Your medical AI leaves the lab. Does your model IP leave with it?

What the threat reporting says

In its report on the evolution of adversarial AI, Google Threat Intelligence Group writes that adversaries increasingly target proprietary AI models, code, prompts and research across sectors including healthcare. It describes a Mandiant investigation into a compromise of a healthcare sector organisation in which the attacker stole corporate data and drug research, including AI research and a proprietary AI model, and then demanded a ransom.

That case was a breach of the organisation's own environment, not an attack on a model installed at a hospital. It still makes a plain point: trained models are now treated as assets worth stealing.

Where the vendor's model actually lives

Many hospitals will not export imaging data and will not accept a vendor cloud. The model is installed on premises, on a GPU appliance or VM beside PACS. Integrators and device OEMs may also hold installations. After the contract ends, the files may still be there.

In that setting, the vendor's model runs on hardware administered by someone else. Whoever can read the host's memory or storage can usually read the weights.

Three separate questions

Patient data protection is about keeping clinical data private and on site. General infrastructure security is about keeping attackers out of the hospital's systems. Model confidentiality is about whether the vendor's trained weights can be copied from the installation.

They overlap, but solving one does not solve the others. A well-run hospital network still hosts the model in plaintext if that is how the model runs.

What encrypted model deployment does

Dropnir keeps the weights encrypted during inference. The model runs on the hospital's own infrastructure and is not decrypted there, while patient data stays on premises. The vendor keeps the key that controls decrypted outputs.

It is one control among many. It does not prevent every breach, it does not replace hospital security, and it does not achieve regulatory compliance on its own. It is not a regulatory approval and does not change a device's classification. The FDA's premarket cybersecurity guidance sets expectations for device makers; encryption of weights may form part of a manufacturer's own security design, but compliance is the manufacturer's assessment.

Scope is specific too: per-study inference for supported computer vision, classification and time-series models, not LLMs and not line-speed video. The accuracy delta of encrypted inference is measured for your model in a pilot rather than promised in advance.

If your model is installed in hospitals, an architecture review looks at one model and one target and tells you what encrypted inference costs and what it protects.