This case study was first published as part of our report, "Alternatives to Concentrated AI." It serves as part of a series of blog posts that highlights builders' projects in their own words. OpenMined's argument: that open privacy-preserving infrastructure lets AI learn from the world’s private data on terms each data steward sets, and lets external researchers and regulators hold concentrated systems accountable without becoming concentrators themselves.

Case study: OpenMined

The argument: that open privacy-preserving infrastructure lets AI learn from the world’s private data on terms each data steward sets, and lets external researchers and regulators hold concentrated systems accountable without becoming concentrators themselves.

The background: The world has digitized more than 180 zettabytes of information, yet today’s most powerful AI models are trained on a fraction of it. The bottleneck is access.

Almost all data, including most American medical, financial, and scientific records, sits behind privacy, legal, and competitive firewalls that no current AI system can cross safely. Institutions are left with an impossible choice: either withhold their data to protect it, or hand over copies and lose control over how it is used. Many institutions cannot accept the risk of misuse, so they must withhold their data.

Decentralized AI offers a way out of this binary. An AI system can be defined as “decentralized” when two conditions, which depend on one another, hold at once. First, computation moves instead of data. The AI model travels to where the data already sits, runs there, and returns only answers or insights. This mitigates the copy problem mentioned above. Second, the data steward’s use rules are respected by design. The steward decides who may use the data, for what purpose, and at what price, and no intermediary can overrule those decisions. This mitigates the control problem mentioned above. Rules attached as metadata to a copy of a dataset become promises the recipient may or may not keep, while rules enforced where the data lives are checked before each computation runs, and access can be withdrawn at any time. A closed platform leveraging federated learning could meet the first condition by sending its model to visit someone else’s data but fail the second by controlling which computations run, on what schedule, and under what rules, leaving the data steward to either accept the platform's rules or leave. A system can move computation to the data and still concentrate all the power over it. Only both together separate an open network from a walled garden that happens to visit your data.

Who builds the infrastructure to support decentralized AI and how they design the system will determine for decades whether the world’s private data is accessible only through a handful of walled gardens or through open networks that institutions and individuals can use, participate in, and govern.

OpenMined’s role: OpenMined’s nonprofit mission is to build the open-source software infrastructure for decentralized AI. Our software sits at the intersection of deep learning, cryptography, and distributed systems, and aims to let institutions and individuals contribute to and learn from AI without their raw data ever leaving the machines they control. Computation travels to the data, and only results are returned, so that each data steward retains control of over what they hold, sets the terms and price under which their information can be queried, and can be attributed, credited, or paid whenever their data measurably shapes a model’s output. In this paradigm, the value a dataset creates flows back to the institution and people who hold the data rather than being pooled in a single intermediary.

How it works: Institutions running Syft host their own data and open it only to approved remote computation. Instead of sending copies anywhere, they let a model come to the data and run against it in place at inference time. Because the computation travels rather than the data, a single model can reach many institutions at once, through techniques like federated retrieval-augmented generation, while each institution keeps its data where it is and sets its own terms of access. OpenMined calls this network-sourced AI (NSAI), in which a model queries a network of data that never moves, and each source sets its own terms of access.

The mechanism is the same whether a node is a hospital, a bank, or a single person, so it is easiest to see at the smallest scale, where one individual plays the role an institution otherwise would. We published a working walkthrough that builds a private, peer-to-peer AI that answers your friends’ messages using local data and privacy controls. Each person runs a node on their own machine. A local folder holds everything the assistant is allowed to know, and sub-folders decide who sees what: a public folder anyone can draw on, and per-sender folders that reveal more only to specific, trusted people. When someone sends a message, the assistant responds using only the folders that person is permitted to see; The rest of the data is never shown to the model.

That last detail is the control rule. The system does not rely on the AI to keep secrets; it simply never hands it secrets to keep, so even a direct attempt to extract private context returns only what the sender was already allowed to access. Because the node communicates in ordinary language, the same code works over WhatsApp, Signal, SMS, or email interchangeably, so no single platform holds power over the user. It is a toy in scale but not in architecture as its governance sits outside the model, data stays with its steward, and control is exercised by choosing what the model may see, and for whom.

How it scales: The same shape scales to institutions. Picture a reader who asks an AI to summarize the news of the day. Instead of drawing on data scraped and copied into a central model, the query fans out across a network of institutions, including a national newspaper, a local journalist, a specialist publisher, each of which independently sets its own terms and price and can accept or decline the request. The model composes an answer from the sources that agreed, and each contributor is attributed for what their data added. Nothing is copied into a central store, and the data providers keep both their content and their leverage.

OpenMined is now running several versions of this picture with real partners. In Indonesia, OpenMined helped a consortium of local news publishers convened by the Indonesian Cyber Media Association (AMSI) supply high-quality, licensed content to local models at inference time, producing AI that reflects local context.

Running inference across many independently governed nodes is slower and more coordination-heavy than querying a single centralized model, and the tooling for pricing, attribution, and quality-of-source across a live network is still being built. However, the demonstration shows that the shape can work.

The peer-to-peer AI described above ships as the opening lecture of a free “Decentralized AI from Scratch” online lecture series, and readers are invited to fork it, extend it, and publish their own, because the goal is not one organization’s product but a movement of many builders converging on shared, interoperable protocols. That movement is already forming at an institutional scale through OpenMined’s partnership work, where consortia of contributors are joining shared networks in which each participant contributes data, keeps control of it, and can be attributed, credited, or even remunerated when their data shapes a model’s output. The peer-to-peer AI and the consortia OpenMined are working with are the same idea at two scales: one person governing a folder, and many institutions governing a network.

The same architecture works in reverse. The infrastructure that lets a model reach data it cannot hold also lets an auditor reach a model it cannot hold because the computation travels and only results return. An external researcher or regulator can run approved evaluations against a system without taking custody of its weights, its training data, or the private benchmark used to test it. OpenMined piloted this with Anthropic and the UK AI Security Institute, running third-party evaluations inside a secure enclave, and NIST's Center for AI Standards and Innovation has since signed a cooperative research and development agreement with OpenMined to enable secure AI evaluations. Our most recent test with this use of the infrastructure completed in August 2026 culminating in the first double-blind evaluation of a frontier model, in which the model developer, the benchmark owner, and the infrastructure provider were three distinct parties, none able to see the others' confidential inputs.

Why it matters for US policymakers: Computing began with centralized mainframes that a few institutions owned and everyone else rented time on, then moved to the open, interoperable network of networks, where open protocols like TCP/IP kept any single company from owning it. The United States stewarded those protocols through public funding from ARPA and NSF, establishing them before commercial network effects could take hold, and gaining decades of economic and strategic advantage as a result. AI is now following the same arc toward centralization, with proprietary stacks drawing unprecedented capital to build the largest moat around the world’s private data. The decentralized AI stack has a fraction of the funding, engineering headcount, and enterprise adoption of the closed alternatives. OpenMined’s view is that the most consequential move for US policymakers is to fund and steward open public infrastructure for the decentralized AI stack, and carry the mature protocols into standards, exactly as the country once did for the open internet.