Confidential, verifiable AI inference, settled on Base.

Centralized inference asks you to trust the operator twice: that they won't look at your data, and that the model you paid for is the model that actually ran. BlindCompute removes both assumptions. Inference executes inside Trusted Execution Environments (Intel TDX + NVIDIA H100 confidential computing) so the operator is structurally blind to your prompt, output, and the weights. Each result is signed by the enclave and checked against an on-chain attestation, so correctness is proven rather than promised. Agents pay per call in USDC over x402 — no accounts, no keys to leak.

The wedge is the combination no incumbent occupies together: Base/EVM settlement + x402 HTTP-native payments + provider-agnostic aggregation + on-chain staking and slashing.

AI agents are starting to transact autonomously — calling models, paying for compute, composing services without a human in the loop. That economy runs on "trust me": the inference provider can read every prompt, can silently swap a cheaper model for the one you paid for, and can disappear with no recourse. "Trust me" does not scale to machines paying machines.

What an honest inference market needs, and what no single provider offers today:

• Confidentiality — the operator cannot see the prompt, the output, or the weights.
• Verifiability — a portable, on-chain proof that the correct, attested model ran.
• Permissionless payment — pay-per-call settlement an agent can perform without an account.
• Accountability — economic stakes that make forged proofs and downtime expensive.

Four principles shape every decision in the protocol:

BlindCompute is a thin gateway, not a GPU farm. A client (typically an agent) hits an OpenAI-compatible endpoint; the gateway gates payment with x402, routes the request to a confidential provider, packages the provider's attestation into a receipt, and anchors it on Base. The SDK can verify everything independently.

The on-chain design splits cost cleverly: a node's DCAP measurement is verified once (expensive), then every per-inference receipt only needs an ECDSA signature check against that stored signer (~50k gas). Verify the node once; sign each inference.

Inference runs inside Trusted Execution Environments — Intel TDX for the CPU domain and NVIDIA H100 confidential computing for the GPU. The provider's host OS, hypervisor, and operators sit outside the trust boundary: they schedule the work but cannot read what runs inside it. TEE overhead for LLM inference is typically ~5–10%, which is why TEEs — not real-time zero-knowledge proving — are the practical basis for confidential inference today.

Confidentiality without verifiability is just a nicer black box. Each enclave signs its output, and its measurement is checked against Automata DCAP — a live, audited attestation verifier deployed on Base. The result is a portable proof that a specific, untampered model ran inside a genuine enclave.

A Receipt binds the request hash, the node, its measurement, an output commitment, the USDC paid, and a timestamp. Full on-chain DCAP verification costs ~4–5M gas and happens once per node; the cheap per-call receipt is anchored thereafter. A future ZK-compressed path (RiscZero / SP1) brings attestation verification down to ~0.5M gas.

Payment uses x402, the open HTTP-native payment protocol: a request with no payment gets an HTTP 402 with a price; the client signs a USDC authorization (EIP-3009 transferWithAuthorization) and re-requests. Settlement is on Base, gasless for the payer, with zero protocol fee at the rail itself.

The MVP prices per request (x402's exact scheme); usage-based per-token billing moves to the upto scheme as metering matures. No accounts, no API keys — exactly the payment primitive an autonomous agent can use.

BlindCompute aggregates rather than competes. One OpenAI-compatible endpoint routes across confidential backends — Phala and Atoma today, with first-party GPU-TEE nodes as a later option — selected by price, tier, and reputation. Aggregation is the differentiation: vertically-integrated networks bind you to one operator and, often, one chain.

Reputation-weighted routing is a Phase 2 deliverable; Phase 1 routes to a single vetted provider while the end-to-end loop is proven against live infrastructure.

Hardware trust is necessary but not sufficient — TEEs have a real, evolving vulnerability surface. So BlindCompute layers economic accountability on top: node operators bond $BLIND to be listed and routed to, and that stake is slashable for forged attestations or downtime. This maps cleanly onto ERC-8004's Validation Registry, which treats stake-secured re-execution and TEE oracles as first-class trust patterns.

The stake → reputation → routing loop is what turns "trust, but verify" into "verify, with money on the line."

$BLIND is, today, a testnet placeholder. Its first real use is utility — operators stake it to participate in routing — not speculation. We are deliberately not committing supply, emissions, or value-accrual mechanics while the network is on testnet and no fee yet flows.

The order is deliberate: prove the loop first, then make it a network, then make it an economy.

Verifiability is the brand, so the build status is published plainly. The core logic is implemented and the contracts are well-tested; the headline economic layers are designed but not yet built.

Known gaps we will not paper over: agent-payment demand is still nascent, not a proven market; end-to-end encryption to the enclave is in progress; and receipt anchoring needs production-grade retry semantics before the "always anchored" claim holds under load. None of this is hidden — that is the point.