Overview
PARANOID lets you use an AI model without the model, the gateway in front of it, or anyone watching the chain learning who sent a request. You deposit 
USDC once into a 
Solana program. After that, every request you send carries a zero-knowledge proof that says "some paid-up member is spending one of its own request slots for this epoch". The gateway checks the proof, forwards the prompt and answers. It never learns which member asked, and two of your requests cannot be linked to each other.
The design is zkAPI, released on 1 October 2026 by the 
Ethereum Foundation and the Open Anonymity Project from a design by Vitalik Buterin and Davide Crapis (February 2026). On 16 October 2026 Buterin described his own "paranoid mode" built on it: zkAPI payments, a 
Tor circuit per conversation, random cover traffic and local prompt rewriting. PARANOID brings the same idea to Solana and puts it behind one 
OpenAI-compatible endpoint.
What you get
| You do | What happens |
|---|---|
| Deposit USDC for some number of epochs | A commitment to your secret joins the member tree. Your wallet is public and linked to that commitment, but never to a request. |
| Paste one endpoint and key into the AI app you already use | Every call carries a proof of membership and spends one slot of your per-epoch allowance. |
| Ask anything | The gateway sees the prompt and the proof. It does not see your wallet, your commitment or your other requests. |
| Spend the same slot twice | Two points of the same line reach the gateway, your secret can be recovered, and anyone can slash your unspent balance. |
| Leave | You stop after the current epoch and take back every epoch you did not reach, after a short slashing window. |
The pieces
- The program (Anchor, Solana): holds the USDC, keeps the Poseidon Merkle tree of members and the recent roots, bills members by time, accepts slashes, and runs a permissionless burn crank.
- The circuit (Circom, Groth16 over BN254):
Request(20, 4), a tree of depth 20 (about one million members over the vault's life) and up to four slots per proof. - The client: makes your secret, your commitment and your proofs on your own device. The secret never leaves it.
- The gateway: an OpenAI-compatible HTTP endpoint that verifies proofs against roots read from the chain, forwards the prompt, and keeps no IP or identity logs. Anyone can run one.
Status
Pre-launch. The program is not deployed on mainnet, there is no token, and the app runs in preview: every screen works, and the buttons that would send a transaction read "Opens at launch".
Next: Architecture