Hacker News Reader

Comment by edot | Hacker News Reader

So Fireworks is ZDR by default, yet Notion configured (asked) Fireworks to retain data? Otherwise, how is there anything to leak?

On the main fireworks breach page, they also say some customer weights of models and datasets to train them were leaked.

View on HN

Fireworks "datasets" are used for batch inference as well as training models. Notion mentioned that the leak was due to some feature they have to classify previous ai conversations. They probably uploaded these conversations as a 'dataset' to fireworks in order to take advantage of their large batch processing discount.

https://docs.fireworks.ai/guides/batch-inference

That is my understanding also.

I like Fireworks.ai and use their APIs when I use Hermes Agent in an Apple Container. I have tried serious use of Hermes with local models, but for good results I like deepseek-4.1-flash-1027 or stronger, and I have trusted their ZDR, and will continue to trust their ZDR. (I buy tokens directly from Deepseek for my open source coding efforts where I don’t care about ZDR.)

Off topic but: strong local models work great with pi-dev and my own purpose built harnesses, but it takes a relatively strong model to make Hermes Agent shine.

Can you really trust an AI company to be actually ZDR though

Not unless you can verify it through secure hardware attestation like with Apple’s private cloud compute system

you can stop after the word "Not"

Even with that, you can't really prove or provide evidence they aren't silently slinging the data elsewhere during transport anyway. Unless you're doing Homomorphic encryption, it all seems to be for show.

There's also the nvidia enclave stuff. If you trust their hardware, then you can also trust its cryptographic proof that the data was not seen by the inference provider.

Ignoring whether or not there could be backdoors, security holes in the Trusted Execution Environment stuff are still being found on a regular cadence.

I'd guess it's good enough to avoid bulk surveillance (and therefore extraction of training data, which I guess is the attack that Notion was running when they screwed up and leaked the data), but that's about it.

Apple's stuff is a similar story. (And so are VM enclaves, which have been around longer.)

Reply on news.ycombinator.com