Blindproof

A thesis for Bittensor

Stop selling what the cloud sells better. Sell what the cloud cannot.

Commodity tokens: the hyperscaler has the scale, and Bittensor should not make that the fight. Tokens kept private: every guarantee rests on parties who do not share notes, and at a centralized provider, collusion is the default state, not an attack. What makes the product private is the absence of a centralized provider, and a centralized provider cannot sell its own absence.

Where the network wins

Three things a centralized provider cannot offer, because each one is its own absence.

1

Local: a GPU in every city.

Private inference keeps the plaintext on the customer’s machine and trades a round trip with the GPU every layer. Distance to the GPU is the whole latency budget.

Centralized provider

GPUs sit in the regions the centralized provider built. For most customers the nearest is about 20 milliseconds away: roughly one second per token on a private lane. Usable for batch work, not for conversation.

Network

Any GPU anywhere can join and serve the nearest customer, the way ride-hailing dispatches the nearest car. A miner in the same city is about 3 milliseconds away: interactive speed. More miners means a nearer GPU for everyone, and more competition for every job.

Why it decides

A centralized provider’s capacity is capital expenditure sited where the provider built. It cannot put a GPU in every city, and it cannot let strangers serve its customers, because its customers trust it rather than the strangers. Permissionless supply is the only way to be everywhere.

2

Cannot be turned off.

A channel that one party can close is open only until that party decides otherwise. This one holds for commodity tokens too.

Centralized provider

One company decides whom it serves. It can refuse you, drop you for an unpopular opinion, be compelled by a government, or change its terms tomorrow. Every one of those is a normal business decision, and none of them needs to break any cryptography.

Network

No party decides. Any miner serves anyone; a miner that refuses is replaced by the next one; there is no office to compel and the protocol has no opinion about your prompt.

Why it decides

Availability to the unpopular is not a feature a centralized provider can add. The moment one company can say no, it will eventually be asked to, and it will have to answer.

3

Collusion is the default state, not an attack.

Every private-compute system has roles that must not share notes: the party that masks, the party that computes, the party that verifies, the party that deals mask material, the party that sees the traffic.

Centralized provider

One company plays every role. The masker’s host, the GPU operator, the verifier, the mask dealer, and the traffic log are the same payroll. “We don’t look” is a policy, and a policy is what changes when the incentive does.

Network

The roles sit with independent strangers who hold separate stakes and leave a public record. Collusion has to be organized among parties with no reason to organize, and the record makes it slashable by anyone who notices.

Why it decides

Every privacy and verification guarantee in the system rests on “these parties don’t share.” A centralized provider makes that false by construction. A network makes it true by default, which is the point of the network.

The product

Who else can read your data: three parties at a centralized provider, none on the network.

Centralized private inference

Enclaves, confidential virtual machines, hosted private endpoints. Besides the customer, who holds the data:

The centralized provider runs the model, keeps the logs
Plaintext
The cloud host TDXRay, 2026: prompts pulled from confidential VMs with attestation intact
Plaintext
The chip vendor root of trust for the enclave
Trusted

3parties, other than the customer, trusted with the data

Masked inference on a network

Blindproof’s private tier: plaintext never leaves the customer’s own machine. Besides the customer, who holds the data:

Every miner any GPU, anywhere
Noise
Every validator checks the proof, never the data
Noise
The chip vendor no enclave, nothing to attest
Not trusted

0parties, other than the customer, trusted with the data

A centralized provider could run the same masking, and its GPU would then see noise too. But its verifier, its mask dealer, and its traffic log would still be the same company as its GPU. The masking can be copied. The right-hand column cannot: it exists only when the roles are held by parties who do not share notes.

ResearchMasked execution runs in off-chain prototypes today; the private tier is the research layer of the Blindproof stack. Determinism is measured, proofs are a prototype, settlement has run on testnet.

What it means for a subnet

Three moves, each one impossible without a proof per job.

  1. Sell guarantees, not tokens

    Deterministic, private, proven, settled. Price the guarantee, and let the hyperscalers have the commodity token.

  2. Make the proof the invoice

    No job without a proof, no fee without a job. Revenue becomes a record anyone can recompute, which is the direct answer to demand opacity.

  3. Publish the ratio

    Customer fees next to emissions, for the same verified jobs, watched in real time. If the business stands on its own, everyone sees it. If it does not, everyone sees that too.

The bear case, answered row by row

Blindproof

The subnet built on this thesis.

The strongest answer to the bear case is not a rebuttal. It is a product that could not exist on centralized compute.

Blindproof is that product: miners run inference on data they mathematically cannot read, and are paid only when a public proof confirms the work ran exactly right. Each guarantee on this page is a layer of the stack, with its status stated.

See the stack Testnet record Read the whitepaper