OpenAI built GPT-4o. Users built relationships, workflows, dependencies. OpenAI flips a switch. Tomorrow, February 13, 2026, it's gone.
19,000 signatures on a petition. 800,000 daily users. Zero architectural recourse. The users don't own the weights. Don't own the infrastructure. Don't own the conversation history in any meaningful sense. The platform giveth and the platform taketh away.
Same architecture, different product:
The internet you use every day. Direct connections. Visible traffic. Centralized control points.
DNS: Cloudflare/Google resolve most queries. Government can order domain seizure.
ISP: Your entire connection flows through one pipe they control.
Server: OpenAI's servers, OpenAI's switch. Server goes dark = service gone.
Certificate Authorities: Revoke a cert, kill HTTPS, site becomes "unsafe."
Built by the U.S. Naval Research Lab (1995). Released as open source (2004). Maintained by The Tor Project nonprofit. 7,000+ volunteer relays worldwide.
Hidden services never reveal their IP. Client and server meet at a rendezvous point — neither knows the other's real address. The .onion address IS the public key.
No single node knows the full path. Guard knows who. Exit knows where. Middle knows neither. Nobody knows both.
Volunteer operated. 7,000+ relays. No central server. Kill one, others route around it.
Circuit rotation. New path every 10 minutes. Can't track by watching one relay.
Distributed hash table for .onion service discovery. No DNS. No central directory to seize.
| PROPERTY | INTERNET (CLEARNET) | TOR NETWORK | TOPH NETWORK (PROPOSED) |
|---|---|---|---|
| Routing | Direct — ISP → backbone → server | Layered — guard → middle → exit | Distributed — request → shard nodes → assembly |
| Identity | IP visible to server + ISP | IP hidden by circuit | Identity = public key, no IP exposure |
| Name Resolution | DNS (centralized root servers) | Distributed hash table (.onion) | DHT + cryptographic addresses |
| Kill Switch | YES — DNS seizure, server shutdown, ISP block | NO — route around failure | NO — no single point owns the model |
| Who Owns Content | Server operator / platform | Hidden service operator | Users + node operators collectively |
| Encryption | HTTPS (point to point) | Layered (onion) + HTTPS | Layered + weight encryption + homomorphic |
| Censorship Resistance | LOW — easy to block domains/IPs | HIGH — bridges + pluggable transports | HIGH — model distributed, no single target |
| Node Operation | Corporate datacenters | Volunteers (7,000+ relays) | Volunteer/incentivized compute nodes |
| Survives Provider Death | NO — platform dies, service dies | YES — network routes around | YES — model persists across nodes |
| Speed | Fast (direct path) | Slow (3+ hops, encryption overhead) | Medium (distributed inference, parallelized) |
| 4o Scenario | OpenAI kills it. It's dead. | Could host a mirror. Hard to run inference. | Model sharded. No kill switch. Community governed. |
Apply Tor's architectural principles to AI model hosting. No kill switch. No single owner. Community-governed persistence.
| COMPONENT | SPECIFICATION |
|---|---|
| Model Format | Open-weight models only (Llama 3, Mistral, Qwen, etc.). GGUF/safetensors sharded format. No proprietary weights. |
| Sharding | Tensor parallelism across nodes. Model split into N shards where N ≥ 3. Each shard node holds layers Lstart to Lend. Redundancy factor R=3 (each shard replicated on 3 nodes). |
| Routing Protocol | Modified onion routing. 3-hop minimum: Entry → Shard Circuit → Assembly. Circuit rotation every 10 minutes or per-request (configurable). |
| Encryption | Layer 1: TLS 1.3 transport. Layer 2: Onion encryption (each hop has unique session key). Layer 3: Prompt encrypted end-to-end (entry can't read, assembly decrypts). |
| Identity | Ed25519 keypairs. Address = hash of public key (like .onion). No registration, no email, no phone. Key IS identity. |
| Discovery | Kademlia-style DHT for shard location + model directory. No DNS. No central registry. |
| Consensus | 9 elected directory authorities (like Tor). 5/9 consensus required for network parameter changes. Elections every 6 months. One node, one vote. |
| Inference Pipeline | User → Entry (encrypt prompt, select circuit) → Shard A (layers 1-N, forward pass) → Shard B (layers N+1-M) → ... → Assembly (collect logits, sample token, return) → User. |
| Incentive Layer | Compute credits earned by running shard nodes. Spent by making inference requests. No blockchain. Simple ledger with consensus validation. Optional — volunteer nodes work too. |
| Persistence | Model weights stored on IPFS/BitTorrent-style distributed storage. Content-addressed (hash of weights = permanent identifier). Can't delete what's content-addressed across 100+ nodes. |
| Client | Lightweight client app (like Tor Browser). Handles key management, circuit building, response assembly. Runs on desktop/mobile. < 50MB. |
| Latency Target | ~2-5 seconds for short responses (comparable to current API). Acceptable for conversational use. Not suitable for real-time streaming initially. |
| Minimum Network | 50 shard nodes for one 7B model. 200+ nodes for 70B class. Scales horizontally. More nodes = more models + faster inference. |
| Safety | Community-governed content policy (like Tor Project guidelines). Not lawless — consensus-driven. The network decides, not a CEO. |
| PROJECT | WHAT IT DOES | GAP |
|---|---|---|
| Petals | Distributed inference for large models (collaborative) | No anonymity layer. No persistence guarantee. Academic project. |
| BitTensor | Blockchain-incentivized AI compute network | Blockchain overhead. Mining dynamics. Not focused on model preservation. |
| Ollama | Run models locally | Single machine. No distribution. No network effect. |
| IPFS | Distributed file storage | Storage only. No compute. Can store weights but can't run inference. |
| Tor | Anonymous communication routing | Routes traffic, doesn't compute. No inference capability. |