Intelligent AI for creating realistic conversation obfuscation.

Why we built on it

Natural Language Encryption turns a private message into small talk. That only protects anyone if the small talk is convincing — a sentence nobody would actually send is itself a flag, and being flagged is worse than sending in the clear.

So we write every message several ways and something has to pick the most natural one. That judge necessarily sees text derived from the user’s message.

Run it on an ordinary inference endpoint and we’d have manufactured the exact record this product exists to prevent — a provider log tying a wallet to the sentences it was deciding between. 0G’s confidential compute moves that judgement somewhere designed not to retain it, and the request never carries plaintext in the first place.

How it works here

1. Encrypt. AES-SIV, client-side. Everything downstream sees ciphertext only.
2. Write it several ways. A pinned local GPT-2 block-codes that ciphertext into several different cover texts, each of which decodes back to the same bytes.
3. Judge in confidential compute. 0G scores which candidate reads most like a person wrote it. If it is unreachable, the first candidate sends anyway — a slower message beats a blocked one.
4. Send the winner. That sentence about coffee is all the platform ever keeps.
5. Decode. The other end reverses it exactly. A valid auth tag means it was ours — an invalid one means it really was small talk.

What 0G sees: candidate cover texts. Ciphertext, never plaintext, and useless without a key that never leaves the device.

Why the codec is local and only the judgement is remote

A steganographic codec has two halves, and only one of them can tolerate hosted inference.

Reversibility needs determinism; naturalness does not

Our encoder is a block coder: at each step the model offers its top 2^k tokens and the ciphertext’s next k bits index into them. Decoding re-runs the same model over the same tokens and recovers those bits. It works for any model — but only if both ends see byte-identical distributions. Hosted GPU inference is non-deterministic even at temperature zero, so routing the coder through it would not degrade the message, it would destroy it.

Choosing between finished candidates has no such constraint. Nobody ever has to reproduce a preference. So the line falls naturally: determinism where reversibility needs it, confidential compute where privacy does.

A judge, not a chatbot

The usual shape for confidential inference is a private assistant. This is narrower: a component that sees derived material, forms an opinion, returns a single integer, and keeps nothing. It never sees plaintext, and the cover text it does see is public by construction — it is the sentence about to be posted to Telegram.

Where we stop, stated plainly

Requests are routed through a broker that settles per request, with the provider signer acknowledged and every request signed. We do not yet capture and verify a TEE attestation per response. Until we do, this is a privacy architecture, not a privacy proof — the difference matters and we would rather name it than let the word “sealed” carry weight it has not earned.

Selection also fails soft. If 0G is unreachable the codec sends the first candidate rather than blocking the message, and the client says which happened instead of claiming a judgement that never ran.

Specifics