pai

🔒 PAI

---

Quick Start

Hosted downloads are temporarily offline while the site moves hosts (pai.direct and get.pai.direct do not currently resolve). Until rehosting completes, building from source with Dockerfile.build is the primary path:

git clone https://github.com/nirholas/pai.git && cd pai
docker build -f Dockerfile.build -t pai-builder .
docker run --privileged --rm -v "$PWD/output:/output" pai-builder
# ISO appears at output/live-image-amd64.hybrid.iso

Then flash it with the auto-flasher: sudo bash scripts/flash.sh --local-iso output/live-image-amd64.hybrid.iso. The download commands below are kept for reference and will work again once hosting is restored.

# One-command download and flash (Linux/macOS):
curl -fsSL https://raw.githubusercontent.com/nirholas/pai/main/scripts/flash.sh | sudo bash

Or manually:

# Download the ISO
curl -LO https://github.com/nirholas/pai/releases/latest/download/pai.iso

# Flash to USB (replace /dev/sdX with your USB device)
sudo dd if=pai.iso of=/dev/sdX bs=4M status=progress && sync

Then reboot, select USB from your boot menu (F12/F2/DEL), and you're in.

Windows? Download the ISO + Rufus, select your USB, click Start.

---

What is PAI?

PAI is a bootable live USB operating system built on Debian 12 that gives you a private, portable AI workstation. Plug it into any x86_64 PC, boot from USB, and you have:

• An offline AI assistant running locally via Ollama — no cloud, no API keys, no data leaving your machine
• A privacy-hardened environment with MAC spoofing, firewall, and Tor integration
• A complete desktop with Sway (Wayland), Firefox ESR, and essential tools
• Zero installation — nothing touches the host machine's hard drive

Like Tails is to privacy-focused browsing, PAI is to private AI. It combines the amnesic, leave-no-trace philosophy of Tails with the power of local large language models.

A computer you can carry anywhere

Take a second to sit with what this is: a full desktop operating system that fits on a USB stick. Not a recovery disk. Not a rescue tool. Not a stripped-down appliance. A real, working computer — desktop, browser, terminal, files, local AI — on a piece of plastic you can slip into a pocket or a wallet.

• Forgot your laptop? Plug PAI into any x86_64 machine — a library PC, a hotel business-center terminal, a friend's desktop, an airport kiosk — and you're home. Same desktop, same AI, same environment. Pull the stick when you leave; the host remembers nothing.
• Travel lighter than light. A 16 GB USB drive weighs a few grams and holds the entire OS, the AI, and every tool you need to get work done.
• Your environment goes where you go. Boot, work, shut down, take the drive with you. No syncing, no accounts, no cloud.

This is the headline feature, and it bears repeating: PAI is a legit computer on your USB drive. Lean enough to fit, powerful enough to run local LLMs, portable enough to forget you're carrying it.

The Problem

Every major AI service — ChatGPT, Claude, Gemini — requires sending your prompts, documents, and conversations to remote servers operated by third parties. You have no control over:

• Who reads your data — your prompts are processed on hardware you don't own
• How long it's stored — retention policies change, breaches happen
• Who it's shared with — training data pipelines, government requests, partnerships
• Where it goes — cross-border data transfers, jurisdictional exposure

Even "private" or "enterprise" tiers ultimately require trust in a corporation's infrastructure and policies.

The Solution

PAI eliminates the entire trust chain:

	Cloud AI	PAI
Where your prompts go	Remote servers	Nowhere — stays on your hardware
Who can read them	The provider, their employees, subprocessors	Only you
Network required	Always	Never (fully offline)
Traces left behind	Server logs, training data, analytics	None — RAM is wiped on shutdown
Cost	$20–200/month	Free forever
Data jurisdiction	Wherever their servers are	Wherever you are

Your conversations exist only in RAM while PAI is running. Shut down, and they're gone. No logs, no history, no server-side copies. The machine doesn't even know PAI was there.

---

How It Works

PAI boots entirely into RAM from the USB drive. The host machine's hard drive is never mounted, read, or written to. When you shut down, all memory is cleared. The host operating system resumes as if nothing happened.

---

Architecture

The system architecture, threat model, and significant design choices are documented under docs/.

Boot Sequence

USB plugged in → BIOS/UEFI selects USB → GRUB/ISOLINUX loads kernel
    → Debian live-boot mounts squashfs from USB
    → systemd starts services:
        1. MAC address randomization (pai-mac-spoof.service)
        2. UFW firewall (deny incoming, allow outgoing, localhost only)
        3. Ollama LLM server (localhost:11434)
        4. Chat UI web server (localhost:8080)
        5. NetworkManager (Wi-Fi/Ethernet)
    → Auto-login on tty1 → Sway (Wayland) launches
    → Firefox ESR opens to localhost:8080 (Chat UI)

Build System

PAI is built using Debian live-build, the same toolchain used by Debian, Tails, and Kali Linux. The build process:

1. Bootstrap — debootstraps a minimal Debian 12 root filesystem
2. Chroot — installs packages and runs hook scripts inside the chroot:
   • 0100 — Installs Ollama (with GPU lib cleanup for CPU-only operation)
   • 0200 — Deploys Chat UI + systemd services
   • 0300 — Configures Sway desktop environment
   • 0350 — Sets up passwordless auto-login
   • 0400 — Plymouth boot splash
   • 0450 — MAC address spoofing service
   • 0500 — UFW firewall hardening
   • 0550 — Tor transparent proxy (opt-in)
   • 0600 — Electrum Bitcoin wallet
   • 0610 — Monero wallet
   • 0650 — AI tools suite
   • 0710 — Development languages
   • 0730 — Git tools
   • 0740 — Terminal enhancements
   • 0750 — Media applications
   • 0800 — Network privacy tools
   • 0830 — Encryption (GnuPG, LUKS)
   • 0840 — System utilities
3. Cleanup — strips GPU libs (~2GB), docs, man pages, non-English locales, caches
4. Binary — compresses the filesystem into squashfs, generates hybrid ISO

ISO Variants

Build	Size	Packages	Disk Required
Minimal	~912 MB	~20 packages (Sway, Firefox, Ollama, networking)	32 GB
Full	~4–6 GB	100+ packages (all hooks enabled)	64 GB+

The minimal build is the current default. It boots in under 30 seconds and runs Ollama + Chat UI with ~1.5 GB of free RAM on a 4 GB machine.

---

Privacy & Security Model

PAI implements defense-in-depth across multiple layers. The goal is not just privacy but operational security — making it difficult for an adversary to determine what you did, when, or where.

Layer 1: Amnesic by Design

Like Tails, PAI is amnesic. It runs entirely from RAM and the read-only squashfs on the USB drive.

• No hard disk access — the host machine's drives are never mounted
• RAM-only operation — all state exists only in volatile memory
• Clean shutdown — powering off clears all RAM, destroying:
  • Chat history and AI conversations
  • Downloaded files and browser history
  • Wi-Fi credentials and network logs
  • Every keystroke and mouse movement

There is no forensic residue. The machine returns to its pre-boot state.

Future: Optional encrypted persistent storage (LUKS) on the USB drive for saving models and configuration across sessions.

Layer 2: Network Anonymity

Feature	Implementation	Default State
MAC spoofing	macchanger via pai-mac-spoof.service	✅ Active on every boot
Firewall	ufw — deny incoming, allow outgoing, localhost only	✅ Active on every boot
Tor routing	Transparent proxy via tor + iptables	⬡ Opt-in (sudo pai-privacy on)
DNS privacy	Tor DNS resolution when privacy mode is active	⬡ Opt-in
Wi-Fi randomization	NetworkManager cloned-mac-address=random	✅ Active on every boot

MAC spoofing randomizes your hardware address on every boot. The access point, ISP, and any local network observer sees a different device each time. Combined with Tor, your traffic is encrypted through three relays — no single relay knows both your identity and your destination.

Firewall denies all incoming connections by default. Ollama and the Chat UI listen only on localhost — they are not accessible from the network, even on the local subnet.

Layer 3: Local-Only AI

The AI runs entirely on-device using Ollama. No tokens, no API keys, no cloud dependencies.

• Model execution: CPU-only (GPU libs stripped to save space)
• Model storage: Pulled into RAM or persistent storage on first use
• Network: Ollama never phones home. It binds to 127.0.0.1:11434
• Supported models: Any GGUF-compatible model — Llama 3.1, Mistral, Phi-3, Gemma, Qwen, DeepSeek, etc.
• Chat UI: Lightweight HTML interface served by Python's http.server on localhost:8080

The trade-off is speed — CPU inference on a laptop is 5–20 tokens/sec depending on the model and hardware. A 7B parameter model runs comfortably on 8 GB RAM. For faster inference, use a machine with more cores or AVX-512 support.

Layer 4: Hardened Defaults