Cloak AI claims provable prompt privacy on Solana inference network

A project called Cloak AI launched a decentralized inference network on Solana this week, claiming it is the first to prove that prompts stay private on every run, and the debate about whether that claim can possibly hold is already running across the decentralized-AI corner of X. The one verifiable fact underneath the thread: the project has published an actual technical paper, and it is more specific than most launch-day marketing.

Key facts

• Cloak AI's X account announced the network on October 28, 2026, describing "uncensored, private, decentralized inference" built from GPUs people contribute, and drew the highest engagement on the decentralized-infrastructure beat that day (roughly 82 likes and 3,500 views in the sweep window).
• A follow-up post claims a "proof-of-private-inference" mechanism and links a paper at cloakai.xyz/paper, which resolves to a live, structured document rather than a placeholder.
• The paper reports measured numbers: on a controlled transformer and Qwen2.5-0.5B, prompt recovery from a single secret-shared activation drops from 100% to about 0.21%, near the 0.2% chance floor, while collusion of both compute parties returns recovery to 99.2%.
• The same paper states the cost plainly: private execution requires 2,171 cryptographic opens and 2.42 MiB of communication per token on a mini transformer, with the note that "private is not free, and not fast."
• All figures are project self-reports. No independent party has reproduced them, and the paper says its measurements "prove the mechanism" on test models, "not a blanket guarantee for every production request."

What's driving the conversation

The intro post from the project account is the anchor of the discourse, and the follow-up made the specific claim that spread it: a per-run proof that no node sees the prompt. Engagement in the sweep window was modest in absolute terms but at the top of the day's decentralized-infrastructure chatter. Two features of the launch shaped how it is being received. First, it is crypto-adjacent by construction: a Solana chain, token references in the project's materials, and the familiar contribute-GPUs-to-earn framing. Second, the paper's own honesty about failure modes, 99.2% recovery under collusion, obfuscation collapsing to 100% recovery on open weights, is unusual, and commenters split on whether that is a strength or an admission the core promise only holds under assumptions attackers may not respect.

The project's positioning, "uncensored" and private, puts it in the same lane as prior entries in this beat, and every one of those launches has faced the same gap between claim and demonstration.

The substance

What is verifiable today: a website, a paper, and an X presence. The paper defines a reconstruction adversary, treats prompt privacy as a measured per-run property, and reports four gates with numbers. Two of its statements are worth quoting because they cut against marketing norms. On activation obfuscation with open weights: a node holding both the public weights and the obfuscated variant "recovers the secret basis in closed form," returning recovery to roughly 100%, so the defense only works when the node does not have the base weights. On the mechanism that carries the open-weight case, additive two-party secret sharing: a single share is information-theoretically uniform, but "privacy lives in non-collusion," and the paper's receipt format discloses a collusion_recovery field of 0.992 rather than hiding it.

What is not verifiable: that the production network on cloakai.xyz implements these defenses, that receipts are emitted on real traffic, or that the economics survive the measured overhead. The paper's Gate F cost figure, 2,171 opens and 2.42 MiB per token at batch size 1, is protocol accounting on a mini transformer, and the authors say putting that byte volume on two real machines is "next on the engine." The gap between a measured mechanism on Qwen2.5-0.5B and a production network serving frontier-weight models over the open internet is exactly where prior decentralized-inference claims have thinned out. Per DeAI's standing rule, all of this remains a claim, not a fact, until someone outside the project reproduces the adversary measurement or audits the running system.

Why builders are watching

Private inference over untrusted nodes is the property the whole decentralized-inference category is judged on, and every provider in it, Morpheus included, gets measured against the same bar: show the mechanism, show the measurement, let a third party check. Cloak AI is the first project in a while to publish its failure modes alongside its wins, which raises the question the discourse is actually arguing about: whether "measured privacy under stated assumptions" is a meaningful upgrade over the usual unaudited "your prompts are encrypted" marketing, or whether the assumptions, non-colluding volunteers, honest orchestrators, are doing all the work. DeAI's prior coverage of the beat shows the pattern to compare against: on-chain providers listing Kimi K3.1 Pro same-day moved fast on distribution, and Eternal's encrypted open-weight assistant made privacy claims that stayed unverified. What would move Cloak AI from claim to fact: a published protocol third parties can run, an independent reproduction of the 0.21% recovery number, and receipts from live production traffic anyone can inspect.