CS PhD @StanfordAILab @StanfordNLP w/ @percyliang @sanmikoyejo. Past: @GoogleDeepMind, CMU, USydney š¦šŗ
š²
Joined January 2017
- Tweets767
- Following995
- Followers4.1K
- Likes8.8K
an example that folks often find surprising: codex (and others) scan your connectors / mcps *unprompted* in the background and you largely wouldnāt know when, what, or why
to catch this you need some form of intermediary infrastructure between your data and agents
user modeling is a key missing piece in making AI truly understand us and being useful, and making it sovereign is critical -- exciting work from @BenShi34!
To train user models / personal agents that best understand us, it helps to have access to all of our scattered digital footprint. For my first release in my PhD, Iām open-sourcing **Homecoming**, a desktop app that automatically aggregates all your personal context across all applications that youāve accessed over your lifetime. It helps auto-request your data packages from over 2000 supported websites, and manages them locally in one place you can query, explore, and use for any downstream application. All your messages, emails, tiktok scrolling activity, goodreads, netflix, stravaā¦ even your 6th grade Wattpad account. You can even explore the features companies use to target ads at you.
This project was super fun to work on as I realized there is so much data about me that I didnāt even know existed. Itās a nice feeling to gain sovereignty over my data.
All data stays local, unless you choose otherwise. Lmk how it is!
Blog: benshi34.github.io/#/blog/hoā¦
Link to download: github.com/benshi34/homecomiā¦
shoutout to @mingyech @dominicjsobhani who're really the driving force behind this!!
Quick updates on the Open Anonymity project (@OpenAnonProject)!
1. OA-chat is live! You can now signup: chat.openanonymity.ai
2. We collaborated with @ethereumfndn (@VitalikButerin, @DavideCrapis, @VittoStack, @curryrasul) to develop zkAPI, a new zero-knowledge protocol for accessing gated / paid APIs with unlinkability. Itās like a generalization of OA unlinkable inference that also abstracts payments away. Now also available on OA-chat!
I'm excited because more infrastructure should exist where privacy and sovereignty is foundational and people are in control.
Quick updates on the Open Anonymity project (@OpenAnonProject)!
1. OA-chat is live! You can now signup: chat.openanonymity.ai
2. We collaborated with @ethereumfndn (@VitalikButerin, @DavideCrapis, @VittoStack, @curryrasul) to develop zkAPI, a new zero-knowledge protocol for accessing gated / paid APIs with unlinkability. Itās like a generalization of OA unlinkable inference that also abstracts payments away. Now also available on OA-chat!
I'm excited because more infrastructure should exist where privacy and sovereignty is foundational and people are in control.
- Short blog with links (code, docs, technical details): openanonymity.ai/blog/oa-ethā¦
- Discord: discord.com/invite/W5M6JMrfMā¦
- People who really drove the project! @mingyech @dominicjsobhani @erikchi @amelia_kuang @cocozxu @DavideCrapis @VittoStack @curryrasul @VitalikButerin
tysm for having us! š
On a new episode of #TheBraveTechnologist, Open Anonymity Project creators Ken Liu (@kenziyuliu) and Erik Chi (@erik_chi_) discuss how the next generation of AI systems could be built with privacy as a default.
Listen to their full chat with @LukeMulks: brave.com/podcast/e120/
19
2,585
awesome work from omar as always! thereās a lot to explore on the interaction between interfaces and your personal contexts
We upgraded Tabracadabra š to bring an entire context-aware assistant (not just tab to autocomplete!) to any textbox. It's pretty great if you hate switching between the chat interface and what you're working on. We're also open-sourcing, so you can try it out!š§µ
7
1,563
solid benchmarks from john as always!!
How much of SQLite, FFmpeg, PHP compiler can LMs code from scratch? Given just an executable and no starter code or internet access.
Introducing ProgramBench: 200 rigorous, whole-repo generation tasks where models design, build, and ship a working program end to end. š§µ
8
1,772
Had a great time discussing AI user privacy on @augmind_fm š
One discussion Iād like to highlight from the chat is that what constitutes the "Privacy Problem" has been shifting as AI progresses.
It used to be that we care a lot about *training-time* user privacy: what gets trained into the model, and what the model would spit out. Say you take an LLM and a book (or any piece of sensitive text). We cared about whether the book would be regurgitated ("memorization"); whether you can remove such a book from the model ("unlearning"); and whether you can detect the book being trained ("membership inference"). And as part of mitigating these problems, we work on training-time techniques like differential privacy, careful data cleaning, and model alignment/guardrails (in ~increasing order of adoption). Guardrails seem to work well enough that people donāt really talk about sensitive model outputs anymore.
Whatās more pressing today, I argue, is *inference-time* user privacy: the fact that intelligent models are served at scale on private user data, which are then centrally managed at model providers. Intelligent models mean that user profiling is now cheap and automatic; your activities can be continuously analyzed to reveal new sensitive insights. Whether your data is trained on or not became less relevant. Having a "digital clone" of you by building on your memory/personalization is now way more profitable. The threat vector changed from the model misbehaving to the provider misbehaving.
Because of this, the techniques to improve user privacy would look different than before. Theyāll look less like fancy learning algorithms (e.g. RL to steer model to output paraphrase of a book than the original book), and more like *peripheral systems* sitting around closed models that we do not control but still want to access. The OA project (openanonymity.ai) is an example: you could build a zero-knowledge proxy to mediate AI inference and combat surveillance, and leverage smaller models to help users build personal memory on-device. This is not to say that thereās no room for training; you just train for different things, and on auxiliary models than the closed models.
thank you so much to @EchoShao8899 @michaelryan207 @shannonzshen for hosting me!
āIn the past, with social media or web search, you are like, here are some specific keywords, here are some posts that I am okay to share with the world; whereas with AI, it feels like you are private, it feels like you are talking to an entity that wonāt reveal your information.ā
For EP4, we welcome @kenziyuliu, Stanford CS PhD student and creator of The Open Anonymity Project. Ken approaches AI privacy from angles most researchers don't: deep learning, applied cryptography, privacy technologies, and real human behavior all at once. In this episode, he shares how to achieve provable private AI inference, why today's agents are a privacy nightmare (and how to fix it), his vision on intelligence neutrality, and more.
0:00 - Teaser
1:08 - Prelude: Introducing Ken Liu
1:41 - Monologue: The Open Anonymity Project
3:41 - Kenās Path to Privacy Research
6:31 - The Biggest Privacy Concern for LLM Users
9:39 - Three Perspectives on Tackling AI Privacy
10:57 - āAI presents a Uniquely Worse Privacy Problemā
13:44 - The Open Anonymity (OA) Project: Unlinkable Inference
17:50 - Blind Signatures as Unlinkable Authentication
20:52 - Secure Inference Proxies
28:31 - Threat Model in the OA Project
31:39 - What If People Give Away Information In Their Prompts
35:58 - OpenClaw, Privacy Nightmare In Agents
43:00 - The Stories Behind the OA Project
50:14 - Intelligence Neutrality
52:22 - Safety Concerns in a World with Private AI Inference
Sharing a super simple, user-owned memory module we've been playing around: nanomem
The basic idea is to treat memory as a pure intelligence problem: ingestion, structuring, and (selective) retrieval are all just LLM calls & agent loops on a on-device markdown file tree. Each file lists a set of facts w/ metadata (timestamp, confidence, source, etc.); no embeddings/RAG/training of any kind.
For example:
- `nanomem add <fact>` starts an agent loop to walk the tree, read relevant files, and edit.
- `nanomem retrieve <query>` walks the tree and returns a single summary string (possibly assembled from many subtrees) related to the query.
Whatās nice about this approach is that the memory system is, by construction:
1. partitionable (human/agents can easily separate `hobbies/snowboard.md` from `tax/residency.md` for data minimization + relevance)
2. portable and user-owned (itās just text files)
3. interpretable (you know exactly whatās written and you can manually edit)
4. forward-compatible (future models can read memory files just the same, and memory quality/speed improves as models get better)
5. modularized (you can optimize ingestion/retrieval/compaction prompts separately)
Privacy & utility. I'm most excited about the ability to partition + selectively disclose memory at inference-time. Selective disclosure helps with both privacy (principle of least privilege & āneed-to-knowā) and utility (as too much context for a query can harm answer quality).
Composability. An inference-time memory module means: (1) you can run such a module with confidential inference (LLMs on TEEs) for provable privacy, and (2) you can selectively disclose context over unlinkable inference of remote models (demo below).
We built nanomem as part of the Open Anonymity project (openanoymity.ai), but itās meant to be a standalone module for humans and agents (e.g., you can write a SKILL for using the CLI tool). Still polishing the rough edges!
- GitHub (MIT): github.com/OpenAnonymity/nanā¦
- Blog: openanonymity.ai/blog/nanomeā¦
- Beta implementation in chat client soon: chat.openanonymity.ai
Work done with amazing project co-leads @amelia_kuang @cocozxu @erikchi !!
shoutout to the student leads @amelia_kuang and @cocozxu !! they've been super awesome and put a lot of thought into this project
xitter.twitterapi.xyz/amelia_kuang/status/20ā¦
AI memory today is a black box: it remembers things about you, but you canāt really inspect it, edit it, or take it with you.
We think memory should be user-owned and user-controlled.
So @cocozxu and I built nanomem: a local-first memory system that turns your chats, notes, and history into a markdown file tree on your device. You can open it, edit it, git-version it, move it anywhere.
No hidden profiles. No lock-in. nanomem treats memory management as a reasoning problem: your memory evolves with you, grows organically from real conversations, and stays independent from any one model or app.
The goal is simple: memory you actually own.
Try it:
npm install -g @openanonymity/nanomem
Blog post: openanonymity.ai/blog/nanomeā¦
Open source (MIT License):
github.com/OpenAnonymity/nanā¦
š«”š«”š«”
remote APIs (AI inference or otherwise) should really be mediated by an unlinkable, zero-knowledge layer, since whoever on the other side can now easily infer a ton about you with linkage and cheap intelligence
My self-sovereign / local / private / secure LLM setup, April 2026
vitalik.eth.limo/general/202ā¦
incredible work from omar as always!
Whatās the point of a āhelpful assistantā if you have to always tell it what to do next?
In a new paper, we introduce a reasoning model that predicts what youāll do next over long contexts (LongNAP š¤).
We trained it on 1,800 hours of computer use from 20 users.
š§µ
12
3,279
congrats on the launch @DanielXieee @QuanliangX and team!! been lucky to witness your tremendous progress!
Origami Robotics is building high-DOF robotic hands with in-joint motors and a co-designed data-collection glove to eliminate the embodiment gap by collecting high-quality, real-world data at scale.
Congrats on the launch, @DanielXieee and @QuanliangX!
ycombinator.com/launches/Pclā¦
@openclaw @steipete just want to flag that Venice AI has no privacy/security model; they are a middleman sitting between users and AI, observing all plaintext prompts/responses (the definition of an eavesdropper). we've flagged this publicly and have not gotten a response
This quoted post is unavailable.
On mass surveillance: a critically overlooked point is that user surveillance profiles are *already here* with providers like OpenAI / Anthropic, in the form of "memory".
To surveil, DoW just needs to *ask* for these profiles. Whether DoW "uses the models" seems less relevant.
Tonight, we reached an agreement with the Department of War to deploy our models in their classified network.
In all of our interactions, the DoW displayed a deep respect for safety and a desire to partner to achieve the best possible outcome.
AI safety and wide distribution of benefits are the core of our mission. Two of our most important safety principles are prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems. The DoW agrees with these principles, reflects them in law and policy, and we put them into our agreement.
We also will build technical safeguards to ensure our models behave as they should, which the DoW also wanted. We will deploy FDEs to help with our models and to ensure their safety, we will deploy on cloud networks only.
We are asking the DoW to offer these same terms to all AI companies, which in our opinion we think everyone should be willing to accept. We have expressed our strong desire to see things de-escalate away from legal and governmental actions and towards reasonable agreements.
We remain committed to serve all of humanity as best we can. The world is a complicated, messy, and sometimes dangerous place.
Readers added context they thought people might want to know
Government officials have contradicted Samās claim, saying OpenAI will allow the DoW to use their models for āall lawful purposesā.
This could allow for uses Anthropic refused to engage in, namely mass surveillance tools and weapons systems with no human oversight.
x.com/undersecretaryā¦
we started The Open Anonymity Project because surveillance is always possible if *someone* has all the logs + user profiles, and be coerced to turn them over
we're just phd students but hey we can write AI apps that's usable: chat.openanonymity.ai
xitter.twitterapi.xyz/kenziyuliu/status/2027ā¦
Can we build a blind, *unlinkable inference* layer where ChatGPT/Claude/Gemini can't tell which call came from which users, like a āVPN for AI inferenceā?
Yes! Blog post below + we built it into open source infra/chat app and served >15k prompts at Stanford so far. How it helps with AI user privacy:
# The AI user privacy problem
If you ask AI to analyze your ChatGPT history today, itās surprisingly easy to infer your demographics, health, immigration status, and political beliefs. Every prompt we send accumulates into an (identity-linked) profile that the AI lab controls completely and indefinitely. At a minimum this is a goldmine for ads (as we know now). A bigger issue is the concentration of power: AI labs can easily become (or asked to become) a Cambridge Analytica, whistleblow your immigration status, or work with health insurance to adjust your premium if they so choose.
This is a uniquely worse problem than search engines because your average query is now more revealing (not just keywords), interactive, and intelligence is now cheap. Despite this, most of us still want these remote models; theyāre just too good and convenient! (this is aka the "privacy paradox".)
# Unlinkable inference as a user privacy architecture
The idea of unlinkable inference is to add privacy while preserving access to the remote models controlled by someone else. A āprivacy wrapperā or āVPN for AI inferenceā, so to speak.
Concretely, itās a blind inference middle layer that:
(1) consists of decentralized proxies that anyone can operate;
(2) blindly authenticates requests (via blind signatures / RFC9474,9578) so requests are provably sandboxed from each other and from user identity;
(3) relays prompts over randomly chosen proxies that donāt see or log traffic (via client-side ephemeral keys or hosting in TEEs); and
(4) the provider simply sees a mixed pool of anonymous prompts from the proxies. No state, pseudonyms, or linkable metadata.
If you squint, an unlinkable inference layer is essentially a vendor for per-request, anonymous, ephemeral AI access credentials (for users or agents alike). It partitions your context so that user tracking is drastically harder.
Obviously, unlinkability isnāt a silver bullet: the prompt itself still goes to the remote model and can leak privacy (so don't use our chat app for a therapy session!). It aims to combat *longitudinal tracking* as a major threat to user privacy, and its statistical power increases quickly by mixing more users and requests.
Unlinkability can be applied at any granularity. For an AI chat app, you can unlinkably request a fresh ephemeral key for every session so tracking is virtually impossible.
# The Open Anonymity Project
We started this project with the belief that intelligence should be a truly public utility. Like water and electricity, providers should be compensated by usage, not who you are or what you do with it. We think unlinkable inference is a first step towards this āintelligence neutralityā.
# Try it out! Itās quite practical
- Chat app āoa-chatā: chat.openanonymity.ai/
(<20 seconds to get going)
- Blog post that should be a fun read: openanonymity.ai/blog/unlinkā¦
- Project page: openanonymity.ai/
- GitHub: github.com/OpenAnonymity
btw this is meant as an open source and distributed tool/infra against user tracking and surveillance.
it has clear privacy/security architecture (see blog: openanonymity.ai/blog/unlinkā¦) and we state clearly what it protects (longitudinal tracking) and doesn't protect (1hr long therapy sessions).
we want to make it such that *anyone* can just run the code (github.com/openanonymity) -- both the chat client (which we try to make pretty + usable), and the proxy -- so no single point of failure / trust.
like you can run a proxy for your book club, and help your club members against tracking.
Can we build a blind, *unlinkable inference* layer where ChatGPT/Claude/Gemini can't tell which call came from which users, like a āVPN for AI inferenceā?
Yes! Blog post below + we built it into open source infra/chat app and served >15k prompts at Stanford so far. How it helps with AI user privacy:
# The AI user privacy problem
If you ask AI to analyze your ChatGPT history today, itās surprisingly easy to infer your demographics, health, immigration status, and political beliefs. Every prompt we send accumulates into an (identity-linked) profile that the AI lab controls completely and indefinitely. At a minimum this is a goldmine for ads (as we know now). A bigger issue is the concentration of power: AI labs can easily become (or asked to become) a Cambridge Analytica, whistleblow your immigration status, or work with health insurance to adjust your premium if they so choose.
This is a uniquely worse problem than search engines because your average query is now more revealing (not just keywords), interactive, and intelligence is now cheap. Despite this, most of us still want these remote models; theyāre just too good and convenient! (this is aka the "privacy paradox".)
# Unlinkable inference as a user privacy architecture
The idea of unlinkable inference is to add privacy while preserving access to the remote models controlled by someone else. A āprivacy wrapperā or āVPN for AI inferenceā, so to speak.
Concretely, itās a blind inference middle layer that:
(1) consists of decentralized proxies that anyone can operate;
(2) blindly authenticates requests (via blind signatures / RFC9474,9578) so requests are provably sandboxed from each other and from user identity;
(3) relays prompts over randomly chosen proxies that donāt see or log traffic (via client-side ephemeral keys or hosting in TEEs); and
(4) the provider simply sees a mixed pool of anonymous prompts from the proxies. No state, pseudonyms, or linkable metadata.
If you squint, an unlinkable inference layer is essentially a vendor for per-request, anonymous, ephemeral AI access credentials (for users or agents alike). It partitions your context so that user tracking is drastically harder.
Obviously, unlinkability isnāt a silver bullet: the prompt itself still goes to the remote model and can leak privacy (so don't use our chat app for a therapy session!). It aims to combat *longitudinal tracking* as a major threat to user privacy, and its statistical power increases quickly by mixing more users and requests.
Unlinkability can be applied at any granularity. For an AI chat app, you can unlinkably request a fresh ephemeral key for every session so tracking is virtually impossible.
# The Open Anonymity Project
We started this project with the belief that intelligence should be a truly public utility. Like water and electricity, providers should be compensated by usage, not who you are or what you do with it. We think unlinkable inference is a first step towards this āintelligence neutralityā.
# Try it out! Itās quite practical
- Chat app āoa-chatā: chat.openanonymity.ai/
(<20 seconds to get going)
- Blog post that should be a fun read: openanonymity.ai/blog/unlinkā¦
- Project page: openanonymity.ai/
- GitHub: github.com/OpenAnonymity
show me the proof & security architecture of privacy more than āitās private AIā and i will switch! :)
from a quick skim, great project but it seems to be man-in-the-middle that can see all prompts and responses traffic. hereās openclaw/claude:
Venice.ai is already today this "unlinkable inference layer," a "VPN for AI"
Use any model (ChatGPT/Claude/Gemini/Grok) through Venice pseudonymously.
Venice.ai is already today this "unlinkable inference layer," a "VPN for AI"
Use any model (ChatGPT/Claude/Gemini/Grok) through Venice pseudonymously.
i.e. free anonymous nano banana 2 at chat.openanonymity.ai
Can we build a blind, *unlinkable inference* layer where ChatGPT/Claude/Gemini can't tell which call came from which users, like a āVPN for AI inferenceā?
Yes! Blog post below + we built it into open source infra/chat app and served >15k prompts at Stanford so far. How it helps with AI user privacy:
# The AI user privacy problem
If you ask AI to analyze your ChatGPT history today, itās surprisingly easy to infer your demographics, health, immigration status, and political beliefs. Every prompt we send accumulates into an (identity-linked) profile that the AI lab controls completely and indefinitely. At a minimum this is a goldmine for ads (as we know now). A bigger issue is the concentration of power: AI labs can easily become (or asked to become) a Cambridge Analytica, whistleblow your immigration status, or work with health insurance to adjust your premium if they so choose.
This is a uniquely worse problem than search engines because your average query is now more revealing (not just keywords), interactive, and intelligence is now cheap. Despite this, most of us still want these remote models; theyāre just too good and convenient! (this is aka the "privacy paradox".)
# Unlinkable inference as a user privacy architecture
The idea of unlinkable inference is to add privacy while preserving access to the remote models controlled by someone else. A āprivacy wrapperā or āVPN for AI inferenceā, so to speak.
Concretely, itās a blind inference middle layer that:
(1) consists of decentralized proxies that anyone can operate;
(2) blindly authenticates requests (via blind signatures / RFC9474,9578) so requests are provably sandboxed from each other and from user identity;
(3) relays prompts over randomly chosen proxies that donāt see or log traffic (via client-side ephemeral keys or hosting in TEEs); and
(4) the provider simply sees a mixed pool of anonymous prompts from the proxies. No state, pseudonyms, or linkable metadata.
If you squint, an unlinkable inference layer is essentially a vendor for per-request, anonymous, ephemeral AI access credentials (for users or agents alike). It partitions your context so that user tracking is drastically harder.
Obviously, unlinkability isnāt a silver bullet: the prompt itself still goes to the remote model and can leak privacy (so don't use our chat app for a therapy session!). It aims to combat *longitudinal tracking* as a major threat to user privacy, and its statistical power increases quickly by mixing more users and requests.
Unlinkability can be applied at any granularity. For an AI chat app, you can unlinkably request a fresh ephemeral key for every session so tracking is virtually impossible.
# The Open Anonymity Project
We started this project with the belief that intelligence should be a truly public utility. Like water and electricity, providers should be compensated by usage, not who you are or what you do with it. We think unlinkable inference is a first step towards this āintelligence neutralityā.
# Try it out! Itās quite practical
- Chat app āoa-chatā: chat.openanonymity.ai/
(<20 seconds to get going)
- Blog post that should be a fun read: openanonymity.ai/blog/unlinkā¦
- Project page: openanonymity.ai/
- GitHub: github.com/OpenAnonymity
Can we build a blind, *unlinkable inference* layer where ChatGPT/Claude/Gemini can't tell which call came from which users, like a āVPN for AI inferenceā?
Yes! Blog post below + we built it into open source infra/chat app and served >15k prompts at Stanford so far. How it helps with AI user privacy:
# The AI user privacy problem
If you ask AI to analyze your ChatGPT history today, itās surprisingly easy to infer your demographics, health, immigration status, and political beliefs. Every prompt we send accumulates into an (identity-linked) profile that the AI lab controls completely and indefinitely. At a minimum this is a goldmine for ads (as we know now). A bigger issue is the concentration of power: AI labs can easily become (or asked to become) a Cambridge Analytica, whistleblow your immigration status, or work with health insurance to adjust your premium if they so choose.
This is a uniquely worse problem than search engines because your average query is now more revealing (not just keywords), interactive, and intelligence is now cheap. Despite this, most of us still want these remote models; theyāre just too good and convenient! (this is aka the "privacy paradox".)
# Unlinkable inference as a user privacy architecture
The idea of unlinkable inference is to add privacy while preserving access to the remote models controlled by someone else. A āprivacy wrapperā or āVPN for AI inferenceā, so to speak.
Concretely, itās a blind inference middle layer that:
(1) consists of decentralized proxies that anyone can operate;
(2) blindly authenticates requests (via blind signatures / RFC9474,9578) so requests are provably sandboxed from each other and from user identity;
(3) relays prompts over randomly chosen proxies that donāt see or log traffic (via client-side ephemeral keys or hosting in TEEs); and
(4) the provider simply sees a mixed pool of anonymous prompts from the proxies. No state, pseudonyms, or linkable metadata.
If you squint, an unlinkable inference layer is essentially a vendor for per-request, anonymous, ephemeral AI access credentials (for users or agents alike). It partitions your context so that user tracking is drastically harder.
Obviously, unlinkability isnāt a silver bullet: the prompt itself still goes to the remote model and can leak privacy (so don't use our chat app for a therapy session!). It aims to combat *longitudinal tracking* as a major threat to user privacy, and its statistical power increases quickly by mixing more users and requests.
Unlinkability can be applied at any granularity. For an AI chat app, you can unlinkably request a fresh ephemeral key for every session so tracking is virtually impossible.
# The Open Anonymity Project
We started this project with the belief that intelligence should be a truly public utility. Like water and electricity, providers should be compensated by usage, not who you are or what you do with it. We think unlinkable inference is a first step towards this āintelligence neutralityā.
# Try it out! Itās quite practical
- Chat app āoa-chatā: chat.openanonymity.ai/
(<20 seconds to get going)
- Blog post that should be a fun read: openanonymity.ai/blog/unlinkā¦
- Project page: openanonymity.ai/
- GitHub: github.com/OpenAnonymity
Linking some related content below:
1. Weāve now built this! (though different techniques)
xitter.twitterapi.xyz/VitalikButerin/status/ā¦
You guys should consider supporting some ZK one-time access token scheme where even you can't tell which call came from which user.
Hiding the sender is a good complement to highly imperfect guarantees of confidentiality of contents.
This is already doable by paying for credits with eth routed through railgun, PP, etc, but that costs ~$1 per tx, if you do a custom access token scheme you can make it viable to not have any linking even between two adjacent calls. (Obviously there's still the IP address issue but that can be handled separately)