Trust tiers

Every model on OGONG carries a trust tier that tells you exactly what guarantee you’re getting. The tier describes how the work is served and checked, not which company made the model.

Two guarantees, plainly

The whitepaper draws the line at two things, and they are not the same:

• Privacy: can the machine operator read your prompt and the answer?
• Correctness: can you be sure the answer really came from the model you asked for?

These are two independent axes, and OGONG offers exactly two tiers, one for each way of pinning down correctness. There is no unverified, “just trust me” tier: all supply on the network is checked one way or the other.

Confidential (TEE): verifiably private

The provider runs inside a Trusted Execution Environment and produces a hardware-signed attestation (a DCAP quote on Intel TDX, with NVIDIA Confidential Computing for the GPU). The quote proves what code and model are running and gives you an encrypted channel into the enclave. The operator of the machine cannot read your prompt or the response.

• Trust root: hardware attestation, checked by you (or a validator on your behalf), and you must check it before you send anything, which is what turns “private” into verifiably private.
• Per-reply guarantee: the enclave signs a receipt over each response, so correctness is hardware-attested for the specific answer you got; settlement won’t release on a receipt that doesn’t verify.
• The honest caveat: confidentiality is only as strong as the TEE itself. A working enclave break on the host serving your request would defeat privacy, and attestation is only as current as the platform’s security version: a valid quote on revoked or out-of-date microcode is rejected. Note the asymmetry: under a compromised minority of enclaves, network correctness still holds (it rests on the audit and the honest validator majority); it’s privacy that degrades.
• Use it for: anything sensitive. Content never leaves the enclave in the clear.

Verified: correct, but the provider can see it

This is the public-compute tier, on any GPU and no special hardware. The provider commits to its work and two independent verifiers re-check it cheaply by teacher-forcing a single pass (see How verification works). If both re-checks agree, the work is accepted and paid. This proves the answer came from the claimed model.

• Trust root: a cryptographic commitment plus an independent statistical audit.
• What kind of guarantee: probabilistic, not cryptographic. Empirically the separation between honest and cheating work is wide (a substituted model misses by ~10x), but it’s a statistical bound calibrated per hardware pair, not a worst-case proof. Keeping the honest cross-hardware drift clear of near-lossless quantization fraud is the network’s central open calibration gate, so thresholds are set conservatively. For a hard, per-reply correctness claim today, the Confidential (TEE) tier is the stronger basis.
• Encrypted in transit, but the operator can read it. The request travels end-to-end encrypted to the GPU: a Verified provider advertises an X-Wing (hybrid post-quantum) key, the client seals to it, and only the provider decapsulates, so the router, gateway, and any relay in between see only ciphertext (and your identity is stripped at the router). What this does not hide is the content from the operator of the GPU running your job: that machine decrypts and processes the plaintext, so a dishonest operator could read it. Hiding content from the operator needs a TEE, so if that’s your threat model, use Confidential.

Why no “private on commodity hardware” tier?

Transit privacy you can have on any GPU (the X-Wing seal above keeps every relay in the dark). Privacy from the operator is the part you can’t have without a TEE: on an ordinary GPU the operator can always read what the card is processing. So the Verified tier gives correctness plus transit encryption, but only the Confidential tier hides content from the machine’s operator. OGONG is honest about this rather than blurring it.

Running your own GPU

Pointing a tool at a GPU you own is a different thing from picking a network tier: there’s no third party to attest or audit, because you already trust the machine. That’s local mode: a zero-signup, no-account server you run for yourself or a friend over an encrypted tunnel. It isn’t part of the marketplace’s tier system. See Local mode.