AI-generated content is making it increasingly difficult to know what is real online, while detection technology struggles to keep up. So how can we protect authentic content without compromising privacy?
This is the challenge InReality is exploring together with Bernardo Machado David, Associate Professor in Cryptography at the IT University of Copenhagen (ITU), as part of the Next Generation Cyber Security project on collaboration with DIREC (Digital Research Centre Denmark)
In this interview, Jeppe Nørregaard, CEO of InReality, speaks with Bernardo about the research behind their collaboration. They dive deep into the technical details of how cryptography and transparency logs could help make real content verifiable from the moment it is created. They discuss how transparency logs can protect information from being altered or tampered with, why current systems are difficult for everyday users to verify, and the challenge of making this technology scalable, affordable and privacy-preserving.
The goal is to move beyond simply detecting what is fake and instead build systems that can help us verify what is real.
Take a look!
Jeppe: Hello, I'm Jeppe from InReality, and I'm here with Bernardo from ITU, associate professor in cryptography.
Bernardo: Yeah, in the section for Theoretical Computer Science.
Jeppe: Yes. And we have a question we want to ask you about your research and about our collaboration. So first of all, what is the fundamental problem that you want to solve, both in research and perhaps in our collaboration?
Bernardo: Well, my research revolves around creating secure, distributed, decentralised systems where parties can collaborate with their potentially private information towards a certain goal, be it computing a function, or just making the data public, or making the data immutable. In the context of our collaboration now in this DIREC project, what we are trying to do is actually make sure that once data is registered on a public registry, it cannot be altered or tampered with by adversaries. In the end, one of our goals is actually allowing users to remove their own information when they want to without exposing themselves.
Jeppe: So for us, it's super relevant because of, of course, GDPR and sort of the right to be forgotten. We want to be able to work with common citizens and have their data be able to be secure, but also private. So, where in the internet do we see these types of systems that don't have that kind of privacy? Is this kind of system already used elsewhere, but without that kind of privacy feature?
Bernardo: So right now, the way this technology is used is basically our browsers and our operating systems trusting the vendors of the browser and the operating system itself to provide a service that verifies the integrity of these cryptographic keys for us. So that's another big challenge that we want to solve in this project. How can you deploy such transparency logs at scale in a way that it is still not prohibitively expensive for end users to run the verification that is needed to make sure data has not been tampered with in their regular laptops and mobile phones and tablets?
Jeppe: So in some sense, we're taking the security used for verifying servers and that are verified by professionals, and we want to be able to bring it out to 8 billion people for everyone to use, but that comes with the additional pressure of scalability and privacy, and we're trying to basically handle that.
Bernardo: Yeah. The privacy aspect is completely new to this specific application of keeping track of data and making sure it comes from proper sources, from humans who have generated the content, and that this data is not being suddenly modified by malicious services that actually store and provide the data to other users.
Jeppe: So at a sort of high level and sort of for the layman, what is a transparency log and why is it useful? What do we use it for today that's already sort of working?
Bernardo: A transparency log allows us to make sure that the information we are retrieving is exactly the same information that the original creator of that post, of that data point, has stored, and that it has not been modified while it was stored in this internet server or by some program that is providing us some application, is providing us with the data.
Jeppe: And so basically, in sort of an internet where nobody trusts anyone, we need a way to check the public key that the certificate we've received is correct. And for this, we use certificate authorities. But then we've pushed the problem to: can we trust the certificate authority? And this is where we want to be able to verify the certificate authority itself. And this is where you say, well, there is an issue in sort of is that being done? Is that actually being monitored in transparency log? Is that correct?
Bernardo: Yes. So that's a big issue, that the transparency logs exist. They allow us to make sure that a service storing certain information is not tampering with that information. But the current technology for these logs does not easily allow the end user to verify the log itself, to verify that the data has not been tampered with.
Jeppe: So you kind of need to be a professional in that game to be able to verify this.
Bernardo: Yes. It's not something that is running on our end user devices. Because it's very costly and kind of complicated to use as well, not really scalable. That's one of the issues we want to address.
Jeppe: Well, good to see you again, and nice chat with you. And we're looking forward for a cool collaboration in DIREC, where we're doing some shared research on this very important and very difficult problem.
Bernardo: Thanks for coming here today. It was always a pleasure to talk about these topics.
