A model that runs without being revealed.
Your model runs on customer sites, edge devices, partner clouds and delivered systems, and it is never decrypted there. There is nothing on the host to extract.
Inference runs directly on the encrypted artefact. You hold the key.
- 01
Model owner
Trained weights, ONNX or TensorRT
- 02
Encrypted artefact
Ciphertext only
- 03
Deployment host
Gateway container, x86 or ARM
- 04
Owner key
Decrypted outputs stay with you
Read the full mechanism
Your trained model is converted into an encrypted artefact. A gateway runs inference directly on that artefact. The weights never exist in plaintext on the host, not on disk, not in memory. You, the model owner, hold the key.
The technique behind it
Technically, this is fully homomorphic encryption (FHE): arithmetic on encrypted values that produces an encrypted result. It is slower than plaintext inference, which is why scope and cadence matter.
Deployment models
- PackageDocker container
- Architecturex86 or ARM
- PlacesOn-prem, edge, partner cloud
- EnclaveNot required
Supported model classes
- Small to medium CNNs
- Classifiers
- Tree models
- Time-series models
Integration
Model in: ONNX or TensorRT. Out: an encrypted artefact plus the gateway that runs it. Where it sits in your existing build and delivery pipeline is mapped in the architecture review.
Why not a dongle, why not an enclave
Dongles and licensing
Control who runs it. Decrypt it to run.
Read the detail
Licensing tools control who may run a model. To run it, they decrypt the weights into memory, where an administrator or a memory dump can reach them. Keep them for entitlement. They do not cover confidentiality during inference.
Hardware enclaves
Fast, if nobody can tamper with the box.
Read the detail
Enclaves protect the model from the host OS, provided nobody can tamper with the box. They are faster and remain a good fit in your own data centre, for latency-critical work and for large models.
Encrypted inference
Weights stay encrypted while the model runs.
Read the detail
The weights stay encrypted during inference, so protection does not depend on the host's chip vendor, hypervisor, OS or physical security. The trade-off is latency, which we measure per model.
Questions engineers ask
How fast is it?
Slower than plaintext inference, by an amount that depends on the model, input size and hardware. It suits per-study, per-batch and per-event decisions, not line-speed video. We measure your model on your target and state the conditions with every figure.
What happens to accuracy?
Models are quantised for encrypted inference, which can cost some accuracy. We measure and report the accuracy delta per model rather than quoting a general figure.
How does this compare with a TEE?
A TEE decrypts the model inside a protected area of a specific chip and assumes physical access is controlled. Encrypted inference never decrypts the weights on the host and needs no enclave. TEEs are faster and remain adequate where you control the hardware.
We already use a dongle. Do we replace it?
No. Dongles and licence servers handle entitlement. Wodan handles confidentiality during inference. They work side by side.
Do you support LLMs?
No. Today the scope is computer vision, classification and time-series models. LLMs are not supported.
Does encryption stop someone cloning the model by querying it?
Not on its own. Someone with unlimited plaintext outputs can train a copy of a narrow model. You keep the decryption key, so decrypted outputs, query volume and output granularity stay under your control. The threat model sets this out.
What hardware do we need?
The gateway is a Docker container on x86 or ARM. No enclave is required. Fit for your specific device and model is assessed in the architecture review.
Bring one model and one target.
We tell you what it costs in latency and what it buys in protection.