RFC: Threat Model

[feynon]

We need to build a foundation that serves a wide range of threat models, from fully air-gapped local setups to hybrid server-assisted deployments, without compromising user accessibility or experience. Concretely, this requires the underlying technology to support defense in depth through clearly defined layers. Example setups are outlined below.

Each successive layer reduces the strength of the threat defense.

1. L1: Local models and local data, with device to device sync and no relays, using local networking technologies such as Bluetooth, Wi-Fi Direct, and Thunderbolt.
2. L2: Local models and local data, with server-side relay based P2P sync and IP obfuscation.
3. L3: Hybrid local and cloud models, with server side encrypted data with IP obfuscation.
4. L4: Hybrid local and cloud models, with server side encrypted data without IP obfuscation.

These levels should be delivered as an accessible, layered product built on a single unified technical foundation, allowing users to dial knobs in Tiles easily, without technical knowhow, according to their specific threat model.

Across all layers, we must ensure that users have a credible exit, with portable identity and data. For L1 and L2, we will support quick backups of the portable Tiles executable, along with identity and data, allowing them to be easily copied to external flash drives.

Resources

• https://usable.tools/personas/
• https://blog.mozilla.ai/introducing-any-llm-managed-platform-a-secure-cloud-vault-and-usage-tracking-service-for-all-your-llm-providers/