雜度的人，我認為我們該做的，就是盡量只使用那些有已證明複雜度結果的東西，而不是只有猜想困難度的東西。我知道說比做容易，但 Justin Drake 談到的一點正是這個：雜湊是可靠的，公鑰（像是橢圓曲線）則不是。So most likely what we will find is that we're like, yes. That's interesting. I hadn't seen that. So there's a two-by-two table of things they thought were false that were false. Like, that's useful. The Jacobian conjecture, that was surprising. We did not think that there would be a counterexample, right? That was very surprising. But for a lot of these things, it's like, yeah, of course, they just — we didn't have the proof. We didn't have — people thought the answer was yes, and the answer was yes. But now we have a formalization. You know, all these guys like Scott Aaronson who look at the complexity of different, you know, kinds of algorithms, I think what we have to do is just try to only work with those things that have proven complexity results, as opposed to those things which have conjectured difficulties. And I know that's easier to say than it is, but because one thing I think Justin Drake was talking about is this, which is hashes are reliable, and public key, you know, like elliptic curves, aren't.

22:18然後 Dev 對此提出了反駁。Illia，你怎麼看？對，我認為基本原則是，以雜湊為基礎的密碼學裡面的東西少很多，所以簡單得多，也因此更可靠。回到 Haseeb 的觀點，如果我們真的需要復原模式，這就是我們的備案，而且應該讓每個人都能用上這個備案。但同時，它極度緩慢、極度沒效率。你不會想讓高效能區塊鏈依賴它。另一方面，我們現在也有後量子的格密碼，這其實已經在整個網路上使用，對吧？你的瀏覽器就是。我們剛剛也在檢查 TLS 和其他地方的一些實作。And then Dev had a counterargument on that. What are your thoughts on that, Illia? Yeah, I mean, I think kind of the principle is the hash-based cryptography is way, Like, there's less of things there, and so it's, like, way simpler, and so it is more reliable. And to Haseeb's point, like, if we do need a recovery mode, that is our backup, and we should have this backup available for everyone. At the same time, it's extremely slow, it's extremely inefficient. And, you know, yeah, you don't want to have, you know, high-performance blockchains relying on that. At the same time, we do have now lattice-based cryptography that is post-quantum, that is actually what's used now across the internet, right? Your browsers, and we were just checking some of the, like, some of the implementations across TLS and other places.

23:03確實，這也是一個猜想，對吧？它的假設是：帶雜訊的矩陣乘法這個數學問題是困難的。好處是，如果這個問題被解開了，AI 也會變得簡單得多，因為 AI 底層也是同樣的矩陣乘法。所以我認為我們還有很多空間。但這也是為什麼，我們不能把密碼學僵化，我們需要在這方面持續創新。就目前來說，我們沒問題，而在這個領域工作的人都非常密切關注這件事，也持續創新，確保走在前面。好。很好，我們收尾吧。要收尾了？對。謝謝大家，密碼學會沒事的。And indeed, it is a conjecture too, right? There's, like, hey, this mathematical problem of, you know, matrix multiplication with noise is hard. The benefit is, if that's solved, we also, like, AI will become way simpler because it's the same matrix multiplication underneath. And so I think there's, like, a lot more kind of room we have. But that's why, like, yeah, we cannot ossify cryptography. We'll need to continue innovating here. For right now, we're fine, and, you know, like, people who are working in this space are all really on top of this and really continue innovating to make sure to be ahead of it. Okay. Good. Let's wrap. We got to wrap? Yeah. But thank you, everybody, and cryptography is going to be okay.