0G · Confidential Compute
Intelligent AI for creating realistic conversation obfuscation.
Every message written several ways. Sealed compute picks the one that sounds most human.
Why it matters
A disguise that reads like a disguise gets you caught.
Hiding a message in ordinary language is the easy half. What flags you is fluency — a sentence nobody would actually send. Scanners are very good at spotting text that doesn’t sit right, and being flagged is worse than sending in the clear.
So something has to judge how natural it reads. And that judge sees text derived from your message. Run it on a normal endpoint and you’ve created the exact record we exist to prevent.
Sealed compute makes the judgement possible without the evidence.
Why the encoder stays local
Reversible steganography needs both ends walking byte-identical distributions, or the message never comes back at all.
Hosted GPU inference can’t promise that — shared fleets, no seed. Even at temperature zero, two runs diverge.
So we split the work. The reversible coding runs on a pinned local model. The naturalness call — a preference, not something anyone has to reproduce — runs on 0G. Determinism where reversibility needs it, sealed compute where privacy does.
How it works
- Encrypt. AES-SIV, on your device. Everything downstream sees ciphertext only.
- Write it several ways. A pinned local GPT-2 encodes that ciphertext into multiple different cover texts.
- Judge in sealed compute. 0G scores which one reads most like a person wrote it.
- Send the winner. That sentence about coffee is all the platform ever keeps.
- Decode. The other end reverses it exactly. A valid auth tag means it was ours — an invalid one means it really was small talk.
What 0G actually sees
Candidate cover texts. Ciphertext, never plaintext, and useless without a key that never leaves your device. Compromise the sidecar tomorrow and you hold sentences about coffee.
The other half: anonymous membership
0G Chain also holds the membership contract. Paying inserts a commitment. Claiming a handle proves you know the secret behind some commitment and burns a one-time nullifier.
wallet → commitment is public. commitment → handle is not. The link is severed by construction, not by our discretion.
Specifics
| Sealed inference | 0G confidential compute — best-of-N cover selection |
|---|---|
| Local codec | GPT-2, pinned, CPU, greedy — deterministic across restarts |
| Encryption | AES-SIV, client-side, key never transmitted |
| Chain | 0G Galileo, chain ID 16602 |
| Membership | Semaphore commitment + single-use nullifier |
0G does not run the encoder, and it cannot. Hosted inference can’t give the byte-determinism reversibility needs. We asked about deploying our own model into their trusted environment — not supported today.
Sealed compute sees candidate cover text. Ciphertext-equivalent, not plaintext — but not nothing.
Best-of-N improves how natural it reads. It isn’t a guarantee against a purpose-built classifier.