Most trusted01
On-device
Perceive raw context, personalize, minimize, and obtain consent.
- Raw source stays here
- Local policy enforcement
- Immediate user review
A working architecture thesis
The cloud does not need your whole lifeto do one useful thing.
A Semantic Airlock turns sensitive context into the smallest useful disclosure for a remote model. The disclosure is inspectable and testable. The sensitive source stays in the trusted tier.
Working termSemantic Airlock
A purpose-bound disclosure architecture for hybrid AI.
The architectural choice
Route representations by sensitivity and purpose, then make the boundary inspectable.The pattern
Compile first. Disclose second.
The local model extracts only what the task needs. Deterministic code and human review decide what is actually permitted to leave.
- 01Sensitive sourcePhoto · voice · document · place
- 02Local perceptionConstrained extraction on device
- 03Policy + approvalValidate, inspect, edit, consent
- trust boundary04Approved disclosureMinimal · purpose-bound · testable
- 05Remote capabilityFrontier synthesis without the source
Beyond local versus cloud
The emerging three-tier split.
Model routing already weighs quality, latency, and cost. Sensitivity and permitted disclosure are joining that list.
Private remote02
Private Cloud Compute
Handle explicitly selected sensitive work that exceeds the device.
- Separate, visible route
- Never a silent fallback
- Useful middle tier
Best capability03
Frontier cloud
Perform expensive synthesis using a minimized, approved brief.
- Works from the brief alone
- Identity stays out of it
- Provider controls still matter
The first proof
The photo becomes a drawing brief.
An on-device model can draft the brief from a child's photograph. OpenAI's image model can then draw from it without receiving the photograph, a face embedding, or the local nickname.
The parent reviews and can edit the brief before generation. The server rejects any request containing fields outside the explicit contract.
See how Crayonymous explains thisAllowed to cross exact schema
{
"scene": "exploring a moon garden",
"characters": [{
"ageBand": "older-child",
"hair": "two long braids",
"features": ["round glasses"],
"clothing": ["striped hoodie"]
}]
}The drawing payload contains
Your scene and four approved Character Card traits: approximate age band, hair silhouette, visible markers, and signature clothing.
It has no field for
The photo itself, the name saved on the card, a photo URL, photo metadata, a face embedding, or an unrestricted photo caption.
The non-negotiables
The model doesn't enforce this. The code does.
Local inference reduces exposure, but enforceable boundaries come from software architecture, product behavior, and evidence.
Confine the source
Raw photos, voices, and documents remain in the most trusted compute tier.
Extract for one purpose
Local intelligence answers a narrow question. It does not produce an unrestricted caption, transcript, or profile.
Enforce outside the model
A fixed list of allowed fields is checked before anything is sent. Whatever is not on the list never leaves.
Let a person inspect it
When the derivative is personal and will leave the device, the user sees and can edit it first.
Never silently escalate
If the local capability is unavailable, the feature fails closed or becomes manual. The source never falls through to cloud processing.
Prove the boundary
Serialization tests, packet traces, content-free logs, retention settings, and external review turn a promise into evidence.
What this does not mean
Minimized is not the same as anonymous.
A derived description can still be personal data. A distinctive combination of traits may identify someone to a party with outside knowledge. Remote providers still have retention policies and operational access to what they process.
The honest promise is narrower: the source is confined, the disclosure is materially smaller and limited to one purpose, and the user can see what crosses. Crayonymous currently discloses that under standard OpenAI API controls, image-generation prompts and outputs may appear in abuse-monitoring logs for up to 30 days.
Data minimization, local sanitization, confidential inference, and privacy-preserving representations all predate this work. The thesis under test is narrower: their combination can become a typed, human-inspectable disclosure boundary with useful evidence for users and product teams.
Beyond coloring sheets
Useful when a task needs a brief, not the original.
Support
A screenshot becomes a sanitized issue report. Its messages, names, and account details stay on the machine.
Documents
A letter becomes the one question you need answered. Nothing else travels with it.
Home
A room photo becomes a floor plan, layout, and style brief. Faces and family photos stay out of the request.
Meetings
Local audio becomes a list of decisions and action items. Voices and the full conversation never leave the room.
Cameras
A local clip becomes one frame that says “package delivered” — all the notification needs.
Family
A photo becomes an approved character description, activity idea, or caption. The original never leaves the device.
Sometimes a summary is not enough. If someone needs to verify the original, examine exact wording, or make a high-stakes decision, the source should stay local—or travel through a separate, explicitly approved path.
Back to the coloring app