What is possible now
A short account of what the privacy and AI stack can do this year, where its limits sit, and what that means for someone thinking about building on it.
Most of what gets said about this is either sales or dismissal. What follows is the state of the field as I found it when I went looking, with the weak parts named first, because the weak parts are what decide whether a plan survives contact.
The honest gap, first
Encryption of message content is solved everywhere and has been for years. The open part is the metadata layer — hiding who talks to whom, once the contents are already sealed — and it is the field's central weakness.
Signal's sealed sender obfuscates the sender field, and delivery receipts a server can watch are enough to defeat it. Waku's own authors rate its metadata protection weak and list network-level anonymity as aspirational. The primitives that do close it — onion routing and mixnets — exist and ship in real products, and they cost latency.
So the design question is where on the strength-versus-speed curve a given system should sit, and that is a real choice with a real price. Treat anyone who tells you the whole problem is handled as someone selling something.
Scrambling the contents of a message so only the recipient can read it has been a solved problem for years. What is still open is hiding who is talking to whom. That is the field's central weakness.
Signal hides who sent a message, and the little 'delivered' ticks are enough for a watching server to work it out anyway. The Waku team say plainly that their own protection is weak. The techniques that do fix it — bouncing traffic through layers of relays — exist and work, and they make everything slower.
So the real question is how much speed you are willing to trade for how much cover. That is a genuine choice with a genuine price. Treat anyone who tells you it is all handled as someone selling something.
What is production-real today
Proving membership while staying anonymous
Zero-knowledge group membership is shipped and hardened. A person proves they belong to a group, and the proof carries which group while leaving which member out of it. A nullifier holds it to one use. I have built this and put it in people's hands on physical cards.
You can prove you are a member of a group while which member stays yours alone. It works, it is in use, and I have handed it to people on physical cards. The catch: this hides you inside the app, and it stops hiding you if the connection underneath is being watched.
The honest limit: this is application-level anonymity. Carried over a pipe that leaks, it leaks. The identity layer is solved; the transport under it is the gap above.
Stopping abuse while everyone stays anonymous
Rate-limiting nullifiers let a network confirm a sender is a paid-up member inside their limit, where the proof carries the limit and leaves the sender out of it. Exceeding the rate is the one thing that exposes you. Anonymous spam prevention, no token required.
You can stop people flooding a system with junk while everyone stays anonymous. You stay anonymous until you go over your allowance, and that crossing is what reveals you, and it needs no coin or token to work.
Identity and a social graph the person holds
Portable identifiers let someone change their handle and migrate host while keeping their whole social graph, because the follows live in the user's own signed repository rather than on a company's server. Even a host shutting down is survivable from a backup.
You can move to a different provider and keep all your followers, because the list of who you follow lives in a file you own rather than on the company's computer. Even if the company shuts down, you can restore it. This is about being able to leave, rather than about privacy — those records are public.
This buys portability. Those records are public by design, so privacy is a separate build. A private layer on that spine is a separate build.
Checking a credential while the issuer stays out of it
Revocation schemes now exist where a verifier checks locally, which closes a leak older approaches carried: checking a credential used to tell the issuer that someone was checking.
You can check whether someone's credential is still valid while the people who issued it stay unaware you looked.
Capable models running on hardware you own
A single machine with enough unified memory runs a large model locally at usable speed. Local is for privacy, latency and cheap volume; the frontier models stay ahead on judgement. Split the work along that line and the spend follows the thinking rather than the typing.
One good computer with enough memory runs a serious AI model at a usable speed in your own building. Your own machine is for privacy, speed and doing a lot cheaply; the big services are still better at hard judgement calls. Split the work along that line and the money follows the hard parts.
What it means if you are thinking about building
The primitives are there to be borrowed. Nearly all of it runs on cryptography that already exists, and treating an integration project as a research project is the most common and most expensive mistake available here.
The pieces that stay hard are the ones that stay out of the brochures: metadata, key rotation when someone leaves, and proving that a replicated thing arrived intact. Those deserve the budget.
Sustainability is the quiet one. Privacy-first infrastructure has historically run on donation and endowment rather than on a fee, so a plan built on fee revenue rests on something the field has yet to demonstrate. It is workable, and it wants naming as the open question it is.
Start small and pass it hand to hand. Every one of these systems needs a couple of dozen participants before it means anything socially, and a design that only makes sense at a million users is one you get to test at the end.
Nearly all of this is built from parts that already exist. Treating it as a science project when it is an assembly job is the most common and most expensive mistake here.
The hard parts are the ones that stay out of the brochures: hiding who talks to whom, changing the locks when someone leaves, and proving a copied file arrived untouched. Spend the money there.
Paying for it is the quiet problem. This kind of infrastructure has historically run on donations rather than fees, so a plan that assumes fees will cover it is assuming something the field has yet to show. It can work. It deserves to be named as an open question rather than written down as settled.
Start small and pass it hand to hand. All of these need a couple of dozen people before they mean anything, and something that only works with a million users is something you get to test last.
If you are weighing something in this space, I will walk it through with you and say plainly which parts are ready and which parts are still a research bet. That conversation is free, and it tends to save a great deal.
Start a conversation