Sean Kimball
Founder
Former Chief Data Officer at AmTrust Financial and Chief Data Strategist at MetLife Investment Management. A decade at Credit Suisse leading global engineering and data architecture.
Blindproof
The Private Inference Subnet
Larvatus prodeo — “I advance masked.” — Descartes
Miners run LLM inference on data they mathematically cannot read — and are paid only when a public proof confirms the work ran exactly right.
Get early access →Miners, validators, and design partners: join before the subnet opens to outside miners in Q1 2027.
DETERMINISTIC · PRIVATE · PROVEN · SETTLED
The Problem
Trustless private inference does not exist.
Every AI service today can read your prompts.
The state of the art is hardware enclaves (TEEs). But enclaves don’t remove trust — they relocate it to the chip vendor and its supply chain.
There, the incentive to extract secrets is enormous, and the theft is a nearly perfect crime: the victim never learns how their secrets got out.
For these industries, “trust the chip” is exactly the trust that cannot be given:
- Finance
- Insurance
- Defense
- Healthcare
- Law
The Solution
The Blindproof stack: four layers, each built on the one below.
One event, two money streams
A single verification moves both at once: the miner’s validator weight rises (emissions) and the client’s escrowed fee releases (revenue).
Subsidy and product settle on the same mathematical event.
Pick a tier:
- 4
SettlementTestnet
Every job is checked, then paid — not sampled. Weights settled on testnet on 5 Oct 2026; fee escrow is designed.
- 3
Private inferenceResearch
Masked execution on the same verified rails: every value a miner holds is noise.
- 2
Proven inferencePrototype
Each piece of computation carries a ZK proof that it produced exactly the canonical output.
- 1
Deterministic inferenceMeasured
Byte-identical execution across GPU types, so verification is a hash comparison.
How Blindproof Works
The design: the client masks, goes offline, and returns to a verified answer.
Masked prompt
The client masks its prompt and submits. Every value a miner receives is noise.
Deterministic execution
Miners run the pinned open-weight model with byte-identical results across GPUs, so outputs compare directly.
Proof per piece
Each piece of computation carries a ZK proof. Validators run anchored checks and a cross-miner determinism vote.
Settlement on verification
Payment follows the proof, on every job. A false credit is slashable by any watcher for a bounty.
Every paid job leaves a proof bundle hashed on-chain.
On testnet so far: steps 2 and 4 have settled end to end on Bittensor testnet with mock inference and mock proofs. Masking runs in off-chain prototypes. See the evidence · See the roadmap
The Benefit
Private inference is the difference between AI as a tool and AI as surveillance.
For the market
AI is moving into every meeting, inbox, calendar, and dataset. Once AI sees everything, private inference becomes the default requirement.
Microsoft’s CEO calls this the Reverse Information Paradox: enterprises pay for intelligence twice — once in fees, again in the proprietary knowledge their prompts reveal.
A business that prompts a frontier model teaches its vendor how it makes its money.
Enterprises need proof, privacy, and determinism before they can use Bittensor. Individuals need private AI that can’t be sold. Why now: enterprises and individuals
Most businesses, and nearly all individuals, cannot afford a GPU fleet on standby — and renting “confidential” hardware reopens the trust gap. On Blindproof, trust rests in proofs, not operators. A network whose machines cannot read the data has no operator to breach.
For Bittensor
Blindproof answers the hardest standing criticisms of the ecosystem. Read our answer to the TAO bear case.
| Today | On Blindproof | |
|---|---|---|
| Verify, then pay | Emissions and fees move on trust, before anyone proves the work. | Verification is the payment event. |
| Auditable revenue | Subnet revenue is self-reported. | The ledger is on-chain. Anyone can check it. |
| Real fees | Many subnets run on emissions alone. | Every job carries a customer fee from day one. |
| Deterministic scoring | Scoring is sampled and subjective. | Weights are a deterministic function of public proofs. |
The TAO Bear Case
Critics say Bittensor shows supply but can’t prove real demand. Blindproof answers them four ways.
-
Don’t just compete on cheap tokens.
Sell deterministic, private, verifiable compute: something commodity inference cannot easily provide.
-
Make every paid job provable.
Every customer job is tied to a verifiable on-chain record.
The proof becomes the invoice.
-
Make real demand visible.
Put customer fees alongside network subsidies in public. Anyone can see how much activity comes from real customers versus network incentives, and judge whether genuine demand is emerging.
-
Make decentralization more private than the cloud.
Centralized compute requires the customer to trust one provider with plaintext — and, behind that provider, the cloud host and the chip vendor. Enclaves relocate that trust; they do not remove it.
On Blindproof, no participant has any picture. The customer’s own machine is the only one that ever holds plaintext; every miner holds noise, and every miner’s work is checked before the next step.
That is not “as private as the cloud.” It is more private, with a proof — and the more miners join, the nearer, cheaper, and more vendor-free the network becomes.
The result
Blindproof doesn’t just help Bittensor prove that customers are buying compute. Blindproof gives that compute a differentiated reason to exist: private, verifiable computation that benefits from being decentralized.
The Team
Built by people who wouldn’t trust the chip.
Mark Gleason
Founder
Head of AI Strategy at OdysseyRe (Fairfax Financial Group). Former Chief of Enterprise Architecture at Hudson Insurance Group. Began as a Department of Defense AI engineer.
Jeanette Straughn
Founder
Head of Enterprise Data Governance at Air Products. Former Head of Global Data Governance at AmTrust Financial, with prior roles at AIG, MetLife, and Validus Reinsurance.
- Contact
- [email protected]