Charles Hoskinson spent this week warning that AI models may be training on unpublished work. He is right about the risk. He is also packaging it inside a phrase โ "private AI infrastructure" โ that has no agreed technical definition. I read the statement three times looking for a single parameter: a latency budget, a proof system, a hardware assumption, a threat model. There is none. What remains is sentiment, and sentiment does not compile.
I have spent the last decade reading marketing copy against source code. Based on my audit work on privacy-preserving verifiers and gas-optimized rollups, the distance between a phrase like "private AI infrastructure" and a deployable system is usually eighteen months and one funding round. The work worth doing here is not to cheer or to jeer. It is to separate the two distinct problems Hoskinson fused into one sentence, because the fix for each runs through completely different machinery.
Context
The crypto industry has needed a narrative since the 2022 drawdown. AI is the only story left standing that both retail and institutions nod at without argument. So it is predictable, and largely rational, that a founder with a large ecosystem behind him would stake a flag in the AI privacy conversation. The Cardano stack has been searching for a native application layer that is not just DeFi forks; AI privacy is a wide-open field where no incumbent has written the standard.
But a narrative flag is not an architecture. In AI engineering, "private AI" already means at least four different things, and they are not interchangeable:
- Local inference on-device, where the model and data never leave the silicon (Apple Intelligence, Qualcomm AI Hub).
- Isolated cloud tenancy, where the workload runs on a provider's hardware inside a partitioned enclave (AWS Bedrock, Azure AI Foundry).
- Cryptographic inference, where the computation itself is hidden from the operator using TEEs, MPC, or homomorphic encryption.
- Federated learning, where gradients move but raw data stays put.
The statement does not tell us which of these it means. That is not a small omission. It is the entire engineering question.
Core
The first thing a code-first audit does is split the claim into layers, because the word "use" is doing three different jobs inside it.
Layer one is pretraining ingestion: a model scrapes text, images, or code that was never published. This is a copyright and provenance problem. It is being litigated now โ Getty against Stability, the New York Times against OpenAI and Microsoft, authors against Meta and Anthropic. The engineering response here is data lineage and retrieval provenance, not a blockchain.
Layer two is inference-time leakage: what happens when you paste your unpublished manuscript, your internal codebase, or your patient notes into a chat window. This is a data-protection problem. It produced the 2023 Samsung code-leak incident and the temporary Italian ban of ChatGPT. The engineering response here is data isolation and a kill switch on training retention.
Layer three is model memorization: an underspecified model regurgitating fragments of training data verbatim. This is measurable, and researchers have shown it is reducible but not eliminable through dedup and differential privacy during training.
Hoskinson's phrase โ "AI may use unpublished work" โ collapses all three into one emotional container. That is good rhetoric and bad specification. A privacy fix aimed at layer two does nothing for layer one, and a copyright license does nothing for layer three. Tracing the noise floor to find the alpha signal means naming which layer you are actually solving.
Now to "private AI infrastructure" as a solution shape. If it means cryptographic inference, the honest cost sheet is brutal. Homomorphic encryption for a transformer forward pass is currently three to five orders of magnitude slower than plaintext. MPC adds round-trip coordination overhead that kills anything latency-sensitive. TEEs are the only branch that is production-viable today, and TEEs are a hardware trust assumption โ you are trusting Intel SGX, AMD SEV, or Apple's Secure Enclave, not a chain. A blockchain does not remove that trust; it just adds a ledger next to it.
This is where I go from curious to skeptical. Code does not lie, but it does hide โ and the place it hides here is the coordination layer. Every decentralized-inference market I have benchmarked pays a coordination tax: matching buyers to GPUs, verifying the output, disputing bad results. That tax lands on the invoice. When I ran the numbers on equivalent workloads, the decentralized option was structurally more expensive than a reserved cloud instance for anything with a stable duty cycle. Render, Akash, io.net all have real utility in bursty, cost-tolerant jobs. Real-time private inference for an enterprise is not that job.
Contrarian
The popular framing is that blockchain is the natural home of AI privacy because it is "trustless." I think that framing is backwards. Most enterprise AI privacy requirements are about data residency, not verifiability. A bank does not need a cryptographic proof that the model did not leak a customer record. It needs a legal and physical guarantee that the record never left the jurisdiction. That is a compliance perimeter, and it is solved by a VM, a firewall, and a contract โ not by a consensus mechanism. Redundancy is the enemy of scalability, and bolting a chain onto an already-solved requirement adds redundancy without adding a capability.
The genuine wedge for verifiable compute is narrow and specific: cases where a party must prove a computation ran correctly without trusting the operator. That is real in DeFi oracles and auditable ML pipelines. It is nearly absent in the everyday corporate privacy story Hoskinson is invoking. The uncomfortable read is that "private AI infrastructure" is being used less as a technical roadmap and more as a stage marker โ a way for an ecosystem to hold narrative ground while the actual privacy work is happening inside Apple's silicon, AWS's enclaves, and OpenAI's isolation settings.
Takeaway
The next six to twelve months will settle this empirically. If Input Output or Midnight ships an AI product with a published threat model, a latency benchmark, and a named hardware assumption, the confidence I place in this analysis should rise. If instead we get more conference keynotes with the same phrase and no parameter list, then the market has its answer. Watch for the spec, not the slogan. A warning about AI privacy is only as durable as the architecture standing behind it โ and right now, that architecture is a slide.