Vitalik Buterin tests AI privacy with zkAPI and Tor routing

Vitalik Buterin leverages a three-layer privacy architecture for AI queries: Speed constraints and data tradeoffs shape experimental results

Vitalik Buterin tested a system that obtains personalized diet and exercise recommendations through local AI choreography that leverages a more powerful remote model. The experiment combines carefully written prompt words, zkAPI payment mechanism, and Tor routing technology to solve issues such as content disclosure, billing association, and network exposure respectively. Buterin reported that while receiving better recommendations, four major limitations were also identified, including slow response speeds and weak isolation between requests.

Ethereum co-founder Vitalik Buterin recently tested a system that allows AI advice while limiting the exposure of personal data. His experiments used health and travel information to generate personalized diet and exercise recommendations. A local model coordinates requests for more powerful remote systems, drawing on the latter's reasoning capabilities and knowledge base. This AI privacy setting combines carefully written prompts, private payments via zkAPI, and Tor routing, which address the risk of identity leakage from different sources.

Vitalik Buterin said that the addition of remote input has improved the quality of suggestions, although privacy protections still need to be improved. He also pointed to the problem of slow response and a clear trade-off between "sharing less information" and "getting useful advice."

Specific implementation of three-layer privacy layers

Vitalik Buterin identifies his local coordinator as Qwen 3.8 Flash Next, which calls cutting-edge models when needed. A Skills File guides these calls, instructing local systems to disclose as little personal information as possible.

The first privacy layer covers the content of the prompt words and writing style. The local model is responsible for building the problem, reducing the risk of remote services identifying it through wording or personal details.

The second privacy layer involves the payment process, because payment methods often link AI requests to identifiable customer accounts. To this end, the experiment used zkAPI, a system designed to separate payment authorization from user identity. The Ethereum Foundation announced on October 1 that zkAPI is a "private usage quota" designed for paid services. Users inject funds into the vault and then authorize spending through zero-knowledge certificates without revealing which deposit paid for the request. In runtime key model, temporary API keys limit spending limits, while signed usage receipts determine the actual amount deducted. Payment services only check proof of funds and do not receive prompt words sent directly to the AI provider.

Tor provides a third layer of privacy protection for network information such as IP addresses. Vitalik Buterin accesses the zkAPI through a command-line tool wrapped in Tor, combining payment privacy with network routing.

This design views these safeguards as complementary because each layer covers a different identification approach. Even if the name is removed from the prompt, payment records or network details may still become potential link clues. The foundation also warned that AI providers can still read submitted prompts. Its documentation states that repeated personal details, reused conversation histories, and writing patterns can lead to different conversations being related.

Impact of speed constraints and data trade-offs on experiments

Vitalik Buterin reported that the recommendations returned by the experiment were improved by incorporating knowledge of cutting-edge models. However, he pointed out four weaknesses, involving network design, request construction, local performance, and the balance between privacy and practicality.

He believes that Tor is poor at handling isolation for individual requests and may not provide sufficient privacy protection for such uses. He also estimates that the latency is 10 to 100 times higher than ideal.

Skills files require better strategies to determine what information remote models should receive. This makes request preparation another unresolved aspect of the experiment.

Vitalik Buterin said that at his settings, Qwen generates approximately 20 to 30 tokens per second. He hopes that the speed can reach more than 100 tokens per second so that the system will feel smooth and comfortable.

AI privacy tradeoffs It remains obvious: The less background information you retain, the more limited the help the remote model can provide. This trade-off suggests that payment and network safeguards alone cannot maintain the quality of personalized advice if the request omits important background details.

Ethereum's Future Vision: Crypto-World Computer

The experiment follows a paper published by Vitalik Buterin on September 27, in which he described Ethereum as the future "Crypto-World Computer." His vision is to combine blockchain security with off-chain cryptographic privacy, verification and decentralized computing.

In the paper, he identified Hegotá, which is planned to be launched next year, as the last regular fork. Subsequent developments will involve recursive STARKs (non-interactive arguments for scalable arithmetic circuits), automated formal verification, optimized consensus mechanisms, and anti-quantum security techniques.

He also cited PeerDAS as an early step towards this broader architecture. The expected result is a more secure, lower-cost, more scalable and higher privacy computing environment guaranteed through modern cryptography.