Privacy is Fundamental: Verifiable Privacy and Transparency in the Age of AI - Brendan Eich

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:00

   Haven't heard that intro in a while. Uh co-founder and CEO of Brave Software, but uh yeah, I found Mozilla too with Jamie Zinsky and some other people about um 27 years ago. That was a time uh it feels like I'm I'm doing the same thing over but better. So I'll talk about this in context of privacy and AI.

2. 0:32

   You have to survive. That's the first rule of startups also for me to improve over time. So uh people don't always talk about privacy when they talk about AI. And many people are cheerfully using hosted models with unknown data retention and logging. Um or they're told, "Oh, trust us, it's going to be logged only this long." Things like that. I don't think this is a good approach. I wouldn't want it for myself.

3. 1:00

   I wouldn't want to tell customers trust me. So I don't think anyone should. I wrote a piece uh with my protege at Mozilla Andreas Gal called trust but verify in 2014. It was inspired by um open source and the ability to do verified builds depending on operating system and compiler. The idea was that you could somehow hope eventually through remote addations to prove that your software wasn't backdoored.

4. 1:30

   It could have been backdoored against your wishes and you were gagged by a national security letter or something like that. So we wrote this piece and I think it still applies. There's some quotes from it that you have to take in the modern spirit. So one of the paragraphs talks about we will establish a verification system at global scale with participants from many regions and jurisdictions.

5. 1:53

   That sounds like a blockchain. So fast forward you know past Bitcoin existed then but other things were still uh gleams in people's eyes. So fast forward to now and near and this looks doable. Um, so to have a community or even adversarial communities, people trying to get bug bounties working around the world to verify verifiable systems seems important to me. Otherwise, you can not

6. 2:21

   only get data exfiltrated or logged or scraped from a hosted model, you may be paying for a model that you think is good and you're getting a less good model. I don't want to name any names, but we've been testing some of the so-called decentralized AI systems out there. And we we find sometimes they're running open source models that are mimicking proprietary closedweight models. It's a little disturbing that people would pay for that and not get the model they thought they were

7. 2:50

   getting. So, no more trust me, bro. This is the trust me bro. He's weeping. He's got privacy perfume, but it's not working. So the first thing we're doing in Brave itself, if you've used Brave, there's something called uh Leo as a nickname, it's browser AI. You can get it in the sidebar or with the star, four-ointed star in the upper right corner. You can get at through the address bar if you

8. 3:17

   want to do a query to it directly through the drop down. And unlike other browsers, we haven't just jumped into the agent mode quickly and rashly. We've done it carefully with a separate mode in our nightly build that lets you operate in a distinct profile, not where all your cookies and crypto and health records and bank accounts are. We put a pink hue on everything so you know you're in this mode. We have a separate model for alignment checking. How many people know what indirect prompt injection is? Have you heard of that?

9. 3:50

   Not enough people. This is where you're using a happy agentic browser. your you've got your Coinbase tab open here. You've got your agents that you're supervising, having them do Ralph Wiggum loops of whatever you want them to do.

10. 4:06

    In the other tab, in the third tab, you've got Reddit open and there's a Reddit post that has hidden text could be concealed in an image even, and it's injecting a prompt that steals everything across all your tabs. When I did JavaScript, the threat model was the remote server and it was distinct from other sites. the same origin policy was what we ended up calling it over time and cross-ite scripting was the threat

11. 4:31

    with agents in browsers. If you pop the agent, all your tabs, all your health data, all your money, all your crypto can go out the window and you don't want that. Um, at least I don't want that. So, we're doing agent mode in a separate profile. We're doing it with this visual cue that you're in that mode and we're doing a separate model that checks results from the main model but without looking at the web content that Reddit

12. 5:01

    post that's been crafted to pone you. So the alignment checking model ignores the web content and it can veto prompt injection attacks. We're also using a better security tuned LLM right now. I think it's um cla and we're keeping up with the best models. Some models are are resistant to prompt injection more than others, but all models are somewhat vulnerable because of the non-determinism, because of the problems of LLM hallucinating, things like that.

13. 5:32

    You can have adversaries injecting prompts. You can have the model just making a bad mistake. In either case, you don't want it to send all your Bitcoin somewhere. Okay. Um, in Brave, not just in nightly, but I believe uh this has now made it to other releases, we have verifiable AI in partnership with Near in the browser AI, Leo, the the browser assistant. You can see at the bottom there, it's Deepseek 3.1 hosted in

14. 6:05

    Near's verifiable network. We're working on allowing these communities or adversaries to verify automatically by themselves around the world. So this is an idea that's being fulfilled now from 2014. The model costs. We think you should pay for things. You shouldn't get a free lunch.

15. 6:26

    We've noticed that another thing happens with some of these agent browsers. If you don't pay for the premium after hitting a quota, they'll downgrade your model. And again, some models are very weak against prompt injection. So if you're using Chat GBT atlas, say, and you run out of uses of their high quality model, which is pretty good, um, ChatgB42 or whatever, they'll down 46

16. 6:50

    now, I suppose, they'll downgrade you to Mini3, and it is not safe against prompt injections. So we did a three blog posts on indirect prompt injections. We tested and responsibly disclosed two perplexity comet chatblas and opera problems we found and they mostly fixed them though in one case I think other people noticed perplexity really wasn't they were playing whack-a-ole in my opinion and that was a problem. So, we educated the

17. 7:21

    industry and the competitors were a little bit um squirming under the spotlight, but it's necessary because you could lose everything. It's much worse than just having one JavaScript attack on one website. We also noticed people are bragging about using LLMs to get past things like cooking consent banners. Everyone hates those things. If you use Brave, you don't see them. So, how many people use Brave?

18. 7:44

    Okay, good. Yeah, we we cut off the script that poses the dialogue because that script sets a cookie because it's a trusting consent framework. It tries to get an exception and that script actually sells you it can loot your data. It can also attack the publishers's data against the publishers's interest. So the safest way to deal with these things is the way we do it which is cut the hydrahead off at the stump and burn it. But LLM sometimes say, "Oh, I'm going to let the cookie

19. 8:09

    consent dialogue fly and I'll try to reject all." And when that fails, ChatGpt agent and ChatGP Atlas, I believe, also cloud computer use fall back on accept all. It's another one of these silent downgrade attacks. Cell phone cell phone. Uh, and the logging on these is terrible. A chatblas logs by default. Perplexity logs I think your navigation history if you have the agent on. So you're just trusting the browser maker not to divulge your your sensitive navigation. Even Google Chrome doesn't

20. 8:42

    go that far. So this is a brave new world where people seem to be forgetting privacy, but it can be put back in. Another thing Brave does is it blocks ads really well, especially on YouTube. If you look at websites with ads and other junk removed, you get a better set of data for agents to look at. And this is, you know, we're looking forward to WebMCP, but that requires the site to be extended with WebMCP and and people to do the right thing. We're going to be

21. 9:08

    scraping images and text for a long time. So blocking ads and other junk is absolutely valuable. Um we do work on in academic settings to improve the state-of-the-art on auditing and we have one trust on this basis because we don't do any um retention of our of our own hosted models or models that we use in our search engine for the LEO browser though you can choose hosted models by anthropic or you can bring your own model the models that we can offer for you to use including anthropic ones run

22. 9:40

    on AWS bedrock with no logging and while there's trust me bro from Amazon there. It's it they're I think they're trustworthy in that regard. Again, the real way to avoid trust without verification is to use near's network. Um we also have SOC2 that's total trust me bro, but it's required by enterprise.

23. 9:59

    Um, we're working with Near on contribution protocol because from the days of Ted Nelson's project Xanadu on people have realized they want to pay contributors creators. They want to pay royalties even they may be required to or they may do it out of their own goodwill. There should be a way to do it including for agentic use of data creator content. And we're we're hoping to collaborate on Ironclaw because we're using Ironclaw and Bray very carefully. We're not giving it access to our Gmail like um

24. 10:31

    that meta executive did. Um Brave is getting big 110 million still growing 40 billion plus pages indexed quality not quantity. There's so much garbage on the web. Um we're working with near on near intense coming soon to Brave. I can't say exactly when but weeks not months.

25. 10:49

    Um so that's the best way to do any to any swaps. No exchange risk. Um looking forward to that. We're offering the full modern AI stack. Browsing, search, agents, transactions, and we are getting customers. I can't name the biggest. They don't want to be named. They're shy, but you can see some of the lesser ones there. Not to put them down. Um, and we're independent. We don't fall back on Bing. We don't scrape Google because scraping Google doesn't get you anywhere. Uh, where can we go from here? I think user first AI is

26. 11:22

    important. people may end up with small tuned models running on their own hardware. That's that's my goal. But if you have hosted models, you can use near's network. And I think that's a great model. It satisfies the trust but verify condition that I set out in 2014.

27. 11:39

    Thank you very much.