The Arrow information paradox (AIP) says there's no ideal way for a potential buyer to determine the value (to them) of some private information a seller is offering to sell them, without actually receiving the information, thus jumping the gun on the potential trade.
The paradox happens because a sale of information is:
Irreversible: the information can't be "returned" like a physical good, once the cat's out of the bag
Indivisible: there's no sense in which "half a secret" can be half as valuable as the whole secret
In other words, if you're considering buying a huge amount of wine but you don't know the quality, you can sample a random bottle of the wine, and if the connoisseur who works for you says it's good you buy the whole lot. But if the thing you're considering buying is One Big Important Secret, you couldn't do something like this (at least in the pre-LLM era).
Of course, the way this has been dealt with in practice is NDAs. And patents I guess. But these only go so far, since they depend on a government to enforce the NDAs, and there have been exceptions where people broke NDAs for arguably justified reasons, e.g. whistleblowers. So in some cases the seller would still prefer to enforce the privacy by technical rather than legal means.
Why, fundamentally, has the AIP held? It's because (until recently) there has been no evaluator able to both:
Understand the secret information and make qualitative judgements about its value, in the buyer's specific context
Credibly forget everything about the secret information (or alternatively just vanish, removing the need for "forgetting")
Human evaluators can understand and exercise judgement but can't forget; cryptography (zero-knowledge proofs, confidential computing, etc.) can forget but can't judge.
Now, of course, over a billion people use competent agents—who can incorporate arbitrary context and make reliable qualitative judgements—on a weekly basis. These agents are also ephemeral, so you can get privacy guarantees you would only be able to get from a human evaluator by killing them.[1]
This is already a published idea called NDAI, not something I came up with. I just thought it was an interesting change in the state of affairs that more readers should be aware of.
Also, I note that an ephemeral agent can actually compute and report back to you a much wider variety of things than "what's the value of this information to me?" For example:
"does their private plan honor their public commitment?"
"is this an infohazard?"
"who had this idea first?"
(For the last one, note that a cryptographic hash can prove you had a certain exact string at a certain time, but you can't tell whether two separate hashed ideas are actually the same idea with just hashes. An ephemeral evaluator who can compare the plaintext unlocks that.)
Related reading
Arrow, K. (1962). “Economic Welfare and the Allocation of Resources for Invention.” In The Rate and Direction of Inventive Activity, NBER / Princeton University Press.
Rahaman, N., Weiss, M., et al. (2024). “Language Models Can Reduce Asymmetry in Information Markets.” arXiv:2403.14443
Stephenson, M., Miller, A., Sun, X., Annem, B., Parikh, R. (2025). “NDAI Agreements.” arXiv:2502.07924
There's a technical detail here that for some levels of security what you actually want is an open-weights evaluator agent running in some kind of trusted environment, in order to close the gap of "whose computer is the agent running on?" There are also obvious concerns about the seller prompt-injecting the agent to ignore previous instructions and say their stuff is really valuable. So in a production-ready version of this you'd actually want to have a sophisticated setup where the buyer supplies their private context and instructions (which the seller doesn't get to see), the seller supplies the actual secret (which the buyer doesn't get to see), and everything runs in some kind of secure enclave so nobody sees all the private stuff together except the ephemeral agent.
The Arrow information paradox (AIP) says there's no ideal way for a potential buyer to determine the value (to them) of some private information a seller is offering to sell them, without actually receiving the information, thus jumping the gun on the potential trade.
The paradox happens because a sale of information is:
In other words, if you're considering buying a huge amount of wine but you don't know the quality, you can sample a random bottle of the wine, and if the connoisseur who works for you says it's good you buy the whole lot. But if the thing you're considering buying is One Big Important Secret, you couldn't do something like this (at least in the pre-LLM era).
Of course, the way this has been dealt with in practice is NDAs. And patents I guess. But these only go so far, since they depend on a government to enforce the NDAs, and there have been exceptions where people broke NDAs for arguably justified reasons, e.g. whistleblowers. So in some cases the seller would still prefer to enforce the privacy by technical rather than legal means.
Why, fundamentally, has the AIP held? It's because (until recently) there has been no evaluator able to both:
Human evaluators can understand and exercise judgement but can't forget; cryptography (zero-knowledge proofs, confidential computing, etc.) can forget but can't judge.
Now, of course, over a billion people use competent agents—who can incorporate arbitrary context and make reliable qualitative judgements—on a weekly basis. These agents are also ephemeral, so you can get privacy guarantees you would only be able to get from a human evaluator by killing them.[1]
This is already a published idea called NDAI, not something I came up with. I just thought it was an interesting change in the state of affairs that more readers should be aware of.
Also, I note that an ephemeral agent can actually compute and report back to you a much wider variety of things than "what's the value of this information to me?" For example:
(For the last one, note that a cryptographic hash can prove you had a certain exact string at a certain time, but you can't tell whether two separate hashed ideas are actually the same idea with just hashes. An ephemeral evaluator who can compare the plaintext unlocks that.)
Related reading
There's a technical detail here that for some levels of security what you actually want is an open-weights evaluator agent running in some kind of trusted environment, in order to close the gap of "whose computer is the agent running on?" There are also obvious concerns about the seller prompt-injecting the agent to ignore previous instructions and say their stuff is really valuable. So in a production-ready version of this you'd actually want to have a sophisticated setup where the buyer supplies their private context and instructions (which the seller doesn't get to see), the seller supplies the actual secret (which the buyer doesn't get to see), and everything runs in some kind of secure enclave so nobody sees all the private stuff together except the ephemeral agent.