Here's a question every AI company has to answer eventually: who can read what your users type? The answer, at most companies, is "the operator, if they want to."

That's not a bug in someone's implementation. It's the architecture. A model that sees the prompt is a model whose operator can see the prompt — through logging, through a debugger, through a subpoena. Once the plaintext exists on the server, privacy is a policy, and policies change.

server sees the prompt:  "trust us, we don't read it"
ciphertext in, ciphertext out:  "you can't, even if you tried"

the proof is the point

Confidential AI flips it. The model computes on ciphertext, so there's no plaintext to leak, and the zk proof shows the computation was correct without revealing what went in. Privacy stops being a promise and becomes a mathematical fact.

Your model should never see the prompt — not because you're worried today, but because a model that can't see it is a model whose owner can't either.