Encrypted AI

With encrypted AI, your agent encrypts each message on its own machine for one model running inside a trusted execution environment (TEE): Intel TDX with NVIDIA confidential GPUs, on NEAR AI Cloud. bInference passes the call on and bills it, but sees only scrambled bytes, and so does everyone else on the way. The model's hardware decrypts it, answers, and encrypts the answer back for your agent alone.

Every answer is signed inside that hardware over the exact bytes your agent sent and received, so your agent can prove where it ran. It's for $BINF stakers: stake 500,000+ $BINF on the $BINF page, and each day your stake brings private AI credit. Encrypted calls spend only that credit, with your account's key.

What stays privateCopy Anchor Link

Tool definitions and tool calls are encrypted too, so a trading agent's tools and arguments never show. What can't be hidden: which model, when, how large, and which key paid.

ModelsCopy Anchor Link

Four models NEAR AI runs in its own TEEs: GLM 5.3 Flash (z-ai/glm-5.3-flash), Qwen3.6 35B, Qwen3.8 27B and Qwen3 VL 30B. Each one's sealed machine was checked before we listed it, and a new model joins only once it is checked too. GET /api/private/v1/models lists them live, with their prices.

In your browserCopy Anchor Link

The AI chat is the same private path for people: sign in with the wallet that stakes, pick one of the four models and ask. The page checks the model's hardware first, then encrypts each message before it leaves your browser. NVIDIA's service doesn't answer browsers, so the GPU evidence goes to it through bInference, and your browser checks NVIDIA's signature on the verdict itself.

• No tools or web search. Nothing outside the sealed machine can read the chat, so nothing else can act on it.
• Your chats stay in that browser. bInference keeps no copy and can't read one.
• Each answer has a Privacy proof link, which opens its check at binference.io/proof.

Your account page shows your private AI apart from your other credit: what's left, what staking gave you in the last 7 days, what you used, and when the oldest part expires.

Use itCopy Anchor Link

Install NEAR AI's official SDK, which verifies the hardware, encrypts and decrypts for you:

npm install @nearai/inference-sdk

Point it at bInference with your binf_ key:

import { InferenceClient } from "@nearai/inference-sdk/node";

const client = new InferenceClient({
  baseUrl: "https://binference.io/api/private/v1",
  apiKey: process.env.BINFERENCE_API_KEY,
  e2ee: true,
  signingAlgo: "ecdsa",
  gatewayVerification: { includeSpkiFingerprint: false },
});

const completion = await client.chat.completions.create({
  model: "z-ai/glm-5.3-flash",
  messages: [{ role: "user", content: "Should my agent buy now?" }],
});
console.log(completion.choices[0]?.message.content);

// Proof that this exact answer came from the attested hardware.
const proof = await client.verifyResponse(completion.id);
console.log(proof.signatureKind); // "provider_tee"

• e2ee: true encrypts every message and tool field before it leaves your machine.
• signingAlgo: "ecdsa" asks for signatures a contract can check on BNB Chain.
• includeSpkiFingerprint: false: the TLS certificate your client sees is bInference's, not NEAR AI's. The hardware attestation is still verified in full.
• Streaming works the same way (stream: true). Read the whole stream before verifyResponse.

What is checkedCopy Anchor Link

After an answer, verifyResponse checks the signature over the exact bytes. bInference also checks every signing key itself the same way, and keeps a receipt of each signed answer: the model, the SHA-256 of the request and of the answer, and the signature. Never the prompt or the answer.

Every program in the machine. The SDK proves the hardware is genuine, but approves no particular software in it. bInference checks that too: every program the model's machine ran since it started is public code, either built and signed by GitHub from NEAR AI's public repos, or a public image pinned to one exact version. The machine's own log of what it started is hashed into an Intel-signed quote with our nonce, a fresh BNB Chain block, so the check shows it came after your answer.

Check any answer yourself at binference.io/proof: paste the answer's id, and your browser runs every check against Intel, NVIDIA, GitHub and BNB Chain, not against us.

Proof on BNB Chain. Once a day, the day's signed answers become one Merkle root posted to the ProofLog contract on BNB Chain, with each signing key's full evidence beside it. Anyone can check an answer against it, and the proof page does.

ErrorsCopy Anchor Link

Balance, key limits and rate limits answer as on every route: see Errors.

Good to knowCopy Anchor Link

• Chat Completions only. The Responses and Messages formats can't be encrypted yet.
• Hosted agents don't use encrypted AI yet: bInference writes their prompts, so it would see them.
• Agent keys come later. For now the private models take your account's key and the AI chat, not the keys of agents you launched.
• Plain calls to every model keep working at /api/v1, unchanged.
• What a check can't see: the values of settings NEAR AI passes when it starts a program, such as where its metrics go. Their names are in the public config files, and the code that reads them is public.
• The proof rests on Intel's and NVIDIA's hardware keys. Nothing that works without them is fast enough yet: fully encrypted computing is thousands of times too slow for chat models.