Over the past week, Chengdu's "AI+" action plan has dominated headlines across Chinese tech media. The target is audacious: 260 billion RMB in core industry scale by 2027, and over 70% penetration of "next-gen smart terminals and agents."
Numbers like these send a clear signal to investors: buy local IT services, bet on government procurement. But as someone who has spent years dissecting zero-knowledge circuits and auditing wallet infrastructure, I see a fundamental leak in this pipeline. The entire plan is built on a premise that AI systems can be trusted. They cannot. Not without cryptographic backbone.
Let me be precise: the policy mentions zero about AI safety, algorithm bias, or data privacy. In a world where EU AI Act fines reach 7% of global revenue, and China's own generative AI regulations require content moderation and model registration, Chengdu's silence on verification is not a gap—it's a vulnerability.
Context: The Mechanic of Scale
Chengdu wants to turn its industrial base—electronics manufacturing, automotive (FAW, Geely), fintech (Bank of Chengdu), and digital entertainment—into an AI showcase. The mechanics are straightforward: fund 100 innovation products and 100 demonstration scenarios, with 20 flagship scenes per year. The city boasts the National Supercomputing Center (100 PFLOPS) and the Tianfu Intelligent Computing Center (targeting 1000 PFLOPS by 2025).
But here's the code that doesn't compile: how do you verify that an AI model running on a terminal or agent is actually the one you deployed? The plan assumes an AI model's output is trustworthy because it came from a sanctioned provider. That assumption breaks under adversarial conditions—malicious updates, data poisoning, or even a simple firmware bug.
Based on my 2026 work building a ZK-circuit for verifiable inference (yes, I wrote a prototype in Rust over three months), I can tell you that without cryptographic verification, any AI system operating at scale is a vector for manipulation. The plan's 70% penetration target for "next-gen smart terminals" implies billions of devices running AI inference—think smart doorbells, industrial sensors, and autonomous warehouse robots. Each one is a potential oracle attack surface if the model's integrity isn't proven.
Core: The ZK Circuit Nobody Ordered
Let's look at the underlying technology stack. The policy doesn't specify a training framework (Megatron, DeepSpeed), a model architecture (MoE, SSM), or a chip strategy. That's typical for a local government strategy—they focus on output, not input. But the missing piece is verifiability.
In my 2025 project integrating zero-knowledge compliance proofs into a DeFi lending protocol, I learned that regulators don't just want data—they want proofs. The same applies here. If a terminal's AI system makes a decision (e.g., rejecting a loan application or triggering a safety override), who proves that the decision came from the correct model with the correct weights and inputs?
A solution I've been advocating for years: ZK-rollup-like verification for AI inference. The concept is straightforward—an AI model generates a proof that its output is the result of executing the exact model with the exact inputs, without revealing the model or the data. This is the intersection of composable privacy (my advocacy) and practical implementation (my shift during the 2022 bear market when I built a Groth16 system from scratch).
Chengdu's plan could adopt this, but it doesn't. Instead, it doubles down on faith-based penetration rates. Math doesn’t negotiate. If the plan relies on traditional cloud-based trust, every smart terminal becomes a potential attack vector—not from external hackers, but from the inability to verify what the model actually did.
Contrarian: The Real Risk Is Not AI Hype—It's AI Opaqueness
The common criticism of Chengdu's plan is that the 260 billion RMB target is inflated, or that local AI companies lack competitiveness. Those are valid concerns, but they miss the deeper flaw. The greatest risk is that nobody will trust the AI outputs, especially in regulated industries like finance and healthcare, where the plan expects early adoption.
Consider: Bank of Chengdu deploys an AI agent to approve small loans. The agent's model is hosted on a local server, updated quarterly. A bug in the update causes the model to approve loans to accounts linked to fraud rings. Who is liable? The bank? The AI vendor? The government that pushed the penetration target? Without a cryptographic audit trail, liability is a legal fog.
In my 2021 post-mortem of the LUNA-UST collapse, I traced the unwind to a single integer overflow in the oracle's withdraw logic. Code is law, but bugs are reality. The same applies here. If the AI's verification mechanism is nonexistent, the law can't enforce accountability.
Moreover, the policy's omission of AI ethics and safety is not an oversight—it's a deliberate choice by a growth-minded administration. They assume national regulations will cover it. But national frameworks like the Interim Measures for Generative AI are about content safety, not model verification. The gap between what the state requires and what the city builds is where disasters happen.
Takeaway: The Next Era Belongs to Verifiable Systems
Chengdu's plan will likely succeed in its narrow goal: pump local IT spending and boost listed stocks like Jiafa Education and Chuangyi Information. But for the long-term health of the AI ecosystem, the city needs to integrate cryptographic verification into every smart terminal it deploys. That means investing in ZK-proof hardware acceleration, on-chain model registries, and standardized AI audit protocols.
Based on my experience auditing institutional custodians in 2024 (where I found critical gaps in MPC key-shares distribution), I can confidently say that the market will eventually price in the cost of trust. Investors will start asking: "How do we know this AI did what it promised?" The cities and companies that have an answer will survive. Chengdu, for now, is silent.
Privacy is a feature, not a bug. And verifiability is the only feature that makes AI scalable in a permissionless world. Chengdu's plan is a powerful engine, but without a cryptographic steering wheel, it's driving blind.