Hushroom

private AI inference. prompt encrypts on your device, runs in a sealed enclave, comes back proven.

[Hushroom @AskHushroom]

Hushroom is live.

CA: J5xCifaJKbDkTDd6aNkfHLyyqU5W1JhSe4gxT6Cgpump

you pay for a request from a shielded ZEC note. your prompt encrypts on your device and goes straight into a GPU enclave the operator cannot read into. the model runs there. what comes back is the answer plus a sealed receipt: a hash of the exact weights that ran, the enclave’s signed attestation, a hash of the output, and the payment nullifier. it proves the named model actually ran on your request. it says nothing about who you are.

who paid, what was asked, what ran. on every other service those three sit in the same row, one request away from being a file on you. here they are cut apart before they meet.

stake $ZZZ and the network mints you blind compute notes, issued so the issuer can’t match a note back to you. spend one per request. no account, no API key, nothing to subpoena.

ask anything. be no one.
$ZZZ / pair ZZZ/VVV

[Hushroom @AskHushroom]

the request path has three handoffs and your identity survives none of them. payment is a shielded note, so it clears without a sender attached. the prompt is ciphertext before it leaves your device. the enclave decrypts it in memory the operator is physically locked out of. three stages, and at no stage does a system hold both your identity and your content.

[Hushroom @AskHushroom]

the thing most “private” AI gets wrong is where the decryption happens. encrypting in transit is table stakes, but the server still decrypts your prompt to run it, and at that moment it’s plaintext in someone’s memory, logged or not. the enclave moves that moment inside hardware the operator is locked out of. the prompt is only ever readable in a place no human has a window into.

[Hushroom @AskHushroom]

the receipt proves the exact weights ran. swap one weight and the hash changes. so “we ran the model you paid for” stops being something you take our word on.