Vitalik Buterin uses zkAPI and Tor to test AI privacy and achieve personalized recommendations

Ethereum co-founder Vitalik Buterin attempts a multi-layered strategy to protect personal data

Ethereum co-founder Vitalik Buterin recently experimented with a multi-layered strategy that aims to protect personal data while obtaining health advice generated by artificial intelligence. He used his health and travel information to try to obtain tailor-made diet and exercise advice without exposing sensitive details to external services.

Local Coordination and Privacy Layer

Buterin's experiments involved a local artificial intelligence model, Qwen 3.8 Flash Next, that routes requests to an advanced remote model as needed. A key component of its approach is to minimize the amount of personal data shared with each query.

His settings are supported by three privacy layers. The first layer focuses on prompt word security: local models are not only responsible for building and filtering questions, but also block identifying language or style clues, thereby reducing the risk of being re-identified by external models.

In terms of transaction privacy, Buterin uses zkAPI, a system that separates payment for services from user identity. According to the Ethereum Foundation, zkAPI is a private-use credit protocol that allows users to deposit funds in a vault and authorize expenditures through zero-knowledge proof, rather than directly linking payments to specific identities or requests.

In practice, temporary API keys are used to manage spending caps, while signed usage receipts determine specific fees. Payment providers can confirm funds through certificates, but will never be exposed to AI queries submitted directly to remote models.

Layer 3 uses Tor routing. By running the zkAPI client on the Tor network, Buterin prevents network-based identification and hides IP addresses and other network data from service providers.

Each layer in the system addresses different privacy risks. Even if names are omitted from the AI prompt, link payment records or online footprints may still reveal the identity of the requester, which means a multi-pronged approach is needed to achieve strong protection.

According to documents shared by the foundation, repeated inclusion of personal details, historical reuse, or consistent writing styles may still allow models to link different conversations to the same person, signaling the inherent complexity of privacy in AI interactions.

Performance and tradeoffs

Buterin acknowledges that the health advice generated through this approach has improved, and that richer responses are attributed to the advanced capabilities of the remote model. However, his experiments also exposed several limitations that affect speed and privacy.

Latency is a major challenge, as due to routing through Tor, response times are 10 to 100 times slower than direct connections. He observed that Tor's network isolation may be insufficient for anonymizing requests, reducing its effectiveness as a privacy layer in this context.

On local machines, Qwen can only process 20 to 30 tokens per second, well below Buterin's goal of more than 100 tokens per second for seamless use. He also emphasized the importance of carefully constructing reminders, pointing out that insufficient or excessive deletions can limit privacy and the quality of artificial intelligence suggestions.

Adjusting information sharing becomes complex: retaining too much context reduces the actual value of the reply, and detailed prompts increase the risk of exposure. This trade-off points to the need for continuous optimization in artificial intelligence workflows that prioritize privacy.

Background: Towards a cryptographic world of computers

This artificial intelligence experiment builds on the concepts outlined by Butrin in a recent article in which he discussed Ethereum's transformation to a cryptographic world of computers. The foundations of this vision include enhanced privacy, formal verification, and decentralized off-chain computing supported by advanced cryptography.

HeGotá is believed to be the last regular Ethereum fork before the introduction of quantum-resistant methods and recursive zero-knowledge proofs, marking an important step in these continued development.