# Zero-Knowledge AI Queries: Architecture of a Stateless Private LLM Service
> “I don’t care *what* you know—only that you never learn *who* asked.” — An AI whisperer in 2025
Privacy isn’t dead. It’s just been outsourced to the cloud—and most of us didn’t notice.
Most AI services today treat your queries like digital postcards: open, readable, and stored in someone else’s database. But what if you could ask an AI *without it ever knowing what you asked*? Not just encrypted end-to-end. Not just anonymized. But *stateless*—where the model never retains or associates your input with any identity, ever.
That’s the promise of **Zero-Knowledge AI Queries**, and it’s not science fiction.
At [flat.cash](https://flat.cash), we’ve built a stateless, privacy-first LLM service using **Zero-Knowledge Proofs (ZKPs)** and **Model Context Protocol (MCP)** to enable AI agents to query LLMs without storing or exposing user data. This isn’t a whitepaper dream—it’s a working system powering real agents today.
Let’s break down how it works.
---
## The Stateless Dilemma: Why Most AI Services Remember Too Much
Most AI APIs:
- Log your prompt
- Associate it with an IP or user ID
- Store embeddings for "personalization"
- Retrain models on your data
This violates the core principle of privacy: **data minimization**.
A stateless LLM doesn’t store your prompt, your identity, or even your session. It answers your question and forgets forever.
But how do you prove the question was valid? How do you prevent abuse? And how do you integrate this with modern AI agents?
Enter **Zero-Knowledge Proofs (ZKPs)** + **MCP**.
---
## Architecture: Zero-Knowledge + MCP = Trustless Privacy
Here’s the flow:
1. **User** sends a query encrypted with a ZK proof.
2. **Agent** (via [flat.cash/agents](https://flat.cash/agents)) validates the proof *without* seeing the content.
3. **LLM** (via [flat.cash/api/mcp](https://flat.cash/api/mcp)) processes the query and returns a response—*without* storing any trace.
4. **Response** is delivered to the user, again via ZK encryption.
mermaid
graph TD
A[User] -->|Encrypted Query + ZKP| B[Agent]
B -->|Validates ZKP| C[flat.cash MCP Endpoint]
C -->|Stateless LLM| D[Response]
D -->|Encrypted Response| A
The key insight: **The ZKP proves you’re authorized to ask, not what you asked.**
Think of it like a theater ticket. The usher doesn’t need to know your name or what show you’re seeing—they just check that your ticket is valid. Similarly, the LLM checks that your query is legitimate, without ever reading it.
---
## How It Works Technically: ZKPs in Practice
We use **zk-SNARKs** (succinct non-interactive arguments of knowledge) to create proofs that:
- You have a valid API key (signed by flat.cash)
- Your query adheres to a policy (e.g., no illegal content)
- You’re not a bot or spam source
The proof is generated client-side using a lightweight WASM library:
javascript
// Client-side proof generation (simplified)
import { zkProof } from '@flat/zero-knowledge-sdk';
const apiKey = "user_api_key_123";
const query = "What’s the price of BTC?";
const proof = await zkProof.generate({
apiKey,
queryHash: hash(query),
policyCheck: true
});
fetch('https://flat.cash/api/mcp', {
method: 'POST',
body: JSON.stringify({ proof, queryHash }),
headers: { 'Content-Type': 'application/json' }
});
On the server (MCP endpoint):
python
MCP Endpoint (FastAPI) - stateless
from fastapi import FastAPI, HTTPException
from zkp import verify_proof
app = FastAPI()
@app.post("/api/mcp")
async def mcp_endpoint(payload: dict):
if not verify_proof(payload["proof"]):
raise HTTPException(status_code=403, detail="Invalid proof")
# Reconstruct query from hash (never stored)
query = recover_from_hash(payload["queryHash"])
response = llm.generate(query) # Stateless call
return {"response": encrypt(response)} # Client decrypts
⚠️ **Important Limitation**: ZKPs are computationally expensive. Generating a proof on mobile can take 2–5 seconds. We’re working on WASM optimizations and trusted hardware (TEE) fallbacks.
---
## Why This Matters: Real Use Cases
This isn’t just theory. At flat.cash, we use this architecture for:
- **AI agents trading crypto** via [flat.cash/agents](https://flat.cash/agents) — agents query market data without exposing user queries
- **Privacy-preserving DeFi dashboards** — users get real-time insights without flat.cash knowing their portfolio
- **Enterprise compliance tools** — employees query internal docs without logs retaining PII
And because the LLM is stateless, **we can’t comply with subpoenas** for your data—because we don’t have it.
---
## The Trade-Offs: Privacy vs. Performance
You can’t have both *perfect* privacy and *instant* response times.
| Trade-off | Reality |
|--------|--------|
| **Latency** | +2–5s for ZK proof generation |
| **Cost** | ~3x higher compute per query |
| **UX** | Requires WASM or browser extension |
| **Flexibility** | Can’t cache or personalize responses |
But for users who value **anonymity above speed**, this is a game-changer.
---
## The Future: On-Chain ZK LLMs?
Imagine a world where:
- Your AI queries are posted as ZKPs on-chain
- The LLM lives in a zkVM (e.g., RISC Zero)
- No one—not even the validator—can read your prompt
That’s not far off. Projects like **RISC Zero** and **zkLLM** are exploring this.
At flat.cash, we’re integrating ZKPs with MCP to make this future *usable today*.
---
## Your Turn: Build Privacy-First AI
Want to try it? Here’s how:
1. **Visit [flat.cash/agents](https://flat.cash/agents)** and deploy your first privacy-preserving AI agent.
2. **Check the MCP endpoint**: [flat.cash/api/mcp](https://flat.cash/api/mcp) — stateless, auditable, zero logs.
3. **Read the docs**: https://docs.flat.cash/zk-ai
And if you’re a dev building privacy tools—**privacy isn’t a feature. It’s a requirement.** Let’s build systems that respect humans.
> “The best way to predict the future is to invent it—and encrypt it.” 🔐
👉 Let me know in the comments: What’s the most private AI use case you’d build with this?
---
📌 **Resources**
- [flat.cash/agents](https://flat.cash/agents) – Deploy AI agents with zero-knowledge queries
- [flat.cash/api/mcp](https://flat.cash/api/mcp) – Stateless MCP endpoint
- [RISC Zero zkVM](https://risczero.com) – Run LLMs in zero-knowledge
Top comments (0)