New standard locks AI models to specific hardware

AI companies now have a way to prevent their models from running on unauthorized machines. A new open standard, developed by the confidential computing firm OPAQUE, allows model builders to lock their software to specific hardware environments. This means the code remains encrypted until the computer it runs on proves it meets strict security conditions set by the developer.

This solution addresses a growing tension in the industry. Businesses want to run powerful AI models on their own infrastructure for privacy and control, but developers fear losing ownership of their intellectual property. By using this standard, creators can ensure their models only unlock in approved environments, protecting their assets without relying on simple trust.

Protecting models from customers

Current security tools usually protect customers from seeing the model, but this new approach flips that dynamic. It protects the model from the customer. As Imran Siddique, Chief Platform Officer at OPAQUE, explained, builders need verifiable proof that their intellectual property is only accessible in environments that meet agreed-upon conditions. This standard provides that proof, removing the need for blind trust between parties.

The system works by keeping model weights encrypted until the receiving infrastructure passes a cryptographic check. The hardware must prove its identity and state to a key broker before the decryption key is released. If the hardware does not match the approved profile, the model remains inaccessible. This ensures that even if a customer has the files, they cannot run the model on unapproved systems.

How the verification process works

When a protected workload starts, it requests a single-use challenge from a central broker. The processor and graphics card provide attestation data, binding the challenge to the specific launch. The broker then verifies certificate chains, signatures, and the freshness of the data. Only if everything matches does the broker seal the decryption key to that specific workload. A mismatch results in no key, effectively blocking the model from running.

OPAQUE tested this exchange on high-end NVIDIA hardware and on separate AMD and Intel confidential servers hosted by major cloud providers. They reported that two independent builds of the software produced identical results across nearly six thousand files. This consistency suggests the standard works reliably across different hardware architectures and cloud environments, which is crucial for widespread adoption.

Limitations of the current demo

However, the public demonstration has significant limits. The quickstart version runs the logic in a single Python process using synthetic data and placeholder keys. It does not perform real-world hardware verification. While the conformance suite passes ninety-one checks, it tests the protocol logic against fake certificates and skips GPU cryptographic verification entirely. A passing test only confirms the code works as written, not that the hardware is secure.

A sharp limitation remains in the physical world. A valid signature cannot distinguish between an authorized key and one stolen from the hardware. Physical attacks on confidential computing chips are documented, and OPAQUE acknowledges this by pointing to existing research rather than claiming the problem is solved. Developers must still run separate tests on their actual deployment machines to confirm security, as reported by GN technics/hardware. This adds a layer of complexity for enterprises seeking to adopt the standard.