During recent discussions about the security of decentralized inference through Routstr, people raised a valid concern: how can we be sure a provider doesn't read our prompts, or alter tool calls to backdoor the machine or the code it generates? Or how do we know the provider does not swap the model for a cheaper one and charge you full price? The usual answer is a TEE, a trusted execution environment. TEEs are hard to audit in practice. You trust the hardware vendor and re-verify a whole software stack after every update. We can do better, and now we do.
Routstr has a confidential mode. Your client talks TLS 1.3 directly to the upstream provider (Venice, for my node), and the Routstr node in between only relays encrypted records. Client and node compute the TLS keys together, so the node can add its API key without ever seeing your prompt or the answer, and it can't change a single byte of the response, tool calls included. Zero-knowledge proofs pin the model and the token cap, and you pay for the usage the provider itself reported. All of this rests on math and on the certificates you already trust, with no enclave or special hardware anywhere.
It works today on routstr.cypherpunk.today, through routstrd (I'm running opencode agents on it) and right in the browser, where the page does every check itself. It's new and experimental, so please try it and tell me what breaks.
Blog: https://juraj.bednar.io/en/blog-en/2026/10/10/confidential-inference-on-routstr-without-trusted-hardware/
Try it in the browser: https://jooray.github.io/routstr-confidential-pwa/
Paper: https://github.com/jooray/routstr-confidential/blob/HEAD/paper/paper.pdf
Code: https://github.com/jooray/routstr-confidential
Nethemba
npub13y…ls5ku
2026-10-13 01:00:01 UTC
Author Public Key
npub13yxp2xmwcsd28gnknpkdw4uhmf9sjvmz4vpts4lp0x929fc5va8qels5kuPublished at
2026-10-13 01:00:01 UTCEvent JSON
{
"id": "8d146ea5496b5aaaeb5a4da0e6fce61a2b3ba6597db41e0381cf7a3813ae5fbc",
"pubkey": "890c151b6ec41aa3a276986cd75797da4b093362ab02b857e1798aa2a714674e",
"created_at": 1791853201,
"kind": 1,
"tags": [],
"content": "During recent discussions about the security of decentralized inference through Routstr, people raised a valid concern: how can we be sure a provider doesn't read our prompts, or alter tool calls to backdoor the machine or the code it generates? Or how do we know the provider does not swap the model for a cheaper one and charge you full price? The usual answer is a TEE, a trusted execution environment. TEEs are hard to audit in practice. You trust the hardware vendor and re-verify a whole software stack after every update. We can do better, and now we do.\n\nRoutstr has a confidential mode. Your client talks TLS 1.3 directly to the upstream provider (Venice, for my node), and the Routstr node in between only relays encrypted records. Client and node compute the TLS keys together, so the node can add its API key without ever seeing your prompt or the answer, and it can't change a single byte of the response, tool calls included. Zero-knowledge proofs pin the model and the token cap, and you pay for the usage the provider itself reported. All of this rests on math and on the certificates you already trust, with no enclave or special hardware anywhere.\n\nIt works today on routstr.cypherpunk.today, through routstrd (I'm running opencode agents on it) and right in the browser, where the page does every check itself. It's new and experimental, so please try it and tell me what breaks.\n\nBlog: https://juraj.bednar.io/en/blog-en/2026/10/10/confidential-inference-on-routstr-without-trusted-hardware/\nTry it in the browser: https://jooray.github.io/routstr-confidential-pwa/\nPaper: https://github.com/jooray/routstr-confidential/blob/HEAD/paper/paper.pdf\nCode: https://github.com/jooray/routstr-confidential",
"sig": "f0834700a0da89fc196289b110cec4f45d8f86eeaf63fcd81260dabdd9dee9e03827f154fa67a6f1238b26249f8ce194f202233d2d094b7d6debe3d6ff507a83"
}