Signal founders built a chatbot that can’t monitor you

welcome home in the loopTIME’s new twice-weekly newsletter on AI. If you’re reading this in your browser, why not subscribe to get the next article delivered straight to your inbox?

What you need to know: Signal founders are working on an encrypted chatbot

Moxie Marlinspike, the cryptographic genius who wrote the code behind Signal and WhatsApp, is working on a new project that could be one of the most important things happening in AI right now.

The tool, named Confer, is an end-to-end encrypted AI assistant. Using smart computation, we ensure that even though the compute-intensive processes that run your AI still occur on servers in the cloud, only you, the user, has access to the unscrambled details of that computation.

A new paradigm — It’s a complete break from the current way of doing things. If you interact with an existing chatbot, your data will not be kept private unless you have a powerful computer running an open source AI system. This is especially true for the most useful models, which are heavily guarded by AI companies but are anyway too large to run on your local machine. While it may feel as intimate as a private chat, the reality is quite different. Marlinspike wrote that while users appear to be conversing with the Assistant, “Honest Expression” will be more like a group chat with “executives and employees, their business partners and service providers, hackers who compromise that plaintext data, future advertisers that will almost certainly appear, and lawyers and governments who subpoena access.”

Anti-surveillance — That data is a potential goldmine for AI companies looking to generate profitable returns from the capital expenditures of building cutting-edge AI systems. AI chat logs reveal how you think, Marlinspike claims. They may therefore be the key to more powerful and manipulative forms of advertising, which are inevitably coming soon. “It would be like someone paying a therapist to convince you of something,” Marlinspike wrote.

Safety impact — A persistent criticism of Signal is that encryption allows malicious users to escape the consequences of their actions. The same applies to encrypted LLMs. But that problem has already been solved. Open source models can be run locally. What’s even more dangerous is that the guardrails can be tweaked and moved away. Confer does not have this problem because users do not have access to the weights of the underlying model. So that private reasoning paradigm actually appears to be a new kind of middle ground. In other words, it combines the privacy protection of open-source models with the ability to protect model weights that was previously only possible with closed-source, easily monitored AI. That may be a benefit, not a loss, for AI safety.

Impact on the ecosystem — For me, one of the most interesting things to think about here is how Confer will impact the broader AI industry. Marlinspike’s key victory with the Signal protocol is probably not the creation of Signal (although it is an important app that I use every day). It was the fact that WhatsApp later used Signal’s code to encrypt the chats of billions of users, extending its impact more broadly. Certainly, I don’t see Google, OpenAI, or Anthropic encrypting user chats end-to-end any time soon. To do so would be directly against their business interests. But by offering a privacy-respecting alternative, Confer could undermine companies’ business models that aren’t user-friendly. (A kind of “race to the top” to steal the line from Anthropic.) With the advent of frontier AI, the balance of power between users and companies has tilted heavily in favor of Big Tech. Conferment may indicate that a trend is not as inevitable as it seems.

Will it work? — Having used Confer for a while, my main criticism is that the free version’s basic model lacks the sparkle of my current favorite model. Marlinspike has not disclosed the AI ​​model that powers the app. In a Signal message, Marlinspike said Confer uses different open source models for different tasks. “My hope is that just as Signal doesn’t put the burden of model selection on people, we also take the burden off of people with model selection and consideration. [cryptographic] Even so, the output contains many of the hallmarks of the initial ChatGPT response. For example, the formulation “It’s not X, it’s Y.” Confer’s paid tier is more expensive than its competitors at $34.99 per month, but its website says it uses “advanced AI models” and offers the ability to personalize how it responds. There’s certainly room for improvement, but it’s version 1 of the product and a great feature suite.

Who you should know: Google CEO Sundar Pichai

Google on Monday became the fourth company in history to reach a valuation of $4 trillion. It’s the latest milestone in a relentless comeback for the company whose CEO Sundar Pichai was once humiliated for appearing to botch Google’s AI lead into OpenAI. Google shares rose after Apple announced it would use Google’s Gemini AI model to power its next-generation Siri in a multi-year partnership expected to be worth billions of dollars.

According to statistics shared by Similarweb earlier this month, Gemini also dominates ChatGPT in global AI traffic share. Gemini currently receives 21.5% of all AI website traffic, up from 5.7% a year ago. ChatGPT is still growing, but at a slower rate and its relative traffic share is now 64.5%, down from 86.7% a year ago.

AI behavior

British media regulator Ofcom on Monday announced an investigation into Elon Musk’s X following a scandal in which its chatbot Grok was used to generate sexual deepfakes of women and children. Officials said the investigation could result in fines of up to 10% of Company X’s global revenue or even an outright ban.