The local model wrote the query. It did not delete it.
@VitalikButerin posted at 00:11 UTC on October 4. When I read it, that post had 213,980 impressions, 1,398 likes, and 273 replies. The goal is diet and exercise advice from his own health and travel data, using frontier models, without leaking private information to them. A local model, Qwen 3.8 Flash Next, writes the queries and calls the remote models as tools. He listed three layers. The local model writes, so the provider does not get his sentences. zkAPI is the payment channel. Tor is the IP. He wrote that you need all three, and that we finally have all three, at least to some extent.
Then he wrote that everything works. He got the recommendations back, and info from the frontier models improved them. Better advice means a useful question left the machine.
What the local model sent
The post is two screenshots of the local model’s notes. Red bars cover some phrases. I am not guessing what is under them.
In the first, the model catches a combination that would be “linkable-ish” and keeps those items separate. Then it notices that all three requests go through the same prepaid account, and asks whether the account itself is the identity. The skill says “a brand-new network identity for every call,” and settlement is per-request. The model writes that there could be a single wallet that links them, and that the doc doesn’t say. So it keeps three requests. Each one should read like a textbook question, not a personal one. Exact lab values stay out where a range will do. It also writes that including typical values helps the model. Ranges and rounded phrasing go out. Multiple values from one person do not go out together. Combining D and A into one request, it says, would be clearly one person’s panel.
The second screenshot is a draft about farmed Atlantic salmon, which menu names map to high-mercury fish, weekly servings for an adult, whether mercury stays through grilling or soup, and how that maps onto an EPA reference dose. A phrase in the middle is under a red bar. The model calls it a possible location hint, because the rules said don’t send a country. It decides the fish-and-restaurants combination is a topic, not personal data, and still rewrites the country out. The replacement line is “in Chinese- and Japanese-language restaurant menus in general (including overseas Chinese restaurants).” It also tells itself to avoid “adult male 32” and just ask for adult guidance. That phrase is the example in the note. I am not treating it as a biography.
The last visible line is the send. One remote call, about 3 to 4 minutes, because the user explicitly asked to use the model. The bars are on the images he posted. The notes describe a scrubbed prompt going out. That prompt is still a question about fish, mercury, and a cuisine. The lab ranges are the rule in the other note, not a claim that this particular call carried them.
The doc and the circuit
The doc is not in the tweet. It is in github.com/ethereum/zkapi/pull/16, opened by vbuterin on October 3 at 14:09 UTC. Still open when I looked. Not merged. The title is “Add Tor-routed client mode and make network timeouts Tor-viable.”
The added file tor-remote-research.md is the skill the local model is following. It says the remote model is a paid, observable tool. What you send is observable. The provider sees the exact prompt text. A user’s identity is often reconstructable from a single sentence that was never scrubbed. The discipline, stated once in that file: retrieve general rules and raw data from the remote model, and apply them locally, where nothing is observed.
The command split is the line the model quoted. make_single_request tears the stack down and builds it again, “a brand-new network identity for every call.” ask continues one conversation, and the provider can link everything in it. The same file says the CLI is a singleton. One wallet, one companion, one settlement queue. Two calls at once destroy each other’s server. A batch is sequential, with about 60 seconds of dead time so the last lease can settle.
The model was reading that file and still did not know which sentence was the identity. A fresh network identity per single request, and also one wallet. The provider can link a conversation. The file does not say, in the section the model was using, whether three single requests on that wallet are one account to the provider or three. It wrote “the doc doesn’t say” and split the panel anyway.
The timing table matches the screenshot. A successful single request, measured on a healthy system, is about 3 to 4.5 minutes end to end. Tor bootstrap is 10 to 60 seconds. The reviewed-model policy fetch is up to 60. Previous-request settlement is up to 90. Generation is 1.5 to 3.5 minutes. Observed answers of 12 to 21 KB took from 2 minutes 57 seconds to 4 minutes 15 seconds. The note’s “~3-4 min” is that table.
The timeouts in the diff are that latency, written down. Policy and catalog fetches go from 10 and 15 seconds to 60, because 10 is fine on a warm circuit and never enough on a cold Tor circuit, and a failed fetch fails closed for every model. The /v1/models deadline goes from 1 minute to 3. Verifier submit goes from 5 seconds to 30. Interrupted-lease recovery goes from 15 seconds to 60. The new script starts a throwaway Tor client, a random high SOCKS port, a throwaway data directory, and points the daemon’s existing relay URL at it. It does not use torify. The pull request says torify leaks LD_PRELOAD into the wallet companion and kills it at startup.
His own list of what is wrong is shorter. Tor is not built for request-by-request de-linking. He calls that the only form of network-layer privacy that makes sense, because long-running identifiers are too fragile. Probably not private enough, and latency 10 to 100 times higher than it could be, at the same time. The skill’s request construction is far from optimal. Qwen 3.8 Flash Next sits at 20 to 30 tokens a second. He wrote that it would only start to feel fast above 100.
What still had to leave
His last bullet is the one I keep. The more careful you are about what data you give a remote model, the less it can help you.
The notes show the bargain. Exact labs stay home, and ranges go out, because the local model wrote that typical values help. One panel becomes three questions, because the combination is the fingerprint. A country name stays home. The cuisine and the mercury table do not. The recommendations got better because a frontier model saw a question. That is the part he was willing to send.
zkAPI still does what it did on October 1. It unlinks the deposit from the prompt. It does not unread the prompt. This run adds the local rewrite, and the rewrite’s job is to decide how much of the prompt is worth the help. On the notes he posted, a textbook question about fish and an EPA dose was worth about 4 minutes and one remote call. The model was not sure the prepaid account was not the name.
If someone says the local model made the chat private, ask what the remote model was sent, and whether those sends shared a key. The screenshots answer the first question. The model did not have an answer to the second.