Blind AI: Idle-Mac Networks, Zero Premium, Discovery Risk

“Encryption works.” – Edward Snowden

Get Full Access to Trends Pro

❓ What You’ll Learn

Why can someone subpoena the AI chats you deleted?
How do you charge for AI that physically can’t read your data?
Which 7 businesses can you start in the gap between encrypted AI and merely “trusted” AI?
How much do idle MacBooks really earn overnight?
What vault attack, Helium economics or Apple clause could sink a company built on this?

💎 Why It Matters

Blind AI inference launched at or below the price of the kind that can read your prompts.

The choice between privacy and capability just collapsed.

🔍 Problem

You paste a contract, a diagnosis or your source code into AI to get real work done.

That prompt now lives on someone else’s server, under their retention policy and any court order they get.

“Delete” turned out to mean “retain, segregate and produce in discovery.”

💡 Solution

Blind AI companies run your encrypted prompt inside a sealed hardware vault that even the machine’s owner can’t open, so the server side can’t read what it serves.

Encrypted on your device. Attested before it runs. Decrypted only for you.

🏁 Players

Blind Inference Providers

Darkbloom • Operator-blind inference on idle Apple Silicon Macs, priced ~50% below API rates. The supply-side wild card.
Tinfoil • YC-backed confidential inference plus a $20/mo private chat. The cleanest “trust the hardware” pitch.
Confer • Signal creator Moxie Marlinspike’s E2EE chatbot, now being integrated to underpin Meta AI.

Confidential Clouds

Apple Private Cloud Compute • The reference architecture: stateless Apple Silicon servers Apple itself can’t inspect, now expanding onto Google Cloud.
Microsoft Azure • Furthest-along hyperscaler: confidential VMs pairing AMD SEV-SNP with H100s plus a managed confidential inferencing service.
NVIDIA Confidential Computing • The shared silicon: H100 and Blackwell GPUs with GA confidential computing that nearly every startup here rides.

Consumer GPU Networks

Salad • The largest consumer network: 60,000+ daily active GPUs across 450K+ nodes, where the host can in principle observe the workload.
Aethir • The revenue leader: reported $39.8M Q3 2025 revenue across 435,000+ datacenter-grade GPU containers.
io.net • Solana-based GPU aggregator processing up to 4B AI tokens per day after an $8M enterprise deal.

Local and Adjacent Tools

Ollama • The default local-model runner. Privacy by locality, free locally, with a $20/mo cloud tier that reintroduces a trusted operator.
LM Studio • Free desktop GUI for local models where data never leaves the machine.
Exo • Open-source clustering of your own Macs into one inference machine. Darkbloom’s closest technical cousin minus the marketplace.

🔮 Predictions

A frontier lab will sell operator-blind access to a proprietary model.
- The model developer is the one party a logged API can’t hide from, which is exactly what a hardware vault removes.
- Providers in the lane serve open weights today, leaving blind access to GPT, Claude and Gemini as unmet demand.
- Apple now runs Apple Intelligence on Google Cloud vaults it doesn’t own, proving frontier models can run blind on rented silicon.
Courtrooms will outpace regulators as the demand driver. A major AI vendor will market “we can’t produce what we can’t read.”
- A court affirmed production of 20 million ChatGPT logs in January 2026.
- An earlier order preserved deleted chats users believed they had deleted.
- Each discovery order is free advertising for an architecture with nothing to produce.
The privacy premium will stay at zero. Blind inference prices at or below standard rates.
- Competition removes any pricing-power basis for a privacy upsell.
- Vault overhead is measured below 7%, so there’s no cost basis for a markup.
- Comparable open-weight models run $0.10-0.15 per million tokens on commodity providers. Blind providers launched under that.
A public side-channel break of GPU confidential computing will force fleet-wide re-attestation.
- Apple’s $1M PCC bug bounty prices how much a break is worth.
- GPU vaults went generally available with CUDA 12.4 and carry far more value per machine, making them the most attractive unbroken target.
- CPU vaults have fallen repeatedly: WireTap pulled Intel SGX keys with a sub-$1,000 interposer and Battering RAM bypassed AMD SEV-SNP for ~€50.

☁️ Opportunities

Ship the “LiteLLM of blind AI”. Offer one proxy that encrypts, attests and routes to the cheapest vault provider.
- AI gateways are already how developers route open-weight inference.
- The wedge is friction. Change one base URL and your app stops leaking prompts.
- Providers in the lane are OpenAI-compatible by design, including Tinfoil keeping your existing OpenAI clients.
Launch the blind-AI benchmark site.
- Providers differ on price, latency and attestation, from post-quantum encryption inside Intel TDX and NVIDIA CC to re-attestation clocks that range from seconds to hours.
- Build the Artificial Analysis of private inference. Monetize with enterprise API access. The site becomes the category’s front door.
- Few track them side by side today.
Start a Mac-fleet supply business for agencies and schools with idle racks.
- Individual owners earn beer money, which is exactly why aggregated fleets are the play.
- Handle onboarding, uptime and payouts for a management cut while early-mover margins are best.
- Roughly 110-130M Apple Silicon Macs have shipped since 2020. Agencies own racks that sit idle 16+ hours a day.

🏔️ Risks

Helium Economics • Consumer-node payouts are hobby-grade. DePIN supply leaves when incentives normalize.
Prospective Compliance • No EU regulator has blessed attestation, so “compliant by hardware” stays an argument until one signs.
Apple License • Multi-tenant inference on strangers’ Macs runs on Apple’s certificates in untested territory.

🔑 Key Lessons

Courtrooms are the category’s best salespeople. Sell to the subpoena-afraid first: legal, HR and M&A feel discovery risk in their bodies.
Trust is migrating from terms of service to silicon. Ask for attestation before a DPA. Build so your privacy claim is a hardware property you can verify.

🔥 Hot Takes

The next AI moat won’t be the model. It’ll be what you can prove you never saw.
“We can’t read it” beats “we won’t read it” in enterprise deals from here out.

😠 Haters

“You sealed the box. What about the pipes?”
Even a blind vault can’t help if the prompt travels in weakly or the answer gets logged after your device decrypts it. The strong builds encrypt the channel end to end and pin the endpoints, so the sealed middle and the secured ends form one chain. The weak ones leave a gap that reaches the same exposure inbound or outbound.

“Local AI eats this from below.”
A good local 14B model is free and private by default. The counterweight is the strongest fact here: Apple, the on-device champion, moved frontier Apple Intelligence to cloud vaults because frontier models exceed what a laptop holds.

“The node operator is exactly the attacker vaults don’t defend against.”
A stranger’s Mac is physically held by the person you’re hiding from, where CPU vaults have already fallen to sub-$1,000 attacks. GPU vaults have no public break yet. The new PCC design uses two independent roots of trust so one broken vendor isn’t fatal.

“Nobody pays for privacy. The prices prove it.”
Tinfoil charges ChatGPT Plus parity and Darkbloom launched below market, so the premium really is zero. That cuts the other way: features priced at zero become defaults. Defaults eat markets.

🔗 Links

Powering the next era of Confidential AI • Google’s account of the Apple PCC stack: Titan chip, Intel TDX and NVIDIA CC assembled for blind inference at scale.
Project Darkbloom: Unlocking Idle Compute for AI • Eigen Labs’ own economics thesis: idle Mac capacity, 95% provider share and why structure beats subsidy.
Confidential Computing on NVIDIA H100 GPUs • NVIDIA’s technical blog on where vault overhead actually hits: PCIe transfers, not GPU compute.

📈 What else?

Trends PRO #0170: Blind AI has more insights.

What you’ll get:

28 Players (133% more)
7 Predictions (75% more)
7 Opportunities (133% more)
5 Risks (67% more)
4 Key Lessons (100% more)
4 Hot Takes (100% more)
8 Links (167% more)

With Trends Pro you’ll learn:

(📈 Pro) Which 30-second signal turns “trust us” into proof a normal user can read?
(📈 Pro) How does a stranger’s idle Mac earn its owner only six dollars a month while the calculator promised $280-600?
(📈 Pro) Which two moats decide who survives the private-AI consolidation?
(📈 Pro) Which audio workflow is still an open lane while the field crowds chat?
(📈 Pro) How do you migrate one regulated vertical off logged APIs after a $670,000 breach penalty?
(📈 Pro) What UX gap leaves privacy claims unverifiable when vendors hand you measurement hashes?
(📈 Pro) Why does a “private edition” at +40% fight the whole market’s pricing?
(📈 Pro) What single upstream flaw could take down every blind-AI provider at once?
(📈 Pro) How do you run a subpoena-shielded AI workspace law firms would actually buy?
(📈 Pro) Which Fortune 500 ban turned generative AI from a perk into a firing risk?
And much more…

Get Weekly Reports

Join 54,000+ founders and investors

📈 Unlock Pro Reports, 1:1 Intros and Masterminds

Become a Trends Pro Member and join 1,200+ founders enjoying…

🧠 Founder Mastermind Groups • To share goals, progress and solve problems together, each group is made up of 6 members who meet for 1 hour each Monday.

📖 160+ Trends Pro Reports • To make sense of new markets, ideas and business models, check out our research reports.

💬 1:1 Founder Intros • Make new friends, share lessons and find ways to help each other. Keep life interesting by meeting new founders each week.

💲 100k+ Startup Discounts • Get access to $100k+ in startup discounts on AWS, Twilio, Webflow, ClickUp and more.

Brought to you by the team behind HeadsUp

Markets and Ideas