Darkbloom: A Private Inference Network, Not a Model, and It Is Still Alpha

One-line job: Understand that Darkbloom is an inference network routing OpenAI-compatible calls to attested Apple Silicon Macs, what its encryption does and does not protect, and which alpha caveats disqualify it for your workload. Audience: Developers evaluating cheaper OpenAI-compatible inference, and Mac owners considering selling idle capacity. Not for: Anyone shopping for a model to download and run locally. Darkbloom is not a model, and it is not a local runtime. Last verified: 2026-08-27 Evidence weight: documentation-verified, third-party-reviewed, vendor claims labeled

Everything on this page dates from August 2026. Darkbloom is a public alpha under rapid development — catalog, prices, platform fee, and hardware gate all change. Treat every figure here as “as of Aug 2026, check GET /v1/models and GET /v1/pricing.”

Darkbloom is a network, not a model

The common misread: people search “Darkbloom setup” expecting a model to install. There is no Darkbloom model. Darkbloom is a decentralized private-inference network: it routes OpenAI-compatible API requests to verified Apple Silicon Macs whose owners opted in as providers. Encryption runs between hops, attestation is rooted in Apple’s SE (Secure Enclave), and a Go coordinator runs inside a CVM (Confidential VM).

Models flow through it, selected per API call. The August 2026 catalog includes GPT-OSS 20B, Gemma 4 26B, and Qwen 3.5 / 3.6 35B A3B — but the consumer docs are explicit that models are not hardcoded. The live list comes from GET /v1/models (consumer quickstart).

Third-party reviewer Kevin Riedl places the category:

“Darkbloom is a public-alpha AI inference network that routes OpenAI-compatible requests to verified Apple Silicon Macs. It offers a novel middle path between a conventional hosted API and a model that runs only on hardware you control.” — Kevin Riedl, Wavect, 25 Aug 2026

Who built it

Darkbloom comes from Eigen Labs, Inc., the team behind EigenLayer, and lives under the Layr-Labs GitHub org in a repo named d-inference. “Project Darkbloom” launched as a research initiative in an April 2026 Eigen Labs post; Bankless covered it in the restaking context.

Repo state verified 27 Aug 2026: 433 stars, 81 forks, 949 commits, 170 releases, composed 43.3% Go (coordinator) and 43.2% Swift (provider), with 7.2% TypeScript for the console UI (repo). Current release is v0.8.13 as of Aug 26, 2026 (releases).¹

One history note for anyone following older write-ups: the maintainers deprecated and removed the Rust provider in May 2026 (#255). The Swift provider is the production path and the fleet migrated off the Rust agent entirely. Install instructions mentioning cargo or a Rust agent describe a system that no longer exists.

The economic argument

The pitch is structural, not algorithmic:

“Most inference pricing includes several layers between silicon and the developer. Capacity is bought, rented, repackaged, and metered before it reaches an API call. Each layer adds margin. Darkbloom routes demand to idle Apple Silicon instead, where the hardware is already paid for and the marginal cost is mostly electricity.” — darkbloom.dev

Supporting landing-page stats, all vendor claims:

“100M+ Apple Silicon machines shipped since 2020 / 50% lower cost at comparable model performance / 18hrs average daily idle time per machine / 100% of inference revenue goes to the hardware owner” — darkbloom.dev

Read the 50% figure as a vendor claim, not a benchmark. It is Darkbloom’s own copy: “delivering comparable model performance at about 50% lower cost than typical API providers” (darkbloom.dev). Wavect’s independent review reports the same rough magnitude while treating it as a starting price posture, not a measured cost-per-accepted-result. The second is the number your finance team cares about.

Architecture

Three components. Knowing which is which is the whole basis for reasoning about the privacy model:

Component	Implementation	Role
Coordinator	Go service (43.3% of repo)	Routes requests, holds billing and model registry. Runs in a Confidential VM. Sees plaintext only while routing and billing.
Provider	Swift binary darkbloom (43.2% of repo)	Runs on a Mac. Decrypts prompts in a hardened process, runs MLX inference in-process (not a subprocess). Attestation rooted in Secure Enclave + MDA (Apple Device Attestation).
Console UI	Next.js (7.2% of repo)	Dashboard at console.darkbloom.dev for consumer accounts and provider enrollment.

The privacy model — hop-by-hop, not end-to-end

This is the technical core and the most misquoted part of the product. The authoritative source is docs/architecture/security/encryption.md.

The path, hop by hop:

1. Consumer → Coordinator. TLS 1.3, plus optional NaCl Box (X25519 key agreement with XSalsa20-Poly1305) sealed to the coordinator’s long-lived public key. Key discovery via GET /v1/encryption-key.
2. Inside the coordinator. Body decrypted in Confidential VM memory for routing and billing. Plaintext is not logged, not retained, not exposed to observability tooling.
3. Coordinator → Provider. Mandatory per-request NaCl Box to the provider’s attested public key. Forward secrecy: “Coordinator generates a fresh ephemeral X25519 key pair for every inference request.”
4. Inside the provider. Hardened process: Hypervisor.framework and Stage 2 page tables for memory isolation, SIP enforced, signed system volume, binary self-hash, debugger attachment blocked and no shell access.
5. Response path. SSE chunks encrypted back to the coordinator’s ephemeral key, then relayed or re-sealed to the consumer.

The canonical doc states the trust boundary in words the maintainers do not want paraphrased:

“The coordinator transiently sees prompt content for routing and billing, while the provider is the final decryption endpoint. That makes Darkbloom’s design materially different from a service where an operator can casually inspect a subprocess, but it also means ‘encrypted’ must not be interpreted as ‘nobody outside our company can ever access plaintext.’” — encryption.md

Wavect’s review supplies the naming discipline:

“In the strict meaning where only the original client and final user ever hold plaintext, the inference path is not end-to-end encrypted. It is better described as hop-by-hop encrypted private inference with a confidential coordinator and an attested provider process.” — Kevin Riedl, Wavect

So: do not describe Darkbloom as end-to-end encrypted. It is hop-by-hop encrypted private inference with a confidential coordinator — the difference between passing and failing a regulated-data review. Darkbloom’s marketing leans harder than its docs (“The provider contributes compute, not visibility… The coordinator routes traffic it cannot read” — darkbloom.dev); when the landing page and the architecture doc diverge, the architecture doc wins.

Trust levels

Every provider advertises an attestation tier, surfaced to consumers:

Level	Meaning	Requirement
none	No attestation	Provider omitted the blob; the consumer sees a warning.
self_signed	SE-signed attestation	Secure Enclave-signed blob plus periodic challenge-response.
hardware	Apple-verified hardware	MDM (Mobile Device Management) enrollment plus a verified MDA (Apple Device Attestation) certificate chain.

The routing gate in coordinator/registry/registry.go requires encrypted response chunks and a non-empty provider public key before the gate dispatches private text. Consequence for provider operators: skipping Secure Enclave identity provisioning (installer step 9) means you cannot advertise hardware and will not receive privacy-gated traffic — and skipping darkbloom doctor after install skips the gate that catches broken installs at all (installation.md).

Catalog and pricing, as of Aug 26 2026

Landing-page snapshot. Figures and catalog membership both change; the live sources are GET /v1/models and GET /v1/pricing.

Model	Input $/M	Output $/M	Typical API $/M	Claimed discount
GPT-OSS 20B (MoE, 128K context)	$0.015	$0.07	$0.14	50% lower
Gemma 4 26B (MoE, 128K context)	$0.03	$0.165	$0.33	50% lower

For models beyond the two above (including Qwen3.5 / 3.6 35B A3B), query GET /v1/pricing (auth required). The public landing-page snapshot is intentionally narrower than the live catalog.

MTP here is Multi-Token Prediction; the DeepSeek-lineage attention scheme these MoE builds use is MLA (Multi-head Latent Attention). Both are model-architecture properties, not Darkbloom features.

The billing floor and the fee holiday, verbatim:

“Darkbloom uses per-token pricing. Platform-set model prices are returned by GET /v1/pricing; if no platform price is configured, the fallback is $0.05 per 1M input tokens and $0.20 per 1M output tokens… Every charged request has a $0.0001 (100 micro-USD) minimum… During public alpha the platform fee is 0%, so providers keep 100% of the per-token revenue.” — consumer/quickstart.md

The 0% fee is a public-alpha promotional rate, not long-term pricing. Any provider ROI model built on 100% revenue retention is modeling a temporary condition. Model the fee coming back. One useful consumer-side mechanic: “Requests routed to your own provider machine via self-route are not charged.” (consumer quickstart) — a Mac that both develops and provides gets free local dev inference.

Compatibility

• OpenAI Chat Completions, streaming and non-streaming
• OpenAI Responses API
• Anthropic Messages API
• Tool calling, vision input (images as base64 data: URIs inside the encrypted body), reasoning models
• Embeddings — listed as unimplemented in the consumer quickstart

Base URL is https://api.darkbloom.dev/v1 with a Bearer token, so adopting it in an existing OpenAI SDK is a base-URL-and-key change.

The caveats that decide whether you should use it

It is a public alpha and it is not audited. The repo says so plainly:

“Darkbloom is under active development and has not been audited. It is upgraded rapidly; features may be added, removed, or changed, and interfaces will have breaking changes. Use it for testing only, not in production. Darkbloom is provided ‘as is’ and Eigen Labs, Inc. does not guarantee its functionality or provide production support.” — Eigen Labs, Inc., repo disclaimer

Wavect’s verdict agrees:

“Our verdict as of 25 August 2026: Darkbloom is worth a bounded evaluation for non-sensitive workloads, but its public alpha should not yet inherit production trust by default.” — Kevin Riedl, Wavect

The hardware gate is narrow. Apple Silicon only — Intel Macs, Linux, and Windows fail the installer preflight outright. macOS must be 14 or newer. Unified memory floor is 48 GB: “We’re starting with Macs that have 48 GB or more.” (darkbloom.dev). Below that you can register interest on the console but cannot earn; a 24 GB M4 Pro does not qualify.

Earnings depend on matched demand, not uptime. The calculator states its own limits — “Estimated earning, not guaranteed. While the system is bootstrapping, we are seeing significant variation in earning levels among providers using the same machine type. The default duty cycle is 5% to reflect this.” and “The estimate assumes bandwidth-limited, single-stream decoding, with duty cycle as the only adjustable input.” (darkbloom.dev). Circulating figures like the $146/month for Qwen 3.6 on a 32 GB M1 Mac projection that surfaced in early coverage are calculator outputs under assumed duty cycle, not observed payouts — Wavect’s calculator-output skepticism applies to all such figures. Community estimates in the $200–$500/month range carry the same caveat (Wayback fallback in case the live thread is gated). Two documented reality checks:

“A public provider issue reported a connected Mac receiving no inference jobs for more than a day (issue #264). That is one report, not a fleet-wide utilization measurement, but it illustrates the central economic risk: eligibility and uptime do not create customer demand.” — Kevin Riedl, Wavect

“One public issue documented extreme Metal memory pressure on a 256 GB M3 Ultra under sustained provider traffic (issue #550). It is still a good reason to test physical footprint, memory compression, termination and host recovery instead of monitoring only ordinary process RSS.” — Kevin Riedl, Wavect

Neither is fleet-wide proof of failure. Both are reasons to treat your own workstation as the thing at risk. Do not buy a Mac from an earnings calculator; start with hardware you already own and measure net revenue per available hour across at least two settlement periods.

Thermal controls are opt-in and experimental. The provider ships a root fan helper (sudo darkbloom fan enable) that the installer never calls automatically. Treat it as a last resort, not a default — and run sudo darkbloom fan uninstall to restore Auto before removing the provider.

Wavect’s go-live gates make a decent evaluation checklist: verify the exact deployed trust boundary; get subprocessors, regions, retention and deletion into a signed contract; fault-inject for provider churn and cold starts; pin alias resolution and quantization so model swaps can’t silently degrade quality; cap cost per accepted result including retries and minimum charges; and confirm the owner workstation stays usable and recovers safely.

Should you look at it?

If you want cheap OpenAI-compatible inference for non-sensitive workloads and can tolerate alpha-grade breakage, the base-URL swap costs almost nothing to try. If you hold regulated data, hop-by-hop encryption with a plaintext-transiting coordinator needs a security-team decision, not a marketing page. And if you own a 48 GB-plus Apple Silicon Mac that idles, running a provider is a reasonable experiment — provided your model assumes demand may not arrive and the 0% fee will not last.

Done means

You can state that Darkbloom is a network rather than a model, describe the coordinator/provider/console split, explain why “hop-by-hop” and not “end-to-end” is correct, name the 48 GB and macOS 14 gates, and cite the alpha disclaimer when someone proposes putting production traffic through it.

What this article does NOT cover

• Consumer API setup and provider install steps: see the companion Darkbloom setup guide
• Benchmarked throughput or latency figures — none independently published as of Aug 2026
• Long-term provider economics after the platform fee returns

Related guides

• Start here: local AI and agents
• Cost-aware model routing for agents
• Different ways of using LLMs for coding: eight patterns
• Why every agent needs a cost cap on day one

Sources

Primary:

• darkbloom.dev, tagline, architecture, pricing table, earnings calculator and disclaimers
• Layr-Labs/d-inference repo, repo stats, languages, alpha disclaimer
• docs/architecture/security/encryption.md, hop-by-hop model, NaCl Box, trust levels, routing gate
• docs/consumer/quickstart.md, base URL, auth, fallback pricing, 0% alpha fee, self-route, embeddings status
• docs/provider/installation.md, preflight, hash verification, doctor, enclave provisioning, version example
• Eigen Labs: Project Darkbloom, project framing and operating realities
• console.darkbloom.dev, account and provider enrollment surface
• Release history, v0.8.13 as of Aug 26 2026
• Technical paper

Secondary:

• Wavect review, Kevin Riedl, 25 Aug 2026, third-party assessment: hop-by-hop naming, earnings caveats, go-live gates, verdict
• Issue #264, connected Mac receiving no jobs for >24h
• Issue #550, Metal memory pressure on a 256 GB M3 Ultra
• Bankless, EigenLayer context
• Reddit r/AI_Agents, user earnings skepticism
• X post on the $146/month projection, calculator-output skepticism
• DevTalk forum thread, community discussion
• Hacker News thread, community discussion

Background:

• Eigen Labs, company background
• Eigen Labs video: Distributed AI Inference on Idle Macs
• unite.ai industry framing, decentralized inference category
• LinkedIn public-alpha launch post
• LinkedIn operator-economics post

Footnotes

1. Version discrepancy worth knowing: the official provider/installation.md shows darkbloom 0.6.5 in its example --version output, while GitHub releases show v0.8.13 as latest on Aug 26, 2026. This guide cites v0.8.13 as current state; the doc’s example output is stale. ↩