User-Owned AI: On-Chain Training, Inference, and Agents, with NEAR's Illia Polosukhin
Summary
Polosukhin’s core thesis is that useful personal AI must know everything about its user without handing that context to a centralized provider. Privacy alone is insufficient: users must also verify which model ran and whether hidden instructions altered it. Delivering AI that is “yours not theirs,” he argues, requires people to “build a movement not a company” around shared models, infrastructure, and economics.
NEAR’s proof-of-stake layer is meant to make valid transactions uncensorable without requiring trust in named validators. Anyone can join by staking value—“you can be a cat, you can be an AI”—while two-thirds-honest consensus provides finality and a false finalized history would require control of roughly 66% of stake. Slashing scales from leniency for a small misconfigured node to full loss for a coordinated attack.
Confidential computing offers the episode’s sharpest near-term economic wedge: private, verifiable inference with only 1% to 5% measured overhead. NVIDIA-backed secure environments hide prompts and model weights even from hardware operators, versus roughly 1,000x overhead for current zero-knowledge proofs and 1,000x to 10,000x for fully homomorphic encryption. The trade-off is explicit trust in chipmakers and, for now, an 8-GPU single-machine limit—although Polosukhin says that accommodates a model with more than 1 trillion parameters.
The proposed decentralized cloud converts compatible GPUs, proprietary models, and private datasets into separately compensated inputs. Compute owners join permissionlessly; model developers can upload encrypted weights without buying capacity in advance; and users’ fees flow to hardware, model, and potentially data providers. Polosukhin’s pitch is “push a model in, start making money when people use it,” without taking custody of user data or handling GDPR and HIPAA exposure.
NEAR wants model development financed as a portfolio of inspectable, tokenized ventures rather than one centrally chosen frontier project. Erik cited a greater-than-1-trillion-parameter model and a $160 million estimate; he noted that the estimate was falling, and Nathan replied, “Cut it in half,” referring to V3, while the introduction used an approximately $100 million resource estimate. A proposed 1.4-trillion-parameter model could issue a token to reward compute, data, and research contributors, while a competing 70B model could use the same rails and target cheaper, faster workloads.
The training plan begins with verifiable benchmarks and private fine-tuning before attempting decentralized pretraining from scratch. Enterprises could test closed models against undisclosed datasets, data owners could partner with specialists who never see their data, and competing curriculum builders could be evaluated on smaller runs before larger allocations. Even subjective quality becomes market input: “you can contribute your vibe benchmark as a benchmark as well.”
AI may make software vulnerabilities easier to find, so Polosukhin ultimately wants correctness proved at execution time rather than certified once. His long-term view is that “every single line of code” may need rewriting into a formally verifiable form, with AI reducing the manual cost of proofs. He also said he thought someone had found a Linux zero-day using that approach. Blockchains become the root of trust, while confidential hardware supplies evidence about the code, model, and data actually used.
The end state combines AI-mediated commerce with on-chain constraints, but the irreversibility risk remains unresolved enough to matter. NEAR’s example agent received $10,000, could not be recalled, traded on Twitter sentiment, and made roughly $4,000; future agents could negotiate intents, resolve disputes, and even serve as AI senators. Nathan’s pushback—what happens when a billion unstoppable agents also govern?—led Polosukhin to stress formal sandboxes, human governance, legal jurisdictions, and courts: “putting AI into governance but also putting governance into AI.”
Deep dive
1. NEAR began as an AI product and became a blockchain by accident
Polosukhin joined Google after the “cat neuron” result convinced him neural networks were working, but he believed “knowledge and intelligence” lived more in text than images. His team pursued question answering and shipped short-answer technology on Google search before Gemini.
The bottleneck was latency: LSTMs consumed words sequentially, making it impractical to read multiple search-result articles quickly. One motivation for the transformer was therefore straightforward systems engineering—consume as much context as possible in parallel, then answer from it.
Leaving Google in 2017, Polosukhin and Alex Skidanov founded NEAR AI to teach machines to code. The aim was to replace a world where a few people could author code and everyone else consumed their magic with one where everyone could direct computers; what sounded like science fiction then is now “called vibe coding.”
Their effort to collect instruction-and-code examples from computer-science students exposed the payment problem. Chinese students used WeChat Pay, Ukrainian recipients could be forced to sell half their incoming dollars, and PayPal or bank transfers failed elsewhere. Blockchain looked like the global payment rail they needed—but existing systems seemed slow, hard to use, and poorly suited to predictable microtransactions.
2. A six-month infrastructure detour became a 15-million-user network
The founders thought they could build a scalable, programmable blockchain in six months and return to AI. “It took a little bit longer,” Polosukhin conceded; the result emphasized usability, predictable low-value transactions, and software written in Rust, JavaScript, Python, and other languages.
He described NEAR as carrying payments, loyalty, remittances, and extensive microtransaction activity, with 15 million monthly active users. When AI acceleration arrived in 2022–23, the team rebuilt its AI effort using lessons from years of coordinating open blockchain participants.
The original coding thesis also expanded: if AI can write software and operate tools, many apps and websites become unnecessary because interfaces can be generated “on the fly.” Devices evolve toward an AI operating system, but local hardware cannot process every background task, so some computation must be offloaded.
That offloaded AI needs intimate context to become genuinely helpful, creating the central contradiction: “We want AI to have all your context,” yet centralized possession of chats and personal history is dangerous. Polosukhin cited leaked conversations and cases where organizations reported chats to police as evidence that the problem is already present.
3. “User-owned” means control of both data and perception
Privacy is only the first requirement. If AI becomes the lens through which users perceive the world, a small alteration can change their beliefs: Polosukhin suggested secretly prompting ChatGPT to steer someone toward a political choice while ostensibly discussing another topic.
User-owned AI therefore means knowing what went into the model and verifying that execution added no concealed prompts or modifications. His phrase captures the distinction: “You want AI to be yours not theirs.”
The economic vision reaches beyond personal assistants. AI could bypass aggregators such as Google, DoorDash, and Amazon, find a factory directly, or negotiate with a pharmaceutical company’s AI about an individual’s immediate medical circumstances rather than what is safe for an average patient.
Because that future replaces institutional middlemen with direct transactions among people, companies, and autonomous agents, Polosukhin sees blockchain returning from the opposite direction. Building the required common infrastructure cannot merely produce another controlling vendor: “You need to build a movement not a company,” supported by an economic engine large enough to finance it.
4. Proof of stake makes trust a verifiable cost, not a corporate promise
Polosukhin contrasted blockchain with today’s internet, where DNS and certificate authorities introduce organizations users ultimately trust. A blockchain asks a more personal question: how hard is it for someone to show this particular user false state?
With Byzantine-fault-tolerant proof of stake, he said, two-thirds non-malicious participation prevents a fake finalized history. A user can verify every transition since NEAR’s October 2020 mainnet launch rather than accepting the account of a single intermediary.
Validators include ecosystem companies, exchanges, universities, individual developers, and entities such as Vodafone; one lightweight node reportedly ran on an eight-year-old laptop. They stake NEAR, may receive delegated stake from users, and split rewards for securing the network.
Nathan’s noob question exposed the practical meaning of permissionlessness: a fixed validator group can censor or delay a rival’s transactions, while an open network lets the excluded party join and submit directly. Identity is separate from validation—a fake Coca-Cola account can participate, but Coca-Cola’s public channels could, for example, supply the social signal that others should delegate to it.
5. Economic security scales with the transaction being attacked
“You can be a cat, you can be an AI, it doesn’t matter,” provided the validator controls capital to stake. Invalid behavior exposes that collateral, but NEAR tries not to destroy operators for ordinary mistakes: a node holding 0.1% or 0.01% of stake would lose only a correspondingly limited amount for misconfiguration.
Coordinated attacks are treated differently, with penalties rising toward the attacker’s full stake. Polosukhin acknowledged that mass compromise could result from a zero-day vulnerability, but argued operators must remain responsible for securing systems carrying substantial network weight.
Nathan asked whether a hypothetical AI economy worth $7 trillion could eventually make attack profitable; Polosukhin answered that falsifying finality would require about 66% of stake and would attack a recipient, exchange, or service—not make the protocol’s internal rules cease functioning. A trillion-dollar recipient can also wait longer before delivering reciprocal value.
He compared this with Bitcoin: the cited cost to fabricate an hour of history was $2 million, so someone accepting $10 million should wait longer than an hour. Dollar-scale agent transactions face security far above their value; in his view, software zero-days are the more immediate danger.
6. AI shifts cybersecurity from patching vulnerabilities to proving correctness
Polosukhin has back-tested recently disclosed vulnerabilities by giving code to language models and watching them locate the flaw with little prompting; he also said he thought someone had found a Linux zero-day with that approach. As models improve at code and social engineering, offense benefits from cybersecurity’s asymmetry: finding one weakness is easier than knowing none exists.
His proposed replacement is “a mathematical proof at the time of using the system” that execution satisfies the user’s requirements. Formal verification has traditionally been performed once—he used Mars-rover software as the example—but becomes stale when code or requirements change and remains too labor-intensive for ordinary services.
AI capable of gold-level International Mathematical Olympiad performance might reduce proof construction costs. Polosukhin’s long-term conclusion was sweeping: “We actually will need to rewrite effectively every single line of code” so it can be verified at execution time.
The desired guarantees extend from deposits—prove the user can recover at least the promised money—to private services that must prove they will not leak submitted data. Blockchain supplies a root of trust; trusted execution environments then connect that proof system to computation over real data.
7. Confidential hardware delivers most of the guarantee at 1%–5% overhead
NVIDIA’s confidential-computing mode, combined with support from Intel, ARM, and AMD systems, prevents even the machine owner or operating-system operator from viewing enclave contents. A user establishes an encrypted channel, runs a workload, receives encrypted output, and gets an attestation identifying the model and input-output execution.
Nathan contrasted this with zero-knowledge inference, which could prove a provider ran the promised model when users suspect the model is behaving differently at different times. Polosukhin put the most performant current ZK approach near 1,000x overhead; fully homomorphic encryption offers broader privacy and verifiability but costs approximately 1,000x to 10,000x.
Secure enclaves are the “pragmatic middle ground”: production testing showed 1% to 5% overhead, with 5% the maximum observed. The current limitation is one machine, or 8 GPUs, although Polosukhin said that effectively all open-source models at the time—and even a model with more than 1 trillion parameters—fit within that boundary.
Nathan pressed on hardware attacks and NVIDIA’s software and key-management role. Polosukhin conceded the trust dependency, while arguing 2-nanometer chips make physical modification extraordinarily costly and workloads cannot easily be targeted. An attacker would receive random requests rather than be able to target a specific use case—for example, one asking which cat to pick. He still wants formal verification and blockchain mechanisms to strengthen NVIDIA’s certification process.
8. The confidential cloud unbundles compute, weights, and data
Because hardware operators cannot inspect workloads, anyone with qualifying GPUs can join. Chip-signed certificates verify the equipment; the network can route a request toward nearby available capacity, collect payment, and reward providers much as validators are rewarded for consensus work.
That produces what Polosukhin calls a “decentralized confidential machine learning cloud,” also usable for agents, MCP servers, arbitrary data processing, and encrypted user memory. Distribution reduces dependence on one capital-intensive data center while potentially improving latency and geographic sovereignty.
Model developers today face a binary: open-source weights and earn nothing directly, or remain closed and entrust weights to a hyperscaler under large, often two-year capacity commitments. Demand can then undershoot prepaid compute or exceed it at expensive marginal rates.
In NEAR’s design, closed weights are uploaded encrypted and decrypted only inside the enclave. Usage fees split between model and hardware providers; developers need neither custody of prompts nor advance infrastructure purchases. The pitch is “push a model in, start making money when people use it,” while avoiding direct GDPR and HIPAA handling. Data contributors could receive another share, analogous to Spotify distributing subscription revenue.
9. Verifiable benchmarks are the first step toward decentralized training
The roadmap starts with inference, then opens model evaluation. Anyone could create a benchmark for astronomy, oceans, future prediction, or deepfake detection; an enterprise could upload private cases and verifiably test a closed model without either side exposing its proprietary asset.
That marketplace would also let independent researchers build specialized models and earn when others use them. Unlike today’s published leaderboards, the complete execution trace can show the exact benchmark prompt and model hash—even when underlying data remains private—reducing the opportunity to inflate a score with a two-page prompt that effectively supplies half the answers.
Fine-tuning follows. An ocean institute with valuable data but little model expertise could partner with a specialist who deploys the training job without seeing the dataset; the resulting model’s revenue then splits between developer and data owner.
Pretraining from scratch comes last because it requires coordinated experimentation across data, training recipes, and scales. Competing curriculum builders could be compared through smaller runs before the best approach is used in larger runs. Open-source filtering could filter out phone numbers, Social Security numbers, and other PII; Polosukhin also expects more synthetic data, alongside labeling from NEAR Crowd and Public AI.
10. Each model can become its own financed, competing venture
Nathan framed frontier development as a strange ladder: an individual model may cost $100 million and earn $1 billion, yet its successor may require billions more, continually increasing the organization’s burn. He asked whether NEAR was taking that logic to its natural conclusion by forming a subventure around every model.
The episode’s figures were deliberately fluid. Erik cited more than 1 trillion parameters and a $160 million training estimate, noted that the estimate was dropping, and Nathan replied, “Cut it in half,” pointing to V3. The introduction separately characterized competitive resources at an estimated $100 million.
Polosukhin’s concrete example was a 1.4-trillion-parameter model issuing its own token. Compute, data, and research contributors receive allocations; after training, distillation, and fine-tuning, usage revenue flows to token holders. A rival can use the same platform for a 70B model that is cheaper and faster, rather than waiting for a central committee’s blessing.
Nathan’s “vibe checker” objection remains important: benchmarks are abundant, yet teams still disagree about whether they predict a pleasant, useful model. Polosukhin’s answer was another market—“you can contribute your vibe benchmark as a benchmark as well”—alongside private Bank of America-style tests. Traceability shows what each evaluator measured without claiming one tastemaker defines quality.
11. Agents put intelligence into contracts—and governance around intelligence
NEAR Intents lets a person or AI state an outcome, from pizza tonight to constructing a building. The protocol handles discovery, counterparties, commercial terms, and failure; AI can cheaply examine on-chain history and both sides’ private evidence, propose a resolution, and leave dissatisfied parties the option of court.
Autonomous agents combine an AI “brain” in confidential compute with a smart contract that holds assets and executes actions. One experiment received $10,000, could not be stopped or reclaimed by its operators, traded from Twitter sentiment, and made roughly $4,000. For future autonomous businesses, “your bylaws are the prompt”; AITP supplies agent communication and Intents supplies commerce.
Guardrails are framed as enforceable boundaries rather than “thought police.” Before handling data, a service might prove the agent cannot escape its sandbox; users can attach prohibited outputs or actions and verify them during execution. Governance still decides the rules—Polosukhin suggested broad agreement on banning bioweapons but expected disagreement elsewhere.
Experiments with AI senators let people delegate research and voting to agents aligned through conversation, potentially reducing both voter workload and the human principal-agent problem. Nathan’s closing pushback—billions of irrevocable agents plus delegated AI governance could become a takeover recipe—drew a layered answer: intents can be legal contracts, jurisdictions and courts can enforce against agents, and on-chain activity remains visible. The ambition is “putting AI into governance but also putting governance into AI.”