zkSI^[docs]v0.1

how itworks,

what itcan't hide

A crowd you can hide in, from day one.

zkSI is noise mining for private SI requests.

A fixed volume of traffic hides the real requests. When real traffic is low, miners fill the gap with decoy requests. When real traffic grows, the decoys shrink. PLANNED

The problem it targets: a private network is only as private as its crowd. With 50 users, there is no crowd. zkSI pays for the crowd until real users replace it. PLANNED

A fixed target. Miners fill the gap.

The network aims for a fixed target volume, for example 1,000 requests per minute. The real value is not decided. PLANNED

Miners deliver the difference between the target and real traffic, and are paid for that volume. PLANNED

Noise matters most at the start and falls on its own as the network grows. What happens when real traffic goes above the target is not decided. [VERIFY]

Cheap at the network. Expensive at the model.

The Noise Pool pays mainly for endpoint noise, because that is where the cost is. PLANNED

In the Noise Lab (v0.1), a local decoy generator hides your request among decoys and pads every request to a fixed size class (256 B, 512 B, 1 KB, 2 KB or 4 KB), so size does not reveal which one is real. It runs only in your browser and sends nothing. v0.1 LOCAL

Next, the same code becomes an open-source client that sends real requests through a partner gateway, and each user pays for their own noise. PLANNED

Decoys only work if they look like real requests. A generator that does not copy real request patterns can be detected. See risks.

Pick a seat. Watch the traffic.

All rows: PLANNED. The exact view of each node depends on the mixnet used, which is not decided. [VERIFY]

What zkSI does not hide

The SI provider still reads the content of your real request. If your prompt contains your name, your email or text that only you would write, noise does not protect you. zkSI hides which request is yours, not what it says.

Who we defend against, and who we don't.

zkSI is built against the adversaries below. Each one says what the design does about it and whether it is built yet. None of it is: it all comes with the network. PLANNED

Out of scope

• What your prompt says. See section 04.
• A compromised device. If your computer or browser is not yours anymore, nothing here helps.
• A provider that refuses decoy traffic.

How much a network observer can still learn depends on the mixnet used, which is not decided. [VERIFY]

If the Noise Pool runs out of money, the noise level drops and so does privacy.

Pay for decoys nobody can see.

Miners are paid for decoys that, by design, look like everything else. Proof of noise is how the network checks they were sent without learning which ones they were. The lab runs steps 2 to 4 locally today; the rest comes with the network.

1. stakeThe miner locks a stake, for example 0.1 ETH. PLANNED
2. commitAt the start of each one-hour epoch, the miner publishes on chain a hash of the batch it is about to send. v0.1 LOCAL on chain: PLANNED
3. sampleAt the end, the hash of a future block picks about 1% of the batch. Nobody knows the sample in advance. v0.1 LOCAL block hash: PLANNED
4. openThe miner reveals the sampled decoys. Two checks: they were sent (their nullifier shows up at the gateway) and they look credible. v0.1 LOCAL (hashes only) nullifier check: PLANNED
5. pay or slashPass: paid for the whole batch. Fail: the stake is lost. PLANNED

Why 1% can be enough

If a miner fakes part of a batch, every opened decoy is a chance to get caught. With 100 decoys opened:

ESTIMATE  math: 1 - (1 - share)^100. Small cheating is harder to catch than big cheating. The batch size per miner and the audit size are not decided. [VERIFY]

Open questions

• Who decides that a decoy is credible, and how. [VERIFY]
• Whether a block hash is random enough, given that block producers can influence it. [VERIFY]

In the lab today. The Noise Lab runs a local version: a SHA-256 commit over the decoy hashes, then it opens ~1% (at least one), chosen from hash(commit + simulated beacon). It only checks hashes. v0.1 LOCAL

v2. The audit becomes a zk proof: the miner shows that k of the published nullifiers are theirs, without saying which. PLANNED

Who pays for the noise.

The Noise Pool pays miners for verified decoys. It mainly pays for endpoint noise, because that is where the cost is. PLANNED

It is meant to be funded from two places: a fee of about 20% on real requests, and a bootstrap fund at the start. PLANNED

Miner rewards are not guaranteed. If the pool runs dry, fewer decoys get paid for, and privacy drops with them.

Any token would come only after real miners exist and after legal review. Until then, everything runs in ETH / USDC. Anything claiming to be a zkSI token today is not ours. DECIDED

Privacy costs real inference.

An endpoint decoy is a real request to a real model, so it costs what a real request costs. We say this up front.

At network level, per hour

With a fixed target of 1,000 requests per minute, the decoys to pay for depend on how many real requests there are:

ESTIMATE  decoys / hour = (1,000 - real) x 60. The target of 1,000 is an example, and prices change over time.

Commit first. Open later.

The core of proof of noise is a commitment: the miner fixes the batch with a hash before anyone knows which decoys will be opened. Changing a single character afterwards changes the hash, so it shows. The lab does this today; on chain it comes with the network. v0.1 LOCAL

This is the code the figure runs:

const sha = async s => hex(await crypto.subtle.digest("SHA-256", enc(s)));

const leaves = await Promise.all(batch.map(sha));   // one hash per decoy
const commit = await sha(leaves.join(""));          // published before sending

// later: a beacon nobody knew in advance picks what gets opened
const pick = parseInt((await sha(commit + beacon)).slice(0, 8), 16) % batch.length;

// anyone can check the opened decoy against the commit
const ok = (await sha(batch[pick])) === leaves[pick]
        && (await sha(leaves.join(""))) === commit;

v1 has no zk: stake, commit, random audit and rewards only. The zk parts come in v2, built with a cryptographer on the team. PLANNED

Don't trust this page. Check it.

What you can check today is small, and we list it as it is.

Check the lab yourself

1. Open zksi.io/lab on a computer.
2. Open the developer tools (F12) and go to the Network tab.
3. Write a request and run the lab.
4. No new request should appear. The page's security policy only allows connections to zksi.io itself (connect-src 'self').

The site has no build step: the files you get are the files we wrote. You can read them with view-source.

The lab's code is public: github.com/zkSI0x/noise-lab (MIT). Its standalone copy blocks every connection (connect-src 'none'), so you can run it offline and watch nothing leave. v0.1 LOCAL

Later

Open problems, written down.

None of these are solved. Each has a planned answer, and each answer still has to be tested.

Limits

• zkSI hides which request is yours, not what it says.
• v0.1 does not send your request to any SI model, so it does not protect a real request yet. It shows the mechanism, locally. v0.1 LOCAL
• It is not "100% anonymous", and nothing here is unbreakable. Do not rely on it for anything where a leak could hurt you.
• The lab's decoys come from fixed templates; a trained detector could spot many of them. v0.1 LOCAL
• The lab's audit only checks hashes, and its timings are simulated. v0.1 LOCAL
• The mixnet is not chosen, so the network layer's real protection is unknown. [VERIFY]
• A block hash as randomness may be biased by block producers. [VERIFY]

Small, testable steps.

Times are estimates for building each step, not dates. Nothing starts counting until the previous step works.

Found a problem? Tell us first.

If you find a security problem in zksi.io or the Noise Lab, email us before you publish it.

Please

• Describe the problem and the steps to reproduce it.
• Give us a reasonable time to fix it before you make it public.
• Do not access other people's data and do not run attacks that slow the site down for others.

We read every report. There is no bug bounty yet. In scope today: zksi.io and the Noise Lab. The network comes next, so there is no network or contract to test yet.

Short answers.