UAP: An Open Ad Protocol That Can't Touch LLM Answers

ChatGPT's sponsored links, live since February 2026, run on a closed system: OpenAI's Advertiser API sells one surface and nobody else can buy or sell into it. Every other inference provider has no monetization path, and the obvious workaround — piping the conversation to an ad server and splicing the winning creative into the prompt — fails twice: it leaks private context and hands an advertiser write access to the model's reasoning for the price of a CPM.

UAP (Universal Ad Protocol) is an open, Apache-2.0 specification built so neither failure is expressible. It rests on three invariants: context confinement (conversation text never leaves the serving node), answer integrity (ad presence or identity can never alter the answer), and earned payment (payment follows verified measurement, not the node's own claim). Three mechanisms back these guarantees: the node commits to an answer digest before the auction runs, a deterministic composer lets anyone verify byte-exact output, and a held-out slice of ad-free traffic exposes any systematic decode influence.

The spec supports two decisioning models: hosted, where the exchange runs the auction against a bounded, k-anonymity-limited signal, and local, where signed campaign bundles sync to the device and the auction runs on-device against full private context — architecturally similar to Chrome's Protected Audience API. Integration for OpenAI-compatible servers (vLLM, SGLang, Ollama, llama.cpp, TGI, LM Studio) is a single middleware wrapper, and any failure in the ad path falls back to the unmodified completion.

The project is still a draft, requiring two independent interoperating implementations to graduate; reference implementations in Python and JavaScript, written separately from the spec, now produce byte-identical results under conformance testing.